{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/7795","repository_url":"https://api.github.com/repos/rapid7/metasploit-framework","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/7795/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/7795/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/7795/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/7795","id":199339088,"number":7795,"title":"Hardware Bridge API.  Initial bridge API that supports the HW rest pr…","user":{"login":"zombieCraig","id":569845,"avatar_url":"https://avatars.githubusercontent.com/u/569845?v=3","gravatar_id":"","url":"https://api.github.com/users/zombieCraig","html_url":"https://github.com/zombieCraig","followers_url":"https://api.github.com/users/zombieCraig/followers","following_url":"https://api.github.com/users/zombieCraig/following{/other_user}","gists_url":"https://api.github.com/users/zombieCraig/gists{/gist_id}","starred_url":"https://api.github.com/users/zombieCraig/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zombieCraig/subscriptions","organizations_url":"https://api.github.com/users/zombieCraig/orgs","repos_url":"https://api.github.com/users/zombieCraig/repos","events_url":"https://api.github.com/users/zombieCraig/events{/privacy}","received_events_url":"https://api.github.com/users/zombieCraig/received_events","type":"User","site_admin":false},"labels":[{"id":103436215,"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/docs","name":"docs","color":"941E94","default":false},{"id":125500911,"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/feature","name":"feature","color":"bfe5bf","default":false},{"id":103436071,"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/library","name":"library","color":"fad8c7","default":false},{"id":103436014,"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/module","name":"module","color":"eb6420","default":false}],"state":"open","locked":false,"assignee":{"login":"pbarry-r7","id":19912177,"avatar_url":"https://avatars.githubusercontent.com/u/19912177?v=3","gravatar_id":"","url":"https://api.github.com/users/pbarry-r7","html_url":"https://github.com/pbarry-r7","followers_url":"https://api.github.com/users/pbarry-r7/followers","following_url":"https://api.github.com/users/pbarry-r7/following{/other_user}","gists_url":"https://api.github.com/users/pbarry-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/pbarry-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pbarry-r7/subscriptions","organizations_url":"https://api.github.com/users/pbarry-r7/orgs","repos_url":"https://api.github.com/users/pbarry-r7/repos","events_url":"https://api.github.com/users/pbarry-r7/events{/privacy}","received_events_url":"https://api.github.com/users/pbarry-r7/received_events","type":"User","site_admin":false},"assignees":[{"login":"pbarry-r7","id":19912177,"avatar_url":"https://avatars.githubusercontent.com/u/19912177?v=3","gravatar_id":"","url":"https://api.github.com/users/pbarry-r7","html_url":"https://github.com/pbarry-r7","followers_url":"https://api.github.com/users/pbarry-r7/followers","following_url":"https://api.github.com/users/pbarry-r7/following{/other_user}","gists_url":"https://api.github.com/users/pbarry-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/pbarry-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pbarry-r7/subscriptions","organizations_url":"https://api.github.com/users/pbarry-r7/orgs","repos_url":"https://api.github.com/users/pbarry-r7/repos","events_url":"https://api.github.com/users/pbarry-r7/events{/privacy}","received_events_url":"https://api.github.com/users/pbarry-r7/received_events","type":"User","site_admin":false}],"milestone":null,"comments":15,"created_at":"2017-01-07T03:53:48Z","updated_at":"2017-01-26T01:26:34Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/7795","html_url":"https://github.com/rapid7/metasploit-framework/pull/7795","diff_url":"https://github.com/rapid7/metasploit-framework/pull/7795.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/7795.patch"},"body":"Provides a method to integrate hardware devices into metasploit.  A REST\r\nAPI is available to hardware devices to either directly support from their device\r\nor via a relay on a computer the device is attached to.  A current draft of the API\r\ndocumentation is here: http://opengarages.org/hwbridge/\r\n\r\nThis patch provides a sample auxiliary/server/local_hwbridge that can be launched\r\nfrom within metasploit.  This sample bridge will look for attached SocketCAN devices\r\nand work as an automotive hardware extension.\r\n\r\nTo connect to a supported hardware device/relay you use: auxiliary/client/hardware/connect\r\nOn successful connection a hwbridge session is created.  These sessions work a lot\r\nlike a meterpreter session.  If the hardware announces a supported specialty (Automotive)\r\nthen extensions are automatically loaded into the hwbridge session providing standard\r\ninteractive and API controls.  Hardware devices can also specify custom commands that\r\nare visible via the hwbridge session as well.\r\n\r\nSome sample automotive post modules are include in post/hardware/automotive\r\nthat utilizes the automotive diagnostic framework, UDS.\r\n\r\nDocumentation for modules exist in the documentation folder and through yard documentation.\r\n\r\nAdditionally, this PR adds a tool which provides a HWBridge serial relay for ELM327 and ST1100 MCUs.  These are traditionally very affordable and common vehicle dongles.  These dongles typically use either Bluetooth or direct serial to communicate to a phone app or other tool.  This relay enables the use of the HWBridge using these cheap devices.\r\n\r\nExample device: http://www.ebay.com/itm/like/221821719820\r\n\r\n## Verification\r\n\r\n### HWBridge\r\n\r\nIt is difficult to test without connected hardware, however on Linux you can emulate hardware.\r\nWe will first setup a virtual CAN device called vcan0 then start metasploit.\r\n\r\n- [x] sudo modprobe vcan\r\n- [x] sudo ip link add dev vcan0 type vcan\r\n- [x] sudo ip link set up vcan0\r\n- [x] Start `msfconsole`\r\n- [x] `use auxiliary/server/local_hwbridge`\r\n- [x] `set URIPATH /`\r\n- [x] `run`\r\n- [x] **Verify** The relay server reported running\r\n- [x] `use auxiliary/client/hwbridge/connect`\r\n- [x] `run`\r\n- [x] **Verify** you see \"HWBridge session established\"\r\n- [x] **Verify** you see a NOTICE message warning you are leaving the matrix\r\n- [x] `sessions`\r\n- [x] **Verify** you see a hwbridge session of type Automotive listed\r\n- [x] `sess 1`\r\n- [x] `help`\r\n- [x] **Verify** you see a list of HWBridge commands including automotive and custom methods\r\n- [x] `supported_buses`\r\n- [x] **Verify** you see vcan0 listed as a supported bus\r\n- [x] `run post/hardware/automotive/malibu_overheat CANBUS=vcan0`\r\n- [x] **Verify** you see \"Request to send CAN Packets...\" sent repeatedly\r\n- [x] **Optional Verify** in another terminal run `candump vcan0` (part of the can-utils package available one some Linux flavors) then re-run the post module and verify CAN packets are indeed being created\r\n\r\n### ELM\r\n\r\nYou will need an ELM327 or ELM327 compatible (ST1100) device attached via serial.  This could be bluetooth's serial interface.  The device should be plugged into your car if you want to run the final tests of pulling the vehicle info.\r\n\r\n- [x] cd tools/hardware\r\n- [x] `ruby ./elm327_relay.rb -b 115200 -s /dev/ttyUSB0`  -b is Baud -s is Serial\r\n- [x] **Verify** you see: Connected.  Relay is up and running...\r\nIn another terminal window\r\n- [x] ./msfconsole\r\n- [x] `use auxiliary/client/hwbridge/connect`\r\n- [x] `run`\r\n- [x] **Verify** You connect and get NOTICE about leaving the matrix\r\n- [ ] `sess 1`\r\n- [x] `supported_buses`\r\n- [x] **Verify** you see can0\r\n- [ ] `run post/hardware/automotive/getvinfo CANBUS=can0`\r\n- [ ] **Verify** you see vehicle info from you car"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/275284885","html_url":"https://github.com/rapid7/metasploit-framework/pull/7795#issuecomment-275284885","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/7795","id":275284885,"user":{"login":"h00die","id":752491,"avatar_url":"https://avatars.githubusercontent.com/u/752491?v=3","gravatar_id":"","url":"https://api.github.com/users/h00die","html_url":"https://github.com/h00die","followers_url":"https://api.github.com/users/h00die/followers","following_url":"https://api.github.com/users/h00die/following{/other_user}","gists_url":"https://api.github.com/users/h00die/gists{/gist_id}","starred_url":"https://api.github.com/users/h00die/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/h00die/subscriptions","organizations_url":"https://api.github.com/users/h00die/orgs","repos_url":"https://api.github.com/users/h00die/repos","events_url":"https://api.github.com/users/h00die/events{/privacy}","received_events_url":"https://api.github.com/users/h00die/received_events","type":"User","site_admin":false},"created_at":"2017-01-26T01:26:34Z","updated_at":"2017-01-26T01:26:34Z","body":"```\r\nhwbridge > run post/hardware/automotive/getvinfo CANBUS=can0\r\n\r\n[*] Available PIDS for pulling realtime data: 48 pids\r\n[*]   [1, 3, 4, 5, 6, 7, 11, 12, 13, 14, 15, 16, 17, 19, 21, 28, 31, 32, 32, 33, 36, 44, 45, 46, 47, 48, 49, 51, 52, 60, 64, 64, 65, 66, 67, 68, 69, 70, 71, 73, 74, 76, 77, 78, 81, 90, 96, 101]\r\n[*]   MIL (Engine Light) : OFF\r\n[*]   Number of DTCs: 0\r\n[*]   Engine Temp: 36 °C / 96 °F\r\n[*]   RPMS: 0\r\n[*]   Speed: 0 km/h  /  0.0 mph\r\n[*] Supported OBD Standards: OBD and OBD-II\r\n[*] Mode $09 Vehicle Info Supported PIDS: [2, 4, 6, 8, 10]\r\n[*] VIN: REDACTED\r\n[*] Calibration ID: REDACTED\r\n[*] PID 6 Response: [\"01\", \"FA\", \"1A\", \"18\", \"19\"]\r\n[*] PID 8 Response: [\"01\", \"44\", \"02\", \"E3\", \"00\", \"75\", \"01\", \"44\", \"00\", \"00\", \"00\", \"00\", \"01\", \"B2\", \"01\", \"44\", \"00\", \"00\", \"00\", \"00\", \"01\", \"9D\", \"01\", \"2B\", \"00\", \"00\", \"00\", \"00\", \"00\", \"98\", \"00\", \"74\", \"01\", \"98\", \"01\", \"44\", \"00\", \"00\", \"00\", \"00\", \"00\", \"00\", \"00\", \"00\", \"00\"]\r\n[*] ECU Name: ECM-EngineControl\r\n```"}}
{"actor":{"display_login":"h00die"}}