## Vulnerable Application

Opens a serial connection to a Quectel cellular modem and registers it as a 'modem' session capable of network
pivoting. The Quectel modems have a limited number of sockets available, configurable using MODEM_SOCKETS. Once
the session is established, it can be routed through using the `route` command.

The Quectel modems do not support all socket operations that other session types such as Meterpreter support. Notable
limitations include not being able to bind to a particular address for any socket and no TCP server support.

This module requires local serial access to a Quectel modem. It has been tested with a Quectel EG91-NA.

## Verification Steps

1. Make a physical connection to the Quectel modem over an RS232 serial cable (optionally with a USB adapter).
2. Identify the connection, e.g. `/dev/ttyUSB0`.
3. Optionally `chmod` it to make it readable by the Metasploit user which will require read and write access to it.
4. Start msfconsole
5. Load the `request` plugin by running `load request`
6. Use the `request` command to obtain the current, unpivoted IP address by running `request -A curl/ https://ifconfig.me`
7. Do: `use auxiliary/server/quectel_modem`
8. Do: `set SERIAL /dev/ttyUSB0` where `/dev/ttyUSB0` is the previously identified connection.
9. Do: `run`, you should see a session opened
10. Do: `route add 0 0 -1` to route all of the traffic through the session.
11. Repeat the `request` to ifconfig.me step and see a different IP address.

## Options

### MODEM_SOCKETS

Number of Quectel socket IDs (SID pool size). This is effectively the number of concurrent connections the modem
supports. The default is `12`.

### SERIAL

Serial device for the Quectel modem. The default is `/dev/ttyUSB0`.

### BAUD

Serial baud rate. The default is `115200`.

### MAX_CHUNK_SIZE

Bytes per AT+QISEND chunk. The default is `1024`.

### PROMPT_TIMEOUT_MS, ACK_TIMEOUT_MS, OPEN_TIMEOUT_MS, CMD_TIMEOUT_MS

Timeout controls for serial AT command operations.

### STARTUP_OK_TIMEOUT_S, STARTUP_OK_INTERVAL_MS, HEALTHCHECK_INTERVAL_S, HEALTHCHECK_TIMEOUT_MS, HEALTHCHECK_MAX_FAILS

Startup probing and runtime health check controls.

## Scenarios

Quectel LTE EG91 modem

```
msf auxiliary(server/quectel_modem) > run
[*] Probing modem with AT until OK...
[+] Modem is responding to AT commands.
[*] Waiting briefly for RDY URC (best-effort)...
[*] Closing any leftover modem socket connections...
[+] Modem session 1 opened (12 sockets, 1024B chunks)
[*] Auxiliary module execution completed
msf auxiliary(server/quectel_modem) > route add 0 0 -1
[*] Route added
(reverse-i-search)`im': tInterrupt: use the 'exit' command to quit
msf auxiliary(server/quectel_modem) > load request
[*] Successfully loaded plugin: Request
msf auxiliary(server/quectel_modem) > request http://ifconfig.me
192.0.2.1
```
