Scapext : Scapy Extended

Scapy is a great tool for network packets manipulation (sniff, dissect, create, send,...).

When I use this tool, I lack some features. So I have written an extension (called Scapext) that, for now, includes :

• GeoIP support (through Maxmind GeoIP Python API). This is faster than the method used in Scapy for now, and easier.


• PFLog pcap type (used by the OpenBSD Packet Filter to log packets ; this allows PF to store valuable information on what happened to the packets logged).


• Early SunRPC support with state handling.

Interested ? See my page about Scapy.

Metasploit Automated Exploitation on N800

As suggested by spaceaquarium, I've tried to get Metasploit Automated Exploitation (one of the killer features of Metasploit Framework 3) working on my N800. And that's easy.

You need Ruby and RubyGems, then install ActiveRecord with gem (for these steps, see my posts about Metasploit Framework and msfweb on N800). Now, install sqlite3-ruby (you may use my package for that).

Last but not least... you need Nmap. You can use this repository.

UPDATE : you can also use my package for Nmap, as it's the latest stable version.

Now, run msfconsole, then :

msf > load db_sqlite3
msf > db_autopwn
[*] Usage: db_autopwn [options]
[...]

msf > db_nmap -p 22,445 [TARGET]

Starting Nmap 3.95 ( http://www.insecure.org/nmap/ ) at 2007-04-11 13:52
[...]
Nmap finished: [...]
msf > db_autopwn -p -t
[*] Analysis completed in [...]
[...]

Nice ! More about this feature here.

msfweb on N800

As I said earlier, I wanted to have msfweb (the Metasploit Framework web interface) running on my N800, because it could be far more easy to use on that kind of devices. Finally it works !

First of all, install Metasploit (read this).

Then, you "only" need to get RubyGems (you can try my package), and get gem files for Rails and its dependencies (you'll find the whole set here). Install each dependency, then Rails itself (run "gem install package-version.gem").

You should be able to run from an xterm (in the directory where you've put Metasploit) the command ./msfweb.

It's a bit slow to start, but it seems to work :

N800 with scapy and metasploit

Thanks to the python package provided by the Maemo "Extras" repository and to the osso-xterm provided by the Maemo-Hackers repository, I have had scapy running on my Nokia N800 for a while.

I have seen that some people had the Metasploit Framework running, thanks to an unreleased Ruby package.

As there is a Ruby file with mud-builder, I have built a Ruby package (you can get it here if you are too lazy to build it yourself) for N800, and... that's it. Just get Metasploit, and run msfcli from an xterm, it works.

As it's not that easy to work with an xterm on the N800 (as on any pocket-sized device), we really need a GUI. For metasploit, one could think of using msfweb plus the integrated web browser. But msfweb does not work for now (needs at least RubyGems and Rails).