{“lastseen”:”2026-06-19T19:36:58″,”description”:”Opens a serial connection to a Quectel cellular modem and registers it as a ‘modem’ session capable of network pivoting. The Quectel modems have a limited number of sockets available, configurable using MODEMSOCKETS. Once the session is established, it…”,”published”:”2026-06-19T19:03:20″,”modified”:”2026-06-19T19:03:20″,”type”:”metasploit”,”title”:”Quectel Cellular Modem Pivot (Serial AT)”,”source”:””,”references”:””,”id”:”MSF:AUXILIARY-SERVER-QUECTEL_MODEM-“,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”##\\n# This module requires Metasploit: https:\/\/metasploit.com\/download\\n# Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n##\\n\\nrequire ‘msf\/base\/sessions\/modem’\\nrequire ‘msf\/base\/sessions\/modem\/quectel’\\n\\nclass MetasploitModule \\u003c Msf::Auxiliary\\n DEFAULT_MAX_CHUNK_SIZE = 1024 # bytes per QISEND chunk\\n DEFAULT_PROMPT_TIMEOUT_MS = 5000 # wait for ‘\\u003e’ after QISEND (ms)\\n DEFAULT_ACK_TIMEOUT_MS = 8000 # wait for SEND OK\/FAIL (ms)\\n DEFAULT_OPEN_TIMEOUT_MS = 30000 # wait for +QIOPEN URC (ms)\\n DEFAULT_CMD_TIMEOUT_MS = 6000 # wait for AT command OK\/ERROR (ms)\\n\\n # === v0.06.4 modem health \/ readiness defaults ===============================\\n DEFAULT_STARTUP_OK_TIMEOUT_S = 0 # total seconds to wait for first AT OK (0 = no timeout)\\n DEFAULT_STARTUP_OK_INTERVAL_MS = 1000 # delay between AT probes at startup (ms)\\n DEFAULT_HEALTHCHECK_INTERVAL_S = 3 # seconds between AT probes at runtime\\n DEFAULT_HEALTHCHECK_TIMEOUT_MS = 2000 # per-probe AT timeout (ms)\\n DEFAULT_HEALTHCHECK_MAX_FAILS = 3 # consecutive failures before marking NOT READY\\n\\n DEFAULT_MODEM_SOCKETS = 12 # SID pool size (0..N-1); Quectel Cell Module supports up to 12\\n\\n # === Metasploit module proper ============================================\\n\\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘Quectel Cellular Modem Pivot (Serial AT)’,\\n ‘Description’ =\\u003e %q{\\n Opens a serial connection to a Quectel cellular modem and registers it as a ‘modem’ session capable of network\\n pivoting. The Quectel modems have a limited number of sockets available, configurable using MODEM_SOCKETS. Once\\n the session is established, it can be routed through using the `route` command.\\n },\\n ‘Author’ =\\u003e [\\n ‘Deral Heiland’, # original SOCKS5 proxy module\\n ‘Spencer McIntyre’ # native session refactor\\n ],\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘Notes’ =\\u003e { ‘Stability’ =\\u003e [], ‘Reliability’ =\\u003e [], ‘SideEffects’ =\\u003e [] }\\n )\\n )\\n\\n register_options(\\n [\\n OptString.new(‘SERIAL’, [ true, ‘Serial device for Quectel modem’, ‘\/dev\/ttyUSB0’ ]),\\n OptInt.new(‘BAUD’, [ true, ‘Serial baud rate’, 115200 ]),\\n\\n # Advanced performance knobs (tune as needed)\\n OptInt.new(‘MODEM_SOCKETS’, [ true, ‘Number of Quectel socket IDs (SID pool size)’, DEFAULT_MODEM_SOCKETS ]),\\n OptInt.new(‘MAX_CHUNK_SIZE’, [ true, ‘Bytes per AT+QISEND chunk’, DEFAULT_MAX_CHUNK_SIZE ]),\\n OptInt.new(‘PROMPT_TIMEOUT_MS’, [ true, \\”Timeout waiting for QISEND ‘\\u003e’ prompt (ms)\\”, DEFAULT_PROMPT_TIMEOUT_MS ]),\\n OptInt.new(‘ACK_TIMEOUT_MS’, [ true, ‘Timeout waiting for SEND OK\/FAIL (ms)’, DEFAULT_ACK_TIMEOUT_MS ]),\\n OptInt.new(‘OPEN_TIMEOUT_MS’, [ true, ‘Timeout waiting for +QIOPEN URC (ms)’, DEFAULT_OPEN_TIMEOUT_MS ]),\\n OptInt.new(‘CMD_TIMEOUT_MS’, [ true, ‘Timeout waiting for AT command OK\/ERROR (ms)’, DEFAULT_CMD_TIMEOUT_MS ]),\\n\\n # modem readiness \/ health watchdog\\n OptInt.new(‘STARTUP_OK_TIMEOUT_S’, [ true, ‘Startup: total seconds to wait for first AT OK (0 = no timeout)’, DEFAULT_STARTUP_OK_TIMEOUT_S ]),\\n OptInt.new(‘STARTUP_OK_INTERVAL_MS’, [ true, ‘Startup: delay between AT probes (ms)’, DEFAULT_STARTUP_OK_INTERVAL_MS ]),\\n OptInt.new(‘HEALTHCHECK_INTERVAL_S’, [ true, ‘Runtime: seconds between modem AT health probes’, DEFAULT_HEALTHCHECK_INTERVAL_S ]),\\n OptInt.new(‘HEALTHCHECK_TIMEOUT_MS’, [ true, ‘Runtime: AT health probe timeout (ms)’, DEFAULT_HEALTHCHECK_TIMEOUT_MS ]),\\n OptInt.new(‘HEALTHCHECK_MAX_FAILS’, [ true, ‘Runtime: consecutive AT probe failures before marking modem NOT READY’, DEFAULT_HEALTHCHECK_MAX_FAILS ])\\n ]\\n )\\n\\n @modem = nil\\n @cfg = {}\\n @session_registered = false\\n end\\n\\n def setup\\n super\\n unless Msf::Sessions::Modem::Quectel::Driver.supported_platform?\\n fail_with(Failure::BadConfig,\\n \\”This module uses Linux-specific termios ioctls and cannot run on #{RUBY_PLATFORM}\\”)\\n end\\n\\n dev = datastore[‘SERIAL’]\\n baud = datastore[‘BAUD’].to_i\\n\\n # Build runtime config from datastore (keep everything in seconds\/bytes internally)\\n @cfg = {\\n modem_sockets: [datastore[‘MODEM_SOCKETS’].to_i, 1].max,\\n max_chunk_size: [datastore[‘MAX_CHUNK_SIZE’].to_i, 1].max,\\n prompt_timeout: [datastore[‘PROMPT_TIMEOUT_MS’].to_i, 0].max \/ 1000.0,\\n ack_timeout: [datastore[‘ACK_TIMEOUT_MS’].to_i, 0].max \/ 1000.0,\\n open_timeout: [datastore[‘OPEN_TIMEOUT_MS’].to_i, 0].max \/ 1000.0,\\n cmd_timeout: [datastore[‘CMD_TIMEOUT_MS’].to_i, 0].max \/ 1000.0,\\n startup_ok_timeout: [datastore[‘STARTUP_OK_TIMEOUT_S’].to_i, 0].max,\\n startup_ok_interval: [datastore[‘STARTUP_OK_INTERVAL_MS’].to_i, 0].max \/ 1000.0,\\n healthcheck_interval: [datastore[‘HEALTHCHECK_INTERVAL_S’].to_i, 0].max,\\n healthcheck_timeout: [datastore[‘HEALTHCHECK_TIMEOUT_MS’].to_i, 0].max \/ 1000.0,\\n healthcheck_max_fails: [datastore[‘HEALTHCHECK_MAX_FAILS’].to_i, 1].max\\n }\\n\\n # Open the serial port and start the background reader thread.\\n begin\\n @modem = Msf::Sessions::Modem::Quectel::Driver.new(dev, baud, framework, @cfg)\\n rescue ::Errno::ENOENT\\n fail_with(Failure::BadConfig, \\”Serial device not found: #{dev}\\”)\\n rescue ::Errno::EACCES\\n fail_with(Failure::BadConfig, \\”Permission denied opening #{dev} – check that your user is in the ‘dialout’ group\\”)\\n rescue ::Errno::EBUSY\\n fail_with(Failure::BadConfig, \\”#{dev} is busy – another process may have it open\\”)\\n rescue ::Errno::EIO, ::Errno::ENXIO\\n fail_with(Failure::Unreachable, \\”I\/O error on #{dev} – check the USB cable and modem power\\”)\\n rescue ::Errno::ENOTTY\\n fail_with(Failure::BadConfig, \\”#{dev} is not a serial port (ioctl TCGETS failed)\\”)\\n rescue ::StandardError =\\u003e e\\n fail_with(Failure::Unknown, \\”Failed to open serial port on #{dev}: #{e.class} #{e.message}\\”)\\n end\\n\\n # Poll AT until the modem is responsive.\\n print_status(‘Probing modem with AT until OK…’)\\n begin\\n @modem.startup_wait_for_ok(@cfg[:startup_ok_timeout], @cfg[:startup_ok_interval], @cfg[:healthcheck_timeout])\\n rescue ::Rex::TimeoutError =\\u003e e\\n fail_with(Failure::TimeoutExpired, e.message)\\n rescue ::StandardError =\\u003e e\\n fail_with(Failure::Unknown, \\”Modem startup probe failed: #{e.class} #{e.message}\\”)\\n end\\n print_good(‘Modem is responding to AT commands.’)\\n\\n # Best-effort wait for the RDY banner (already past it on a warm start).\\n print_status(‘Waiting briefly for RDY URC (best-effort)…’)\\n @modem.wait_for_rdy(5)\\n\\n # Disable echo so URC parsing is not confused by command echoes.\\n begin\\n @modem.send_at(‘ATE0’, @cfg[:cmd_timeout])\\n rescue ::StandardError =\\u003e e\\n fail_with(Failure::Unknown, \\”Failed to disable echo (ATE0): #{e.class} #{e.message}\\”)\\n end\\n\\n # Close any leftover socket connections from a previous session (e.g. MSF\\n # crashed without sending AT+QICLOSE). Errors are silently ignored – a SID\\n # that is not open will return ERROR, which is expected.\\n print_status(‘Closing any leftover modem socket connections…’)\\n (0…@cfg[:modem_sockets]).each do |sid|\\n @modem.send_at(\\”AT+QICLOSE=#{sid},0\\”, @cfg[:cmd_timeout])\\n rescue ::StandardError =\\u003e e\\n nil\\n end\\n\\n # Start runtime health watchdog now that the modem is known-good.\\n @modem.start_health_watchdog\\n end\\n\\n def cleanup\\n # Only close the modem if the session was never registered.\\n # Once the session takes ownership, it is responsible for\\n # closing the modem via Msf::Sessions::Modem::Quectel#cleanup.\\n @modem.close if @modem \\u0026\\u0026 !@session_registered\\n super\\n end\\n\\n def run\\n unless @modem.modem_ready?\\n print_error(‘Modem is not ready – check serial connection and power’)\\n return\\n end\\n\\n sess = Msf::Sessions::Modem::Quectel.new(@modem)\\n sess.set_from_exploit(self)\\n framework.sessions.register(sess)\\n # Transfer modem ownership to the session; cleanup must not close it now.\\n @session_registered = true\\n print_good(\\”Modem session #{sess.sid} opened (#{@cfg[:modem_sockets]} sockets, #{@cfg[:max_chunk_size]}B chunks)\\”)\\n # Return immediately – the session runs independently of this module job.\\n end\\n\\nend\\n”,”sourceHref”:”https:\/\/github.com\/rapid7\/metasploit-framework\/blob\/master\/modules\/auxiliary\/server\/quectel_modem.rb”,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.rapid7.com\/db\/modules\/auxiliary\/server\/quectel_modem\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-06-19T19:36:58″,”description”:”Opens a serial connection to a Quectel cellular modem and registers it as a ‘modem’ session capable of network pivoting. The Quectel modems have a…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,169,13,33,7,11,5],"class_list":["post-64425","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-metasploit","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n