Class: Msf::Plugin::PcapLog::PcapLogDispatcher

Inherits:
Object
  • Object
show all
Includes:
Ui::Console::CommandDispatcher
Defined in:
plugins/pcap_log.rb

Overview

Implements a pcap console command dispatcher.

Instance Attribute Summary

Attributes included from Ui::Console::CommandDispatcher

#driver

Attributes included from Rex::Ui::Text::DispatcherShell::CommandDispatcher

#shell, #tab_complete_items

Instance Method Summary collapse

Methods included from Ui::Console::CommandDispatcher

#active_module, #active_module=, #active_session, #active_session=, #build_range_array, #docs_dir, #framework, #load_config, #log_error, #remove_lines

Methods included from Rex::Ui::Text::DispatcherShell::CommandDispatcher

#cmd_help, #cmd_help_help, #cmd_help_tabs, #deprecated_cmd, #deprecated_commands, #deprecated_help, #docs_dir, #help_to_s, included, #print, #print_error, #print_good, #print_line, #print_status, #print_warning, #tab_complete_directory, #tab_complete_filenames, #tab_complete_generic, #tab_complete_source_address, #unknown_command, #update_prompt

Constructor Details

#initialize(*args) ⇒ PcapLogDispatcher

Returns a new instance of PcapLogDispatcher.



149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
 
# File 'plugins/pcap_log.rb', line 149

def initialize(*args)
  super
  @dir = File.join(Msf::Config.config_directory, 'logs')
  @prefix = 'msf3-session'
  @filter = nil
  @pcaprub_loaded = false
  begin
    require 'pcaprub'
    @pcaprub_loaded = true
    @iface = ::Pcap.lookupdev
  rescue ::Exception => e
    print_error "#{e.class}: #{e}"
    @pcaprub_loaded = false
    @pcaprub_error = e
  end
end

Instance Method Details

#cmd_pcap_dir(*args) ⇒ Object 



47
48
49
50
 
# File 'plugins/pcap_log.rb', line 47

def cmd_pcap_dir(*args)
  @dir = args[0] || @dir || '/tmp'
  print_line "#{name} Directory: #{@dir}"
end

#cmd_pcap_filter(*args) ⇒ Object 



37
38
39
40
 
# File 'plugins/pcap_log.rb', line 37

def cmd_pcap_filter(*args)
  @filter = args.join(' ') || @filter
  print_line "#{name} BPF filter: #{@filter}"
end

#cmd_pcap_iface(*args) ⇒ Object 



52
53
54
55
 
# File 'plugins/pcap_log.rb', line 52

def cmd_pcap_iface(*args)
  @iface = args[0] || @iface
  print_line "#{name} Interface: #{@iface}"
end

#cmd_pcap_prefix(*args) ⇒ Object 



42
43
44
45
 
# File 'plugins/pcap_log.rb', line 42

def cmd_pcap_prefix(*args)
  @prefix = args[0] || @prefix || 'msf3-session'
  print_line "#{name} prefix: #{@prefix}"
end

#cmd_pcap_start(*_args) ⇒ Object 



57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
 
# File 'plugins/pcap_log.rb', line 57

def cmd_pcap_start(*_args)
  unless @pcaprub_loaded
    print_error('Pcap module not available')
    return false
  end

  if @capture_thread && @capture_thread.alive?
    print_error 'Capture already started.'
    return false
  end

  gen_fname
  print_line "Starting packet capture from #{@iface} to #{@fname}"
  okay, msg = validate_options
  unless okay
    print_error msg
    return false
  end
  dev = (@iface || ::Pcap.lookupdev)
  @capture_file.write(PCAP_FILE_HEADER)
  @capture_file.flush
  @pcap = ::Pcap.open_live(dev, 65535, true, 1)
  @pcap.setfilter(@filter) if @filter
  @capture_thread = Thread.new do
    @pcap.each do |pkt|
      @capture_file.write(convert_to_pcap(pkt))
      @capture_file.flush
    end
  end
end

#cmd_pcap_stop(*_args) ⇒ Object 



88
89
90
91
92
93
94
95
96
97
98
99
 
# File 'plugins/pcap_log.rb', line 88

def cmd_pcap_stop(*_args)
  if @capture_thread && @capture_thread.alive?
    print_line "Stopping packet capture from #{@iface} to #{@fname}"
    print_line "Capture Stats: #{@pcap.stats.inspect}"
    @pcap = nil
    @capture_file.close if @capture_file.respond_to? :close
    @capture_thread.kill
    @capture_thread = nil
  else
    print_error 'No capture running.'
  end
end

#commands ⇒ Object 



25
26
27
28
29
30
31
32
33
34
35
 
# File 'plugins/pcap_log.rb', line 25

def commands
  {
    'pcap_filter' => 'Set/Get a BPF-style packet filter',
    'pcap_dir' => 'Set/Get a directory to log pcaps to',
    'pcap_prefix' => 'Set/Get a filename prefix to log pcaps to',
    'pcap_iface' => 'Set/Get an interface to capture from',
    'pcap_start' => 'Start a capture',
    'pcap_stop' => 'Stop a running capture',
    'pcap_show_config' => 'Show the current PcapLog configuration'
  }
end

#convert_to_pcap(packet) ⇒ Object 



101
102
103
104
105
 
# File 'plugins/pcap_log.rb', line 101

def convert_to_pcap(packet)
  t = Time.now
  sz = packet.size
  [t.to_i, t.usec, sz, sz, packet].pack('V4A*')
end

#datastore ⇒ Object

Need to pretend to have a datastore for Exploit::Capture to function.



145
146
147
 
# File 'plugins/pcap_log.rb', line 145

def datastore
  {}
end

#gen_fname ⇒ Object 



107
108
109
110
111
 
# File 'plugins/pcap_log.rb', line 107

def gen_fname
  t = Time.now
  file_part = format('%s_%04d-%02d-%02d_%02d-%02d-%02d.pcap', @prefix, t.year, t.month, t.mday, t.hour, t.min, t.sec)
  @fname = File.join(@dir, file_part)
end

#name ⇒ Object 



21
22
23
 
# File 'plugins/pcap_log.rb', line 21

def name
  'PcapLog'
end

#validate_options ⇒ Object

Check for euid 0 and check for a valid place to write files



114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
 
# File 'plugins/pcap_log.rb', line 114

def validate_options
  # Check for root.
  unless Process.euid.zero?
    msg = 'You must run as root in order to capture packets.'
    return [false, msg]
  end

  # Check directory suitability.
  unless File.directory? @dir
    msg = "Invalid pcap directory specified: '#{@dir}'"
    return [false, msg]
  end

  unless File.writable? @dir
    msg = "No write permission to directory: '#{@dir}'"
    return [false, msg]
  end

  @capture_file = File.open(@fname, 'ab')
  unless File.writable? @fname
    msg = "Cannot write to file: '#{@fname}'"
    return [false, msg]
  end

  # If you got this far, you're golden.
  msg = "We're good!"
  return [true, msg]
end