Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
# -*- coding: binary -*-
2

3
require 'rex/post/meterpreter/extensions/sniffer/tlv'
4
require 'rex/post/meterpreter/extensions/sniffer/command_ids'
5
require 'rex/post/meterpreter/extension'
6

7
module Rex
8
module Post
9
module Meterpreter
10
module Extensions
11
module Sniffer
12

13
###
14
#
15
# This meterpreter extension can be used to capture remote traffic
16
#
17
###
18
class Sniffer < Extension
19

20
  def self.extension_id
21
    EXTENSION_ID_SNIFFER
22
  end
23

24
  def initialize(client)
25
    super(client, 'sniffer')
26

27
    client.register_extension_aliases(
28
      [
29
        {
30
          'name' => 'sniffer',
31
          'ext'  => self
32
        },
33
      ])
34
  end
35

36

37
  # Enumerate the remote sniffable interfaces
38
  def interfaces()
39
    ifaces = []
40
    request = Packet.create_request(COMMAND_ID_SNIFFER_INTERFACES)
41
    response = client.send_request(request)
42
    response.each(TLV_TYPE_SNIFFER_INTERFACES) { |p|
43
      vals  = p.tlvs.map{|x| x.value }
44
      iface = { }
45
      if vals.length == 8
46
        # Windows
47
        ikeys = %W{idx name description type mtu wireless usable dhcp}
48
      else
49
        # Mettle
50
        ikeys = %W{idx name description usable}
51
      end
52
      ikeys.each_index { |i| iface[ikeys[i]] = vals[i] }
53
      ifaces << iface
54
    }
55
    return ifaces
56
  end
57

58
  # Start a packet capture on an opened interface
59
  def capture_start(intf,maxp=200000,filter="")
60
    request = Packet.create_request(COMMAND_ID_SNIFFER_CAPTURE_START)
61
    request.add_tlv(TLV_TYPE_SNIFFER_INTERFACE_ID, intf.to_i)
62
    request.add_tlv(TLV_TYPE_SNIFFER_PACKET_COUNT, maxp.to_i)
63
    request.add_tlv(TLV_TYPE_SNIFFER_ADDITIONAL_FILTER, filter) if filter.length > 0
64
    client.send_request(request)
65
  end
66

67
  # Stop an active packet capture
68
  def capture_stop(intf)
69
    request = Packet.create_request(COMMAND_ID_SNIFFER_CAPTURE_STOP)
70
    request.add_tlv(TLV_TYPE_SNIFFER_INTERFACE_ID, intf.to_i)
71
    response = client.send_request(request)
72
    {
73
      :packets => response.get_tlv_value(TLV_TYPE_SNIFFER_PACKET_COUNT),
74
      :bytes   => response.get_tlv_value(TLV_TYPE_SNIFFER_BYTE_COUNT),
75
    }
76
  end
77

78
  # Retrieve stats about a current capture
79
  def capture_stats(intf)
80
    request = Packet.create_request(COMMAND_ID_SNIFFER_CAPTURE_STATS)
81
    request.add_tlv(TLV_TYPE_SNIFFER_INTERFACE_ID, intf.to_i)
82
    response = client.send_request(request)
83
    {
84
      :packets => response.get_tlv_value(TLV_TYPE_SNIFFER_PACKET_COUNT),
85
      :bytes   => response.get_tlv_value(TLV_TYPE_SNIFFER_BYTE_COUNT),
86
    }
87
  end
88

89
  # Release packets from a current capture
90
  def capture_release(intf)
91
    request = Packet.create_request(COMMAND_ID_SNIFFER_CAPTURE_RELEASE)
92
    request.add_tlv(TLV_TYPE_SNIFFER_INTERFACE_ID, intf.to_i)
93
    response = client.send_request(request)
94
    {
95
      :packets => response.get_tlv_value(TLV_TYPE_SNIFFER_PACKET_COUNT),
96
      :bytes   => response.get_tlv_value(TLV_TYPE_SNIFFER_BYTE_COUNT),
97
    }
98
  end
99

100
  # Buffer the current capture to a readable buffer
101
  def capture_dump(intf)
102
    request = Packet.create_request(COMMAND_ID_SNIFFER_CAPTURE_DUMP)
103
    request.add_tlv(TLV_TYPE_SNIFFER_INTERFACE_ID, intf.to_i)
104
    response = client.send_request(request, 3600)
105
    {
106
      :packets => response.get_tlv_value(TLV_TYPE_SNIFFER_PACKET_COUNT),
107
      :bytes   => response.get_tlv_value(TLV_TYPE_SNIFFER_BYTE_COUNT),
108
      :linktype => response.get_tlv_value(TLV_TYPE_SNIFFER_INTERFACE_ID) || 1,
109
    }
110
  end
111

112
  # Retrieve the packet data for the specified capture
113
  def capture_dump_read(intf, len=16384)
114
    request = Packet.create_request(COMMAND_ID_SNIFFER_CAPTURE_DUMP_READ)
115
    request.add_tlv(TLV_TYPE_SNIFFER_INTERFACE_ID, intf.to_i)
116
    request.add_tlv(TLV_TYPE_SNIFFER_BYTE_COUNT, len.to_i)
117
    response = client.send_request(request, 3600)
118
    {
119
      :bytes   => response.get_tlv_value(TLV_TYPE_SNIFFER_BYTE_COUNT),
120
      :data    => response.get_tlv_value(TLV_TYPE_SNIFFER_PACKET)
121
    }
122
  end
123

124
end
125

126
end; end; end; end; end
127

128