1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::Remote::Capture
8

9
  def initialize
10
    super(
11
      'Name' => 'Pcap Replay Utility',
12
      'Description' => %q{
13
        Replay a packet capture (PCAP) file.
14
      },
15
      'Author' => 'amaloteaux',
16
      'License' => MSF_LICENSE,
17
      'Notes' => {
18
        'Stability' => [SERVICE_RESOURCE_LOSS],
19
        'SideEffects' => [IOC_IN_LOGS],
20
        'Reliability' => []
21
      }
22
    )
23

24
    register_options([
25
      OptPath.new('FILENAME', [true, 'The local pcap file to process']),
26
      OptString.new('FILE_FILTER', [false, 'The filter string to apply on the file']),
27
      OptInt.new('LOOP', [true, 'The number of times to loop through the file', 1]),
28
      OptInt.new('DELAY', [true, 'the delay in millisecond between each loop', 0]),
29
      OptInt.new('PKT_DELAY', [true, 'the delay in millisecond between each packet', 0]),
30
    ])
31

32
    deregister_options('SNAPLEN', 'FILTER', 'PCAPFILE', 'RHOST', 'TIMEOUT', 'SECRET', 'GATEWAY_PROBE_HOST', 'GATEWAY_PROBE_PORT')
33
  end
34

35
  def run
36
    filename = datastore['FILENAME']
37

38
    unless File.exist?(filename) && File.file?(filename)
39
      print_error('Pcap File does not exist')
40
      return
41
    end
42

43
    check_pcaprub_loaded
44

45
    open_pcap
46

47
    vprint_status('Sending file...')
48

49
    pkt_delay = datastore['PKT_DELAY']
50
    delay = datastore['DELAY']
51
    iterations = datastore['LOOP']
52
    infinity = true if iterations <= 0
53
    file_filter = datastore['FILE_FILTER']
54
    count = 0
55
    while (iterations > 0) || infinity
56
      vprint_status("Sending file (iterations: #{count += 1})")
57
      inject_pcap(filename, file_filter, pkt_delay)
58
      iterations -= 1 unless infinity
59
      Kernel.select(nil, nil, nil, (delay * 1.0) / 1000) if (iterations > 0) || infinity
60
    end
61

62
    close_pcap
63
  end
64
end
65

66