Class: Msf::Plugin::PcapLog::PcapLogDispatcher

Inherits:
Object
  • Object
show all
Includes:
Ui::Console::CommandDispatcher
Defined in:
plugins/pcap_log.rb

Overview

Implements a pcap console command dispatcher.

Instance Attribute Summary

Attributes included from Ui::Console::CommandDispatcher

#driver

Attributes included from Rex::Ui::Text::DispatcherShell::CommandDispatcher

#shell, #tab_complete_items

Instance Method Summary collapse

Methods included from Ui::Console::CommandDispatcher

#active_module, #active_module=, #active_session, #active_session=, #build_range_array, #docs_dir, #framework, #log_error, #remove_lines

Methods included from Rex::Ui::Text::DispatcherShell::CommandDispatcher

#cmd_help, #cmd_help_help, #cmd_help_tabs, #deprecated_cmd, #deprecated_commands, #deprecated_help, #docs_dir, #help_to_s, #print, #print_error, #print_good, #print_line, #print_status, #print_warning, #tab_complete_directory, #tab_complete_filenames, #tab_complete_generic, #tab_complete_source_address, #update_prompt

Constructor Details

#initialize(*args) ⇒ PcapLogDispatcher

Returns a new instance of PcapLogDispatcher.


161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
 
# File 'plugins/pcap_log.rb', line 161

def initialize(*args)
  super
  @dir = File.join(Msf::Config.config_directory, 'logs')
  @prefix = "msf3-session"
  @filter = nil
  @pcaprub_loaded = false
  begin
    require 'pcaprub'
    @pcaprub_loaded = true
    @iface = ::Pcap.lookupdev
  rescue ::Exception => e
    print_error "#{e.class}: #{e}"
    @pcaprub_loaded = false
    @pcaprub_error = e
  end
end

Instance Method Details

#cmd_pcap_dir(*args) ⇒ Object 


55
56
57
58
 
# File 'plugins/pcap_log.rb', line 55

def cmd_pcap_dir(*args)
  @dir = args[0] || @dir || "/tmp"
  print_line "#{self.name} Directory: #{@dir}"
end

#cmd_pcap_filter(*args) ⇒ Object 


45
46
47
48
 
# File 'plugins/pcap_log.rb', line 45

def cmd_pcap_filter(*args)
  @filter = args.join(' ') || @filter
  print_line "#{self.name} BPF filter: #{@filter}"
end

#cmd_pcap_iface(*args) ⇒ Object 


60
61
62
63
 
# File 'plugins/pcap_log.rb', line 60

def cmd_pcap_iface(*args)
  @iface = args[0] || @iface
  print_line "#{self.name} Interface: #{@iface}"
end

#cmd_pcap_prefix(*args) ⇒ Object 


50
51
52
53
 
# File 'plugins/pcap_log.rb', line 50

def cmd_pcap_prefix(*args)
  @prefix = args[0] || @prefix || "msf3-session"
  print_line "#{self.name} prefix: #{@prefix}"
end

#cmd_pcap_start(*args) ⇒ Object 


65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
 
# File 'plugins/pcap_log.rb', line 65

def cmd_pcap_start(*args)

  unless @pcaprub_loaded 
    print_error("Pcap module not available")
    return false
  end

  if @capture_thread && @capture_thread.alive?
    print_error "Capture already started."
    return false
  end

  gen_fname
  print_line "Starting packet capture from #{@iface} to #{@fname}"
  okay,msg = validate_options
  unless okay
    print_error msg
    return false
  end
  dev = (@iface || ::Pcap.lookupdev)
  @capture_file.write(PCAP_FILE_HEADER)
  @capture_file.flush
  @pcap = ::Pcap.open_live(dev, 65535, true, 1)
  @pcap.setfilter(@filter) if @filter
  @capture_thread = Thread.new {
    @pcap.each do |pkt|
      @capture_file.write(convert_to_pcap(pkt))
      @capture_file.flush
    end
  }
end

#cmd_pcap_stop(*args) ⇒ Object 


97
98
99
100
101
102
103
104
105
106
107
108
 
# File 'plugins/pcap_log.rb', line 97

def cmd_pcap_stop(*args)
  if @capture_thread && @capture_thread.alive?
    print_line "Stopping packet capture from #{@iface} to #{@fname}"
    print_line "Capture Stats: #{@pcap.stats.inspect}"
    @pcap = nil
    @capture_file.close if @capture_file.respond_to? :close
    @capture_thread.kill
    @capture_thread = nil
  else
    print_error "No capture running."
  end
end

#commands ⇒ Object 


32
33
34
35
36
37
38
39
40
41
42
43
 
# File 'plugins/pcap_log.rb', line 32

def commands
  {
    "pcap_filter" => "Set/Get a BPF-style packet filter",
    "pcap_dir"    => "Set/Get a directory to log pcaps to",
    "pcap_prefix" => "Set/Get a filename prefix to log pcaps to",
    "pcap_iface"  => "Set/Get an interface to capture from",
    "pcap_start"  => "Start a capture",
    "pcap_stop"   => "Stop a running capture",

    "pcap_show_config"  => "Show the current PcapLog configuration"
  }
end

#convert_to_pcap(packet) ⇒ Object 


110
111
112
113
114
 
# File 'plugins/pcap_log.rb', line 110

def convert_to_pcap(packet)
  t = Time.now
  sz = packet.size
  [t.to_i, t.usec, sz, sz, packet].pack("V4A*")
end

#datastore ⇒ Object

Need to pretend to have a datastore for Exploit::Capture to function.


157
158
159
 
# File 'plugins/pcap_log.rb', line 157

def datastore
  {}
end

#gen_fname ⇒ Object 


116
117
118
119
120
121
122
 
# File 'plugins/pcap_log.rb', line 116

def gen_fname
  t = Time.now
  file_part = "%s_%04d-%02d-%02d_%02d-%02d-%02d.pcap" % [
    @prefix, t.year, t.month, t.mday, t.hour, t.min, t.sec
  ]
  @fname = File.join(@dir, file_part)
end

#name ⇒ Object 


28
29
30
 
# File 'plugins/pcap_log.rb', line 28

def name
  "PcapLog"
end

#validate_options ⇒ Object

Check for euid 0 and check for a valid place to write files


125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
 
# File 'plugins/pcap_log.rb', line 125

def validate_options

  # Check for root.
  unless Process.euid.zero?
    msg = "You must run as root in order to capture packets."
    return [false, msg]
  end

  # Check directory suitability.
  unless File.directory? @dir
    msg = "Invalid pcap directory specified: '#{@dir}'"
    return [false, msg]
  end

  unless File.writable? @dir
    msg = "No write permission to directory: '#{@dir}'"
    return [false, msg]
  end

  @capture_file = File.open(@fname, "ab")
  unless File.writable? @fname
    msg = "Cannot write to file: '#{@fname}'"
    return [false, msg]
  end

  # If you got this far, you're golden.
  msg = "We're good!"
  return [true, msg]
end