metasploit-framework/lib/msf/core/exploit/capture.rb

module Msf

###
#
# This module provides methods for receiving raw packets. 
# Please see the pcaprub documentation for more information.
#
###

module Exploit::Capture

	#
	# Initializes an instance of an exploit module that captures traffic
	#
	
	def initialize(info = {})
		super

		register_options(
			[
				OptString.new('INTERFACE', [false, 'The name of the interface']),
				OptString.new('FILTER', [false, 'The filter string for capturing traffic']),
				OptInt.new('SNAPLEN', [true, 'The number of bytes to capture', 65535]),
				OptInt.new('TIMEOUT', [true, 'The number of seconds to wait for new data', 1])

			], Msf::Exploit::Capture
		)

		
		begin
			require 'pcaprub'
			@pcaprub_loaded = true
		rescue ::Exception => e
			@pcaprub_loaded = false
			@pcaprub_error  = e
		end

		begin
			require 'scruby'
			@scruby_loaded = true
		rescue ::Exception => e
			@scruby_loaded = false
			@scruby_error  = e
		end
			
	end

	def stats_recv
		return(0) if not self.capture
		self.capture.stats['recv']
	end

	def stats_drop
		return(0) if not self.capture
		self.capture.stats['drop']
	end

	def stats_ifdrop
		return(0) if not self.capture
		self.capture.stats['ifdrop']
	end
	
	#
	# Opens a handle to the specified device
	#
	def open_pcap
	
		if (not @pcaprub_loaded)
			print_status("The Pcaprub module is not available: #{@pcaprub_error.to_s}")
			raise RuntimeError, "Pcaprub not available"
		end
		
		# Capture device
		dev = datastore['INTERFACE'] || ::Pcap.lookupdev
		len = (datastore['SNAPLEN']  || 65535).to_i
		tim = (datastore['TIMEOUT']  || 0).to_i
		fil = datastore['FILTER']
				
		# XXX: Force the interface to be up
		system("ifconfig", dev, "up")

		self.capture = ::Pcap.open_live(dev, len, true, tim)

		if (not self.capture)
			raise RuntimeError, "Could not open the device interface"
		end

		self.capture.setfilter(fil) if fil
	end

	def close_pcap 
		return if not self.capture
		self.capture.close
		self.capture = nil
	end

	# Extend this to support a wider range of link layer types
	def capture_find_linklayer(pkt)
		return if not pkt
		raw = pkt.raw_data
		off = 0
		
		case pkt.datalink
		when 119
			off = 144
		else
		end

		raw[off, raw.length - off]
	end

	def capture_extract_ies(raw)
		set = {}
		ret = 0
		idx = 0
		len = 0

		while (idx < raw.length)
			len = raw[idx+1]
			return set if not len
			set[ raw[idx] ] ||= []
			set[ raw[idx] ].push(raw[idx + 2, len])
			idx += len + 2
		end

		return set
	end
	
	def each_packet
		return if not self.capture
	
		# print_status("Link type is #{capture.datalink}")
							
		capture.each do |packet|
			dec = Scruby.linklayer_dissector(capture.datalink, packet)

			if(dec)
				break if not yield(true, dec)
			else
				break if not yield(false, packet)
			end		
		end
	end

	def find_layers(pkt, cls)
		res = []
		pkt.layers_list.each do |layer|
			if layer.class == cls
				res << layer
			end
		end
		res
	end


	attr_accessor :capture

end

end