Addition of the new Pcap interface

Force user to install the pcapx and lorcon libs



git-svn-id: file:///home/svn/framework3/trunk@4114 4d416f70-5f16-0410-b530-b9f4589650da

lib/msf/core/exploit.rb

@@ -238,7 +238,8 @@ class Exploit < Msf::Module
 
 	# Networks
 	require 'msf/core/exploit/lorcon'
-
+	require 'msf/core/exploit/pcap'
+	
 	#
 	# Returns an array of all of the exploit mixins.  Lame algorithm right now.
 	# We search the Msf::Exploit namespace for all modules that do not have any

lib/msf/core/exploit/lorcon.rb

@@ -6,6 +6,7 @@ module Msf
 # using the Ruby Lorcon module, a wrapper for the lorcon library.
 #
 ###
+
 module Exploit::Lorcon
 
 	#
@@ -23,10 +24,9 @@ module Exploit::Lorcon
 			], Msf::Exploit::Lorcon
 		)
 
-		$:.unshift(File.join(Msf::Config.install_root, 'external'))
-	
+		
 		begin
-			require 'ruby-lorcon/Lorcon'
+			require 'Lorcon'
 			@lorcon_loaded = true
 		rescue ::Exception => e
 			@lorcon_loaded = false
@@ -41,8 +41,8 @@ module Exploit::Lorcon
 	def open_wifi
 	
 		if (not @lorcon_loaded)
-			print_status("The Lorcon module is not available, please see external/ruby-lorcon/README")
-			return
+			print_status("The Lorcon module is not available: #{@lorcon_error.to_s}")
+			raise RuntimeError, "Lorcon not available"
 		end
 		
 		self.wifi = ::Lorcon::Device.new(datastore['INTERFACE'], datastore['DRIVER'], datastore['CHANNEL'])

lib/msf/core/exploit/pcap.rb

@@ -0,0 +1,68 @@
+module Msf
+
+###
+#
+# This module provides methods for receiving packets through the PcapX module
+#
+###
+
+module Exploit::Pcap
+
+	#
+	# Initializes an instance of an exploit module that receives raw packets
+	#
+	
+	def initialize(info = {})
+		super
+
+		register_options(
+			[
+				OptString.new('INTERFACE', [true, 'The name of the interface to sniff', 'eth0'])
+			], Msf::Exploit::Pcap
+		)
+
+		begin
+			require 'PcapX'
+			@pcapx_loaded = true
+		rescue ::Exception => e
+			@pcapx_loaded = false
+			@pcapx_error  = e
+		end
+	
+	end
+
+	#
+	# Opens a network device for capture
+	#
+	def pcap_open_live(device = 'eth0', snaplen=65535, promisc=true)
+	
+		if (not @pcapx_loaded)
+			print_status("The PcapX module is not available: #{@pcapx_error.to_s}")
+			raise RuntimeError, "PcapX not available"
+			return
+		end
+
+		self.capture =  ::PcapX::Capture.open_live(device, snaplen.to_i, promisc)
+	end
+	
+	#
+	# Sets the pcap filter
+	# 
+	def pcap_setfilter(filter='')
+		return if not self.capture
+		self.capture.setfilter(filter)
+	end
+	
+	#
+	# Opens a network device based on datastore
+	#
+	def pcap_open(filter='')
+		pcap_open_live(datastore['INTERFACE'])
+		pcap_setfilter(filter)
+	end
+	
+
+	attr_accessor :capture
+end
+
+end

modules/auxiliary/test_pcap.rb

@@ -0,0 +1,44 @@
+require 'msf/core'
+
+module Msf
+
+class Auxiliary::TestPcap < Msf::Auxiliary
+
+	include Auxiliary::Report
+	include Msf::Exploit::Pcap
+	
+	def initialize
+		super(
+			'Name'        => 'Simple Network Capture Tester',
+			'Version'     => '$Revision: 3624 $',
+			'Description' => 'This module sniffs HTTP GET requests from the network',
+			'Author'      => 'hdm',
+			'License'     => MSF_LICENSE,
+			'Actions'     =>
+				[
+				 	[ 'Sniffer' ]
+				],
+			'PassiveActions' => 
+				[
+					'Sniffer'
+				],
+			'DefaultAction'  => 'Sniffer'
+		)
+	end
+
+	def run
+		print_status("Opening the network interface...")
+		pcap_open()
+		print_status("Sniffing packets...")
+		capture.each_packet do |pkt|
+			next if not pkt.tcp?
+			next if not pkt.tcp_data
+			if (pkt.tcp_data =~ /^GET\s+([^\s]+)\s+HTTP/)
+				print_status("GET #{$1}")
+			end
+		end
+	end
+	
+end
+
+end