Cleanup pSnuffle

GSoC/Meterpreter_Web_Console
Brendan Coles 2018-06-04 15:27:20 +00:00
parent f1701ecc93
commit e1d69d6307
1 changed files with 36 additions and 40 deletions

View File

@ -11,8 +11,6 @@
# Cheers - Max Moser - mmo@remote-exploit.org # Cheers - Max Moser - mmo@remote-exploit.org
## ##
class MetasploitModule < Msf::Auxiliary class MetasploitModule < Msf::Auxiliary
include Msf::Auxiliary::Report include Msf::Auxiliary::Report
include Msf::Exploit::Capture include Msf::Exploit::Capture
@ -28,31 +26,28 @@ class MetasploitModule < Msf::Auxiliary
[ 'Sniffer' ], [ 'Sniffer' ],
[ 'List' ] [ 'List' ]
], ],
'PassiveActions' => 'PassiveActions' => [ 'Sniffer' ],
[
'Sniffer'
],
'DefaultAction' => 'Sniffer' 'DefaultAction' => 'Sniffer'
) )
register_options [
OptString.new('PROTOCOLS', [true, 'A comma-delimited list of protocols to sniff or "all".', 'all']),
]
register_options([ register_advanced_options [
OptString.new('PROTOCOLS', [true, 'A comma-delimited list of protocols to sniff or "all".', "all"]),
])
register_advanced_options([
OptPath.new('ProtocolBase', [true, 'The base directory containing the protocol decoders', OptPath.new('ProtocolBase', [true, 'The base directory containing the protocol decoders',
File.join(Msf::Config.data_directory, "exploits", "psnuffle") File.join(Msf::Config.data_directory, 'exploits', 'psnuffle')
]), ]),
]) ]
deregister_options('RHOST') deregister_options('RHOST', 'RHOSTS')
end end
def load_protocols def load_protocols
base = datastore['ProtocolBase'] base = datastore['ProtocolBase']
if (not File.directory?(base)) unless File.directory? base
raise RuntimeError,"The ProtocolBase parameter is set to an invalid directory" raise RuntimeError, 'The ProtocolBase parameter is set to an invalid directory'
end end
allowed = datastore['PROTOCOLS'].split(',').map{|x| x.strip.downcase} allowed = datastore['PROTOCOLS'].split(',').map{|x| x.strip.downcase}
@protos = {} @protos = {}
decoders = Dir.new(base).entries.grep(/\.rb$/).sort decoders = Dir.new(base).entries.grep(/\.rb$/).sort
@ -63,14 +58,14 @@ class MetasploitModule < Msf::Auxiliary
m.module_eval(File.read(f, File.size(f))) m.module_eval(File.read(f, File.size(f)))
m.constants.grep(/^Sniffer(.*)/) do m.constants.grep(/^Sniffer(.*)/) do
proto = $1 proto = $1
if allowed.include?(proto.downcase) or datastore['PROTOCOLS'] == 'all' next unless allowed.include?(proto.downcase) || datastore['PROTOCOLS'] == 'all'
klass = m.const_get("Sniffer#{proto}") klass = m.const_get("Sniffer#{proto}")
@protos[proto.downcase] = klass.new(framework, self) @protos[proto.downcase] = klass.new(framework, self)
print_status("Loaded protocol #{proto} from #{f}...") print_status("Loaded protocol #{proto} from #{f}...")
end end
end rescue => e
rescue ::Exception => e
print_error("Decoder #{n} failed to load: #{e.class} #{e} #{e.backtrace}") print_error("Decoder #{n} failed to load: #{e.class} #{e} #{e.backtrace}")
end end
end end
@ -81,12 +76,12 @@ class MetasploitModule < Msf::Auxiliary
# Load all of our existing protocols # Load all of our existing protocols
load_protocols load_protocols
if(action.name == 'List') if action.name == 'List'
print_status("Protocols: #{@protos.keys.sort.join(', ')}") print_status("Protocols: #{@protos.keys.sort.join(', ')}")
return return
end end
print_status("Sniffing traffic.....") print_status 'Sniffing traffic.....'
open_pcap open_pcap
each_packet do |pkt| each_packet do |pkt|
@ -99,7 +94,7 @@ class MetasploitModule < Msf::Auxiliary
true true
end end
close_pcap close_pcap
print_status("Finished sniffing") print_status 'Finished sniffing'
end end
end end
@ -115,7 +110,7 @@ class BaseProtocolParser
self.module = mod self.module = mod
self.sessions = {} self.sessions = {}
self.dport = 0 self.dport = 0
register_sigs() register_sigs
end end
def parse(pkt) def parse(pkt)
@ -153,7 +148,8 @@ class BaseProtocolParser
purge_keys = [] purge_keys = []
sessions.each_key do |ses| sessions.each_key do |ses|
# Check for cleanup abilities... kills performance in large environments maybe # Check for cleanup abilities... kills performance in large environments maybe
if ((sessions[ses][:mtime]-sessions[ses][:ctime])>300) #When longer than 5 minutes no packet was related to the session, delete it # When longer than 5 minutes no packet was related to the session, delete it
if ((sessions[ses][:mtime] - sessions[ses][:ctime]) > 300)
# too bad to this session has no action for a long time # too bad to this session has no action for a long time
purge_keys << ses purge_keys << ses
end end
@ -179,7 +175,7 @@ class BaseProtocolParser
end end
end end
return sessions[sessionid] sessions[sessionid]
end end
def get_session_src(pkt) def get_session_src(pkt)