module Msf ### # # This module provides methods for receiving raw packets. # Please see the pcaprub documentation for more information. # ### module Exploit::Capture # # Initializes an instance of an exploit module that captures traffic # def initialize(info = {}) super register_options( [ OptString.new('INTERFACE', [false, 'The name of the interface']), OptString.new('FILTER', [false, 'The filter string for capturing traffic']), OptInt.new('SNAPLEN', [true, 'The number of bytes to capture', 65535]), OptInt.new('TIMEOUT', [true, 'The number of seconds to wait for new data', 1]) ], Msf::Exploit::Capture ) require 'packetfu' begin require 'pcaprub' @pcaprub_loaded = true rescue ::Exception => e @pcaprub_loaded = false @pcaprub_error = e end end def stats_recv return(0) if not self.capture self.capture.stats['recv'] end def stats_drop return(0) if not self.capture self.capture.stats['drop'] end def stats_ifdrop return(0) if not self.capture self.capture.stats['ifdrop'] end # # Opens a handle to the specified device # def open_pcap if (not @pcaprub_loaded) print_status("The Pcaprub module is not available: #{@pcaprub_error.to_s}") raise RuntimeError, "Pcaprub not available" end # Capture device dev = datastore['INTERFACE'] || ::Pcap.lookupdev len = (datastore['SNAPLEN'] || 65535).to_i tim = (datastore['TIMEOUT'] || 0).to_i fil = datastore['FILTER'] # XXX: Force the interface to be up system("ifconfig", dev, "up") self.capture = ::Pcap.open_live(dev, len, true, tim) if (not self.capture) raise RuntimeError, "Could not open the device interface" end self.capture.setfilter(fil) if fil end def close_pcap return if not self.capture self.capture.close self.capture = nil end def capture_extract_ies(raw) set = {} ret = 0 idx = 0 len = 0 while (idx < raw.length) len = raw[idx+1] return set if not len set[ raw[idx] ] ||= [] set[ raw[idx] ].push(raw[idx + 2, len]) idx += len + 2 end return set end def each_packet return if not self.capture self.capture.each do |pkt| yield(PacketFu::Packet.parse(pkt)) end end attr_accessor :capture end end