github/bettercap
1
0
Fork 0
mirror of https://github.com/bettercap/bettercap synced 2025-08-14 10:46:57 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions

new: new c2 module, first draft

Browse source
This commit is contained in:
Simone Margaritelli 2021-01-27 00:17:25 +01:00
commit 583a54c194
23 changed files with 579 additions and 163 deletions
Download patch file Download diff file Expand all files Collapse all files

61
modules/events_stream/events_rotation.go Normal file
View file

@ -0,0 +1,61 @@
package events_stream
import (
"fmt"
"github.com/evilsocket/islazy/zip"
"os"
"time"
)
func (mod *EventsStream) doRotation() {
if mod.output == os.Stdout {
return
} else if !mod.rotation.Enabled {
return
}
output, isFile := mod.output.(*os.File)
if !isFile {
return
}
mod.rotation.Lock()
defer mod.rotation.Unlock()
doRotate := false
if info, err := output.Stat(); err == nil {
if mod.rotation.How == "size" {
doRotate = float64(info.Size()) >= float64(mod.rotation.Period*1024*1024)
} else if mod.rotation.How == "time" {
doRotate = info.ModTime().Unix()%int64(mod.rotation.Period) == 0
}
}
if doRotate {
var err error
name := fmt.Sprintf("%s-%s", mod.outputName, time.Now().Format(mod.rotation.Format))
if err := output.Close(); err != nil {
mod.Printf("could not close log for rotation: %s\n", err)
return
}
if err := os.Rename(mod.outputName, name); err != nil {
mod.Printf("could not rename %s to %s: %s\n", mod.outputName, name, err)
} else if mod.rotation.Compress {
zipName := fmt.Sprintf("%s.zip", name)
if err = zip.Files(zipName, []string{name}); err != nil {
mod.Printf("error creating %s: %s", zipName, err)
} else if err = os.Remove(name); err != nil {
mod.Printf("error deleting %s: %s", name, err)
}
}
mod.output, err = os.OpenFile(mod.outputName, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)
if err != nil {
mod.Printf("could not open %s: %s", mod.outputName, err)
}
}
}

13
modules/events_stream/events_stream.go
View file

@ -2,6 +2,7 @@ package events_stream
import (
"fmt"
"io"
"os"
"strconv"
"sync"
@ -27,7 +28,7 @@ type EventsStream struct {
session.SessionModule
timeFormat string
outputName string
output *os.File
output io.Writer
rotation rotation
triggerList *TriggerList
waitFor string
@ -149,13 +150,13 @@ func NewEventsStream(s *session.Session) *EventsStream {
"Print the list of filters used to ignore events.",
func(args []string) error {
if mod.Session.EventsIgnoreList.Empty() {
fmt.Printf("Ignore filters list is empty.\n")
mod.Printf("Ignore filters list is empty.\n")
} else {
mod.Session.EventsIgnoreList.RLock()
defer mod.Session.EventsIgnoreList.RUnlock()
for _, filter := range mod.Session.EventsIgnoreList.Filters() {
fmt.Printf(" '%s'\n", string(filter))
mod.Printf(" '%s'\n", string(filter))
}
}
return nil
@ -322,7 +323,7 @@ func (mod *EventsStream) Show(limit int) error {
}
if numSelected := len(selected); numSelected > 0 {
fmt.Println()
mod.Printf("\n")
for i := range selected {
mod.View(selected[numSelected-1-i], false)
}
@ -360,7 +361,9 @@ func (mod *EventsStream) Stop() error {
return mod.SetRunning(false, func() {
mod.quit <- true
if mod.output != os.Stdout {
mod.output.Close()
if fp, ok := mod.output.(*os.File); ok {
fp.Close()
}
}
})
}

4
modules/events_stream/events_triggers.go
View file

@ -1,8 +1,6 @@
package events_stream
import (
"os"
"github.com/bettercap/bettercap/session"
"github.com/evilsocket/islazy/tui"
@ -41,7 +39,7 @@ func (mod *EventsStream) showTriggers() error {
})
if len(rows) > 0 {
tui.Table(os.Stdout, colNames, rows)
tui.Table(mod.Session.Events.Stdout, colNames, rows)
mod.Session.Refresh()
}

113
modules/events_stream/events_view.go
View file

@ -2,12 +2,11 @@ package events_stream
import (
"fmt"
"os"
"strings"
"time"
"github.com/bettercap/bettercap/network"
"github.com/bettercap/bettercap/session"
"io"
"os"
"strings"
"github.com/bettercap/bettercap/modules/net_sniff"
"github.com/bettercap/bettercap/modules/syn_scan"
@ -15,18 +14,17 @@ import (
"github.com/google/go-github/github"
"github.com/evilsocket/islazy/tui"
"github.com/evilsocket/islazy/zip"
)
func (mod *EventsStream) viewLogEvent(e session.Event) {
fmt.Fprintf(mod.output, "[%s] [%s] [%s] %s\n",
func (mod *EventsStream) viewLogEvent(output io.Writer, e session.Event) {
fmt.Fprintf(output, "[%s] [%s] [%s] %s\n",
e.Time.Format(mod.timeFormat),
tui.Green(e.Tag),
e.Label(),
e.Data.(session.LogMessage).Message)
}
func (mod *EventsStream) viewEndpointEvent(e session.Event) {
func (mod *EventsStream) viewEndpointEvent(output io.Writer, e session.Event) {
t := e.Data.(*network.Endpoint)
vend := ""
name := ""
@ -42,7 +40,7 @@ func (mod *EventsStream) viewEndpointEvent(e session.Event) {
}
if e.Tag == "endpoint.new" {
fmt.Fprintf(mod.output, "[%s] [%s] endpoint %s%s detected as %s%s.\n",
fmt.Fprintf(output, "[%s] [%s] endpoint %s%s detected as %s%s.\n",
e.Time.Format(mod.timeFormat),
tui.Green(e.Tag),
tui.Bold(t.IpAddress),
@ -50,7 +48,7 @@ func (mod *EventsStream) viewEndpointEvent(e session.Event) {
tui.Green(t.HwAddress),
tui.Dim(vend))
} else if e.Tag == "endpoint.lost" {
fmt.Fprintf(mod.output, "[%s] [%s] endpoint %s%s %s%s lost.\n",
fmt.Fprintf(output, "[%s] [%s] endpoint %s%s %s%s lost.\n",
e.Time.Format(mod.timeFormat),
tui.Green(e.Tag),
tui.Red(t.IpAddress),
@ -58,127 +56,84 @@ func (mod *EventsStream) viewEndpointEvent(e session.Event) {
tui.Green(t.HwAddress),
tui.Dim(vend))
} else {
fmt.Fprintf(mod.output, "[%s] [%s] %s\n",
fmt.Fprintf(output, "[%s] [%s] %s\n",
e.Time.Format(mod.timeFormat),
tui.Green(e.Tag),
t.String())
}
}
func (mod *EventsStream) viewModuleEvent(e session.Event) {
func (mod *EventsStream) viewModuleEvent(output io.Writer, e session.Event) {
if *mod.Session.Options.Debug {
fmt.Fprintf(mod.output, "[%s] [%s] %s\n",
fmt.Fprintf(output, "[%s] [%s] %s\n",
e.Time.Format(mod.timeFormat),
tui.Green(e.Tag),
e.Data)
}
}
func (mod *EventsStream) viewSnifferEvent(e session.Event) {
func (mod *EventsStream) viewSnifferEvent(output io.Writer, e session.Event) {
if strings.HasPrefix(e.Tag, "net.sniff.http.") {
mod.viewHttpEvent(e)
mod.viewHttpEvent(output, e)
} else {
fmt.Fprintf(mod.output, "[%s] [%s] %s\n",
fmt.Fprintf(output, "[%s] [%s] %s\n",
e.Time.Format(mod.timeFormat),
tui.Green(e.Tag),
e.Data.(net_sniff.SnifferEvent).Message)
}
}
func (mod *EventsStream) viewSynScanEvent(e session.Event) {
func (mod *EventsStream) viewSynScanEvent(output io.Writer, e session.Event) {
se := e.Data.(syn_scan.SynScanEvent)
fmt.Fprintf(mod.output, "[%s] [%s] found open port %d for %s\n",
fmt.Fprintf(output, "[%s] [%s] found open port %d for %s\n",
e.Time.Format(mod.timeFormat),
tui.Green(e.Tag),
se.Port,
tui.Bold(se.Address))
}
func (mod *EventsStream) viewUpdateEvent(e session.Event) {
func (mod *EventsStream) viewUpdateEvent(output io.Writer, e session.Event) {
update := e.Data.(*github.RepositoryRelease)
fmt.Fprintf(mod.output, "[%s] [%s] an update to version %s is available at %s\n",
fmt.Fprintf(output, "[%s] [%s] an update to version %s is available at %s\n",
e.Time.Format(mod.timeFormat),
tui.Bold(tui.Yellow(e.Tag)),
tui.Bold(*update.TagName),
*update.HTMLURL)
}
func (mod *EventsStream) doRotation() {
if mod.output == os.Stdout {
return
} else if !mod.rotation.Enabled {
return
}
mod.rotation.Lock()
defer mod.rotation.Unlock()
doRotate := false
if info, err := mod.output.Stat(); err == nil {
if mod.rotation.How == "size" {
doRotate = float64(info.Size()) >= float64(mod.rotation.Period*1024*1024)
} else if mod.rotation.How == "time" {
doRotate = info.ModTime().Unix()%int64(mod.rotation.Period) == 0
}
}
if doRotate {
var err error
name := fmt.Sprintf("%s-%s", mod.outputName, time.Now().Format(mod.rotation.Format))
if err := mod.output.Close(); err != nil {
fmt.Printf("could not close log for rotation: %s\n", err)
return
}
if err := os.Rename(mod.outputName, name); err != nil {
fmt.Printf("could not rename %s to %s: %s\n", mod.outputName, name, err)
} else if mod.rotation.Compress {
zipName := fmt.Sprintf("%s.zip", name)
if err = zip.Files(zipName, []string{name}); err != nil {
fmt.Printf("error creating %s: %s", zipName, err)
} else if err = os.Remove(name); err != nil {
fmt.Printf("error deleting %s: %s", name, err)
}
}
mod.output, err = os.OpenFile(mod.outputName, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)
if err != nil {
fmt.Printf("could not open %s: %s", mod.outputName, err)
}
}
}
func (mod *EventsStream) View(e session.Event, refresh bool) {
func (mod *EventsStream) Render(output io.Writer, e session.Event) {
var err error
if err, mod.timeFormat = mod.StringParam("events.stream.time.format"); err != nil {
fmt.Fprintf(mod.output, "%v", err)
fmt.Fprintf(output, "%v", err)
mod.timeFormat = "15:04:05"
}
if e.Tag == "sys.log" {
mod.viewLogEvent(e)
mod.viewLogEvent(output, e)
} else if strings.HasPrefix(e.Tag, "endpoint.") {
mod.viewEndpointEvent(e)
mod.viewEndpointEvent(output, e)
} else if strings.HasPrefix(e.Tag, "wifi.") {
mod.viewWiFiEvent(e)
mod.viewWiFiEvent(output, e)
} else if strings.HasPrefix(e.Tag, "ble.") {
mod.viewBLEEvent(e)
mod.viewBLEEvent(output, e)
} else if strings.HasPrefix(e.Tag, "hid.") {
mod.viewHIDEvent(e)
mod.viewHIDEvent(output, e)
} else if strings.HasPrefix(e.Tag, "mod.") {
mod.viewModuleEvent(e)
mod.viewModuleEvent(output, e)
} else if strings.HasPrefix(e.Tag, "net.sniff.") {
mod.viewSnifferEvent(e)
mod.viewSnifferEvent(output, e)
} else if e.Tag == "syn.scan" {
mod.viewSynScanEvent(e)
mod.viewSynScanEvent(output, e)
} else if e.Tag == "update.available" {
mod.viewUpdateEvent(e)
mod.viewUpdateEvent(output, e)
} else {
fmt.Fprintf(mod.output, "[%s] [%s] %v\n", e.Time.Format(mod.timeFormat), tui.Green(e.Tag), e)
fmt.Fprintf(output, "[%s] [%s] %v\n", e.Time.Format(mod.timeFormat), tui.Green(e.Tag), e)
}
}
func (mod *EventsStream) View(e session.Event, refresh bool) {
mod.Render(mod.output, e)
if refresh && mod.output == os.Stdout {
mod.Session.Refresh()

13
modules/events_stream/events_view_ble.go
View file

@ -4,6 +4,7 @@ package events_stream
import (
"fmt"
"io"
"github.com/bettercap/bettercap/network"
"github.com/bettercap/bettercap/session"
@ -11,7 +12,7 @@ import (
"github.com/evilsocket/islazy/tui"
)
func (mod *EventsStream) viewBLEEvent(e session.Event) {
func (mod *EventsStream) viewBLEEvent(output io.Writer, e session.Event) {
if e.Tag == "ble.device.new" {
dev := e.Data.(*network.BLEDevice)
name := dev.Device.Name()
@ -23,7 +24,7 @@ func (mod *EventsStream) viewBLEEvent(e session.Event) {
vend = fmt.Sprintf(" (%s)", tui.Yellow(vend))
}
fmt.Fprintf(mod.output, "[%s] [%s] new BLE device%s detected as %s%s %s.\n",
fmt.Fprintf(output, "[%s] [%s] new BLE device%s detected as %s%s %s.\n",
e.Time.Format(mod.timeFormat),
tui.Green(e.Tag),
name,
@ -41,15 +42,11 @@ func (mod *EventsStream) viewBLEEvent(e session.Event) {
vend = fmt.Sprintf(" (%s)", tui.Yellow(vend))
}
fmt.Fprintf(mod.output, "[%s] [%s] BLE device%s %s%s lost.\n",
fmt.Fprintf(output, "[%s] [%s] BLE device%s %s%s lost.\n",
e.Time.Format(mod.timeFormat),
tui.Green(e.Tag),
name,
dev.Device.ID(),
vend)
} /* else {
fmt.Fprintf(s.output,"[%s] [%s]\n",
e.Time.Format(mod.timeFormat),
tui.Green(e.Tag))
} */
}
}

2
modules/events_stream/events_view_ble_unsupported.go
View file

@ -6,6 +6,6 @@ import (
"github.com/bettercap/bettercap/session"
)
func (mod *EventsStream) viewBLEEvent(e session.Event) {
func (mod *EventsStream) viewBLEEvent(output io.Writer, e session.Event) {
}

7
modules/events_stream/events_view_hid.go
View file

@ -2,6 +2,7 @@ package events_stream
import (
"fmt"
"io"
"github.com/bettercap/bettercap/network"
"github.com/bettercap/bettercap/session"
@ -9,16 +10,16 @@ import (
"github.com/evilsocket/islazy/tui"
)
func (mod *EventsStream) viewHIDEvent(e session.Event) {
func (mod *EventsStream) viewHIDEvent(output io.Writer, e session.Event) {
dev := e.Data.(*network.HIDDevice)
if e.Tag == "hid.device.new" {
fmt.Fprintf(mod.output, "[%s] [%s] new HID device %s detected on channel %s.\n",
fmt.Fprintf(output, "[%s] [%s] new HID device %s detected on channel %s.\n",
e.Time.Format(mod.timeFormat),
tui.Green(e.Tag),
tui.Bold(dev.Address),
dev.Channels())
} else if e.Tag == "hid.device.lost" {
fmt.Fprintf(mod.output, "[%s] [%s] HID device %s lost.\n",
fmt.Fprintf(output, "[%s] [%s] HID device %s lost.\n",
e.Time.Format(mod.timeFormat),
tui.Green(e.Tag),
tui.Red(dev.Address))

19
modules/events_stream/events_view_http.go
View file

@ -6,6 +6,7 @@ import (
"encoding/hex"
"encoding/json"
"fmt"
"io"
"net/url"
"regexp"
"strings"
@ -128,11 +129,11 @@ func (mod *EventsStream) dumpRaw(body []byte) string {
return "\n" + hex.Dump(body) + "\n"
}
func (mod *EventsStream) viewHttpRequest(e session.Event) {
func (mod *EventsStream) viewHttpRequest(output io.Writer, e session.Event) {
se := e.Data.(net_sniff.SnifferEvent)
req := se.Data.(net_sniff.HTTPRequest)
fmt.Fprintf(mod.output, "[%s] [%s] %s\n",
fmt.Fprintf(output, "[%s] [%s] %s\n",
e.Time.Format(mod.timeFormat),
tui.Green(e.Tag),
se.Message)
@ -166,15 +167,15 @@ func (mod *EventsStream) viewHttpRequest(e session.Event) {
}
}
fmt.Fprintf(mod.output, "\n%s\n", dump)
fmt.Fprintf(output, "\n%s\n", dump)
}
}
func (mod *EventsStream) viewHttpResponse(e session.Event) {
func (mod *EventsStream) viewHttpResponse(output io.Writer, e session.Event) {
se := e.Data.(net_sniff.SnifferEvent)
res := se.Data.(net_sniff.HTTPResponse)
fmt.Fprintf(mod.output, "[%s] [%s] %s\n",
fmt.Fprintf(output, "[%s] [%s] %s\n",
e.Time.Format(mod.timeFormat),
tui.Green(e.Tag),
se.Message)
@ -198,14 +199,14 @@ func (mod *EventsStream) viewHttpResponse(e session.Event) {
}
}
fmt.Fprintf(mod.output, "\n%s\n", dump)
fmt.Fprintf(output, "\n%s\n", dump)
}
}
func (mod *EventsStream) viewHttpEvent(e session.Event) {
func (mod *EventsStream) viewHttpEvent(output io.Writer, e session.Event) {
if e.Tag == "net.sniff.http.request" {
mod.viewHttpRequest(e)
mod.viewHttpRequest(output, e)
} else if e.Tag == "net.sniff.http.response" {
mod.viewHttpResponse(e)
mod.viewHttpResponse(output, e)
}
}

35
modules/events_stream/events_view_wifi.go
View file

@ -3,6 +3,7 @@ package events_stream
import (
"fmt"
"github.com/bettercap/bettercap/modules/wifi"
"io"
"strings"
"github.com/bettercap/bettercap/network"
@ -11,7 +12,7 @@ import (
"github.com/evilsocket/islazy/tui"
)
func (mod *EventsStream) viewWiFiApEvent(e session.Event) {
func (mod *EventsStream) viewWiFiApEvent(output io.Writer, e session.Event) {
ap := e.Data.(*network.AccessPoint)
vend := ""
if ap.Vendor != "" {
@ -23,7 +24,7 @@ func (mod *EventsStream) viewWiFiApEvent(e session.Event) {
}
if e.Tag == "wifi.ap.new" {
fmt.Fprintf(mod.output, "[%s] [%s] wifi access point %s%s detected as %s%s.\n",
fmt.Fprintf(output, "[%s] [%s] wifi access point %s%s detected as %s%s.\n",
e.Time.Format(mod.timeFormat),
tui.Green(e.Tag),
tui.Bold(ap.ESSID()),
@ -31,20 +32,20 @@ func (mod *EventsStream) viewWiFiApEvent(e session.Event) {
tui.Green(ap.BSSID()),
tui.Dim(vend))
} else if e.Tag == "wifi.ap.lost" {
fmt.Fprintf(mod.output, "[%s] [%s] wifi access point %s (%s) lost.\n",
fmt.Fprintf(output, "[%s] [%s] wifi access point %s (%s) lost.\n",
e.Time.Format(mod.timeFormat),
tui.Green(e.Tag),
tui.Red(ap.ESSID()),
ap.BSSID())
} else {
fmt.Fprintf(mod.output, "[%s] [%s] %s\n",
fmt.Fprintf(output, "[%s] [%s] %s\n",
e.Time.Format(mod.timeFormat),
tui.Green(e.Tag),
ap.String())
}
}
func (mod *EventsStream) viewWiFiClientProbeEvent(e session.Event) {
func (mod *EventsStream) viewWiFiClientProbeEvent(output io.Writer, e session.Event) {
probe := e.Data.(wifi.ProbeEvent)
desc := ""
if probe.FromAlias != "" {
@ -57,7 +58,7 @@ func (mod *EventsStream) viewWiFiClientProbeEvent(e session.Event) {
rssi = fmt.Sprintf(" (%d dBm)", probe.RSSI)
}
fmt.Fprintf(mod.output, "[%s] [%s] station %s%s is probing for SSID %s%s\n",
fmt.Fprintf(output, "[%s] [%s] station %s%s is probing for SSID %s%s\n",
e.Time.Format(mod.timeFormat),
tui.Green(e.Tag),
probe.FromAddr,
@ -66,7 +67,7 @@ func (mod *EventsStream) viewWiFiClientProbeEvent(e session.Event) {
tui.Yellow(rssi))
}
func (mod *EventsStream) viewWiFiHandshakeEvent(e session.Event) {
func (mod *EventsStream) viewWiFiHandshakeEvent(output io.Writer, e session.Event) {
hand := e.Data.(wifi.HandshakeEvent)
from := hand.Station
@ -86,7 +87,7 @@ func (mod *EventsStream) viewWiFiHandshakeEvent(e session.Event) {
what += " (half)"
}
fmt.Fprintf(mod.output, "[%s] [%s] captured %s -> %s %s to %s\n",
fmt.Fprintf(output, "[%s] [%s] captured %s -> %s %s to %s\n",
e.Time.Format(mod.timeFormat),
tui.Green(e.Tag),
from,
@ -95,20 +96,20 @@ func (mod *EventsStream) viewWiFiHandshakeEvent(e session.Event) {
hand.File)
}
func (mod *EventsStream) viewWiFiClientEvent(e session.Event) {
func (mod *EventsStream) viewWiFiClientEvent(output io.Writer, e session.Event) {
ce := e.Data.(wifi.ClientEvent)
ce.Client.Alias = mod.Session.Lan.GetAlias(ce.Client.BSSID())
if e.Tag == "wifi.client.new" {
fmt.Fprintf(mod.output, "[%s] [%s] new station %s detected for %s (%s)\n",
fmt.Fprintf(output, "[%s] [%s] new station %s detected for %s (%s)\n",
e.Time.Format(mod.timeFormat),
tui.Green(e.Tag),
ce.Client.String(),
tui.Bold(ce.AP.ESSID()),
tui.Dim(ce.AP.BSSID()))
} else if e.Tag == "wifi.client.lost" {
fmt.Fprintf(mod.output, "[%s] [%s] station %s disconnected from %s (%s)\n",
fmt.Fprintf(output, "[%s] [%s] station %s disconnected from %s (%s)\n",
e.Time.Format(mod.timeFormat),
tui.Green(e.Tag),
ce.Client.String(),
@ -117,16 +118,16 @@ func (mod *EventsStream) viewWiFiClientEvent(e session.Event) {
}
}
func (mod *EventsStream) viewWiFiEvent(e session.Event) {
func (mod *EventsStream) viewWiFiEvent(output io.Writer, e session.Event) {
if strings.HasPrefix(e.Tag, "wifi.ap.") {
mod.viewWiFiApEvent(e)
mod.viewWiFiApEvent(output, e)
} else if e.Tag == "wifi.client.probe" {
mod.viewWiFiClientProbeEvent(e)
mod.viewWiFiClientProbeEvent(output, e)
} else if e.Tag == "wifi.client.handshake" {
mod.viewWiFiHandshakeEvent(e)
mod.viewWiFiHandshakeEvent(output, e)
} else if e.Tag == "wifi.client.new" || e.Tag == "wifi.client.lost" {
mod.viewWiFiClientEvent(e)
mod.viewWiFiClientEvent(output, e)
} else {
fmt.Fprintf(mod.output, "[%s] [%s] %v\n", e.Time.Format(mod.timeFormat), tui.Green(e.Tag), e)
fmt.Fprintf(output, "[%s] [%s] %v\n", e.Time.Format(mod.timeFormat), tui.Green(e.Tag), e)
}
}