github/bettercap
1
0
Fork 0
mirror of https://github.com/bettercap/bettercap synced 2025-08-22 06:23:18 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #2 from GoSecure/rdp-errors

Browse source 
Handled common errors in rdp proxy
This commit is contained in:
Alexandre Beaulieu 2019-05-14 14:51:33 -04:00 • committed by GitHub
commit b3154e907e
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 29 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

34
modules/rdp_proxy/rdp_proxy_linux_amd64.go
View file

@ -67,7 +67,7 @@ mod.AddParam(session.NewIntParameter("rdp.proxy.start", "40000", "Starting port
mod.AddParam(session.NewStringParameter("rdp.proxy.command", "pyrdp-mitm.py", "", "The PyRDP base command to launch the man-in-the-middle."))
mod.AddParam(session.NewStringParameter("rdp.proxy.out", "./", "", "The output directory for PyRDP artifacts."))
mod.AddParam(session.NewStringParameter("rdp.proxy.targets", session.ParamSubnet, "", "Comma separated list of IP addresses to proxy to, also supports nmap style IP ranges."))
mod.AddParam(session.NewStringParameter("rdp.proxy.regexp", "(?i)(cookie:|mstshash=|clipboard data|client info|credential|username|password)", "", "Print PyRDP logs matching this regular expression."))
mod.AddParam(session.NewStringParameter("rdp.proxy.regexp", "(?i)(cookie:|mstshash=|clipboard data|client info|credential|username|password|error)", "", "Print PyRDP logs matching this regular expression."))
return mod
}
@ -85,13 +85,11 @@ func (mod RdpProxy) Author() string {
}
func (mod *RdpProxy) isTarget(ip string) bool {
for _, addr := range mod.targets {
if addr.String() == ip {
return true
}
}
return false
}
@ -166,7 +164,21 @@ func (mod *RdpProxy) configureFirewall(enable bool) (err error) {
return err
}
}
return
}
// Fixes a bug that may come up when interrupting the application too quickly.
func (mod *RdpProxy) repairFirewall() (err error) {
rules := [][]string{
{ "-t", "nat", "-F", "BCAPRDP" },
{ "-t", "nat", "-X", "BCAPRDP" },
}
for _, rule := range rules {
if _, err = core.Exec("iptables", rule); err != nil {
return err
}
}
return
}
@ -215,7 +227,11 @@ func (mod *RdpProxy) Configure() (err error) {
} else if err = mod.queue.SetMode(nfqueue.NFQNL_COPY_PACKET); err != nil {
return
} else if err = mod.configureFirewall(true); err != nil {
return
// Attempt to repair firewall, then retry once
mod.repairFirewall()
if err = mod.configureFirewall(true); err != nil {
return
}
}
return nil
}
@ -247,7 +263,15 @@ func (mod *RdpProxy) handleRdpConnection(payload *nfqueue.Payload) int {
stderrPipe, _ := cmd.StderrPipe()
if err := cmd.Start(); err != nil {
// XXX: Failed to start the rdp proxy... accept connection transparently and log?
// Wont't handle things like "port already in use" since it happens at runtime
mod.Error("PyRDP Start error : %v", err.Error())
mod.Info("Failed to start PyRDP, won't intercept target %s", ips)
// Add an exception in the firewall to avoid intercepting packets to this destination and port
mod.doReturn(dst.String(), dport, true)
payload.SetVerdict(nfqueue.NF_DROP)
return 0
}
// Use goroutines to keep logging each instance of PyRDP