new: krb5 krb-as-req parser

modules/net_sniff_krb5.go

@@ -0,0 +1,40 @@
+package modules
+
+import (
+	"encoding/asn1"
+
+	"github.com/evilsocket/bettercap-ng/core"
+	"github.com/evilsocket/bettercap-ng/packets"
+
+	"github.com/google/gopacket"
+	"github.com/google/gopacket/layers"
+)
+
+func krb5Parser(ip *layers.IPv4, pkt gopacket.Packet, udp *layers.UDP) bool {
+	if udp.DstPort != 88 {
+		return false
+	}
+
+	var req packets.Krb5Request
+	_, err := asn1.UnmarshalWithParams(udp.Payload, &req, packets.Krb5AsReqParam)
+	if err != nil {
+		return false
+	}
+
+	s, err := req.String()
+	NewSnifferEvent(
+		pkt.Metadata().Timestamp,
+		"krb5",
+		ip.SrcIP.String(),
+		ip.DstIP.String(),
+		SniffData{
+			"req": req,
+		},
+		"%s %s -> %s : %s",
+		core.W(core.BG_RED+core.FG_BLACK, "krb-as-req"),
+		vIP(ip.SrcIP),
+		vIP(ip.DstIP),
+		s,
+	).Push()
+	return true
+}

modules/net_sniff_parsers.go

@@ -44,9 +44,9 @@ func udpParser(ip *layers.IPv4, pkt gopacket.Packet, verbose bool) {
 
 	if dnsParser(ip, pkt, udp) {
 		return
-	}
-
-	if verbose == true {
+	} else if krb5Parser(ip, pkt, udp) {
+		return
+	} else if verbose == true {
 		NewSnifferEvent(
 			pkt.Metadata().Timestamp,
 			"udp",