Refactoring modules

modules/net_sniff/net_sniff_ntlm.go

@@ -0,0 +1,67 @@
+package net_sniff
+
+import (
+	"regexp"
+	"strings"
+
+	"github.com/bettercap/bettercap/packets"
+
+	"github.com/google/gopacket"
+	"github.com/google/gopacket/layers"
+
+	"github.com/evilsocket/islazy/tui"
+)
+
+var (
+	ntlmRe  = regexp.MustCompile("(WWW-|Proxy-|)(Authenticate|Authorization): (NTLM|Negotiate)")
+	challRe = regexp.MustCompile("(WWW-|Proxy-|)(Authenticate): (NTLM|Negotiate)")
+	respRe  = regexp.MustCompile("(WWW-|Proxy-|)(Authorization): (NTLM|Negotiate)")
+	ntlm    = packets.NewNTLMState()
+)
+
+func isNtlm(s string) bool {
+	return ntlmRe.FindString(s) != ""
+}
+
+func isChallenge(s string) bool {
+	return challRe.FindString(s) != ""
+}
+
+func isResponse(s string) bool {
+	return respRe.FindString(s) != ""
+}
+
+func ntlmParser(ip *layers.IPv4, pkt gopacket.Packet, tcp *layers.TCP) bool {
+	data := tcp.Payload
+	ok := false
+
+	for _, line := range strings.Split(string(data), "\r\n") {
+		if isNtlm(line) {
+			tokens := strings.Split(line, " ")
+			if len(tokens) != 3 {
+				continue
+			}
+			if isChallenge(line) {
+				ok = true
+				ntlm.AddServerResponse(tcp.Ack, tokens[2])
+			} else if isResponse(line) {
+				ok = true
+				ntlm.AddClientResponse(tcp.Seq, tokens[2], func(data packets.NTLMChallengeResponseParsed) {
+					NewSnifferEvent(
+						pkt.Metadata().Timestamp,
+						"ntlm.response",
+						ip.SrcIP.String(),
+						ip.DstIP.String(),
+						nil,
+						"%s %s > %s | %s",
+						tui.Wrap(tui.BACKDARKGRAY+tui.FOREWHITE, "ntlm.response"),
+						vIP(ip.SrcIP),
+						vIP(ip.DstIP),
+						data.LcString(),
+					).Push()
+				})
+			}
+		}
+	}
+	return ok
+}