-
Notifications
You must be signed in to change notification settings - Fork 3
/
Copy pathlegithost.py
155 lines (135 loc) · 4.59 KB
/
legithost.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
#! /usr/bin/env python
import imp
import os
import argparse
from inspect import getmembers
from output import out
from utils import ip_to_bin, get_mac
try:
import pcap
except:
out.error("pylibpcap not found.")
out.error("$sudo pip install pylibpcap.")
out.error("Exiting.")
exit()
try:
import dpkt
except:
out.error("dpkt not found.")
out.error("$sudo pip install dpkt.")
out.error("Exiting.")
exit()
class LegitHost:
def __init__(self, ifacename, modules, listen=False):
self.mod_dir = 'modules'
self.modules = list()
self.interface = None
self.listen = listen
# Get interface to use
for iface in pcap.findalldevs():
if ifacename == iface[0]:
self.interface = iface
break
if not self.interface:
out.error("Can't find %s interface. Priveleges ?" % ifacename)
self.stop()
# Load modules
self.loadModules(modules)
def findModules(self):
modlist = [x for x in os.listdir(self.mod_dir) if x[-3:] == '.py' and x[0] != '_']
# Remove the trailing .py
return [x[:-3] for x in modlist]
def loadModules(self,modules):
out.debug("Started loading modules", 2)
# If no modules specified through command-line args, import
# all modules in modules directory.
if not modules:
modules = self.findModules()
for module in modules:
self.loadModule(module)
out.debug("Finished loading modules", 2)
def loadModule(self, name):
try:
f, pathname, desc = imp.find_module(name, [self.mod_dir])
except ImportError:
out.error("Couldn't find %s module." % name)
self.stop()
lm = imp.load_source(name, pathname)
module = [x for x in getmembers(lm) if x[0] == name][0][1]
out.debug("loaded module %s" % name, 0)
self.addModule(module)
# We add and instance of the module to the list of modules (instances)
def addModule(self, module):
self.modules.append(module(self.interface))
def startListener(self):
p = pcap.pcapObject()
p.open_live(self.getInterfaceName(), 1600, 0, 100)
out.verbose("legitHost listener started")
try:
while True:
p.dispatch(1, self.handlePackets)
except KeyboardInterrupt:
out.error("Got keyboard interrupt.")
self.stop()
def getInterfaceName(self):
return self.interface[0]
def stop(self):
# Anything to clean before exiting
out.verbose("Exiting.")
exit()
# Returns a structured packet
def parseData(self, data):
packet = dpkt.ethernet.Ethernet(data)
# Skip packets sent from our machine
if packet.dst == get_mac(self.interface[0]):
return None
# ARP
if packet.type == dpkt.ethernet.ETH_TYPE_ARP:
packet.data = dpkt.arp.ARP(str(packet.data))
# IPv4
elif packet.type == dpkt.ethernet.ETH_TYPE_IP:
packet.data = dpkt.ip.IP(str(packet.data))
# UDP
if packet.data.p == dpkt.ip.IP_PROTO_UDP:
packet.data.data = dpkt.udp.UDP(str(packet.data.data))
# LLMNR (224.0.0.252:5355), same packet format as DNS
if packet.data.dst == ip_to_bin("224.0.0.252") and packet.data.data.dport == 5355:
packet.data.data.data = dpkt.dns.DNS(str(packet.data.data.data))
# Netbios Name Service (from 137 UDP to 137 UDP)
if packet.data.data.dport == 137 and packet.data.data.dport == 137:
packet.data.data.data = dpkt.netbios.NS(str(packet.data.data.data))
# TCP
elif packet.data.p == dpkt.ip.IP_PROTO_TCP:
packet.data.data = dpkt.tcp.TCP(str(packet.data.data))
return packet
def handlePackets(self, pktlen, data, timestamp):
# First, parse the packet
packet = self.parseData(data)
if not packet:
return False
# Then send it for each module's condition
for module in self.modules:
if module.condition(packet):
if not self.listen:
out.debug("%s module accepted new packet." % module.getName(), 1)
# TODO Dispatch to another thread
module.action(packet)
else:
out.debug("Ignored matched packet for %s module." % module.getName(), 2)
def run(self):
# Listen for packets
self.startListener()
# Build configuration from commmand line parameters
if __name__ == '__main__':
parser = argparse.ArgumentParser()
parser.add_argument('-i', dest='interface', type=str, nargs=1, help='Network interface to use.', required=True)
parser.add_argument('-d', dest='debug', type=int, nargs=1, help='Debug level')
parser.add_argument('-m', dest='module', type=str, nargs='+', help='Modules list')
parser.add_argument('-l', dest='listen', action='store_true', help='Listen mode')
options = parser.parse_args()
# Set debug level
out.setLevel(0)
if options.debug:
out.setLevel(options.debug[0])
legit_host = LegitHost(options.interface[0], options.module, listen=options.listen)
legit_host.run()