Skip to content

Commit c2586d0

Browse files
committed
Instead of raising, offer advice on BPF filtering
Many people don't know how to disable ICMP echo responses off the top of their head. However, the problem is solvable with a decent BPF filter.
1 parent c653362 commit c2586d0

File tree

1 file changed

+4
-1
lines changed

1 file changed

+4
-1
lines changed

modules/auxiliary/server/icmp_exfil.rb

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -127,7 +127,10 @@ def icmp_listener
127127
# -(Windows) netsh firewall set opmode mode = ENABLE
128128

129129
if packet.icmp_type == 0 and packet.icmp_code == 0 and packet.ip_saddr == @iface_ip
130-
raise RuntimeError , "Dectected ICMP echo response. Disable OS ICMP handling!"
130+
print_error "Dectected ICMP echo response. You must either disable ICMP handling"
131+
print_error "or try a more restrictive BPF filter. You might try:"
132+
print_error " set BPF_FILTER icmp and not src #{datastore['LOCALIP']}"
133+
return
131134
end
132135

133136
if @record

0 commit comments

Comments
 (0)