-
Notifications
You must be signed in to change notification settings - Fork 24
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #968 from proditis/master
Update docker containers
- Loading branch information
Showing
6 changed files
with
185 additions
and
37 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,126 @@ | ||
| #!/usr/bin/perl | ||
| use Net::Pcap; | ||
| use NetPacket::Ethernet; | ||
| use NetPacket::IP; | ||
| use NetPacket::TCP; | ||
| use NetPacket::UDP; | ||
| use NetPacket::ICMP; | ||
| use Socket; | ||
| use DBI; | ||
| use strict; | ||
| $|++; | ||
| my $err; | ||
| #my $filter_str='( tcp or udp or icmp ) and ( dst net 10.0.0.0/16 )'; | ||
| my $filter_str='( tcp or udp or icmp ) and ( src net 10.10.0.0/24 and dst net 10.0.160.0/24 ) and not ( src host 10.10.0.1 )'; | ||
| # Use network device passed in program arguments or if no | ||
| # argument is passed, determine an appropriate network | ||
| # device for packet sniffing using the | ||
| # Net::Pcap::lookupdev method | ||
|
|
||
| my $dev = $ARGV[0]; | ||
| my $out=$ARGV[1]; | ||
| unless (defined $dev) { | ||
| $dev = Net::Pcap::lookupdev(\$err); | ||
| if (defined $err) { | ||
| die 'Unable to determine network device for monitoring - ', $err; | ||
| } | ||
| } | ||
| my $dsn = "DBI:mysql:database=echoCTF;host=172.24.0.253;port=3306"; | ||
| my $username = "vpnuser"; | ||
| my $password = 'vpnuserpass'; | ||
|
|
||
| # connect to MySQL database | ||
| my %attr = ( PrintError=>0, # turn off error reporting via warn() | ||
| RaiseError=>1 # report error via die() | ||
| ); | ||
| my $dbh = DBI->connect($dsn,$username,$password,\%attr); | ||
| my $sql = "INSERT INTO findingsd ( srcip, dstip,dstport, proto) VALUES (INET_ATON(?),INET_ATON(?),?,?)"; | ||
| my $sth = $dbh->prepare($sql); | ||
|
|
||
| my ($address, $netmask); | ||
| my $object; | ||
| # pcap_open_live($dev, $snaplen, $promisc, $to_ms, \$err) | ||
| # Returns a packet capture descriptor for looking at packets on the network. | ||
| # The $dev parameter specifies which network interface to capture packets from. | ||
| # The $snaplen and $promisc parameters specify the maximum number of bytes to | ||
| # capture from each packet, and whether to put the interface into promiscuous | ||
| # mode, respectively. The $to_ms parameter specifies a read timeout in | ||
| # milliseconds. The packet descriptor will be undefined if an error occurs, and | ||
| # the $err parameter will be set with an appropriate error message. | ||
| $object = Net::Pcap::pcap_open_live($dev, 1024, 0, 1, \$err); | ||
|
|
||
| unless (defined $object) { | ||
| die 'Unable to create packet capture on device ', $dev, ' - ', $err; | ||
| } | ||
|
|
||
|
|
||
| my $filter; | ||
| Net::Pcap::compile( | ||
| $object, | ||
| \$filter, | ||
| $filter_str, | ||
| 0, | ||
| 0 | ||
| ) && die 'Unable to compile packet capture filter'; | ||
| Net::Pcap::setfilter($object, $filter) && die 'Unable to set packet capture filter'; | ||
|
|
||
| Net::Pcap::loop($object, -1, \&syn_packets, '') || | ||
| die 'Unable to perform packet capture'; | ||
|
|
||
| Net::Pcap::close($object); | ||
|
|
||
| sub logPacket { | ||
| my ($srcip, $mtype, $dstip, $dstport, $prt, $color) = @_; | ||
| my $TIMESTAMP=time(); | ||
| print "$srcip => $dstip:$dstport/$prt\n"; | ||
| $sth->execute($srcip,$dstip,$dstport,$prt); | ||
| } | ||
|
|
||
| sub syn_packets { | ||
| my ($user_data, $header, $packet) = @_; | ||
|
|
||
| # Strip ethernet encapsulation of captured packet | ||
| my $eth = NetPacket::Ethernet->decode($packet); | ||
| my $ether_data = NetPacket::Ethernet::strip($packet); | ||
| # Decode contents of TCP/IP packet contained within | ||
| # captured ethernet packet | ||
| my $ip = NetPacket::IP->decode($ether_data); | ||
| my $srcport = 0; | ||
| my $dstport = 0; | ||
| my $size = $ip->{'len'}; | ||
| my $prt=""; | ||
| my $color=""; | ||
| my $mtype=""; | ||
|
|
||
| if ($ip->{'proto'}==6) { | ||
| my $decoded_packet = NetPacket::TCP->decode($ip->{'data'}); | ||
| $prt = "tcp"; | ||
| $color="#8E44AD"; | ||
| $mtype="A"; | ||
| $srcport=$decoded_packet->{'src_port'}; | ||
| $dstport=$decoded_packet->{'dest_port'}; | ||
| } | ||
| elsif($ip->{'proto'}==1) { | ||
| $color="#2E86C1"; | ||
| $prt = "icmp"; | ||
| $mtype="A"; | ||
| $dstport=0; | ||
| } | ||
| elsif($ip->{'proto'}==17) { | ||
| my $decoded_packet = NetPacket::UDP->decode($ip->{'data'}); | ||
| $prt = "udp"; | ||
| $color="#FF5733"; | ||
| $mtype="M"; | ||
| $srcport=$decoded_packet->{'src_port'}; | ||
| $dstport=$decoded_packet->{'dest_port'}; | ||
| } | ||
|
|
||
| my $srchw = $eth->{src_mac}; | ||
| my $dsthw = $eth->{dest_mac}; | ||
| my $srcip = $ip->{'src_ip'}; | ||
| my $dstip = $ip->{'dest_ip'}; | ||
| $srchw=~ s/..\K\B/:/g; | ||
| $dsthw=~ s/..\K\B/:/g; | ||
| my $TIMESTAMP=time(); | ||
| logPacket $srcip,$mtype,$dstip,$dstport,$prt,$color; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,36 @@ | ||
| [supervisord] | ||
| nodaemon=true | ||
| pidfile=/run/supervisord.pid | ||
| logfile=/var/log/supervisord.log | ||
| user=root | ||
| logfile_maxbytes=0 | ||
| [unix_http_server] | ||
| file=/var/run/supervisor.sock ; (the path to the socket file) | ||
| chmod=0700 ; sockef file mode (default 0700) | ||
|
|
||
| [supervisorctl] | ||
| serverurl=unix:///run/supervisord.sock | ||
|
|
||
| [rpcinterface:supervisor] | ||
| supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface | ||
|
|
||
| [supervisorctl] | ||
| serverurl=unix:///var/run/supervisor.sock ; use a unix:// URL for a unix socket | ||
|
|
||
| [program:findingsd] | ||
| priority = 100 | ||
| user = root | ||
| command=perl /var/www/echoCTF.RED/contrib/findingsd.pl eth2 | ||
| autostart=true | ||
| autorestart=true | ||
| stdout_logfile = /dev/null | ||
| stdout_logfile_maxbytes = 0 | ||
| stderr_logfile = /dev/null | ||
| stderr_logfile_maxbytes = 0 | ||
|
|
||
| [program:tail] | ||
| user = root | ||
| command = tail -3f /var/log/openvpn/openvpn.log | ||
| stdout_logfile=/dev/fd/1 | ||
| stdout_logfile_maxbytes=0 | ||
| redirect_stderr=true |