bettercap 1.1.4 → 1.1.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 0302105b4b7c6f181542e22fff7662fa6b4b922b
-  data.tar.gz: b46e666f283922dbe0bdb09fd6f2883dee7d89b2
+  metadata.gz: 724a91086ccfab829ec09e9ad381a9025dfd8380
+  data.tar.gz: 59292cebacc9ed01bb85d2ce3ac5a63151fd58fc
 SHA512:
-  metadata.gz: ef42d62d1d051931e7b2ea84d56e09498e630628a1293bd3be5fc7a23d5457b57a2470896431171638bd59981ec0736a85847b359f592ca991ba378301831a34
-  data.tar.gz: ca6291a117033ab2139a616a7e8734fbf0bc5b05b57e25299b222bfceed8bcbc9785b148a988c4c059cfd4079d79b7f24d1cdfd76a439ce3c3b35f42d0c4a6d8
+  metadata.gz: 7eb4990aeac1e69a85b87ea3dcd6e09f29701efc6932668919e5ecf1ba2de0a3d2c8da97b33350a7246947eef0adf5247fbc0f44c56b1520816c95a225198720
+  data.tar.gz: b0f32c69b41f4308b1bcbe7c9119c2b307579fbe9aaa7f2abc5d29b8c8376ada977e0ca6a8a41caff9a531da8e7b83cb97d4dcb71cf4ba23f6175d23a8a35f1c

data/.gitignore

@@ -2,4 +2,9 @@
 *.swo
 *.gem
 *.sh
-.idea
+.idea
+cert.crt
+cert.key
+cert.pem
+test_https_proxy.rb
+mkchangelog.rb

data/bin/bettercap

@@ -23,6 +23,10 @@ begin
   OptionParser.new do |opts|
     opts.banner = "Usage: #{$0} [options]"
     opts.version = BetterCap::VERSION
+    
+		opts.on( '-G', '--gateway ADDRESS', 'Manually specify the gateway address, if not specified the current gateway will be retrieved and used. ' ) do |v|
+      ctx.options[:gateway] = v
+    end
 
     opts.on( '-I', '--interface IFACE', 'Network interface name - default: ' + ctx.options[:iface].to_s ) do |v|
       ctx.options[:iface] = v
@@ -53,6 +57,11 @@ begin
       ctx.options[:sniffer] = true
     end
 
+    opts.on( '--sniffer-source FILE', 'Load packets from the specified PCAP file instead of the interface ( will enable sniffer ).' ) do |v|
+      ctx.options[:sniffer] = true
+      ctx.options[:sniffer_src] = File.expand_path v
+    end
+
     opts.on( '--sniffer-pcap FILE', 'Save all packets to the specified PCAP file ( will enable sniffer ).' ) do |v|
       ctx.options[:sniffer] = true
       ctx.options[:sniffer_pcap] = File.expand_path v
@@ -131,23 +140,7 @@ begin
 
     opts.on('-h', '--help', 'Display the available options.') do
       puts opts
-      puts "\nExamples:\n".bold
-      puts " - Sniffer / Credentials Harvester\n".bold
-      puts "  Default sniffer mode, all parsers enabled:\n\n"
-      puts "    sudo bettercap -X\n".bold
-      puts "  Enable sniffer and load only specified parsers:\n\n"
-      puts "    sudo bettercap -X -P \"FTP,HTTPAUTH,MAIL,NTLMSS\"\n".bold
-      puts "  Enable sniffer + all parsers and parse local traffic as well:\n\n"
-      puts "    sudo bettercap -X -L\n".bold
-      puts " - Transparent Proxy\n".bold
-      puts "  Enable proxy on default ( 8080 ) port with no modules ( quite useless ):\n\n"
-      puts "    sudo bettercap --proxy\n".bold
-      puts "  Enable proxy and use a custom port:\n\n"
-      puts "    sudo bettercap --proxy --proxy-port=8081\n".bold
-      puts "  Enable proxy and load the module example_proxy_module.rb:\n\n"
-      puts "    sudo bettercap --proxy --proxy-module=example_proxy_module.rb\n".bold
-      puts "  Disable spoofer and enable proxy ( stand alone proxy mode ):\n\n"
-      puts "    sudo bettercap -S NONE --proxy".bold
+      puts "\nFor examples & instructions please visit " + "http://bettercap.org/features/".bold
       exit
     end
   end.parse!
@@ -168,10 +161,18 @@ begin
 
   Logger.logfile = ctx.options[:logfile]
 
+
+  if !ctx.options[:gateway].nil?
+    raise BetterCap::Error, "Invalid gateway" if !Network.is_ip?(ctx.options[:gateway])
+    ctx.gateway = ctx.options[:gateway]
+    Logger.info("Targetting manual gateway #{ctx.gateway}")
+  end
+  
   ctx.update_network
 
   if ctx.options[:target].nil?
-    Logger.info "Targeting the whole subnet #{ctx.network.to_range} ..."
+    Logger.info( "Targeting the whole subnet #{ctx.network.to_range} ..." ) unless \
+     ctx.options[:spoofer] == 'NONE' or ctx.options[:spoofer] == 'none'
 
     ctx.start_discovery_thread
   else
@@ -192,7 +193,6 @@ begin
   ctx.spoofer=Array.new
   spoofer_modules_names=ctx.options[:spoofer].split(",")
   spoofer_modules_names.each do |module_name|
-    Logger.info "Loading module : #{module_name}"
     ctx.spoofer << SpooferFactory.get_by_name( module_name )
     ctx.spoofer.last.start
   end

data/lib/bettercap.rb

@@ -12,6 +12,10 @@
 
 =end
 
+# they hate us 'cause they ain't us
+Encoding.default_external = Encoding::UTF_8
+Encoding.default_internal = Encoding::UTF_8
+
 require 'optparse'
 require 'colorize'
 require 'packetfu'

data/lib/bettercap/banner

@@ -3,4 +3,5 @@
 | '_ \ / _ \ __| __/ _ \ '__/ __/ _` | '_ \
 | |_) |  __/ |_| ||  __/ | | (_| (_| | |_) |
 |_.__/ \___|\__|\__\___|_|  \___\__,_| .__/
-                                     |_| #VERSION#
+                                     |_| #VERSION#
+http://bettercap.org/

data/lib/bettercap/context.rb

@@ -36,6 +36,7 @@ class Context
     end
 
     @options = {
+      gateway: nil,
       iface: iface,
       spoofer: 'ARP',
       half_duplex: false,
@@ -47,6 +48,7 @@ class Context
       sniffer: false,
       sniffer_pcap: nil,
       sniffer_filter: nil,
+      sniffer_src: nil,
       parsers: ['*'],
       local: false,
 
@@ -113,7 +115,7 @@ class Context
     @firewall = FirewallFactory.get_firewall
     @ifconfig = PacketFu::Utils.ifconfig @options[:iface]
     @network  = @ifconfig[:ip4_obj]
-    @gateway  = Network.get_gateway
+    @gateway  = Network.get_gateway if @gateway.nil?
 
     raise BetterCap::Error, "Could not determine IPv4 address of '#{@options[:iface]}' interface." unless !@network.nil?
 
@@ -124,7 +126,7 @@ class Context
   def start_discovery_thread
     @discovery_running = true
     @discovery_thread = Thread.new {
-      Logger.info 'Network discovery thread started.'
+      Logger.info( 'Network discovery thread started.' ) unless @options[:arpcache]
 
       while @discovery_running
         empty_list = false
@@ -158,11 +160,10 @@ class Context
     @discovery_running = false
 
     if @discovery_thread != nil
-      Logger.info 'Stopping network discovery thread ...'
+      Logger.info( 'Stopping network discovery thread ...' ) unless @options[:arpcache]
 
-      # I doubt this will ever raise an exception
       begin
-        @discovery_thread.join
+        @discovery_thread.exit
       rescue
       end
     end

data/lib/bettercap/discovery/icmp.rb

@@ -22,7 +22,7 @@ class IcmpAgent
       if RUBY_PLATFORM =~ /darwin/
         ping = Shell.execute("ping -i #{timeout} -c 2 255.255.255.255")
       elsif RUBY_PLATFORM =~ /linux/
-        ping = Shell.execute("ping -i #{timeout} -c 2 -b 255.255.255.255")
+        ping = Shell.execute("ping -i #{timeout} -c 2 -b 255.255.255.255 2> /dev/null")
       end
     }
   end

data/lib/bettercap/firewalls/linux.rb

@@ -26,10 +26,6 @@ class LinuxFirewall < IFirewall
   end
 
   def add_port_redirection( iface, proto, from, addr, to )
-    # clear nat
-    shell.execute('iptables -t nat -F')
-    # clear
-    shell.execute('iptables -F')
     # post route
     shell.execute('iptables -t nat -I POSTROUTING -s 0/0 -j MASQUERADE')
     # accept all

data/lib/bettercap/network.rb

@@ -18,7 +18,6 @@ require 'bettercap/target'
 require 'bettercap/factories/firewall_factory'
 require 'bettercap/discovery/icmp'
 require 'bettercap/discovery/udp'
-require 'bettercap/discovery/syn'
 require 'bettercap/discovery/arp'
 
 class Network
@@ -70,10 +69,8 @@ class Network
       if ctx.options[:arpcache] == false
         icmp = IcmpAgent.new timeout
         udp  = UdpAgent.new ctx.ifconfig, ctx.gateway, ctx.ifconfig[:ip_saddr]
-        syn  = SynAgent.new ctx.ifconfig, ctx.gateway, ctx.ifconfig[:ip_saddr]
         arp  = ArpAgent.new ctx.ifconfig, ctx.gateway, ctx.ifconfig[:ip_saddr]
 
-        syn.wait
         icmp.wait
         arp.wait
         udp.wait
@@ -85,8 +82,6 @@ class Network
     end
 
 =begin
-  FIXME:
-
   Apparently on Mac OSX the gem pcaprub ( or libpcap itself ) has
   a bug, so we can't use 'PacketFu::Utils::arp' since the funtion
   it's using:

data/lib/bettercap/proxy/proxy.rb

@@ -121,13 +121,14 @@ class Proxy
       total_size = opts[:request].content_length unless opts[:request].content_length.nil?
     end
 
-    buff = ""
+    buff = ''
     read = 0
 
+
     if total_size
-      chunk_size = 1024
-    else
       chunk_size = [ 1024, total_size ].min
+    else
+      chunk_size = 1024
     end
 
     if chunk_size > 0
@@ -154,11 +155,17 @@ class Proxy
 
   def html_streaming( request, response, from, to )
     buff = ''
-    loop do
-      from.read 1024, buff
 
-      break unless buff.size > 0
+    if response.content_length.nil?
+      loop do
+        from.read 1024, buff
+
+        break unless buff.size > 0
 
+        response << buff
+      end
+    else
+      from.read response.content_length, buff
       response << buff
     end
 

data/lib/bettercap/proxy/response.rb

@@ -13,11 +13,12 @@ This project is released under the GPL 3 license.
 module Proxy
 
 class Response
-  attr_reader :content_type, :content_length, :headers, :code, :headers_done
+  attr_reader :content_type, :charset, :content_length, :headers, :code, :headers_done
   attr_accessor :body
 
   def initialize
     @content_type = nil
+    @charset = 'UTF-8'
     @content_length = nil
     @body = ''
     @code = nil
@@ -43,22 +44,25 @@ class Response
   def <<(line)
     # we already parsed the heders, collect response body
     if @headers_done
-      @body += line
+      @body += line.force_encoding( @charset )
     else
       # parse the response status
       if @code.nil? and line =~ /^HTTP\/[\d\.]+\s+(.+)/
         @code = $1.chomp
 
-        # parse the content type
-      elsif line =~ /^Content-Type: ([^;]+).*/i
+      # parse the content type
+      elsif line =~ /^Content-Type:\s*([^;]+).*/i
         @content_type = $1.chomp
+        if line =~ /^.+;\s*charset=(.+)/i
+          @charset = $1.chomp
+        end
 
-        # parse content length
+      # parse content length
       elsif line =~ /^Content-Length:\s+(\d+)\s*$/i
         @content_length = $1.to_i
 
-        # last line, we're done with the headers
-      elsif line.chomp == ""
+      # last line, we're done with the headers
+      elsif line.chomp.empty?
         @headers_done = true
 
       end

data/lib/bettercap/sniffer/parsers/https.rb

@@ -14,23 +14,29 @@ require 'colorize'
 require 'resolv'
 
 class HttpsParser < BaseParser
-    def on_packet( pkt )
-        begin
-          if pkt.tcp_dst == 443
-            # the DNS resolution could take a while and block other parsers.
-            Thread.new do
-              begin
-                  hostname = Resolv.getname pkt.ip_daddr
-              rescue
-                  hostname = pkt.ip_daddr.to_s
-              end
-
-              Logger.write "[#{pkt.ip_saddr}:#{pkt.tcp_src} > #{pkt.ip_daddr}:#{pkt.tcp_dst} #{pkt.proto.last}] " +
-                           '[HTTPS] '.green +
-                           "https://#{hostname}/".yellow
-            end
+  @@prev = nil
+
+  def on_packet( pkt )
+    begin
+      if pkt.tcp_dst == 443
+        # the DNS resolution could take a while and block other parsers.
+        Thread.new do
+          begin
+              hostname = Resolv.getname pkt.ip_daddr
+          rescue
+              hostname = pkt.ip_daddr.to_s
+          end
+
+          if @@prev.nil? or @@prev != hostname
+            Logger.write "[#{pkt.ip_saddr}:#{pkt.tcp_src} > #{pkt.ip_daddr}:#{pkt.tcp_dst} #{pkt.proto.last}] " +
+                         '[HTTPS] '.green +
+                         "https://#{hostname}/".yellow
+
+            @@prev = hostname
           end
-        rescue
         end
+      end
+    rescue
     end
+  end
 end

data/lib/bettercap/sniffer/sniffer.rb

@@ -27,7 +27,7 @@ class Sniffer
 
     setup( ctx )
 
-    @@cap.stream.each do |p|
+    self.stream.each do |p|
       begin
         parsed = Packet.parse p
       rescue Exception => e
@@ -44,6 +44,16 @@ class Sniffer
 
   private
 
+  def self.stream
+    if @@ctx.options[:sniffer_src].nil?
+      @@cap.stream
+    else
+      Logger.info "Reading packets from #{@@ctx.options[:sniffer_src]} ..."
+
+      PcapFile.file_to_array @@ctx.options[:sniffer_src]
+    end
+  end
+
   def self.skip_packet?( pkt )
     !@@ctx.options[:local] and
         ( pkt.ip_saddr == @@ctx.ifconfig[:ip_saddr] or

data/lib/bettercap/spoofers/arp.rb

@@ -147,7 +147,10 @@ class ArpSpoofer < ISpoofer
     @ctx.firewall.enable_forwarding( @forwarding )
 
     @running = false
-    @spoof_thread.join
+    begin
+      @spoof_thread.exit
+    rescue
+    end
 
     Logger.info "Restoring ARP table of #{@ctx.targets.size} targets ..."
 

data/lib/bettercap/version.rb

@@ -10,6 +10,6 @@ This project is released under the GPL 3 license.
 
 =end
 module BetterCap
-  VERSION = '1.1.4'
+  VERSION = '1.1.5'
   BANNER = File.read( File.dirname(__FILE__) + '/banner' ).gsub( '#VERSION#', "v#{VERSION}")
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: bettercap
 version: !ruby/object:Gem::Version
-  version: 1.1.4
+  version: 1.1.5
 platform: ruby
 authors:
 - Simone Margaritelli
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-08-08 00:00:00.000000000 Z
+date: 2015-10-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: colorize
@@ -91,7 +91,6 @@ files:
 - lib/bettercap/discovery/arp.rb
 - lib/bettercap/discovery/base.rb
 - lib/bettercap/discovery/icmp.rb
-- lib/bettercap/discovery/syn.rb
 - lib/bettercap/discovery/udp.rb
 - lib/bettercap/error.rb
 - lib/bettercap/factories/firewall_factory.rb
@@ -142,7 +141,6 @@ files:
 - test/sniffer/parsers/url_parser_test.rb
 - test/target_test.rb
 - test/test_helper.rb
-- test_https_proxy.rb
 homepage: http://github.com/evilsocket/bettercap
 licenses:
 - GPL3

data/lib/bettercap/discovery/syn.rb

@@ -1,45 +0,0 @@
-=begin
-
-BETTERCAP
-
-Author : Simone 'evilsocket' Margaritelli
-Email  : evilsocket@gmail.com
-Blog   : http://www.evilsocket.net/
-
-This project is released under the GPL 3 license.
-
-=end
-require 'bettercap/discovery/base'
-
-# Send SYN probes trying to filling the ARP table.
-class SynAgent < BaseAgent
-  private
-
-  def send_probe( ip )
-    pkt = PacketFu::TCPPacket.new
-    pkt.ip_v      = 4
-    pkt.ip_hl     = 5
-    pkt.ip_tos	  = 0
-    pkt.ip_len	  = 20
-    pkt.ip_frag   = 0
-    pkt.ip_ttl    = 115
-    pkt.ip_proto  = 6	# TCP
-    pkt.ip_saddr  = @local_ip
-    pkt.ip_daddr  = ip
-    pkt.payload   = "\xC\x0\xF\xF\xE\xE"
-    pkt.tcp_flags.ack  = 0
-    pkt.tcp_flags.fin  = 0
-    pkt.tcp_flags.psh  = 0
-    pkt.tcp_flags.rst  = 0
-    pkt.tcp_flags.syn  = 1
-    pkt.tcp_flags.urg  = 0
-    pkt.tcp_ecn        = 0
-    pkt.tcp_win	       = 8192
-    pkt.tcp_hlen       = 5
-    pkt.tcp_dst        = rand(1024..65535)
-    pkt.recalc
-
-    pkt.to_w( @ifconfig[:iface] )
-  end
-end
-

data/test_https_proxy.rb

@@ -1,29 +0,0 @@
-require 'openssl'
-require 'socket'
-
-sock = TCPSocket.new( '172.20.10.2', 8083 )
-
-ctx = OpenSSL::SSL::SSLContext.new
-
-# we need this? :P ctx.set_params(verify_mode: OpenSSL::SSL::VERIFY_PEER)
-
-socket = OpenSSL::SSL::SSLSocket.new(sock, ctx).tap do |socket|
-  socket.sync_close = true
-  socket.connect
-
-  socket.write "GET / HTTP/1.1\n" +
-               "Host: www.facebook.com\n" +
-               "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\n" +
-               "Accept-encoding: gzip, deflate, sdch\n" +
-               "Accept-language: it-IT,it;q=0.8,en-US;q=0.6,en;q=0.4,la;q=0.2\n" +
-               "Cache-control: max-age=0\n" +
-               "User-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.125 Safari/537.36\n" +
-               "\n\n"
-
-  while line = socket.gets # Read lines from socket
-    puts line         # and print them
-  end
-
-  socket.close
-end
-