Initial public release

Full BigBrother network implant - passive SOC + active exploitation. Personal identifiers removed; all capabilities intact. See README.md for setup and docs/deployment.md for detailed deployment.
2026-06-26 09:52:50 -04:00
commit ccc6b729de
175 changed files with 47941 additions and 0 deletions
@@ -0,0 +1,134 @@
+#!/usr/bin/env bash
+# BigBrother Operator Script — Extract Files from PCAPs
+#
+# Uses tshark to extract transferred files from PCAP captures.
+# Supports HTTP objects, SMB file transfers, FTP data, and TFTP.
+#
+# Usage: ./extract_files.sh <pcap_dir> [output_dir]
+#
+# Examples:
+#   ./extract_files.sh ./bb-pull-20240115/pcaps
+#   ./extract_files.sh /opt/cases/acme/pcaps /opt/cases/acme/extracted
+#
+# Requires: tshark (Wireshark CLI)
+
+set -euo pipefail
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+CYAN='\033[0;36m'
+NC='\033[0m'
+
+# ---------------------------------------------------------------------------
+# Arguments
+# ---------------------------------------------------------------------------
+
+PCAP_DIR="${1:-}"
+OUTPUT_DIR="${2:-$(pwd)/extracted-files-$(date +%Y%m%d-%H%M%S)}"
+
+if [[ -z "$PCAP_DIR" ]]; then
+    echo -e "${RED}Usage: $0 <pcap_dir> [output_dir]${NC}"
+    exit 1
+fi
+
+if [[ ! -d "$PCAP_DIR" ]]; then
+    echo -e "${RED}[-] PCAP directory not found: $PCAP_DIR${NC}"
+    exit 1
+fi
+
+# Check dependencies
+if ! command -v tshark &>/dev/null; then
+    echo -e "${RED}[-] tshark not found — install with: apt install tshark${NC}"
+    exit 1
+fi
+
+# Create output structure
+mkdir -p "$OUTPUT_DIR"/{http,smb,ftp,tftp,dicom,imf}
+
+echo -e "${CYAN}[*] BigBrother File Extraction${NC}"
+echo -e "    PCAP dir:  ${PCAP_DIR}"
+echo -e "    Output:    ${OUTPUT_DIR}"
+echo ""
+
+# ---------------------------------------------------------------------------
+# Extract files from each PCAP
+# ---------------------------------------------------------------------------
+
+PCAP_COUNT=0
+HTTP_COUNT=0
+SMB_COUNT=0
+FTP_COUNT=0
+
+for pcap in "$PCAP_DIR"/*.pcap "$PCAP_DIR"/*.pcapng; do
+    [[ -f "$pcap" ]] || continue
+    PCAP_COUNT=$((PCAP_COUNT + 1))
+    basename_pcap=$(basename "$pcap")
+    echo -e "${YELLOW}[*] Processing: ${basename_pcap}${NC}"
+
+    # HTTP objects (downloads, uploads, pages)
+    echo -e "    Extracting HTTP objects..."
+    http_dir="$OUTPUT_DIR/http/${basename_pcap%.pcap*}"
+    mkdir -p "$http_dir"
+    tshark -r "$pcap" --export-objects "http,$http_dir" 2>/dev/null || true
+    count=$(find "$http_dir" -type f 2>/dev/null | wc -l)
+    HTTP_COUNT=$((HTTP_COUNT + count))
+    echo -e "    ${GREEN}Found $count HTTP objects${NC}"
+
+    # SMB file transfers
+    echo -e "    Extracting SMB objects..."
+    smb_dir="$OUTPUT_DIR/smb/${basename_pcap%.pcap*}"
+    mkdir -p "$smb_dir"
+    tshark -r "$pcap" --export-objects "smb,$smb_dir" 2>/dev/null || true
+    count=$(find "$smb_dir" -type f 2>/dev/null | wc -l)
+    SMB_COUNT=$((SMB_COUNT + count))
+    echo -e "    ${GREEN}Found $count SMB objects${NC}"
+
+    # FTP data streams
+    echo -e "    Extracting FTP data..."
+    ftp_dir="$OUTPUT_DIR/ftp/${basename_pcap%.pcap*}"
+    mkdir -p "$ftp_dir"
+    tshark -r "$pcap" --export-objects "ftp-data,$ftp_dir" 2>/dev/null || true
+    count=$(find "$ftp_dir" -type f 2>/dev/null | wc -l)
+    FTP_COUNT=$((FTP_COUNT + count))
+    echo -e "    ${GREEN}Found $count FTP objects${NC}"
+
+    # TFTP transfers
+    echo -e "    Extracting TFTP data..."
+    tftp_dir="$OUTPUT_DIR/tftp/${basename_pcap%.pcap*}"
+    mkdir -p "$tftp_dir"
+    tshark -r "$pcap" --export-objects "tftp,$tftp_dir" 2>/dev/null || true
+
+    # IMF (email) objects
+    echo -e "    Extracting email objects..."
+    imf_dir="$OUTPUT_DIR/imf/${basename_pcap%.pcap*}"
+    mkdir -p "$imf_dir"
+    tshark -r "$pcap" --export-objects "imf,$imf_dir" 2>/dev/null || true
+
+    echo ""
+done
+
+# ---------------------------------------------------------------------------
+# Summary
+# ---------------------------------------------------------------------------
+
+if [[ $PCAP_COUNT -eq 0 ]]; then
+    echo -e "${RED}[-] No PCAP files found in $PCAP_DIR${NC}"
+    exit 1
+fi
+
+TOTAL=$(find "$OUTPUT_DIR" -type f ! -name "*.md" 2>/dev/null | wc -l)
+
+echo -e "${GREEN}[+] Extraction complete${NC}"
+echo -e "    PCAPs processed: ${PCAP_COUNT}"
+echo -e "    Total files:     ${TOTAL}"
+echo -e "      HTTP objects:  ${HTTP_COUNT}"
+echo -e "      SMB objects:   ${SMB_COUNT}"
+echo -e "      FTP objects:   ${FTP_COUNT}"
+echo ""
+du -sh "$OUTPUT_DIR"/* 2>/dev/null | sed 's/^/    /'
+echo ""
+echo -e "${CYAN}[*] Review extracted files for sensitive data:${NC}"
+echo "    - Documents: find $OUTPUT_DIR -name '*.doc*' -o -name '*.pdf' -o -name '*.xls*'"
+echo "    - Config:    find $OUTPUT_DIR -name '*.conf' -o -name '*.ini' -o -name '*.xml'"
+echo "    - Scripts:   find $OUTPUT_DIR -name '*.ps1' -o -name '*.bat' -o -name '*.sh'"