1eb35c9050
Fix #211 : Remove tool identity strings from deployed artifacts
...
- Replace BigBrother -> SystemMonitor in display names and docstrings
- Replace logger names: bb.* -> sensor.*
- Replace process names: bb-* -> sensor-*
- Replace home directory: ~/.bigbrother -> ~/.implant
- Replace LUKS device: /dev/mapper/bb-* -> /dev/mapper/sensor-*
- Updated 76 Python files across all modules
- Improves OPSEC by removing obvious tool fingerprints from logs and runtime
2026-04-06 11:39:48 -04:00
ae4933044b
Fix #209 : Prevent SSH MITM in data_exfil.py exfiltration
...
- Replace StrictHostKeyChecking=no with accept-new (verify on first connect)
- Require ssh_known_hosts_file config key pointing to operator's known_hosts
- Validate known_hosts file exists before attempting transfer
- Fail explicitly if known_hosts not configured (prevents silent MITM vulnerability)
- Uses -o UserKnownHostsFile=path to use pinned host keys
2026-04-06 11:39:11 -04:00
e9735a15bb
Fix #208 : Prevent SSTI in responder_mgr.py Jinja2 template
...
- Use jinja2.Environment with BaseLoader instead of Template
- Enable autoescape=True to escape all template variables
- Sanitize relay_targets by converting to strings: [str(ip) for ip in ...]
- Prevents template injection even if relay_targets contains malicious content
2026-04-06 11:38:59 -04:00
156144c1a7
Fix indentation issues in passive modules requires_capture_bus attribute
...
- Removed misplaced requires_capture_bus entries that broke indentation
- Added requires_capture_bus = True correctly after requires_root in all passive modules
- All passive modules now have valid Python syntax
2026-04-06 11:37:43 -04:00
04eae3a43e
Add requires_capture_bus attribute to BaseModule and passive modules
...
- BaseModule now has requires_capture_bus = False default
- All 17 passive modules set requires_capture_bus = True
- bigbrother.py imports CaptureBus from core.capture_bus
- Ready for Engine to instantiate and inject CaptureBus
2026-04-06 11:36:24 -04:00
59cdda0596
Fix #206 : Resolve auto interface to actual interface name
...
- Engine.__init__ now detects actual interface when config has 'auto'
- Uses get_primary_interface() to find default route interface
- PacketCapture module updated to use detected interface with fallback
- Handles Pi Zero 2W (wlan0) and other non-eth0 systems
2026-04-06 11:35:52 -04:00
56cca8ac3d
Phase 5: Final integration — fix imports, full module discovery, interactive menu
...
- Fix pyserial import error in cellular_backup.py (lazy import with fallback)
- Replace stealth-only module discovery with discover_all_modules() across all
5 categories (stealth, passive, active, intel, connectivity)
- Wire up interactive menu options 5-8:
- View Credentials: query credential_db SQLite, Rich table with stats
- View Intelligence: host count, cred stats, security posture summary
- Network Topology: host table from topology_mapper state data
- Timeline: recent entries from operator_audit HMAC-chained log
- Update start command to discover+register all enabled modules (not just stealth)
- Update modules/activate/selftest commands to use full module discovery
- Add is_module_enabled() config-aware helper for per-category defaults
- Fix modules.yaml module count headers (16->17 passive, 8->9 active/intel)
- Set bettercap_mgr enabled=false (all active modules disabled by default)
- Add tests/test_all_modules.py: 179 parametrized tests covering import,
BaseModule subclass, attributes, and instantiation for all 55 modules
across passive, active, intel, and connectivity categories
- All 256 tests passing
2026-03-18 13:59:27 -04:00
ba5143b560
Phase 4: Active modules, templates, and operator scripts
...
Active modules (9 files in modules/active/):
- bettercap_mgr: Central bettercap orchestrator with REST API health
monitoring, event stream parsing, crash recovery with corrective
gratuitous ARPs, caplet management, and process disguise
- arp_spoof: Thin bettercap wrapper for ARP spoofing with OPSEC warnings
- dns_poison: DNS poisoning with zone template loading support
- dhcp_spoof: DHCPv6 spoofing via bettercap for rogue DNS injection
- evil_twin: hostapd-based rogue AP with captive portal and dnsmasq,
iptables redirect, credential capture via HTTP POST handler
- ipv6_slaac: IPv6 SLAAC spoofing via bettercap + mitm6 WPAD abuse
- responder_mgr: Responder subprocess manager with hash file monitoring,
NTLMv1/v2 parsing, session log scanning, relay target coordination
- mitmproxy_mgr: Transparent proxy with addon scripts, tier checking
(OPi Zero 3+ only), iptables setup, credential/token extraction
- ntlm_relay: ntlmrelayx wrapper with multi-protocol relay (SMB, LDAP,
LDAPS, HTTP, MSSQL, ADCS), Responder exclusion coordination, SOCKS
Templates (9 files):
- 4 captive portals: corporate SSO, guest WiFi, Outlook/M365, VPN
(self-contained HTML with inline CSS, realistic login forms)
- 2 DNS zones: redirect-all and selective Jinja2 template
- 2 hostapd configs: open AP and WPA2-PSK Jinja2 templates
- 1 Responder.conf Jinja2 template with protocol toggles
Operator scripts (6 files in scripts/operator/):
- pull_data.sh: rsync structured data over WireGuard/Tailscale
- extract_files.sh: tshark HTTP/SMB/FTP/TFTP file extraction
- extract_print_jobs.sh: TCP/9100 print job reconstruction + PDF convert
- extract_emails.sh: SMTP email extraction with attachment detection
- crack_hashes.sh: Export creds to hashcat format, optional auto-crack
- generate_report.py: SQLite-to-Markdown/HTML engagement report generator
2026-03-18 13:48:11 -04:00
955ebfc8db
Add Phase 3 connectivity modules — 8 modules + bridge scripts
...
WireGuard (primary C2, PersistentKeepalive=0 for zero idle traffic),
Tailscale (fallback mesh VPN), Bridge (transparent inline L2 bridge with
802.1X bypass and ebtables protocol suppression), WiFiClient (WPA2-PSK
and WPA2-Enterprise via wpa_supplicant), ReverseTunnel (autossh over
stunnel/websocket — never raw SSH on 443), CellularBackup (LTE modem
via AT commands/mmcli, OPi Zero 3+ only), BLEEmergency (GATT server
with PSK auth for local last-resort access), DataExfil (priority-based
exfil with IMMEDIATE/NIGHTLY/ON_DEMAND tiers through connectivity chain).
Bridge scripts: setup_bridge.sh (create br0, disable STP, suppress
CDP/LLDP/BPDU via ebtables) and teardown_bridge.sh (safe cleanup).
2026-03-18 13:43:04 -04:00
176da06dc9
Add Phase 2 intel modules — 9 intelligence modules for on-device analysis
...
- credential_db: Central credential store with dedup, hashcat/CSV/JSON export, crack tracking
- topology_mapper: Network graph from HOST_DISCOVERED/VLAN_DETECTED events, Graphviz DOT/SVG output
- net_intel: Beacon detection (stddev/mean analysis), comm graph, DNS tunneling, service deps
- user_timeline: Per-user activity timelines, work hours, admin/service account identification
- supply_chain_detect: Passive detection of PyPI/npm mirrors, WSUS, CI/CD, SCCM, container registries
- change_detector: Continuous baseline diff for burn detection, scan/security tool alerts
- security_posture: EDR/SIEM/NAC/honeypot/scanner detection by DNS/port/UA, risk gating
- operator_audit: Append-only HMAC chain audit log for engagement deconfliction
- tool_output_parser: Unified parser for bettercap events, Responder logs, mitmproxy flows
2026-03-18 13:33:17 -04:00
ab27aa968b
Add 9 advanced passive modules: VLAN, network mapper, auth tracker, SMB, cloud tokens, LDAP, RDP, QUIC, DB interceptor
...
Phase 2 batch 2: protocol-specific passive modules for deep network
visibility. Each module subscribes to capture_bus, parses protocol
structures with struct (no scapy), buffers SQLite writes, and publishes
bus events for cross-module correlation.
- vlan_discovery: 802.1Q/DTP/CDP/LLDP/STP/EAPOL layer-2 parsing
- network_mapper: communication graph with role classification and DOT output
- auth_flow_tracker: Kerberos/NTLM/SSH/LDAP auth correlation per user
- smb_monitor: SMB2/3 tree connect, file access, GPP/SYSVOL detection
- cloud_token_harvester: regex scan cleartext HTTP for AWS/JWT/OAuth/SAML/GCP tokens
- ldap_harvester: BER/ASN.1 LDAP parsing for AD object inventory and LAPS detection
- rdp_monitor: RDP cookie + CredSSP NTLM extraction, admin workstation detection
- quic_analyzer: QUIC Initial packet parsing with RFC 9001 key derivation for SNI
- db_interceptor: MSSQL TDS, MySQL, PostgreSQL, Redis RESP, MongoDB OP_MSG parsing
2026-03-18 13:31:18 -04:00
1c85244e9c
Add 8 passive network observation modules (Phase 2)
...
- PacketCapture: tcpdump subprocess with zstd compression + AES-256-GCM encryption, disk auto-purge
- DNSLogger: DNS query/response parsing with DoH detection, batch SQLite writes
- TLSSNIExtractor: TLS ClientHello SNI extraction with TCP reassembly for fragments
- CredentialSniffer: FTP/HTTP Basic/form POST/SNMP/LDAP/NTLMv1v2 credential extraction
- KerberosHarvester: AS-REQ/AS-REP/TGS-REP parsing for hashcat modes 7500/18200/13100
- HostDiscovery: ARP/DHCP/mDNS/NetBIOS/SSDP/LLMNR passive host inventory with OUI lookup
- OSFingerprint: p0f-style TCP SYN analysis + HTTP UA/SSH banner/SMB dialect fingerprinting
- TrafficAnalyzer: flow tracking, protocol distribution, top talkers, beacon detection
All modules extend BaseModule, use capture_bus subscription, struct-based parsing
(no scapy), batch SQLite writes, and publish bus events.
2026-03-18 13:30:39 -04:00
6caf1a15ca
Add Phase 1 advanced stealth modules: anti-forensics, traffic mimicry, JA3 spoofing, IDS testing, LKM rootkit, overlayfs manager
...
6 Python modules extending BaseModule + LKM kernel module template:
- anti_forensics.py: timestomping, core dump disable, swap off, journal vacuum, history suppression, bettercap tmpfs home, secure deletion
- traffic_mimicry.py: two-phase baseline/shaping engine matching implant traffic to observed network patterns
- ja3_spoofer.py: TLS fingerprint spoofing with Chrome/Firefox/Edge profiles, iptables NFQUEUE interception, SSL context configuration
- ids_tester.py: on-demand Snort/Suricata rule assessment with risk levels, preflight validation, caplet analysis
- lkm_rootkit.py: kernel module lifecycle (build/load/unload) for process/file/connection hiding on generic Debian hosts
- overlayfs_manager.py: tmpfs-backed overlayfs with tier-aware size budgets for zero SD card write activity
- bb_hide.c: ftrace-based LKM hooking getdents64/tcp4_seq_show/udp4_seq_show with self-hiding from lsmod
- Makefile: standard out-of-tree kernel module build
2026-03-18 08:23:02 -04:00
d883b07e34
Add Phase 1 core stealth modules: MAC manager, process disguise, log suppression, encrypted storage, tmpfs manager, watchdog
...
6 stealth modules implementing the OPSEC layer:
- MacManager: innocuous MAC profiles from DB, DHCP hostname/vendor class spoofing, TCP stack tuning (TTL, window, timestamps)
- ProcessDisguise: rename processes to system service names via prctl, auto-disguise on MODULE_STARTED/TOOL_RESTARTED events
- LogSuppression: rsyslog filters, auditd exclusions, journald rate limits, shell history/utmp/wtmp clearing with clean removal on stop
- EncryptedStorage: LUKS2 container with HKDF network-derived key (CPU serial + C2 component), fallback key, auto-format and subdirectory creation
- TmpfsManager: tier-aware RAM-backed mounts for working dirs and WAL files, power loss = instant evidence destruction
- Watchdog: periodic health checks, auto-restart (max 3), OOM priority assignment by module type, bus event monitoring
2026-03-18 08:21:01 -04:00
0a05f009e8
Add Phase 1 core infrastructure: event bus, state manager, engine, capture bus, tool manager, scheduler, resource monitor, kill switch
...
Core framework (8 files in core/) + BaseModule ABC (2 files in modules/):
- bus.py: Multiprocess-safe pub/sub event bus using mp.Queue with background dispatcher thread, 20 canonical event types
- state.py: SQLite persistent state with WAL mode, dedicated writer thread with 500ms coalesce, module status + generic key-value store
- engine.py: Module lifecycle manager with multiprocess model, dependency resolution (topological sort), hardware tier detection (opi_zero3/pi_zero/generic), resource budgeting, scope enforcement, engagement phase gating
- capture_bus.py: Single AF_PACKET socket packet demux with per-module subscriber queues, BPF filter matching, drop-oldest backpressure
- tool_manager.py: Subprocess lifecycle for external tools (bettercap/tcpdump/Responder/mitmproxy/ntlmrelayx) with exponential backoff restart, /proc resource monitoring, process disguise via prctl, health check callbacks, graceful SIGTERM->SIGKILL shutdown
- scheduler.py: Cron-like task scheduler with jitter, thread pool execution, enable/disable/run_now controls
- resource_monitor.py: System + per-process RAM/CPU/disk/thermal monitoring, OOM kill lowest-priority module, thermal shedding at 70C
- kill_switch.py: 7-phase wipe sequence (stop procs, corrective ARP, LUKS destroy, shred keys, zero-fill, clear RAM, reboot), boot flag for interrupted wipe resume, dead man's switch
- modules/base.py: BaseModule ABC with start/stop/status/configure/health_check interface contract
2026-03-18 08:13:11 -04:00
Cobra