n0mad1k
ccc6b729de
Full BigBrother network implant - passive SOC + active exploitation. Personal identifiers removed; all capabilities intact. See README.md for setup and docs/deployment.md for detailed deployment.
86 lines
3.0 KiB
Bash
Executable File
86 lines
3.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Teardown bridge and restore interfaces
|
|
#
|
|
# Removes the transparent bridge, flushes ebtables rules, and restores
|
|
# the original interface state. Safe to call even if the bridge is
|
|
# already down or partially broken.
|
|
|
|
set -uo pipefail
|
|
# Note: no -e — we want all cleanup steps to run even if some fail
|
|
|
|
BRIDGE="br0"
|
|
|
|
echo "Tearing down bridge $BRIDGE"
|
|
|
|
# --------------------------------------------------------------------------
|
|
# Identify bridge members before removal
|
|
# --------------------------------------------------------------------------
|
|
MEMBERS=()
|
|
if ip link show "$BRIDGE" &>/dev/null; then
|
|
while IFS= read -r line; do
|
|
iface=$(echo "$line" | awk '{print $2}' | tr -d ':')
|
|
if [[ -n "$iface" ]]; then
|
|
MEMBERS+=("$iface")
|
|
fi
|
|
done < <(bridge link show master "$BRIDGE" 2>/dev/null | grep -oP '^\d+:\s+\K\S+')
|
|
fi
|
|
|
|
# --------------------------------------------------------------------------
|
|
# Remove ebtables rules
|
|
# --------------------------------------------------------------------------
|
|
if command -v ebtables &>/dev/null; then
|
|
echo "Flushing ebtables rules"
|
|
ebtables -F 2>/dev/null || true
|
|
ebtables -X 2>/dev/null || true
|
|
fi
|
|
|
|
# --------------------------------------------------------------------------
|
|
# Bring bridge down
|
|
# --------------------------------------------------------------------------
|
|
ip link set down dev "$BRIDGE" 2>/dev/null || true
|
|
|
|
# --------------------------------------------------------------------------
|
|
# Remove interfaces from bridge and restore state
|
|
# --------------------------------------------------------------------------
|
|
for iface in "${MEMBERS[@]}"; do
|
|
echo "Restoring interface: $iface"
|
|
|
|
# Remove from bridge
|
|
ip link set "$iface" nomaster 2>/dev/null || true
|
|
|
|
# Disable promiscuous mode
|
|
ip link set "$iface" promisc off 2>/dev/null || true
|
|
|
|
# Re-enable IPv6
|
|
sysctl -qw "net.ipv6.conf.${iface}.disable_ipv6=0" 2>/dev/null || true
|
|
|
|
# Bring interface up (in case it was downed)
|
|
ip link set up dev "$iface" 2>/dev/null || true
|
|
done
|
|
|
|
# --------------------------------------------------------------------------
|
|
# Delete bridge device
|
|
# --------------------------------------------------------------------------
|
|
if ip link show "$BRIDGE" &>/dev/null; then
|
|
ip link del "$BRIDGE" 2>/dev/null || true
|
|
echo "Bridge $BRIDGE deleted"
|
|
else
|
|
echo "Bridge $BRIDGE already removed"
|
|
fi
|
|
|
|
# --------------------------------------------------------------------------
|
|
# Re-enable IPv6 globally on bridge name (cleanup)
|
|
# --------------------------------------------------------------------------
|
|
sysctl -qw "net.ipv6.conf.${BRIDGE}.disable_ipv6=0" 2>/dev/null || true
|
|
|
|
# --------------------------------------------------------------------------
|
|
# Verify cleanup
|
|
# --------------------------------------------------------------------------
|
|
if ip link show "$BRIDGE" &>/dev/null; then
|
|
echo "Warning: bridge $BRIDGE still exists after teardown" >&2
|
|
exit 1
|
|
else
|
|
echo "Bridge teardown complete"
|
|
exit 0
|
|
fi
|