n0mad1k
ba5143b560
Active modules (9 files in modules/active/): - bettercap_mgr: Central bettercap orchestrator with REST API health monitoring, event stream parsing, crash recovery with corrective gratuitous ARPs, caplet management, and process disguise - arp_spoof: Thin bettercap wrapper for ARP spoofing with OPSEC warnings - dns_poison: DNS poisoning with zone template loading support - dhcp_spoof: DHCPv6 spoofing via bettercap for rogue DNS injection - evil_twin: hostapd-based rogue AP with captive portal and dnsmasq, iptables redirect, credential capture via HTTP POST handler - ipv6_slaac: IPv6 SLAAC spoofing via bettercap + mitm6 WPAD abuse - responder_mgr: Responder subprocess manager with hash file monitoring, NTLMv1/v2 parsing, session log scanning, relay target coordination - mitmproxy_mgr: Transparent proxy with addon scripts, tier checking (OPi Zero 3+ only), iptables setup, credential/token extraction - ntlm_relay: ntlmrelayx wrapper with multi-protocol relay (SMB, LDAP, LDAPS, HTTP, MSSQL, ADCS), Responder exclusion coordination, SOCKS Templates (9 files): - 4 captive portals: corporate SSO, guest WiFi, Outlook/M365, VPN (self-contained HTML with inline CSS, realistic login forms) - 2 DNS zones: redirect-all and selective Jinja2 template - 2 hostapd configs: open AP and WPA2-PSK Jinja2 templates - 1 Responder.conf Jinja2 template with protocol toggles Operator scripts (6 files in scripts/operator/): - pull_data.sh: rsync structured data over WireGuard/Tailscale - extract_files.sh: tshark HTTP/SMB/FTP/TFTP file extraction - extract_print_jobs.sh: TCP/9100 print job reconstruction + PDF convert - extract_emails.sh: SMTP email extraction with attachment detection - crack_hashes.sh: Export creds to hashcat format, optional auto-crack - generate_report.py: SQLite-to-Markdown/HTML engagement report generator
135 lines
4.4 KiB
Bash
Executable File
135 lines
4.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# BigBrother Operator Script — Extract Files from PCAPs
|
|
#
|
|
# Uses tshark to extract transferred files from PCAP captures.
|
|
# Supports HTTP objects, SMB file transfers, FTP data, and TFTP.
|
|
#
|
|
# Usage: ./extract_files.sh <pcap_dir> [output_dir]
|
|
#
|
|
# Examples:
|
|
# ./extract_files.sh ./bb-pull-20240115/pcaps
|
|
# ./extract_files.sh /opt/cases/acme/pcaps /opt/cases/acme/extracted
|
|
#
|
|
# Requires: tshark (Wireshark CLI)
|
|
|
|
set -euo pipefail
|
|
|
|
RED='\033[0;31m'
|
|
GREEN='\033[0;32m'
|
|
YELLOW='\033[1;33m'
|
|
CYAN='\033[0;36m'
|
|
NC='\033[0m'
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Arguments
|
|
# ---------------------------------------------------------------------------
|
|
|
|
PCAP_DIR="${1:-}"
|
|
OUTPUT_DIR="${2:-$(pwd)/extracted-files-$(date +%Y%m%d-%H%M%S)}"
|
|
|
|
if [[ -z "$PCAP_DIR" ]]; then
|
|
echo -e "${RED}Usage: $0 <pcap_dir> [output_dir]${NC}"
|
|
exit 1
|
|
fi
|
|
|
|
if [[ ! -d "$PCAP_DIR" ]]; then
|
|
echo -e "${RED}[-] PCAP directory not found: $PCAP_DIR${NC}"
|
|
exit 1
|
|
fi
|
|
|
|
# Check dependencies
|
|
if ! command -v tshark &>/dev/null; then
|
|
echo -e "${RED}[-] tshark not found — install with: apt install tshark${NC}"
|
|
exit 1
|
|
fi
|
|
|
|
# Create output structure
|
|
mkdir -p "$OUTPUT_DIR"/{http,smb,ftp,tftp,dicom,imf}
|
|
|
|
echo -e "${CYAN}[*] BigBrother File Extraction${NC}"
|
|
echo -e " PCAP dir: ${PCAP_DIR}"
|
|
echo -e " Output: ${OUTPUT_DIR}"
|
|
echo ""
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Extract files from each PCAP
|
|
# ---------------------------------------------------------------------------
|
|
|
|
PCAP_COUNT=0
|
|
HTTP_COUNT=0
|
|
SMB_COUNT=0
|
|
FTP_COUNT=0
|
|
|
|
for pcap in "$PCAP_DIR"/*.pcap "$PCAP_DIR"/*.pcapng; do
|
|
[[ -f "$pcap" ]] || continue
|
|
PCAP_COUNT=$((PCAP_COUNT + 1))
|
|
basename_pcap=$(basename "$pcap")
|
|
echo -e "${YELLOW}[*] Processing: ${basename_pcap}${NC}"
|
|
|
|
# HTTP objects (downloads, uploads, pages)
|
|
echo -e " Extracting HTTP objects..."
|
|
http_dir="$OUTPUT_DIR/http/${basename_pcap%.pcap*}"
|
|
mkdir -p "$http_dir"
|
|
tshark -r "$pcap" --export-objects "http,$http_dir" 2>/dev/null || true
|
|
count=$(find "$http_dir" -type f 2>/dev/null | wc -l)
|
|
HTTP_COUNT=$((HTTP_COUNT + count))
|
|
echo -e " ${GREEN}Found $count HTTP objects${NC}"
|
|
|
|
# SMB file transfers
|
|
echo -e " Extracting SMB objects..."
|
|
smb_dir="$OUTPUT_DIR/smb/${basename_pcap%.pcap*}"
|
|
mkdir -p "$smb_dir"
|
|
tshark -r "$pcap" --export-objects "smb,$smb_dir" 2>/dev/null || true
|
|
count=$(find "$smb_dir" -type f 2>/dev/null | wc -l)
|
|
SMB_COUNT=$((SMB_COUNT + count))
|
|
echo -e " ${GREEN}Found $count SMB objects${NC}"
|
|
|
|
# FTP data streams
|
|
echo -e " Extracting FTP data..."
|
|
ftp_dir="$OUTPUT_DIR/ftp/${basename_pcap%.pcap*}"
|
|
mkdir -p "$ftp_dir"
|
|
tshark -r "$pcap" --export-objects "ftp-data,$ftp_dir" 2>/dev/null || true
|
|
count=$(find "$ftp_dir" -type f 2>/dev/null | wc -l)
|
|
FTP_COUNT=$((FTP_COUNT + count))
|
|
echo -e " ${GREEN}Found $count FTP objects${NC}"
|
|
|
|
# TFTP transfers
|
|
echo -e " Extracting TFTP data..."
|
|
tftp_dir="$OUTPUT_DIR/tftp/${basename_pcap%.pcap*}"
|
|
mkdir -p "$tftp_dir"
|
|
tshark -r "$pcap" --export-objects "tftp,$tftp_dir" 2>/dev/null || true
|
|
|
|
# IMF (email) objects
|
|
echo -e " Extracting email objects..."
|
|
imf_dir="$OUTPUT_DIR/imf/${basename_pcap%.pcap*}"
|
|
mkdir -p "$imf_dir"
|
|
tshark -r "$pcap" --export-objects "imf,$imf_dir" 2>/dev/null || true
|
|
|
|
echo ""
|
|
done
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Summary
|
|
# ---------------------------------------------------------------------------
|
|
|
|
if [[ $PCAP_COUNT -eq 0 ]]; then
|
|
echo -e "${RED}[-] No PCAP files found in $PCAP_DIR${NC}"
|
|
exit 1
|
|
fi
|
|
|
|
TOTAL=$(find "$OUTPUT_DIR" -type f ! -name "*.md" 2>/dev/null | wc -l)
|
|
|
|
echo -e "${GREEN}[+] Extraction complete${NC}"
|
|
echo -e " PCAPs processed: ${PCAP_COUNT}"
|
|
echo -e " Total files: ${TOTAL}"
|
|
echo -e " HTTP objects: ${HTTP_COUNT}"
|
|
echo -e " SMB objects: ${SMB_COUNT}"
|
|
echo -e " FTP objects: ${FTP_COUNT}"
|
|
echo ""
|
|
du -sh "$OUTPUT_DIR"/* 2>/dev/null | sed 's/^/ /'
|
|
echo ""
|
|
echo -e "${CYAN}[*] Review extracted files for sensitive data:${NC}"
|
|
echo " - Documents: find $OUTPUT_DIR -name '*.doc*' -o -name '*.pdf' -o -name '*.xls*'"
|
|
echo " - Config: find $OUTPUT_DIR -name '*.conf' -o -name '*.ini' -o -name '*.xml'"
|
|
echo " - Scripts: find $OUTPUT_DIR -name '*.ps1' -o -name '*.bat' -o -name '*.sh'"
|