metasploit-framework/plugins/db_tracker.rb

64 lines
1.2 KiB
Ruby

module Msf
###
#
# This class hooks all socket calls and updates the database with
# data gathered from the connection parameters
#
###
class Plugin::DB_Tracer < Msf::Plugin
###
#
# This class implements a socket communication tracker
#
###
class DBTracerEventHandler
include Rex::Socket::Comm::Events
def on_before_socket_create(comm, param)
end
def on_socket_created(comm, sock, param)
# Ignore local listening sockets
return if not sock.peerhost
if (sock.peerhost != '0.0.0.0' and sock.peerport)
host = param.context['Msf'].db.get_host(param.context, sock.peerhost)
return if not host
port = param.context['Msf'].db.get_service(param.context, host, param.proto, sock.peerport)
return if not port
end
end
end
def initialize(framework, opts)
super
if(not framework.db.active)
raise PluginLoadError.new("The database backend has not been initialized")
end
@eh = DBTracerEventHandler.new
Rex::Socket::Comm::Local.register_event_handler(@eh)
end
def cleanup
Rex::Socket::Comm::Local.deregister_event_handler(@eh)
end
def name
"db_tracker"
end
def desc
"Monitors socket calls and updates the database backend"
end
end
end