Skip to content

Commit 82a41a3

Browse files
whotwagnerwhotwagner
authored
Merge pull request #176 from whotwagner/feature_bettercap
Feature bettercap
2 parents 16a013d + c14513f commit 82a41a3

41 files changed

Lines changed: 6542 additions & 31 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/python-publish.yml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,4 +32,3 @@ jobs:
3232
run: python -m build
3333
- name: Publish package distributions to PyPI
3434
uses: pypa/gh-action-pypi-publish@release/v1
35-

‎docs/source/configuration/bettercap_config.rst‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
.. _bettercap_config:
2+
3+
================
4+
bettercap_config
5+
================
6+
7+
bettercap_config holds settings for the Bettercap rest-api. The configuration
8+
always starts with an identifier for the connection. This identifier can be
9+
selected when executing a command in a playbook. The first connection in this
10+
file is the default if no explicit connection was selected in the command.
11+
12+
.. code-block:: yaml
13+
14+
###
15+
bettercap_config:
16+
default:
17+
url: "http://localhost:8081"
18+
username: user
19+
password: password
20+
remote:
21+
url: "http://remote.host.tld:8081"
22+
username: btrcp
23+
password: somepass
24+
25+
.. code-block:: yaml
26+
27+
# bettercap-playbook.yml:
28+
commands:
29+
# this is executed on the remote host:
30+
- type: bettercap
31+
cmd: post_api_session
32+
data:
33+
cmd: "net.sniff on"
34+
connection: remote
35+
# this is executed on localhost:
36+
- type: bettercap
37+
cmd: get_events
38+
39+
40+
.. confval:: url
41+
42+
This option stores the url to the rest-api
43+
44+
:type: str
45+
46+
.. confval:: username
47+
48+
The http basic username for the rest-api
49+
50+
:type: str
51+
52+
.. confval:: password
53+
54+
The http basic password for the rest-api
55+
56+
:type: str
57+
58+
.. confval:: cafile
59+
60+
The path to the ca-file for the encryption if https is in use.
61+
62+
:type: str

‎docs/source/configuration/index.rst‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ The optional configuration-file is in yaml-format and is divided into three sect
1515

1616
* **cmd_config**: defines settings for all commands
1717
* **msf_config**: connection settings for the msfrpcd
18+
* **bettercap_config**: connection settings for the bettercap rest-api
1819
* **sliver_config**: connection settings for the sliver-api
1920

2021
The following configuration file is an example for a basic configuration with
@@ -27,6 +28,12 @@ sliver and metasploit:
2728
loop_sleep: 5
2829
command_delay: 0
2930
31+
bettercap_config:
32+
default:
33+
url: "http://localhost:8081"
34+
username: user
35+
password: password
36+
3037
msf_config:
3138
password: securepassword
3239
server: 127.0.0.1
@@ -41,5 +48,6 @@ For detailed information about the config sections see:
4148

4249
config_vars
4350
command_config
51+
bettercap_config
4452
msf_config
4553
sliver_config

‎docs/source/playbook/commands/bettercap.rst‎

Lines changed: 297 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,297 @@
1+
.. _bettercap:
2+
3+
=========
4+
bettercap
5+
=========
6+
7+
This command communicates with the bettercap rest-api. It supports all
8+
endpoints of the official api. Please see `Bettercap Rest-Api Docs <https://www.bettercap.org/modules/core/apirest/>`_
9+
for additional information. All commands return a json-formatted string.
10+
11+
All commands support the setting: `connection`. This settings allows to query a api-command on a specific host. The name
12+
of the connection must be set in attackmate.yml. If connection is not set, the command will be executed on the first
13+
connection in attackmate.yml:
14+
15+
.. code-block:: yaml
16+
17+
# .attackmate.yml:
18+
bettercap_config:
19+
default:
20+
url: "http://localhost:8081"
21+
username: btrcp
22+
password: secret
23+
remote:
24+
url: "http://somehost:8081"
25+
username: user
26+
password: secret
27+
28+
# bettercap-playbook.yml:
29+
commands:
30+
# this is executed on the remote host:
31+
- type: bettercap
32+
cmd: post_api_session
33+
data:
34+
cmd: "net.sniff on"
35+
connection: remote
36+
# this is executed on localhost:
37+
- type: bettercap
38+
cmd: get_events
39+
40+
.. note::
41+
42+
To configure the connection to the bettercap rest-api see :ref:`bettercap_config`
43+
44+
45+
post_api_session
46+
----------------
47+
48+
Post a command to the interactive session.
49+
50+
.. code-block:: yaml
51+
52+
###
53+
commands:
54+
- type: bettercap
55+
cmd: post_api_session
56+
data:
57+
cmd: "net.sniff on"
58+
59+
.. confval:: data
60+
61+
Dict(key/values) of post-data:
62+
63+
:type: Dict[str,str]
64+
65+
get_file
66+
--------
67+
68+
Get a file from the api-server.
69+
70+
.. code-block:: yaml
71+
72+
###
73+
commands:
74+
- type: bettercap
75+
cmd: get_file
76+
filename: "/etc/passwd"
77+
78+
.. confval:: filename
79+
80+
Full path of the filename on the api-server.
81+
82+
:type: str
83+
84+
85+
delete_api_events
86+
-----------------
87+
88+
Clear the events buffer.
89+
90+
.. code-block:: yaml
91+
92+
###
93+
commands:
94+
- type: bettercap
95+
cmd: delete_api_events
96+
97+
98+
get_events
99+
----------
100+
101+
Get all events
102+
103+
.. code-block:: yaml
104+
105+
###
106+
commands:
107+
- type: bettercap
108+
cmd: get_events
109+
110+
111+
get_session_modules
112+
-------------------
113+
114+
Get session modules
115+
116+
.. code-block:: yaml
117+
118+
###
119+
commands:
120+
- type: bettercap
121+
cmd: get_session_modules
122+
123+
get_session_env
124+
---------------
125+
126+
Get session environment
127+
128+
.. code-block:: yaml
129+
130+
###
131+
commands:
132+
- type: bettercap
133+
cmd: get_session_env
134+
135+
get_session_gateway
136+
-------------------
137+
138+
Get session gateway
139+
140+
.. code-block:: yaml
141+
142+
###
143+
commands:
144+
- type: bettercap
145+
cmd: get_session_gateway
146+
147+
get_session_interface
148+
---------------------
149+
150+
Get session interface
151+
152+
.. code-block:: yaml
153+
154+
###
155+
commands:
156+
- type: bettercap
157+
cmd: get_session_interface
158+
159+
get_session_options
160+
-------------------
161+
162+
Get session options
163+
164+
.. code-block:: yaml
165+
166+
###
167+
commands:
168+
- type: bettercap
169+
cmd: get_session_options
170+
171+
get_session_packets
172+
-------------------
173+
174+
Get session packets
175+
176+
.. code-block:: yaml
177+
178+
###
179+
commands:
180+
- type: bettercap
181+
cmd: get_session_packets
182+
183+
get_session_started_at
184+
----------------------
185+
186+
Get session started at
187+
188+
.. code-block:: yaml
189+
190+
###
191+
commands:
192+
- type: bettercap
193+
cmd: get_session_started_at
194+
195+
get_session_hid
196+
---------------
197+
198+
Get a JSON of the HID devices in the current session
199+
200+
.. code-block:: yaml
201+
202+
###
203+
commands:
204+
- type: bettercap
205+
cmd: get_session_hid
206+
207+
.. confval:: mac
208+
209+
Optional parameter to return the info of a specific endpoint
210+
211+
:type: str
212+
213+
.. code-block:: yaml
214+
215+
###
216+
commands:
217+
- type: bettercap
218+
cmd: get_session_hid
219+
mac: "32:26:9f:a4:08"
220+
221+
get_session_ble
222+
---------------
223+
224+
Get a JSON of the BLE devices in the current session.
225+
226+
.. code-block:: yaml
227+
228+
###
229+
commands:
230+
- type: bettercap
231+
cmd: get_session_ble
232+
233+
.. confval:: mac
234+
235+
Optional parameter to return the info of a specific endpoint
236+
237+
:type: str
238+
239+
.. code-block:: yaml
240+
241+
###
242+
commands:
243+
- type: bettercap
244+
cmd: get_session_ble
245+
mac: "32:26:9f:a4:08"
246+
247+
get_session_lan
248+
---------------
249+
250+
Get a JSON of the lan devices in the current session
251+
252+
.. code-block:: yaml
253+
254+
###
255+
commands:
256+
- type: bettercap
257+
cmd: get_session_lan
258+
259+
.. confval:: mac
260+
261+
Optional parameter to return the info of a specific endpoint
262+
263+
:type: str
264+
265+
.. code-block:: yaml
266+
267+
###
268+
commands:
269+
- type: bettercap
270+
cmd: get_session_lan
271+
mac: "32:26:9f:a4:08"
272+
273+
get_session_wifi
274+
----------------
275+
276+
Get a JSON of the wifi devices (clients and access points) in the current session
277+
278+
.. code-block:: yaml
279+
280+
###
281+
commands:
282+
- type: bettercap
283+
cmd: get_session_wifi
284+
285+
.. confval:: mac
286+
287+
Optional parameter to return the info of a specific endpoint
288+
289+
:type: str
290+
291+
.. code-block:: yaml
292+
293+
###
294+
commands:
295+
- type: bettercap
296+
cmd: get_session_wifi
297+
mac: "32:26:9f:a4:08"

0 commit comments

Comments
 (0)