search

mandiant / flare-fakenet-ng

FakeNet-NG - Next Generation Dynamic Network Analysis Tool
Apache License 2.0
1.73k stars 357 forks source link

Add support for WHOIS command on IRCListener #159

Open 3V3RYONE opened 1 year ago

3V3RYONE commented 1 year ago

This PR fixes #35

Cause of Bug The reason of this unknown command bug is because there is no specific function in fakenet/listeners/IRCListener.py that deals with the WHOIS command. Therefore, whenever the WHOIS command is executed, the current code executes the irc_DEFAULT function in fakenet/listeners/IRCListener.py, that displays the unknown command message as output.

Fix I went ahead and defined a function with the name irc_WHOIS which deals with the WHOIS command. I analyzed the ideal output of WHOIS command (executed without fakenet running), and then added the respective fields in the irc_WHOIS function to replicate the same output.

idealWHOISOutput

Before 27/03/23 01:45:34 PM [ IRCServer] Client issued an unknown command WHOIS IEUser

After AfterChanges

Note While the output is working as expected, there is one side effect. The WHOIS command's output keeps on printing in a forever loop at the client side, even though it is executed once. While I am trying to work on this issue and fix it, I would love any help to proceed in the right direction. Thank you! :)

tinajn commented 1 year ago

@3V3RYONE Can you mention the client you were using to test? It seems like irssi from the screenshot.

3V3RYONE commented 1 year ago

Hey @tinajn , yup I used irssi as the client!

tinajn commented 1 year ago

Could you also add a test for the WHOIS command to test.py?

3V3RYONE commented 1 year ago

Surely, getting back to work on this issue latest by Monday! Will add the tests too :)

3V3RYONE commented 1 year ago

Tested the WHOIS command, works well with the new changes :tada:

Note

  1. The testing was done by creating an IRC client in a python prompt alongside fakenet running.
  2. We could not test the changes with test.py, because as per the docs, IRC Listener test is known to fail in test.py in windows.
  3. We could not test the changes with the original irssi client, because IRSSI v1.2.2 (as used to report and replicate the bug) is no longer available to use via cygwin. Newer versions of IRSSI do not work with fakenet currently.

Before WHOIS

Client issued an unknown command WHOIS: dr_evil

WhatsApp Image 2023-05-29 at 5 13 55 PM

After WHOIS

Client has issued WHOIS command: dr_evil

WhatsApp Image 2023-05-29 at 5 13 55 PM (1)

tinajn commented 1 year ago

Thank you @3V3RYONE.

In the process of testing code with an IRC client. Will merge once I have tested.