TFTP_Carving/test.py at main · http8080/TFTP_Carving · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
import pyshark
import nest_asyncio


def tftp_data():
    opcode = {
        "RRQ": "0001",
        "WRQ": "0002",
        "DATA_Block": "0003",
        "ACK_Block": "0004",
        "ERROR_Block": "0005"
    }

    mode = {
        "Octet": "6f63746574"
    }

    data = ""
    file_name = "str(index.data.data)[4:-14]"
    ACK_list = []

    for index in packet:
        if str(index).find("UDP") != -1:
            try:
                if str(index.data.data)[0:4] == opcode["RRQ"]:
                    print(f"RRQ : {index.data.data}")
                elif str(index.data.data)[0:4] == opcode["WRQ"] and str(index.data.data)[0:4].find(mode["Octet"]):
                    print(f"WRQ [Octet] : {bytes.fromhex(str(index.data.data)[4:-14])}")
                    file_name = bytes.fromhex(str(index.data.data)[4:-14])
                elif str(index.data.data)[0:4] == opcode["DATA_Block"]:
                    print(f"DATA_Block [ {str(index.data.data)[4:8]} ] : {str(index.data.data)[8:]}")
                    data += str(index.data.data)[8:]
                elif str(index.data.data)[0:4] == opcode["ACK_Block"]:
                    print(f"ACK_Block [ {str(index.data.data)[4:8]} ]")
                    ACK_list.append(str(index.data.data)[:8])
                elif str(index.data.data)[0:4] == opcode["ERROR_Block"]:
                    print(f"ERROR_Block [ {index.data.data} ] ")

            except:
                pass

    data += str(ACK_list.pop())
    print(file_name)
    print(data)

    with open(f"{file_name}", "wb") as file:
        file.write(bytes.fromhex(data))


packet = pyshark.FileCapture("garbagefile.pcapng")

tftp_data()

packet.close()
packet.eventloop.stop()