extract_credentials

Instructions

Implementation Reference

• index.js:365-509 (handler)

  Full handler implementation for the 'extract_credentials' tool. Captures plaintext credentials from HTTP Basic Auth (decoded), FTP, Telnet, and formats Kerberos hashes from PCAP files using tshark for LLM analysis and cracking.

  server.tool(
      'extract_credentials',
      'Extract potential credentials (HTTP Basic Auth, FTP, Telnet) from a PCAP file for LLM analysis',
      {
        pcapPath: z.string().describe('Path to the PCAP file to analyze (e.g., ./demo.pcap)'),
      },
      async (args) => {
        try {
          const tsharkPath = await findTshark();
          const { pcapPath } = args;
          console.error(`Extracting credentials from PCAP file: ${pcapPath}`);
    
          await fs.access(pcapPath);
    
          // Extract plaintext credentials
          const { stdout: plaintextOut } = await execAsync(
            `${tsharkPath} -r "${pcapPath}" -T fields -e http.authbasic -e ftp.request.command -e ftp.request.arg -e telnet.data -e frame.number`,
            { env: { ...process.env, PATH: `${process.env.PATH}:/usr/bin:/usr/local/bin:/opt/homebrew/bin` } }
          );
  
          // Extract Kerberos credentials
          const { stdout: kerberosOut } = await execAsync(
            `${tsharkPath} -r "${pcapPath}" -T fields -e kerberos.CNameString -e kerberos.realm -e kerberos.cipher -e kerberos.type -e kerberos.msg_type -e frame.number`,
            { env: { ...process.env, PATH: `${process.env.PATH}:/usr/bin:/usr/local/bin:/opt/homebrew/bin` } }
          );
  
          const lines = plaintextOut.split('\n').filter(line => line.trim());
          const packets = lines.map(line => {
            const [authBasic, ftpCmd, ftpArg, telnetData, frameNumber] = line.split('\t');
            return {
              authBasic: authBasic || '',
              ftpCmd: ftpCmd || '',
              ftpArg: ftpArg || '',
              telnetData: telnetData || '',
              frameNumber: frameNumber || ''
            };
          });
    
          const credentials = {
            plaintext: [],
            encrypted: []
          };
    
          // Process HTTP Basic Auth
          packets.forEach(p => {
            if (p.authBasic) {
              const [username, password] = Buffer.from(p.authBasic, 'base64').toString().split(':');
              credentials.plaintext.push({ type: 'HTTP Basic Auth', username, password, frame: p.frameNumber });
            }
          });
    
          // Process FTP
          packets.forEach(p => {
            if (p.ftpCmd === 'USER') {
              credentials.plaintext.push({ type: 'FTP', username: p.ftpArg, password: '', frame: p.frameNumber });
            }
            if (p.ftpCmd === 'PASS') {
              const lastUser = credentials.plaintext.findLast(c => c.type === 'FTP' && !c.password);
              if (lastUser) lastUser.password = p.ftpArg;
            }
          });
    
          // Process Telnet
          packets.forEach(p => {
            if (p.telnetData) {
              const telnetStr = p.telnetData.trim();
              if (telnetStr.toLowerCase().includes('login:') || telnetStr.toLowerCase().includes('password:')) {
                credentials.plaintext.push({ type: 'Telnet Prompt', data: telnetStr, frame: p.frameNumber });
              } else if (telnetStr && !telnetStr.match(/[A-Z][a-z]+:/) && !telnetStr.includes(' ')) {
                const lastPrompt = credentials.plaintext.findLast(c => c.type === 'Telnet Prompt');
                if (lastPrompt && lastPrompt.data.toLowerCase().includes('login:')) {
                  credentials.plaintext.push({ type: 'Telnet', username: telnetStr, password: '', frame: p.frameNumber });
                } else if (lastPrompt && lastPrompt.data.toLowerCase().includes('password:')) {
                  const lastUser = credentials.plaintext.findLast(c => c.type === 'Telnet' && !c.password);
                  if (lastUser) lastUser.password = telnetStr;
                  else credentials.plaintext.push({ type: 'Telnet', username: '', password: telnetStr, frame: p.frameNumber });
                }
              }
            }
          });
  
          // Process Kerberos credentials
          const kerberosLines = kerberosOut.split('\n').filter(line => line.trim());
          kerberosLines.forEach(line => {
            const [cname, realm, cipher, type, msgType, frameNumber] = line.split('\t');
            
            if (cipher && type) {
              let hashFormat = '';
              // Format hash based on message type
              if (msgType === '10' || msgType === '30') { // AS-REQ or TGS-REQ
                hashFormat = '$krb5pa$23$';
                if (cname) hashFormat += `${cname}$`;
                if (realm) hashFormat += `${realm}$`;
                hashFormat += cipher;
              } else if (msgType === '11') { // AS-REP
                hashFormat = '$krb5asrep$23$';
                if (cname) hashFormat += `${cname}@`;
                if (realm) hashFormat += `${realm}$`;
                hashFormat += cipher;
              }
  
              if (hashFormat) {
                credentials.encrypted.push({
                  type: 'Kerberos',
                  hash: hashFormat,
                  username: cname || 'unknown',
                  realm: realm || 'unknown',
                  frame: frameNumber,
                  crackingMode: msgType === '11' ? 'hashcat -m 18200' : 'hashcat -m 7500'
                });
              }
            }
          });
  
          console.error(`Found ${credentials.plaintext.length} plaintext and ${credentials.encrypted.length} encrypted credentials`);
    
          const outputText = `Analyzed PCAP: ${pcapPath}\n\n` +
            `Plaintext Credentials:\n${credentials.plaintext.length > 0 ? 
              credentials.plaintext.map(c => 
                c.type === 'Telnet Prompt' ? 
                  `${c.type}: ${c.data} (Frame ${c.frame})` : 
                  `${c.type}: ${c.username}:${c.password} (Frame ${c.frame})`
              ).join('\n') : 
              'None'}\n\n` +
            `Encrypted/Hashed Credentials:\n${credentials.encrypted.length > 0 ?
              credentials.encrypted.map(c =>
                `${c.type}: User=${c.username} Realm=${c.realm} (Frame ${c.frame})\n` +
                `Hash=${c.hash}\n` +
                `Cracking Command: ${c.crackingMode}\n`
              ).join('\n') :
              'None'}\n\n` +
            `Note: Encrypted credentials can be cracked using tools like John the Ripper or hashcat.\n` +
            `For Kerberos hashes:\n` +
            `- AS-REQ/TGS-REQ: hashcat -m 7500 or john --format=krb5pa-md5\n` +
            `- AS-REP: hashcat -m 18200 or john --format=krb5asrep`;
    
          return {
            content: [{ type: 'text', text: outputText }],
          };
        } catch (error) {
          console.error(`Error in extract_credentials: ${error.message}`);
          return { content: [{ type: 'text', text: `Error: ${error.message}` }], isError: true };
        }
      }
    );

• index.js:368-370 (schema)

  Input schema for the 'extract_credentials' tool defining the required pcapPath parameter.

  {
    pcapPath: z.string().describe('Path to the PCAP file to analyze (e.g., ./demo.pcap)'),
  },

• index.js:366-366 (registration)

  Registration of the tool name in server.tool call.

  'extract_credentials',

• index.js:637-655 (helper)

  Associated prompt template 'extract_credentials_prompt' for guiding LLM usage of the tool.

  server.prompt(
    'extract_credentials_prompt',
    {
      pcapPath: z.string().describe('Path to the PCAP file'),
    },
    ({ pcapPath }) => ({
      messages: [{
        role: 'user',
        content: {
          type: 'text',
          text: `Please analyze the PCAP file at ${pcapPath} for potential credential exposure:
  1. Look for plaintext credentials (HTTP Basic Auth, FTP, Telnet)
  2. Identify Kerberos authentication attempts
  3. Extract any hashed credentials
  4. Provide security recommendations for credential handling`
        }
      }]
    })
  );