Proxsneak/bettercap/packets/teamviewer.go

package packets

import (
	"encoding/binary"
	"fmt"
)

const TeamViewerPort = 5938

var teamViewerCommands = map[uint8]string{
	10:  "CMD_IDENTIFY",
	11:  "CMD_REQUESTCONNECT",
	13:  "CMD_DISCONNECT",
	14:  "CMD_VNCDISCONNECT",
	15:  "CMD_TVCONNECTIONFAILED",
	16:  "CMD_PING",
	17:  "CMD_PINGOK",
	18:  "CMD_MASTERCOMMAND",
	19:  "CMD_MASTERRESPONSE",
	20:  "CMD_CHANGECONNECTION",
	21:  "CMD_NOPARTNERCONNECT",
	22:  "CMD_CONNECTTOWAITINGTHREAD",
	23:  "CMD_SESSIONMODE",
	24:  "CMD_REQUESTROUTINGSESSION",
	25:  "CMD_TIMEOUT",
	26:  "CMD_JAVACONNECT",
	27:  "CMD_KEEPALIVEBEEP",
	28:  "CMD_REQUESTKEEPALIVE",
	29:  "CMD_MASTERCOMMAND_ENCRYPTED",
	30:  "CMD_MASTERRESPONSE_ENCRYPTED",
	31:  "CMD_REQUESTRECONNECT",
	32:  "CMD_RECONNECTTOWAITINGTHREAD",
	33:  "CMD_STARTLOGGING",
	34:  "CMD_SERVERAVAILABLE",
	35:  "CMD_KEEPALIVEREQUEST",
	36:  "CMD_OK",
	37:  "CMD_FAILED",
	38:  "CMD_PING_PERFORMANCE",
	39:  "CMD_PING_PERFORMANCE_RESPONSE",
	40:  "CMD_REQUESTKEEPALIVE2",
	41:  "CMD_DISCONNECT_SWITCHEDTOUDP",
	42:  "CMD_SENDMODE_UDP",
	43:  "CMD_KEEPALIVEREQUEST_ANSWER",
	44:  "CMD_ROUTE_CMD_TO_CLIENT",
	45:  "CMD_NEW_MASTERLOGIN",
	46:  "CMD_BUDDY",
	47:  "CMD_ACCEPTROUTINGSESSION",
	48:  "CMD_NEW_MASTERLOGIN_ANSWER",
	49:  "CMD_BUDDY_ENCRYPTED",
	50:  "CMD_REQUEST_ROUTE_BUDDY",
	51:  "CMD_CONTACT_OTHER_MASTER",
	52:  "CMD_REQUEST_ROUTE_ENCRYPTED",
	53:  "CMD_ENDSESSION",
	54:  "CMD_SESSIONID",
	55:  "CMD_RECONNECT_TO_SESSION",
	56:  "CMD_RECONNECT_TO_SESSION_ANSWER",
	57:  "CMD_MEETING_CONTROL",
	58:  "CMD_CARRIER_SWITCH",
	59:  "CMD_MEETING_AUTHENTICATION",
	60:  "CMD_ROUTERCMD",
	61:  "CMD_PARTNERRECONNECT",
	62:  "CMD_CONGRESTION_CONTROL",
	63:  "CMD_ACK",
	70:  "CMD_UDPREQUESTCONNECT",
	71:  "CMD_UDPPING",
	72:  "CMD_UDPREQUESTCONNECT_VPN",
	90:  "CMD_DATA",
	91:  "CMD_DATA2",
	92:  "CMD_DATA_ENCRYPTED",
	93:  "CMD_REQUESTENCRYPTION",
	94:  "CMD_CONFIRMENCRYPTION",
	95:  "CMD_ENCRYPTIONREQUESTFAILED",
	96:  "CMD_REQUESTNOENCRYPTION",
	97:  "CMD_UDPFLOWCONTROL",
	98:  "CMD_DATA3",
	99:  "CMD_DATA3_ENCRYPTED",
	100: "CMD_DATA3_RESENDPACKETS",
	101: "CMD_DATA3_ACKPACKETS",
	102: "CMD_AUTH_CHALLENGE",
	103: "CMD_AUTH_RESPONSE",
	104: "CMD_AUTH_RESULT",
	105: "CMD_RIP_MESSAGES",
	106: "CMD_DATA4",
	107: "CMD_DATASTREAM",
	108: "CMD_UDPHEARTBEAT",
	109: "CMD_DATA_DIRECTED",
	110: "CMD_UDP_RESENDPACKETS",
	111: "CMD_UDP_ACKPACKETS",
	112: "CMD_UDP_PROTECTEDCOMMAND",
	113: "CMD_FLUSHSENDBUFFER",
}

type TeamViewerPacket struct {
	Magic       uint16
	Version     string
	CommandCode uint8
	Command     string
}

func ParseTeamViewer(data []byte) *TeamViewerPacket {
	if len(data) < 3 {
		return nil
	}

	magic := binary.BigEndian.Uint16(data[0:2])
	cmdCode := uint8(data[3])
	version := "1.x"
	cmd := "CMD_?"

	if magic == 0x1724 {
		version = "1.x"
	} else if magic == 0x1130 {
		version = "2.x"
	} else {
		version = fmt.Sprintf("?.? (magic=0x%x)", magic)
	}

	if val, found := teamViewerCommands[cmdCode]; !found {
		return nil
	} else {
		cmd = val
	}

	return &TeamViewerPacket{
		Magic:       magic,
		Version:     version,
		CommandCode: cmdCode,
		Command:     cmd,
	}
}