mushorg · milinddethe15 · Jan 30, 2025 · Jan 30, 2025 · Jan 31, 2025 · Feb 5, 2025
diff --git a/protocols/helpers/helpers.go b/protocols/helpers/helpers.go
@@ -36,3 +36,8 @@ func StorePayload(data []byte) (string, error) {
 	}
 	return sha256Hash, nil
 }
+
+func HashData(data []byte) string {
+	hash := sha256.Sum256(data)
+	return hex.EncodeToString(hash[:])
+}
diff --git a/protocols/tcp/responses/110_tcp b/protocols/tcp/responses/110_tcp
@@ -0,0 +1 @@
++OK 
diff --git a/protocols/tcp/responses/135_tcp b/protocols/tcp/responses/135_tcp
diff --git a/protocols/tcp/responses/139_tcp b/protocols/tcp/responses/139_tcp
diff --git a/protocols/tcp/responses/1433_tcp b/protocols/tcp/responses/1433_tcp
diff --git a/protocols/tcp/responses/21000_tcp b/protocols/tcp/responses/21000_tcp
@@ -0,0 +1,4 @@
+Microsoft Windows XP [Version 5.1.2600]
+(C) Copyright 1985-2001 Microsoft Corp.
+
+C:\WINDOWS\system32> 
diff --git a/protocols/tcp/responses/21_tcp b/protocols/tcp/responses/21_tcp
@@ -0,0 +1 @@
+220 Welcome to localhost
diff --git a/protocols/tcp/responses/25_tcp b/protocols/tcp/responses/25_tcp
@@ -0,0 +1 @@
+250 localhost ESMTP Postfix
diff --git a/protocols/tcp/responses/3306_tcp b/protocols/tcp/responses/3306_tcp
diff --git a/protocols/tcp/responses/4444_tcp b/protocols/tcp/responses/4444_tcp
@@ -0,0 +1,4 @@
+Microsoft Windows XP [Version 5.1.2600]
+(C) Copyright 1985-2001 Microsoft Corp.
+
+C:\WINDOWS\system32> 
diff --git a/protocols/tcp/responses/445_tcp b/protocols/tcp/responses/445_tcp
diff --git a/protocols/tcp/responses/4899_tcp b/protocols/tcp/responses/4899_tcp
diff --git a/protocols/tcp/responses/5060_tcp b/protocols/tcp/responses/5060_tcp
@@ -0,0 +1,26 @@
+SIP/2.0 200 OK
+Via: SIP/2.0/TCP 127.0.0.1:5060;branch=1234567890
+From: sip:1234567890@127.0.0.1;tag=bad-012345
+To: <sip:0987654321@127.0.0.1;user=phone>;tag=bad-012345
+Call-ID: 1348979872-797979222304855
+Cseq: 15 INVITE
+Contact: sip:0987654321@127.0.0.1
+Content-Length: 401
+Content-Type: application/sdp
+
+v=0
+Anonymous 1234567890 9876543210 IN IP4 127.0.0.1
+s=SIGMA is the best
+s=gotcha
+c=IN IP4 127.0.0.1
+t=0 0
+m=audio 36952 RTP/AVP 107 119 100 106 6 0 97 105 98 8 18 3 5 101
+a=rtpmap:107 BV32/16000
+a=rtpmap:119 BV32-FEC/16000
+a=rtpmap:100 SPEEX/16000
+a=rtpmap:106 SPEEX-FEC/16000
+a=rtpmap:97 SPEEX/8000
+a=rtpmap:105 SPEEX-FEC/8000
+a=rtpmap:98 iLBC/8000
+a=rtpmap:101 telephone-event/8000
+a=fmtp:101 0-11
diff --git a/protocols/tcp/responses/5900_tcp b/protocols/tcp/responses/5900_tcp
@@ -0,0 +1 @@
+RFB 003.008
diff --git a/protocols/tcp/responses/8009_tcp b/protocols/tcp/responses/8009_tcp
diff --git a/protocols/tcp/responses/80_tcp b/protocols/tcp/responses/80_tcp
@@ -0,0 +1,15 @@
+HTTP/1.1 200 OK
+Connection: close
+Date: Sun, 27 Nov 2005 13:07:34 GMT
+Server: Microsoft-IIS/6.0
+X-Powered-By: ASP.NET
+X-AspNet-Version: 2.0.50727
+Accept-Ranges: bytes
+Content-Length: 30
+Cache-Control: private
+Content-Type: text/html; charset=utf-8
+
+<HTML>
+<BODY>
+</BODY>
+</HTML>
diff --git a/protocols/tcp/tcp.go b/protocols/tcp/tcp.go
@@ -3,6 +3,7 @@ package tcp
 import (
 	"context"
 	"crypto/rand"
+	"embed"
 	"encoding/hex"
 	"fmt"
 	"log/slog"
@@ -28,6 +29,58 @@ type tcpServer struct {
 	events []parsedTCP
 }
 
+//go:embed responses/*
+var embeddedFiles embed.FS
+
+var responseFileMap = map[uint16]string{
+	21:    "responses/21_tcp",
+	25:    "responses/25_tcp",
+	80:    "responses/80_tcp",
+	110:   "responses/110_tcp",
+	135:   "responses/135_tcp",
+	139:   "responses/139_tcp",
+	445:   "responses/445_tcp",
+	1433:  "responses/1433_tcp",
+	3306:  "responses/3306_tcp",
+	4444:  "responses/4444_tcp",
+	4899:  "responses/4899_tcp",
+	5060:  "responses/5060_tcp",
+	5900:  "responses/5900_tcp",
+	8009:  "responses/8009_tcp",
+	21000: "responses/21000_tcp",
+}
+
+func (s *tcpServer) getResponse(port uint16) ([]byte, error) {
+	filePath, exists := responseFileMap[port]
+	if !exists {
+		return nil, fmt.Errorf("file not found for port: %v", port)
+	}
+
+	return embeddedFiles.ReadFile(filePath)
+}
+
+func (s *tcpServer) sendPortSpecificResponse(conn net.Conn, port uint16, logger interfaces.Logger) error {
+	response, err := s.getResponse(port)
+	if err != nil {
+		// If no specific response file exists, fall back to random data
+		logger.Debug("No specific response file found, sending random data",
+			slog.String("handler", "tcp"),
+			slog.Uint64("port", uint64(port)))
+		return s.sendRandom(conn)
+	}
+
+	s.events = append(s.events, parsedTCP{
+		Direction:   "write",
+		PayloadHash: helpers.HashData(response),
+		Payload:     response,
+	})
+
+	if _, err := conn.Write(response); err != nil {
+		return fmt.Errorf("failed to write response: %w", err)
+	}
+	return nil
+}
+
 func (s *tcpServer) sendRandom(conn net.Conn) error {
 	randomInt, err := rand.Int(rand.Reader, big.NewInt(500))
 	if err != nil {
@@ -114,8 +167,8 @@ func HandleTCP(ctx context.Context, conn net.Conn, md connection.Metadata, logge
 		}
 	}
 
-	// sending some random data
-	if err := server.sendRandom(conn); err != nil {
+	// Send port-specific or random response
+	if err := server.sendPortSpecificResponse(conn, md.TargetPort, logger); err != nil {
 		logger.Error("write error", slog.String("handler", "tcp"), producer.ErrAttr(err))
 	}