
#some weirdness about pyshark
import sys
reload(sys)
sys.setdefaultencoding('utf8')


import pyshark 
pcap = pyshark.FileCapture('pcap.pcap')

dataDNS = ""
dataTCP = ""
dataSMB = ""

for packet in pcap:
    if "DNS" in packet and "txt" in dir(packet.dns):
        dataDNS += (packet.dns.qry_name+" "+packet.dns.txt)
        dataDNS += "\n"
    if "TCP" in packet: # and (packet.ip.dst == "52.0.104.200" or packet.ip.src == "52.0.104.200"):
        if packet.tcp.stream == "0" and "payload" in dir(packet.tcp): #"segment_data" in dir(packet.tcp):
            if packet.ip.src == "52.0.104.200":
                packet.tcp.raw_mode = True
                dataTCP += packet.tcp.payload
                dataTCP += "\n"
                packet.tcp.raw_mode = False
            else:
                packet.tcp.raw_mode = True
                dataTCP += "R"
                dataTCP += packet.tcp.payload
                dataTCP += "\n"
                packet.tcp.raw_mode = False
                
    #need to reverse R/not R for the first packages for SMB2 for who knows what reason
    if "SMB2" in packet:
        if "read_length" in dir(packet.smb2) and packet.smb2.read_length != "92" and packet.smb2.read_length != "8192" and packet.smb2.read_length != "1024" and packet.smb2.read_length != "0":
            packet.tcp.raw_mode = True
            dataSMB += "R"
            dataSMB += packet.tcp.payload[168:]
            dataSMB += "\n"
            packet.tcp.raw_mode = False
        if "write_length" in dir(packet.smb2) and packet.smb2.write_length != "116":
            packet.tcp.raw_mode = True
            dataSMB += packet.tcp.payload[232:]
            dataSMB += "\n"
            packet.tcp.raw_mode = False 
            
        
#(smb2 && ip.src == 192.168.221.105 && smb2.read_length != 8192 && smb2.read_length != 92) || (smb2 && smb2.write_length < 65000 && ip.src == 192.168.221.91 && smb2.write_length != 116)

#dump DNS traffic
f = open("parsedpcap.txt", "w")
f.write(dataDNS)
f.close()
#dump direct TCP traffic
f = open("parsedpcap2.txt", "w")
f.write(dataTCP)
f.close()
#dump SMB traffic
f = open("parsedpcap3.txt", "w")
f.write(dataSMB)
f.close()
print("Done..")

#This only produces a rough draft of what the what the needed data looks like, so I manually fixed some mistakes that are not covered by this