Wireshark? Nope, Network Shell (Part 3 Final)

In this article I end this mini series with the introduction of the final feature I will be adding, that being the ability to export packet captures to a pcapng file using a windows tool available for download.

This was the blog where I finally got asynchronous scans working and I was excited to introduce this feature, but it turns out that it doesn’t make sense, at least for what I’ll be using it for. You see, we’re capturing packets on a single interface, so unless you’re trying to capture traffic on multiple interfaces, it doesn’t make sense, and a feature like this just makes things much more complicated than they need to be. It was after getting the code working that I realized the actual functionality would become messy, and it’s just not worth it.

Nevertheless, there is still another feature that I did want to introduce, the ability to generate PCAP files so that you can view the data in a program like Wireshark, if that’s your cup of tea. To perform this, we’ll need to break one of our rules and use a separate executable, etl2pcapng.exe. This tool, which I will refer to as “e2p,” is a Microsoft tool that allows us to convert ETL files to PCAPNG files, giving us the ability to expand and use other tools to perform our analysis.

The implementation is quite simple. For my script, I’ll be dropping the executable in the same directory as the script, making my life a lot easier and the code just a bit simpler. Once we have that executable, we can add just a few lines of code to automatically generate this file whenever we run a scan.

Start-PacketCapture {
            #Get Current Date & Time To Be Used To Name Session Capture
            $DateStamp = Get-Date -Format "ddMMyyyyHHmmss"

            $SessionName =  -join("CaptureSession","",${DateStamp})
            # Initialize Packet Capture Session
            New-NetEventSession -Name $SessionName

            # Adding Provider To Session, Default Should Be Microsoft-Windows-TCPIP But Will Add Option In Future
            Add-NetEventProvider -Name “Microsoft-Windows-TCPIP” -SessionName $SessionName
            Add-NetEventPacketCaptureProvider -SessionName $SessionName

            # Saving Session Object That Contains Information About Where The Log File Is Located
            $SessionObject = Get-NetEventSession -Name $SessionName
            
            $time = Read-Host "Packet Capture Duration(Seconds)? "
            # If time is set to 0 seconds then the script will run infinitely, well until the file hits 256 MB.
            if ($time -eq "0") {
                # Notify user that the packet capture is running
                Write-Host "Infinite Packet Capture Is WIP"
            }
            else {
                # Notify user that the packet capture is running for specified amount of seconds
                Write-Host "Started The Packet Capture In The Background For ${time} Seconds"

                # Start Packet Capture Job
                Start-NetEventSession -Name $SessionName

                # Use Timeout To Time The Capture
                Start-Sleep -Seconds $time

                # Stop The Packet Capture Job
                Stop-NetEventSession -Name $SessionName
                
                # Parse The Logs
                $SessionObjectLog = Get-WinEvent -Path $SessionObject.LocalFilePath –Oldest

                .\etl2pcapng.exe $SessionObject.LocalFilePath "$SessionName.pcapng"

            }
            Remove-NetEventSession -Name $SessionName
        }

As proof, I ran a scan that generated a PCAP file with the name ‘CaptureSession11022023082203.pcapng.’ I was able to verify that there was actual network data within it in Wireshark, as you can see below.

I hope that this mini-series was helpful and inspiring. PowerShell is extremely powerful, and I hope to show you that you can perform just about any task or build any application that you want with a bit of know-how and creativity. If you’re interested in the full project, I ask that you visit my Github page where I will upload all the scripts and tools that I develop in these articles.

As a final piece, I ask that you try this script and build a GUI around it, maybe one that is similar to that of Wireshark.

Thanks, and take care.