logshell

#!/bin/bash

## Function that will check if a shell connection has been made so that logging can start.
check_connection() {
    local command="$2"

    # Check if the command contains "ssh"...
    if [[ $command == *"ssh"* ]]; then
        # if so, get IP / hostname from the command itself.
        target=$(echo "$command" | grep -oP '(?<=@)[^\s]+')
        client='SSH'
        return 0
    fi

    # Checks for Ncat connection string...
    if [[ $1 =~ Ncat:\ Connection\ from\ .* ]]; then
        target=$(echo "$1" | grep -oE "[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+" | tail -1)
        client='Ncat'
        return 0
    fi

    # No connection was made.
    return 1
}

# Removes any unwanted characters from a user input line.
clean_line() {
    local str="$1"
    
    # Cleans line of ^M (new line) characters.
    str=$(echo "$str" | sed 's/\r//g')
    
    # This loop cleans up backspaces in user input, so we only log the final characters without the ^H clutter.
   local result=""
    for ((i=0; i<${#str}; i++)); do
        local char="${str:$i:1}"
        if [ "$char" = $'\x08' ]; then
            result="${result%?}"
        else
            result+="$char"
        fi
    done

    echo "$result"
}

# Intructiosn on how to use the program alongisde netcat.
if [ "$#" -lt 1 ]; then
    echo "Usage: logshell <netcat command>"
    exit 1
fi

# Directory where log files will be stored.
# You can customize this as needed.
LOGDIR="/tmp"

connection_established=false
client=''
target=''

# Records the session output and simultaneously processes it line by line.
script -q -c "$*" /tmp/record.log | tee >(while IFS= read -r line; do
    # Waits until a connection is established to start logging.
    if ! $connection_established && check_connection "$line" "$*"; then
        # Set log file location.
        log_file="$LOGDIR/$target.log"

        # Check if the file exists and if we don't have write permissions...
        if [ -e "$log_file" ] && ! [ -w "$log_file" ]; then
            # If log file exists but we can't write to it, print error and don't log.
            echo "Error: Log file already exists but you don't have write permissions on it. Perhaps you previously used LogShell with sudo?"
            echo "Session is NOT being logged. Either delete log file at $log_file or grant write permissions."
            echo
            continue 
        fi

        # Will start logging now.
        connection_established=true
        
        # Writes a header indicating the start of a new session along with a timestamp.
        echo "=============================================================" >> "$log_file"
        echo "Shell session via $client initiated at: $(date +"%Y-%m-%d %T")" >> "$log_file"
        echo "=============================================================" >> "$log_file"
        continue
    elif $connection_established; then
        # Cleans line before logging it alonside the timestamp.
        line=$(clean_line "$line")
        echo "($(date +"%T")) $line" >> "$log_file"
    fi
# Removes the temporary output file after the session is done.
done; rm /tmp/record.log)