BaseAttack.py 22 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546
  1. # Aidmar
  2. from scapy.layers.inet import Ether
  3. import ipaddress
  4. import os
  5. import random
  6. import re
  7. import tempfile
  8. from abc import abstractmethod, ABCMeta
  9. import numpy as np # TO-DO: it needs to be added to required packages
  10. import ID2TLib.libpcapreader as pr
  11. from scapy.utils import PcapWriter
  12. from Attack import AttackParameters
  13. from Attack.AttackParameters import Parameter
  14. from Attack.AttackParameters import ParameterTypes
  15. class BaseAttack(metaclass=ABCMeta):
  16. """
  17. Abstract base class for all attack classes. Provides basic functionalities, like parameter validation.
  18. """
  19. def __init__(self, statistics, name, description, attack_type):
  20. """
  21. To be called within the individual attack class to initialize the required parameters.
  22. :param statistics: A reference to the Statistics class.
  23. :param name: The name of the attack class.
  24. :param description: A short description of the attack.
  25. :param attack_type: The type the attack belongs to, like probing/scanning, malware.
  26. """
  27. # Reference to statistics class
  28. self.statistics = statistics
  29. # Class fields
  30. self.attack_name = name
  31. self.attack_description = description
  32. self.attack_type = attack_type
  33. self.params = {}
  34. self.supported_params = {}
  35. self.attack_start_utime = 0
  36. self.attack_end_utime = 0
  37. @abstractmethod
  38. def generate_attack_pcap(self):
  39. """
  40. Creates a pcap containing the attack packets.
  41. :return: The location of the generated pcap file.
  42. """
  43. pass
  44. ################################################
  45. # HELPER VALIDATION METHODS
  46. # Used to validate the given parameter values
  47. ################################################
  48. @staticmethod
  49. def _is_mac_address(mac_address: str):
  50. """
  51. Verifies if the given string is a valid MAC address. Accepts the formats 00:80:41:ae:fd:7e and 00-80-41-ae-fd-7e.
  52. :param mac_address: The MAC address as string.
  53. :return: True if the MAC address is valid, otherwise False.
  54. """
  55. pattern = re.compile('^([0-9A-Fa-f]{2}[:-]){5}([0-9A-Fa-f]{2})$', re.MULTILINE)
  56. if isinstance(mac_address, list):
  57. for mac in mac_address:
  58. if re.match(pattern, mac) is None:
  59. return False
  60. else:
  61. if re.match(pattern, mac_address) is None:
  62. return False
  63. return True
  64. @staticmethod
  65. def _is_ip_address(ip_address: str):
  66. """
  67. Verifies that the given string or list of IP addresses (strings) is a valid IPv4/IPv6 address.
  68. Accepts comma-separated lists of IP addresses, like "192.169.178.1, 192.168.178.2"
  69. :param ip_address: The IP address(es) as list of strings or comma-separated string.
  70. :return: True if all IP addresses are valid, otherwise False. And a list of IP addresses as string.
  71. """
  72. ip_address_output = []
  73. # a comma-separated list of IP addresses must be splitted first
  74. if isinstance(ip_address, str):
  75. ip_address = ip_address.split(',')
  76. for ip in ip_address:
  77. try:
  78. ipaddress.ip_address(ip)
  79. ip_address_output.append(ip)
  80. except ValueError:
  81. return False, ip_address_output
  82. if len(ip_address_output) == 1:
  83. return True, ip_address_output[0]
  84. else:
  85. return True, ip_address_output
  86. @staticmethod
  87. def _is_port(ports_input: str):
  88. """
  89. Verifies if the given value is a valid port. Accepts port ranges, like 80-90, 80..99, 80...99.
  90. :param ports_input: The port number as int or string.
  91. :return: True if the port number is valid, otherwise False. If a single port or a comma-separated list of ports
  92. was given, a list of int is returned. If a port range was given, the range is resolved
  93. and a list of int is returned.
  94. """
  95. def _is_invalid_port(num):
  96. """
  97. Checks whether the port number is invalid.
  98. :param num: The port number as int.
  99. :return: True if the port number is invalid, otherwise False.
  100. """
  101. return num < 1 or num > 65535
  102. if isinstance(ports_input, str):
  103. ports_input = ports_input.replace(' ', '').split(',')
  104. elif isinstance(ports_input, int):
  105. ports_input = [ports_input]
  106. ports_output = []
  107. for port_entry in ports_input:
  108. if isinstance(port_entry, int):
  109. if _is_invalid_port(port_entry):
  110. return False
  111. ports_output.append(port_entry)
  112. elif isinstance(port_entry, str) and port_entry.isdigit():
  113. # port_entry describes a single port
  114. port_entry = int(port_entry)
  115. if _is_invalid_port(port_entry):
  116. return False
  117. ports_output.append(port_entry)
  118. elif '-' in port_entry or '..' in port_entry:
  119. # port_entry describes a port range
  120. # allowed format: '1-49151', '1..49151', '1...49151'
  121. match = re.match('^([0-9]{1,5})(?:-|\.{2,3})([0-9]{1,5})$', port_entry)
  122. # check validity of port range
  123. # and create list of ports derived from given start and end port
  124. (port_start, port_end) = int(match.group(1)), int(match.group(2))
  125. if _is_invalid_port(port_start) or _is_invalid_port(port_end):
  126. return False
  127. else:
  128. ports_list = [i for i in range(port_start, port_end + 1)]
  129. # append ports at ports_output list
  130. ports_output += ports_list
  131. if len(ports_output) == 1:
  132. return True, ports_output[0]
  133. else:
  134. return True, ports_output
  135. @staticmethod
  136. def _is_timestamp(timestamp: str):
  137. """
  138. Checks whether the given value is in a valid timestamp format. The accepted format is:
  139. YYYY-MM-DD h:m:s, whereas h, m, s may be one or two digits.
  140. :param timestamp: The timestamp to be checked.
  141. :return: True if the timestamp is valid, otherwise False.
  142. """
  143. is_valid = re.match('[0-9]{4}(?:-[0-9]{1,2}){2} (?:[0-9]{1,2}:){2}[0-9]{1,2}', timestamp)
  144. return is_valid is not None
  145. @staticmethod
  146. def _is_boolean(value):
  147. """
  148. Checks whether the given value (string or bool) is a boolean. Strings are valid booleans if they are in:
  149. {y, yes, t, true, on, 1, n, no, f, false, off, 0}.
  150. :param value: The value to be checked.
  151. :return: True if the value is a boolean, otherwise false. And the casted boolean.
  152. """
  153. # If value is already a boolean
  154. if isinstance(value, bool):
  155. return True, value
  156. # If value is a string
  157. # True values are y, yes, t, true, on and 1;
  158. # False values are n, no, f, false, off and 0.
  159. # Raises ValueError if value is anything else.
  160. try:
  161. import distutils.core
  162. value = distutils.util.strtobool(value.lower())
  163. is_bool = True
  164. except ValueError:
  165. is_bool = False
  166. return is_bool, value
  167. @staticmethod
  168. def _is_float(value):
  169. """
  170. Checks whether the given value is a float.
  171. :param value: The value to be checked.
  172. :return: True if the value is a float, otherwise False. And the casted float.
  173. """
  174. try:
  175. value = float(value)
  176. return True, value
  177. except ValueError:
  178. return False, value
  179. # Aidmar
  180. @staticmethod
  181. def _is_domain(val: str):
  182. """
  183. Verifies that the given string is a valid URI.
  184. :param uri: The URI as string.
  185. :return: True if URI is valid, otherwise False.
  186. """
  187. domain = re.match('^(?:[a-zA-Z]|[0-9]|[$-_@.&+]|[!*\(\),]|(?:%[0-9a-fA-F][0-9a-fA-F]))+$', val)
  188. return (domain is not None)
  189. #########################################
  190. # HELPER METHODS
  191. #########################################
  192. def add_param_value(self, param, value):
  193. """
  194. Adds the pair param : value to the dictionary of attack parameters. Prints and error message and skips the
  195. parameter if the validation fails.
  196. :param param: The parameter name.
  197. :param value: The parameter's value.
  198. :return: None.
  199. """
  200. # by default no param is valid
  201. is_valid = False
  202. # get AttackParameters instance associated with param
  203. # for default values assigned in attack classes, like Parameter.PORT_OPEN
  204. if isinstance(param, AttackParameters.Parameter):
  205. param_name = param
  206. # for values given by user input, like port.open
  207. else:
  208. # Get Enum key of given string identifier
  209. param_name = AttackParameters.Parameter(param)
  210. # Get parameter type of attack's required_params
  211. param_type = self.supported_params.get(param_name)
  212. # Verify validity of given value with respect to parameter type
  213. if param_type is None:
  214. print('Parameter ' + str(param_name) + ' not available for chosen attack. Skipping parameter.')
  215. # If value is query -> get value from database
  216. elif self.statistics.is_query(value):
  217. value = self.statistics.process_db_query(value, False)
  218. if value is not None and value is not "":
  219. is_valid = True
  220. else:
  221. print('Error in given parameter value: ' + value + '. Data could not be retrieved.')
  222. # Validate parameter depending on parameter's type
  223. elif param_type == ParameterTypes.TYPE_IP_ADDRESS:
  224. is_valid, value = self._is_ip_address(value)
  225. elif param_type == ParameterTypes.TYPE_PORT:
  226. is_valid, value = self._is_port(value)
  227. elif param_type == ParameterTypes.TYPE_MAC_ADDRESS:
  228. is_valid = self._is_mac_address(value)
  229. elif param_type == ParameterTypes.TYPE_INTEGER_POSITIVE:
  230. if isinstance(value, int) and int(value) >= 0:
  231. is_valid = True
  232. elif isinstance(value, str) and value.isdigit() and int(value) >= 0:
  233. is_valid = True
  234. value = int(value)
  235. elif param_type == ParameterTypes.TYPE_FLOAT:
  236. is_valid, value = self._is_float(value)
  237. # this is required to avoid that the timestamp's microseconds of the first attack packet is '000000'
  238. # but microseconds are only chosen randomly if the given parameter does not already specify it
  239. # e.g. inject.at-timestamp=123456.987654 -> is not changed
  240. # e.g. inject.at-timestamp=123456 -> is changed to: 123456.[random digits]
  241. if param_name == Parameter.INJECT_AT_TIMESTAMP and is_valid and ((value - int(value)) == 0):
  242. value = value + random.uniform(0, 0.999999)
  243. elif param_type == ParameterTypes.TYPE_TIMESTAMP:
  244. is_valid = self._is_timestamp(value)
  245. elif param_type == ParameterTypes.TYPE_BOOLEAN:
  246. is_valid, value = self._is_boolean(value)
  247. elif param_type == ParameterTypes.TYPE_PACKET_POSITION:
  248. ts = pr.pcap_processor(self.statistics.pcap_filepath, "False").get_timestamp_mu_sec(int(value))
  249. if 0 <= int(value) <= self.statistics.get_packet_count() and ts >= 0:
  250. is_valid = True
  251. param_name = Parameter.INJECT_AT_TIMESTAMP
  252. value = (ts / 1000000) # convert microseconds from getTimestampMuSec into seconds
  253. # Aidmar
  254. elif param_type == ParameterTypes.TYPE_DOMAIN:
  255. is_valid = self._is_domain(value)
  256. # add value iff validation was successful
  257. if is_valid:
  258. self.params[param_name] = value
  259. else:
  260. print("ERROR: Parameter " + str(param) + " or parameter value " + str(value) +
  261. " not valid. Skipping parameter.")
  262. def get_param_value(self, param: Parameter):
  263. """
  264. Returns the parameter value for a given parameter.
  265. :param param: The parameter whose value is wanted.
  266. :return: The parameter's value.
  267. """
  268. return self.params.get(param)
  269. def check_parameters(self):
  270. """
  271. Checks whether all parameter values are defined. If a value is not defined, the application is terminated.
  272. However, this should not happen as all attack should define default parameter values.
  273. """
  274. # parameters which do not require default values
  275. non_obligatory_params = [Parameter.INJECT_AFTER_PACKET, Parameter.NUMBER_ATTACKERS]
  276. for param, type in self.supported_params.items():
  277. # checks whether all params have assigned values, INJECT_AFTER_PACKET must not be considered because the
  278. # timestamp derived from it is set to Parameter.INJECT_AT_TIMESTAMP
  279. if param not in self.params.keys() and param not in non_obligatory_params:
  280. print("\033[91mCRITICAL ERROR: Attack '" + self.attack_name + "' does not define the parameter '" +
  281. str(param) + "'.\n The attack must define default values for all parameters."
  282. + "\n Cannot continue attack generation.\033[0m")
  283. import sys
  284. sys.exit(0)
  285. def write_attack_pcap(self, packets: list, append_flag: bool = False, destination_path: str = None):
  286. """
  287. Writes the attack's packets into a PCAP file with a temporary filename.
  288. :return: The path of the written PCAP file.
  289. """
  290. # Only check params initially when attack generation starts
  291. if append_flag is False and destination_path is None:
  292. # Check if all req. parameters are set
  293. self.check_parameters()
  294. # Determine destination path
  295. if destination_path is not None and os.path.exists(destination_path):
  296. destination = destination_path
  297. else:
  298. temp_file = tempfile.NamedTemporaryFile(delete=False, suffix='.pcap')
  299. destination = temp_file.name
  300. # Write packets into pcap file
  301. pktdump = PcapWriter(destination, append=append_flag)
  302. pktdump.write(packets)
  303. # Store pcap path and close file objects
  304. pktdump.close()
  305. return destination
  306. #########################################
  307. # RANDOM IP/MAC ADDRESS GENERATORS
  308. #########################################
  309. @staticmethod
  310. def generate_random_ipv4_address(ipClass, n: int = 1):
  311. """
  312. Generates n random IPv4 addresses.
  313. :param n: The number of IP addresses to be generated
  314. :return: A single IP address, or if n>1, a list of IP addresses
  315. """
  316. def is_invalid(ipAddress: ipaddress.IPv4Address):
  317. return ipAddress.is_multicast or ipAddress.is_unspecified or ipAddress.is_loopback or \
  318. ipAddress.is_link_local or ipAddress.is_reserved or ipAddress.is_private
  319. # Aidmar - generate a random IP from specific class
  320. #def generate_address():
  321. # return ipaddress.IPv4Address(random.randint(0, 2 ** 32 - 1))
  322. def generate_address(ipClass):
  323. #print(ipClass)
  324. """if "private" in ipClass:
  325. ipClassesByte1 = {"A-private": 10, "B-private": 172, "C-private": 192}
  326. b1 = ipClassesByte1[ipClass]
  327. ipClassesByte2 = {"A-private": {0,255}, "B-private": {16,131}, "C-private": {168,168}}
  328. minB2 = ipClassesByte1[ipClass][0]
  329. maxB2 = ipClassesByte1[ipClass][1]
  330. b2 = random.randint(minB2, maxB2)
  331. b3b4 = random.randint(0, 2 ** 16 - 1)
  332. ipAddress = ipaddress.IPv4Address(str(b1)+str(b2)+str(b3b4))
  333. else:"""
  334. if ipClass == "Unknown":
  335. return ipaddress.IPv4Address(random.randint(0, 2 ** 32 - 1))
  336. else:
  337. # For DDoS attack, we do not generate private IPs
  338. if "private" in ipClass:
  339. ipClass = ipClass[0] # convert A-private to A
  340. ipClassesByte1 = {"A": {1,126}, "B": {128,191}, "C":{192, 223}, "D":{224, 239}, "E":{240, 254}}
  341. temp = list(ipClassesByte1[ipClass])
  342. minB1 = temp[0]
  343. maxB1 = temp[1]
  344. b1 = random.randint(minB1, maxB1)
  345. b2 = random.randint(1, 255)
  346. b3 = random.randint(1, 255)
  347. b4 = random.randint(1, 255)
  348. ipAddress = ipaddress.IPv4Address(str(b1) +"."+ str(b2) + "." + str(b3) + "." + str(b4))
  349. return ipAddress
  350. ip_addresses = []
  351. for i in range(0, n):
  352. address = generate_address(ipClass)
  353. while is_invalid(address):
  354. address = generate_address(ipClass)
  355. ip_addresses.append(str(address))
  356. if n == 1:
  357. return ip_addresses[0]
  358. else:
  359. return ip_addresses
  360. @staticmethod
  361. def generate_random_ipv6_address(n: int = 1):
  362. """
  363. Generates n random IPv6 addresses.
  364. :param n: The number of IP addresses to be generated
  365. :return: A single IP address, or if n>1, a list of IP addresses
  366. """
  367. def is_invalid(ipAddress: ipaddress.IPv6Address):
  368. return ipAddress.is_multicast or ipAddress.is_unspecified or ipAddress.is_loopback or \
  369. ipAddress.is_link_local or ipAddress.is_private or ipAddress.is_reserved
  370. def generate_address():
  371. return ipaddress.IPv6Address(random.randint(0, 2 ** 128 - 1))
  372. ip_addresses = []
  373. for i in range(0, n):
  374. address = generate_address()
  375. while is_invalid(address):
  376. address = generate_address()
  377. ip_addresses.append(str(address))
  378. if n == 1:
  379. return ip_addresses[0]
  380. else:
  381. return ip_addresses
  382. @staticmethod
  383. def generate_random_mac_address(n: int = 1):
  384. """
  385. Generates n random MAC addresses.
  386. :param n: The number of MAC addresses to be generated.
  387. :return: A single MAC addres, or if n>1, a list of MAC addresses
  388. """
  389. def is_invalid(address: str):
  390. first_octet = int(address[0:2], 16)
  391. is_multicast_address = bool(first_octet & 0b01)
  392. is_locally_administered = bool(first_octet & 0b10)
  393. return is_multicast_address or is_locally_administered
  394. def generate_address():
  395. mac = [random.randint(0x00, 0xff) for i in range(0, 6)]
  396. return ':'.join(map(lambda x: "%02x" % x, mac))
  397. mac_addresses = []
  398. for i in range(0, n):
  399. address = generate_address()
  400. while is_invalid(address):
  401. address = generate_address()
  402. mac_addresses.append(address)
  403. if n == 1:
  404. return mac_addresses[0]
  405. else:
  406. return mac_addresses
  407. # Aidmar
  408. def get_reply_delay(self, ip_dst):
  409. """
  410. Gets the minimum and the maximum reply delay for all the connections of a specific IP.
  411. :param ip_dst: The IP to reterive its reply delay.
  412. :return minDelay: minimum delay
  413. :return maxDelay: maximum delay
  414. """
  415. minDelay = self.statistics.process_db_query(
  416. "SELECT minDelay FROM conv_statistics WHERE ipAddressB='" + ip_dst + "' LIMIT 1")
  417. maxDelay = self.statistics.process_db_query(
  418. "SELECT maxDelay FROM conv_statistics WHERE ipAddressB='" + ip_dst + "' LIMIT 1")
  419. if not minDelay or not maxDelay:
  420. allMinDelays = self.statistics.process_db_query("SELECT minDelay FROM conv_statistics LIMIT 1000;")
  421. minDelay = np.median(allMinDelays)
  422. allMaxDelays = self.statistics.process_db_query("SELECT maxDelay FROM conv_statistics LIMIT 1000;")
  423. maxDelay = np.median(allMaxDelays)
  424. minDelay = int(minDelay) * 10 ** -6 # convert from micro to seconds
  425. maxDelay = int(maxDelay) * 10 ** -6
  426. return minDelay,maxDelay
  427. # Group the packets in conversations
  428. def packetsToConvs(self,exploit_raw_packets):
  429. """
  430. Classifies a bunch of packets to conversations groups. A conversation is a set of packets go between host A (IP,port)
  431. to host B (IP,port)
  432. :param exploit_raw_packets: A set of packets contains several conversations.
  433. :return conversations: A set of arrays, each array contains the packet of specifc conversation
  434. :return orderList_conversations: An array contains the conversations ids (IP_A,port_A, IP_b,port_B) in the order
  435. they appeared in the original packets.
  436. """
  437. conversations = {}
  438. orderList_conversations = []
  439. for pkt_num, pkt in enumerate(exploit_raw_packets):
  440. eth_frame = Ether(pkt[0])
  441. ip_pkt = eth_frame.payload
  442. ip_dst = ip_pkt.getfieldval("dst")
  443. ip_src = ip_pkt.getfieldval("src")
  444. tcp_pkt = ip_pkt.payload
  445. port_dst = tcp_pkt.getfieldval("dport")
  446. port_src = tcp_pkt.getfieldval("sport")
  447. conv_req = (ip_src, port_src, ip_dst, port_dst)
  448. conv_rep = (ip_dst, port_dst, ip_src, port_src)
  449. if conv_req not in conversations and conv_rep not in conversations:
  450. pktList = [pkt]
  451. conversations[conv_req] = pktList
  452. # Order list of conv
  453. orderList_conversations.append(conv_req)
  454. else:
  455. if conv_req in conversations:
  456. pktList = conversations[conv_req]
  457. pktList.append(pkt)
  458. conversations[conv_req] = pktList
  459. else:
  460. pktList = conversations[conv_rep]
  461. pktList.append(pkt)
  462. conversations[conv_rep] = pktList
  463. return (conversations, orderList_conversations)