SQLiAttack.py 9.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233
  1. # Created by Aidmar
  2. """
  3. ATutor 2.2.1 SQL Injection / Remote Code Execution
  4. This module exploits a SQL Injection vulnerability and an authentication weakness vulnerability in ATutor. This essentially
  5. means an attacker can bypass authentication and reach the administrator's interface where they can upload malicious code.
  6. more info:
  7. https://www.rapid7.com/db/modules/exploit/multi/http/atutor_sqli
  8. """
  9. import logging
  10. import math
  11. from operator import itemgetter
  12. import operator
  13. from random import randint, uniform
  14. from lea import Lea
  15. from Attack import BaseAttack
  16. from Attack.AttackParameters import Parameter as Param
  17. from Attack.AttackParameters import ParameterTypes
  18. logging.getLogger("scapy.runtime").setLevel(logging.ERROR)
  19. # noinspection PyPep8
  20. from scapy.utils import RawPcapReader
  21. from scapy.layers.inet import IP, Ether, TCP, RandShort
  22. #from scapy.all import *
  23. class SQLiAttack(BaseAttack.BaseAttack):
  24. # Metasploit default packet rate
  25. maxDefaultPPS = 55
  26. minDefaultPPS = 5
  27. # HTTP port
  28. http_port = 80
  29. # Metasploit experiments show this range of ports
  30. minDefaultPort = 30000
  31. maxDefaultPort = 50000
  32. def __init__(self, statistics, pcap_file_path):
  33. """
  34. Creates a new instance of the SQLi Attack.
  35. :param statistics: A reference to the statistics class.
  36. """
  37. # Initialize attack
  38. super(SQLiAttack, self).__init__(statistics, "SQLi Attack", "Injects a SQLi attack'",
  39. "Resource Exhaustion")
  40. # Define allowed parameters and their type
  41. self.supported_params = {
  42. Param.MAC_SOURCE: ParameterTypes.TYPE_MAC_ADDRESS,
  43. Param.IP_SOURCE: ParameterTypes.TYPE_IP_ADDRESS,
  44. Param.MAC_DESTINATION: ParameterTypes.TYPE_MAC_ADDRESS,
  45. Param.IP_DESTINATION: ParameterTypes.TYPE_IP_ADDRESS,
  46. Param.TARGET_HOST: ParameterTypes.TYPE_URI,
  47. Param.TARGET_URI: ParameterTypes.TYPE_URI,
  48. Param.INJECT_AT_TIMESTAMP: ParameterTypes.TYPE_FLOAT,
  49. Param.INJECT_AFTER_PACKET: ParameterTypes.TYPE_PACKET_POSITION,
  50. Param.PACKETS_PER_SECOND: ParameterTypes.TYPE_FLOAT
  51. }
  52. # PARAMETERS: initialize with default utilsvalues
  53. # (values are overwritten if user specifies them)
  54. most_used_ip_address = self.statistics.get_most_used_ip_address()
  55. if isinstance(most_used_ip_address, list):
  56. most_used_ip_address = most_used_ip_address[0]
  57. self.add_param_value(Param.IP_SOURCE, most_used_ip_address)
  58. self.add_param_value(Param.MAC_SOURCE, self.statistics.get_mac_address(most_used_ip_address))
  59. self.add_param_value(Param.TARGET_URI, "/")
  60. self.add_param_value(Param.TARGET_HOST, "www.hackme.com")
  61. self.add_param_value(Param.INJECT_AFTER_PACKET, randint(0, self.statistics.get_packet_count()))
  62. self.add_param_value(Param.PACKETS_PER_SECOND,self.maxDefaultPPS)
  63. # victim configuration
  64. # consider that the destination has port 80 opened
  65. random_ip_address = self.statistics.get_random_ip_address()
  66. self.add_param_value(Param.IP_DESTINATION, random_ip_address)
  67. destination_mac = self.statistics.get_mac_address(random_ip_address)
  68. if isinstance(destination_mac, list) and len(destination_mac) == 0:
  69. destination_mac = self.generate_random_mac_address()
  70. self.add_param_value(Param.MAC_DESTINATION, destination_mac)
  71. def generate_attack_pcap(self):
  72. def update_timestamp(timestamp, pps, maxdelay):
  73. """
  74. Calculates the next timestamp to be used based on the packet per second rate (pps) and the maximum delay.
  75. :return: Timestamp to be used for the next packet.
  76. """
  77. return timestamp + uniform(1 / pps, maxdelay)
  78. # Aidmar
  79. def getIntervalPPS(complement_interval_pps, timestamp):
  80. """
  81. Gets the packet rate (pps) in specific time interval.
  82. :return: the corresponding packet rate for packet rate (pps) .
  83. """
  84. for row in complement_interval_pps:
  85. if timestamp <= row[0]:
  86. return row[1]
  87. return complement_interval_pps[-1][1] # in case the timstamp > capture max timestamp
  88. # Timestamp
  89. timestamp_next_pkt = self.get_param_value(Param.INJECT_AT_TIMESTAMP)
  90. # TO-DO: find better pkt rate
  91. pps = self.get_param_value(Param.PACKETS_PER_SECOND)
  92. randomdelay = Lea.fromValFreqsDict({1 / pps: 70, 2 / pps: 30, 5 / pps: 15, 10 / pps: 3})
  93. # Aidmar - calculate complement packet rates of BG traffic per interval
  94. complement_interval_pps = self.statistics.calculate_complement_packet_rates(pps)
  95. # Initialize parameters
  96. packets = []
  97. mac_source = self.get_param_value(Param.MAC_SOURCE)
  98. ip_source = self.get_param_value(Param.IP_SOURCE)
  99. mac_destination = self.get_param_value(Param.MAC_DESTINATION)
  100. ip_destination = self.get_param_value(Param.IP_DESTINATION)
  101. target_host = self.get_param_value(Param.TARGET_HOST)
  102. target_uri = self.get_param_value(Param.TARGET_URI)
  103. # Aidmar - check ip.src == ip.dst
  104. if ip_source == ip_destination:
  105. print("\nERROR: Invalid IP addresses; source IP is the same as destination IP: " + ip_source + ".")
  106. import sys
  107. sys.exit(0)
  108. path_attack_pcap = None
  109. replayDelay = self.get_reply_delay(ip_destination)
  110. # Inject SQLi Attack
  111. # Read SQLi Attack pcap file
  112. orig_ip_dst = None
  113. exploit_raw_packets = RawPcapReader("ATutorSQLi.pcap")
  114. port_source = randint(self.minDefaultPort,self.maxDefaultPort) # experiments show this range of ports
  115. for pkt_num, pkt in enumerate(exploit_raw_packets):
  116. eth_frame = Ether(pkt[0])
  117. ip_pkt = eth_frame.payload
  118. tcp_pkt = ip_pkt.payload
  119. str_http_pkt = str(tcp_pkt.payload)
  120. if pkt_num == 0:
  121. prev_orig_port_source = tcp_pkt.getfieldval("sport")
  122. if tcp_pkt.getfieldval("dport") == self.http_port:
  123. orig_ip_dst = ip_pkt.getfieldval("dst") # victim IP
  124. # Request
  125. if ip_pkt.getfieldval("dst") == orig_ip_dst: # victim IP
  126. # There are 363 TCP connections with different source ports, for each of them we generate random port
  127. if tcp_pkt.getfieldval("sport") != prev_orig_port_source:
  128. port_source = randint(self.minDefaultPort, self.maxDefaultPort)
  129. prev_orig_port_source = tcp_pkt.getfieldval("sport")
  130. # Ether
  131. eth_frame.setfieldval("src", mac_source)
  132. eth_frame.setfieldval("dst", mac_destination)
  133. # IP
  134. ip_pkt.setfieldval("src", ip_source)
  135. ip_pkt.setfieldval("dst", ip_destination)
  136. # TCP
  137. tcp_pkt.setfieldval("sport",port_source)
  138. eth_frame.payload = b''
  139. ip_pkt.payload = b''
  140. tcp_pkt.payload = b''
  141. #temp = "GET / HTTP/1.0\r\n\r\n"
  142. #temp = "GET / HTTP/1.1\r\nHost: 192.168.189.1\r\nUser-Agent: Mozilla/4.0(compatible;MSIE6.0;WindowsNT5.1)\r\nContent-Type: application/x-www-form-urlencoded\r\n\r\n"
  143. if len(str_http_pkt) > 0:
  144. # convert payload bytes to str => str = "b'..\\r\\n..'"
  145. str_http_pkt = str_http_pkt[2:-1]
  146. str_http_pkt = str_http_pkt.replace('/ATutor', target_uri)
  147. str_http_pkt = str_http_pkt.replace(orig_ip_dst, target_host)
  148. str_http_pkt = str_http_pkt.replace("\\n", "\n")
  149. str_http_pkt = str_http_pkt.replace("\\r", "\r")
  150. new_pkt = (eth_frame / ip_pkt/ tcp_pkt / str_http_pkt)
  151. new_pkt.time = timestamp_next_pkt
  152. maxdelay = randomdelay.random()
  153. pps = self.minDefaultPPS if getIntervalPPS(complement_interval_pps, timestamp_next_pkt) is None else max(
  154. getIntervalPPS(complement_interval_pps, timestamp_next_pkt), self.minDefaultPPS)
  155. timestamp_next_pkt = update_timestamp(timestamp_next_pkt, pps, maxdelay)
  156. # Reply
  157. else:
  158. # Ether
  159. eth_frame.setfieldval("src", mac_destination)
  160. eth_frame.setfieldval("dst", mac_source)
  161. # IP
  162. ip_pkt.setfieldval("src", ip_destination)
  163. ip_pkt.setfieldval("dst", ip_source)
  164. # TCP
  165. tcp_pkt.setfieldval("dport", port_source)
  166. eth_frame.payload = b''
  167. ip_pkt.payload = b''
  168. tcp_pkt.payload = b''
  169. if len(str_http_pkt) > 0:
  170. # convert payload bytes to str => str = "b'..\\r\\n..'"
  171. str_http_pkt = str_http_pkt[2:-1]
  172. str_http_pkt = str_http_pkt.replace('/ATutor', target_uri)
  173. str_http_pkt = str_http_pkt.replace(orig_ip_dst, target_host)
  174. str_http_pkt = str_http_pkt.replace("\\n", "\n")
  175. str_http_pkt = str_http_pkt.replace("\\r", "\r")
  176. new_pkt = (eth_frame / ip_pkt / tcp_pkt / str_http_pkt)
  177. timestamp_next_pkt = timestamp_next_pkt + uniform(replayDelay, 2 * replayDelay)
  178. new_pkt.time = timestamp_next_pkt
  179. packets.append(new_pkt)
  180. # TO-DO: Last connection, victim start a connection from port 4444.
  181. # Store timestamp of first packet (for attack label)
  182. self.attack_start_utime = packets[0].time
  183. self.attack_end_utime = packets[-1].time
  184. if len(packets) > 0:
  185. packets = sorted(packets, key=lambda pkt: pkt.time)
  186. path_attack_pcap = self.write_attack_pcap(packets, True, path_attack_pcap)
  187. # return packets sorted by packet time_sec_start
  188. # pkt_num+1: because pkt_num starts at 0
  189. return pkt_num + 1, path_attack_pcap