EternalBlueExploit.py 14 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306
  1. # Created by Aidmar
  2. import logging
  3. from random import randint, uniform
  4. from lea import Lea
  5. from Attack import BaseAttack
  6. from Attack.AttackParameters import Parameter as Param
  7. from Attack.AttackParameters import ParameterTypes
  8. logging.getLogger("scapy.runtime").setLevel(logging.ERROR)
  9. # noinspection PyPep8
  10. from scapy.utils import RawPcapReader
  11. from scapy.layers.inet import IP, Ether, TCP, RandShort
  12. class EternalBlueExploit(BaseAttack.BaseAttack):
  13. # Metasploit default packet rate
  14. maxDefaultPPS = 100
  15. minDefaultPPS = 5
  16. # SMB port
  17. smb_port = 445
  18. # Empirical values from Metasploit experiments
  19. minDefaultPort = 30000
  20. maxDefaultPort = 50000
  21. last_conn_dst_port = 4444
  22. def __init__(self, statistics, pcap_file_path):
  23. """
  24. Creates a new instance of the EternalBlue Exploit.
  25. :param statistics: A reference to the statistics class.
  26. """
  27. # Initialize attack
  28. super(EternalBlueExploit, self).__init__(statistics, "EternalBlue Exploit", "Injects an EternalBlue exploit'",
  29. "Resource Exhaustion")
  30. # Define allowed parameters and their type
  31. self.supported_params = {
  32. Param.MAC_SOURCE: ParameterTypes.TYPE_MAC_ADDRESS,
  33. Param.IP_SOURCE: ParameterTypes.TYPE_IP_ADDRESS,
  34. Param.MAC_DESTINATION: ParameterTypes.TYPE_MAC_ADDRESS,
  35. Param.IP_DESTINATION: ParameterTypes.TYPE_IP_ADDRESS,
  36. Param.INJECT_AT_TIMESTAMP: ParameterTypes.TYPE_FLOAT,
  37. Param.INJECT_AFTER_PACKET: ParameterTypes.TYPE_PACKET_POSITION,
  38. Param.PACKETS_PER_SECOND: ParameterTypes.TYPE_FLOAT
  39. }
  40. # PARAMETERS: initialize with default utilsvalues
  41. # (values are overwritten if user specifies them)
  42. most_used_ip_address = self.statistics.get_most_used_ip_address()
  43. if isinstance(most_used_ip_address, list):
  44. most_used_ip_address = most_used_ip_address[0]
  45. self.add_param_value(Param.IP_SOURCE, most_used_ip_address)
  46. self.add_param_value(Param.MAC_SOURCE, self.statistics.get_mac_address(most_used_ip_address))
  47. self.add_param_value(Param.INJECT_AFTER_PACKET, randint(0, self.statistics.get_packet_count()))
  48. self.add_param_value(Param.PACKETS_PER_SECOND,self.maxDefaultPPS)
  49. # victim configuration
  50. random_ip_address = self.statistics.get_random_ip_address()
  51. self.add_param_value(Param.IP_DESTINATION, random_ip_address)
  52. destination_mac = self.statistics.get_mac_address(random_ip_address)
  53. if isinstance(destination_mac, list) and len(destination_mac) == 0:
  54. destination_mac = self.generate_random_mac_address()
  55. self.add_param_value(Param.MAC_DESTINATION, destination_mac)
  56. def generate_attack_pcap(self):
  57. def update_timestamp(timestamp, pps, maxdelay):
  58. """
  59. Calculates the next timestamp to be used based on the packet per second rate (pps) and the maximum delay.
  60. :return: Timestamp to be used for the next packet.
  61. """
  62. return timestamp + uniform(1 / pps, maxdelay)
  63. # Aidmar
  64. def getIntervalPPS(complement_interval_pps, timestamp):
  65. """
  66. Gets the packet rate (pps) in specific time interval.
  67. :return: the corresponding packet rate for packet rate (pps) .
  68. """
  69. for row in complement_interval_pps:
  70. if timestamp<=row[0]:
  71. return row[1]
  72. return complement_interval_pps[-1][1] # in case the timstamp > capture max timestamp
  73. # Timestamp
  74. timestamp_next_pkt = self.get_param_value(Param.INJECT_AT_TIMESTAMP)
  75. # TO-DO: find better pkt rate
  76. pps = self.get_param_value(Param.PACKETS_PER_SECOND)
  77. randomdelay = Lea.fromValFreqsDict({1 / pps: 70, 2 / pps: 30, 5 / pps: 15, 10 / pps: 3})
  78. # Aidmar - calculate complement packet rates of BG traffic per interval
  79. complement_interval_pps = self.statistics.calculate_complement_packet_rates(pps)
  80. # Initialize parameters
  81. packets = []
  82. mac_source = self.get_param_value(Param.MAC_SOURCE)
  83. ip_source = self.get_param_value(Param.IP_SOURCE)
  84. #port_source = self.get_param_value(Param.PORT_SOURCE)
  85. mac_destination = self.get_param_value(Param.MAC_DESTINATION)
  86. ip_destination = self.get_param_value(Param.IP_DESTINATION)
  87. # Aidmar - check ip.src == ip.dst
  88. self.ip_src_dst_equal_check(ip_source, ip_destination)
  89. path_attack_pcap = None
  90. minDelay, maxDelay = self.get_reply_delay(ip_destination)
  91. # Set TTL based on TTL distribution of IP address
  92. source_ttl_dist = self.statistics.get_ttl_distribution(ip_source)
  93. if len(source_ttl_dist) > 0:
  94. source_ttl_prob_dict = Lea.fromValFreqsDict(source_ttl_dist)
  95. source_ttl_value = source_ttl_prob_dict.random()
  96. else:
  97. source_ttl_value = self.statistics.process_db_query("most_used(ttlValue)")
  98. destination_ttl_dist = self.statistics.get_ttl_distribution(ip_destination)
  99. if len(destination_ttl_dist) > 0:
  100. destination_ttl_prob_dict = Lea.fromValFreqsDict(destination_ttl_dist)
  101. destination_ttl_value = destination_ttl_prob_dict.random()
  102. else:
  103. destination_ttl_value = self.statistics.process_db_query("most_used(ttlValue)")
  104. # Scan (MS17) for EternalBlue
  105. # Read Win7_eternalblue_scan_vulnerable pcap file
  106. orig_ip_dst = None
  107. exploit_raw_packets = RawPcapReader("resources/Win7_eternalblue_scan.pcap")
  108. port_source = randint(self.minDefaultPort,self.maxDefaultPort) # experiments show this range of ports
  109. for pkt_num, pkt in enumerate(exploit_raw_packets):
  110. eth_frame = Ether(pkt[0])
  111. ip_pkt = eth_frame.payload
  112. tcp_pkt = ip_pkt.payload
  113. if pkt_num == 0:
  114. if tcp_pkt.getfieldval("dport") == self.smb_port:
  115. orig_ip_dst = ip_pkt.getfieldval("dst") # victim IP
  116. # Request
  117. if ip_pkt.getfieldval("dst") == orig_ip_dst: # victim IP
  118. # Ether
  119. eth_frame.setfieldval("src", mac_source)
  120. eth_frame.setfieldval("dst", mac_destination)
  121. # IP
  122. ip_pkt.setfieldval("src", ip_source)
  123. ip_pkt.setfieldval("dst", ip_destination)
  124. ip_pkt.setfieldval("ttl", source_ttl_value)
  125. # TCP
  126. tcp_pkt.setfieldval("sport",port_source)
  127. new_pkt = (eth_frame / ip_pkt / tcp_pkt)
  128. new_pkt.time = timestamp_next_pkt
  129. maxdelay = randomdelay.random()
  130. pps = max(getIntervalPPS(complement_interval_pps, timestamp_next_pkt), self.minDefaultPPS)
  131. timestamp_next_pkt = update_timestamp(timestamp_next_pkt, pps, maxdelay)
  132. # Reply
  133. else:
  134. # Ether
  135. eth_frame.setfieldval("src", mac_destination)
  136. eth_frame.setfieldval("dst", mac_source)
  137. # IP
  138. ip_pkt.setfieldval("src", ip_destination)
  139. ip_pkt.setfieldval("dst", ip_source)
  140. ip_pkt.setfieldval("ttl", destination_ttl_value)
  141. # TCP
  142. tcp_pkt.setfieldval("dport", port_source)
  143. new_pkt = (eth_frame / ip_pkt / tcp_pkt)
  144. timestamp_next_pkt = timestamp_next_pkt + uniform(minDelay, maxDelay)
  145. new_pkt.time = timestamp_next_pkt
  146. packets.append(new_pkt)
  147. # Inject EternalBlue exploit packets
  148. # Read Win7_eternalblue_exploit pcap file
  149. exploit_raw_packets = RawPcapReader("resources/Win7_eternalblue_exploit.pcap")
  150. port_source = randint(self.minDefaultPort,self.maxDefaultPort) # experiments show this range of ports
  151. # conversations = {(ip.src, ip.dst, port.src, port.dst): packets}
  152. conversations, orderList_conversations = self.packetsToConvs(exploit_raw_packets)
  153. # the last two connections have special treatment, they start after the other connections finish
  154. # TO-DO
  155. conv_start_timesamp = timestamp_next_pkt
  156. for conv_index, conv in enumerate(orderList_conversations):
  157. conv_start_timesamp = conv_start_timesamp + uniform(0.001,0.01) # the distance between the starts of the converstaions
  158. timestamp_next_pkt = conv_start_timesamp
  159. conv_pkts = conversations[conv]
  160. if conv_index == len(orderList_conversations) - 2: # Not the last conversation
  161. timestamp_next_pkt = packets[-1].time + uniform(0.001,0.01)
  162. if conv_index != len(orderList_conversations)-1: # Not the last conversation
  163. port_source += 2
  164. for pkt_num, pkt in enumerate(conv_pkts):
  165. eth_frame = Ether(pkt[0])
  166. ip_pkt = eth_frame.payload
  167. tcp_pkt = ip_pkt.payload
  168. if pkt_num == 0:
  169. if tcp_pkt.getfieldval("dport") == self.smb_port:
  170. orig_ip_dst = ip_pkt.getfieldval("dst")
  171. # defining req/rep should be adapted to fit the last converstaion where
  172. # victim starts a connection with the attacker
  173. # Request
  174. if ip_pkt.getfieldval("dst") == orig_ip_dst: # victim IP
  175. # Ether
  176. eth_frame.setfieldval("src", mac_source)
  177. eth_frame.setfieldval("dst", mac_destination)
  178. # IP
  179. ip_pkt.setfieldval("src", ip_source)
  180. ip_pkt.setfieldval("dst", ip_destination)
  181. ip_pkt.setfieldval("ttl", source_ttl_value)
  182. # TCP
  183. tcp_pkt.setfieldval("sport", port_source)
  184. new_pkt = (eth_frame / ip_pkt / tcp_pkt)
  185. new_pkt.time = timestamp_next_pkt
  186. maxdelay = randomdelay.random()
  187. pps = max(getIntervalPPS(complement_interval_pps, timestamp_next_pkt), self.minDefaultPPS)
  188. timestamp_next_pkt = update_timestamp(timestamp_next_pkt, pps, maxdelay)
  189. # Reply
  190. else:
  191. # Ether
  192. eth_frame.setfieldval("src", mac_destination)
  193. eth_frame.setfieldval("dst", mac_source)
  194. # IP
  195. ip_pkt.setfieldval("src", ip_destination)
  196. ip_pkt.setfieldval("dst", ip_source)
  197. ip_pkt.setfieldval("ttl", destination_ttl_value)
  198. # TCP
  199. tcp_pkt.setfieldval("dport", port_source)
  200. new_pkt = (eth_frame / ip_pkt / tcp_pkt)
  201. timestamp_next_pkt = timestamp_next_pkt + uniform(minDelay, maxDelay)
  202. new_pkt.time = timestamp_next_pkt
  203. packets.append(new_pkt)
  204. else: # Last conversation where the victim start a connection with the attacker
  205. timestamp_next_pkt = packets[-1].time + uniform(0.001, 0.01)
  206. port_source = randint(self.minDefaultPort,self.maxDefaultPort)
  207. for pkt_num, pkt in enumerate(conv_pkts):
  208. eth_frame = Ether(pkt[0])
  209. ip_pkt = eth_frame.payload
  210. tcp_pkt = ip_pkt.payload
  211. # defining req/rep should be adapted to fit the last converstaion where
  212. # victim start a connection with the attacker
  213. # Request
  214. if tcp_pkt.getfieldval("dport") == self.last_conn_dst_port:
  215. # Ether
  216. eth_frame.setfieldval("src", mac_destination)
  217. eth_frame.setfieldval("dst", mac_source)
  218. # IP
  219. ip_pkt.setfieldval("src", ip_destination)
  220. ip_pkt.setfieldval("dst", ip_source)
  221. ip_pkt.setfieldval("ttl", destination_ttl_value)
  222. # TCP
  223. tcp_pkt.setfieldval("sport", port_source)
  224. new_pkt = (eth_frame / ip_pkt / tcp_pkt)
  225. new_pkt.time = timestamp_next_pkt
  226. maxdelay = randomdelay.random()
  227. pps = max(getIntervalPPS(complement_interval_pps, timestamp_next_pkt), self.minDefaultPPS)
  228. timestamp_next_pkt = update_timestamp(timestamp_next_pkt, pps, maxdelay)
  229. # Reply
  230. else:
  231. # Ether
  232. eth_frame.setfieldval("src", mac_source)
  233. eth_frame.setfieldval("dst", mac_destination)
  234. # IP
  235. ip_pkt.setfieldval("src", ip_source)
  236. ip_pkt.setfieldval("dst", ip_destination)
  237. ip_pkt.setfieldval("ttl", source_ttl_value)
  238. # TCP
  239. tcp_pkt.setfieldval("dport", port_source)
  240. new_pkt = (eth_frame / ip_pkt / tcp_pkt)
  241. timestamp_next_pkt = timestamp_next_pkt + uniform(minDelay, maxDelay)
  242. new_pkt.time = timestamp_next_pkt
  243. packets.append(new_pkt)
  244. # Store timestamp of first packet (for attack label)
  245. self.attack_start_utime = packets[0].time
  246. self.attack_end_utime = packets[-1].time
  247. if len(packets) > 0:
  248. packets = sorted(packets, key=lambda pkt: pkt.time)
  249. path_attack_pcap = self.write_attack_pcap(packets, True, path_attack_pcap)
  250. # return packets sorted by packet time_sec_start
  251. # pkt_num+1: because pkt_num starts at 0
  252. return pkt_num + 1, path_attack_pcap