EternalBlueExploit.py 15 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327
  1. # Created by Aidmar
  2. import logging
  3. from random import randint, uniform
  4. from lea import Lea
  5. from Attack import BaseAttack
  6. from Attack.AttackParameters import Parameter as Param
  7. from Attack.AttackParameters import ParameterTypes
  8. logging.getLogger("scapy.runtime").setLevel(logging.ERROR)
  9. # noinspection PyPep8
  10. from scapy.utils import RawPcapReader
  11. from scapy.layers.inet import IP, Ether, TCP, RandShort
  12. class EternalBlueExploit(BaseAttack.BaseAttack):
  13. # Metasploit default packet rate
  14. maxDefaultPPS = 100
  15. minDefaultPPS = 5
  16. # SMB port
  17. smb_port = 445
  18. # Empirical values from Metasploit experiments
  19. minDefaultPort = 30000
  20. maxDefaultPort = 50000
  21. last_conn_dst_port = 4444
  22. def __init__(self, statistics, pcap_file_path):
  23. """
  24. Creates a new instance of the EternalBlue Exploit.
  25. :param statistics: A reference to the statistics class.
  26. """
  27. # Initialize attack
  28. super(EternalBlueExploit, self).__init__(statistics, "EternalBlue Exploit", "Injects an EternalBlue exploit'",
  29. "Resource Exhaustion")
  30. # Define allowed parameters and their type
  31. self.supported_params = {
  32. Param.MAC_SOURCE: ParameterTypes.TYPE_MAC_ADDRESS,
  33. Param.IP_SOURCE: ParameterTypes.TYPE_IP_ADDRESS,
  34. #Param.PORT_SOURCE: ParameterTypes.TYPE_PORT,
  35. Param.MAC_DESTINATION: ParameterTypes.TYPE_MAC_ADDRESS,
  36. Param.IP_DESTINATION: ParameterTypes.TYPE_IP_ADDRESS,
  37. Param.INJECT_AT_TIMESTAMP: ParameterTypes.TYPE_FLOAT,
  38. Param.INJECT_AFTER_PACKET: ParameterTypes.TYPE_PACKET_POSITION,
  39. Param.PACKETS_PER_SECOND: ParameterTypes.TYPE_FLOAT
  40. }
  41. # PARAMETERS: initialize with default utilsvalues
  42. # (values are overwritten if user specifies them)
  43. most_used_ip_address = self.statistics.get_most_used_ip_address()
  44. if isinstance(most_used_ip_address, list):
  45. most_used_ip_address = most_used_ip_address[0]
  46. self.add_param_value(Param.IP_SOURCE, most_used_ip_address)
  47. self.add_param_value(Param.MAC_SOURCE, self.statistics.get_mac_address(most_used_ip_address))
  48. self.add_param_value(Param.INJECT_AFTER_PACKET, randint(0, self.statistics.get_packet_count()))
  49. #self.add_param_value(Param.PORT_SOURCE, str(RandShort()))
  50. self.add_param_value(Param.PACKETS_PER_SECOND,self.maxDefaultPPS)
  51. # victim configuration
  52. # TO-DO: confirm that ip.dst uses Win OS
  53. random_ip_address = self.statistics.get_random_ip_address()
  54. self.add_param_value(Param.IP_DESTINATION, random_ip_address)
  55. destination_mac = self.statistics.get_mac_address(random_ip_address)
  56. if isinstance(destination_mac, list) and len(destination_mac) == 0:
  57. destination_mac = self.generate_random_mac_address()
  58. self.add_param_value(Param.MAC_DESTINATION, destination_mac)
  59. def generate_attack_pcap(self):
  60. def update_timestamp(timestamp, pps, maxdelay):
  61. """
  62. Calculates the next timestamp to be used based on the packet per second rate (pps) and the maximum delay.
  63. :return: Timestamp to be used for the next packet.
  64. """
  65. return timestamp + uniform(1 / pps, maxdelay)
  66. # Aidmar
  67. def getIntervalPPS(complement_interval_pps, timestamp):
  68. """
  69. Gets the packet rate (pps) in specific time interval.
  70. :return: the corresponding packet rate for packet rate (pps) .
  71. """
  72. for row in complement_interval_pps:
  73. if timestamp<=row[0]:
  74. return row[1]
  75. return complement_interval_pps[-1][1] # in case the timstamp > capture max timestamp
  76. # Timestamp
  77. timestamp_next_pkt = self.get_param_value(Param.INJECT_AT_TIMESTAMP)
  78. # TO-DO: find better pkt rate
  79. pps = self.get_param_value(Param.PACKETS_PER_SECOND)
  80. randomdelay = Lea.fromValFreqsDict({1 / pps: 70, 2 / pps: 30, 5 / pps: 15, 10 / pps: 3})
  81. # Aidmar - calculate complement packet rates of BG traffic per interval
  82. complement_interval_pps = self.statistics.calculate_complement_packet_rates(pps)
  83. # Initialize parameters
  84. packets = []
  85. mac_source = self.get_param_value(Param.MAC_SOURCE)
  86. ip_source = self.get_param_value(Param.IP_SOURCE)
  87. #port_source = self.get_param_value(Param.PORT_SOURCE)
  88. mac_destination = self.get_param_value(Param.MAC_DESTINATION)
  89. ip_destination = self.get_param_value(Param.IP_DESTINATION)
  90. # Aidmar - check ip.src == ip.dst
  91. if ip_source == ip_destination:
  92. print("\nERROR: Invalid IP addresses; source IP is the same as destination IP: " + ip_source + ".")
  93. import sys
  94. sys.exit(0)
  95. path_attack_pcap = None
  96. minDelay, maxDelay = self.get_reply_delay(ip_destination)
  97. # Scan (MS17) for EternalBlue
  98. # Read Win7_eternalblue_scan_vulnerable pcap file
  99. orig_ip_dst = None
  100. exploit_raw_packets = RawPcapReader("Win7_eternalblue_scan.pcap")
  101. port_source = randint(self.minDefaultPort,self.maxDefaultPort) # experiments show this range of ports
  102. for pkt_num, pkt in enumerate(exploit_raw_packets):
  103. eth_frame = Ether(pkt[0])
  104. ip_pkt = eth_frame.payload
  105. tcp_pkt = ip_pkt.payload
  106. if pkt_num == 0:
  107. if tcp_pkt.getfieldval("dport") == self.smb_port:
  108. orig_ip_dst = ip_pkt.getfieldval("dst") # victim IP
  109. # Request
  110. if ip_pkt.getfieldval("dst") == orig_ip_dst: # victim IP
  111. # Ether
  112. eth_frame.setfieldval("src", mac_source)
  113. eth_frame.setfieldval("dst", mac_destination)
  114. # IP
  115. ip_pkt.setfieldval("src", ip_source)
  116. ip_pkt.setfieldval("dst", ip_destination)
  117. # TCP
  118. tcp_pkt.setfieldval("sport",port_source)
  119. new_pkt = (eth_frame / ip_pkt / tcp_pkt)
  120. new_pkt.time = timestamp_next_pkt
  121. maxdelay = randomdelay.random()
  122. pps = self.minDefaultPPS if getIntervalPPS(complement_interval_pps,timestamp_next_pkt) is None else max(
  123. getIntervalPPS(complement_interval_pps,timestamp_next_pkt), self.minDefaultPPS)
  124. timestamp_next_pkt = update_timestamp(timestamp_next_pkt, pps, maxdelay)
  125. # Reply
  126. else:
  127. # Ether
  128. eth_frame.setfieldval("src", mac_destination)
  129. eth_frame.setfieldval("dst", mac_source)
  130. # IP
  131. ip_pkt.setfieldval("src", ip_destination)
  132. ip_pkt.setfieldval("dst", ip_source)
  133. # TCP
  134. tcp_pkt.setfieldval("dport", port_source)
  135. new_pkt = (eth_frame / ip_pkt / tcp_pkt)
  136. timestamp_next_pkt = timestamp_next_pkt + uniform(minDelay, maxDelay)
  137. new_pkt.time = timestamp_next_pkt
  138. packets.append(new_pkt)
  139. # Inject EternalBlue exploit packets
  140. # Read Win7_eternalblue_exploit pcap file
  141. exploit_raw_packets = RawPcapReader("Win7_eternalblue_exploit.pcap")
  142. # Group the packets in conversations
  143. def packetsToConvs(exploit_raw_packets):
  144. conversations = {}
  145. orderList_conversations = []
  146. for pkt_num, pkt in enumerate(exploit_raw_packets):
  147. eth_frame = Ether(pkt[0])
  148. ip_pkt = eth_frame.payload
  149. ip_dst = ip_pkt.getfieldval("dst")
  150. ip_src = ip_pkt.getfieldval("src")
  151. tcp_pkt = ip_pkt.payload
  152. port_dst = tcp_pkt.getfieldval("dport")
  153. port_src = tcp_pkt.getfieldval("sport")
  154. conv_req = (ip_src, port_src, ip_dst, port_dst)
  155. conv_rep = (ip_dst, port_dst, ip_src, port_src)
  156. if conv_req not in conversations and conv_rep not in conversations:
  157. pktList = [pkt]
  158. conversations[conv_req] = pktList
  159. # Order list of conv
  160. orderList_conversations.append(conv_req)
  161. else:
  162. if conv_req in conversations:
  163. pktList = conversations[conv_req]
  164. pktList.append(pkt)
  165. conversations[conv_req] = pktList
  166. else:
  167. pktList = conversations[conv_rep]
  168. pktList.append(pkt)
  169. conversations[conv_rep] = pktList
  170. return (conversations,orderList_conversations)
  171. port_source = randint(self.minDefaultPort,self.maxDefaultPort) # experiments show this range of ports
  172. # conversations = {(ip.src, ip.dst, port.src, port.dst): packets}
  173. temp_tuple = packetsToConvs(exploit_raw_packets)
  174. conversations = temp_tuple[0]
  175. orderList_conversations = temp_tuple[1]
  176. for conv_index, conv in enumerate(orderList_conversations):
  177. conv_pkts = conversations[conv]
  178. if conv_index != len(orderList_conversations)-1: # Not the last conversation
  179. port_source += 2
  180. for pkt_num, pkt in enumerate(conv_pkts):
  181. eth_frame = Ether(pkt[0])
  182. ip_pkt = eth_frame.payload
  183. tcp_pkt = ip_pkt.payload
  184. if pkt_num == 0:
  185. if tcp_pkt.getfieldval("dport") == self.smb_port:
  186. orig_ip_dst = ip_pkt.getfieldval("dst")
  187. # defining req/rep should be adapted to fit the last converstaion where
  188. # victim start a connection with the attacker
  189. # Request
  190. if ip_pkt.getfieldval("dst") == orig_ip_dst: # victim IP
  191. # Ether
  192. eth_frame.setfieldval("src", mac_source)
  193. eth_frame.setfieldval("dst", mac_destination)
  194. # IP
  195. ip_pkt.setfieldval("src", ip_source)
  196. ip_pkt.setfieldval("dst", ip_destination)
  197. # TCP
  198. tcp_pkt.setfieldval("sport", port_source)
  199. new_pkt = (eth_frame / ip_pkt / tcp_pkt)
  200. # TO-DO: reply should have different timestamp delay
  201. new_pkt.time = timestamp_next_pkt
  202. maxdelay = randomdelay.random()
  203. pps = self.minDefaultPPS if getIntervalPPS(complement_interval_pps, timestamp_next_pkt) is None else max(
  204. getIntervalPPS(complement_interval_pps, timestamp_next_pkt), self.minDefaultPPS)
  205. timestamp_next_pkt = update_timestamp(timestamp_next_pkt, pps, maxdelay)
  206. # Not perfect timestamp
  207. #req_time = req_time + randomDelay || rep_time + randomDelay
  208. # Reply
  209. else:
  210. # Ether
  211. eth_frame.setfieldval("src", mac_destination)
  212. eth_frame.setfieldval("dst", mac_source)
  213. # IP
  214. ip_pkt.setfieldval("src", ip_destination)
  215. ip_pkt.setfieldval("dst", ip_source)
  216. # TCP
  217. tcp_pkt.setfieldval("dport", port_source)
  218. new_pkt = (eth_frame / ip_pkt / tcp_pkt)
  219. timestamp_next_pkt = timestamp_next_pkt + uniform(minDelay, maxDelay)
  220. new_pkt.time = timestamp_next_pkt
  221. # Not perfect timestamp
  222. # rep_time = req_time + replayDelay
  223. packets.append(new_pkt)
  224. else: # Last conversation where the victim start a connection with the attacker
  225. port_source = randint(self.minDefaultPort,self.maxDefaultPort)
  226. for pkt_num, pkt in enumerate(conv_pkts):
  227. eth_frame = Ether(pkt[0])
  228. ip_pkt = eth_frame.payload
  229. tcp_pkt = ip_pkt.payload
  230. # defining req/rep should be adapted to fit the last converstaion where
  231. # victim start a connection with the attacker
  232. # Request
  233. if tcp_pkt.getfieldval("dport") == self.last_conn_dst_port:
  234. # Ether
  235. eth_frame.setfieldval("src", mac_destination)
  236. eth_frame.setfieldval("dst", mac_source)
  237. # IP
  238. ip_pkt.setfieldval("src", ip_destination)
  239. ip_pkt.setfieldval("dst", ip_source)
  240. # TCP
  241. tcp_pkt.setfieldval("sport", port_source)
  242. new_pkt = (eth_frame / ip_pkt / tcp_pkt)
  243. # TO-DO: reply should have different timestamp delay
  244. new_pkt.time = timestamp_next_pkt
  245. maxdelay = randomdelay.random()
  246. pps = self.minDefaultPPS if getIntervalPPS(complement_interval_pps, timestamp_next_pkt) is None else max(
  247. getIntervalPPS(complement_interval_pps, timestamp_next_pkt), self.minDefaultPPS)
  248. timestamp_next_pkt = update_timestamp(timestamp_next_pkt, pps, maxdelay)
  249. # Not perfect timestamp
  250. # req_time = req_time + randomDelay || rep_time + randomDelay
  251. # Reply
  252. else:
  253. # Ether
  254. eth_frame.setfieldval("src", mac_source)
  255. eth_frame.setfieldval("dst", mac_destination)
  256. # IP
  257. ip_pkt.setfieldval("src", ip_source)
  258. ip_pkt.setfieldval("dst", ip_destination)
  259. # TCP
  260. tcp_pkt.setfieldval("dport", port_source)
  261. new_pkt = (eth_frame / ip_pkt / tcp_pkt)
  262. timestamp_next_pkt = timestamp_next_pkt + uniform(minDelay, maxDelay)
  263. new_pkt.time = timestamp_next_pkt
  264. # Not perfect timestamp
  265. # rep_time = req_time + replayDelay
  266. packets.append(new_pkt)
  267. # Store timestamp of first packet (for attack label)
  268. self.attack_start_utime = packets[0].time
  269. self.attack_end_utime = packets[-1].time
  270. if len(packets) > 0:
  271. packets = sorted(packets, key=lambda pkt: pkt.time)
  272. path_attack_pcap = self.write_attack_pcap(packets, True, path_attack_pcap)
  273. # return packets sorted by packet time_sec_start
  274. # pkt_num+1: because pkt_num starts at 0
  275. return pkt_num + 1, path_attack_pcap