3
0

SMBScanAttack.py 20 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372
  1. import logging
  2. import random as rnd
  3. import scapy.layers.inet as inet
  4. from scapy.layers.smb import *
  5. import Attack.AttackParameters as atkParam
  6. import Attack.BaseAttack as BaseAttack
  7. import ID2TLib.SMB2 as SMB2
  8. import ID2TLib.SMBLib as SMBLib
  9. import ID2TLib.Utility as Util
  10. logging.getLogger("scapy.runtime").setLevel(logging.ERROR)
  11. # noinspection PyPep8
  12. class SMBScanAttack(BaseAttack.BaseAttack):
  13. def __init__(self):
  14. """
  15. Creates a new instance of the SMBScanAttack.
  16. """
  17. # Initialize attack
  18. super(SMBScanAttack, self).__init__("SmbScan Attack", "Injects an SMB scan",
  19. "Scanning/Probing")
  20. self.host_os = Util.get_rnd_os()
  21. # Define allowed parameters and their type
  22. self.supported_params.update({
  23. atkParam.Parameter.IP_SOURCE: atkParam.ParameterTypes.TYPE_IP_ADDRESS,
  24. atkParam.Parameter.IP_DESTINATION: atkParam.ParameterTypes.TYPE_IP_ADDRESS,
  25. atkParam.Parameter.PORT_SOURCE: atkParam.ParameterTypes.TYPE_PORT,
  26. atkParam.Parameter.MAC_SOURCE: atkParam.ParameterTypes.TYPE_MAC_ADDRESS,
  27. atkParam.Parameter.MAC_DESTINATION: atkParam.ParameterTypes.TYPE_MAC_ADDRESS,
  28. atkParam.Parameter.INJECT_AT_TIMESTAMP: atkParam.ParameterTypes.TYPE_FLOAT,
  29. atkParam.Parameter.INJECT_AFTER_PACKET: atkParam.ParameterTypes.TYPE_PACKET_POSITION,
  30. atkParam.Parameter.IP_SOURCE_RANDOMIZE: atkParam.ParameterTypes.TYPE_BOOLEAN,
  31. atkParam.Parameter.PACKETS_PER_SECOND: atkParam.ParameterTypes.TYPE_FLOAT,
  32. atkParam.Parameter.PORT_SOURCE_RANDOMIZE: atkParam.ParameterTypes.TYPE_BOOLEAN,
  33. atkParam.Parameter.HOSTING_IP: atkParam.ParameterTypes.TYPE_IP_ADDRESS,
  34. atkParam.Parameter.HOSTING_VERSION: atkParam.ParameterTypes.TYPE_STRING,
  35. atkParam.Parameter.SOURCE_PLATFORM: atkParam.ParameterTypes.TYPE_STRING,
  36. atkParam.Parameter.PROTOCOL_VERSION: atkParam.ParameterTypes.TYPE_STRING
  37. })
  38. def init_params(self):
  39. """
  40. Initialize the parameters of this attack using the user supplied command line parameters.
  41. Use the provided statistics to calculate default parameters and to process user
  42. supplied queries.
  43. """
  44. # PARAMETERS: initialize with default values
  45. # (values are overwritten if user specifies them)
  46. most_used_ip_address = self.statistics.get_most_used_ip_address()
  47. self.add_param_value(atkParam.Parameter.IP_SOURCE, most_used_ip_address)
  48. self.add_param_value(atkParam.Parameter.IP_SOURCE_RANDOMIZE, 'False')
  49. self.add_param_value(atkParam.Parameter.MAC_SOURCE, self.statistics.get_mac_address(most_used_ip_address))
  50. all_ips = self.statistics.get_ip_addresses()
  51. if not isinstance(all_ips, list):
  52. ip_destinations = []
  53. ip_destinations.append(all_ips)
  54. else:
  55. ip_destinations = all_ips
  56. self.add_param_value(atkParam.Parameter.IP_DESTINATION, ip_destinations)
  57. destination_mac = []
  58. for ip in ip_destinations:
  59. destination_mac.append(self.statistics.get_mac_address(str(ip)))
  60. if isinstance(destination_mac, list) and len(destination_mac) == 0:
  61. destination_mac = self.generate_random_mac_address()
  62. self.add_param_value(atkParam.Parameter.MAC_DESTINATION, destination_mac)
  63. self.add_param_value(atkParam.Parameter.PORT_SOURCE, rnd.randint(1024, 65535))
  64. self.add_param_value(atkParam.Parameter.PORT_SOURCE_RANDOMIZE, 'True')
  65. self.add_param_value(atkParam.Parameter.PACKETS_PER_SECOND,
  66. (self.statistics.get_pps_sent(most_used_ip_address) +
  67. self.statistics.get_pps_received(most_used_ip_address)) / 2)
  68. self.add_param_value(atkParam.Parameter.INJECT_AFTER_PACKET, rnd.randint(0, self.statistics.get_packet_count()))
  69. rnd_ip_count = self.statistics.get_ip_address_count() // 2
  70. self.add_param_value(atkParam.Parameter.HOSTING_IP, self.statistics.get_random_ip_address(rnd_ip_count))
  71. self.add_param_value(atkParam.Parameter.HOSTING_VERSION, SMBLib.get_smb_version(platform=self.host_os))
  72. self.add_param_value(atkParam.Parameter.SOURCE_PLATFORM, Util.get_rnd_os())
  73. self.add_param_value(atkParam.Parameter.PROTOCOL_VERSION, "1")
  74. def generate_attack_packets(self):
  75. pps = self.get_param_value(atkParam.Parameter.PACKETS_PER_SECOND)
  76. # Calculate complement packet rates of the background traffic for each interval
  77. complement_interval_pps = self.statistics.calculate_complement_packet_rates(pps)
  78. # Timestamp
  79. timestamp_next_pkt = self.get_param_value(atkParam.Parameter.INJECT_AT_TIMESTAMP)
  80. # store start time of attack
  81. self.attack_start_utime = timestamp_next_pkt
  82. timestamp_prv_reply, timestamp_confirm = 0, 0
  83. # Initialize parameters
  84. ip_source = self.get_param_value(atkParam.Parameter.IP_SOURCE)
  85. ip_destinations = self.get_param_value(atkParam.Parameter.IP_DESTINATION)
  86. hosting_ip = self.get_param_value(atkParam.Parameter.HOSTING_IP)
  87. mac_source = self.get_param_value(atkParam.Parameter.MAC_SOURCE)
  88. mac_dest = self.get_param_value(atkParam.Parameter.MAC_DESTINATION)
  89. # Check smb version
  90. smb_version = self.get_param_value(atkParam.Parameter.PROTOCOL_VERSION)
  91. if smb_version not in SMBLib.smb_versions:
  92. SMBLib.invalid_smb_version(smb_version)
  93. hosting_version = self.get_param_value(atkParam.Parameter.HOSTING_VERSION)
  94. if hosting_version not in SMBLib.smb_versions:
  95. SMBLib.invalid_smb_version(hosting_version)
  96. # Check source platform
  97. src_platform = self.get_param_value(atkParam.Parameter.SOURCE_PLATFORM).lower()
  98. self.packets = []
  99. # randomize source ports according to platform, if specified
  100. if self.get_param_value(atkParam.Parameter.PORT_SOURCE_RANDOMIZE):
  101. sport = Util.generate_source_port_from_platform(src_platform)
  102. else:
  103. sport = self.get_param_value(atkParam.Parameter.PORT_SOURCE)
  104. # No destination IP was specified, but a destination MAC was specified, generate IP that fits MAC
  105. if isinstance(ip_destinations, list) and isinstance(mac_dest, str):
  106. ip_destinations = self.statistics.get_ip_address_from_mac(mac_dest)
  107. if len(ip_destinations) == 0:
  108. ip_destinations = self.generate_random_ipv4_address("Unknown", 1)
  109. # Check ip.src == ip.dst
  110. self.ip_src_dst_equal_check(ip_source, ip_destinations)
  111. ip_dests = []
  112. if isinstance(ip_destinations, list):
  113. ip_dests = ip_destinations
  114. else:
  115. ip_dests.append(ip_destinations)
  116. if isinstance(ip_dests, list):
  117. rnd.shuffle(ip_dests)
  118. # Randomize source IP, if specified
  119. if self.get_param_value(atkParam.Parameter.IP_SOURCE_RANDOMIZE):
  120. ip_source = self.generate_random_ipv4_address("Unknown", 1)
  121. while ip_source in ip_dests:
  122. ip_source = self.generate_random_ipv4_address("Unknown", 1)
  123. mac_source = self.statistics.get_mac_address(str(ip_source))
  124. if len(mac_source) == 0:
  125. mac_source = self.generate_random_mac_address()
  126. # Get MSS, TTL and Window size value for source IP
  127. source_mss_value, source_ttl_value, source_win_value = self.get_ip_data(ip_source)
  128. for ip in ip_dests:
  129. if ip != ip_source:
  130. # Get destination Mac Address
  131. mac_destination = self.statistics.get_mac_address(str(ip))
  132. if len(mac_destination) == 0:
  133. if isinstance(mac_dest, str):
  134. if len(self.statistics.get_ip_address_from_mac(mac_dest)) != 0:
  135. ip = self.statistics.get_ip_address_from_mac(mac_dest)
  136. self.ip_src_dst_equal_check(ip_source, ip)
  137. mac_destination = mac_dest
  138. else:
  139. mac_destination = self.generate_random_mac_address()
  140. # Get MSS, TTL and Window size value for destination IP
  141. destination_mss_value, destination_ttl_value, destination_win_value = self.get_ip_data(ip)
  142. min_delay, max_delay = self.get_reply_delay(ip)
  143. # New connection, new random TCP sequence numbers
  144. attacker_seq = rnd.randint(1000, 50000)
  145. victim_seq = rnd.randint(1000, 50000)
  146. # Randomize source port for each connection if specified
  147. if self.get_param_value(atkParam.Parameter.PORT_SOURCE_RANDOMIZE):
  148. sport = Util.generate_source_port_from_platform(src_platform, sport)
  149. # 1) Build request package
  150. request_ether = inet.Ether(src=mac_source, dst=mac_destination)
  151. request_ip = inet.IP(src=ip_source, dst=ip, ttl=source_ttl_value, flags='DF')
  152. request_tcp = inet.TCP(sport=sport, dport=SMBLib.smb_port, window=source_win_value, flags='S',
  153. seq=attacker_seq, options=[('MSS', source_mss_value)])
  154. attacker_seq += 1
  155. request = (request_ether / request_ip / request_tcp)
  156. request.time = timestamp_next_pkt
  157. # Append request
  158. self.packets.append(request)
  159. # Update timestamp for next package
  160. timestamp_reply = Util.update_timestamp(timestamp_next_pkt, pps, min_delay)
  161. while timestamp_reply <= timestamp_prv_reply:
  162. timestamp_reply = Util.update_timestamp(timestamp_prv_reply, pps, min_delay)
  163. timestamp_prv_reply = timestamp_reply
  164. if ip in hosting_ip:
  165. # 2) Build TCP packages for ip that hosts SMB
  166. # destination sends SYN, ACK
  167. reply_ether = inet.Ether(src=mac_destination, dst=mac_source)
  168. reply_ip = inet.IP(src=ip, dst=ip_source, ttl=destination_ttl_value, flags='DF')
  169. reply_tcp = inet.TCP(sport=SMBLib.smb_port, dport=sport, seq=victim_seq, ack=attacker_seq,
  170. flags='SA',
  171. window=destination_win_value, options=[('MSS', destination_mss_value)])
  172. victim_seq += 1
  173. reply = (reply_ether / reply_ip / reply_tcp)
  174. reply.time = timestamp_reply
  175. self.packets.append(reply)
  176. # requester confirms, ACK
  177. confirm_ether = request_ether
  178. confirm_ip = request_ip
  179. confirm_tcp = inet.TCP(sport=sport, dport=SMBLib.smb_port, seq=attacker_seq, ack=victim_seq,
  180. window=source_win_value, flags='A')
  181. confirm = (confirm_ether / confirm_ip / confirm_tcp)
  182. timestamp_confirm = Util.update_timestamp(timestamp_reply, pps, min_delay)
  183. confirm.time = timestamp_confirm
  184. self.packets.append(confirm)
  185. smb_mid = rnd.randint(1, 65535)
  186. smb_pid = rnd.randint(1, 65535)
  187. smb_req_tail_arr = []
  188. smb_req_tail_size = 0
  189. # select dialects based on smb version
  190. if smb_version is "1":
  191. smb_req_dialects = SMBLib.smb_dialects[0:6]
  192. else:
  193. smb_req_dialects = SMBLib.smb_dialects
  194. if len(smb_req_dialects) == 0:
  195. smb_req_tail_arr.append(SMBNegociate_Protocol_Request_Tail())
  196. smb_req_tail_size = len(SMBNegociate_Protocol_Request_Tail())
  197. else:
  198. for dia in smb_req_dialects:
  199. smb_req_tail_arr.append(SMBNegociate_Protocol_Request_Tail(BufferData=dia))
  200. smb_req_tail_size += len(SMBNegociate_Protocol_Request_Tail(BufferData=dia))
  201. smb_req_head = SMBNegociate_Protocol_Request_Header(Flags2=0x2801, PID=smb_pid, MID=smb_mid,
  202. ByteCount=smb_req_tail_size)
  203. smb_req_length = len(smb_req_head) + smb_req_tail_size
  204. smb_req_net_bio = NBTSession(TYPE=0x00, LENGTH=smb_req_length)
  205. smb_req_tcp = inet.TCP(sport=sport, dport=SMBLib.smb_port, flags='PA', seq=attacker_seq,
  206. ack=victim_seq)
  207. smb_req_ip = inet.IP(src=ip_source, dst=ip, ttl=source_ttl_value)
  208. smb_req_ether = inet.Ether(src=mac_source, dst=mac_destination)
  209. attacker_seq += len(smb_req_net_bio) + len(smb_req_head) + smb_req_tail_size
  210. smb_req_combined = (smb_req_ether / smb_req_ip / smb_req_tcp / smb_req_net_bio / smb_req_head)
  211. for i in range(0, len(smb_req_tail_arr)):
  212. smb_req_combined = smb_req_combined / smb_req_tail_arr[i]
  213. timestamp_smb_req = Util.update_timestamp(timestamp_confirm, pps, min_delay)
  214. smb_req_combined.time = timestamp_smb_req
  215. self.packets.append(smb_req_combined)
  216. # destination confirms SMB request package
  217. reply_tcp = inet.TCP(sport=SMBLib.smb_port, dport=sport, seq=victim_seq, ack=attacker_seq,
  218. window=destination_win_value, flags='A')
  219. confirm_smb_req = (reply_ether / reply_ip / reply_tcp)
  220. timestamp_reply = Util.update_timestamp(timestamp_smb_req, pps, min_delay)
  221. confirm_smb_req.time = timestamp_reply
  222. self.packets.append(confirm_smb_req)
  223. # smb response package
  224. first_timestamp = time.mktime(time.strptime(self.statistics.get_pcap_timestamp_start()[:19],
  225. "%Y-%m-%d %H:%M:%S"))
  226. server_guid, security_blob, capabilities, data_size, server_start_time =\
  227. SMBLib.get_smb_platform_data(self.host_os, first_timestamp)
  228. timestamp_smb_rsp = Util.update_timestamp(timestamp_reply, pps, min_delay)
  229. diff = timestamp_smb_rsp - timestamp_smb_req
  230. begin = Util.get_filetime_format(timestamp_smb_req + diff * 0.1)
  231. end = Util.get_filetime_format(timestamp_smb_rsp - diff * 0.1)
  232. system_time = rnd.randint(begin, end)
  233. if smb_version is not "1" and hosting_version is not "1":
  234. smb_rsp_paket = SMB2.SMB2_SYNC_Header(Flags=1)
  235. smb_rsp_negotiate_body =\
  236. SMB2.SMB2_Negotiate_Protocol_Response(DialectRevision=0x02ff, SecurityBufferOffset=124,
  237. SecurityBufferLength=len(security_blob),
  238. SecurityBlob=security_blob, Capabilities=capabilities,
  239. MaxTransactSize=data_size, MaxReadSize=data_size,
  240. MaxWriteSize=data_size, SystemTime=system_time,
  241. ServerStartTime=server_start_time,
  242. ServerGuid=server_guid)
  243. smb_rsp_length = len(smb_rsp_paket) + len(smb_rsp_negotiate_body)
  244. else:
  245. smb_rsp_paket =\
  246. SMBNegociate_Protocol_Response_Advanced_Security(Start="\xffSMB", PID=smb_pid, MID=smb_mid,
  247. DialectIndex=5, SecurityBlob=security_blob)
  248. smb_rsp_length = len(smb_rsp_paket)
  249. smb_rsp_net_bio = NBTSession(TYPE=0x00, LENGTH=smb_rsp_length)
  250. smb_rsp_tcp = inet.TCP(sport=SMBLib.smb_port, dport=sport, flags='PA', seq=victim_seq,
  251. ack=attacker_seq)
  252. smb_rsp_ip = inet.IP(src=ip, dst=ip_source, ttl=destination_ttl_value)
  253. smb_rsp_ether = inet.Ether(src=mac_destination, dst=mac_source)
  254. victim_seq += len(smb_rsp_net_bio) + len(smb_rsp_paket)
  255. if smb_version is not "1" and hosting_version is not "1":
  256. victim_seq += len(smb_rsp_negotiate_body)
  257. smb_rsp_combined = (smb_rsp_ether / smb_rsp_ip / smb_rsp_tcp / smb_rsp_net_bio / smb_rsp_paket)
  258. if smb_version is not "1" and hosting_version is not "1":
  259. smb_rsp_combined = (smb_rsp_combined / smb_rsp_negotiate_body)
  260. smb_rsp_combined.time = timestamp_smb_rsp
  261. self.packets.append(smb_rsp_combined)
  262. # source confirms SMB response package
  263. confirm_tcp = inet.TCP(sport=sport, dport=SMBLib.smb_port, seq=attacker_seq, ack=victim_seq,
  264. window=source_win_value, flags='A')
  265. confirm_smb_res = (confirm_ether / confirm_ip / confirm_tcp)
  266. timestamp_confirm = Util.update_timestamp(timestamp_smb_rsp, pps, min_delay)
  267. confirm_smb_res.time = timestamp_confirm
  268. self.packets.append(confirm_smb_res)
  269. # attacker sends FIN ACK
  270. confirm_tcp = inet.TCP(sport=sport, dport=SMBLib.smb_port, seq=attacker_seq, ack=victim_seq,
  271. window=source_win_value, flags='FA')
  272. source_fin_ack = (confirm_ether / confirm_ip / confirm_tcp)
  273. timestamp_src_fin_ack = Util.update_timestamp(timestamp_confirm, pps, min_delay)
  274. source_fin_ack.time = timestamp_src_fin_ack
  275. attacker_seq += 1
  276. self.packets.append(source_fin_ack)
  277. # victim sends FIN ACK
  278. reply_tcp = inet.TCP(sport=SMBLib.smb_port, dport=sport, seq=victim_seq, ack=attacker_seq,
  279. window=destination_win_value, flags='FA')
  280. destination_fin_ack = (reply_ether / reply_ip / reply_tcp)
  281. timestamp_dest_fin_ack = Util.update_timestamp(timestamp_src_fin_ack, pps, min_delay)
  282. victim_seq += 1
  283. destination_fin_ack.time = timestamp_dest_fin_ack
  284. self.packets.append(destination_fin_ack)
  285. # source sends final ACK
  286. confirm_tcp = inet.TCP(sport=sport, dport=SMBLib.smb_port, seq=attacker_seq, ack=victim_seq,
  287. window=source_win_value, flags='A')
  288. final_ack = (confirm_ether / confirm_ip / confirm_tcp)
  289. timestamp_final_ack = Util.update_timestamp(timestamp_dest_fin_ack, pps, min_delay)
  290. final_ack.time = timestamp_final_ack
  291. self.packets.append(final_ack)
  292. else:
  293. # Build RST package
  294. reply_ether = inet.Ether(src=mac_destination, dst=mac_source)
  295. reply_ip = inet.IP(src=ip, dst=ip_source, ttl=destination_ttl_value, flags='DF')
  296. reply_tcp = inet.TCP(sport=SMBLib.smb_port, dport=sport, seq=0, ack=attacker_seq, flags='RA',
  297. window=destination_win_value, options=[('MSS', destination_mss_value)])
  298. reply = (reply_ether / reply_ip / reply_tcp)
  299. reply.time = timestamp_reply
  300. self.packets.append(reply)
  301. pps = max(Util.get_interval_pps(complement_interval_pps, timestamp_next_pkt), 10)
  302. timestamp_next_pkt = Util.update_timestamp(timestamp_next_pkt, pps)
  303. def generate_attack_pcap(self):
  304. # store end time of attack
  305. self.attack_end_utime = self.packets[-1].time
  306. # write attack self.packets to pcap
  307. pcap_path = self.write_attack_pcap(sorted(self.packets, key=lambda pkt: pkt.time))
  308. # return packets sorted by packet time_sec_start
  309. return len(self.packets), pcap_path