3
0

SMBScanAttack.py 23 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427
  1. import logging
  2. import random as rnd
  3. import scapy.layers.inet as inet
  4. from scapy.layers.smb import *
  5. import Attack.AttackParameters as atkParam
  6. import Attack.BaseAttack as BaseAttack
  7. import ID2TLib.SMB2 as SMB2
  8. import ID2TLib.SMBLib as SMBLib
  9. import ID2TLib.Utility as Util
  10. logging.getLogger("scapy.runtime").setLevel(logging.ERROR)
  11. # noinspection PyPep8
  12. class SMBScanAttack(BaseAttack.BaseAttack):
  13. def __init__(self):
  14. """
  15. Creates a new instance of the SMBScanAttack.
  16. This Attack injects TCP Syn Requests to the port 445 of several ips and related response into the output
  17. pcap file.
  18. If port 445 is open, it will simulate and inject the SMB Protocol Negotiation too.
  19. """
  20. # Initialize attack
  21. super(SMBScanAttack, self).__init__("SmbScan Attack", "Injects an SMB scan",
  22. "Scanning/Probing")
  23. self.host_os = Util.get_rnd_os()
  24. # Define allowed parameters and their type
  25. self.supported_params.update({
  26. atkParam.Parameter.IP_SOURCE: atkParam.ParameterTypes.TYPE_IP_ADDRESS,
  27. atkParam.Parameter.IP_DESTINATION: atkParam.ParameterTypes.TYPE_IP_ADDRESS,
  28. atkParam.Parameter.TARGET_COUNT: atkParam.ParameterTypes.TYPE_INTEGER_POSITIVE,
  29. atkParam.Parameter.HOSTING_PERCENTAGE: atkParam.ParameterTypes.TYPE_PERCENTAGE,
  30. atkParam.Parameter.PORT_SOURCE: atkParam.ParameterTypes.TYPE_PORT,
  31. atkParam.Parameter.MAC_SOURCE: atkParam.ParameterTypes.TYPE_MAC_ADDRESS,
  32. atkParam.Parameter.INJECT_AT_TIMESTAMP: atkParam.ParameterTypes.TYPE_FLOAT,
  33. atkParam.Parameter.INJECT_AFTER_PACKET: atkParam.ParameterTypes.TYPE_PACKET_POSITION,
  34. atkParam.Parameter.IP_SOURCE_RANDOMIZE: atkParam.ParameterTypes.TYPE_BOOLEAN,
  35. atkParam.Parameter.PACKETS_PER_SECOND: atkParam.ParameterTypes.TYPE_FLOAT,
  36. atkParam.Parameter.PORT_SOURCE_RANDOMIZE: atkParam.ParameterTypes.TYPE_BOOLEAN,
  37. atkParam.Parameter.HOSTING_IP: atkParam.ParameterTypes.TYPE_IP_ADDRESS,
  38. atkParam.Parameter.HOSTING_VERSION: atkParam.ParameterTypes.TYPE_STRING,
  39. atkParam.Parameter.SOURCE_PLATFORM: atkParam.ParameterTypes.TYPE_STRING,
  40. atkParam.Parameter.PROTOCOL_VERSION: atkParam.ParameterTypes.TYPE_STRING
  41. })
  42. def init_params(self):
  43. """
  44. Initialize the parameters of this attack using the user supplied command line parameters.
  45. Use the provided statistics to calculate default parameters and to process user
  46. supplied queries.
  47. """
  48. # PARAMETERS: initialize with default values
  49. # (values are overwritten if user specifies them)
  50. most_used_ip_address = self.statistics.get_most_used_ip_address()
  51. self.add_param_value(atkParam.Parameter.IP_SOURCE, most_used_ip_address)
  52. self.add_param_value(atkParam.Parameter.IP_SOURCE_RANDOMIZE, 'False')
  53. self.add_param_value(atkParam.Parameter.MAC_SOURCE, self.statistics.get_mac_address(most_used_ip_address))
  54. self.add_param_value(atkParam.Parameter.TARGET_COUNT, 200)
  55. self.add_param_value(atkParam.Parameter.IP_DESTINATION, "1.1.1.1")
  56. self.add_param_value(atkParam.Parameter.PORT_SOURCE, rnd.randint(1024, 65535))
  57. self.add_param_value(atkParam.Parameter.PORT_SOURCE_RANDOMIZE, 'True')
  58. self.add_param_value(atkParam.Parameter.PACKETS_PER_SECOND,
  59. (self.statistics.get_pps_sent(most_used_ip_address) +
  60. self.statistics.get_pps_received(most_used_ip_address)) / 2)
  61. self.add_param_value(atkParam.Parameter.INJECT_AFTER_PACKET, rnd.randint(0, self.statistics.get_packet_count()))
  62. self.add_param_value(atkParam.Parameter.HOSTING_PERCENTAGE, 0.5)
  63. self.add_param_value(atkParam.Parameter.HOSTING_IP, "1.1.1.1")
  64. self.add_param_value(atkParam.Parameter.HOSTING_VERSION, SMBLib.get_smb_version(platform=self.host_os))
  65. self.add_param_value(atkParam.Parameter.SOURCE_PLATFORM, Util.get_rnd_os())
  66. self.add_param_value(atkParam.Parameter.PROTOCOL_VERSION, "1")
  67. def generate_attack_packets(self):
  68. """
  69. Creates the attack packets.
  70. """
  71. pps = self.get_param_value(atkParam.Parameter.PACKETS_PER_SECOND)
  72. # Calculate complement packet rates of the background traffic for each interval
  73. complement_interval_pps = self.statistics.calculate_complement_packet_rates(pps)
  74. # Timestamp
  75. timestamp_next_pkt = self.get_param_value(atkParam.Parameter.INJECT_AT_TIMESTAMP)
  76. # store start time of attack
  77. self.attack_start_utime = timestamp_next_pkt
  78. timestamp_prv_reply, timestamp_confirm = 0, 0
  79. # Initialize parameters
  80. ip_source = self.get_param_value(atkParam.Parameter.IP_SOURCE)
  81. dest_ip_count = self.get_param_value(atkParam.Parameter.TARGET_COUNT)
  82. ip_addr_count = self.statistics.get_ip_address_count()
  83. if ip_addr_count < dest_ip_count + 1:
  84. dest_ip_count = ip_addr_count
  85. # Check for user defined target IP addresses
  86. ip_destinations = self.get_param_value(atkParam.Parameter.IP_DESTINATION)
  87. if isinstance(ip_destinations, list):
  88. dest_ip_count = dest_ip_count - len(ip_destinations)
  89. elif ip_destinations is not "1.1.1.1":
  90. dest_ip_count = dest_ip_count - 1
  91. ip_destinations = [ip_destinations]
  92. else:
  93. ip_destinations = []
  94. # Take random targets from pcap
  95. rnd_ips = self.statistics.get_random_ip_address(dest_ip_count)
  96. if not isinstance(rnd_ips, list):
  97. rnd_ips = [rnd_ips]
  98. ip_destinations = ip_destinations + rnd_ips
  99. # Make sure the source IP is not part of targets
  100. if ip_source in ip_destinations and isinstance(ip_destinations, list):
  101. ip_destinations.remove(ip_source)
  102. self.add_param_value(atkParam.Parameter.IP_DESTINATION, ip_destinations)
  103. ip_destinations = self.get_param_value(atkParam.Parameter.IP_DESTINATION)
  104. # Calculate the amount of IP addresses which are hosting SMB
  105. host_percentage = self.get_param_value(atkParam.Parameter.HOSTING_PERCENTAGE)
  106. rnd_ip_count = len(ip_destinations) * host_percentage
  107. # Check for user defined IP addresses which are hosting SMB
  108. hosting_ip = self.get_param_value(atkParam.Parameter.HOSTING_IP)
  109. if isinstance(hosting_ip, list):
  110. rnd_ip_count = rnd_ip_count - len(hosting_ip)
  111. elif hosting_ip is not "1.1.1.1":
  112. rnd_ip_count = rnd_ip_count - 1
  113. hosting_ip = [hosting_ip]
  114. else:
  115. hosting_ip = []
  116. hosting_ip = hosting_ip + ip_destinations[:int(rnd_ip_count)]
  117. self.add_param_value(atkParam.Parameter.HOSTING_IP, hosting_ip)
  118. # Shuffle targets
  119. rnd.shuffle(ip_destinations)
  120. # FIXME: Handle mac addresses correctly
  121. mac_source = self.get_param_value(atkParam.Parameter.MAC_SOURCE)
  122. mac_dest = self.get_param_value(atkParam.Parameter.MAC_DESTINATION)
  123. # Check smb version
  124. smb_version = self.get_param_value(atkParam.Parameter.PROTOCOL_VERSION)
  125. if smb_version not in SMBLib.smb_versions:
  126. SMBLib.invalid_smb_version(smb_version)
  127. hosting_version = self.get_param_value(atkParam.Parameter.HOSTING_VERSION)
  128. if hosting_version not in SMBLib.smb_versions:
  129. SMBLib.invalid_smb_version(hosting_version)
  130. # Check source platform
  131. src_platform = self.get_param_value(atkParam.Parameter.SOURCE_PLATFORM).lower()
  132. self.packets = []
  133. # randomize source ports according to platform, if specified
  134. if self.get_param_value(atkParam.Parameter.PORT_SOURCE_RANDOMIZE):
  135. sport = Util.generate_source_port_from_platform(src_platform)
  136. else:
  137. sport = self.get_param_value(atkParam.Parameter.PORT_SOURCE)
  138. # No destination IP was specified, but a destination MAC was specified, generate IP that fits MAC
  139. if isinstance(ip_destinations, list) and isinstance(mac_dest, str):
  140. ip_destinations = self.statistics.get_ip_address_from_mac(mac_dest)
  141. if len(ip_destinations) == 0:
  142. ip_destinations = self.generate_random_ipv4_address("Unknown", 1)
  143. # Check ip.src == ip.dst
  144. self.ip_src_dst_equal_check(ip_source, ip_destinations)
  145. ip_dests = []
  146. if isinstance(ip_destinations, list):
  147. ip_dests = ip_destinations
  148. else:
  149. ip_dests.append(ip_destinations)
  150. if isinstance(ip_dests, list):
  151. rnd.shuffle(ip_dests)
  152. # Randomize source IP, if specified
  153. if self.get_param_value(atkParam.Parameter.IP_SOURCE_RANDOMIZE):
  154. ip_source = self.generate_random_ipv4_address("Unknown", 1)
  155. while ip_source in ip_dests:
  156. ip_source = self.generate_random_ipv4_address("Unknown", 1)
  157. mac_source = self.statistics.get_mac_address(str(ip_source))
  158. if len(mac_source) == 0:
  159. mac_source = self.generate_random_mac_address()
  160. # Get MSS, TTL and Window size value for source IP
  161. source_mss_value, source_ttl_value, source_win_value = self.get_ip_data(ip_source)
  162. mac_dests = self.statistics.get_mac_addresses(ip_dests)
  163. first_timestamp_smb = self.statistics.get_pcap_timestamp_start()[:19]
  164. for ip in ip_dests:
  165. if ip != ip_source:
  166. # Get destination Mac Address
  167. mac_destination = ""
  168. if ip in mac_dests.keys():
  169. mac_destination = mac_dests[ip]
  170. if len(mac_destination) == 0:
  171. if isinstance(mac_dest, str):
  172. ip_from_mac = self.statistics.get_ip_address_from_mac(mac_dest)
  173. if len(ip_from_mac) != 0:
  174. ip = ip_from_mac
  175. self.ip_src_dst_equal_check(ip_source, ip)
  176. mac_destination = mac_dest
  177. else:
  178. mac_destination = self.generate_random_mac_address()
  179. # Get MSS, TTL and Window size value for destination IP
  180. destination_mss_value, destination_ttl_value, destination_win_value = self.get_ip_data(ip)
  181. min_delay, max_delay = self.get_reply_delay(ip)
  182. # New connection, new random TCP sequence numbers
  183. attacker_seq = rnd.randint(1000, 50000)
  184. victim_seq = rnd.randint(1000, 50000)
  185. # Randomize source port for each connection if specified
  186. if self.get_param_value(atkParam.Parameter.PORT_SOURCE_RANDOMIZE):
  187. sport = Util.generate_source_port_from_platform(src_platform, sport)
  188. # 1) Build request package
  189. request_ether = inet.Ether(src=mac_source, dst=mac_destination)
  190. request_ip = inet.IP(src=ip_source, dst=ip, ttl=source_ttl_value, flags='DF')
  191. request_tcp = inet.TCP(sport=sport, dport=SMBLib.smb_port, window=source_win_value, flags='S',
  192. seq=attacker_seq, options=[('MSS', source_mss_value)])
  193. attacker_seq += 1
  194. request = (request_ether / request_ip / request_tcp)
  195. request.time = timestamp_next_pkt
  196. # Append request
  197. self.packets.append(request)
  198. # Update timestamp for next package
  199. timestamp_reply = Util.update_timestamp(timestamp_next_pkt, pps, min_delay)
  200. while timestamp_reply <= timestamp_prv_reply:
  201. timestamp_reply = Util.update_timestamp(timestamp_prv_reply, pps, min_delay)
  202. timestamp_prv_reply = timestamp_reply
  203. if ip in hosting_ip:
  204. # 2) Build TCP packages for ip that hosts SMB
  205. # destination sends SYN, ACK
  206. reply_ether = inet.Ether(src=mac_destination, dst=mac_source)
  207. reply_ip = inet.IP(src=ip, dst=ip_source, ttl=destination_ttl_value, flags='DF')
  208. reply_tcp = inet.TCP(sport=SMBLib.smb_port, dport=sport, seq=victim_seq, ack=attacker_seq,
  209. flags='SA',
  210. window=destination_win_value, options=[('MSS', destination_mss_value)])
  211. victim_seq += 1
  212. reply = (reply_ether / reply_ip / reply_tcp)
  213. reply.time = timestamp_reply
  214. self.packets.append(reply)
  215. # requester confirms, ACK
  216. confirm_ether = request_ether
  217. confirm_ip = request_ip
  218. confirm_tcp = inet.TCP(sport=sport, dport=SMBLib.smb_port, seq=attacker_seq, ack=victim_seq,
  219. window=source_win_value, flags='A')
  220. confirm = (confirm_ether / confirm_ip / confirm_tcp)
  221. timestamp_confirm = Util.update_timestamp(timestamp_reply, pps, min_delay)
  222. confirm.time = timestamp_confirm
  223. self.packets.append(confirm)
  224. # 3) Build SMB Negotiation packets
  225. smb_mid = rnd.randint(1, 65535)
  226. smb_pid = rnd.randint(1, 65535)
  227. smb_req_tail_arr = []
  228. smb_req_tail_size = 0
  229. # select dialects based on smb version
  230. if smb_version is "1":
  231. smb_req_dialects = SMBLib.smb_dialects[0:6]
  232. else:
  233. smb_req_dialects = SMBLib.smb_dialects
  234. if len(smb_req_dialects) == 0:
  235. smb_req_tail_arr.append(SMBNegociate_Protocol_Request_Tail())
  236. smb_req_tail_size = len(SMBNegociate_Protocol_Request_Tail())
  237. else:
  238. for dia in smb_req_dialects:
  239. smb_req_tail_arr.append(SMBNegociate_Protocol_Request_Tail(BufferData=dia))
  240. smb_req_tail_size += len(SMBNegociate_Protocol_Request_Tail(BufferData=dia))
  241. # Creation of SMB Negotiate Protocol Request packet
  242. smb_req_head = SMBNegociate_Protocol_Request_Header(Flags2=0x2801, PID=smb_pid, MID=smb_mid,
  243. ByteCount=smb_req_tail_size)
  244. smb_req_length = len(smb_req_head) + smb_req_tail_size
  245. smb_req_net_bio = NBTSession(TYPE=0x00, LENGTH=smb_req_length)
  246. smb_req_tcp = inet.TCP(sport=sport, dport=SMBLib.smb_port, flags='PA', seq=attacker_seq,
  247. ack=victim_seq)
  248. smb_req_ip = inet.IP(src=ip_source, dst=ip, ttl=source_ttl_value)
  249. smb_req_ether = inet.Ether(src=mac_source, dst=mac_destination)
  250. attacker_seq += len(smb_req_net_bio) + len(smb_req_head) + smb_req_tail_size
  251. smb_req_combined = (smb_req_ether / smb_req_ip / smb_req_tcp / smb_req_net_bio / smb_req_head)
  252. for i in range(0, len(smb_req_tail_arr)):
  253. smb_req_combined = smb_req_combined / smb_req_tail_arr[i]
  254. timestamp_smb_req = Util.update_timestamp(timestamp_confirm, pps, min_delay)
  255. smb_req_combined.time = timestamp_smb_req
  256. self.packets.append(smb_req_combined)
  257. # destination confirms SMB request package
  258. reply_tcp = inet.TCP(sport=SMBLib.smb_port, dport=sport, seq=victim_seq, ack=attacker_seq,
  259. window=destination_win_value, flags='A')
  260. confirm_smb_req = (reply_ether / reply_ip / reply_tcp)
  261. timestamp_reply = Util.update_timestamp(timestamp_smb_req, pps, min_delay)
  262. confirm_smb_req.time = timestamp_reply
  263. self.packets.append(confirm_smb_req)
  264. # smb response package
  265. first_timestamp = time.mktime(time.strptime(first_timestamp_smb, "%Y-%m-%d %H:%M:%S"))
  266. server_guid, security_blob, capabilities, data_size, server_start_time =\
  267. SMBLib.get_smb_platform_data(self.host_os, first_timestamp)
  268. timestamp_smb_rsp = Util.update_timestamp(timestamp_reply, pps, min_delay)
  269. diff = timestamp_smb_rsp - timestamp_smb_req
  270. begin = Util.get_filetime_format(timestamp_smb_req + diff * 0.1)
  271. end = Util.get_filetime_format(timestamp_smb_rsp - diff * 0.1)
  272. system_time = rnd.randint(begin, end)
  273. # Creation of SMB Negotiate Protocol Response packets
  274. if smb_version is not "1" and hosting_version is not "1":
  275. smb_rsp_packet = SMB2.SMB2_SYNC_Header(Flags=1)
  276. smb_rsp_negotiate_body =\
  277. SMB2.SMB2_Negotiate_Protocol_Response(DialectRevision=0x02ff, SecurityBufferOffset=124,
  278. SecurityBufferLength=len(security_blob),
  279. SecurityBlob=security_blob, Capabilities=capabilities,
  280. MaxTransactSize=data_size, MaxReadSize=data_size,
  281. MaxWriteSize=data_size, SystemTime=system_time,
  282. ServerStartTime=server_start_time,
  283. ServerGuid=server_guid)
  284. smb_rsp_length = len(smb_rsp_packet) + len(smb_rsp_negotiate_body)
  285. else:
  286. smb_rsp_packet =\
  287. SMBNegociate_Protocol_Response_Advanced_Security(Start="\xffSMB", PID=smb_pid, MID=smb_mid,
  288. DialectIndex=5, SecurityBlob=security_blob)
  289. smb_rsp_length = len(smb_rsp_packet)
  290. smb_rsp_net_bio = NBTSession(TYPE=0x00, LENGTH=smb_rsp_length)
  291. smb_rsp_tcp = inet.TCP(sport=SMBLib.smb_port, dport=sport, flags='PA', seq=victim_seq,
  292. ack=attacker_seq)
  293. smb_rsp_ip = inet.IP(src=ip, dst=ip_source, ttl=destination_ttl_value)
  294. smb_rsp_ether = inet.Ether(src=mac_destination, dst=mac_source)
  295. victim_seq += len(smb_rsp_net_bio) + len(smb_rsp_packet)
  296. if smb_version is not "1" and hosting_version is not "1":
  297. victim_seq += len(smb_rsp_negotiate_body)
  298. smb_rsp_combined = (smb_rsp_ether / smb_rsp_ip / smb_rsp_tcp / smb_rsp_net_bio / smb_rsp_packet)
  299. if smb_version is not "1" and hosting_version is not "1":
  300. smb_rsp_combined = (smb_rsp_combined / smb_rsp_negotiate_body)
  301. smb_rsp_combined.time = timestamp_smb_rsp
  302. self.packets.append(smb_rsp_combined)
  303. # source confirms SMB response package
  304. confirm_tcp = inet.TCP(sport=sport, dport=SMBLib.smb_port, seq=attacker_seq, ack=victim_seq,
  305. window=source_win_value, flags='A')
  306. confirm_smb_res = (confirm_ether / confirm_ip / confirm_tcp)
  307. timestamp_confirm = Util.update_timestamp(timestamp_smb_rsp, pps, min_delay)
  308. confirm_smb_res.time = timestamp_confirm
  309. self.packets.append(confirm_smb_res)
  310. # attacker sends FIN ACK
  311. confirm_tcp = inet.TCP(sport=sport, dport=SMBLib.smb_port, seq=attacker_seq, ack=victim_seq,
  312. window=source_win_value, flags='FA')
  313. source_fin_ack = (confirm_ether / confirm_ip / confirm_tcp)
  314. timestamp_src_fin_ack = Util.update_timestamp(timestamp_confirm, pps, min_delay)
  315. source_fin_ack.time = timestamp_src_fin_ack
  316. attacker_seq += 1
  317. self.packets.append(source_fin_ack)
  318. # victim sends FIN ACK
  319. reply_tcp = inet.TCP(sport=SMBLib.smb_port, dport=sport, seq=victim_seq, ack=attacker_seq,
  320. window=destination_win_value, flags='FA')
  321. destination_fin_ack = (reply_ether / reply_ip / reply_tcp)
  322. timestamp_dest_fin_ack = Util.update_timestamp(timestamp_src_fin_ack, pps, min_delay)
  323. victim_seq += 1
  324. destination_fin_ack.time = timestamp_dest_fin_ack
  325. self.packets.append(destination_fin_ack)
  326. # source sends final ACK
  327. confirm_tcp = inet.TCP(sport=sport, dport=SMBLib.smb_port, seq=attacker_seq, ack=victim_seq,
  328. window=source_win_value, flags='A')
  329. final_ack = (confirm_ether / confirm_ip / confirm_tcp)
  330. timestamp_final_ack = Util.update_timestamp(timestamp_dest_fin_ack, pps, min_delay)
  331. final_ack.time = timestamp_final_ack
  332. self.packets.append(final_ack)
  333. else:
  334. # Build RST package
  335. reply_ether = inet.Ether(src=mac_destination, dst=mac_source)
  336. reply_ip = inet.IP(src=ip, dst=ip_source, ttl=destination_ttl_value, flags='DF')
  337. reply_tcp = inet.TCP(sport=SMBLib.smb_port, dport=sport, seq=0, ack=attacker_seq, flags='RA',
  338. window=destination_win_value, options=[('MSS', destination_mss_value)])
  339. reply = (reply_ether / reply_ip / reply_tcp)
  340. reply.time = timestamp_reply
  341. self.packets.append(reply)
  342. pps = max(Util.get_interval_pps(complement_interval_pps, timestamp_next_pkt), 10)
  343. timestamp_next_pkt = Util.update_timestamp(timestamp_next_pkt, pps)
  344. def generate_attack_pcap(self):
  345. """
  346. Creates a pcap containing the attack packets.
  347. :return: The location of the generated pcap file.
  348. """
  349. # store end time of attack
  350. self.attack_end_utime = self.packets[-1].time
  351. # write attack self.packets to pcap
  352. pcap_path = self.write_attack_pcap(sorted(self.packets, key=lambda pkt: pkt.time))
  353. # return packets sorted by packet time_sec_start
  354. return len(self.packets), pcap_path