PDA

View Full Version : soket


ustaz99
19-03-04, 12:14 PM
malas la kat ittutor.net diorang jenis taknak tolong la..
harap dapat petunjuk dari korang lak ek, saya baru belajar benda2 nie...
malam tadi test port forwarding ke pc windows, port 135, 139, 445,
dari local pc mdk9.2.
WinXP tu tanpa service pack is vulnerable to dcom&dcom2 exploit.
tapi dgn pforw ni dpt drop pattern '\x90' yg slalunya wujud dlm
stack based buffer overflow..
buat masa nie, testing kat port samba cam takde masalah dan dgn port http.
yg kali nie, buat dalam thread version lak, pid adalah sama utk setiap thread
tapi berlainan tid..
koding yg nie sesajer taruk kod thread mutex dgn cond, tapi tak guna pun,
tapi tu bermakna saya cuba mula membuat applikasi soket yg lain,
cam, simple relay chat. erm... tak tau taktiknya camner, tapi kan,
boleh ker setiap client yg connect, app ni akan menggunakan satu tty/pty utk
semua connections, atau tekniknya dgn tambah satu thread akan pool setiap
setiap active connection dan manage buffer yg menyimpan setiap text line.


<pre>
#include <sys/socket.h>
#include <sys/select.h>
#include <netdb.h>
#include <signal.h>
#include <sys/wait.h>
#include <pthread.h>

#define BUFLEN 1024
#define BUFFER_QUEUE_SIZE 16
#define OVER -1

/* Circular buffer of integers. */

struct prodcons {
int buffer[BUFFER_QUEUE_SIZE];/* the actual data */
pthread_mutex_t lock; /* mutex ensuring exclusive access to buffer */
int readpos, writepos; /* positions for reading and writing */
pthread_cond_t notempty; /* signaled when buffer is not empty */
pthread_cond_t notfull; /* signaled when buffer is not full */
} buffer; /* global variable */

struct curconnect {
char *hostname;
int port;
char *forw_server;
int forw_port;
int num_curr_conn;
} conn;

/* Initialize a buffer */

void init(struct prodcons * B)
{
pthread_mutex_init(&b->lock, NULL);
pthread_cond_init(&b->notempty, NULL);
pthread_cond_init(&b->notfull, NULL);
b->readpos = 0;
b->writepos = 0;
}

/* Store an integer in the buffer */

void put(struct prodcons * b, int data)
{
pthread_mutex_lock(&b->lock);
/* Wait until buffer is not full */
while ((b->writepos + 1) % BUFFER_QUEUE_SIZE == b->readpos) { // BUFFER_QUEUE_SIZE + 1 = 1
pthread_cond_wait(&b->notfull, &b->lock);
/* pthread_cond_wait reacquired b->lock before returning */
}
/* Write the data and advance write pointer */
b->buffer[b->writepos] = data;
b->writepos++;
if (b->writepos >= BUFFER_QUEUE_SIZE) b->writepos = 0;
/* Signal that the buffer is now not empty */
pthread_cond_signal(&b->notempty);
pthread_mutex_unlock(&b->lock);
}

/* Read and remove an integer from the buffer */

int get(struct prodcons * B)
{
int data;
pthread_mutex_lock(&b->lock);
/* Wait until buffer is not empty */
while (b->writepos == b->readpos) {
pthread_cond_wait(&b->notempty, &b->lock);
}
/* Read the data and advance read pointer */
data = b->buffer[b->readpos];
b->readpos++;
if (b->readpos >= BUFFER_QUEUE_SIZE) b->readpos = 0;
/* Signal that the buffer is now not full */
pthread_cond_signal(&b->notfull);
pthread_mutex_unlock(&b->lock);
return data;
}

in_addr_t resolve(char *);
void *thread(void *);
int delchar(char *, int *, char, int);
int connectfd(int *, char *, int);
int listenfd(int *, unsigned long, int);

int pow(int num, int mul) {
int ret = 1;
for(;mul>0;mul--)
ret *= num;
return ret;
}

int stoi(char *str) {
int i,ret=0,len=strlen(str);
for(i=0;i<len;i++)
ret+=pow(10,len-i-1)*((int)(*(str+i))-48);
return ret;
}

in_addr_t resolve(char *name)
{
struct hostent *he;
in_addr_t ip;

if((ip=inet_addr(name))==(-1)) //convert ip dot notation style to binary
{
if((he=gethostbyname(name))==0) // else, the arg is in name
exit(1);
memcpy(&ip,he->h_addr,4);
}
return ip;
}

int main(int argc, char *argv[]) {

int sock, *scli, slen;
pthread_t tid;
init(&buffer);

if(argc<4) {
printf("[!] Please type %s [s-port] [d-hostname] [d-port]\n", argv[0]);
return 1;
}

conn.port = stoi(argv[1]);
conn.forw_server = argv[2];
conn.forw_port = stoi(argv[3]);

struct sockaddr_in client;

if(!listenfd(&sock, INADDR_ANY, conn.port)) {
return 1;
}

while(1) {
slen = sizeof(client);
scli = (int *)malloc(sizeof(int));
*scli = accept(sock, (struct sockaddr *) &client, &slen);
pthread_create(&tid, NULL, thread, scli);
pthread_detach(tid);
}

close(sock);
return 0;
}

int listenfd(int *sockfd, unsigned long long_ip, int port) {

struct sockaddr_in host;

host.sin_family = AF_INET;
host.sin_addr.s_addr = htonl(long_ip);
host.sin_port = htons(port);

if ((*sockfd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) < 0) {
perror("[!] Socket");
return 0;
}

if (bind(*sockfd, (struct sockaddr *) &host, sizeof(host)) < 0) {
perror("[!] Bind");
return 0;
}

if (listen(*sockfd, 1024) < 0) {
perror("[!] Listen");
return 0;
}
return *sockfd;
}


int connectfd(int *sockfd, char *hostname, int port) {

struct sockaddr_in host;

host.sin_family = AF_INET;
host.sin_addr.s_addr = resolve(hostname);
host.sin_port = htons(port);

if ((*sockfd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) < 0) {
perror("[!] Socket");
return 0;
}

if (connect(*sockfd, (struct sockaddr *)&host, sizeof(host)) != 0) {
perror("[!] Connect");
return 0;
}

return *sockfd;
}

// delete num of char(s) from word given
int delchar(char *word, int *len, char c, int num)
{
int i,k,found=0;
for(i=0;i<*len;i++)
{
if(*(word+i)==c)
{
if(++k>=num && !(*(word+i+1)==c))
{
found+=k;
k=0;
} else
*(word+i-found)=*(word+i);
} else {
*(word+i-found)=*(word+i);
k=0;
}
}
return (*len)-=found;
}


void *thread(void *vargp)
{
int i, len, scli = *((int *)vargp);
int sser, tid = pthread_self();
char buf[BUFLEN];

fd_set fdreadme;

free(vargp);

if(!connectfd(&sser, conn.forw_server, conn.forw_port)) {
close(scli);
return NULL;
}

FD_ZERO(&fdreadme);

while(1) {
FD_SET(scli, &fdreadme);
FD_SET(sser, &fdreadme);

if(select(FD_SETSIZE, &fdreadme, NULL, NULL, NULL) < 0 ) break;

// recieve packet from server to client
if(FD_ISSET(sser, &fdreadme))
{
// read packet from server
if((len = recv(sser, buf, sizeof(buf), 0)) <= 0)
{
//printf("\n Connection close\n");
close(sser);
close(scli);
return 0;
}
if(write(scli, buf, len) <= 0) break;
}

// write packet from client to server
if(FD_ISSET(scli, &fdreadme))
{
// read from client
if((len = read(scli, buf, sizeof(buf))) <= 0)
{
//printf("\n Connection terminated\n");
close(sser);
close(scli);
return 0;
}
// check for BOF pattern "\x90\x90\x90"...
delchar(buf, &len, '\x90', 3); // try with at least '\x90'*3
// send packet to server
if(send(sser, buf, len, 0) <= 0) break;
}
}

close(sser);
close(scli);
return NULL;
}
</pre>

fr0z3n
20-03-04, 03:00 PM
oh dia drop "\x90" (nop) dalam shellcode...kalo attacker pakai polymorphic shellcode amacam lak?

bulus geng
23-03-04, 08:37 PM
err tumpang tanye sikit ...
bole run ke ? apsal variable dalam function init struct prodcons tak same dgn pointer kat bawah?... kalau tak silap sepatutnya program nih jadi client dan server sekali sebab ade function listen dan accept utk server dan function connect utk client .. aku rase ape yang dibuat ia akan listen port yang telah di define dan akan diforwardkan(connect) ke port yang di define dan host add yang telah di takrif dalam main tadik dalam keadaan yang dibuka dan difilter/delete buffer (delchar) yang bercode \x90 ..... betul ke camtuh weih???

ustaz99
24-03-04, 09:35 AM
boleh run je, sorry la, koding nak cepat jer, banyak header takde, erm.. betul la takrifan saudara tu kut.. ah ha.. best la, ada gak orang reply... kiter share2 ek.

erm... ceh, ye la, yg ni sajer2 jer nak tambah function delchar tu kat koding nie, anyway, kalau polymorphic still ada pattern dia jugak kan, jap, jap, polymorphic kan still ada nop kan, psal nak jump kat ner??? kalau sorokkan '/bin/sh', 'cmd.exe', etc... guna polymorphic boleh la kan, atau ada idea lain...

#kalau saya ada idea lain, boleh tambah koding lagi kat sini. anyway still tak pernah sentuh soket windows lagi. newbie.

bulus geng
24-03-04, 11:43 AM
jump nih ikot architecture kan? intel?

fr0z3n
24-03-04, 01:20 PM
Pi blajer pasal polymorphic and printable shellcode... pastu baru senang kita nak cakap :)

bulus geng
24-03-04, 02:12 PM
camne nak detect eh ubah ubah sebalik shellcode tuh? pattern matching tak best laa kot

ustaz99
24-03-04, 02:50 PM
... erm, okay, saya belajar dulu. bye.

ustaz99
25-03-04, 10:21 AM
camner saya tambah dua line

delchar(buf, &len, '\x90', 3); // try with at least '\x90'*3
delchar(buf, &len, '@', 5); // try with at least '@'*5

boleh tak???

bulus geng
25-03-04, 01:51 PM
aku rase kalau nak elok copy sume pattern yang ade dalam IDS dan tarok kat delchar ... '@@@@@' nih pattern ape? :)

ustaz99
25-03-04, 07:43 PM
erk, nanti aku cari instructions kat lingkungan printable character, dan...
slamat berjumpa lagi... ingat nak lone ranger. bye.

fr0z3n
26-03-04, 12:59 PM
aku rasa kalo filter satu dua pattern tak cukup..coz kalo kita pakai polymorhpic atau printable atau teknik lelain dia leh jadi memacam pattern..satu lagi..attackers leh encrypt shellcode tu pastu decrypt balik...contoh macam shellcode yang vlad buat....selain tu attackers juga boleh guna obfuscation technique...

p/s: ada banyak lagi technique yang belom popular kat public...kena banyak pi berkenalan and berguru dengan owang coz google.com kenkadang not everything.....

jackie
26-03-04, 03:56 PM
detect dan drop/redirect "x90" ..it's not that easy my friend to stop an attacker.. kadang2 gif/jpg pun ade char tu.

BTW:

aku tak try program ko, so no komen pasal program ko.. however nice work, and keep on learning. May the packets be with U!

ustaz99
26-03-04, 08:28 PM
tq2, 4 all of u's.
skrg ni dah slow balik, psal kena under lecturer sini jap,
so, kalau ada apa2 nanti saya post lagi, but not too likely expose in here,
dan... best la korang, rasanya camnie la yg saya harapkan.

psal '\x90' tu, ye ke.. erm... tak perasan pun, tq's alot.
dan jugak psal printable shellcode tu.. erm.. bye.

bulus geng
27-03-04, 10:46 AM
Kiriman asal oleh jackie
detect dan drop/redirect "x90" ..it's not that easy my friend to stop an attacker.. kadang2 gif/jpg pun ade char tu.

BTW:

aku tak try program ko, so no komen pasal program ko.. however nice work, and keep on learning. May the packets be with U!

hehehe adat lah ade false positive sket ...

ustaz99
29-03-04, 04:29 PM
erm... tahu kan, buat masa ni kena stop dulu, walaupun ada byk idea2 baru comes in mind.
dan, archive2 lama tu ada saja simpan kat http://www.olympic.org.my/fatah/socket.tgz .(dir browsing denied), kan.

dan, erm, erm.. false positive la kan..

ustaz99
31-03-04, 11:25 AM
akum, lama tak masuk..
camni.. bagi korang camner langkah terbaik utk elakkan hangus 'broken pipe'.
yg atas ni style threading, satu pid, byk kawan, bila satu crash, habis sumer kengkawan dia..
rasanya berlaku bila masa nak send, servis port dah down (dr pglmn yg lepas la).

bulus geng
31-03-04, 05:39 PM
kalau pakai fork() ok ke?

ustaz99
01-04-04, 10:34 AM
yg guna fork() tak ada problem setakat ni, mungkin kebetulan kut.
ei.. aku ingat nak buat satu research community/lab la. tapi kat tempat aku takde saper macam nak ikut rentak. setakat ni masih lone ranger lagi. keadaan skrg ni sgt kritikal utk aku. byk benda kena solve dulu. apa2 hal leh pm dulu. mungkin kena byk study dari koding yg sedia ada cam, ettercap, nmap & etc. (& i'm hate it)..

yg psal obfuscation technique tu.. tak pernah dgr cara tu utk stack based bof, kalau dlm programming biasa ada la..
teknik dlm assembly.. ishh.. baru perasan ayat tu ari nie.
byk benda kalau nak meminta, susah nak didapati.

bulus geng
01-04-04, 07:55 PM
buat arr.... share kat sini gak biar reramai dapat share hehehe

ustaz99
12-04-04, 11:04 AM
erm, dalam 2 hari nie, kena balik rumah jap, psal parent balik sabak bernam ada kenduri..
sambil2 tu study psal packet... nie link dia.

header (http://www.olympic.org.my/fatah/socket/artofexploit/project5/header.h)
source arp request (http://www.olympic.org.my/fatah/socket/artofexploit/project5/projek5.c)
tgz (http://www.olympic.org.my/fatah/socket/artofexploit/project5/projek5.tgz)

kiter share2.

ustaz99
13-04-04, 06:53 PM
eject cd guna ioctl..
-man ioctl_list
-man ioctl
-less /usr/include/linux/cdrom.h
eject cd (http://www.olympic.org.my/fatah/socket/artofexploit/learning/cdrom/start1.c)

dgn packet capturing tu dah update, okies.
+queue w/ template

ustaz99
15-04-04, 10:27 AM
erm.. ada satu terlupa. boleh memory leak.
bugs pada
free(cur);

kena ganti dengan..
free(cur->addr);
free(cur);

ustaz99
16-04-04, 08:29 AM
for icmp(firstly program), so.. tak functional sangat.
http://www.olympic.org.my/fatah/socket/artofexploit/project5/projek5_2.c
http://www.olympic.org.my/fatah/socket/artofexploit/project5/header.h

ustaz99
19-04-04, 09:51 AM
posting ini di-offtopic-kan.

ustaz99
21-04-04, 05:00 PM
http://www.olympic.org.my/fatah/socket/artofexploit/project5/netutils.c
http://www.olympic.org.my/fatah/socket/artofexploit/project5/header.h
http://www.olympic.org.my/fatah/socket/artofexploit/project5/queue.h