예제 #1
0
파일: SMBScanAttack.py 프로젝트: xTikk/ID2T
    def init_params(self):
        """
        Initialize the parameters of this attack using the user supplied command line parameters.
        Use the provided statistics to calculate default parameters and to process user
        supplied queries.
        """

        # PARAMETERS: initialize with default values
        # (values are overwritten if user specifies them)
        most_used_ip_address = self.statistics.get_most_used_ip_address()

        self.add_param_value(atkParam.Parameter.IP_SOURCE,
                             most_used_ip_address)
        self.add_param_value(atkParam.Parameter.IP_SOURCE_RANDOMIZE, 'False')
        self.add_param_value(
            atkParam.Parameter.MAC_SOURCE,
            self.statistics.get_mac_address(most_used_ip_address))

        self.add_param_value(atkParam.Parameter.TARGET_COUNT, 200)
        self.add_param_value(atkParam.Parameter.IP_DESTINATION, "1.1.1.1")

        self.add_param_value(atkParam.Parameter.PORT_SOURCE,
                             rnd.randint(1024, 65535))
        self.add_param_value(atkParam.Parameter.PORT_SOURCE_RANDOMIZE, 'True')
        self.add_param_value(
            atkParam.Parameter.PACKETS_PER_SECOND,
            (self.statistics.get_pps_sent(most_used_ip_address) +
             self.statistics.get_pps_received(most_used_ip_address)) / 2)

        self.add_param_value(
            atkParam.Parameter.INJECT_AFTER_PACKET,
            rnd.randint(0, self.statistics.get_packet_count()))
        start = Util.get_timestamp_from_datetime_str(
            self.statistics.get_pcap_timestamp_start())
        end = Util.get_timestamp_from_datetime_str(
            self.statistics.get_pcap_timestamp_end())
        self.add_param_value(atkParam.Parameter.INJECT_AT_TIMESTAMP,
                             (start + end) / 2)
        self.add_param_value(atkParam.Parameter.INJECT_PPS, 0)

        self.add_param_value(atkParam.Parameter.HOSTING_PERCENTAGE, 0.5)
        self.add_param_value(atkParam.Parameter.HOSTING_IP, "1.1.1.1")
        self.add_param_value(atkParam.Parameter.HOSTING_VERSION,
                             SMBLib.get_smb_version(platform=self.host_os))
        self.add_param_value(atkParam.Parameter.SOURCE_PLATFORM,
                             Util.get_rnd_os())
        self.add_param_value(atkParam.Parameter.PROTOCOL_VERSION, "1")
예제 #2
0
    def process_attack(self, attack: str, params: str, time=False):
        """
        Takes as input the name of an attack (classname) and the attack parameters as string. Parses the string of
        attack parameters, creates the attack by writing the attack packets and returns the path of the written pcap.

        :param attack: The classname of the attack to inject.
        :param params: The parameters for attack customization, see attack class for supported params.
        :param time: Measure packet generation time or not.
        :return: The file path to the created pcap file.
        """
        attack = self.choose_attack(attack)

        self.create_attack(attack, self.seed)

        print("Validating and adding attack parameters.")

        # Add attack parameters if provided
        params_dict = []
        if isinstance(params, list) and params:
            # Convert attack param list into dictionary
            for entry in params:
                params_dict.append(entry.split('='))
            params_dict = dict(params_dict)
            # Check if Parameter.INJECT_AT_TIMESTAMP and Parameter.INJECT_AFTER_PACKET are provided at the same time
            # if TRUE: delete Parameter.INJECT_AT_TIMESTAMP (lower priority) and use Parameter.INJECT_AFTER_PACKET
            if (atkParam.Parameter.INJECT_AFTER_PACKET.value in params_dict) and (
                        atkParam.Parameter.INJECT_AT_TIMESTAMP.value in params_dict):
                print("CONFLICT: Parameters", atkParam.Parameter.INJECT_AT_TIMESTAMP.value, "and",
                      atkParam.Parameter.INJECT_AFTER_PACKET.value,
                      "given at the same time. Ignoring", atkParam.Parameter.INJECT_AT_TIMESTAMP.value, "and using",
                      atkParam.Parameter.INJECT_AFTER_PACKET.value, "instead to derive the timestamp.")
                del params_dict[atkParam.Parameter.INJECT_AT_TIMESTAMP.value]

            # Extract attack_note parameter, if not provided returns an empty string
            key_attack_note = "attack.note"
            attack_note = params_dict.get(key_attack_note, "")
            params_dict.pop(key_attack_note, None)  # delete entry if found, otherwise return an empty string

            # Pass paramters to attack controller
            self.set_params(params_dict)
        else:
            attack_note = "This attack used only (random) default parameters."

        self.current_attack.init_objects()

        print("Generating attack packets...", end=" ")
        sys.stdout.flush()  # force python to print text immediately
        if time:
            self.current_attack.set_start_time()
        # Generate attack packets
        self.current_attack.generate_attack_packets()
        if time:
            self.current_attack.set_finish_time()
        duration = self.current_attack.get_packet_generation_time()
        # Write attack into pcap file
        attack_result = self.current_attack.generate_attack_pcap()

        self.total_packets = attack_result[0]
        temp_attack_pcap_path = attack_result[1]
        if len(attack_result) == 3:
            # Extract the list of additional files, if available
            self.additional_files += attack_result[2]
        print("done. (total: " + str(self.total_packets) + " pkts", end="")
        if time:
            print(" in ", duration, " seconds", end="")
        print(".)")

        # Warning if attack duration gets exceeded by more than 1 second
        if atkParam.Parameter.ATTACK_DURATION in self.current_attack.supported_params and \
                        self.current_attack.get_param_value(atkParam.Parameter.ATTACK_DURATION) != 0:
            attack_duration = self.current_attack.get_param_value(atkParam.Parameter.ATTACK_DURATION)
            packet_duration = abs(self.current_attack.attack_end_utime - self.current_attack.attack_start_utime)
            time_diff = abs(attack_duration - packet_duration)
            if self.current_attack.exceeding_packets > 0 and time_diff > 1:
                exceeding_packets = ""
                if self.current_attack.exceeding_packets:
                    exceeding_packets = " ({} attack pkts)".format(self.current_attack.exceeding_packets)
                print("Warning: attack duration was exceeded by {0} seconds{1}.".format(time_diff, exceeding_packets))
            elif time_diff > 1:
                print("Warning: attack duration was not reached by generated pkts by {} seconds.".format(time_diff))

        # Warning if pcap length gets exceeded
        pcap_end = Util.get_timestamp_from_datetime_str(self.statistics.get_pcap_timestamp_end())
        time_diff = pcap_end - self.current_attack.attack_end_utime
        if time_diff < 0:
            print("Warning: end of pcap exceeded by " + str(round(abs(time_diff), 2)) + " seconds.")

        # Store label into LabelManager
        label = Label.Label(attack, self.get_attack_start_utime(), self.get_attack_end_utime(),
                            self.total_packets, self.seed, self.current_attack.params, attack_note)
        self.label_mgr.add_labels(label)

        return temp_attack_pcap_path, duration