Add support for forge frames and send them. #954
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jjnicola
force-pushed
the
frame-forgery
branch
from
f088028
to
081baa5
Compare
jjnicola
force-pushed
the
frame-forgery
branch
from
9e6867b
to
26594e4
Compare
2 tasks
Kraemii
reviewed
Nov 23, 2021
Kraemii
reviewed
Nov 23, 2021
This functions allows to get the interface's ID where a frame will be sent through, depending on the target's IP
It receives now a new int parameter to tell the function to return the frame only or to include the payload. It returns now a char * instead of a struct ether_header.
…nd prepares the socket for captures
Example usage:
Run the following script with openvas-nasl
```
if(description) {
script_oid("1.2.3");
exit(0);
}
include("misc_func.inc");
myhost = this_host();
port = 22022;
srcport= 35000;
dstip = get_host_ip();
src_mac = raw_string (0x08, 0x00, 0x27, 0x8f, 0x69, 0xbb); # get_local_mac_address_from_ip can be used
dst_mac = raw_string (0x54, 0xe1, 0xad, 0xd4, 0xed, 0x74); # send_arp_request() can be used
ether_proto = 0x0800;
filter = string("ether dst ", hexstr(dst_mac), " and src port ", 35000);
ip = forge_ip_packet(ip_v : 4,
ip_hl : 5,
ip_tos : 0,
ip_len : 20,
ip_id : rand(),
ip_p : IPPROTO_TCP,
ip_ttl : 255,
ip_off : 0,
ip_src : myhost,
ip_dst: dstip);
display (IPPROTO_TCP);
tcp = forge_tcp_packet(ip : ip,
th_ack : 0,
th_dport : port,
th_flags : TH_SYN,
#th_seq : tcp_seq + 1024,
th_sport : srcport,
th_x2 : 0,
th_off : 5,
th_win : 1024,
th_urp : 0,
data: "hola mundo");
frame = forge_frame (src_haddr: src_mac, dst_haddr: dst_mac, ether_proto: ether_proto, payload: tcp);
f = send_frame (frame: frame, pcap_filter: filter, timeout: 10);
dump_frame (frame:f);
```
jjnicola
force-pushed
the
frame-forgery
branch
from
b38b927
to
5c4c45f
Compare
Kraemii
approved these changes
Nov 25, 2021
y0urself
approved these changes
Nov 25, 2021
mergify bot
pushed a commit
that referenced
this pull request
Nov 25, 2021
* Add function get_iface_index()
This functions allows to get the interface's ID where a frame will be sent through, depending on the target's IP
* Extend capture_next_frame() with a new param.
It receives now a new int parameter to tell the function to return the frame only or to include the payload.
It returns now a char * instead of a struct ether_header.
* Add struct pseudo_frame
* Add function to forge a frame
* Add function to prepare a message which includes a frame as payload and prepares the socket for captures
* Add function to dump a frame
* Make new functions visibles
Example usage:
Run the following script with openvas-nasl
```
if(description) {
script_oid("1.2.3");
exit(0);
}
include("misc_func.inc");
myhost = this_host();
port = 22022;
srcport= 35000;
dstip = get_host_ip();
src_mac = raw_string (0x08, 0x00, 0x27, 0x8f, 0x69, 0xbb); # get_local_mac_address_from_ip can be used
dst_mac = raw_string (0x54, 0xe1, 0xad, 0xd4, 0xed, 0x74); # send_arp_request() can be used
ether_proto = 0x0800;
filter = string("ether dst ", hexstr(dst_mac), " and src port ", 35000);
ip = forge_ip_packet(ip_v : 4,
ip_hl : 5,
ip_tos : 0,
ip_len : 20,
ip_id : rand(),
ip_p : IPPROTO_TCP,
ip_ttl : 255,
ip_off : 0,
ip_src : myhost,
ip_dst: dstip);
display (IPPROTO_TCP);
tcp = forge_tcp_packet(ip : ip,
th_ack : 0,
th_dport : port,
th_flags : TH_SYN,
#th_seq : tcp_seq + 1024,
th_sport : srcport,
th_x2 : 0,
th_off : 5,
th_win : 1024,
th_urp : 0,
data: "hola mundo");
frame = forge_frame (src_haddr: src_mac, dst_haddr: dst_mac, ether_proto: ether_proto, payload: tcp);
f = send_frame (frame: frame, pcap_filter: filter, timeout: 10);
dump_frame (frame:f);
```
* Fix invalid read/write reported by valgrind
(cherry picked from commit 2550b26)
jjnicola
added a commit
that referenced
this pull request
Nov 26, 2021
* Add function get_iface_index()
This functions allows to get the interface's ID where a frame will be sent through, depending on the target's IP
* Extend capture_next_frame() with a new param.
It receives now a new int parameter to tell the function to return the frame only or to include the payload.
It returns now a char * instead of a struct ether_header.
* Add struct pseudo_frame
* Add function to forge a frame
* Add function to prepare a message which includes a frame as payload and prepares the socket for captures
* Add function to dump a frame
* Make new functions visibles
Example usage:
Run the following script with openvas-nasl
```
if(description) {
script_oid("1.2.3");
exit(0);
}
include("misc_func.inc");
myhost = this_host();
port = 22022;
srcport= 35000;
dstip = get_host_ip();
src_mac = raw_string (0x08, 0x00, 0x27, 0x8f, 0x69, 0xbb); # get_local_mac_address_from_ip can be used
dst_mac = raw_string (0x54, 0xe1, 0xad, 0xd4, 0xed, 0x74); # send_arp_request() can be used
ether_proto = 0x0800;
filter = string("ether dst ", hexstr(dst_mac), " and src port ", 35000);
ip = forge_ip_packet(ip_v : 4,
ip_hl : 5,
ip_tos : 0,
ip_len : 20,
ip_id : rand(),
ip_p : IPPROTO_TCP,
ip_ttl : 255,
ip_off : 0,
ip_src : myhost,
ip_dst: dstip);
display (IPPROTO_TCP);
tcp = forge_tcp_packet(ip : ip,
th_ack : 0,
th_dport : port,
th_flags : TH_SYN,
#th_seq : tcp_seq + 1024,
th_sport : srcport,
th_x2 : 0,
th_off : 5,
th_win : 1024,
th_urp : 0,
data: "hola mundo");
frame = forge_frame (src_haddr: src_mac, dst_haddr: dst_mac, ether_proto: ether_proto, payload: tcp);
f = send_frame (frame: frame, pcap_filter: filter, timeout: 10);
dump_frame (frame:f);
```
* Fix invalid read/write reported by valgrind
(cherry picked from commit 2550b26)
Co-authored-by: Juan José Nicola <jjnicola@gmail.com>
mergify bot
pushed a commit
that referenced
this pull request
Nov 29, 2021
* Add function get_iface_index()
This functions allows to get the interface's ID where a frame will be sent through, depending on the target's IP
* Extend capture_next_frame() with a new param.
It receives now a new int parameter to tell the function to return the frame only or to include the payload.
It returns now a char * instead of a struct ether_header.
* Add struct pseudo_frame
* Add function to forge a frame
* Add function to prepare a message which includes a frame as payload and prepares the socket for captures
* Add function to dump a frame
* Make new functions visibles
Example usage:
Run the following script with openvas-nasl
```
if(description) {
script_oid("1.2.3");
exit(0);
}
include("misc_func.inc");
myhost = this_host();
port = 22022;
srcport= 35000;
dstip = get_host_ip();
src_mac = raw_string (0x08, 0x00, 0x27, 0x8f, 0x69, 0xbb); # get_local_mac_address_from_ip can be used
dst_mac = raw_string (0x54, 0xe1, 0xad, 0xd4, 0xed, 0x74); # send_arp_request() can be used
ether_proto = 0x0800;
filter = string("ether dst ", hexstr(dst_mac), " and src port ", 35000);
ip = forge_ip_packet(ip_v : 4,
ip_hl : 5,
ip_tos : 0,
ip_len : 20,
ip_id : rand(),
ip_p : IPPROTO_TCP,
ip_ttl : 255,
ip_off : 0,
ip_src : myhost,
ip_dst: dstip);
display (IPPROTO_TCP);
tcp = forge_tcp_packet(ip : ip,
th_ack : 0,
th_dport : port,
th_flags : TH_SYN,
#th_seq : tcp_seq + 1024,
th_sport : srcport,
th_x2 : 0,
th_off : 5,
th_win : 1024,
th_urp : 0,
data: "hola mundo");
frame = forge_frame (src_haddr: src_mac, dst_haddr: dst_mac, ether_proto: ether_proto, payload: tcp);
f = send_frame (frame: frame, pcap_filter: filter, timeout: 10);
dump_frame (frame:f);
```
* Fix invalid read/write reported by valgrind
(cherry picked from commit 2550b26)
jjnicola
added a commit
that referenced
this pull request
Nov 29, 2021
* Add function get_iface_index()
This functions allows to get the interface's ID where a frame will be sent through, depending on the target's IP
* Extend capture_next_frame() with a new param.
It receives now a new int parameter to tell the function to return the frame only or to include the payload.
It returns now a char * instead of a struct ether_header.
* Add struct pseudo_frame
* Add function to forge a frame
* Add function to prepare a message which includes a frame as payload and prepares the socket for captures
* Add function to dump a frame
* Make new functions visibles
Example usage:
Run the following script with openvas-nasl
```
if(description) {
script_oid("1.2.3");
exit(0);
}
include("misc_func.inc");
myhost = this_host();
port = 22022;
srcport= 35000;
dstip = get_host_ip();
src_mac = raw_string (0x08, 0x00, 0x27, 0x8f, 0x69, 0xbb); # get_local_mac_address_from_ip can be used
dst_mac = raw_string (0x54, 0xe1, 0xad, 0xd4, 0xed, 0x74); # send_arp_request() can be used
ether_proto = 0x0800;
filter = string("ether dst ", hexstr(dst_mac), " and src port ", 35000);
ip = forge_ip_packet(ip_v : 4,
ip_hl : 5,
ip_tos : 0,
ip_len : 20,
ip_id : rand(),
ip_p : IPPROTO_TCP,
ip_ttl : 255,
ip_off : 0,
ip_src : myhost,
ip_dst: dstip);
display (IPPROTO_TCP);
tcp = forge_tcp_packet(ip : ip,
th_ack : 0,
th_dport : port,
th_flags : TH_SYN,
#th_seq : tcp_seq + 1024,
th_sport : srcport,
th_x2 : 0,
th_off : 5,
th_win : 1024,
th_urp : 0,
data: "hola mundo");
frame = forge_frame (src_haddr: src_mac, dst_haddr: dst_mac, ether_proto: ether_proto, payload: tcp);
f = send_frame (frame: frame, pcap_filter: filter, timeout: 10);
dump_frame (frame:f);
```
* Fix invalid read/write reported by valgrind
(cherry picked from commit 2550b26)
Co-authored-by: Juan José Nicola <jjnicola@gmail.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What:
Add support for forge frames and send them
Jira: SC-383
Why:
New feature
How:
Example usage:
Run the following script with openvas-nasl
If you want to try something at lower level, you can try the following script, which sends an arp request as raw string, without need to forge the frame. Just be sure to use the right local MAC address and ip address (in the example, 0x08, 0x00, 0x27, 0x8f, 0x69, 0xbb and 0xc0, 0xa8, 0x00, 0x01 , respectively )
Checklist: