Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use port 0 as wildcard #7

Merged
merged 2 commits into from Feb 28, 2018
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
3 changes: 2 additions & 1 deletion Dockerfile
@@ -1,7 +1,8 @@
FROM rust:latest
WORKDIR /usr/src/rshijack
COPY . .
RUN cargo build --release --verbose
RUN cargo build --release --verbose \
&& strip target/release/rshijack
FROM busybox:1-glibc
COPY --from=0 /usr/src/rshijack/target/release/rshijack /usr/local/bin/rshijack
COPY --from=0 /lib/x86_64-linux-gnu/libdl.so.2 \
Expand Down
19 changes: 6 additions & 13 deletions src/main.rs
Expand Up @@ -44,16 +44,13 @@ fn run() -> Result<()> {
println!("Waiting for SEQ/ACK to arrive from the srcip to the dstip.");
println!("(To speed things up, try making some traffic between the two, /msg person asdf)");

let (mut seq, ack, offset) = net::getseqack(&arguments.interface, &arguments.src, &arguments.dst)?;
println!("[+] Got packet! SEQ = 0x{:x}, ACK = 0x{:x}", seq, ack);
let mut connection = net::getseqack(&arguments.interface, &arguments.src, &arguments.dst)?;
println!("[+] Got packet! SEQ = 0x{:x}, ACK = 0x{:x}", connection.seq, connection.ack);

let (mut tx, _rx) = net::create_socket()?;

// bump seq
seq += offset as u32;

if arguments.reset {
net::sendtcp(&mut tx, &arguments.src, &arguments.dst, TcpFlags::RST, seq, 0, &[])?;
connection.reset(&mut tx)?;
println!("[+] Connection has been reset");
return Ok(());
}
Expand All @@ -62,8 +59,7 @@ fn run() -> Result<()> {
info!("Sending 1kb of null bytes to prevent desync");

let data = vec![0; 1024];
net::sendtcp(&mut tx, &arguments.src, &arguments.dst, TcpFlags::ACK | TcpFlags::PSH, seq, ack, &data)?;
seq += data.len() as u32;
connection.sendtcp(&mut tx, TcpFlags::ACK | TcpFlags::PSH, &data)?;
}

println!("Starting hijack session, Please use ^D to terminate.");
Expand All @@ -78,13 +74,10 @@ fn run() -> Result<()> {
break;
}

net::sendtcp(&mut tx, &arguments.src, &arguments.dst, TcpFlags::ACK | TcpFlags::PSH, seq, ack, &data[..len])?;

// bump seq afterwards
seq += len as u32;
connection.sendtcp(&mut tx, TcpFlags::ACK | TcpFlags::PSH, &data[..len])?;
}

net::sendtcp(&mut tx, &arguments.src, &arguments.dst, TcpFlags::ACK | TcpFlags::FIN, seq, ack, &[])?;
connection.sendtcp(&mut tx, TcpFlags::ACK | TcpFlags::FIN, &[])?;
println!("Exiting..");

Ok(())
Expand Down
45 changes: 39 additions & 6 deletions src/net.rs
Expand Up @@ -20,7 +20,39 @@ use std::net::SocketAddrV4;
use errors::{Result, ResultExt};


pub fn getseqack(interface: &str, src: &SocketAddrV4, dst: &SocketAddrV4) -> Result<(u32, u32, usize)> {
#[derive(Debug)]
pub struct Connection {
pub src: SocketAddrV4,
pub dst: SocketAddrV4,
pub seq: u32,
pub ack: u32,
}

impl Connection {
#[inline]
pub fn new(src: SocketAddrV4, dst: SocketAddrV4, seq: u32, ack: u32) -> Connection {
Connection {
src,
dst,
seq,
ack,
}
}

#[inline]
pub fn sendtcp(&mut self, tx: &mut TransportSender, flags: u16, data: &[u8]) -> Result<()> {
sendtcp(tx, &self.src, &self.dst, flags, self.seq, self.ack, &data)?;
self.seq += data.len() as u32;
Ok(())
}

#[inline]
pub fn reset(&mut self, tx: &mut TransportSender) -> Result<()> {
sendtcp(tx, &self.src, &self.dst, TcpFlags::RST, self.seq, 0, &[])
}
}

pub fn getseqack(interface: &str, src: &SocketAddrV4, dst: &SocketAddrV4) -> Result<Connection> {
let interfaces = datalink::interfaces();
let interface = interfaces.into_iter()
.filter(|iface: &NetworkInterface| iface.name == interface)
Expand Down Expand Up @@ -57,8 +89,8 @@ pub fn getseqack(interface: &str, src: &SocketAddrV4, dst: &SocketAddrV4) -> Res
debug!("tcp: {:?}", tcp_hdr);

// skip packet if src/dst port doesn't match
if src.port() != tcp_hdr.source_port ||
dst.port() != tcp_hdr.dest_port {
if (src.port() != tcp_hdr.source_port && src.port() != 0) ||
(dst.port() != tcp_hdr.dest_port && dst.port() != 0) {
continue;
}

Expand All @@ -67,10 +99,11 @@ pub fn getseqack(interface: &str, src: &SocketAddrV4, dst: &SocketAddrV4) -> Res
continue;
}

return Ok((
tcp_hdr.sequence_no,
return Ok(Connection::new(
SocketAddrV4::new(ip_hdr.source_addr, tcp_hdr.source_port),
SocketAddrV4::new(ip_hdr.dest_addr, tcp_hdr.dest_port),
tcp_hdr.sequence_no + remaining.len() as u32,
tcp_hdr.ack_no,
remaining.len(),
));
}
},
Expand Down