Skip to content

Commit 6bb9b81

Browse files
OffensivePythonOffensivePython
committed
Update and rename latest to latest/probe.py
1 parent ec85066 commit 6bb9b81

1 file changed

Lines changed: 253 additions & 0 deletions

File tree

‎latest/probe.py‎

Lines changed: 253 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,253 @@
1+
import time
2+
import Queue
3+
import random
4+
import socket
5+
import struct
6+
import logging
7+
import threading
8+
from convert import *
9+
from protocol import ethernet, ip, tcp, udp
10+
11+
ETH_P_IP = 0x0800 # IP protocol
12+
ETH_P_ALL = 0x0003 # Every packet
13+
NSCRIPT_PATH = 'nscript' # NSCRIPT PATH
14+
15+
PAYLOAD = {
16+
53:('\x5d\x0d\x01\x00\x00\x01\x00\x00\x00\x00\x00\x00\x06'
17+
'google\x03com\x00\x00\x01\x00\x01'), # 'google.com' DNS Lookup
18+
161:('\x30\x26\x02\x01\x01\x04\x06public\xa1\x19\x02'
19+
'\x04\x56\x9f\x5a\xdd\x02\x01\x00\x02\x01\x00\x30\x0b\x30\x09\x06'
20+
'\x05\x2b\x06\x01\x02\x01\x05\x00'), # SNMP GetNextRequest|public|2c version|1.3.6.1.2.1
21+
123:('\x17\x00\x02\x05'), # NTP systats commands lacks 38 null bytes (just to save bandwidth)
22+
1900:('M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\n'
23+
'MAN: "ssdp:discover"\r\nMX: 2\r\nST: ssdp:all\r\n\r\n')
24+
}
25+
26+
class Generator(object):
27+
def __init__(self, size):
28+
self.size = size
29+
self.inc = size/4
30+
if self.inc<1:
31+
self.inc = 1
32+
self.base = -self.inc
33+
self.num = self.base
34+
self.index = 0
35+
def __iter__(self):
36+
return self
37+
def next(self):
38+
if (self.num+self.inc)>=self.size:
39+
self.next_index()
40+
self.next_base()
41+
self.num = self.num + self.inc
42+
return self.num
43+
def next_base(self):
44+
self.base = 0
45+
self.base-= self.index
46+
self.num = self.base
47+
def next_index(self):
48+
self.index+=1
49+
if self.index>=self.inc:
50+
raise StopIteration
51+
def suspend(self):
52+
return self.size, self.inc, self.base, self.num, self.index
53+
def resume(self, size, inc, base, num, index):
54+
self.size = size
55+
self.inc = inc
56+
self.base = base
57+
self.num = num
58+
self.index = index
59+
60+
class ScriptEngine(object):
61+
def __init__(self, imports):
62+
self.imports = imports
63+
self.event = threading.Event()
64+
self.queues = {}
65+
self.thread = []
66+
def Load(self):
67+
for script in self.imports:
68+
q = Queue.Queue()
69+
s = __import__('{}.{}'.format(NSCRIPT_PATH, script),
70+
fromlist=[NSCRIPT_PATH])
71+
t = threading.Thread(target=s.run,
72+
args=(q, self.event))
73+
self.thread.append(t)
74+
t.setDaemon(True)
75+
t.start()
76+
self.queues[script] = q
77+
def Feed(self, host, port):
78+
for scr in self.imports:
79+
for r in self.imports[scr]:
80+
if port in xrange(r[0], r[1]):
81+
self.queues[scr].put((host, port))
82+
break
83+
def Cleanup(self):
84+
while Alive(self.thread):
85+
time.sleep(10)
86+
87+
class nscan(object):
88+
def __init__(self, options):
89+
self.options = options
90+
self.hosts = self.split(options.hosts, options.threads)
91+
self.ports = options.ports
92+
self.srcp = random.randint(1, 65535)#self.PickPort() # source port
93+
self.smac = options.smac
94+
self.dmac = options.dmac
95+
self.ifname = options.ifname
96+
self.siface = options.siface
97+
self.diface = options.diface
98+
self.banner = options.banner
99+
self.count = options.count
100+
self.cooldown = options.cooldown
101+
self.queue = Queue.Queue()
102+
if options.stype.upper()=='U':
103+
self.stype = socket.IPPROTO_UDP
104+
else:
105+
self.stype = socket.IPPROTO_TCP
106+
self.events = {
107+
'send': threading.Event(),
108+
'recv': threading.Event()}
109+
self.threads = {
110+
'send': [],
111+
'recv': None}
112+
def __Transport(self, src, dst=0):
113+
if self.stype==socket.IPPROTO_TCP:
114+
transport = tcp.TCP(src, dst)
115+
transport.seqn = 0xDEADC0DE
116+
else:
117+
transport = udp.UDP(src, dst)
118+
return transport
119+
def __Pack(self, transport, src, dst):
120+
if self.stype==socket.IPPROTO_TCP:
121+
transport.payload = ''
122+
else:
123+
transport.payload = PAYLOAD.get(transport.dstp, '\x00\r\n\r\n')
124+
packed = transport.pack(src, dst)
125+
return packed + transport.payload
126+
def __CookieCheck(self, data):
127+
check = False
128+
dstp = struct.unpack('!H', data[22:24])[0]
129+
if self.stype==socket.IPPROTO_UDP:
130+
if dstp==self.srcp:
131+
check = True
132+
else:
133+
ackn = struct.unpack('!L', data[28:32])[0]
134+
flags = struct.unpack('B', data[33])[0] & 0b010010 # SYN-ACK
135+
if dstp==self.srcp and ackn==0xDEADC0DF and flags==18:
136+
check = True
137+
return check
138+
def init(self):
139+
generators = []
140+
for h in self.hosts:
141+
g = Generator(h[1]-h[0])
142+
generators.append(g)
143+
t = threading.Thread(target=self.send, args=(h, self.srcp, g))
144+
t.setDaemon(True)
145+
self.threads['send'].append(t)
146+
t = threading.Thread(target=self.recv)
147+
t.setDaemon(True)
148+
self.threads['recv'] = t
149+
if 'resume' in dir(self.options):
150+
i = 0
151+
for g in generators:
152+
g.resume(*self.options.indexes[i])
153+
i+=1
154+
return self.threads, self.events, self.queue, generators
155+
def run(self):
156+
self.events['send'].set()
157+
self.events['recv'].set()
158+
for t in self.threads['send']:
159+
t.start()
160+
self.threads['recv'].start()
161+
def send(self, hosts, srcp, gen):
162+
if 'ppp' in self.ifname:
163+
family = socket.AF_INET
164+
proto = socket.IPPROTO_RAW
165+
eth = ''
166+
else:
167+
family = socket.AF_PACKET
168+
proto = ETH_P_IP
169+
eth = ethernet.ETHER(mac2byte(self.smac), mac2byte(self.dmac), ETH_P_IP).pack()
170+
sock = socket.socket(family, socket.SOCK_RAW, proto)
171+
transport = self.__Transport(srcp, 0)
172+
npacket = 0
173+
self.events['send'].wait()
174+
target = hosts[0]
175+
while self.events['send'].isSet():
176+
try:
177+
target = hosts[0] + gen.next()
178+
iph = ip.IP(self.diface, dec2dot(target), self.stype)
179+
except StopIteration:
180+
break
181+
for port_list in self.ports:
182+
for port in range(port_list[0], port_list[1]):
183+
if self.events['send'].isSet():
184+
transport.dstp = port
185+
packet = eth + iph.pack() + self.__Pack(transport, iph.src, iph.dst) #tcph.pack(iph.src, iph.dst)
186+
sock.sendto(packet, (dec2dot(target), 0)) # self.ifname
187+
npacket+=1
188+
if not npacket%self.cooldown[0]:
189+
time.sleep(self.cooldown[1])
190+
else:
191+
break
192+
logging.info('[SEND] Sent: {} packets'.format(npacket))
193+
sock.close()
194+
def recv(self):
195+
sock = socket.socket(socket.AF_INET,
196+
socket.SOCK_RAW,
197+
self.stype)
198+
sock.bind(('', self.srcp))
199+
sock.settimeout(5)
200+
self.events['recv'].wait()
201+
counter = 0
202+
while self.events['recv'].isSet():
203+
try:
204+
data, sa_ll = sock.recvfrom(65535)
205+
if self.__CookieCheck(data):
206+
self.queue.put(Extract(data))
207+
counter += 1
208+
if counter==self.count:
209+
self.events['send'].clear()
210+
break
211+
except socket.timeout:
212+
continue
213+
214+
sock.close()
215+
logging.info('[RECV] Received: {} packets'.format(counter))
216+
def split(self, hosts, n):
217+
'''
218+
Split host range into n parts (multithreaded)
219+
'''
220+
nhosts = hosts[1] - hosts[0] # number of hosts
221+
nparts = nhosts/n + 1
222+
host_parts = []
223+
start = hosts[0]
224+
while True:
225+
if len(host_parts)<n-1:
226+
end = start + nparts
227+
host_parts.append((start, end))
228+
start = end
229+
else:
230+
host_parts.append((start, hosts[1]))
231+
break
232+
return host_parts
233+
def PickPort(self):
234+
while True:
235+
srcp = random.randrange(10000, 65535)
236+
if srcp not in self.sport:
237+
self.sport.append(srcp)
238+
break
239+
return srcp
240+
241+
def Extract(packet):
242+
src = socket.inet_ntoa(packet[12:16])
243+
srcp = struct.unpack('!H', packet[20:22])[0]
244+
return src, srcp
245+
246+
def Alive(thread_list):
247+
''' check if thread is alive '''
248+
alive = False
249+
for t in thread_list:
250+
if t.isAlive():
251+
alive = True
252+
break
253+
return alive

0 commit comments

Comments
 (0)