With this section,
we will take a look at one method of implementing a
connection hijacking utility.
As noted in the previous section,
this script is written to monitor for FTP sessions and to terminate
them as soon as it detects a successful login.
This trigger could also be written to look out for
any number of different messages, but in this case,
we have chosen this one.
Now let's move into the demonstration environment and see how
this connection hijacking utility works.
We'll see at the very beginning of our script,
again, we import in all of the different Scapy modules with scapy.all import *.
And again,
we will start this script at the bottom where we have main being
called and then here is the main function.
For the purposes of this review,
we will not be covering the StateTracking aspect here because it's something
I just sort of stuck in there as a bonus and it's not necessarily required
for our purposes in showing a connection hijack.
Next we have a couple of different global variables that we define,
and then under that, we have a little monitoring for traffic,
which just gives us something on the screen whenever we first run
the script so we know something is happening.
And then the main logic here is held within this try and the try
is just Python's version of exception handling.
So in this case,
we're going to make sure that there is a soft out of the program should
you break out which is required as currently written.
Now, what we're doing with this script,
instead of what we're doing in the previous ones where we were taking an
existing capture and loading all the packets in from that capture and
then assessing the packets that we pulled in,
in this case, we're actually performing live capture in the background,
and the function that we're going to show here in a minute is actually
run for every single packet that it texts on the wire.
So in this case, we utilize the prn parameter of the sniff command,
and what this does is it will automatically run the
MonitorTraffic function for each one of these packets.
And we also see that there is a filter on here which says
only pay attention to TCP traffic port 21.
Now let's move up here to the function at hand.
Okay, in large chunks, this piece of the logic,
all it does is it actually gives us a consistent key format that we can use.
So it's going to stick the IP address of the source and the destination
into a consistent format so we can track it easier.
And in this case,
what we're going to be using it for if we're not paying attention to
state tracking is we're going to be using it to maintain a termination
dictionary which keeps track of all of the different connections that
we are terminating with this program and it ensures that those
connections stay terminated.
The second piece right here,
what this is for is one of the things we noticed when we were developing
this program is sometimes the remote device terminates on the first packet
that we send it telling it to reset the connection and sometimes it's still
throwing additional packets to us.
So even though we detected a packet that we want to terminate from,
sometimes if it's continuing to throw traffic at us as we're detecting it,
it does not pay attention to the initial termination packet and
that termination packet needs to be repeated.
So in this case,
this is the part of the logic which just checks to see if a specific key entry,
which is that client and server thing that we've just
covered in the previous little code module,
is within the current termination dictionary,
and if it is and it's matching the current packet that we've captured in,
then it says it will automatically just terminate it again.
This piece of logic, for the moment,
you can completely ignore because that's part of state tracking
which were not paying attention to for this.
And then we get into the main detection part of this specific
function and what this is doing if you take a look at it is it's
checking to see if the packet has a raw layer.
So why would it do that?
Well,
all of the different commands within FTP would exist within
the raw layer from Scapy's perspective, it's within the raw layer after TCP.
So if it doesn't have a raw layer,
it's not going to have any commands associated with it and
the function can basically not pay attention to it at all and
it can drop out of the function.
If it has a raw layer,
then what it's going to do is it's going to check
and see if that raw layers load,
which is the the information that's inside the that payload,
contains 230.
And if we remember from our previous module,
the 230 is a login successful message.
And if we detect that, automatically run the TerminateSession function,
and if we see here lower on the screen here,
the TerminateSession function is down here and what it does is it just
builds a packet based on the TCP information that it's gotten from the
packet that we're supposed to terminate.
It pulls in the sequence numbers, it pulls in the acknowledgement numbers,
and it makes sure that that information is consistent
with what the remote device expects.
Then we build a packet from that information and then we
send that packet off to that remote device,
so in this case, it's the remote server.
All we're doing, if we move in here a little bit closer,
is we're going to be setting the TCP reset flag.
So in this case,
all we're doing is we're taking whatever packet that comes in and we're saying,
okay, we're going to kick this back out to that server with a reset flag.
So basically,
we're just trying to force a reset on that connection as we go through.
Now once that function returns,
it's going to perform this part of this code block.
And what this does is it adds that specific key
entry to the termination dictionary,
and what that's for is that's supposed to catch if a specific
connection did not terminate correctly as we expected it and say
the next packet or three packets from now,
it sees traffic coming in with that same ephemeral matching port number,
matching source and destination number, then it will automatically say,
well hold on, we tried to terminate that before,
it should already be terminated and it will
redirect it to the terminate session, so it'll resend that terminate packet.
And then the last part of this function is this here,
which is basically just for debugging.
If you have debugging enabled,
it's going to print out additional information to the screen.
One, the TerminateSession function is going to print out terminating sessions,
so every time it sends that terminate packet out,
it's going to say that.
And then this code block,
what it basically does is it gives you a little bit more
information about what the key is, what the ephemeral port number is,
the current flags, and then if it has a raw part of the packet,
it will print that off to the screen.
So with that covered, we can go ahead and run this,
and the first thing we're going to notice,
and if we we may have noted it from earlier modules,
since we're using the sniff command, in this case,
the sniff command requires you to have a root access or administrative
access depending on what operating system you're using.
In this case,
I'm using Linux so I need root access to allow me to
capture the packets were all off the wire.
So in this case, I left debugging enabled.
So if I take my device here,
and I'm just on the local system and there is a remote FTP server,
if I try to FTP into that remote server,
you're going to see on the screen in the background
here the packets that came through.
So in this case,
the source and destination IP addresses are shown so from 101‑102.
The ephemeral port is 55328, and on that first entry,
it shows the syn,
and then the second one is a syn ack and an ack and then a psh ack.
So the psh ack specifically has more information in that that's listed
with a b with little single quotes and what that is,
it's the raw layer that we were talking about and it's part of the
information that we're getting back from the server.
So if we enter a username in here, we'll see that we sent out that user kali,
we got returned from the server the 331 Please specify your password.
Now as soon as I hit Enter here,
the server is going to okay me because this is the correct password,
and you're going to see a whole bunch additional output which
shows it trying to terminate that connection.
So what's the net effect here?
It looks like we're still connected.
If we try to list a file, however,
it sees that the remote server has closed the connection.
If I try to do that again, it looks the same here,
so it doesn't give you a chance to do anything before it
terminates that connection on the server.
So effectively, we're hijacking that connection,
somebody is trying to use FTP, and we're detecting that,
and we are automatically sending a reset to that
server based on a successful login.
So that finishes up this demonstration of our connection hijack
utility, and now we're going to move into our summary.