Simple Network Intrussion Prevention System (Ping Flooding Case)

[5ynL0rd]

Code:

#!/usr/bin/python
# Simple Network Intrussion Prevention System
# Sample Case: Ping Flooding
#
# Module Requirement: python-pcapy
# testing on Ubuntu
#
# coded by: 5ynL0rd


import pcapy
import re
import binascii
import os
import json

from datetime import datetime

class VoidSniff:
    def __init__(self, pcap_filter):
         self.device = "any"  
         self.snaplen = 2048    
         self.promisc = 1    
         self.to_ms = 100        
         self.pcap_filter = pcap_filter
         self.max_pkts = -1
         self.p = pcapy.open_live(self.device, self.snaplen, self.promisc, self.to_ms)
        
    def packethandler(self, hdr, data):
         byte = len(data)
         timestamp = datetime.now()
         contain = binascii.b2a_hex(data)
         src_ip = '%s.%s.%s.%s' %(int('0x'+contain[56:58], 0),int('0x'+contain[58:60], 0),int('0x'+contain[60:62], 0),int('0x'+contain[62:64], 0))
         dst_ip = '%s.%s.%s.%s' %(int('0x'+contain[64:66], 0),int('0x'+contain[66:68], 0),int('0x'+contain[68:70], 0),int('0x'+contain[70:72], 0))
         src_port = str(int('0x'+contain[72:76], 0))
         dst_port = str(int('0x'+contain[76:80], 0))
        
         # PING Flooding Detection
         if self.pcap_filter == 'icmp':
             data = [{'ip': src_ip,
                     'timestamp': '%s-%s-%s-%s-%s-%s-%s' % (datetime.utcnow().year,
                                                                datetime.utcnow().month,
                                                                datetime.utcnow().day,
                                                                datetime.utcnow().hour,
                                                                datetime.utcnow().minute,
                                                                datetime.utcnow().second,
                                                                datetime.utcnow().microsecond
                                                                ),
             }]
             data = json.dumps(data)

             try:
                 data_prev = open('dump.json', 'r').read()
             except Exception, err:
                 open('dump.json', 'w').write(data)
             else:
                 data_prev = json.loads(data_prev)
                 data = json.loads(data)
                 data = data_prev + data
                 open('dump.json', 'w').write(json.dumps(data))
                
             try:
                 blacklist = open('blacklist.json', 'r').read()
             except Exception, err:
                 blacklist = []
             else:
                 blacklist = json.loads(blacklist)
                
             data_from_json = open('dump.json','r').read()
             data_from_json = json.loads(data_from_json)
             if len(data_from_json) >= 50 and {'ip': src_ip} not in blacklist:
                 first = data[0]['timestamp']
                 delta = datetime.utcnow() - datetime(int(first.split('-')[0]),
                                                          int(first.split('-')[1]),
                                                          int(first.split('-')[2]),
                                                          int(first.split('-')[3]),
                                                          int(first.split('-')[4]),
                                                          int(first.split('-')[5]),
                                                          int(first.split('-')[6]))
                 if delta.seconds == 0:
                     print '[!] ALERT! PING FLOODING FROM: %s' % src_ip
                     b_data = json.dumps([{'ip':src_ip}])
                     try:
                         b_data_prev = open('blacklist.json', 'r').read()
                     except Exception:
                         pass
                     else:
                         b_data = b_data_prev + b_data
                     open('blacklist.json', 'w').write(b_data)
                     os.system('iptables -A INPUT -s %s -p ICMP --icmp-type 8 -j DROP' % src_ip)
                     print '[!] IP %s Blocked!' % src_ip
                 os.remove('dump.json')

        
    def run(self):
         self.p.setfilter(self.pcap_filter)
         self.p.loop(self.max_pkts, self.packethandler)

if __name__ == '__main__':    
    icmp_sniff = VoidSniff('icmp')
    icmp_sniff.run()

http://void-labs.appspot.com/pastebin?pa...c1081ee9a8

fungsi scriptnya utk auto blocking IP yg melakukan ping flooding (taruh script di PC router)

sudah diuji di OS Ubuntu (jalankan script dengan akses root atau sudo).
modul bantu yg perlu diinstall: python-pcapy
$ sudo apt-get install python-pcapy

semoga berguna dan bisa dikembangkan lebih lanjut, sorry kalo code nya agak kotor & boros.

[chaer.newbie]

baca timeline dc ditwitter. penasaran siapa yg posting, taunya emnag dewa yg posting ,

kalo ping flooding ini berdasarkan jumlah paket apa yang terus menerus om ?

[5ynL0rd]

(04-27-2012 07:48 AM)chaer.newbie Wrote:  baca timeline dc ditwitter. penasaran siapa yg posting, taunya emnag dewa yg posting ,

kalo ping flooding ini berdasarkan jumlah paket apa yang terus menerus om ?

berdasarkan waktu & jumlah paket. saya filternya dari paket ICMP yg masuk dalam waktu tertentu. (kasarnya yg dempet2 per paketnya). tau kan yg dempet2? mepet2.. rapet.. tau donk yg suka rapet2an..
kalo ada bug monggo di post & dibahas bareng2

---

ada bug dari script diatas. masalah dump & load json data dari blacklist.json silahkan dibahas gmn perbaikinya. ada bug juga di preventionnya. Biar ada diskusi programming & lebih hidup :)

---

update codenya:
http://void-labs.appspot.com/pastebin?pa...211a02c7e2

klo mau edit2 rule preventionnya mainin aj iptables command nya.

[ditatompel]

Ane udah coba omz di kompi ane..

Spoiler:

Btw, buat terminate scriptnya gimana yak? Ane coba pake CTRL + C kaga mau omz..
akhirnya ane kill pidnya..

[5ynL0rd]

(04-27-2012 10:27 AM)ditatompel Wrote:  Ane udah coba omz di kompi ane..

Spoiler:

Btw, buat terminate scriptnya gimana yak? Ane coba pake CTRL + C kaga mau omz..
akhirnya ane kill pidnya..

sbnernya pake ctrl+C sih, nunggu ada paket lewat dlu baru ke terminate. nanti ditempatin eksepsinya deh biar langsung. Update dikit codenya:

Code:

#!/usr/bin/python
# Simple Network Intrussion Prevention System
# Sample Case: Ping Flooding
#
# Module Requirement: python-pcapy
# testing on Ubuntu
#
# coded by: 5ynL0rd

import pcapy
import re
import binascii
import os
import subprocess
import sys
import json
import time
import commands

from datetime import datetime
from multiprocessing import Process, Lock

class VoidSniff:
    def __init__(self, pcap_filter):
         self.device = "any"  
         self.snaplen = 2048    
         self.promisc = 1    
         self.to_ms = 100        
         self.pcap_filter = pcap_filter
         self.max_pkts = -1
         self.total_byte_http_downstream = 0
         self.total_byte_http_upstream = 0
         self.p = pcapy.open_live(self.device, self.snaplen, self.promisc, self.to_ms)
        
    def packethandler(self, hdr, data):
         byte = len(data)
         timestamp = datetime.now()
         contain = binascii.b2a_hex(data)
         src_ip = '%s.%s.%s.%s' %(int('0x'+contain[56:58], 0),int('0x'+contain[58:60], 0),int('0x'+contain[60:62], 0),int('0x'+contain[62:64], 0))
         dst_ip = '%s.%s.%s.%s' %(int('0x'+contain[64:66], 0),int('0x'+contain[66:68], 0),int('0x'+contain[68:70], 0),int('0x'+contain[70:72], 0))
         src_port = str(int('0x'+contain[72:76], 0))
         dst_port = str(int('0x'+contain[76:80], 0))
        
         # PING Flooding Detection
         if self.pcap_filter == 'icmp':
             data = [{'ip': src_ip,
                     'timestamp': '%s-%s-%s-%s-%s-%s-%s' % (datetime.utcnow().year,
                                                                datetime.utcnow().month,
                                                                datetime.utcnow().day,
                                                                datetime.utcnow().hour,
                                                                datetime.utcnow().minute,
                                                                datetime.utcnow().second,
                                                                datetime.utcnow().microsecond
                                                                ),
             }]
             data = json.dumps(data)

             try:
                 data_prev = open('dump.json', 'r').read()
             except Exception, err:
                 open('dump.json', 'w').write(data)
             else:
                 data_prev = json.loads(data_prev)
                 data = json.loads(data)
                 data = data_prev + data
                 open('dump.json', 'w').write(json.dumps(data))
                
             try:
                 blacklist = open('blacklist.json', 'r').read()
             except Exception, err:
                 blacklist = []
             else:
                 blacklist = json.loads(blacklist)
                
             data_from_json = open('dump.json','r').read()
             data_from_json = json.loads(data_from_json)
             if len(data_from_json) >= 50 and {'ip': src_ip} not in blacklist:
                 first = data[0]['timestamp']
                 delta = datetime.utcnow() - datetime(int(first.split('-')[0]),
                                                          int(first.split('-')[1]),
                                                          int(first.split('-')[2]),
                                                          int(first.split('-')[3]),
                                                          int(first.split('-')[4]),
                                                          int(first.split('-')[5]),
                                                          int(first.split('-')[6]))
                 if delta.seconds == 0 and src_ip not in protect_ip:
                     print '[!] ALERT! PING FLOODING FROM: %s' % src_ip
                     b_data = json.dumps([{'ip':src_ip}])
                     try:
                         b_data_prev = open('blacklist.json', 'r').read()
                     except Exception:
                         pass
                     else:
                         b_data = json.loads(b_data_prev) + json.loads(b_data)
                         b_data = json.dumps(b_data)
                     open('blacklist.json', 'w').write(b_data)
                     os.system('iptables -A FORWARD -s %s -p icmp -j DROP' % src_ip)
                     #os.system('iptables -A OUTPUT -s %s -p icmp -j DROP' % src_ip)
                     print '[!] IP %s:%s Blocked!: dest %s:%s' % (src_ip, src_port, dst_ip, dst_port)
                 os.remove('dump.json')
         #print 'src_ip -> %s:%s\ndest_ip -> %s:%s\n' % (src_ip, src_port, dst_ip, dst_port)
        
    def run(self):
         print '[+] Thread %s start' % self.pcap_filter
         self.p.setfilter(self.pcap_filter)
         self.p.loop(self.max_pkts, self.packethandler)

if __name__ == '__main__':
    PROJECT_PATH = os.path.abspath(os.path.dirname(__file__))
    
    dev_list = pcapy.findalldevs()
    protect_ip = []
    for i in dev_list:
        x = commands.getoutput('ifconfig %s | grep "inet addr"' % i)
        if re.search(r'inet addr:([0-9\.]+)', x):
            protect_ip.append(re.search(r'inet addr:([0-9\.]+)', x).groups()[0])
  
    gateway_ip = commands.getoutput('route | grep default')
    protect_ip.append(re.search(r'default[ ]+([0-9\.]+) ', gateway_ip).groups()[0])
    tcp_sniff = VoidSniff('tcp')
    icmp_sniff = VoidSniff('icmp')
    tcp_run = Process(target=tcp_sniff.run)
    icmp_run = Process(target=icmp_sniff.run)
    
    tcp_run.start()
    icmp_run.start()
    open(os.path.join(PROJECT_PATH, 'pid.txt'), 'w').write('%s:%s' %(tcp_run.pid, icmp_run.pid))

ada project kecil2an kbneran jadi di update2 codenya. tapi casenya ga bisa blocking diri sendiri atau gatewaynya & posisi script jalan di router. yg di blocking client2nya..

repos publicnya kalo mau ngikutin ada disini:
https://bitbucket.org/synl0rd/bams

[ditatompel]

(04-27-2012 10:37 AM)5ynL0rd Wrote:  

(04-27-2012 10:27 AM)ditatompel Wrote:  Ane udah coba omz di kompi ane..

Spoiler:

Btw, buat terminate scriptnya gimana yak? Ane coba pake CTRL + C kaga mau omz..
akhirnya ane kill pidnya..

sbnernya pake ctrl+C sih, nunggu ada paket lewat dlu baru ke terminate. nanti ditempatin eksepsinya deh biar langsung. Update dikit codenya:

Code:

#!/usr/bin/python
# Simple Network Intrussion Prevention System
# Sample Case: Ping Flooding
#
# Module Requirement: python-pcapy
# testing on Ubuntu
#
# coded by: 5ynL0rd

import pcapy
import re
import binascii
import os
import subprocess
import sys
import json
import time
import commands

from datetime import datetime
from multiprocessing import Process, Lock

class VoidSniff:
    def __init__(self, pcap_filter):
         self.device = "any"  
         self.snaplen = 2048    
         self.promisc = 1    
         self.to_ms = 100        
         self.pcap_filter = pcap_filter
         self.max_pkts = -1
         self.total_byte_http_downstream = 0
         self.total_byte_http_upstream = 0
         self.p = pcapy.open_live(self.device, self.snaplen, self.promisc, self.to_ms)
        
    def packethandler(self, hdr, data):
         byte = len(data)
         timestamp = datetime.now()
         contain = binascii.b2a_hex(data)
         src_ip = '%s.%s.%s.%s' %(int('0x'+contain[56:58], 0),int('0x'+contain[58:60], 0),int('0x'+contain[60:62], 0),int('0x'+contain[62:64], 0))
         dst_ip = '%s.%s.%s.%s' %(int('0x'+contain[64:66], 0),int('0x'+contain[66:68], 0),int('0x'+contain[68:70], 0),int('0x'+contain[70:72], 0))
         src_port = str(int('0x'+contain[72:76], 0))
         dst_port = str(int('0x'+contain[76:80], 0))
        
         # PING Flooding Detection
         if self.pcap_filter == 'icmp':
             data = [{'ip': src_ip,
                     'timestamp': '%s-%s-%s-%s-%s-%s-%s' % (datetime.utcnow().year,
                                                                datetime.utcnow().month,
                                                                datetime.utcnow().day,
                                                                datetime.utcnow().hour,
                                                                datetime.utcnow().minute,
                                                                datetime.utcnow().second,
                                                                datetime.utcnow().microsecond
                                                                ),
             }]
             data = json.dumps(data)

             try:
                 data_prev = open('dump.json', 'r').read()
             except Exception, err:
                 open('dump.json', 'w').write(data)
             else:
                 data_prev = json.loads(data_prev)
                 data = json.loads(data)
                 data = data_prev + data
                 open('dump.json', 'w').write(json.dumps(data))
                
             try:
                 blacklist = open('blacklist.json', 'r').read()
             except Exception, err:
                 blacklist = []
             else:
                 blacklist = json.loads(blacklist)
                
             data_from_json = open('dump.json','r').read()
             data_from_json = json.loads(data_from_json)
             if len(data_from_json) >= 50 and {'ip': src_ip} not in blacklist:
                 first = data[0]['timestamp']
                 delta = datetime.utcnow() - datetime(int(first.split('-')[0]),
                                                          int(first.split('-')[1]),
                                                          int(first.split('-')[2]),
                                                          int(first.split('-')[3]),
                                                          int(first.split('-')[4]),
                                                          int(first.split('-')[5]),
                                                          int(first.split('-')[6]))
                 if delta.seconds == 0 and src_ip not in protect_ip:
                     print '[!] ALERT! PING FLOODING FROM: %s' % src_ip
                     b_data = json.dumps([{'ip':src_ip}])
                     try:
                         b_data_prev = open('blacklist.json', 'r').read()
                     except Exception:
                         pass
                     else:
                         b_data = json.loads(b_data_prev) + json.loads(b_data)
                         b_data = json.dumps(b_data)
                     open('blacklist.json', 'w').write(b_data)
                     os.system('iptables -A FORWARD -s %s -p icmp -j DROP' % src_ip)
                     #os.system('iptables -A OUTPUT -s %s -p icmp -j DROP' % src_ip)
                     print '[!] IP %s:%s Blocked!: dest %s:%s' % (src_ip, src_port, dst_ip, dst_port)
                 os.remove('dump.json')
         #print 'src_ip -> %s:%s\ndest_ip -> %s:%s\n' % (src_ip, src_port, dst_ip, dst_port)
        
    def run(self):
         print '[+] Thread %s start' % self.pcap_filter
         self.p.setfilter(self.pcap_filter)
         self.p.loop(self.max_pkts, self.packethandler)

if __name__ == '__main__':
    PROJECT_PATH = os.path.abspath(os.path.dirname(__file__))
    
    dev_list = pcapy.findalldevs()
    protect_ip = []
    for i in dev_list:
        x = commands.getoutput('ifconfig %s | grep "inet addr"' % i)
        if re.search(r'inet addr:([0-9\.]+)', x):
            protect_ip.append(re.search(r'inet addr:([0-9\.]+)', x).groups()[0])
  
    gateway_ip = commands.getoutput('route | grep default')
    protect_ip.append(re.search(r'default[ ]+([0-9\.]+) ', gateway_ip).groups()[0])
    tcp_sniff = VoidSniff('tcp')
    icmp_sniff = VoidSniff('icmp')
    tcp_run = Process(target=tcp_sniff.run)
    icmp_run = Process(target=icmp_sniff.run)
    
    tcp_run.start()
    icmp_run.start()
    open(os.path.join(PROJECT_PATH, 'pid.txt'), 'w').write('%s:%s' %(tcp_run.pid, icmp_run.pid))

ada project kecil2an kbneran jadi di update2 codenya. tapi casenya ga bisa blocking diri sendiri atau gatewaynya & posisi script jalan di router. yg di blocking client2nya..

repos publicnya kalo mau ngikutin ada disini:
https://bitbucket.org/synl0rd/bams

Owh gitu ya...
Jd dia ambil whitelist ip dan gatewaynya dari ifconfig ya?
Ane pelajari dulu omz...

Spoiler:

di bangku hidupku cuma ada kamu

[tabun]

keren, ane ambil buat belajar..

[5ynL0rd]

yup ngambil ip dlu ceritanya sih, biar ga blocking diri sendiri atau gatewaynya. rencananya mau jadi service yg sediain rest utk bisa diambil informasinya dari luar.

besok jadi kan kita ke mandi bareng?

[mariachi]

saya udah nyoba om

ane bikin report sederhana dari file json nya biar gampang liatnya

Spoiler for: Simple Report

tapi lumayan makan resource cpu yah processnya om

[5ynL0rd]

iya om soalnya read write file plus arraynya dijumlah2.. berat pasti tanpa db engine. mungkin diganti ke db engine berbentuk file semodel sqlite atau Berkeley DB (bsddb). reposnya blm diupdate lagi kerjaan masih numpuk :)