Python Fundamentals

Hello all,

It's time to take a bit of a tangent and discuss a very readable, maintainable, c based, and large community supported language, Python! Why are we looking into Python? Python is used to write many tools that pen testers/hackers use on a daily basis, such as nmap. It can also be easily invoked in a shell which has many uses.

Recall the first post on buffer overflow attacks? Python can be invoked in gdb (an assembler debugging tool) to execute shell code for a buffer overflow attack:

(gdb) run $(python -c '"\x90" * bytes + "\x31\xc0\x83\xec\x01\x88\x04\x24\x68\x2f\x7a\x73\x68\x68\x2f\x62\x69\x6e\x68\x2f\x75\x73\x72\x89\xe6\x50\x56\xb0\x0b\x89\xf3\x89\xe1\x31\xd2\xcd\x80\xb0\x01\x31\xdb\xcd\x80" + "return_addr" * 10)

Where bytes is the number of bytes required to overwrite a program's return address and return_addr is any address that returns the program into the NOP sled.

Python is powerful! So it is worth while to learn it. Let's create a simple port scanner to look at some of the language features of Python. The program is below:

import socket

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
server = '<server ip or domain name>'

def pscan(port):
    try:
        s.connect((server,port))
        return True
    except:
        return False

for port_num in range(1,65535):
    if pscan(port_num):
        print(port_num,'is open')
    else:
        print(port_num,'is closed')

In the program above, we are importing the socket library which gives us access to the connect and socket functions. We define a pscan function which accepts a port as parameter and tries to connect to the server's address and passed in port number. The for loop at the bottom iterates through all 65,535 ports and if the pscan is able to successfully connect to the port, it will indicate the port is open.

Notice that unlike other languages, python does not require semicolons to terminate lines. Lines are instead terminated by a new line and blocks of code are indicated by 4 spaces which forces indentation. A lot of these concepts are explained by the zen of python which is pep 20 in the python documentation found below:

https://www.python.org/dev/peps/pep-0020/

Another great tutorial channel is Sentdex. The program above was barrowed from him and his citation is below:

sentdex. (2014, Aug 17). Python 3 Programming Tutorial - Sockets simple port scanner. Retrieved From  https://www.youtube.com/watch?v=szm3camsf8k

Comments

Post a Comment

Popular posts from this blog

Covering Your Tracks

The ability to remain stealth during a penetration exercise is what separates a sophisticated hacker from a script kitty. The phrase “The Quieter You Become, The More You Are Able to Hear” holds true, especially in the field of hacking. Being able to perform Ani-forensics and avoid detection is critical to the success of hacking and penetration testing and understanding these methods is beneficial, even for white hat hackers, as there will be times in a penetration where the system is already compromised. In such cases, understanding what the attacker is doing in order to cover their tracks can help determine the sophistication of the attack or bring prosecution to the attacker. All hacks begin with system enumeration and nmap is one of the best tools to use during this discovery phase. However, as I explained in Scanning With nmap blog, port scanning a bunch of IP Addresses or every port on a target system is noisy and can cause denial of service conditions (very bad if you are ...
Read more

LDAP Vulnerabilities

Image
Note** The following examples utilize Web for Penetration Testers which I do not own any rights to. These examples provide solutions to the live image of Web for Pentester 1 which can be downloaded at https://pentesterlab.com/exercises/web_for_pentester/course . Please attempt these exercises on your own before reviewing my solutions to gain maximum benefit.   Web for Penetration Testers Example 1 Lightweight Directory Access Protocol (LDAP) can be thought of as a hierarchical directory structure. Using the live iso of Web for Pentester 1 lab we can find that Open LDAP service is running by running performing a nmap scan from our kali box (attacking machine): Figure 1 Using the ldapsearch command with the -b (base dn [top of hierarchy in this case]) -LLL (print responses in LDIF format without comments or version) and -x (simple authentication) flags (-h specifies the host) from our kali box (see Figure 2), we see that there are three common names (cn) entries: admin, ...
Read more

Setting Up a Proxy to Protect Your Public IP (An Introduction to Proxies)

Image
I recently purchased a static IP address. While this is great for setting up VPNs, websites, and other major benefits it bothered me that I normally visit CTFs and sites that contain malicious code to accomplish these CTF challenges. There had to be a way I could better protect my public IP from direct exposure in the event I did something stupid while surfing the web. This is where a proxies come into play. A proxy is exactly the same thing meant in the English language; think if computer A who set up the proxy wants to talk to computer C. An intermediary could be introduced (Proxy Server B) so that when computer C talks to computer A it has to go through Proxy Server B. Thus Computer C thinks its talking to Proxy Server B and only sees that IP address; when in reality all traffic is getting forwarded to computer A and vise versa. This creates a layer of abstraction. There are many types of proxies such as reverse proxies which is used mainly for public facing web sites. We are strict...
Read more