exploit15.py

import os
import ipaddress
import requests
requests.packages.urllib3.disable_warnings()
import json
import time
import eventlet
import subprocess
import signal
import sys
import numpy as np


def portscan():
    ping_list = ["redis.demo.svc.cluster.local"]
    for n in range(1):
      for svc in ping_list:
        os.system("nmap -p- -O {0}".format(svc))
      time.sleep(1)


def portscan_lite():
    ping_list = ["node.demo.svc.cluster.local", "redis.demo.svc.cluster.local"]
    for svc in ping_list:
        os.system("nmap {0}".format(svc))



def ping_of_death():
    ping_list = ["node.demo.svc.cluster.local"]
    for n in range(2):
      for svc in ping_list:
        os.system("ping {} -c 2  -s 40000".format(svc))

def getaddr():
    while True:
      try:
        ipaddr = input('What is the IP of the SQL container: ')
        ipaddress.ip_address(ipaddr)
      except ValueError:
        print("inavlid IP address format:")
        continue
      else:
        return(ipaddr)

def get_neuvector_token(username,password,controller_ip):
    url = "https://"+ controller_ip+":10443/v1/auth"
    #url = "https://neuvector-svc-controller.neuvector.svc.cluster.local:10443/v1/auth"
    payload = {"password" : {"username" : username, "password" : password}}
    headers = {'content-type': 'application/json'}
    r = requests.post(url, data=json.dumps(payload), headers=headers, verify=False)
    return (r)


def neuvector_credentials():
          username = input("What is Neuvector username: ")
          password = input("What is Neuvector password: ")
          ipaddr = input("what is the IP Address of Selected Controller: ")
          return {"username": username, "password": password, "controller_ip": ipaddr}


def https_google():
    results = os.system("curl https://www.google.com > /tmp/test")
    return (results)

def http_google():
    results = os.system("curl http://www.google.com > /tmp/test")
    return (results)


def change_mode_monitor(token, controller_ip):
    done =0
    retries = 5
    url = "https://"+controller_ip+":10443/v1/service/config"
    #url = "https://neuvector-svc-controller.neuvector.svc.cluster.local:10443/v1/service/config"
    payload = {"config": {"services": ["exploit.demo", "node-pod.demo","redis-pod.demo", "nginx-pod.demo"], "policy_mode": "Monitor"}}
    headers = {'X-Auth-Token': token}
    while done  < retries:
            r = requests.patch(url, data=json.dumps(payload), headers=headers, verify=False)
            if r.status_code == 200:
                return(r)
                break
            else:
                print(r.status_code)
                print ("try #{}".format(done))
                done += 1
    return(r)

def change_mode_protect(token, controller_ip):
    done =0
    retries = 5
    url = "https://"+controller_ip+":10443/v1/service/config"
    #url = "https://neuvector-svc-controller.neuvector.svc.cluster.local:10443/v1/service/config"
    payload = {"config": {"services": ["exploit.demo", "node-pod.demo", "redis-pod.demo", "nginx-pod.demo"], "policy_mode": "Protect"}}
    headers = {'X-Auth-Token': token}
    while done  < retries:
        r = requests.patch(url, data=json.dumps(payload), headers=headers, verify=False)
        if r.status_code == 200:
            return(r)
            break
        else:
            print(r.status_code)
            print ("try #{}".format(done))
            done += 1
    return(r)


def change_mode_discover(token, controller_ip):
    done =0
    retries = 5
    url = "https://"+controller_ip+":10443/v1/service/config"
    #url = "https://neuvector-svc-controller.neuvector.svc.cluster.local:10443/v1/service/config"
    payload = {"config": {"services": ["exploit.demo", "node-pod.demo", "redis-pod.demo", "nginx-pod.demo"], "policy_mode": "Discover"}}
    headers = {'X-Auth-Token': token}
    while done  < retries:
        r = requests.patch(url, data=json.dumps(payload), headers=headers, verify=False)
        if r.status_code == 200:
            return(r)
            break
        else:
            print(r.status_code)
            print ("try #{}".format(done))
            done += 1
    return(r)

def convert_token(token):
    token_string = str(token.text)
    token_dict=json.loads(token_string)
    return(token_dict['token']['token'])

def generate_client_traffic():
    url = "http://nginx-webui.demo.svc.cluster.local"
    for n in range(10):
        requests.get(url)

def suspicious_process():
    domain_list = ["google","neuvector"]
    for svc in domain_list:
        os.system("wget https://{}.com".format(svc))


def os_update():
    os.system("apt-get update -y")
    
def neuvector_Logout(token):
    url = "https://neuvector-svc-controller.neuvector.svc.cluster.local:10443/v1/auth"
    headers = {'X-Auth-Token': token}
    r = requests.delete(url,headers=headers, verify=False)


def ping_flood():
    ping_list = ["node.demo.svc.cluster.local", "redis.demo.svc.cluster.local"]
    for n in range(1):
      for svc in ping_list:
        os.system("ping -f {} -w  2".format(svc))



def request_smuggling():
    ping_list = [ "nginx-webui.demo.svc.cluster.local"]
    headers = {'Content-Length': '999'}
    print("start http request smuggling")
    for svc in ping_list:
        url = "http://"+svc
        os.system("curl -H \"Content-Length: -123\" http://{} & ".format(svc))

def mysql_password():
    svc ="mysql1.demo.svc.cluster.local"
    for n in range(5):
        os.system("mysql -h {} -u hacker -password=hackck1".format(svc))
        time.sleep(2)


def mysql_password_correct():
    svc ="mysql1.demo.svc.cluster.local"
    for n in range(5):
        os.system("mysql -h {} -u root -password=password".format(svc))
        time.sleep(2)



def slow_loris():
    node_list = ["nginx-webui.demo.svc.cluster.local"]
    for n in range(2):
        for svc in node_list:
            os.system("telnet  {} 80 &".format(svc))





def inputNumber():
    while True:
        try:
            num = float(input(prompt))
            break
        except ValueError:
            pass
    return num



def generate_all_traffic(token,controller_ip):

     print("Sending Client Traffic....")
     generate_client_traffic()
     https_google()
     print("***********************************")
     input("Press Enter to continue...")

     # Generate Threats
     print("Sending Threats....")
     slow_loris()
     ping_of_death()
     ping_flood()
     suspicious_process()
     mysql_password()
     request_smuggling()
     print("***********************************")
     input("Press Enter to continue...")



     # Change Services to Monitor_mode

     print("Change Services to Monitor Mode....")
     r = change_mode_monitor(token,controller_ip)
     print(r)
     input("Press Enter to continue...")


      # Genrate Violations
     print("Creating Violations....")
     http_google()
     portscan()
     http_google()
     os_update()
     ping_flood()
     input("Press Enter to continue...")


   # Change Services to Proctect_mode
     print("Change Services to Protect Mode....")
     r = change_mode_protect(token, controller_ip)
     print(r)
     input("Press Enter to continue...")

      # Genrate Violations in protect mode
     print("Creating Violations....")
     http_google()
     portscan_lite()
     input("Press Enter to continue...")


     print("Change Services to Discover Mode....")
     r = change_mode_discover(token, controller_ip)
     print(r)

def displayMenu(options):
    #x = displayMenu(np.array(["Entername", "Display Greeting", Quit"]))
    for i in range(len(options)):
        print ("{0:5}.  {1}".format(i+1,options[i]))

    while True:
        try:
            choice = float(input ("Please choose a menu item: "))
            break
        except ValueError:
            print("Invalid Choice")
            pass
    return choice


def items(token, controller_ip):
    menuItems = np.array(["Launch all","Initiate Client Traffic","Initate Ping Death Threat","Initiate Ping Flood Threat",
                         "Launch Suspicious Process","Initiate HTTP Request Smuggling Threat", "Launch Port Scan","Initiate MySQL Unauthorized User with packet capture",
                         "Initiate Slow Loris Threat", "Show Monitor Violations","Show Blocked violations","External http traffic","External https traffic",
                         "Change services to Discover Mode", "Change services to Monitor  Mode", "Change services to Protect  Mode","MYSQL Root","Quit"])
    while True:
        os.system("clear")
        choice = displayMenu(menuItems)
        if choice == 1:
            generate_all_traffic(token, controller_ip)
        elif choice == 2:
            print("Generating Client Traffic")
            generate_client_traffic()
            input("Press Enter to continue...")
        elif choice == 3:
            print("Generating Ping Death Threat")
            ping_of_death()
            input("Press Enter to continue...")
        elif choice == 4:
            print("Generating Ping Flood Threat")
            ping_flood()
            input("Press Enter to continue...")
        elif choice == 5:
            print("Launch Suspicious Process")
            suspicious_process()
            input("Press Enter to continue...")
        elif choice == 6:
            print("Launch HTTP Request Smuggling")
            request_smuggling()
            input("Press Enter to continue...")
        elif choice == 7:
            print("Launch PortScan")
            change_mode_monitor(token,controller_ip)
            portscan_lite()
            input("Press Enter to continue...")
        elif choice == 8:
            print("Launch MySQL Attack")
            mysql_password()
            input("Press Enter to continue...")
        elif choice == 9:
            print("Launch Slow Loris Threat")
            slow_loris()
            input("Press Enter to continue...")
        elif choice == 10:
            print("Launch Monitored Violations")
            change_mode_monitor(token, controller_ip)
            portscan()
            input("Press Enter to continue...")
        elif choice == 11:
            print("Launch Blocked Violations")
            change_mode_protect(token, controller_ip)
            portscan_lite()
            input("Press Enter to continue...")
        elif choice == 12:
            print("Launch http://google.com traffic")
            http_google()
            input("Press Enter to continue...")
        elif choice == 13:
            print("Launch https://google.com traffic")
            https_google()
            input("Press Enter to continue...")
        elif choice == 14:
            print("Change Services to Discover Mode")
            change_mode_discover(token, controller_ip)
            input("Press Enter to continue...")
        elif choice == 15:
            print("Change Services to Monitor Mode")
            change_mode_monitor(token, controller_ip)
            input("Press Enter to continue...")
        elif choice == 16:
            print("Change Services to Protect Mode")
            change_mode_protect(token, controller_ip)
            input("Press Enter to continue...")
        elif choice == 17:
             print("Genrerate Mysql login")
             mysql_password_correct()
        elif choice == 18:
             break






def main():

    username = sys.argv[1]
    password = sys.argv[2]
    controller_ip = sys.argv[3]

    token_txt = get_neuvector_token(username,password,controller_ip)
    token= convert_token(token_txt)
    

    items(token,controller_ip)


if __name__ == '__main__':
    main()