fugu
-
Posts
197 -
Joined
-
Last visited
-
Days Won
6
Posts posted by fugu
-
-
I wonder if you could diff -u -r the backup vs. what he messed around with to see what he changed.
-
Can you try to just disable you DHCP client, and use a static ip addr? It might just work.
-
I was not thinking about any extra gpio, or resoldering anything. I was just thinking about drilling a small hole in the case and maybe glueing(/or just fitting) a piece of plastic to the existing gpio, so it can be pressed without having to open the case. In my circumstance, I took a little too much off the top and ruined my case. If there was somthing already available I'd probably have more hair on the sides of my head. (hehehe)No extra gpio is easily available
-
I'm looking to buy another ducky, but it would be nice to have the gpio button accessible when the case is attached. I tried to do-it-my-self but i just managed to break-it-my-self. Any ideas on if that might be possible?
-
I'm not that familiar with www.wigle.net, but it looks like there are a few parts that are similar. However, my program is designed to be run on a server, from which clients would connect to to do their processing. It looks like with wiggle.net, you only have control over the clients if I'm not mistaken. I don't know who or where wigle.net is run by, but it's kinda nice being in control of your own data. If you control the server and the software, it's less of a privacy problem. Also, my program is not just for wifi data, but can be used to plot any locational data. It could be used to plot GSM data, or just GPS data. Right now, to plot data, it takes a csv file with just:
Long1,Lat1
Long2,Lat2
Long3,Lat3
I plan on using this with other projects so that extra data can be loaded and analyzed, like GPS altitude, GPS accuracy, signal strength, air temperature, whatever, etc.
It pulls the map tiles through the server to deliver the pictures to the client. I had initially cached the map tiles for faster loading, but then found out that it was a violation for ToS, so I changed the program so it doesn't cache any files.
-
So i have a new project, it's kinda just a framework right now but its to help plot out GPS datas so those numbers you get actually have some meaning. A while back kismet had a plotting software that came with the package, but I think they stopped updating it and it eventually stopped working with kismet if I recall correctly. You can use my software to plot data, or if you modify the code slightly, you can even analyze the data before you plot it. I'm hoping to use this framework for other projects, but I thought I'd share it now as it is.
hxxp://sourceforge.net/p/phpmapplotter/
-
a slight modification, (http://termbin.com/afo9). this uses a different formulation for the free space path loss, which is better for dipole emmitters. there is a zenith angle dependency for transmition of radio waves from an emmitter so its not exactly 1/r^2 but really (sin(theta)/r)^2. this assumes the emmitter is verticly oreinted.
-
Ok, I havn't done any strigent testing on this yet, but from what I can tell it works. (http://termbin.com/aug8) the results
target values => array ( 0 => -20, 1 => 3, 2 => 4, 3 => 0.5, ) initial guess values => array ( 0 => -18.5, 1 => 2.8, 2 => 4.2, 3 => 0.7, ) final values => array ( 0 => -20.084988695677, 1 => 2.9135452656805, 2 => 3.8889743416155, 3 => 0.49322017558866, ) 2.954425842552E-16
I was missing some variables and I had the deritives messed up. I also substituted the EIRP ($Eio) variable with it's linear equivilant ($Efo) to make the numbers come out smoother. also 10 data points was not enough to get consistant results so I make 100 points now for testing.EDIT: I just changed all the initial guess values to 0.0, and it still converges
target values => array ( 0 => -20, 1 => 3, 2 => 4, 3 => 0.5, ) initial guess values => array ( 0 => 0, 1 => 0, 2 => 0, 3 => 0, ) final values => array ( 0 => -20.033286684618, 1 => 3.1267942833894, 2 => 3.9592060929975, 3 => 0.63538010259819, ) 1.2444712182315E-16
-
i just pick php as my default cause I know it probably better that most other languages except for maybe bash.
That line in python might read
input_array.append([S_i, x_i, y_i, z_i]);
it's the 2 little brackets next to the $input_array variable. is building up sort of a a 2D array for all the data one might be collecting from a senor, which I don't have right now, so I'm faking the data in that loop. I add a little noise to the RSSI variable, also, so it behaves a little bit more like real world data. The function "J" is a tricky one, it's really were the magic happens, it is where the Jacobian Matrix is created. This is a matrix of 1st-order deritives of the equation that I started with, and populated with all the fake data I created. So, in the example, we have 10 fake data points and 4 unknown variables, so the Jacobian matrix is a 10x4 matrix. I also think that this is were the problem is in the algorithm. I probably did the math wrong on the deritives. I'm not that smart in math, some math guy name Gauss came up with this a long time ago, and I'm just trying to copy him:) -
So this code is not yet functional, but I'm hoping to work more on it (the z coordinate is messed up). The Matrix code that goes along with it is also broken in parts but it's working for what I need it for. And I get to make use of the netcat pastebin featured last week on hak5 yay!
-
So my idea involes nonlinear least squares regression, which can be multidimensional and handle multible variables; wikipedia is not that great at explaining this, and although has more infomation IMHO wolfram is as hard to follow as a math teacher is. (hxxp://mathworld.wolfram.com/NonlinearLeastSquaresFitting.html). From what I've gathered:
10^(RSSI/10) = 10^(EIRP/10)* (c/(4*pi*f))^2 * (1/(x^2+y^2+z^2)).
some of these are known in abundance like RSSI , f, and part of the x, y, and z's, AND some of these are unknown like the EIRP and the other part of the x, y ,and z's. Nonlinear regression requires a guess value for the unknowns. if the guess values are close enough then the algorithm will converge on the solution that best fits this equation, calculating the best fit values for EIRP and the x, y, z of the source signal. One problem with this is coming up with an initial guess set of parameters from the data that is collected, that is just close enough to keep the algorithm from diverging when the program is run.
-
i was thinking of coming up with a "least squares" algorithm for finding a solution to this problem using a single sensor. In this case I think i'd probably have to assume a stationary source to find a solution, at least to make the program simple enough to function at first. It might be able to be modified to track a moving target, but adding variables or diminsions can greatly decrease the change that this algorithm will converge on a solution.
-
I have a question, why can't we just use 1 sensor to triangulate an RF source, if we move the source around?
-
Does anyone know the relationship between RSSI, EIRP, frequency, and distance for radio transmitions? I kinda have an idea but I'd like a verification.
TYTYTY:)
-
Ok I have not gotten any response from those email addresses or the mailing lists. I'm worried that netfilter has become abandoned. I can't imagine that to be true but i don't know how else to get in contact with anyone. weird.
-
I believe that bat file is part of Microsoft Visual C Express. I don't know why it would be required for NumPy.
-
FYI: you can test this with
sudo p0f -i eth0 -f /etc/p0f/p0f.fp "tcp[tcpflags] & (tcp-syn) != 0 && tcp[tcpflags] & (tcp-ack) = 0"
I do have a question that maybe some one here can anwser. I've been trying to contact the people from netfilter; they don't have forums but they do have a mailing list which is not functioning as far as I can tell, and even email that I've found has not had any response. Anyone have a clue how I can get help from them, or with netfilter in general? thanks
-
You could do a search engine search for O'Reilly Ultimate Collection
-
i looking for a more popular connector for the R802T and I found this:
http://www.nooelec.com/store/male-mcx-to-male-sma-pigtail-rg174-0-5-length.html
hxxp://www.nooelec.com/store/male-mcx-to-male-sma-pigtail-rg174-0-5-length.html
Male MCX to Male SMA pigtail cable, RG174, 0.5' length
Male MCX to male SMA upconverter to SDR interconnect cable.
Very high-quality male MCX to male SMA RG174 pigtail cable, 0.5' in length. Low-loss RG174 + short cable length means there is no need to worry about potential attenuation. Matched 50 ohm connectors. Great for attaching MCX-style SDRs such as NESDR Mini, NESDR Micro & TV28T (v1 & v2) to our Ham It Up RF upconverter. <br />
Anyone know if that is the right type of connection? MCX? -
i've seen tcpd before, but didn't know what it was used for. I will read more about how that program works. It sounds like a good alternative to the ucspi-tcp programs i've been playing around with. It appears to have way more control then the other programs, using hosts.allow/hosts.deny. It does look a little bit more involved, so it'll take a little while for me to learn how it works. Thanks for the tip!
-
Ok I realize i couldn't get your code to work for the filenames. For some reason I just couldn't get it to compile. My goal for whole project this was to make an interface for the program 'tcpserver' from the package "ucspi-tcp". It basically creates a a multithreaded server that can host 1 program over and over again, one time for each thread. This is the program that I would like to have it host, and I want it to generate a pair of fifo pipes that I can interacte with, when I chose to do so (by running another instance of it maybe). I know terminals are much more complicated but I'm looking at this as kind of a simple multithreaded netcat server application, reading from the pipes can really be done by any program, but i was thinking this same program might be able to do it too, having all the tools needed to do this already in place. I think checking the fd's before and after polling is a great idea, but can't we still close those connections at the end of the program, just before we return 0?
I reverted back to my orginal filename generating system, so that I could get it to work. And it's now functioning:) I hope that I'm explaining well enough what I was hoping to accomplish with this.Term1 server$ tcpserver 192.168.1.100 4444 juggle
client1$ nc 192.168.1.100 4444 hello world 1 client2$ nc 192.168.1.100 4444 hello world 2 client3$ nc 192.168.1.100 4444 ...
Term2 server$ juggle /tmp/std_out_00001 /tmp/std_in_00001 hello world 1 Term3 server$ juggle /tmp/std_out_00002 /tmp/std_in_00002 hello world 2
here is my current working version, with the filenames fixed, only delete fifos that we create, only close fd's that are still open, there is a problem with shuting down the program and getting it to cleanup the fifo's that are made. When you SIGINT on any of the parts, it doesn't delete the fifo's like I'd think it should. In bash there is the "trap" command which could clean this up, but afaik c doesn't impliment. Also, because it's not running to the end of the program, I'm having trouble testing what actually happens when the program gets there.#include <fcntl.h> #include <poll.h> #include <stdbool.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #define BUF_SIZE 2048 bool bytes_redirect(int fdin, int fdout){ int read_bytes; char buffer[BUF_SIZE]; do { read_bytes = read(fdin, buffer, BUF_SIZE); if(read_bytes < 0){ // Failed to read. return false; } else if (read_bytes != write(fdout,buffer,read_bytes)) { // Failed to write the complete buffer. return false; } } while (read_bytes == BUF_SIZE); return true; } char *find_open_named_pipe(const char *file_name_format, int index, bool *file_exists){ char buffer[50]; char *myfd_str; sprintf(buffer,file_name_format, index); if(access(buffer , F_OK ) != -1) { *file_exists = true; } else { *file_exists = false; } myfd_str = (char *) malloc(sizeof(char)*(strlen(buffer))); memcpy(myfd_str, &buffer, strlen(buffer)+1); return myfd_str; } int main(int argc, char *argv[]){ struct pollfd poll_file_descriptor[2]; char *myfdin = ""; char *myfdout = ""; int fdin, fdout, index = 0; bool file1exists, file2exists; bool continue_loop = true; bool i_created_fifos; if(argc > 2){ myfdin = argv[1]; myfdout = argv[2]; fdout = open(myfdout, O_WRONLY); //different order, out first fdin = open(myfdin, O_RDONLY); i_created_fifos = false; }else{ index = 0; do{ index++; if(index>=99){ return -1; } myfdin = find_open_named_pipe((const char *)"/tmp/std_in_%05d", index, &file1exists); myfdout = find_open_named_pipe((const char *)"/tmp/std_out_%05d", index, &file2exists); }while(file1exists || file2exists ); mkfifo(myfdin, 0600); mkfifo(myfdout, 0600); fdin = open(myfdin, O_RDONLY); //different order, in first fdout = open(myfdout, O_WRONLY); i_created_fifos = true; } poll_file_descriptor[0].fd = fdin; poll_file_descriptor[0].events = POLLIN; poll_file_descriptor[0].revents = 0; poll_file_descriptor[1].fd = STDIN_FILENO; poll_file_descriptor[1].events = POLLIN; poll_file_descriptor[1].revents = 0; while (continue_loop) { if(fdin < 0 || fdout < 0){ break; } poll(poll_file_descriptor,2,1200000); if(fdin < 0 || fdout < 0){ break; } if (poll_file_descriptor[0].revents != 0) { continue_loop = bytes_redirect(fdin, STDOUT_FILENO); if(!continue_loop){ break; } } if (poll_file_descriptor[1].revents != 0) { continue_loop = bytes_redirect(STDIN_FILENO, fdout); if(!continue_loop){ break; } } if (poll_file_descriptor[0].revents == 0 && poll_file_descriptor[1].revents == 0){ break; } } if(fdout >=0) close(fdout); if(fdin >=0) close(fdin); if(i_created_fifos){ unlink(myfdin); unlink(myfdout); free(myfdin); free(myfdout); } return 0; } -
this is a work in progress but I figure what the heck. linux can easily change wifi mac addresses. i've always thought it should be able to easily change the syn packet fingerprint as well, but it can't (afaik). this python program can alter the syn packets before they leave the computer. it only works on linux, and needs iptables with nfqueue, python-nfqueue, and scapy.
WARNING: this will alter your current firewall and I can't guarantee that it will not break anything. If you want to add the NFQUEUE entries manually to the outgoing rules of you iptables, then I suggest that you comment out the 3 lines that contain os.system('iptables-restore '+tempfile_name).
This program will try to save the state of your firewall when it starts up, and will try to restore it when the program finishes.
This program currently will not work if there are any iptables rules that contain a --state parameter, because I think that conntrack is not properly tracking the new altered packets as the orginal connection.
So here it is, test it at your own risk:import logging l=logging.getLogger("scapy.runtime") l.setLevel(49) import os,sys,nfqueue,re,socket from scapy.all import * conf.verbose = 0 conf.L3socket = L3RawSocket #Win7 syn chars = dict(); chars["ip_frag"] = 0L; chars["ip_ttl"] = 128; chars["tcp_window"] = 8192; chars["tcp_options"] = [('MSS', 1460), ('NOP', None), ('WScale', 2), ('NOP', None), ('NOP', None), ('SAckOK', '')] ########################## ########################## MODIFING FIREWALL ########################## #store orginal firewall proc_str = "iptables-save" proc = subprocess.Popen(proc_str, shell=True, stderr=subprocess.PIPE, stdout=subprocess.PIPE) iptables_save = '' for line in proc.stdout: iptables_save += line #create modified firewall to allow packet capture of out going packets only # FYI, by altering the outgoing packets info, the response packets will # not completely "pair up" to the the ones iptables tried to send out, # ipso facto we have to break connection tracking to change our fingerprint iptables_save_nfqueue = re.sub(r"OUTPUT(.*)-j ACCEPT", "OUTPUT\g<1>-j NFQUEUE --queue-num 0", iptables_save) iptables_save_nfqueue = re.sub("-A\s+OUTPUT\s+-o\s+lo\s+-j NFQUEUE --queue-num 0", "-A OUTPUT -o lo -j ACCEPT", iptables_save_nfqueue) proc_str = "tempfile" proc = subprocess.Popen(proc_str, shell=True, stderr=subprocess.PIPE, stdout=subprocess.PIPE) tempfile_name = '' for line in proc.stdout: tempfile_name += line tempfile_name = tempfile_name[:-1] outputFile = open(tempfile_name, "w") outputFile.write(iptables_save_nfqueue) outputFile.close() os.system('iptables-restore '+tempfile_name) os.remove(tempfile_name) # END FIREWALL MOD s = socket.socket(socket.AF_PACKET, socket.SOCK_RAW) s.bind(("eth0", 0x0800)) def send_rawsock(pkt): global s s.send(str(pkt)) def process(i, payload): global chars data = payload.get_data() pkt = IP(data) proto = pkt.proto #print data.encode("hex") # Check if it is a ICMP packet if proto is 0x01: #print "ICMP PACKET" payload.set_verdict(nfqueue.NF_ACCEPT) pass # Check if it is an TCP packet elif proto is 0x06: if int(pkt[TCP].flags) is 2: #SYN-only #print "TCP SYN PACKET" new_tcp_opts_len = len(chars["tcp_options"]) current_tcp_opts_len = len(pkt[TCP].options) options_are_the_same = True if pkt[IP].frag != chars["ip_frag"]: options_are_the_same = False if pkt[IP].ttl != chars["ip_ttl"]: options_are_the_same = False if pkt[TCP].window != chars["tcp_window"]: options_are_the_same = False if current_tcp_opts_len == new_tcp_opts_len: for i in range(0,current_tcp_opts_len): if pkt[TCP].options[i][0] != chars["tcp_options"][i][0]: options_are_the_same = False break if pkt[TCP].options[i][1] != chars["tcp_options"][i][1]: options_are_the_same = False break if options_are_the_same: payload.set_verdict(nfqueue.NF_ACCEPT) pass else: payload.set_verdict(nfqueue.NF_DROP) newpkt = Ether()/IP()/TCP() newpkt[IP].version = pkt[IP].version newpkt[IP].ihl = pkt[IP].ihl newpkt[IP].tos = pkt[IP].tos #newpkt[IP].len = pkt[IP].len newpkt[IP].id = pkt[IP].id newpkt[IP].flags = pkt[IP].flags newpkt[IP].frag = chars["ip_frag"] newpkt[IP].ttl = chars["ip_ttl"] newpkt[IP].proto = pkt[IP].proto newpkt[IP].src = pkt[IP].src newpkt[IP].dst = pkt[IP].dst newpkt[IP].options = pkt[IP].options newpkt[TCP].sport = pkt[TCP].sport newpkt[TCP].dport = pkt[TCP].dport newpkt[TCP].seq = pkt[TCP].seq newpkt[TCP].ack = pkt[TCP].ack #newpkt[TCP].dataofs = pkt[TCP].dataofs newpkt[TCP].reserved = pkt[TCP].reserved newpkt[TCP].flags = pkt[TCP].flags newpkt[TCP].window = chars["tcp_window"] newpkt[TCP].urgptr = pkt[TCP].urgptr newpkt[TCP].options = chars["tcp_options"] send_rawsock(newpkt) pass else: #print "TCP NONSYN PACKET" payload.set_verdict(nfqueue.NF_ACCEPT) pass # Check if it is an UDP packet elif proto is 0x11: #print "UDP PACKET" payload.set_verdict(nfqueue.NF_ACCEPT) pass # packet is other else: #print "OTHER PACKET" payload.set_verdict(nfqueue.NF_ACCEPT) pass def main(s): global iptables_save q = nfqueue.queue() q.open() q.set_callback(process) q.fast_open(0, socket.AF_INET) try: q.try_run() except KeyboardInterrupt: print "Exiting..." q.unbind(socket.AF_INET) q.close() s.close() #restore orginal firewall proc_str = "tempfile" proc = subprocess.Popen(proc_str, shell=True, stderr=subprocess.PIPE, stdout=subprocess.PIPE) tempfile_name = '' for line in proc.stdout: tempfile_name += line tempfile_name = tempfile_name[:-1] outputFile = open(tempfile_name, "w") outputFile.write(iptables_save) outputFile.close() os.system('iptables-restore '+tempfile_name) os.remove(tempfile_name) try: main(s) except: print "Error: caught main(s) exception" #restore orginal firewall proc_str = "tempfile" proc = subprocess.Popen(proc_str, shell=True, stderr=subprocess.PIPE, stdout=subprocess.PIPE) tempfile_name = '' for line in proc.stdout: tempfile_name += line tempfile_name = tempfile_name[:-1] outputFile = open(tempfile_name, "w") outputFile.write(iptables_save) outputFile.close() os.system('iptables-restore '+tempfile_name) os.remove(tempfile_name)
-
i also had a thought. if this can create the stdin and stdout as files, could it not also read from those 2 files turning your command prompt into an interface for those fifos? i think it might be able to work, but it is not working for me. i don't know if it has anything to do with the blocking nature of the 'open' commands inside the program. I was thinking about adding the '| O_NONBLOCKING' flags to the open commands, then adding my own little wait so that the fifos can connect in any order they want to (i.e. not needing to connect the fdin's first then the fdout's second the way it is doing it right now).
$ gcc -o juggle ./juggle_fifos.c -lm
#include <fcntl.h> #include <math.h> #include <poll.h> #include <stdbool.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <sys/stat.h> #include <unistd.h> #define FIFO_FOLDER_NAME "/tmp" #define BUF_SIZE 2048 bool bytes_redirect(int fdin, int fdout){ int read_bytes; char buffer[BUF_SIZE]; do { read_bytes = read(fdin, buffer, BUF_SIZE); if(read_bytes < 0){ // Failed to read. return false; } else if (read_bytes != write(fdout,buffer,read_bytes)) { // Failed to write the complete buffer. return false; } } while (read_bytes == BUF_SIZE); return true; } static int number_of_chars_to_write_int(int number) { int sign_length = 0; if (number < 0) { sign_length = 1; number *= -1; } return sign_length + (int)log10((double)number); } char * construct_filename(const char *path, char *file_prefix, int index) { int filename_length = strlen(path) + 1 + strlen(file_prefix) + number_of_chars_to_write_int(index) + 1; char *filename = (char *) malloc ( filename_length ); if (filename == NULL) { return NULL; } if (snprintf(filename, filename_length, "%s/%s%d", path, file_prefix, index)<0) { free( filename ); return NULL; } return filename; } int is_directory(const char *name) { struct stat statbuf; return (stat(name, &statbuf)==0) && (S_ISDIR(statbuf.st_mode)); } char ** find_available_filenames(const char *directory_name, char **filename_prefix, int count) { int index; int file_counter; char ** filenames; if (count < 1) { return NULL; } else if (!is_directory(directory_name)) { return NULL; } filenames = (char**)malloc( count * sizeof(char *) ); if (filenames == NULL) { return NULL; } for (index = 1; index < 100; index++) { for (file_counter = 0 ; file_counter < count ; file_counter++) { filenames[file_counter] = construct_filename( directory_name, filename_prefix[file_counter], index ); if (access( filenames[file_counter], F_OK ) == 0) { // File exists already, so bad index... // Free all the filenames accumulated so far. do { free( filenames[file_counter] ); filenames[file_counter] = NULL; } while (file_counter-- > 0); // Break this loop to try a new index. break; } } if (filenames[0] != NULL) { // We have our result. break; } } if (filenames[0] == NULL) { // No appropriate index found. free( filenames ); return NULL; } return filenames; } int main(int argc, char *argv[]){ struct pollfd poll_file_descriptor[2]; char *myfdin = ""; char *myfdout = ""; char *inputargs[] = {"std_in_","std_out_"}; char **filenames; int fdin, fdout, index = 0; bool file1exists, file2exists; bool continue_loop = true; if(argc > 2){ myfdin = argv[1]; myfdout = argv[2]; }else{ filenames = find_available_filenames(FIFO_FOLDER_NAME, inputargs, 2); myfdin = filenames[0]; myfdout = filenames[1]; mkfifo(myfdin, 0600); mkfifo(myfdout, 0600); } fdin = open(myfdin, O_RDONLY); if(fdin < 0){ return -1; }else{ free(myfdin); } fdout = open(myfdout, O_WRONLY); if(fdout < 0){ return -1; }else{ free(myfdout); } poll_file_descriptor[0].fd = fdin; poll_file_descriptor[0].events = POLLIN; poll_file_descriptor[0].revents = 0; poll_file_descriptor[1].fd = STDIN_FILENO; poll_file_descriptor[1].events = POLLIN; poll_file_descriptor[1].revents = 0; while (continue_loop) { poll(poll_file_descriptor,2,1200000); if (poll_file_descriptor[0].revents != 0) { continue_loop = bytes_redirect(fdin, STDOUT_FILENO); if(!continue_loop){ break; } } if (poll_file_descriptor[1].revents != 0) { continue_loop = bytes_redirect(STDIN_FILENO, fdout); if(!continue_loop){ break; } } if (poll_file_descriptor[0].revents == 0 && poll_file_descriptor[1].revents == 0){ break; } } close(fdout); close(fdin); unlink(myfdin); unlink(myfdout); return 0; } -
<erased due to user error>
boolean is_directory(const char *name) { struct stat statbuf; return (stat(folder_name, &statbuf)==0) && (S_ISDIR(statbuf.st_mode)); }has a typo,
boolean is_directory(const char *name) { struct stat statbuf; return (stat(name, &statbuf)==0) && (S_ISDIR(statbuf.st_mode)); }I'm still having trouble getting it to compile too, but ill keep trying
So I'm having a bit of a security nightmare right now, advice appreciated!
in Business and Enterprise IT
Posted
find / -type f -exec md5sum '{}' \; 2> /dev/null > /path/to/md5sums_dump.txt