a k#d~@sdZddlmZddlmZddlZddlZddlZddlmZm Z ddl m Z ddl m Z mZddlmZdd lmZmZmZdd lmZmZmZdd lmZdd lmZmZmZdd lm Z ddl!m"Z"m#Z#gdZ$e e$de _%dZ&dZ'dZ(dZ)dZ*dZ+dZ,dZ-ddddddZ.Gddde/Z0Gd d!d!e/Z1Gd"d#d#e/Z2Gd$d%d%e/Z3Gd&d'd'e/Z4Gd(d)d)eZ5e5e j%Z6d*d+Z7d?d.d/Z8d0d1Z9d2d3Z:d4d5Z;d6d7Zd@d=d>Z?dS)Az+ Clone of p0f v3 passive OS fingerprinting )absolute_import)print_functionN) KnowledgeBase select_path)conf)raworb) NoPayload)IPTCP TCPOptions)HTTP HTTPRequest HTTPResponse)IPv6)RandByte RandShort RandString)warning) integer_types string_types)z/etc/p0fz/usr/share/p0fz /opt/localzp0f.fp(<#msswssoksackts)rrrc@s<eZdZgdZddZeddZeddZdd Zd S) TCP_Signature olayoutquirks ip_opt_lenip_verttlrwinwin_typewscale pay_classts1c CsF||_||_||_||_||_||_||_||_| |_| |_ | |_ dSNr&) selfr'r(r)r*r+rr,r-r.r/r0r3H/var/www/html/gsl.tools/lib/python3.9/site-packages/scapy/modules/p0f.py__init__7szTCP_Signature.__init__c s|j}tfdd}|dkr|j}|jdd}|jd@rF|d|jjrV|d|jjrv|d|jr|d q|jd kr|d n*|j }d }|j r|d |j d@r|d|t }|j }|jd @r|d|jd kr|d|jjr|jd kr|dn|jr|d|jjr*|dn|jr:|d|jjrL|d|jrXdnd }d } d } d } d} |jd>d} t|| d}|rt|d }|d kr|dd}| dt|7} |dr|dq|dkr|dd}| d7} qzt|d}Wn"ty0|dYqYn0|d|}|tvr~td |d}| dt|7} |r|dt|nd}t||kr|dq|dkr|dks|d kr||dqn||kr|dq|rt||}t|dkr|d }|dkr|} nh|dkr6|} | d!kr||d"nF|d#kr|d } | sV|d$|dr|jj r|jjs|d%n.|dks|d&ks|t|kr|dq||d}q| dd'} || |||| |d| || S)(zi Receives a TCP packet (assuming it's valid), and returns a TCP_Signature object cs|dSr1)add)namer(r3r4addqNsz'TCP_Signature.from_packet..addqrrecn0+dfid+rid-flowseq-ack-ack+urgf+uptr+pushf+rrNzeol+%i,opt+znop,badz%s,r# "exwsr$ts1-ts2+r)!versionsetr+ZihltosflagsZevilZDFidhlimfltcr windowseqAackUurgptrPpayloadZdataofsrrlenstrip IndexErrortcp_options_p0fr structcalcsizeunpackS)clspktr*r9r+r)tcpr,r/rr.r0r'ZoptlenxZonumolenZovalZofmtZoptsizer3r8r4 from_packetEs                                " zTCP_Signature.from_packetc Cst|d\}}}}}}}} |d\}} } |dkr6dnt|} |ddkr^t|dddfn t|df\}} t|}|dkrdnt|}|dkrd t}}n|dd d krt|d dt}}n\|d d krt|ddt}}n8|dd dkrt|d dt}}nt|t}}| dkr0dnt| }|rXtdd| dD}nt}| dkrldn t| dk}||||| ||||||d }|| fS)z| Parses a TCP sig line and returns a tuple consisting of a TCP_Signature object and bad_ttl as bool r$,*rR-NTFrrrr%rmtucss|] }|VqdSr1r3.0qr3r3r4 z-TCP_Signature.from_raw_sig..+) lparse partitionint WIN_TYPE_ANY WIN_TYPE_MSS WIN_TYPE_MOD WIN_TYPE_MTUWIN_TYPE_NORMAL frozensetsplit)rksig_lineverr+rorZwsizer'r(pclass_scaler*bad_ttlr)r,r-r.r/sigr3r3r4 from_raw_sigs,0  zTCP_Signature.from_raw_sigc CsPddd|jD}d}||j|jt|j|j|j|j|j|j ||j f }|S)Nrqcss|] }|VqdSr1r3rvr3r3r4ryrzz(TCP_Signature.__str__..z%i:%i+%i:%i:%i:%i,%i:%s:%s:%i) joinr(r*r+ guess_distr)rr,r.r'r/)r2r(fmtsr3r3r4__str__s zTCP_Signature.__str__N __name__ __module__ __qualname__ __slots__r5 classmethodrprrr3r3r3r4r%3s x r%c@s<eZdZgdZddZeddZeddZdd Zd S) HTTP_Signaturehttp_verhdrhdr_sethabsentswcCs"||_||_||_||_||_dSr1r)r2rrrrrr3r3r4r5s zHTTP_Signature.__init__cCst|tj}d}||}|dkr:|d|t|}n|}|}|dd\}}d|vrdd}nd|vrrd}ntd d }g} t} |dD]D} | d \} } }|r| }| | |f| | | d vr|}qt | }|||| d|S) zl Receives an HTTP packet (assuming it's valid), and returns a HTTP_Signature object s rRNz rz1.0rz1.1zHTTP version is not 1.0/1.1rH:) User-AgentServer)rr rbfindrcdecoder ValueErrorrTr}rdappendr6tuple)rkrlZ http_payloadZcrlfcrlfZ crlfcrlfIndexheaders first_linerrZ headers_foundrZ header_liner7rvaluerr3r3r4rps4  zHTTP_Signature.from_packetcCst|d\}}}}|dkrdnt|}g}td|D]Z}|d\} } } | ddkrx|| dd | ddd fq6|| | ddd fq6t|} td d | D} t|d}||| | ||S)zM Parses an HTTP sig line and returns a HTTP_Signature object rrrrRz ,(?![^\[]*\])=r?rNTFcss|]}|ds|dVqdS)rrNr3)rwheaderr3r3r4ry)rzz.HTTP_Signature.from_raw_sig..rq)r|r~rerr}rrr)rkrrZhorderrZexpswrZ new_horderrr7rrrrr3r3r4rs "zHTTP_Signature.from_raw_sigcs8ddfdd|jD}d}||j||jf}|S)N)HostrDatez Content-Typerrqc3s*|]"\}}|vr|n d||fVqdS)z%s=[%s]Nr3)rwnvZskipvalr3r4ry0rzz)HTTP_Signature.__str__..z %i:%s::%s)rrrr)r2rrrr3rr4r-s zHTTP_Signature.__str__Nrr3r3r3r4rs % rc@seZdZddgZddZdS) MTU_Recordlabel_idrucCs||_t||_dSr1)rr~rur2rrr3r3r4r5:szMTU_Record.__init__Nrrrrr5r3r3r3r4r7src@seZdZgdZddZdS) TCP_Record)rrrcCs$||_t|\}}||_||_dSr1)rr%rrr)r2rrrrr3r3r4r5BszTCP_Record.__init__Nrr3r3r3r4r?src@seZdZddgZddZdS) HTTP_RecordrrcCs||_t||_dSr1)rrrrrr3r3r4r5LszHTTP_Record.__init__Nrr3r3r3r4rIsrc@sBeZdZdZddZddZdddZd d Zd d Zd dZ dS)p0fKnowledgeBasez self.base = { "mtu" (str): [sig(tuple), ...] "tcp"/"http" (str): { direction (str): [sig(tuple), ...] } } self.labels = (label(tuple), ...) cCs^zt|j}Wn ty.td|jYdS0i|_g|_||t|j|_|dS)NzCan't open base %s) openfilename Exceptionrbaselabels _parse_filerclose)r2fr3r3r4 lazy_init[s    zp0fKnowledgeBase.lazy_initcCsd}|D]}|ddvrq|}|ddkrt|ddd\}}|dkrdg|j|<|j|}nD||jvr~|gi|j|<n||j|vrg|j||<|j||}q|d\}}} |}|d kr|dkrt} n|d krt} n |d krt} || || q|d krX|d7}|dkr0|j| qt| d \} } } }|j| | | |fq|dkrt dd| dD}|j||f7<qdS)zS Parses p0f.fp file and stores the data with described structures. rRr); [rrruz = rrmhttplabelrsyscss|] }|VqdSr1r3rwr7r3r3r4ryrzz/p0fKnowledgeBase._parse_file..rqN) rdr|rr}rrrrrrr)r2filerlinesection directionZ curr_recordsparamrvalZ record_classtcr7flavorZ sys_namesr3r3r4rhsF          zp0fKnowledgeBase._parse_fileNc Cslg}|jd|D]T}|j|j}|d|d}}|r||kr|rZ||vrf||jq||jq|S)a{Get TCP signatures that match an OS genre and details (if specified). If osdetails isn't specified, then we pick all signatures that match osgenre. Examples: >>> p0fdb.get_sigs_by_os("request", "Linux", "2.6") >>> p0fdb.get_sigs_by_os("response", "Windows", "8") >>> p0fdb.get_sigs_by_os("request", "FreeBSD") rmrr)rrrrr) r2rosgenre osdetailssigs tcp_recordrr7rr3r3r4get_sigs_by_oss   zp0fKnowledgeBase.get_sigs_by_oscCs(t|\}}d}d}|jd|D]}|j}d} |j} |j|jkrFq"|jdkrl| |jdkrbdhnhd8} | |jkr| |jA| @} | |jA|j@} |s"| dd hs"| d d hrq"d } |j|jkrq"|jr|j|jkrq"n |j|jks|j|jt krd } |j dkr|j |j ks"|j dkr*|j |j ks"|j dkrF|j |j krFq"|j tkrd|j|jkrq"n\|j tkr|j|jrq"n>|j tkr|s"|j|krq"n|j tkr|r"|j|krq"|j|j} | |j|j| f}| s| d dkr|S|s|}q"|s"|}q"|r|S|r$|SdS)a; Finds the best match for the given signature and direction. If a match is found, returns a tuple consisting of: - label: the matched label - dist: guessed distance from the packet source - fuzzy: whether the match is fuzzy Returns None if no match was found NrmFrRrr@>r=r?r>r=r>r?r;Trr)detect_win_multirrr(r'r*r)rr+MAX_DISTrr.r/r-rr,rrrrr)r2r"rZ win_multiuse_mtugmatchZfmatchrrsZfuzzyZ ref_quirksZdeletedaddedrmatchr3r3r4tcp_find_matchsx             zp0fKnowledgeBase.tcp_find_matchc sd}|jd|D]}|jjdkr4jjkr4qjj@jksHqtjj@dkr^qfdd}|stq|j|j}jojojjv}||f}|ddkr|S|s|}q|r|SdS)a Finds the best match for the given signature and direction. If a match is found, returns a tuple consisting of: - label: the matched label - dishonest: whether the software was detected as dishonest Returns None if no match was found NrrRrcsd}tj}jD]}|}||krD|dj|dkrD|d7}q||kr|dsZdSjD]}|d|dkr`dSq`|}q|dj|dvrdS|d7}qdS)NrrrFT)rcr)phiZhdr_lenZkhZorig_phiphrr"r3r4headers_correls(      z8p0fKnowledgeBase.http_find_match..headers_correlr) rrrrrcrrrr) r2r"rrZ http_recordrrZ dishonestrr3rr4http_find_matchs(  z p0fKnowledgeBase.http_find_matchcCs.|jdD]}||jkr |j|jSq dS)z Finds a match for the given MTU. If a match is found, returns the label string. Returns None if no match was found ruN)rrurr)r2ruZ mtu_recordr3r3r4mtu_find_match<s zp0fKnowledgeBase.mtu_find_match)N) rrr__doc__rrrrrrr3r3r3r4rQs  0 MArcCs"dD]}||kr||SqdS)N) @r3)r+Zottlr3r3r4rKsrrrHccsB||d|}|D] }|Vqt|t|D] }|Vq2dS)z& Parsing of 'a:b:c:d:e' lines N)rrangerc)rr delimiterdefaultaeltrr3r3r4r|Qs r|cCs6|}|to$|tp$|t}|s2td|S)z Validate that the packet is an IPv4/IPv6 and TCP packet. If the packet is valid, a copy is returned. If not, TypeError is raised. zNot a TCP/IP packet)copyZhaslayerr r r TypeError)rlZvalidr3r3r4validate_packet\s rcCs|j}|j}|r|dkrdS|dfdtdfdtddf|tdfdg}|jrb||ddf|jdkr|dtdf|dtddf||tdf|D] \}}||s|||fSqdS) z Figure out if window size is a multiplier of MSS or MTU. Receives a TCP signature and returns the multiplier and whether mtu should be used d)rRFF T)rT)rr,MIN_TCP4r0rr*MIN_TCP6)r"rr,optionsdivrr3r3r4rhs(     rcCst|}|t|}|tjjrD|tjjr4d}nd}t|}nX|tj rt t|tj }|t krrd}n|t krd}ntdt|}ntd||fS)zz Returns a p0f signature of the packet, and the direction. Raises TypeError if the packet isn't valid for p0f responserequestzNot an HTTP payloadz"Not a SYN, SYN/ACK, or HTTP packet)r __class__rr rVrjr]r%rprbr Zguess_payload_classrrrr)rlrrrr3r3r4 packet2p0fs"     rcCsjt|}d}|jjD]\}}|dkr|}q|s2dS|jdkrD|tn|t}ts`tddSt |S)z Fingerprints the MTU based on the maximum segment size specified in TCP options. If a match was found, returns the label. If not returns None rMSSNrp0f base empty.) rrbrrSrrp0fdbget_baserr)rlrr7rrur3r3r4fingerprint_mtusrcCsFt|\}}ts tddSt|tr6t||St||SdS)Nr)rrrr isinstancer%rr)rlrrr3r3r4p0fs   rc sbz t|}Wnty YdS0t|\}}t|t}|dk}|rR|rLdnd}n |rZdnd}|d|d}gfd d }|rd nd } || |d |r|d} | ddkrdnd} || | dd| dt| dkr|dddd| dD|r2|d|dn|r$dnd} || d|dt||d7}|d 7}t |dS)!z+Calls p0f and prints a user-friendly outputNrZSYNzSYN+ACKz HTTP Requestz HTTP Responsez2.-[ %IP.src%:%TCP.sport% -> %IP.dst%:%TCP.dport% (z) ]- | csd||fdS)Nz | %-8s = %s )r)r7rfieldsr3r4 add_fieldszprnp0f..add_fieldZClientrz%IP.src%:%TCP.sport%rr!ZAppZOSr rr#ZSysz, css|] }|VqdSr1r3rr3r3r4ryrzzprnp0f..rZDistanceUNKNOWNzRaw sigrHz`____ ) rrrrr%Zsprintfrcrstrprint) rlrrrZ is_tcp_sigZ to_serverZpkt_typeresr Z cli_or_svrrZ app_or_osr3rr4prnp0fs:        rrc st|s|stdt}|jd@}|rRt|trHt|\} } qtdnTt s`g} n|dkrldnd} t | ||} fdd| D} | std t | } | jd krĈj| jkrtd | j} jd kr| j|_| jd krtdng_d| vrBjdO_d| vr:jd kr@t dd_nd _n:jdM_d| vrbd _njd kr|t dd_d| vrjt ddO_d| vrjd Bnjd@_nD| j|_d| vrt dd_d| vrjt ddO_ddt|j}|d}|d}fdd|d d!D}g}| jd"D]}|d#kr| jt krd| j!}nd}| j"d kr|rd |kr|krnn|#d|fn|#dt d$|fn|#d| j"fnB|d%kr| j$d krd&}d'| vrb|rFd(|kr2|krFnn|#d|fn|#dt d)|dfnB|rd |kr|krnn|#d|fn|#dt%fn|#d| j$fnx|d*krz|\}}d+| vrd }n@|d,ur|}n0|d,usd |krd-ksnt d.d/}d0| vrb|dkrb|d,usTd |krRd-ksfnt dd1}nd }|#d ||ffn|d2kr|#d3n|d4kr|#d5n|d,dd6kr|#d7d8| vr2td9n\|d:kr(t gd;d}d<|d }t&t'(|)}|#d=t'*||fn td>|||_qZ| jt+krR| j!|_,n| jt krd?d|D}|sztd@|d d| j!|_,n`| jt-kr| j!t dd| j!|_,n8| jt.kr|| j!|_,n| jt/krt0|_,ntdAdB| vrd |_1n|j1d krt dd1|_1dC| vrP|jdDM_|j2d krnt dd1|_2ndE| vrn|jdFO_d |_2dG| vr|jdHM_|j3d krt dd|_3ndI| vr|jdJO_dK| vr|jdLBn|jdM@|_| j4r|j5st6j7t&t ddNdOnt8|_5S)PaModifies pkt so that p0f will think it has been sent by a specific OS. Either osgenre or signature is required to impersonate. If signature is specified (as a raw string), we use the signature. signature format: "ip_ver:ttl:ip_opt_len:mss:window,wscale:opt_layout:quirks:pay_class" If osgenre is specified, we randomly pick a signature with a label that matches osgenre (and osdetails, if specified). Note: osgenre is case sensitive ("linux" -> "Linux" etc.), and osdetails is a substring of a label flavor ("7", "8" and "7 or 8" will all match the label "s:win:Windows:7 or 8") For now, only TCP SYN/SYN+ACK packets are supported.z0osgenre or signature is required to impersonate!zUnsupported signature typerrrcs&g|]}|jdks|jjkr|qS)rR)r*rS)rwr)rlr3r4 rzz#p0f_impersonate..zNo match in the p0f databaserRz#Can't convert between IPv4 and IPv6rrzUnhandled IPv4 option fieldr=r>rir?r;rr<r@icSst|tr|SdSr1)rr)rr3r3r4int_onlyDsz!p0f_impersonate..int_onlyrZWScalecsg|] }|qSr3r3)rwo)rr3r4rIrz Timestamp)NNrqrrrrOrNr"rPNlxlwrQlZnop)NOPNr )ZSAckOKrHeol)ZEOLNrJzUnhandled opt+ quirkr!)rLrrMz!%iIZSAckzUnhandled TCP option %scSsg|]}|ddkr|qS)rrr3)rwrnr3r3r4rrzz5TCP window value requires MSS, and MSS option not setz#Unhandled window size specificationrBrDirCrFirErrGr$irL)load)9rrr rVrrr%rrrrrrandomchoicer*rSr(r+r)rrrWrandintrUrXrYrZdictgetr'rr-rr,rrr.rrrgrh_fixrirr[rrrrr\r^r`r/rbrZ raw_layerr )rlrr signatureZ extrahopsruZuptimermZtcp_typerrrrr(Z orig_optsZmss_hintZws_hintZts_hintroptZmaxmssZmaxwsr0Zts2Zsack_lenZ optstructZrand_valrr3)rrlr4p0f_impersonates              "        "   ""   $ $                           r))rrH)NNNrrN)@r __future__rrrrgr!Z scapy.datarrZ scapy.configrZ scapy.compatrrZ scapy.packetr Zscapy.layers.inetr r r Zscapy.layers.httpr rrZscapy.layers.inet6rZscapy.volatilerrrZ scapy.errorrZscapy.libs.sixrrZ _p0fpathsZp0f_baserrrrrrrrrfobjectr%rrrrrrrr|rrrrrrr)r3r3r3r4sf        6O x    ,