全端口监控的实现

用户1423082

发布于 2024-12-31 10:35:47

10000

代码可运行

文章被收录于专栏：giantbranch's bloggiantbranch's blog

运行总次数：0

代码可运行

方式1

一个是通过抓包，一旦收到SYN，就回复一个SYN ACK 但是这个需要iptables将出去的RST ACK包给拦截掉

#!/usr/bin/env python
# -*- coding: utf-8 -*-
# @Date    : 2018-07-23 14:50:27
# @Author  : giantbranch (giantbranch@gmail.com)
# @Link    : http://www.giantbranch.cn/
# @tags : 

from scapy.all import *

SSH_PORT = 22

# 定义数据包回调函数
def packet_callback(packet):
    # print packet.show()
    if TCP in packet:
        if packet["TCP"].dport == SSH_PORT or packet["TCP"].sport == SSH_PORT:
            return
        # SYN packet
        # 如果我们接收到一个SYN包，则我们构造一个SYN ACK包返回去。
        if packet["TCP"].flags == 0x02:
            # print "receive SYN packet"
            ip = IP(dst=packet["IP"].src, src=packet["IP"].dst)
            tcp = TCP(sport=packet["TCP"].dport, dport=packet["TCP"].sport)
            # syn ack flags
            tcp.flags = 0x012
            tcp.ack = packet["TCP"].seq + 1
            send(ip/tcp)
        # FIN ACK packet 
        # 如果我们接收到一个FIN ACK包，我们则返回一个ACK包。否则他会重传。
        elif packet["TCP"].flags == 0x011:
            # print "receive SYN packet"
            ip = IP(dst=packet["IP"].src, src=packet["IP"].dst)
            tcp = TCP(sport=packet["TCP"].dport, dport=packet["TCP"].sport)
            # ack flags
            tcp.seq = packet["TCP"].ack
            tcp.ack = packet["TCP"].seq + 1
            send(ip/tcp)
        # PSH ACK packet
        elif packet["TCP"].flags == 0x018:  
            # print "receive PSH ACK packet"
            if packet.haslayer("Raw"):
                print "payload is:\n"
                print packet["Raw"]
        else:
            print "tcp flags is : %s" % packet["TCP"].flags
    elif UDP in packet:
        pass
        # print "this is a udp packet"
    else:
        pass

sniff(prn=packet_callback, store=0)

iptables

iptables -A OUTPUT -p tcp --tcp-flags ALL RST,ACK -j DROP

那这样nmap扫描的时候就会以为端口都开放了

方式2

通过iptables直接做一个全端口转发，转发到你自己写的程序的端口即可

If you want to redirect all TCP and UDP traffic to Blackhole use the following command:

sudo iptables -t nat -A PREROUTING -p tcp --dport 1:65535 -j REDIRECT --to-ports 5000
sudo iptables -t nat -A PREROUTING -p udp --dport 1:65535 -j REDIRECT --to-ports 5000

Suppose you have other services running on the Host e.g. 22, 445 and you don’t want to capture them via Blackhole,you can create multiple iptables rules:

sudo iptables -t nat -A PREROUTING -p tcp --dport 1:21 -j REDIRECT --to-ports 5000
sudo iptables -t nat -A PREROUTING -p tcp --dport 23:444 -j REDIRECT --to-ports 5000
sudo iptables -t nat -A PREROUTING -p tcp --dport 446:65535 -j REDIRECT --to-ports 5000