GaloisInc / BESSPIN-Tool-Suite

The core tool of the BESSPIN Framework.
Other
5 stars 2 forks source link

Refactor hack-ota script into a class #1191

Closed podhrmic closed 3 years ago

podhrmic commented 3 years ago

Initial work: https://github.com/GaloisInc/BESSPIN-Tool-Suite/blob/develop/besspin/cyberPhys/hacking/hack-ota.py

Sequence of the full hack: OTA_server_hack_sequence

Refactoring requirements: 1) make it class with class methods, not a script 2) has to keep an internal state (NOMINAL/HACKED), and the OtaHack class should be instantiated for each Debian target (something like: h = OtaHack(targetIp) 3) Methods:

def uploadFile(self, filename)->(bool,str):
    """
    Attempt to upload file.
    Returns a tuple - bool for was upload succesfull (true/false),
    and string containing the server request/response (so it can be displayed on hacker kiosk)
    """
    pass

def getStackAddress(self)->(bool,str):
    """
    Attempt to get stack address by sending a malicious filename that leaks the stack address.
   Returns a tuple - bool for was the attempt succesfull (true/false),
    and string containing the server request/response (so it can be displayed on hacker kiosk)
    Exceptions must be handled as the connection might be killed by SSITH hardware.
    """
    pass

def changeSecretKey(self)->(bool,str):
    """
    Attempt to change the secret key to zeros, after the stack address has been recovered.
   Returns a tuple - bool for was the attempt succesfull (true/false),
    and string containing the server request/response (so it can be displayed on hacker kiosk)
    Exceptions must be handled as the connection might be killed by SSITH hardware.
    """
    pass

def hackServer(self)->(bool,str):
    """
    First attempt to get stack address, then attempt to change the secret key.
   Server is hacked only if both operations are successfull. Only then an arbitrary file can be uploaded.
    """
   pass

4) needs to be imported into HackerKiosk python backend - maybe add it as a part of cyberphyslib module for simplicity?

podhrmic commented 3 years ago

Fixed in #1195