Refactoring requirements:
1) make it class with class methods, not a script
2) has to keep an internal state (NOMINAL/HACKED), and the OtaHack class should be instantiated for each Debian target (something like: h = OtaHack(targetIp)
3) Methods:
def uploadFile(self, filename)->(bool,str):
"""
Attempt to upload file.
Returns a tuple - bool for was upload succesfull (true/false),
and string containing the server request/response (so it can be displayed on hacker kiosk)
"""
pass
def getStackAddress(self)->(bool,str):
"""
Attempt to get stack address by sending a malicious filename that leaks the stack address.
Returns a tuple - bool for was the attempt succesfull (true/false),
and string containing the server request/response (so it can be displayed on hacker kiosk)
Exceptions must be handled as the connection might be killed by SSITH hardware.
"""
pass
def changeSecretKey(self)->(bool,str):
"""
Attempt to change the secret key to zeros, after the stack address has been recovered.
Returns a tuple - bool for was the attempt succesfull (true/false),
and string containing the server request/response (so it can be displayed on hacker kiosk)
Exceptions must be handled as the connection might be killed by SSITH hardware.
"""
pass
def hackServer(self)->(bool,str):
"""
First attempt to get stack address, then attempt to change the secret key.
Server is hacked only if both operations are successfull. Only then an arbitrary file can be uploaded.
"""
pass
4) needs to be imported into HackerKiosk python backend - maybe add it as a part of cyberphyslib module for simplicity?
Initial work: https://github.com/GaloisInc/BESSPIN-Tool-Suite/blob/develop/besspin/cyberPhys/hacking/hack-ota.py
Sequence of the full hack:![OTA_server_hack_sequence](https://user-images.githubusercontent.com/2790461/121063952-d138d680-c77b-11eb-8f3b-b2f6490597a8.png)
Refactoring requirements: 1) make it class with class methods, not a script 2) has to keep an internal state (NOMINAL/HACKED), and the
OtaHack
class should be instantiated for each Debian target (something like:h = OtaHack(targetIp)
3) Methods:4) needs to be imported into HackerKiosk python backend - maybe add it as a part of
cyberphyslib
module for simplicity?