用scapython识别telnet协议_Python_Telnet_Scapy

用scapython识别telnet协议

python

用scapython识别telnet协议,python,telnet,scapy,Python,Telnet,Scapy,我正在和Scapy一起读Pcap文件。如何识别此pcap文件中是否存在使用Telnet协议的数据包我发现，只有当其中一个端口为23时，Scapy才能将“telnet”写入dport/sport，但如果我正在使用另一个端口进行telnet，我如何使用Scapy识别这个端口？尝试这样做 PcapReader（'your_file.pcap'）中的pkt的： #您可以尝试打印摘要以查看数据包打印（pkt.summary（）） #应该打印类似于 #IP/TCP 10.1.99.25:ftp_数据>1

我正在和Scapy一起读Pcap文件。如何识别此pcap文件中是否存在使用Telnet协议的数据包

我发现，只有当其中一个端口为23时，Scapy才能将“telnet”写入dport/sport，但如果我正在使用另一个端口进行telnet，我如何使用Scapy识别这个端口？

尝试这样做

PcapReader（'your_file.pcap'）中的pkt的

：
#您可以尝试打印摘要以查看数据包
打印（pkt.summary（））
#应该打印类似于
#IP/TCP 10.1.99.25:ftp_数据>10.1.99.2:telnet S
pkt_src=pkt[IP].src
pky_type=pkt[IP].type
pkt_payload=pkt[TCP]。有效负载
如果[…]

您可以打印pkt字典，查看

telnet

字符串可能位于哪个键下，并进行一些模式匹配

我在另一个stackoverflow回答中看到了直接使用PcapReader的建议，即不使用rdpcap获取内存，但我丢失了链接，TimRoberts在评论中说“Telnet与其他TCP协议无法区分”。这在某种程度上是正确的，因为所有TCP数据包都使用相同的结构，这在多个互联网工程任务组（IETF）征求意见（RFC）文件中概述：

以下是TCP数据包的结构

常见的应用程序协议，如超文本传输协议（HTTP）、文件传输协议（FTP）和Telnet都使用这种结构

关于应用协议Telnet。正如您已经知道的，telnet协议的官方端口分配是端口23。大多数供应商都遵守此端口标准，这就是为什么“只有当其中一个端口为23时，Scapy才能将‘telnet’写入dport/sport。”

这是使用端口23的Telnet会话的TCP层：

Layer TCP:
    Source Port: 1254
    Destination Port: 23
    Stream index: 0
    TCP Segment Len: 0
    Sequence number: 0    (relative sequence number)
    Sequence number (raw): 72603759
    Next sequence number: 1    (relative sequence number)
    Acknowledgment number: 0
    Acknowledgment number (raw): 0
    1010 .... = Header Length: 40 bytes (10)
    Flags: 0x002 (SYN)
    000. .... .... = Reserved: Not set
    ...0 .... .... = Nonce: Not set
    .... 0... .... = Congestion Window Reduced (CWR): Not set
    .... .0.. .... = ECN-Echo: Not set
    .... ..0. .... = Urgent: Not set
    .... ...0 .... = Acknowledgment: Not set
    .... .... 0... = Push: Not set
    .... .... .0.. = Reset: Not set
    .... .... ..1. = Syn: Set
    Expert Info (Chat/Sequence): Connection establish request (SYN): server port 23
    Connection establish request (SYN): server port 23
    Severity level: Chat
    Group: Sequence
    .... .... ...0 = Fin: Not set
    TCP Flags: \xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7S\xc2\xb7
    Window size value: 32120
    Calculated window size: 32120
    Checksum: 0x5d40 [unverified]
    Checksum Status: Unverified
    Urgent pointer: 0
    Options: (20 bytes), Maximum segment size, SACK permitted, Timestamps, No-Operation (NOP), Window scale
    TCP Option - Maximum segment size: 1460 bytes
    Kind: Maximum Segment Size (2)
    Length: 4
    MSS Value: 1460
    TCP Option - SACK permitted
    TCP Option - Timestamps: TSval 1444389, TSecr 0
    Timestamp value: 1444389
    Timestamp echo reply: 0
    TCP Option - No-Operation (NOP)
    TCP Option - Window scale: 0 (multiply by 1)
    Shift count: 0
    Multiplier: 1
    Timestamps
    Time since first frame in this TCP stream: 0.000000000 seconds
    Time since previous frame in this TCP stream: 0.000000000 seconds
    Kind: SACK Permitted (4)
    Kind: Time Stamp Option (8)
    Kind: No-Operation (1)
    Kind: Window Scale (3)
    Length: 2
    Length: 10
    Length: 3

这是使用端口3005的Telnet会话的TCP层：

Layer TCP:
    Source Port: 52187
    Destination Port: 3005
    Stream index: 0
    TCP Segment Len: 0
    Sequence number: 0    (relative sequence number)
    Sequence number (raw): 1355255000
    Next sequence number: 1    (relative sequence number)
    Acknowledgment number: 0
    Acknowledgment number (raw): 0
    1011 .... = Header Length: 44 bytes (11)
    Flags: 0x002 (SYN)
    000. .... .... = Reserved: Not set
    ...0 .... .... = Nonce: Not set
    .... 0... .... = Congestion Window Reduced (CWR): Not set
    .... .0.. .... = ECN-Echo: Not set
    .... ..0. .... = Urgent: Not set
    .... ...0 .... = Acknowledgment: Not set
    .... .... 0... = Push: Not set
    .... .... .0.. = Reset: Not set
    .... .... ..1. = Syn: Set
    Expert Info (Chat/Sequence): Connection establish request (SYN): server port 3005
    Connection establish request (SYN): server port 3005
    Severity level: Chat
    Group: Sequence
    .... .... ...0 = Fin: Not set
    TCP Flags: \xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7S\xc2\xb7
    Window size value: 65535
    Calculated window size: 65535
    Checksum: 0x0afb [unverified]
    Checksum Status: Unverified
    Urgent pointer: 0
    Options: (24 bytes), Maximum segment size, No-Operation (NOP), Window scale, No-Operation (NOP), No-Operation (NOP), Timestamps, SACK permitted, End of Option List (EOL)
    TCP Option - Maximum segment size: 1460 bytes
    Kind: Maximum Segment Size (2)
    Length: 4
    MSS Value: 1460
    TCP Option - No-Operation (NOP)
    TCP Option - Window scale: 6 (multiply by 64)
    Shift count: 6
    Multiplier: 64
    TCP Option - Timestamps: TSval 3609205717, TSecr 0
    Timestamp value: 3609205717
    Timestamp echo reply: 0
    TCP Option - SACK permitted
    TCP Option - End of Option List (EOL)
    Timestamps
    Time since first frame in this TCP stream: 0.000000000 seconds
    Time since previous frame in this TCP stream: 0.000000000 seconds
    Kind: No-Operation (1)
    Kind: Window Scale (3)
    Kind: No-Operation (1)
    Kind: No-Operation (1)
    Kind: Time Stamp Option (8)
    Kind: SACK Permitted (4)
    Kind: End of Option List (0)
    Length: 3
    Length: 10
    Length: 2
    TCP Option - No-Operation (NOP)
    TCP Option - No-Operation (NOP)

import pyshark

# the pcap is a Telnet session over port 3005
capture = pyshark.FileCapture('telnet-pcap-1.pcapng')
for packet in capture:
    if hasattr(packet, 'tcp'):
        layers = packet.layers
        #      0            1           2             3
        # [<ETH Layer>, <IP Layer>, <TCP Layer>, <DATA Layer>]
        if len(layers) > 3:
            payload = packet.tcp.payload

这是使用端口21的FTP会话的TCP层：

Layer TCP:
    Source Port: 35974
    Destination Port: 21
    Stream index: 0
    TCP Segment Len: 0
    Sequence number: 0    (relative sequence number)
    Sequence number (raw): 29473206
    Next sequence number: 1    (relative sequence number)
    Acknowledgment number: 0
    Acknowledgment number (raw): 0
    1010 .... = Header Length: 40 bytes (10)
    Flags: 0x002 (SYN)
    000. .... .... = Reserved: Not set
    ...0 .... .... = Nonce: Not set
    .... 0... .... = Congestion Window Reduced (CWR): Not set
    .... .0.. .... = ECN-Echo: Not set
    .... ..0. .... = Urgent: Not set
    .... ...0 .... = Acknowledgment: Not set
    .... .... 0... = Push: Not set
    .... .... .0.. = Reset: Not set
    .... .... ..1. = Syn: Set
    Expert Info (Chat/Sequence): Connection establish request (SYN): server port 21
    Connection establish request (SYN): server port 21
    Severity level: Chat
    Group: Sequence
    .... .... ...0 = Fin: Not set
    TCP Flags: \xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7S\xc2\xb7
    Window size value: 32648
    Calculated window size: 32648
    Checksum: 0x8fda [unverified]
    Checksum Status: Unverified
    Urgent pointer: 0
    Options: (20 bytes), Maximum segment size, No-Operation (NOP), Window scale, No-Operation (NOP), No-Operation (NOP), Timestamps
    TCP Option - Maximum segment size: 1380 bytes
    Kind: Maximum Segment Size (2)
    Length: 4
    MSS Value: 1380
    TCP Option - No-Operation (NOP)
    TCP Option - Window scale: 0 (multiply by 1)
    Shift count: 0
    Multiplier: 1
    TCP Option - Timestamps: TSval 1657560000, TSecr 0
    Timestamp value: 1657560000
    Timestamp echo reply: 0
    Timestamps
    Time since first frame in this TCP stream: 0.000000000 seconds
    Time since previous frame in this TCP stream: 0.000000000 seconds
    Kind: No-Operation (1)
    Kind: Window Scale (3)
    Kind: No-Operation (1)
    Kind: No-Operation (1)
    Kind: Time Stamp Option (8)
    Length: 3
    Length: 10
    TCP Option - No-Operation (NOP)
    TCP Option - No-Operation (NOP)

这是使用端口22的SSH会话的TCP层：

Layer TCP:
    Source Port: 57732
    Destination Port: 22
    Stream index: 0
    TCP Segment Len: 0
    Sequence number: 0    (relative sequence number)
    Sequence number (raw): 71043058
    Next sequence number: 1    (relative sequence number)
    Acknowledgment number: 0
    Acknowledgment number (raw): 0
    1011 .... = Header Length: 44 bytes (11)
    Flags: 0x002 (SYN)
    000. .... .... = Reserved: Not set
    ...0 .... .... = Nonce: Not set
    .... 0... .... = Congestion Window Reduced (CWR): Not set
    .... .0.. .... = ECN-Echo: Not set
    .... ..0. .... = Urgent: Not set
    .... ...0 .... = Acknowledgment: Not set
    .... .... 0... = Push: Not set
    .... .... .0.. = Reset: Not set
    .... .... ..1. = Syn: Set
    Expert Info (Chat/Sequence): Connection establish request (SYN): server port 22
    Connection establish request (SYN): server port 22
    Severity level: Chat
    Group: Sequence
    .... .... ...0 = Fin: Not set
    TCP Flags: \xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7S\xc2\xb7
    Window size value: 65535
    Calculated window size: 65535
    Checksum: 0xd079 [unverified]
    Checksum Status: Unverified
    Urgent pointer: 0
    Options: (24 bytes), Maximum segment size, No-Operation (NOP), Window scale, No-Operation (NOP), No-Operation (NOP), Timestamps, SACK permitted, End of Option List (EOL)
    TCP Option - Maximum segment size: 1460 bytes
    Kind: Maximum Segment Size (2)
    Length: 4
    MSS Value: 1460
    TCP Option - No-Operation (NOP)
    TCP Option - Window scale: 6 (multiply by 64)
    Shift count: 6
    Multiplier: 64
    TCP Option - Timestamps: TSval 1452973307, TSecr 0
    Timestamp value: 1452973307
    Timestamp echo reply: 0
    TCP Option - SACK permitted
    TCP Option - End of Option List (EOL)
    Timestamps
    Time since first frame in this TCP stream: 0.000000000 seconds
    Time since previous frame in this TCP stream: 0.000000000 seconds
    Kind: No-Operation (1)
    Kind: Window Scale (3)
    Kind: No-Operation (1)
    Kind: No-Operation (1)
    Kind: Time Stamp Option (8)
    Kind: SACK Permitted (4)
    Kind: End of Option List (0)
    Length: 3
    Length: 10
    Length: 2
    TCP Option - No-Operation (NOP)
    TCP Option - No-Operation (NOP)

如前所述，这些TCP层几乎无法区分。因此，试图单独使用TCP层将很难通过端口23以外的端口确定Telnet会话。因此，尝试使用Scapy来识别这些会话而不进行更深入的数据包分析将是极其困难的

您可以分析TCP数据包的数据层，以确定连接是否为Telnet会话。这同样需要大量的工作，除非您已经做了一定程度的流量分析

使用Python模块pyshark可以从数据层提取内容

端口23上的Telnet会话：

import pyshark

# the pcap is a Telnet session over port 23
capture = pyshark.FileCapture('telnet-raw.pcap')
for packet in capture:
    if hasattr(packet, 'tcp'):
        layers = packet.layers
        #      0            1           2             3
        # [<ETH Layer>, <IP Layer>, <TCP Layer>, <DATA Layer>]
        if len(layers) > 3:
            payload = packet.tcp.payload

输出中的第四个和第五个十六进制字符串是破译可能发生的TCP连接类型的重要部分

import binascii

hex_data = '0d:0a:4f:70:65:6e:42:53:44:2f:69:33:38:36:20:28:6f:6f:66:29:20:28:74:74:79:70:31:29:0d:0a:0d:0a6c:6f:67:69:6e:3a:20 '
hex_string = ' '.join(hex_data.split('0d:0a')).replace(':', '')
hex_list = hex_string.split()
for item in hex_list:
    decoded_string = binascii.unhexlify(item)
    print(decoded_string)
    # output 
    b'OpenBSD/i386 (oof) (ttyp1)'
    b'login: '

import binascii

hex_data = '0d:0a:55:73:65:72:20:41:63:63:65:73:73:20:56:65:72:69:66:69:63:61:74:69:6f:6e:0d:0a:0d:0a:55:73:65:72:6e:61:6d:65:3a:20'

# removing line breaks from the hex string
hex_string = ' '.join(hex_data.split('0d:0a')).replace(':', '')
hex_list = hex_string.split()
for item in hex_list:
    decoded_string = binascii.unhexlify(item)
    print(decoded_string)
    # output 
    b'User Access Verification'
    b'Username: '

在解码十六进制之后，我们可以看到认证正在通过端口23进行

端口3005上的Telnet会话：

Layer TCP:
    Source Port: 52187
    Destination Port: 3005
    Stream index: 0
    TCP Segment Len: 0
    Sequence number: 0    (relative sequence number)
    Sequence number (raw): 1355255000
    Next sequence number: 1    (relative sequence number)
    Acknowledgment number: 0
    Acknowledgment number (raw): 0
    1011 .... = Header Length: 44 bytes (11)
    Flags: 0x002 (SYN)
    000. .... .... = Reserved: Not set
    ...0 .... .... = Nonce: Not set
    .... 0... .... = Congestion Window Reduced (CWR): Not set
    .... .0.. .... = ECN-Echo: Not set
    .... ..0. .... = Urgent: Not set
    .... ...0 .... = Acknowledgment: Not set
    .... .... 0... = Push: Not set
    .... .... .0.. = Reset: Not set
    .... .... ..1. = Syn: Set
    Expert Info (Chat/Sequence): Connection establish request (SYN): server port 3005
    Connection establish request (SYN): server port 3005
    Severity level: Chat
    Group: Sequence
    .... .... ...0 = Fin: Not set
    TCP Flags: \xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7S\xc2\xb7
    Window size value: 65535
    Calculated window size: 65535
    Checksum: 0x0afb [unverified]
    Checksum Status: Unverified
    Urgent pointer: 0
    Options: (24 bytes), Maximum segment size, No-Operation (NOP), Window scale, No-Operation (NOP), No-Operation (NOP), Timestamps, SACK permitted, End of Option List (EOL)
    TCP Option - Maximum segment size: 1460 bytes
    Kind: Maximum Segment Size (2)
    Length: 4
    MSS Value: 1460
    TCP Option - No-Operation (NOP)
    TCP Option - Window scale: 6 (multiply by 64)
    Shift count: 6
    Multiplier: 64
    TCP Option - Timestamps: TSval 3609205717, TSecr 0
    Timestamp value: 3609205717
    Timestamp echo reply: 0
    TCP Option - SACK permitted
    TCP Option - End of Option List (EOL)
    Timestamps
    Time since first frame in this TCP stream: 0.000000000 seconds
    Time since previous frame in this TCP stream: 0.000000000 seconds
    Kind: No-Operation (1)
    Kind: Window Scale (3)
    Kind: No-Operation (1)
    Kind: No-Operation (1)
    Kind: Time Stamp Option (8)
    Kind: SACK Permitted (4)
    Kind: End of Option List (0)
    Length: 3
    Length: 10
    Length: 2
    TCP Option - No-Operation (NOP)
    TCP Option - No-Operation (NOP)

import pyshark

# the pcap is a Telnet session over port 3005
capture = pyshark.FileCapture('telnet-pcap-1.pcapng')
for packet in capture:
    if hasattr(packet, 'tcp'):
        layers = packet.layers
        #      0            1           2             3
        # [<ETH Layer>, <IP Layer>, <TCP Layer>, <DATA Layer>]
        if len(layers) > 3:
            payload = packet.tcp.payload

输出中的第三个十六进制字符串是破译可能发生的TCP连接类型的重要部分

import binascii

hex_data = '0d:0a:4f:70:65:6e:42:53:44:2f:69:33:38:36:20:28:6f:6f:66:29:20:28:74:74:79:70:31:29:0d:0a:0d:0a6c:6f:67:69:6e:3a:20 '
hex_string = ' '.join(hex_data.split('0d:0a')).replace(':', '')
hex_list = hex_string.split()
for item in hex_list:
    decoded_string = binascii.unhexlify(item)
    print(decoded_string)
    # output 
    b'OpenBSD/i386 (oof) (ttyp1)'
    b'login: '

import binascii

hex_data = '0d:0a:55:73:65:72:20:41:63:63:65:73:73:20:56:65:72:69:66:69:63:61:74:69:6f:6e:0d:0a:0d:0a:55:73:65:72:6e:61:6d:65:3a:20'

# removing line breaks from the hex string
hex_string = ' '.join(hex_data.split('0d:0a')).replace(':', '')
hex_list = hex_string.split()
for item in hex_list:
    decoded_string = binascii.unhexlify(item)
    print(decoded_string)
    # output 
    b'User Access Verification'
    b'Username: '

解码十六进制后，我们可以看到端口3005上正在发生某种类型的身份验证。需要进行额外的分析，以确定此会话是Telnet会话还是其他会话。

实际上，您不能。Telnet与其他TCP协议无法区分。Telnet不是一个协议。