Developing a TCP Network Proxy - Pwn Adventure 3
VloĆŸit
- Äas pĆidĂĄn 21. 06. 2018
- Part 9: To analyse the game traffic, we are developing a simple proof of concept TCP network proxy. Then we can start to reverse engineer the protocol.
GitHub: github.com/LiveOverflow/PwnAd...
đŽ Playlist: âą Pwn Adventure 3: Pwnie...
=[ đŽ Stuff I use ]=
â Microphone:* geni.us/ntg3b
â Graphics tablet:* geni.us/wacom-intuos
â Camera#1 for streaming:* geni.us/sony-camera
â Lens for streaming:* geni.us/sony-lense
â Connect Camera#1 to PC:* geni.us/cam-link
â Keyboard:* geni.us/mech-keyboard
â Old Microphone:* geni.us/mic-at2020usb
US Store Front:* www.amazon.com/shop/liveoverflow
=[ â€ïž Support ]=
â per Video: / liveoverflow
â per Month: / @liveoverflow
=[ đ Social ]=
â Twitter: / liveoverflow
â Website: liveoverflow.com/
â Subreddit: / liveoverflow
â Facebook: / liveoverflow
=[ đ P.S. ]=
All links with "*" are affiliate links.
LiveOverflow / Security Flag GmbH is part of the Amazon Affiliate Partner Programm.
#PwnAdventure #NetworkSecurity #CTF
![DEEP CYCLE SYSTEMS [DCS] DEFAMATION CASE [UPDATE 4]](http://i.ytimg.com/vi/XdTSbNJWclY/mqdefault.jpg)
LOVE YOUUUUU! KEEP IT UP!!
Seriously, this CZcams series is some of the highest level stuff Iâve ever seen. â€ïž
same
LOL as lots of love
This is so awesome!!! I'm taking out of it some python i didn't know too âș
Yep, I also binge watched the whole thing and can not wait for the next part to be released! Also, author has really good feel of what is interesting and what is dumb and technical. At least from my perspective. I really like it!
Actually it is low level stuff he is doing.
I just want you to know that when I saw this I actually jumped with joy. The content you make has such a powerful positive effect on a lot of people and, at least for me, motivates. So thank you
I've been watching all of these today, and HOLY moly this is fun and exciting! You take all the in-the-weeds stuff and call it out for being frustrating and tough, which is really validating. A lot of these tests just take confidence and willingness to potentially waste time - or as I feel after watching this, learn stuff but make less progress than I hoped.
Thank you, big thank you :))))))))))) I love it
TIL your can reload modules in python
Simon816 in python 3 the âreloadâ function has been moved to âimportlibâ tho
jeez that was a smart move right :)
had a similar experience with lua lately. turns out `require(name)` does its caching magic by just always returning `package.loaded[name] or some_complicated_load_logic(name)`. guess what happens if you `require("package").loaded[name]=nil`.
can also be exploited in reverse: `require("package").loaded._some_dummy_global={}` makes every `require("_some_dummy_global")` (even though that module doesn't exist) in THE WHOLE VM (no matter the global environment being sandboxed, it living in another thread, etc) access the same table.
You changed my perspective about programming and networking and made it so much fun .. Great work .. Keep it up ..
Your voice is SO chilling omg. Awesome vid as always! ;)
Over 2 years old and only 250 comments - I owe you a comment on this one then. Loving the playlist! Loving the content! Think of the effect you've had on so many people's education; you're more effective than many teachers and I think it's just your hobby?! :) Great work; be proud
this, is, awesome! i never knew you could reload libraries mid python script and that totally blew my mind!
Oh man the way you handled the parser with the reload and exception catcher is pretty smart. If it was me I'd probably just end restarting the whole thing a billion times and cursing
Finally I love this series. It is my favourite series!
Nice! I love this series so much keep going!
Thank you so much!! Please never stop youtube, i love you :D.
Excited for this one!! Thanks!!
Nice video. Well done. Keep on. I think the data at the end show us the result of the soccer match tomorrow (GER - SWE).
You are a monster. I love your videos, please keep on doing, you're amazing at this
This helped me fix an issue where I was doing Thread.run() instead of Thread.start() thanks for fixing a totally unrelated issue.
Boy I just love the Pwn Adventure 3 videos
I worked along with this and made a script a lot like this(Python3), this works for A LOT of games. Thank you sir i can't thank you enough!
Do you know how to connect the client to the proxy for other online games? I tried to edit the host file to map proxy IP to game's host name, but it doesn't work :/
@@nifengjujuzhang8429 Did you found a solution?
Best series on CZcams right here no doubt about it
Nice introduction to proxies and to Python ! You are great
Hopefully he learns Python 3 though. :D
such an amazing work man thanks , keep your works up :) đ€
Dude this is amazing! Great videos!
DUUUUDE THAT CLIFFHANGER
I WANT THNEXT EPISODE NOOOOOW
but I understand these take alot of hard work to make, keep it up, you're doing great. Don't rush anything :)
PS you deserve more views
Makes me think of that one episode of Star Trek: TNG with "kiddie Picard"..
czcams.com/video/L7ergVR6sb4/video.html
cliffhanger? 11:37 shows the player's X Y Z positions sent to the server. see also 12:04
Thanks you for all of your videos !!!
Wow, wirklich die beste Serie auf CZcams! Mach weiter so! Finde es auch sehr gut erklĂ€rt fĂŒr Leute die sich nicht so mit den sonst so krassen Dingen auf deinem Kanal auskennen ^^ und ich konnte n paar Sachen fĂŒr Python an sich lernen :D đ
Ich stimme dir zu, ich bin gespannt auf mehr!
(Ich bin ein AnfÀnger auf Deutsch, Entschuldigung.)
Scott passt schon :D wenn ich dir helfen darf: "AnfÀnger in Deutsch" ;)
Vielen Dank!! Ich schÀtze es! Es ist einfacher zu lesen als zu schreiben.
Great content, learning lots here :D keep it up
Seriously a awesome adventure
So creative, keep it up dude!
Great info, keep up the excellent work
This is the kind of "Let's plays" I want (:
Ok so I never knew about the reload method and wow is that going to be VERY useful in the future
TCP socket is not packet-based, but stream. Assuming that each read operation will always hit the internal protocol packet boundaries will sometimes fail. IP stacks in all end-points can in there buffering split and join up data as they see fit
awesome use of reload
Loved it!!
I recently wrote an elevator attack simulator for university research that emulated sockets in python using pipes and we performed MitM attacks in a similar way (just locally instead of over the network). I WISH I HAD KNOWN ABOUT THE ABILITY TO RELOAD!!!! Every time we wanted make changes to our parser we had to kill it all and start over, so stupid!
Itâs always the little things *facepalm*. This series is awesome keep it up!
I bet you will never forget that xD
liveoverflow is like "I'm not an expert but.." then proceeds to do the thing amazingly well
One interesting idea is to issue commands to the network proxy via chat. You can even use a custom ASCII control character like ESC and invoke the commands from code you have overwritten with LD_PRELOAD! (Maybe custom keybindings or something)
Your Channel is so great ! ^^
What?! I've reached the end of the playlist? It's 3:00 AM and I want moar of this :D
Love your series and how you explain everything!
Do you know how to connect the client to the proxy for other online games? I tried to edit the host file to map proxy IP to game's host name, but it doesn't work :/
WoW, you amazed me.
This video deserves millions of like
a wonderful video again
You could also place socket hooks in the game itself, instead of creating a proxy. You should look into hooking the send and recv functions.
GODLIKE!
Protip: Set self.daemon = True in the threads. No need to kill the script then.
Cleanup may be skipped for the threads on exit as they are just killed if the script receives a SIGINT, but that's also the case when you just kill the script and still good enough for a hacky proxy.
Wow! I never know that it's possible to reload modules during runtime in python. Cool!
well done . ther i only respect i have throw you . i wish you all the best :)
Fr easy to understand tutorial
Question. Around 11 minutes the python script was being modified while also being ran. Is this possible or was it just video editing?
I tried with my own python packet sniffer script and it just continues to run. Tried googling around as well.
Been going through your past videos as I learn more and gain confidence, thank you for making them
Nice!
I've written a shitload of python over the last couple of years, but I haven't seen anything as cool as the `reload` function in months. Mind blown.
At the end gives possibility to manipulate position also gives pointers to write advanced hacking trainers or etc... so can go wild with that.
hex-encoded floating point triples for location data
I know I'm late, but you might want to take a look at tera-proxy, it's related to this.
Very rare that a game doesn't use encrypted packets but a good start.
while i try to start the file, with the ip and port, i receive this error: socket.error: [Errno 10013] An attempt was made to access a socket in a way forbidden by its access permissions.
using python 2.7
Thank you sir
What would need to be change to develop a UDP proxy? (ex. change socket type, ...etc.)
I'd gone for a simpler approach, hooking the functions the game uses to send and receive data. A proxy, however, is a fairly more universal approach. Not to mention it works just well since the packets aren't encrypted.
Gonna try to implement a generic game-proxy in vb.net. If i know the encryption method would it be possible to decrypt and encrypt the data on the fly or would it be a problem performance wise (packet loss or something) ?
And nice video mate i always wanted to do something like this but i didn't came up with a concept.
this is so useful. i do have a problem, i'm getting an error because the port that the game client sends requests from is already in use. the "socket.SOL_SOCKET, socket.SO_REUSEADDR, 1" option did nothing unfortunately. how can i get over this?
Hey, great stuff. Quick question: what would you do if you couldn't use hosts file? How can you translate destination IP address so it could go to your proxy (on Windows)?
You have to hook the connect function from windows socket dll in the game then change ip to your proxy. You can use detours or easyhook.
wait , i don't understand , proxy might be impossbiel with the ash code that the server had??
so why u can use those datas?
4:59 you can hear a quiet Discord notification sound ;)
wow
can u mention any good resources for learning disassembly using gdb ?
I hav started my information security career and wanna study malware analysis .So it starts with reverse engineering.
Just learning by doing and google the instructions you donât understand etc. keep an eye out for repeating patterns in the assembly code.
I started with proxy, turns out I should've gone to messing with binaries. Mine one is running on node.js, because for some reason JavaScript is the language that is easiest for me
Where are you getting the IP from that you put into your HOST file and the master.pwn3 part from???? And how are you opening python to look like that? The latest python when I open it, only shows me a command window?????
In the Proxy class, run function, why is everything inside a While True loop? Wouldn't that mean that it would create new game2proxy and Proxy2Server every iteration?
Thanks
The one call is waiting until a client connects. And only then the loop continues and creates a new object to wait for the next player.
Thanks! I completely forgot about multiple players...
LiveOverflow I'm sorry, but what do you mean by "the one call"?
great I'll make one
I need help somebody i followed tutorial and everytime i open my python script in terminal it just says setting up proxy and never actually shows packets please help
The next video is already the 10th in this series! Time flies!
How did you create your animated diagrams? I'm using Impress with SVG animation export now but would be keen to hear about nicer methods.
Photoshop and Premiere. But Iâm not that happy with the process
how do you get what ports are uses for client/server? Cant find that video
well im still confused about the 3002 to 3006 ports for example my game here when i get to log in there is a label says its a 5555 port and when i use wireshark there is no port other than 5555 so im confused over what should i do about this can anyone help ?
Nice
We should make this video be a trending video on youtube đž
Can you make a guide specifically on making Python proxy servers?
can you do that to other online games? like a legends of league, fornite, dota 2
Can your proxy code be used to forward and intercept udp packets as well?
You would need to change SOCK_STREAM to SOCK_DGRAM for each socket declaration
I'm trying to make a proxy server but with an online server. But I can't find a fff way to redirect outgoing traffic to localhost! Hosts don't help.
What is the reason he only receives 4096 bytes from the Game Server??
In this video you can develop a proxy as the game server is accessed via DNS name (game.pwn3): what you can do if the game server is accessed using IP addresses?
Ip spoofing.
Hey man, did you figure it out?
Hi I'm not experience with python 2 can you say what super(Proxy2Server,self).__init__() means?
Next level shitđ±đâ
Im confused your pointing the same address to 2 different things in the host file??
hello, how can we add client's server ip address to Proxy2Server automatically.
I get socket.error: [Errno 10013] An attempt was made to access a socket in a way forbidden by its access permissions error
Cheeses. I just finished watching this after the previous 8 in a row, and I have to tell you... I am starting to feel like someone watching a baseball game, and it's the fourth inning and people are starting to notice that the pitcher only thrown strikes and not a single player from the opposing team has gotten on base the whole game.
Why is there a while true in Proxy .run ?
one thing I don't understand is, why do you have both the g2p and p2s inside the run method inside a while loop? why do we need the while loop?
Because we have to receive packets from the game, g2p. And then directly forward them to the player p2s.
@@LiveOverflow I tried to make a little example of the sockets and to my surprise it worked without the whole loop inside the Proxy class
Why are you using the buffer size of 4096 for receiving files? How did you figure out that you need that value? Or was it just the thought "to have the buffer big enough"?
Big enough
Because the data was probably too big to receive
this would be soooooo easy and efficient to implement in Golang
Watched video, got and idea on how to improve this script... and then found a bug in our production code while testing my idea. That is a like
Tell me more :P
Well, first of all I thought that Ctrl+C in your case does not work because you wrapped the whole logic in try catch Exception. And KeyboardInterrupt (Ctrl+C) is subclass of Exception. I was about to comment but I wanted to double check first. I did not want to setup the game so I was testing on one service. And I realized that my client actually changes its server once every 3-4 minutes and the range of IPs is unknown to me and cannot be predicted. And this logic is normal nowadays as most MMOs either use several servers to balance server load. That is when I found out that Wireshark is not able to track traffic per application (at least out of the box, of course custom modules can be written). So I started to make my own script using psutil.net_connections() and filtering results for needed pid then intercepting packets for all those connections. And that is where I saw TCP handshake: SYN -> SYN-ACK -> ACK was broken.
Can you by chance create a proxy for ragnarok online?
I don't understand why implementation on master server is necessary. Can't we just implement the proxy connecting to the game server? Meaning the user manually logs in, then runs the tcp proxy.
I'm trying to do the same with an android game, I'm using CCProxy to receive the package and WPE PRO for analysis. But I only have the ip in numbers (without DNS), the host file does not accept only numbers, do you have any suggestions as I could do?
@@BluBOo_ found a solution?
@@BluBOo_ some programes that proxy server in the adroid games called hex bot 7
How can you dislike this video? :O
What if the port is static?
Are you participating in the Google CTF this weekend?
Hi, wie heiĂt der Texteditor den du benutz?
Das ist Sublime Text www.sublimetext.com/