Vortex level0, while still learning C....

I have been playing around with overthewire.org first levels of wargame(s) a few times before. Its a golden opportunity for me now to do them in C.
Althou going over the "C-socket hill" was pretty tough, i finally managed it!

The first one i solved was vortex level0.

I did it a few different ways and ended up with a tidy code (i think):

vortex_level0.c

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netdb.h>

#define HOST "vortex.labs.overthewire.org"
#define PORT "5842"

int sockfd();
int connect_host();
int handle_uints();
int get_tze_pass();

int main()
{
    int socket;
    socket = sockfd();
    connect_host(socket);
    handle_uints(socket);
    get_tze_pass(socket);
    close(socket);
    return 0;
}

int sockfd()
{
    return socket(AF_INET, SOCK_STREAM, 0);
}
int connect_host(int socket)
{
    struct addrinfo hostname, *p;
    memset(&hostname, 0, sizeof(hostname));
    hostname.ai_family = AF_INET;
    hostname.ai_socktype = SOCK_STREAM;

    getaddrinfo(HOST,PORT, &hostname, &p);
    connect(socket, p->ai_addr, p->ai_addrlen);
   
    return 0;
}
int handle_uints(int socket)
{
    int uints[4], i, sum = 0;
    for (i = 0; i < 4; i++) {
        read(socket, &uints[i], 4);
    }
    for (i = 0; i < 4; i++) {
        sum = sum + uints[i];
    }
    send(socket, &sum, sizeof(sum), 0);
    return 0;
}
int get_tze_pass(int socket)
{
    char login[18];
    recv(socket, &login, sizeof(login), 0);
    printf("%s\n", login);
    recv(socket, &login, sizeof(login), 0);
    printf("%s\n", login);
    return 0;
}

A game of Craps (Ruby and Java)

This week i have been reading lots about c language and "programming logics and design". We are supposed to learn C programming and develop a game in the end of this module assignment.

In one example we are writing a game of craps in c... C is just too much typing, and hard to keep control over all syntax' for a newbie, but still learning! :D
Although we are programming in C, i first wrote the program in ruby wich gave me a much clearer understanding of what to do in C.(except from classes and rest of easy ruby syntaxes)

Even if you don't know much about programming, i guess you should be able to understand what the program does.

class Craps

    def initialize

        puts "A game of craps"

        first_roll

    end

    def first_roll

        roll = roll_dice

        case roll

        when 7,11

            game_won

        when 2,3,12

            game_lost

        else

            puts "Your point is: " + roll.to_s

            @my_points = roll

            keep_rolling

        end

    end

    def roll_dice

        #dice = (1+rand(6)) + (1+rand(6))

        die1 = 1+rand(6)

        die2 = 1+rand(6)

        dice = die1 + die2

        puts "You rolled: #{die1} + #{die2} = #{dice}"

        return dice

    end

    def game_won

        puts "You win"

        exit

    end

    def game_lost

        puts "You lose"

        exit

    end

    def keep_rolling

        roll = roll_dice

        case roll

        when @my_points

            game_won

        when 7

            game_lost

        else

            while roll

                case roll_dice

                when @my_points

                    game_won

                when 7

                    game_lost

                end

            end

        end

    end

end

play = Craps.new

# Output:

# A game of craps

# You rolled: 5

# Your point is: 5

# You rolled: 12

# You rolled: 8

# You rolled: 5

# You win

I will not paste the C program here, since its pretty similar to the example in "C how to program" by Deitel and Deitel. Boooring! >)

A game of craps (Java)

The java version is just the same. The java syntax' are pretty easy to learn after studying C the last couple of weeks. Java is the language to learn if i ever want to make an android app... but... do i? o_O

I seem to love this game... maybe not, but its an easy way to learn, among other well written programs.

import java.util.Random;

class Craps {

private Random randomizeDice = new Random();

int my_point;

int roll = 0;

public void game_won() {

System.out.println("You win!");

System.exit(0);

}

public void game_lost() {

System.out.println("You lose!");

System.exit(0);

}

public void first_roll() {

roll = roll_dice();

switch (roll) {

case 7:

case 11:

game_won();

case 2:

case 3:

case 12:

game_lost();

default:

my_point = roll;

System.out.println("Your point is: " + my_point);

}

}

Low Interaction honeypots

I have the last two weeks been playing around with a few low interaction honeypots. Sure it would be preferable to install a high interaction honeypot, but since im doing this on a virtual machine i didnt dare go that way. I ended up with two different systems running on the same machine, Dionaea and Kippo.

Honeywall
Althou its not necessary to use a honeywall while using low interaction honeypots i wanted to build my own honeywall for this project, wich main purpose was to log everything going in and out from the honeynet. I built my "wall" using OpenBSD-5.0 with snort-2.9.2 installed. In addition to snort, i used tcpdump and pf-logging as DCAP.
Regarding DCON i used pf to block and allow traffic to and from my honeypot. Session limit and snort_inline on outgoing connections would be preferable - but again i didnt feel this was critical for my honeynet, since i was using low interaction honeypots. (snort_inline isnt supported under obsd if i understand correctly)
So far this wall is working properly, but i need to know more about how to use my wall in a honeynet with high interaction honeypots and build a more userfriendly interface to use with snort and loggings.
Snort was a pain in the arse to install on OBSD, but eventually i got it up and running.

Kippo
Its important to change the common signatures hackers can see immediately after connecting to the "kippo".
The first guy who got access to my kippo-honeypot saw the most common signature(uptime 14 days IE), and logged off immediatly afterwards. Uptime is the first thing to change, among other things found in base.py. To make it abit more realistic i could also make a new filesystem, clone of a real file system (after you sanitize it for personal info and... what ever:-)


 Dionaea
I didnt do anything after installing and start this service. So far ive captured a few binaries, and one of those binaries are unique. I find this honeypot pretty cool, but so far i havent had the time to check out all of its futures nor the complete logs. More to come regarding the logs and captured malware, hopefully.