dankwiki

Omphalos: Difference between revisions

← Older edit

Dank (talk | contribs)

2 user groups
11,302 edits
include the data organization document from github
 
(69 intermediate revisions by the same user not shown)
Line 1: Line 1:
[[File:omphalos-2011-07-23.png|thumb|right|Two omphalos processes, 2011-07-23]]
[[File:omphalos.png|right]]
A tool for network enumeration, protection, evaluation, and subjugation. Omphalos makes use of passive and active portscanning, DNS/DHCP/[[Zeroconf]] server interrogation, portknock detection, covert channel detection and establishment, ARP scanning, automatic WEP cracking, man-in-the-middling, and a whole host of other tricks. GPS integration? Oh yes. Coordination across multiple interfaces? Of course. Use of Linux's MMAP_RX_SOCKET and MMAP_TX_SOCKET? Wouldn't have it any other way. Userspace networking is made visible to the host via a TUN/TAP device. While designed as an offensive tool, omphalos has proven useful to me for network debugging and troubleshooting, as well as experimentation.
[[File:omphalos-2011-12-01.jpg|thumb|right|Three omphalos processes, 2011-12-01]]


Omphalos is not a "''point-and-click''" tool so much as "''pull the pin''" or perhaps "''spray the area''". Default behavior is to redirect and seize all traffic, attack weak cryptosystems, archive authentication materials, and learn everything that can be learned. Ideally, a tiny microprocessor would be paired with power and a network device, stealthily physically inserted into a network, and left there; <tt>omphalos</tt> and [[Hackery#liburine|liburine]] would then combine to provide complete network dominance. I hope to combine network programming and high-performance computing to create a tool capable of much havoc.
A tool for network enumeration, protection, observation and domination. Omphalos makes use of passive and active portscanning, DNS/DHCP/[[Zeroconf]] server interrogation, portknock detection, covert channel detection and establishment, ARP scanning, automatic WEP cracking, man-in-the-middling, and a whole host of other tricks. GPS integration? Oh yes. Coordination across multiple interfaces? Of course. Use of Linux's <tt>MMAP_RX_SOCKET</tt> and <tt>MMAP_TX_SOCKET</tt>? Wouldn't have it any other way. Userspace networking is made visible to the host via a [[TUN/TAP]] device. While designed as an offensive tool, omphalos has proven useful for network debugging and troubleshooting, as well as experimentation.


'''Omphalos: Because one layer is never enough.''' Code is hosted on [https://github.com/dankamongmen/omphalos GitHub]. Bugtracking is hosted on [http://dank.qemfd.net/bugzilla/buglist.cgi?cmdtype=runnamed&namedcmd=omphalos qemfd-bugzilla]. There's a mailing list at [http://groups.google.com/group/omphalos-dev Google Groups].
* '''The latest release is [https://github.com/dankamongmen/omphalos/releases/tag/v0.99.9 0.99.9], released 2019-11-20.'''
* [[Arch]]'s AUR contains [https://aur.archlinux.org/packages/omphalos/ omphalos]
 
Omphalos is not a "''point-and-click''" tool so much as "''pull the pin''" or perhaps "''spray the area''". Default behavior is to redirect and seize all traffic, attack weak cryptosystems, archive authentication materials, and learn everything that can be learned. Ideally, a tiny microprocessor would be paired with power and a network device, stealthily physically inserted into a network, and left there; <tt>omphalos</tt> and [[Hackery#liburine|liburine]] would then combine to provide complete network dominance. I hope to combine network programming and the techniques of high-performance computing to create a tool capable of much havoc.
 
'''Omphalos: Because one layer is never enough.''' Code is hosted on [https://github.com/dankamongmen/omphalos GitHub], as are [https://github.com/dankamongmen/omphalos/issues modern issues]. Old bugs are still available at [https://nick-black.com/bugzilla/buglist.cgi?cmdtype=runnamed&namedcmd=omphalos bugzilla]. There's a mailing list at [http://groups.google.com/group/omphalos-dev Google Groups].
==Similar Tools==
==Similar Tools==
* [http://www.thoughtcrime.org/software/sslsniff/ SSLSNIFF] from Thoughtcrime Labs
* [http://www.thoughtcrime.org/software/sslsniff/ SSLSNIFF] from Thoughtcrime Labs
* [http://arpon.sourceforge.net/ ArpON] by Andrea Di Pasquale et al
* [http://ettercap.sourceforge.net/ ettercap] by Alberto Ornaghi and Marco Valleri
* [http://ettercap.sourceforge.net/ ettercap] by Alberto Ornaghi and Marco Valleri
* [http://www.nixgeneration.com/~jaime/netdiscover/ Netdiscover] by Jaime Peñalba
* [http://www.nixgeneration.com/~jaime/netdiscover/ Netdiscover] by Jaime Peñalba
* [http://www.netresec.com/?page=NetworkMiner NetworkMiner] from NETRESEC AB
* [http://www.jdisc.com/ JDisc Discovery] from JDisc UG
* [http://www.lantopolog.com/ LanTopolog] by Yuriy Volokitin
* [http://code.google.com/p/mirandaupnptool/ Miranda] by Craig Heffner
===Countertools===
===Countertools===
We want to defeat systems like:
We want to defeat systems like:
* [http://arpon.sourceforge.net/ ArpON] by Andrea Di Pasquale et al
* [http://arpon.sourceforge.net/ ArpON] by Andrea Di Pasquale et al
===Subsumed Tools===
Omphalos implements all or portions of the functionality of the following tools:
* [[Avahi]], the linux [[zeroconf]] daemon
* [http://www.litech.org/radvd/ radvd], the linux IPv6 Router Advertisement daemon
==Versions/Milestones/Releases==
==Versions/Milestones/Releases==
{| border="1" class="wikitable"
{| border="1" class="wikitable"
Line 19: Line 32:
! Features
! Features
|-
|-
|0.98
|0.98 (initial alpha)
|2011-09-10 (planned)
|'''[https://github.com/dankamongmen/omphalos/tree/v0.98alpha 2011-10-07]''' (actual)
2011-09-23 (planned)
|
|
*Detection of network entities at layers 2 and 3.
*Detection of network entities at layers 2 and 3.
Line 28: Line 42:
*[[ARP]]- and [[DNS]]-based probing
*[[ARP]]- and [[DNS]]-based probing
|-
|-
|0.99
|0.99.0β (initial beta)
|2011-11-11 (planned)
|'''[https://github.com/dankamongmen/omphalos/tree/v0.99.0β 2011-12-01]''' (actual)
2011-11-11 (planned)
|
|
*Routing/iptables configuration capabilities
*Routing/iptables configuration capabilities
Line 42: Line 57:
*GPS support
*GPS support
*Logging support
*Logging support
*[[Topology Discovery|LLTD]] and some [[NetBIOS]] support
|}
|}


Line 172: Line 188:
|}
|}


==Attack Capabilities==
==Analysis and Attack Capabilities==
===Physical Layer Support===
{| class="wikitable" border="1"
! Protocol
! [[Standards|Standard]]
! [[Pcap|libpcap]] linktype
! Linux ARP type
! Analyzed?
|-
| BSD Loopback
| ?
| DLT_NULL
| N/A
| No
|-
| Linux Cooked Capture
| [http://linuxmanpages.com/man7/packet.7.php packet(7)]
| DLT_LINUX_SLL
| N/A
| Yes
|-
| [[Ethernet]]
* Ethernet II/DIX
* Novell 802.3
* IEEE 802.2 LLC
* SNAP
* 802.1Q VLAN/802.1p QoS (IEEE 802.3ac)
| IEEE 802.3-2008
| DLT_EN10MB
| ARPHRD_ETHER
| Yes
|-
| Token Ring
| IEEE 802.5
| DLT_IEEE802
| ARPHRD_IEEE802_TR
| No
|-
| ARCNET
| ANSI 878.1
|
* DLT_ARCNET
* DLT_ARCNET_LINUX
| ARPHRD_ARCNET
| No
|-
| SLIP
(Serial Line Internet Protocol)
|
* RFC 1055 (SLIP)
* RFC 1154 (CSLIP)
| DLT_SLIP
|
* ARPHRD_SLIP
* ARPHRD_SLIP6
* ARPHRD_CSLIP
* ARPHRD_CSLIP6
| No
|-
| PPP (Point-to-Point Protocol)
* BSD/OS PPP
* PPP over serial
* PPPoE (PPP over [[Ethernet]])
* PPPoA (PPP over ATM)
* Cisco PPP/HDLC
| RFC 1661
* ?
* RFC 1662
* RFC 2516
* RFC 2364
* RFC 1547
| DLT_PPP
* DLT_PPP_BSDOS
* DLT_PPP_SERIAL
* DLT_PPP_ETHER
* ?
* DLT_C_HDLC
| ARPHRD_PPP
| Partial
* No
* No
* No
* No
* Yes
|-
| FDDI
(Fiber Distributed Data Interface)
|
* MAC: ANSI X3.139-1987 / ISO 9314-2
* PHY: ANSI X3.148-1988 / ISO 9314-1
| DLT_FDDI
| ARPHRD_FDDI
| No
|-
| Fibre Channel
| RFC 2625
| DLT_IP_OVER_FC
|
* ARPHRD_FCPP
* ARPHRD_FCAL
* ARPHRD_FCPL
* ARPHRD_FCFABRIC
| No
|-
| IrDA
(Infrared Data Association)
|
* IrDA PHY Spec v1.5
* IrDA Link Access Protocol v1.1
| DLT_LINUX_IRDA
| ARPHRD_IRDA
| Yes
|-
| Radiotap
| De facto
| DLT_IEEE802_11_RADIO
| ARPHRD_IEEE80211_RADIOTAP
| Yes
|-
| Firewire
| IEEE 1394
| N/A
| ARPHRD_IEEE1394
| Yes
|-
| Frame Relay
| ?
| DLT_FRELAY
| ARPHRD_FRAD
| No
|-
| Apple LocalTalk
| ?
| DLT_LTALK
| ARPHRD_APPLETLK
| No
|-
| LAPD
(Link Access Protocol - D Channel)
| ITU Q.921
| DLT_LINUX_LAPD
| ARPHRD_LAPB
| No
|-
|}
 
===Layer 2===
===Layer 2===
====Topology Discovery====
''For more information, see the [[Topology Discovery]] page.''
{| class="wikitable" border="1"
|-
! Protocol
! Standard
! Support
|-
| [[Topology_Discovery#Link-Local_Topology_Discovery_.28LLTD.29_Protocol|LLTDP]]
| Microsoft
|
* Extraction of data from HELLO packets
* Enumeration via DISCOVERY requests
|-
| [[Topology_Discovery#Link-Layer_Discovery_Protocol_.28LLDP.29|LLDP]]
| IEEE 802.1AB-2005
|
* None yet
|-
| [[Topology_Discovery#Cisco_Discovery_Protocol_.28CDP.29|CDP]]
| Cisco
|
* None yet
|-
| STP
| IEEE 802.1D
|
* Minimal analysis of BDPUs
|-
|}
====802.3/Ethernet II====
====802.3/Ethernet II====
* Detect physical hosts on the network via MAC analysis
** Classify as locally-generated, multicast, etc
* Flood a network with spoofed MAC addresses, in the hope of forcing fail-open behavior to facilitate attacks (see <tt>macof</tt> from [http://monkey.org/~dugsong/dsniff/ dsniff] and ''Hacking Layer 2: Fun with Ethernet Switches'' from BlackHat 2002)
* Flood a network with spoofed MAC addresses, in the hope of forcing fail-open behavior to facilitate attacks (see <tt>macof</tt> from [http://monkey.org/~dugsong/dsniff/ dsniff] and ''Hacking Layer 2: Fun with Ethernet Switches'' from BlackHat 2002)
* Probe and autodetect CAM sizes and hash functions, allowing for minimal CAM overflows
* Probe and autodetect CAM sizes and hash functions, allowing for minimal CAM overflows
Line 185: Line 378:
* VLAN hopping
* VLAN hopping


====802.11====
====[[WiFi|802.11]]====
* Passively attack weak cryptosystems (especially WEP), or do so actively if configured
* Passively attack weak cryptosystems (especially WEP), or do so actively if configured
* Channel hopping or locked operation
* Channel hopping or locked operation
Line 191: Line 384:
* Respond as master to probed networks, on a to-order basis
* Respond as master to probed networks, on a to-order basis
* Ability to run omphalos in as an AP client via userspace networking atop radiotap (Monitor mode) and WPA/EAPOL support
* Ability to run omphalos in as an AP client via userspace networking atop radiotap (Monitor mode) and WPA/EAPOL support
** Or, more likely, some kind of hostapd control using Master mode
* "[http://www.airtightnetworks.com/WPA2-Hole196 Hole 196]" injection
* "[http://www.airtightnetworks.com/WPA2-Hole196 Hole 196]" injection
* Viehbock's [http://sviehb.files.wordpress.com/2011/12/viehboeck_wps.pdf WPS EAP-NACK] brute-force attack ([http://www.kb.cert.org/vuls/id/723755 US-CERT #723755])


====STP====
* '''FIXME'''
====DTP====
* '''FIXME'''
===Layer 3===
===Layer 3===
* ICMP redirects
* ICMP redirects
Line 211: Line 402:
* Cryptographic downgrade attacks on HTTPS etc
* Cryptographic downgrade attacks on HTTPS etc
===Layer 5===
===Layer 5===
* FireSheep-like session hijacking
* FireSheep- and BEAST-like session hijacking
* Progressive user identity/demographic discovery aka "maximum creepy" (heuristics on machine name, web pages visited, accounts revealed, mails sent etc)
* Progressive user identity/demographic discovery aka "maximum creepy" (heuristics on machine name, web pages visited, accounts revealed, mails sent etc)
** Watch for and aggregate probed wireless networks, DHCP lease renewals, etc
** Watch for and aggregate probed wireless networks, DHCP lease renewals, etc
Line 220: Line 411:
Omphalos currently only runs or indeed builds on fairly recent Linux systems, due to extensive use of advanced capabilities of the Linux networking stack (and the small fact that I don't run anything else). I doubt that I would accept patches to add Windows/MacOSX support, but you're certainly welcome to maintain them yourself. Once the main functionality set is complete (0.98 release), I'll add support for falling back to plain old PF_PACKET sockets without ringbuffers; that ought add support for any UNIX-based OS with a basic <tt>rtnetlink</tt> implementation.
Omphalos currently only runs or indeed builds on fairly recent Linux systems, due to extensive use of advanced capabilities of the Linux networking stack (and the small fact that I don't run anything else). I doubt that I would accept patches to add Windows/MacOSX support, but you're certainly welcome to maintain them yourself. Once the main functionality set is complete (0.98 release), I'll add support for falling back to plain old PF_PACKET sockets without ringbuffers; that ought add support for any UNIX-based OS with a basic <tt>rtnetlink</tt> implementation.
===User Interfaces===
===User Interfaces===
* <tt>omphalos-tty</tt>: line-based console output with readline-based input
* <tt>omphalos-tty</tt>: line-based console output with [[readline]]-based input
* <tt>omphalos-ncurses</tt>: screen-based terminal output with ncurses-based input
* <tt>omphalos-ncurses</tt>: screen-based terminal output with [[ncurses]]-based input
* GTK: I'd like to add a GTK UI, but it's not a major priority
* GTK: I'd like to add a GTK UI, but it's not a major priority
** If you'd like to contribute freely-licensed, original artwork to this effort, please contact me!
** If you'd like to contribute freely-licensed, original artwork to this effort, please contact me!
* WxWidgets, QT: Dubious that I'll add one, but I'd take patches.
* WxWidgets, QT: Dubious that I'll add one, but I'd take patches.
* Java: nope
* Java: nope
==Project documentation==
==Project documentation==
Transcluded from top of my git repository at GitHub.
===README===
<include src="https://raw.github.com/dankamongmen/omphalos/master/README" />
===Data Organization===
<include src="https://raw.github.com/dankamongmen/omphalos/master/doc/dataorganization.txt" />
<include src="https://raw.github.com/dankamongmen/omphalos/master/doc/dataorganization.txt" />
==Open Bugs==
 
{{#bugzilla:columns=id,priority,status,to,from,component,summary
|status=ASSIGNED
|product=omphalos
|sort=priority,id
|noresultsmessage="No matching bugs found."
}}
----
----
<blockquote>''One of her sisterhood lugged me squealing into life. Creation from nothing. What has she in the bag? A misbirth with a trailing navelcord, hushed in ruddy wool. The cords of all link back, strandentwining cable of all flesh. That is why mystic monks. Will you be as gods? Gaze in your omphalos.'' -- James Joyce, ''[http://www.doc.ic.ac.uk/~rac101/concord/texts/ulysses/files/ulysses3.html Ulysses]''</blockquote>
<blockquote>''One of her sisterhood lugged me squealing into life. Creation from nothing. What has she in the bag? A misbirth with a trailing navelcord, hushed in ruddy wool. The cords of all link back, strandentwining cable of all flesh. That is why mystic monks. Will you be as gods? Gaze in your omphalos.'' -- James Joyce, ''[http://www.doc.ic.ac.uk/~rac101/concord/texts/ulysses/files/ulysses3.html Ulysses]''</blockquote>
<hr>
<hr>
==See Also==
* [[Packet sockets]]


[[CATEGORY: Projects]]
[[CATEGORY: Projects]]
[[CATEGORY: Networking]]
[[CATEGORY: Networking]]
[[CATEGORY: Offensive Computing]]
[[CATEGORY: Offensive Computing]]
Retrieved from "https://nick-black.com/dankwiki/index.php?title=Omphalos"