pwn_waf - This is a simple network firewall for pwn challeng

项目说明

AWD PWN WAF

中文版

CTF AWD WAF FOR PWN

Author: I0gan

Mail:

Intro

The WAF is a traffic capture tool for AWD PWN, which is con to analyze and write anti attack exp, and is very conducive to the use of PWN Ctfer. The tool has been used in AWD competitions for many times. I hope you can give me a star. The WAF has four modes.

1. The CATCH mode simply capture the attacked interacti, which can be under the log path.

2. The I0GAN mode is a defense mode, which can prevent attackers from getting the shell, and can also view the attacker's interacti. This mode is used cautiously, strictly abides by the rules of the ctf competition. If you the rules of the competition. The consequences are borne by yourslves.

3. The FORWARD [Recommend] mode simply forwards the attacker's traffic to hit others, and we can capture the traffic in the middle. Of course, if the attacker successfully gets the flag, We can also get the flag in the log file.

4. The FORWARD_MUTIL is based on FORWARD mode, it mainly loop get 's host information from hosts.txt file then forward attacker's traffic to .

Contributor

Fix Log

CATCH / I0GAN modes waf principle

Execve the target elf file by creating a child process, and then the parent process uses ptrace to monitor the syscall of the child process. If the standard IO is used, the data is read and recorded in the log. If the syscall is dangerous, it is also recorded in the log

FORWARD / FORWARD_MULTI modes waf principle

Capture traffic from standard I / O and forward it to the target server. You can captrue traffic between the attacker and the , and you can also get 's flag.

Code Tree

How to use?

0x00 Know your server

After ssh to your server, checking your server for monitored program.

So monitored program is /pwn.

If the ser is chroot, you should notice something, like this

Like this situation, the monitored program is /home/pwn/pwn

Next, we should found a path that have read && write permissions to pwn user.

Use touch command to test then find this path.

In general, this condition will be satisfied in the /tmp directory. But if ser is chroot you should find this path in chroot args1 [/home/pwn].

If not found path, this waf just can be used in RUN_FORWARD mode.

replace this program.

You should replace /home/pwn/pwn to our waf program.

0x01 Configure waf

Some configuration information of all modes is in makefile

#### CATCH and I0GAN mode configure

In makefile

LOG_PATH is a log file path

ARCH Represents whether the program is 32-bit or 64 bit.

You shold set LOG_PATH to your path that have read && write permissions in pwn user.

#### FORWARD mode configure

LOG_PATH is a log file path

ARCH Represents whether the program is 32-bit or 64 bit.

FORWARD_IP is static 's ip

FORWARD_PORT is static 's port

You shold set LOG_PATH to your path that have read && write permissions in pwn user.

If you not ha to write anaything, You should close logger. Modify makefile

So this mode is not rely on other file. you can use this mode to avoid attacked from attacker.

#### FOWARD_MULTI mode configure

If you use RUN_FORWARD_MULTI mode, you must set hosts information in hosts.txt, like

hosts.txt

And set log path in makefile

LOG_PATH is a log file path

ARCH Represents whether the program is 32-bit or 64 bit.

You shold set LOG_PATH to your path that have read && write permissions in pwn user.

0x02 Compile

#### Compile all

#### Notice

Compile En must <= target glibc
Or waf cannot execute

or

You will get catch,i0gan,redir files

The catch is RUN_CATCH mode waf program

The i0gan is RUN_I0GAN mode waf program

The forward is RUN_FORWARD mode waf program

The forward_mutil is RUN_FORWARD_MULTI mode waf program

#### simple test

After compiling all successfully, you can run ./catch or ./i0gan directly to test
Store the interactive log file in the directory /tmp/.waf/ , The name of file format is time + hex microseconds + .log

0x03 Add waf to server

The pwn service paths stored in different events may be different. Take /pwn/pwn as an example. If you don't know where it is, cat /etc/xinetd.d/pwn service can view its own service path. The LOG_PATH you should find by yourself that have read && write permissions in pwn user. Here take LOG_PATH is /tmp/.waf as an example.

#### CATCH or I0GAN mode

Upload the compiled catch or i0gan program file to the /tmp directory.

1. Copy the monitored service program to LOG_PATH directory.

2. Replace the service program with WAF program

Notice:
You must use nc to test. If server is down, checking your listened pwn program's permission and log permission.
If your program is orw type, open fd start with 6, not 3

If the attacker attacks, the corresponding attack log file will be generated in the directory /tmp/.i0gan/. Each attack will generate a file, which can be directly analyzed after being attacked

#### FOWARD mode

Upload the compiled forward program file to the /tmp directory.

If your server have not permissions to store log, you should Close log, just set LOG_METHOD := OPEN in makefile and recompile forward.

1. Replace the service program with WAF program

#### FOWARD_MULTI mode

Upload the compiled forward_multi and hosts.txt files to the /tmp directory.

1. Copy hosts.txt under LOG_PATH
2. Replace the service program with WAF program

Notice:
You must use nc to test. Check your log permission

0x04 Test your server

Note that you need to test your service

The common problem is that the permissions are not enough, which appear in the log path without permissions.

Test CATCH

server

attacker

server log

Test I0GAN

server

attacker

server log

Test FORWARD

's ip is 127.0.0.1, port is 20000

test nc

In makefile

Compile forward

Server

attacker

server log

Test FORWARD_MULTI

In hosts.txt

The 8081 port is not open.

Server

Attacker:

The ser log

项目信息

开发语言：C

Star 数：218

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕This is a simple network firewall for pwn challenges of ctf awd competition, light and simple code.There is no dependence, the log format is clear with the hexadecimal payload string and original string, which is more convenient to exp script. 【ctf awd比赛中的针对于pwn题的waf，拥有抓取、通防、转发、多人转发模式，推荐使用转发模式】展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。