Jump to content

UDP Packet Send/Receive

MrBeatnik
 Share

Recommended Posts

MrBeatnik Wayfarer

MrBeatnik

Posted
Posted

Hi all.

I would like to create a script that sends a particular packet, and listens for a response.

Quick rundown:

I have a 16bit app that sends a UDP (bootp) packet to a server, and receives a UDP (bootp) packet in return.

This app doesn't work on other platforms (32bit etc), hence I want to recreate what this app is doing.

I have captured the packet send and receive from this application.

Does anyone have any suggeston on where to start with this?

I have looked at basic UDP/TCP connections in autoit, usually having a client and server.

In this case, there would be no server side script created in autoit - I am connecting to a (DHCP) server that should be listening for particular UDP packets already.

Send Packet is attached (This is a wireshark pcap file. Rename the .txt to .pcap).

The packet is basically talking to the router I think, which will forward onto the server in question.

Thanks!

bootp_send.txt

Please correct me if I am wrong in any of my posts. I like learning from my mistakes too.

Link to comment
Share on other sites
  • 4 months later...
MrBeatnik Wayfarer

MrBeatnik

Posted
  • Author
Posted

Hey all...

I see that some have downloaded the file for a peek.

I'm still looking at sending this packet, but having issues.

I have tried to look at WinPcap Autoit3 UDF for sending this packet, but haven't had any joy.

Perhaps a better description of what I want to do might encourage some help? :)

I want to send a bootp packet which is forwarded on to DHCP.

DHCP then replies with various data - I am particularly looking for Option 12 from the scope (which is hostname - prefilled out when the reservation was created).

I can then use this name to modify the sysprep.inf entry to name a computer without any user interaction.

As I mentioned earlier, this was working from a 16bit app (no permissions required), but I can't get that app working on a 32bit platform. I finally decided that reproducing what this 16bit app does on the wire would be the "easiest" way to get what I want.

So, even with the WinPcap UDF, I cannot send this exact packet - or at least haven't figured out how to do so yet.

Does anyone have any ideas?? It would be very much appreciated.

Please correct me if I am wrong in any of my posts. I like learning from my mistakes too.

Link to comment
Share on other sites
MrBeatnik Wayfarer

MrBeatnik

Posted
  • Author
Posted

I have made some headway this morning since the post.

The packet send is working - Wireshark shows that it gets the expected reply.

Normally, that would be it completed (aside from sniffing to take the reply packet and do something with it)...

BUT: I want to run this on something that doesn't have WinPCap installed - or at least not installed in the normal fashion. The final code would want to run on Windows PE. The standard WinPCap install isn't supported by WinPE, so I can't install it.

Anyone know what files I should be putting into PE (or a machine that hasn't got WinPCap without having to install).

In otherwords, a FileInstall function inside my script that pushes down the required dlls etc would be nice.

Any ideas on that?

#include <Winpcap.au3> ;Latest version
#include <Array.au3>

$winpcap=_PcapSetup()   ; initialize winpcap
$pcap_devices=_PcapGetDeviceList()  ; get devices list
If ($pcap_devices=-1) Then
    MsgBox(16,"Pcap error !",_PcapGetLastError())
    exit
EndIf

_ArrayDisplay($pcap_devices,"Devices list",-1,-1) ; display it just so I can ensure I am connecting to the correct device
_PcapFree() ; close winpcap

$winpcap=_PcapSetup()   ; initialize winpcap
$pcap_devices=_PcapGetDeviceList()  ; get devices list
$pcap=_PcapStartCapture($pcap_devices[3][0]) ; my interface

$broadcastmac="FFFFFFFFFFFF" ; broacast
$mymac=StringReplace($pcap_devices[3][6],":","") ; my mac address in hex
$ethertype="0800"   ; ethertype = IP
$checkSum="1a35"   ; Just manual for now...

$mypacket="0x"&$broadcastmac&$mymac&$ethertype&"4500014800010000641155a500000000ffffffff004400430134" & $checkSum & "01010600ca1d0c4a0100000000000000000000000000000000000000" & $mymac & "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" ; stick together to a binary string !
_PcapSendPacket($pcap,$mypacket) ; sends a valid ethernet broadcast !

_PcapFree() ; close winpcap

Please correct me if I am wrong in any of my posts. I like learning from my mistakes too.

Link to comment
Share on other sites
MrBeatnik Wayfarer

MrBeatnik

Posted
  • Author
Posted

Thanks for the input Manadar...

I have quickly created a script to send the data, and it sends OK!

The following script works fine (wireshark shows the correct packet being sent, and the correct return packet).

However, I am having trouble reading the return packet.

UDPStartup()
$socketA = UDPOpen("192.168.100.254", 67) ;Port 67 is BOOTPS port, .254 is router.
If @error <> 0 Then Exit

$mymac=StringReplace("00:AA:AA:89:32:AA",":","") ; my mac address in hex (note fake mac for posting purpose)

$mypacket="0x"&"01010600ca1d0c4a0100000000000000000000000000000000000000" & $mymac & "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" ; stick together to a binary string !


$status = UDPSend($socketA, $mypacket)
MsgBox(0,"",$status)

UDPCloseSocket($socketA)
UDPShutdown()

The packet is sent to the router port 67, but FROM my PC on port 3061.

The return packet is send FROM the rounter on port 67, but TO my PC on port 68.

How can I ensure that I am monitoring port 68 for UDP receive?

Port 68 is expected for this packet, as this is the bootp client port.

Thanks!!

Please correct me if I am wrong in any of my posts. I like learning from my mistakes too.

Link to comment
Share on other sites
99ojo Universalist

99ojo

Posted
Posted

Thanks for the input Manadar...

I have quickly created a script to send the data, and it sends OK!

The following script works fine (wireshark shows the correct packet being sent, and the correct return packet).

However, I am having trouble reading the return packet.

UDPStartup()
$socketA = UDPOpen("192.168.100.254", 67) ;Port 67 is BOOTPS port, .254 is router.
If @error <> 0 Then Exit

$mymac=StringReplace("00:AA:AA:89:32:AA",":","") ; my mac address in hex (note fake mac for posting purpose)

$mypacket="0x"&"01010600ca1d0c4a0100000000000000000000000000000000000000" & $mymac & "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" ; stick together to a binary string !


$status = UDPSend($socketA, $mypacket)
MsgBox(0,"",$status)

UDPCloseSocket($socketA)
UDPShutdown()

The packet is sent to the router port 67, but FROM my PC on port 3061.

The return packet is send FROM the rounter on port 67, but TO my PC on port 68.

How can I ensure that I am monitoring port 68 for UDP receive?

Port 68 is expected for this packet, as this is the bootp client port.

Thanks!!

Hi,

see helpfile UDPRecv. This should help you to bind a socket to UDP listening Port 68.

;-))

Stefan

Link to comment
Share on other sites
MrBeatnik Wayfarer

MrBeatnik

Posted
  • Author
Posted

Hi,

see helpfile UDPRecv. This should help you to bind a socket to UDP listening Port 68.

;-))

Stefan

I do have a quick bit of code attempting to bind, but it doesn't seem to pick anything up (even though wireshark does show the packet being received)... perhaps I am mixing up what I am binding to...

If I use the code below, the script never finishes (it never picks up anything).

If I change SocketB bind to the router address with port 67 (the port that is being sent from), the error code below always gives 10049.

The bootp response form the router is instant.

UDPStartup()
$mymac=StringReplace("00:AA:AA:89:32:AA",":","") ; my mac address in hex (note fake mac for posting purpose)
$mypacket="0x"&"01010600ca1d0c4a0100000000000000000000000000000000000000" & $mymac & "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" ; stick together to a binary string !


;=================
; NOW LETS SEND!
;=================
$socketA = UDPOpen("192.168.100.254", 67) ;Port 67 is BOOTPS port, .254 is router.
If @error <> 0 Then Exit
$status = UDPSend($socketA, $mypacket)
;MsgBox(0,"",$status)



;=================
; NOW LETS LISTEN!
;=================

$socketB = UDPBind("192.168.100.1", 68) ;local PC, port 68 = bootp client port
If @error <> 0 Then
    msgbox(0,"Error",@error)
    Exit
EndIf

While 1
    $data = UDPRecv($socketB, 50)
    If $data <> "" Then
        MsgBox(0, "UDP DATA", $data, 1)
    EndIf
    sleep(100)
WEnd



UDPCloseSocket($socketA)
UDPShutdown()

Please correct me if I am wrong in any of my posts. I like learning from my mistakes too.

Link to comment
Share on other sites
MrBeatnik Wayfarer

MrBeatnik

Posted
  • Author
Posted

Hmmm, I think the maxlen flag on the UDPRecv was too short.

I am receiving about ~304 and I had it set to 50 from the demo script.

Will post back soon to let you know how I am doing.

Please correct me if I am wrong in any of my posts. I like learning from my mistakes too.

Link to comment
Share on other sites
MrBeatnik Wayfarer

MrBeatnik

Posted
  • Author
Posted

Ok, so it seems to be working on XP.

The packet is showing up - although I haven't decoded it yet it's still in hex. That's fine for now, the rest should be easy.

However...

Windows PE is another story.

It runs, but it doesn't finish - again it seems like it's not picking up the details (I have modified the data (mac/ip) accordingly for the PE machine)...

I need to do some sniffing to see whats happening on the NIC.

Thanks for everyone's help so far - amazing.

I'll be back later no doubt!

Please correct me if I am wrong in any of my posts. I like learning from my mistakes too.

Link to comment
Share on other sites
MrBeatnik Wayfarer

MrBeatnik

Posted
  • Author
Posted

Hello again!

Thanks for the help so far.

Windows PE is causing me issues - I appreciate that support on PE might be a little sparse here.

My code doesn't seem to see the reply to the port I am listening on.

Wireshark shows that the reply packet IS being sent to the port I am listening on.

I have some basic code that outputs what is being received from the port.

This code basically outputs "no data" or "data" to a form constantly.

Whilst this is running, I have other code that is sending the packet (that will trigger the return packet) every 5 seconds.

As I said Wireshark is showing that the packet is sent and received, but the RECEIVE code that works perfectly in XP is not working in PE.

Any suggestions? Is this a limitation of Autoit in PE?

Please correct me if I am wrong in any of my posts. I like learning from my mistakes too.

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...