Luigi Auriemma

this night I have released my new project called Proxocket:

http://aluigi.org/mytoolz.htm#proxocket

in short words it is a:
- winsock sniffer for single applications which dumps any packet in a CAP file without requiring to run a real sniffer or admin privileges
- packets manipulator, through the easy editing of a custom dll is possible to control any packet sent and received by a specific application

the first feature is something similar to what is possible to capture with WPE PRO but a lot better because it supports more protocols and other informations and, moreover, doesn't need to be injected in the process, the only thing you must do to use it is placing its ws2_32.dll file in the folder of the application to monitor.

for example if you place ws2_32.dll in "C:\program files\Firefox" and launch Firefox, will be created a proxocket_DATE.cap file which will contain all the data sent and received by that session of Firefox in tcpdump format (so readable with any graphic sniffer like Wireshark).
So, differently to a classical sniffer, you can use it even if you have torrent, emule or any other bandwith consumer program running at the same moment without affecting the packets captured by Proxocket.

the second feature instead is more interesting because allow anyone to handle the packets of an application without loosing days in building a hooker, injector or thinking to other solutions.
all you must do is getting the myproxocket.c base code available in the package, adding your code in myrecvfrom or the other available functions, compiling it as a dll and placing it with the proxocket ws2_32.dll in the folder of the program.

this allows to create various things in some minutes like a rudimental firewall which bans any IP which sends a specific sequence of byte (for example for blocking an unpatched vulnerability) or an entire range of malicious IP addresses, a real-time decrypter/uncompressor/parser for a specific protocol (for example for ventrilo, or the various games which use compressors like the Doom ports) or testing a vulnerability (I have converted the q3unban plugin for sudppipe in a proxocket dll in less than 30 seconds) and so on... all without wasting time or other limitations.

anyway this is the first version so any feedback and suggestion is welcome.

ws2_32 and wsock32 have the same "capture/manipulation" functions but Winsock is divided in these two dlls, so some programs (usually the old programs) are linked to wsock32.dll while all the others to ws2_32.dll

myproxocket can be easily compiled with: gcc -s -O2 -shared -o myproxocket.dll myproxocket.c

anyway the gcc command-line was already included at the end of the commented header at the beginning of myproxocket.c

This is very interesting this could be useful for many applications

anyway remember that mybind is executed AFTER the real bind so this has a partial effect.

As written in myproxocket.c the my* functions are still experimental and I still need to find a better way to handle some functions like myconnect and mybind because probably is better to handle them BEFORE the real one.

Any idea is welcome, I plan to release a 0.1.1 version just in these days for optimizing the my* functions with things like, for example, if in mysend() you return -1 the real send() will not be called.
I want to add that thing because, for who doesn't know it, the sending of zero bytes forces the other endpoint of the connection to close it, so if the user wants to avoid the sending of a specific packet or data it's enough that he returns -1 or 0 in mysend* and the real function will not be called avoiding the disconnection.

Thanks Luigi, very nice tool.

ok, in the next version I will also add some commented examples in myproxocket.c

anyway for your problem (for what I have understood) what you need to do is something like the following:
but this will work in the next version when I will place mybind before the real bind

released version 0.1.1
and yes sethioz, I have successfully redirected the bind function binding 127.0.0.1 instead of my ethernet one which was forced in the main program.
I have also redirected the connect() function with success... very funny.

that hex you wrote doesn't work because it's 4 bytes long and not 16 (\x61 is 1 byte no 4 ih ih ih)

if you want to replace the original string with something which has a different length the thing is a bit longer and you must be sure that the "buf" of the original program is big enough to contain the new modification.
the following is a new function that you must add to your code and which will do ALL the job:
so in mysend() you must only add:

it could be a problem derived by the real size of the buffer, as I explained before or I wrote in myproxocket.c (don't remember) modifying the buffer in the mysend* functions can be a problem on some programs for various technical reasons.

so at the moment doesn't exist an "official" work-around although exist various ideas

new version out

Sethioz, what you want is something outside the purpose of the project.
The Proxocket project offers a "base" for fully customizing anything socket related while what you talk about is a new program developed through myproxocket... which is a totally new project of which I'm not interested.

myproxocket.c is only an example, it's up to the developer to add all the stuff he needs, the base is already there.

I have just released the q3unban plugin for proxocket which demonstrates how easy is to write plugins:

http://aluigi.org/poc.htm#q3unban_proxocket

Hello,
im a complete n00b with C , but i have been playing with that redirect thing.

below is my expiriment which doesnt work as it should.
is here someone who can tell me how to redirect traffic to a proxy?


int myconnect(SOCKET s, const struct sockaddr *name, int namelen) {

if(ntohs(((struct sockaddr_in *)name)->sin_port) == 80) {
((struct sockaddr_in *)name)->sin_addr.s_addr = inet_addr("PROXYIP");
((struct sockaddr_in *)name)->sin_port = htons(3128);

}
}



My GET request looks like this:
GET /customers/newproducts.html HTTP/1.0
But if you were connected through a Web proxy server, the GET should look like this:
GET http://mydowmain.com/customers/newproducts.html HTTP/1.0

Somehow i have to add the domain to the GET query.
Im googling like crazy now. but without ANY knowledge of C this is going to be a tough and long ride for me.

help is appreceated.

your myconnect looks correct, have you added your new myproxocket.dll and the proxocket's ws_32.dll in the same folder of the software you want to "redirect"?

the problem lies in the fact that the GET request, doesnt has the 'http://domain' part in it.
here is the msg from proxy when i open a page.



So, i fiddled with the sendto function and put this in


now, all requests end up at google.
i need to grab the hostname from the buffer, and replace the "GET /" with "GET http://hostname"
but i have no clue about how regex is implemented in c.

so, i'll keep googling and trying.

ah so you didn't want simply to redirect the connection to another host but to forse the usage of a proxy... uhmmm in this case there are various other solutions.

the first, and most simple, is using sockscap for "socksifiying" the main program.
obviously you will need to use a socks proxy server and not a http proxy.

if sockscap can't work with that program (very rare) or you can't use the proxy server as a socks proxy you can still modify myproxocket.c as you said but it's not very simple if you are not good with C.

for example if the proxy supports the CONNECT method you need only to send "CONNECT IP:PORT\r\n\r\n" in myconnect using the original send function (there is an example in the sample myproxocket.c), alternatively the idea of replacing the "GET /" is ok but requires various modifications.

ok, thanks.
but that send function crashes firefox, so that is not an option i think.
eventually, i want to place this dll on my kid's pc. i have a linux proxy that filters certain websites.
recently, one of the buggers found out how to turn the proxy off.. :(

But since im doing quite a good job in php, i think im in for a C challenge.
if only i get some regex support in C and im on my way. i know one thing : i have a lot of reading to do.

i AM using the right code like this yes?



*edit*
it seems once i send() something, the app crashes. ( this is with firefox,ie and teamspeak)
*edit2*
original send() examples dont work either. it ends up in crashing the app.

well seems that I have been able to do the job and doesn't seem so bad :)
check the attachment.
it has been tested with firefox and in practice it sends the "http://IP:PORT" string between the http request and the rest of the data without modifying data or using additional memory.

for the crash in firefox it's a thing I missed in my myproxocket.c example, the WINAPI at the beginning of the real_* functions.

I will probably release a new version of proxocket tomorrow because although it's only an example and there are no changes that I need to perform on proxocket, it's an important example.

Sorry, but i dont see any attachement. but i can wait till tomorrow with the new version.

i really appreceate the help here, and im glad to know i helped you find and fixed a bug.