Port knocking is a somewhat obscure technique for hiding network services. Under normal circumstances an attacker can use a port scanner to uncover what daemons are listening on a server:
$ nmap -sV backdrifting.net Starting Nmap 6.46 ( http://nmap.org ) at 2017-07-17 Nmap scan report for backdrifting.net (XX.XXX.XX.XX) Host is up (0.075s latency). Not shown: 990 filtered ports PORT STATE SERVICE VERSION 22/tcp open ssh (protocol 2.0) 80/tcp open http Apache httpd 443/tcp open ssl/http Apache httpd 465/tcp closed smtps 587/tcp open smtp Symantec Enterprise Security manager smtpd 993/tcp open ssl/imap Dovecot imapd
Note: Port scanning is illegal in some countries - consult local law before scanning others.
Sometimes however, a sysadmin may not want their services so openly displayed. You can’t brute-force ssh logins if you don’t know sshd is running.
With port knocking, a daemon on the server secretly listens for network packets. A prospective client must make connections to a series of ports, in order, without interruption and in quick succession. Note that these ports do not need to be open on the server - attempting to connect to a closed port is enough. Once this sequence is entered, the server will allow access to the hidden service for the IP address in question.
This sounds mischievously similar to steganography - we’re hiding an authentication protocol inside failed TCP connections! With that thought driving me, it sounded like writing a port-knocking daemon would be fun.
There are several approaches to writing a port-knocker. One is to run as a daemon listening on several ports. This is arguably the simplest approach, and doesn’t require root credentials, but is particularly weak because a port scanner will identify the magic ports as open, leaving the attacker to discover the knocking combination.
Another approach (used by Moxie Marlinspike’s knockknock) is to listen to kernel logs for rejected incoming TCP connections. This approach has the advantage of not requiring network access at all, but requires that the kernel output such information to a log file, making it less portable.
The third (and most common) approach to port knocking is to use packet-sniffing to watch for incoming connections. This has the added advantage of working on any operating system libpcap (or a similar packet sniffing library) has been ported to. Unfortunately it also requires inspecting each packet passing the computer, and usually requires root access.
Since I have some familiarity with packet manipulation in Python already, I opted for the last approach.
With Scapy, the core of the problem is trivial:
def process_packet(packet): src = packet.src # IP Header port = packet.dport # TCP Header if( port in sequence ): knock_finished = addKnock(sequence, src, port, clients) if( knock_finished ): trigger(username, command, src) # Sequence broken elif( src in clients ): del clients[src] sniff(filter="tcp", prn=process_packet)
The rest is some semantics about when to remove clients from the list, and dropping from root permissions before running whatever command was triggered by the port knock. Code available here.