Developing a TCP Network Proxy - Pwn Adventure 3

Part 9: To analyse the game traffic, we are developing a simple proof of concept TCP network proxy. Then we can start to reverse engineer the protocol.
GitHub: github.com/Liv...
🌴 Playlist: • Pwn Adventure 3: Pwnie...
=[ 🔴 Stuff I use ]=
→ Microphone:* geni.us/ntg3b
→ Graphics tablet:* geni.us/wacom-...
→ Camera#1 for streaming:* geni.us/sony-c...
→ Lens for streaming:* geni.us/sony-l...
→ Connect Camera#1 to PC:* geni.us/cam-link
→ Keyboard:* geni.us/mech-k...
→ Old Microphone:* geni.us/mic-at...
US Store Front:* www.amazon.com...
=[ ❤️ Support ]=
→ per Video: / liveoverflow
→ per Month: / @liveoverflow
=[ 🐕 Social ]=
→ Twitter: / liveoverflow
→ Website: liveoverflow.com/
→ Subreddit: / liveoverflow
→ Facebook: / liveoverflow
=[ 📄 P.S. ]=
All links with "*" are affiliate links.
LiveOverflow / Security Flag GmbH is part of the Amazon Affiliate Partner Programm.
#PwnAdventure #NetworkSecurity #CTF

[@andreerfabbro]

LOVE YOUUUUU! KEEP IT UP!! Seriously, this KZbin series is some of the highest level stuff I’ve ever seen. ❤️

[@d3m815]

same

[@muuzis]

LOL as lots of love

[@GrandpaGameHacker]

This is so awesome!!! I'm taking out of it some python i didn't know too ☺

[@benusman1738]

Yep, I also binge watched the whole thing and can not wait for the next part to be released! Also, author has really good feel of what is interesting and what is dumb and technical. At least from my perspective. I really like it!

[@kfftfuftur]

Actually it is low level stuff he is doing.

[@benjaminbrady2385]

I just want you to know that when I saw this I actually jumped with joy. The content you make has such a powerful positive effect on a lot of people and, at least for me, motivates. So thank you

[@ASCENDANTGAMERSAGE]

DUUUUDE THAT CLIFFHANGER I WANT THNEXT EPISODE NOOOOOW but I understand these take alot of hard work to make, keep it up, you're doing great. Don't rush anything :) PS you deserve more views

[@triularity]

Makes me think of that one episode of Star Trek: TNG with "kiddie Picard".. kzbin.info/www/bejne/gmjIo5qMh5ummJY

[@milahu]

cliffhanger? 11:37 shows the player's X Y Z positions sent to the server. see also 12:04

[@pete3897]

Over 2 years old and only 250 comments - I owe you a comment on this one then. Loving the playlist! Loving the content! Think of the effect you've had on so many people's education; you're more effective than many teachers and I think it's just your hobby?! :) Great work; be proud

[@johndelta4319]

I worked along with this and made a script a lot like this(Python3), this works for A LOT of games. Thank you sir i can't thank you enough!

[@nifengjujuzhang8429]

Do you know how to connect the client to the proxy for other online games? I tried to edit the host file to map proxy IP to game's host name, but it doesn't work :/

[@mopozow6624]

@@nifengjujuzhang8429 Did you found a solution?

[@Simon8162]

TIL your can reload modules in python

[@apenasmeucanal5984]

Simon816 in python 3 the “reload” function has been moved to “importlib” tho

[@alexandrerozier1305]

jeez that was a smart move right :)

[@nonchip]

had a similar experience with lua lately. turns out `require(name)` does its caching magic by just always returning `package.loaded[name] or some_complicated_load_logic(name)`. guess what happens if you `require("package").loaded[name]=nil`. can also be exploited in reverse: `require("package").loaded._some_dummy_global={}` makes every `require("_some_dummy_global")` (even though that module doesn't exist) in THE WHOLE VM (no matter the global environment being sandboxed, it living in another thread, etc) access the same table.

[@legendkerl1650]

What?! I've reached the end of the playlist? It's 3:00 AM and I want moar of this :D Love your series and how you explain everything!

[@nifengjujuzhang8429]

Do you know how to connect the client to the proxy for other online games? I tried to edit the host file to map proxy IP to game's host name, but it doesn't work :/

[@ulissemini5492]

this, is, awesome! i never knew you could reload libraries mid python script and that totally blew my mind!

[@nielsjonkman7196]

Your voice is SO chilling omg. Awesome vid as always! ;)

[@arisweedler4703]

I've been watching all of these today, and HOLY moly this is fun and exciting! You take all the in-the-weeds stuff and call it out for being frustrating and tough, which is really validating. A lot of these tests just take confidence and willingness to potentially waste time - or as I feel after watching this, learn stuff but make less progress than I hoped. Thank you, big thank you :))))))))))) I love it

[@wdai03]

Oh man the way you handled the parser with the reload and exception catcher is pretty smart. If it was me I'd probably just end restarting the whole thing a billion times and cursing

[@himanshuagarwal3451]

You changed my perspective about programming and networking and made it so much fun .. Great work .. Keep it up ..

[@mywave82]

TCP socket is not packet-based, but stream. Assuming that each read operation will always hit the internal protocol packet boundaries will sometimes fail. IP stacks in all end-points can in there buffering split and join up data as they see fit

[@Fabian-_-]

Wow, wirklich die beste Serie auf KZbin! Mach weiter so! Finde es auch sehr gut erklärt für Leute die sich nicht so mit den sonst so krassen Dingen auf deinem Kanal auskennen ^^ und ich konnte n paar Sachen für Python an sich lernen :D 👍

[@ScottJFox]

Ich stimme dir zu, ich bin gespannt auf mehr! (Ich bin ein Anfänger auf Deutsch, Entschuldigung.)

[@Fabian-_-]

Scott passt schon :D wenn ich dir helfen darf: "Anfänger in Deutsch" ;)

[@ScottJFox]

Vielen Dank!! Ich schätze es! Es ist einfacher zu lesen als zu schreiben.

[@Andy-lf4di]

Protip: Set self.daemon = True in the threads. No need to kill the script then. Cleanup may be skipped for the threads on exit as they are just killed if the script receives a SIGINT, but that's also the case when you just kill the script and still good enough for a hacky proxy.

[@InjectionSec]

I recently wrote an elevator attack simulator for university research that emulated sockets in python using pipes and we performed MitM attacks in a similar way (just locally instead of over the network). I WISH I HAD KNOWN ABOUT THE ABILITY TO RELOAD!!!! Every time we wanted make changes to our parser we had to kill it all and start over, so stupid! It’s always the little things *facepalm*. This series is awesome keep it up!

[@rickiwinner]

I bet you will never forget that xD

[@jacobledbetter8243]

This helped me fix an issue where I was doing Thread.run() instead of Thread.start() thanks for fixing a totally unrelated issue.

[@Fachher]

Nice video. Well done. Keep on. I think the data at the end show us the result of the soccer match tomorrow (GER - SWE).

[@Railrat420]

Best series on KZbin right here no doubt about it

[@spicybaguette7706]

One interesting idea is to issue commands to the network proxy via chat. You can even use a custom ASCII control character like ESC and invoke the commands from code you have overwritten with LD_PRELOAD! (Maybe custom keybindings or something)

[@futhorck771]

liveoverflow is like "I'm not an expert but.." then proceeds to do the thing amazingly well

[@TheMtenn100]

You are a monster. I love your videos, please keep on doing, you're amazing at this

[@patrick1020000]

awesome use of reload

[@haydene3802]

Question. Around 11 minutes the python script was being modified while also being ran. Is this possible or was it just video editing? I tried with my own python packet sniffer script and it just continues to run. Tried googling around as well. Been going through your past videos as I learn more and gain confidence, thank you for making them

[@hblaub]

Nice introduction to proxies and to Python ! You are great

[@ScottJFox]

Hopefully he learns Python 3 though. :D

[@thiagosoares6362]

This video deserves millions of like

[@BrandNewByxor]

I've written a shitload of python over the last couple of years, but I haven't seen anything as cool as the `reload` function in months. Mind blown.

[@GamePlayByFaks]

At the end gives possibility to manipulate position also gives pointers to write advanced hacking trainers or etc... so can go wild with that.

[@NeoCortex3]

Boy I just love the Pwn Adventure 3 videos

[@elertan]

You could also place socket hooks in the game itself, instead of creating a proxy. You should look into hooking the send and recv functions.

[@NoNameBAM]

4:59 you can hear a quiet Discord notification sound ;)

[@foor]

wow

[@MrDavidCrane]

hex-encoded floating point triples for location data

[@frognik79]

Very rare that a game doesn't use encrypted packets but a good start.

[@logix2435]

Nice! I love this series so much keep going!

[@jonasvanderschaaf]

Finally I love this series. It is my favourite series!

[@sanderninenine5333]

Thank you so much!! Please never stop youtube, i love you :D.

[@Justin-oo3bh]

Ok so I never knew about the reload method and wow is that going to be VERY useful in the future

[@NavanBethrax]

Gonna try to implement a generic game-proxy in vb.net. If i know the encryption method would it be possible to decrypt and encrypt the data on the fly or would it be a problem performance wise (packet loss or something) ? And nice video mate i always wanted to do something like this but i didn't came up with a concept.

[@tobe2105]

I'd gone for a simpler approach, hooking the functions the game uses to send and receive data. A proxy, however, is a fairly more universal approach. Not to mention it works just well since the packets aren't encrypted.

[@icryo]

Excited for this one!! Thanks!!

[@luax0]

Thanks you for all of your videos !!!

[@wtfman468]

Fr easy to understand tutorial

[@palmenros]

In the Proxy class, run function, why is everything inside a While True loop? Wouldn't that mean that it would create new game2proxy and Proxy2Server every iteration? Thanks

[@LiveOverflow]

The one call is waiting until a client connects. And only then the loop continues and creates a new object to wait for the next player.

[@palmenros]

Thanks! I completely forgot about multiple players...

[@EvilSapphireR]

LiveOverflow I'm sorry, but what do you mean by "the one call"?

[@270jonp]

Seriously a awesome adventure

[@prakashyadav008]

can u mention any good resources for learning disassembly using gdb ? I hav started my information security career and wanna study malware analysis .So it starts with reverse engineering.

[@LiveOverflow]

Just learning by doing and google the instructions you don’t understand etc. keep an eye out for repeating patterns in the assembly code.

[@chidaruma_]

Dude this is amazing! Great videos!

[@Pumpekk]

Hey, great stuff. Quick question: what would you do if you couldn't use hosts file? How can you translate destination IP address so it could go to your proxy (on Windows)?

[@buraktarm1463]

You have to hook the connect function from windows socket dll in the game then change ip to your proxy. You can use detours or easyhook.

[@muhammetaliarturk7107]

such an amazing work man thanks , keep your works up :) 🤙

[@sSoKoSs]

GODLIKE!

[@slagunes4705]

So creative, keep it up dude!

[@L0j1k]

Cheeses. I just finished watching this after the previous 8 in a row, and I have to tell you... I am starting to feel like someone watching a baseball game, and it's the fourth inning and people are starting to notice that the pitcher only thrown strikes and not a single player from the opposing team has gotten on base the whole game.

[@batlin]

How did you create your animated diagrams? I'm using Impress with SVG animation export now but would be keen to hear about nicer methods.

[@LiveOverflow]

Photoshop and Premiere. But I’m not that happy with the process

[@mierdamegusta]

This is the kind of "Let's plays" I want (:

[@RuslanKoptiev]

Wow! I never know that it's possible to reload modules during runtime in python. Cool!

[@helgesverre]

Great content, learning lots here :D keep it up

[@A___Way]

Great info, keep up the excellent work

[@agustinscaz15]

In this video you can develop a proxy as the game server is accessed via DNS name (game.pwn3): what you can do if the game server is accessed using IP addresses?

[@EvilSapphireR]

Ip spoofing.

[@hexploit2736]

Hey man, did you figure it out?

[@D3adStyle]

Why are you using the buffer size of 4096 for receiving files? How did you figure out that you need that value? Or was it just the thought "to have the buffer big enough"?

[@LiveOverflow]

Big enough

[@xyptul]

Because the data was probably too big to receive

[@Rednesswahn]

The next video is already the 10th in this series! Time flies!

[@R13TechNewbie]

We should make this video be a trending video on youtube 😸

[@Gem-gi7km]

What would need to be change to develop a UDP proxy? (ex. change socket type, ...etc.)

[@spazman6117]

Where are you getting the IP from that you put into your HOST file and the master.pwn3 part from???? And how are you opening python to look like that? The latest python when I open it, only shows me a command window?????

[@maxistarling]

WoW, you amazed me.

[@lentsukimori8288]

Loved it!!

[@YaBoyZesty]

This is the exact same thing a runescape player named kaitnieks did to hack runescape back in 2002, there were no youtube, google was very young so very little tutorials. Genius

[@j3ker491]

Your Channel is so great ! ^^

[@__mk_km__]

I started with proxy, turns out I should've gone to messing with binaries. Mine one is running on node.js, because for some reason JavaScript is the language that is easiest for me

[@hoxorious]

a wonderful video again

[@gw2exploits83]

Can you make a guide specifically on making Python proxy servers?

[@philippep4036]

wait , i don't understand , proxy might be impossbiel with the ash code that the server had?? so why u can use those datas?

[@brainface2970]

You forgot to add the info thing for your TCP Video.

[@LiveOverflow]

what do you mean?

[@realNAKAMI]

1:03 top right corner. looks like you intended to put a link there...

[@Rednesswahn]

LiveOverflow It's called infocard (youtube)

[@medjassertoubib4467]

well done . ther i only respect i have throw you . i wish you all the best :)

[@Anonymouspock]

Are you participating in the Google CTF this weekend?

[@DreamBlackHD]

while i try to start the file, with the ip and port, i receive this error: socket.error: [Errno 10013] An attempt was made to access a socket in a way forbidden by its access permissions. using python 2.7

[@jordantrogdon7547]

I need help somebody i followed tutorial and everytime i open my python script in terminal it just says setting up proxy and never actually shows packets please help

[@pcccmn]

I don't understand why implementation on master server is necessary. Can't we just implement the proxy connecting to the game server? Meaning the user manually logs in, then runs the tcp proxy.

[@ragnarlothbrok367]

I don't fucking understand a shit from this loopsy code, the only thing lacking in it is 14421321312521 recursions, great job

[@ArturKorobeynyk]

Watched video, got and idea on how to improve this script... and then found a bug in our production code while testing my idea. That is a like

[@LiveOverflow]

Tell me more :P

[@ArturKorobeynyk]

Well, first of all I thought that Ctrl+C in your case does not work because you wrapped the whole logic in try catch Exception. And KeyboardInterrupt (Ctrl+C) is subclass of Exception. I was about to comment but I wanted to double check first. I did not want to setup the game so I was testing on one service. And I realized that my client actually changes its server once every 3-4 minutes and the range of IPs is unknown to me and cannot be predicted. And this logic is normal nowadays as most MMOs either use several servers to balance server load. That is when I found out that Wireshark is not able to track traffic per application (at least out of the box, of course custom modules can be written). So I started to make my own script using psutil.net_connections() and filtering results for needed pid then intercepting packets for all those connections. And that is where I saw TCP handshake: SYN -> SYN-ACK -> ACK was broken.

[@smilecat2841]

can you do that to other online games? like a legends of league, fornite, dota 2

[@yattsu8660]

this is so useful. i do have a problem, i'm getting an error because the port that the game client sends requests from is already in use. the "socket.SOL_SOCKET, socket.SO_REUSEADDR, 1" option did nothing unfortunately. how can i get over this?

[@BlackDawn]

Can your proxy code be used to forward and intercept udp packets as well?

[@jeyfus]

You would need to change SOCK_STREAM to SOCK_DGRAM for each socket declaration

[@JohnSmithULIR0]

It's 2018, and people still use python 2.6.... SMH... I just hope they really discontinue it pretty soon, which it's already about to happen yay! xD - Apart from that, been loving the series so far!

[@LiveOverflow]

bye bye good/simple/straightforward raw byte support with strings in python :'(

[@metaorior]

Thank you sir

[@PKperformanceEU]

all good, however the encryption makes it unreadable, so while yes you see packets when making proxy, those are useless. instead you should hook the ws2send function, that way you will see the raw data.

[@kenji2787]

@PKperformance do you have a link tutorial where one can learn about this? I couldn’t find anything on ws2send, and hook is too common of a word.

[@nenojay6832]

one thing I don't understand is, why do you have both the g2p and p2s inside the run method inside a while loop? why do we need the while loop?

[@LiveOverflow]

Because we have to receive packets from the game, g2p. And then directly forward them to the player p2s.

[@nenojay6832]

@@LiveOverflow I tried to make a little example of the sockets and to my surprise it worked without the whole loop inside the Proxy class

[@TheJJ100100]

Nice!

[@mohammedabdo.m576]

great I'll make one

[@КАЖАНГЕЙМіНҐ]

how do you get what ports are uses for client/server? Cant find that video

[@lucasnany397]

I'm trying to make a proxy server but with an online server. But I can't find a fff way to redirect outgoing traffic to localhost! Hosts don't help.

[@crispy_rw]

What is the reason he only receives 4096 bytes from the Game Server??

[@omralmdni2835]

What are the benefits of writing a custom python proxy over using something like wireshark. Auto-didactic benefits, such as learning how to make a proxy in python, do not count ;)

[@LiveOverflow]

Why does that not count? Also can you manipulate traffic with wireshark or even inject packets? ;)

[@o.l._l.o.000]

How can you dislike this video? :O

[@Im_Ninooo]

this would be soooooo easy and efficient to implement in Golang

[@xfadedxshadow]

Im confused your pointing the same address to 2 different things in the host file??

[@waqarahmed4200]

Why just not use Wireshark intercept tcp traffic and reversing .....?

[@packiathaik2532]

Hi I'm not experience with python 2 can you say what super(Proxy2Server,self).__init__() means?

[@portswigger1038]

hello, how can we add client's server ip address to Proxy2Server automatically.

[@cassandradawn780]

He: Wireshark Me: Bioshark

[@henke37]

Protip: it's all wrong. Use one thread, not three. The select function lets you know which socket has data and/or is done sending data. That's the style points. The big problem next is the failure to understand that tcp is a stream based protocol. One recv call can return data for multiple "packets". And/or the head and/or tail of one. You need to buffer and wait for a "complete" packet. Oh, and don't forget to deal with receiving multiple packets in one go. Of course, this is easier said than done when starting out. You kinda need to know what size the "packets" are.

[@LiveOverflow]

Agreed with the select part. That would probably have been more elegant... it's the first time I have done more "complex" networking besides a simple socket test program and it works, so whatevs ;) But thanks for pointing that out! > Of course, this is easier said than done when starting out. You kinda need to know what size the "packets" are. That's exactly the issue! We don't know. However we can kind of take single `recv()` as a single packet for now. that will make the `parse.py` soo much simpler. Of course in theory it's a stream, but if we receive less than 4096 bytes we can kind of assume that it's most likely contain at least one whole packet. Also it's very unlikely that the game will fill-up the complete network buffers to really see a stream. It sends the data chunks out so slow, that we can work with single `recv()` for now. In the end this is just a hacky proxy to work with this game and not some kind of generic TCP proxy product for consumers - as long as it works for what we want to do it's perfectly fine ;) I never claimed to be a great developer :D

[@hoangbui8373]

That is why for many game packet, you will see a byte(s) field for packet size usually the first two or so bytes. However, from the video - it look like the first 12 bytes are for your position. Maybe it is padded somewhere after that.

[@DanKaschel]

"it's all wrong" proceeds to nitpick a minor design detail

[@puct9]

It's all wrong because he doesn't use Python 3 >:(

[@hysenndregjoni853]

If it was all wrong it wouldn't work. Pragmatically it is all right, at least right enough.

[@darkbestower9999]

Can you make a video or series on cracking ransomware, specifically, GandCrab V3? It would be very appreciated and helpful and even fun for you!