Developing a TCP Network Proxy - Pwn Adventure 3

Part 9: To analyse the game traffic, we are developing a simple proof of concept TCP network proxy. Then we can start to reverse engineer the protocol.
GitHub: github.com/Liv...
🌴 Playlist: • Pwn Adventure 3: Pwnie...
=[ 🔴 Stuff I use ]=
→ Microphone:* geni.us/ntg3b
→ Graphics tablet:* geni.us/wacom-...
→ Camera#1 for streaming:* geni.us/sony-c...
→ Lens for streaming:* geni.us/sony-l...
→ Connect Camera#1 to PC:* geni.us/cam-link
→ Keyboard:* geni.us/mech-k...
→ Old Microphone:* geni.us/mic-at...
US Store Front:* www.amazon.com...
=[ ❤️ Support ]=
→ per Video: / liveoverflow
→ per Month: / @liveoverflow
=[ 🐕 Social ]=
→ Twitter: / liveoverflow
→ Website: liveoverflow.com/
→ Subreddit: / liveoverflow
→ Facebook: / liveoverflow
=[ 📄 P.S. ]=
All links with "*" are affiliate links.
LiveOverflow / Security Flag GmbH is part of the Amazon Affiliate Partner Programm.
#PwnAdventure #NetworkSecurity #CTF

[@andreerfabbro]

LOVE YOUUUUU! KEEP IT UP!! Seriously, this KZbin series is some of the highest level stuff I’ve ever seen. ❤️

[@d3m815]

same

[@muuzis]

LOL as lots of love

[@GrandpaGameHacker]

This is so awesome!!! I'm taking out of it some python i didn't know too ☺

[@benusman1738]

Yep, I also binge watched the whole thing and can not wait for the next part to be released! Also, author has really good feel of what is interesting and what is dumb and technical. At least from my perspective. I really like it!

[@kfftfuftur]

Actually it is low level stuff he is doing.

[@Simon8162]

TIL your can reload modules in python

[@apenasmeucanal5984]

Simon816 in python 3 the “reload” function has been moved to “importlib” tho

[@alexandrerozier1305]

jeez that was a smart move right :)

[@nonchip]

had a similar experience with lua lately. turns out `require(name)` does its caching magic by just always returning `package.loaded[name] or some_complicated_load_logic(name)`. guess what happens if you `require("package").loaded[name]=nil`. can also be exploited in reverse: `require("package").loaded._some_dummy_global={}` makes every `require("_some_dummy_global")` (even though that module doesn't exist) in THE WHOLE VM (no matter the global environment being sandboxed, it living in another thread, etc) access the same table.

[@benjaminbrady2385]

I just want you to know that when I saw this I actually jumped with joy. The content you make has such a powerful positive effect on a lot of people and, at least for me, motivates. So thank you

[@ASCENDANTGAMERSAGE]

DUUUUDE THAT CLIFFHANGER I WANT THNEXT EPISODE NOOOOOW but I understand these take alot of hard work to make, keep it up, you're doing great. Don't rush anything :) PS you deserve more views

[@triularity]

Makes me think of that one episode of Star Trek: TNG with "kiddie Picard".. kzbin.info/www/bejne/gmjIo5qMh5ummJY

[@milahu]

cliffhanger? 11:37 shows the player's X Y Z positions sent to the server. see also 12:04

[@pete3897]

Over 2 years old and only 250 comments - I owe you a comment on this one then. Loving the playlist! Loving the content! Think of the effect you've had on so many people's education; you're more effective than many teachers and I think it's just your hobby?! :) Great work; be proud

[@johndelta4319]

I worked along with this and made a script a lot like this(Python3), this works for A LOT of games. Thank you sir i can't thank you enough!

[@nifengjujuzhang8429]

Do you know how to connect the client to the proxy for other online games? I tried to edit the host file to map proxy IP to game's host name, but it doesn't work :/

[@mopozow6624]

@@nifengjujuzhang8429 Did you found a solution?

[@ulissemini5492]

this, is, awesome! i never knew you could reload libraries mid python script and that totally blew my mind!

[@wdai03]

Oh man the way you handled the parser with the reload and exception catcher is pretty smart. If it was me I'd probably just end restarting the whole thing a billion times and cursing

[@arisweedler4703]

I've been watching all of these today, and HOLY moly this is fun and exciting! You take all the in-the-weeds stuff and call it out for being frustrating and tough, which is really validating. A lot of these tests just take confidence and willingness to potentially waste time - or as I feel after watching this, learn stuff but make less progress than I hoped. Thank you, big thank you :))))))))))) I love it

[@legendkerl1650]

What?! I've reached the end of the playlist? It's 3:00 AM and I want moar of this :D Love your series and how you explain everything!

[@nifengjujuzhang8429]

Do you know how to connect the client to the proxy for other online games? I tried to edit the host file to map proxy IP to game's host name, but it doesn't work :/

[@nielsjonkman7196]

Your voice is SO chilling omg. Awesome vid as always! ;)

[@Fabian-_-]

Wow, wirklich die beste Serie auf KZbin! Mach weiter so! Finde es auch sehr gut erklärt für Leute die sich nicht so mit den sonst so krassen Dingen auf deinem Kanal auskennen ^^ und ich konnte n paar Sachen für Python an sich lernen :D 👍

[@ScottJFox]

Ich stimme dir zu, ich bin gespannt auf mehr! (Ich bin ein Anfänger auf Deutsch, Entschuldigung.)

[@Fabian-_-]

Scott passt schon :D wenn ich dir helfen darf: "Anfänger in Deutsch" ;)

[@ScottJFox]

Vielen Dank!! Ich schätze es! Es ist einfacher zu lesen als zu schreiben.

[@himanshuagarwal3451]

You changed my perspective about programming and networking and made it so much fun .. Great work .. Keep it up ..

[@mywave82]

TCP socket is not packet-based, but stream. Assuming that each read operation will always hit the internal protocol packet boundaries will sometimes fail. IP stacks in all end-points can in there buffering split and join up data as they see fit

[@mierdamegusta]

This is the kind of "Let's plays" I want (:

[@InjectionSec]

I recently wrote an elevator attack simulator for university research that emulated sockets in python using pipes and we performed MitM attacks in a similar way (just locally instead of over the network). I WISH I HAD KNOWN ABOUT THE ABILITY TO RELOAD!!!! Every time we wanted make changes to our parser we had to kill it all and start over, so stupid! It’s always the little things *facepalm*. This series is awesome keep it up!

[@rickiwinner]

I bet you will never forget that xD

[@Andy-lf4di]

Protip: Set self.daemon = True in the threads. No need to kill the script then. Cleanup may be skipped for the threads on exit as they are just killed if the script receives a SIGINT, but that's also the case when you just kill the script and still good enough for a hacky proxy.

[@hblaub]

Nice introduction to proxies and to Python ! You are great

[@ScottJFox]

Hopefully he learns Python 3 though. :D

[@jacobledbetter8243]

This helped me fix an issue where I was doing Thread.run() instead of Thread.start() thanks for fixing a totally unrelated issue.

[@futhorck771]

liveoverflow is like "I'm not an expert but.." then proceeds to do the thing amazingly well

[@TheMtenn100]

You are a monster. I love your videos, please keep on doing, you're amazing at this

[@patrick1020000]

awesome use of reload

[@Railrat420]

Best series on KZbin right here no doubt about it

[@sanderninenine5333]

Thank you so much!! Please never stop youtube, i love you :D.

[@NeoCortex3]

Boy I just love the Pwn Adventure 3 videos

[@spicybaguette7706]

One interesting idea is to issue commands to the network proxy via chat. You can even use a custom ASCII control character like ESC and invoke the commands from code you have overwritten with LD_PRELOAD! (Maybe custom keybindings or something)

[@Fachher]

Nice video. Well done. Keep on. I think the data at the end show us the result of the soccer match tomorrow (GER - SWE).

[@jonasvanderschaaf]

Finally I love this series. It is my favourite series!

[@frognik79]

Very rare that a game doesn't use encrypted packets but a good start.

[@MrDavidCrane]

hex-encoded floating point triples for location data

[@Justin-oo3bh]

Ok so I never knew about the reload method and wow is that going to be VERY useful in the future

[@agustinscaz15]

In this video you can develop a proxy as the game server is accessed via DNS name (game.pwn3): what you can do if the game server is accessed using IP addresses?

[@EvilSapphireR]

Ip spoofing.

[@hexploit2736]

Hey man, did you figure it out?

[@BrandNewByxor]

I've written a shitload of python over the last couple of years, but I haven't seen anything as cool as the `reload` function in months. Mind blown.

[@NoNameBAM]

4:59 you can hear a quiet Discord notification sound ;)

[@foor]

wow

[@jordantrogdon7547]

I need help somebody i followed tutorial and everytime i open my python script in terminal it just says setting up proxy and never actually shows packets please help

[@GamePlayByFaks]

At the end gives possibility to manipulate position also gives pointers to write advanced hacking trainers or etc... so can go wild with that.

[@elertan]

You could also place socket hooks in the game itself, instead of creating a proxy. You should look into hooking the send and recv functions.

[@wtfman468]

Fr easy to understand tutorial

[@thiagosoares6362]

This video deserves millions of like

[@logix2435]

Nice! I love this series so much keep going!

[@haydene3802]

Question. Around 11 minutes the python script was being modified while also being ran. Is this possible or was it just video editing? I tried with my own python packet sniffer script and it just continues to run. Tried googling around as well. Been going through your past videos as I learn more and gain confidence, thank you for making them

[@tobe2105]

I'd gone for a simpler approach, hooking the functions the game uses to send and receive data. A proxy, however, is a fairly more universal approach. Not to mention it works just well since the packets aren't encrypted.

[@Adolf1Extra]

I know I'm late, but you might want to take a look at tera-proxy, it's related to this.

[@icryo]

Excited for this one!! Thanks!!

[@R13TechNewbie]

We should make this video be a trending video on youtube 😸

[@270jonp]

Seriously a awesome adventure

[@luax0]

Thanks you for all of your videos !!!

[@RuslanKoptiev]

Wow! I never know that it's possible to reload modules during runtime in python. Cool!

[@ragnarlothbrok367]

I don't fucking understand a shit from this loopsy code, the only thing lacking in it is 14421321312521 recursions, great job

[@muhammetaliarturk7107]

such an amazing work man thanks , keep your works up :) 🤙

[@L0j1k]

Cheeses. I just finished watching this after the previous 8 in a row, and I have to tell you... I am starting to feel like someone watching a baseball game, and it's the fourth inning and people are starting to notice that the pitcher only thrown strikes and not a single player from the opposing team has gotten on base the whole game.

[@DreamBlackHD]

while i try to start the file, with the ip and port, i receive this error: socket.error: [Errno 10013] An attempt was made to access a socket in a way forbidden by its access permissions. using python 2.7

[@slagunes4705]

So creative, keep it up dude!

[@crispy_rw]

What is the reason he only receives 4096 bytes from the Game Server??

[@JohnSmithULIR0]

It's 2018, and people still use python 2.6.... SMH... I just hope they really discontinue it pretty soon, which it's already about to happen yay! xD - Apart from that, been loving the series so far!

[@LiveOverflow]

bye bye good/simple/straightforward raw byte support with strings in python :'(

[@chidaruma_]

Dude this is amazing! Great videos!

[@YaBoyZesty]

This is the exact same thing a runescape player named kaitnieks did to hack runescape back in 2002, there were no youtube, google was very young so very little tutorials. Genius

[@A___Way]

Great info, keep up the excellent work

[@palmenros]

In the Proxy class, run function, why is everything inside a While True loop? Wouldn't that mean that it would create new game2proxy and Proxy2Server every iteration? Thanks

[@LiveOverflow]

The one call is waiting until a client connects. And only then the loop continues and creates a new object to wait for the next player.

[@palmenros]

Thanks! I completely forgot about multiple players...

[@EvilSapphireR]

LiveOverflow I'm sorry, but what do you mean by "the one call"?

[@helgesverre]

Great content, learning lots here :D keep it up

[@sSoKoSs]

GODLIKE!

[@Rednesswahn]

The next video is already the 10th in this series! Time flies!

[@ArturKorobeynyk]

Watched video, got and idea on how to improve this script... and then found a bug in our production code while testing my idea. That is a like

[@LiveOverflow]

Tell me more :P

[@ArturKorobeynyk]

Well, first of all I thought that Ctrl+C in your case does not work because you wrapped the whole logic in try catch Exception. And KeyboardInterrupt (Ctrl+C) is subclass of Exception. I was about to comment but I wanted to double check first. I did not want to setup the game so I was testing on one service. And I realized that my client actually changes its server once every 3-4 minutes and the range of IPs is unknown to me and cannot be predicted. And this logic is normal nowadays as most MMOs either use several servers to balance server load. That is when I found out that Wireshark is not able to track traffic per application (at least out of the box, of course custom modules can be written). So I started to make my own script using psutil.net_connections() and filtering results for needed pid then intercepting packets for all those connections. And that is where I saw TCP handshake: SYN -> SYN-ACK -> ACK was broken.

[@pcccmn]

I don't understand why implementation on master server is necessary. Can't we just implement the proxy connecting to the game server? Meaning the user manually logs in, then runs the tcp proxy.

[@Gem-gi7km]

What would need to be change to develop a UDP proxy? (ex. change socket type, ...etc.)

[@prakashyadav008]

can u mention any good resources for learning disassembly using gdb ? I hav started my information security career and wanna study malware analysis .So it starts with reverse engineering.

[@LiveOverflow]

Just learning by doing and google the instructions you don’t understand etc. keep an eye out for repeating patterns in the assembly code.

[@medjassertoubib4467]

well done . ther i only respect i have throw you . i wish you all the best :)

[@zafercagatayumut916]

I get socket.error: [Errno 10013] An attempt was made to access a socket in a way forbidden by its access permissions error

[@j3ker491]

Your Channel is so great ! ^^

[@maxistarling]

WoW, you amazed me.

[@Im_Ninooo]

this would be soooooo easy and efficient to implement in Golang

[@__mk_km__]

I started with proxy, turns out I should've gone to messing with binaries. Mine one is running on node.js, because for some reason JavaScript is the language that is easiest for me

[@lentsukimori8288]

Loved it!!

[@Pumpekk]

Hey, great stuff. Quick question: what would you do if you couldn't use hosts file? How can you translate destination IP address so it could go to your proxy (on Windows)?

[@buraktarm1463]

You have to hook the connect function from windows socket dll in the game then change ip to your proxy. You can use detours or easyhook.

[@yattsu8660]

this is so useful. i do have a problem, i'm getting an error because the port that the game client sends requests from is already in use. the "socket.SOL_SOCKET, socket.SO_REUSEADDR, 1" option did nothing unfortunately. how can i get over this?

[@spazman6117]

Where are you getting the IP from that you put into your HOST file and the master.pwn3 part from???? And how are you opening python to look like that? The latest python when I open it, only shows me a command window?????

[@hoxorious]

a wonderful video again

[@sreyanchakravarty7694]

First of all why did you need a 3rd thread? Why make the Proxy class a thread? Why not just make it a wrapper class? And why did you not break out from the loop in the run method in the Proxy class. Doesnt that mean that the Proxy class will just keep making connections? Since its run method never exits?

[@omarbgm5898]

well im still confused about the 3002 to 3006 ports for example my game here when i get to log in there is a label says its a 5555 port and when i use wireshark there is no port other than 5555 so im confused over what should i do about this can anyone help ?

[@NavanBethrax]

Gonna try to implement a generic game-proxy in vb.net. If i know the encryption method would it be possible to decrypt and encrypt the data on the fly or would it be a problem performance wise (packet loss or something) ? And nice video mate i always wanted to do something like this but i didn't came up with a concept.

[@o.l._l.o.000]

How can you dislike this video? :O

[@PKperformanceEU]

all good, however the encryption makes it unreadable, so while yes you see packets when making proxy, those are useless. instead you should hook the ws2send function, that way you will see the raw data.

[@kenji2787]

@PKperformance do you have a link tutorial where one can learn about this? I couldn’t find anything on ws2send, and hook is too common of a word.

[@batlin]

How did you create your animated diagrams? I'm using Impress with SVG animation export now but would be keen to hear about nicer methods.

[@LiveOverflow]

Photoshop and Premiere. But I’m not that happy with the process

[@philippep4036]

wait , i don't understand , proxy might be impossbiel with the ash code that the server had?? so why u can use those datas?

[@lucasnany397]

I'm trying to make a proxy server but with an online server. But I can't find a fff way to redirect outgoing traffic to localhost! Hosts don't help.

[@Yotanido]

So you are one of those people who still use python 2 for new programs, huh?

[@RoiEXLab]

Yndostrui IKR

[@metaorior]

python is versatile

[@RobertPendell]

Something wrong with Python 2?

[@ryuuji159]

since 2008 exists python 3, maybe 10 years is enought to replace that old python 2

[@metaorior]

well i guess he's just more used to the syntax, as he mentioned in the video

[@portswigger1038]

hello, how can we add client's server ip address to Proxy2Server automatically.

[@D3adStyle]

Why are you using the buffer size of 4096 for receiving files? How did you figure out that you need that value? Or was it just the thought "to have the buffer big enough"?

[@LiveOverflow]

Big enough

[@tulparid]

Because the data was probably too big to receive

[@brainface2970]

You forgot to add the info thing for your TCP Video.

[@LiveOverflow]

what do you mean?

[@realNAKAMI]

1:03 top right corner. looks like you intended to put a link there...

[@Rednesswahn]

LiveOverflow It's called infocard (youtube)

[@xfadedxshadow]

Im confused your pointing the same address to 2 different things in the host file??

[@gw2exploits83]

Can you make a guide specifically on making Python proxy servers?

[@packiathaik2532]

Hi I'm not experience with python 2 can you say what super(Proxy2Server,self).__init__() means?

[@user-rw4qr8uv1f]

how do you get what ports are uses for client/server? Cant find that video

[@metaorior]

Thank you sir

[@smilecat2841]

can you do that to other online games? like a legends of league, fornite, dota 2

[@c2h2c2h210]

good one, but for networking Go is way better and simpler

[@HL2013Master]

@LiveOverflow What if the hosts file does not redirect the traffic to localhost? for example 127.0.0.1 37.114.57.220 will not redirect the traffic destined for 37.114.57.220 to localhos

[@nenojay6832]

one thing I don't understand is, why do you have both the g2p and p2s inside the run method inside a while loop? why do we need the while loop?

[@LiveOverflow]

Because we have to receive packets from the game, g2p. And then directly forward them to the player p2s.

[@nenojay6832]

@@LiveOverflow I tried to make a little example of the sockets and to my surprise it worked without the whole loop inside the Proxy class

[@mohammedabdo.m576]

great I'll make one

[@CrypticConsole]

Proxy to localhost if you want to run the exploit on one pc

[@ff6106]

hi how i can i do this