SDN Opendaylight Controller: Add/Remove Flow Entries using OSGI CLI

Start Controller
$ ./run.sh

Start Switches using mininet
$ sudo mn --topo single,2 --controller remote,ip=192.168.56.101 --switch ovsk,protocols=OpenFlow13

osgi> addMDFlow openflow:1 f40
osgi> removeMDFlow openflow:1 f40

f40 is and XML file, f40.xml located at openlowplugin/test-scripts/xmls which is part of your openflowplugin git clone.

You can also execute addMDFlow command as shown below
osgi> addMDFlow openflow:1 f40 8
where 8 represents new Table ID.

To make sure flows are pushed onto OpenvSwitch(OVS) execute below command
$ sudo ovs-ofctl -O OpenFlow dump-flows s1


Adding a Flow Entry to Switch using OSGI CLI.

Verifying Flow Entry exists on Switch by executing ovs-ofctl command on machine where Mininet is running.

Removing a Flow Entry on Switch using OSGI CLI

Verifying Flow Entry exists on Switch by executing ovs-ofctl command on machine where Mininet is running.

Below articles might be of interest
ovs-ofctl OVS action commands for OpenFlow 1.3
http://blog.disects.com/2014/01/ovs-ofctl-ovs-action-commands-for.html

 ovs-ofctl commands on OpenFlow 1.3 Mininet Open vSwitch (OVSK)
http://blog.disects.com/2014/01/ovs-ofctl-commands-on-openflow-13.html

Info to Exploit Writing

https://code.google.com/p/it-sec-catalog/wiki/Exploitation

Exploit writing tutorials from corelanc0d3r
https://www.corelan.be/
http://www.exploit-db.com/

Heap overflow
https://net-ninja.net/

Heap Spray
https://www.corelan.be/index.php/2011/12/31/exploit-writing-tutorial-part-11-heap-spraying-demystified/
http://www.fuzzysecurity.com/tutorials/expDev/8.html
https://www.greyhathacker.net/?p=549
https://community.rapid7.com/community/metasploit/blog/2013/03/04/new-heap-spray-technique-for-metasploit-browser-exploitation
https://www.corelan.be/index.php/2013/02/19/deps-precise-heap-spray-on-firefox-and-ie10/

Use After Free
http://www.fuzzysecurity.com/tutorials/expDev/11.html
http://www.thegreycorner.com/2010/01/heap-spray-exploit-tutorial-internet.html
http://www.blackhat.com/presentations/bh-usa-07/Afek/Whitepaper/bh-usa-07-afek-WP.pdf

Installing CPqD switch, invoke using Mininet and OpenFlow 1.3 for Communication

Installing CPqD switch on Mininet instead of OVSK.

If OVSK is already installed remove it using below commands

sudo kill `cd /usr/local/var/run/openvswitch && cat ovsdb-server.pid ovs-vswitchd.pid`

sudo /etc/init.d/openvswitch-switch stop

sudo apt-get remove openvswitch-common openvswitch-datapath-dkms openvswitch-controller openvswitch-pki openvswitch-switch

Git clone mininet
Below git command will check out the latest Mininet
git clone git://github.com/mininet/mininet.git

If you want to run the last tagged/released version of Mininet, use
git clone git://github.com/mininet/mininet
git checkout -b 2.1.0 2.1.0

Install CPqD
cd mininet/util
sudo ./install.sh -n3fx

Start CPqD Switch
sudo mn --topo single,2 --controller remote,ip=192.168.1.8 --switch user,protocols=OpenFlow13

CPqD works in User space and OVS works in kernel space.

To get the dpid of CPqD switch
sudo dpctl tcp:127.0.0.1:6634 features

To get the stats and flow rule for CPqD switch:
dpctl tcp:127.0.0.1:6634 stats-flow

dpctl doc
https://github.com/CPqD/ofsoftswitch13/wiki/Dpctl-Documentation

ovs-ofctl OVS action commands for OpenFlow 1.3

Add flows to Open vSwitch (OVSK)

Modify VLAN ID on a packet.

mininet@mininet-vm104:~$ sudo ovs-ofctl -O OpenFlow13 add-flow s1 "dl_type=0x0800,metadata=12345,cookie=8,table=2,actions=mod_vlan_vid:101"

mininet@mininet-vm104:~$

To list flows added to vSwitch

mininet@mininet-vm104:~$ sudo ovs-ofctl -O OpenFlow13 dump-flows s1

OFPST_FLOW reply (OF1.3) (xid=0x2):

 cookie=0x8, duration=20.959s, table=2, n_packets=0, n_bytes=0, ip,metadata=0x3039 actions=mod_vlan_vid:101

mininet@mininet-vm104:~$

To delete flows

mininet@mininet-vm104:~$ sudo ovs-ofctl -O OpenFlow13 del-flows s1

mininet@mininet-vm104:~$ sudo ovs-ofctl -O OpenFlow13 dump-flows s1

OFPST_FLOW reply (OF1.3) (xid=0x2):

mininet@mininet-vm104:~$

Modify VLAN priority on a packet. Valid values are between 0 (lowest) and 7 (highest).

mininet@mininet-vm104:~$ sudo ovs-ofctl -O OpenFlow13 add-flow s1 "dl_type=0x0800,metadata=12345,cookie=8,table=2,priority=100,actions=mod_vlan_pcp:7"

mininet@mininet-vm104:~$

mininet@mininet-vm104:~$

mininet@mininet-vm104:~$ sudo ovs-ofctl -O OpenFlow13 dump-flows s1       
OFPST_FLOW reply (OF1.3) (xid=0x2):

 cookie=0x8, duration=4.512s, table=2, n_packets=0, n_bytes=0, priority=100,ip,metadata=0x3039 actions=mod_vlan_pcp:7

mininet@mininet-vm104:~$

mininet@mininet-vm104:~$ sudo ovs-ofctl -O OpenFlow13 add-flow s1 "dl_type=0x0800,metadata=12345,cookie=8,table=2,priority=100,actions=push_mpls:0x8847"

mininet@mininet-vm104:~$

mininet@mininet-vm104:~$

mininet@mininet-vm104:~$ sudo ovs-ofctl -O OpenFlow13 dump-flows s1       
OFPST_FLOW reply (OF1.3) (xid=0x2):

 cookie=0x8, duration=4.49s, table=2, n_packets=0, n_bytes=0, priority=100,ip,metadata=0x3039 actions=push_mpls:0x8847

mininet@mininet-vm104:~$

IPv4 ToS/DSCP must be a multiple of 4 between 0 and 255.

mininet@mininet-vm104:~$ sudo ovs-ofctl -O OpenFlow13 add-flow s1 "dl_type=0x0800,metadata=12345,cookie=8,table=2,priority=100,actions=mod_dl_src:11:11:11:11:11:11,mod_dl_dst:22:22:22:22:22:22,mod_nw_src=1.1.1.1,mod_nw_dst=2.2.2.2,mod_nw_tos:16"

mininet@mininet-vm104:~$

mininet@mininet-vm104:~$ sudo ovs-ofctl -O OpenFlow13 dump-flows s1       
OFPST_FLOW reply (OF1.3) (xid=0x2):

 cookie=0x8, duration=3.884s, table=2, n_packets=0, n_bytes=0, priority=100,ip,metadata=0x3039 actions=mod_dl_src:11:11:11:11:11:11,mod_dl_dst:22:22:22:22:22:22,mod_nw_src:1.1.1.1,mod_nw_dst:2.2.2.2,mod_nw_tos:16

mininet@mininet-vm104:~$

For manpage you can refer below link

http://openvswitch.org/cgi-bin/ovsman.cgi?page=utilities%2Fovs-ofctl.8

ovs-ofctl commands on OpenFlow 1.3 Mininet switch (ovsk)

ovs−ofctl program is a command line tool for monitoring and administering OpenFlow switches. It can also show the current state of an OpenFlow switch, including features, configuration, and table entries. It should work with any OpenFlow switch, not just Open vSwitch.

Before pushing the flows we need to start mininet switch. using below command(also shown in snapshot).
sudo mn --topo single,2 --controller remote,ip=192.168.56.103:6653 --switch ovsk,protocols=OpenFlow13
where,
192.168.56.103 is openflowplugin Controllers IP Address and protocols=OpenFlow13 states that we need to use OpenFlow protocol version 1.3, tcp/6653 is used for OF1.3 communication and 6633 for OF1.0.
Point to note here, Mininet and Controller are running on different Virtual Machines.

 If the above command is successfully executed we should see OF1.3 communication between OVSK(switch s1 here) and SDN Controller.
Flows can be added as

sudo ovs-ofctl -O Openflow13 add-flow s1 in_port=1,actions=nw_ttl:2,output:2

sudo ovs-ofctl -O OpenFlow13 add-flow s1 priority=11,dl_type=0x0800,nw_src=10.0.0.1,action=mod_tp_dst:8888

If the above command is successfully configured on OVSK we should successfully dump flows.
mininet@mininet-vm:~$ sudo ovs-ofctl -O OpenFlow13 dump-flows s1
OFPST_FLOW reply (OF1.3) (xid=0x2):
 cookie=0x0, duration=7.443s, table=0, n_packets=0, n_bytes=0, priority=11,ip,nw_src=10.0.0.1 actions=mod_tp_dst:8888

ovs-ofctl connects to an OpenFlow switch using ssl, tcp(ip and port), socket file, unix file etc. ovs-ofctl talks to ovs-vswitchd, and ovs-vsctl talks to ovsdb-server.

Detailed options can be found at
http://openvswitch.org/cgi-bin/ovsman.cgi?page=utilities%2Fovs-ofctl.8

Manual Unpacking of UPX Packed Binary File

FileName: calc.exe
MD5: 829e4805b0e12b383ee09abdc9e2dc3c
File Size: 114688
Source: C:\WINDOWS\system32
OS Used: Windows XP Pro SP3 (English)

Create UPX Packed binary using below command
upx -9 -o calc_upx9.exe calc.exe

File Size after packing is 57856 bytes

Packer Info

Lets start unpacking, load the file to OllyDBG. OllyDBG detects and warns about the Packer, ignore the message (click NO).

0x01020250  is the current Entry Point

01020250  60               PUSHAD

Real OEP = OEP find in Olly - Image Base

Real OEP = 0x01020250 - 0x01000000

After ignoring the warning, step over (F8) POPAD, right click on ESP(0x0006FFA4) and follow in dump.

POPAD will push all the REGISTERs values onto Stack.

In the dump window select first 2/4 bytes and go for a hardware breakpoint on access as shown below. First 4 bytes selected is the value of EDI Register on Stack in little endian format.

Run the binary (F9) after setting the breakpoint, will stop execution when hits a break point (0x010203CE). When breakpoint is hit the CPU is

010203CD   61               POPAD

010203CE   8D4424 80        LEA EAX,DWORD PTR SS:[ESP-80]

010203D2   6A 00            PUSH 0

010203D4   39C4             CMP ESP,EAX

010203D6  ^75 FA            JNZ SHORT calc_upx.010203D2

010203D8   83EC 80          SUB ESP,-80

010203DB  -E9 9520FFFF      JMP calc_upx.01012475

Put a breakpoint at 0x010203DB (first JUMP instruction after POPAD), press F9 and when we hit the breakpoint single step (F8) one time from JUMP, will land at

01012475   6A 70            PUSH 70

01012477   68 E0150001      PUSH calc_upx.010015E0

Right click on 0x01012475 and "Dump debugged process", copy the value in Modify text box which will be our OEP and  click on Dump button which will create a new binary (dump_test.exe here).

dump_test.exe is not executable since it doesn't have proper Import Address Table (IAT). Executing the binary will throw below error

Load the original binary (calc.exe) into ImportREC, paste the OEP copied from Modify text field when creating dump file. Click on AutoSearch to automatically search IAT's. Will give below log message

Original IAT RVA found at: 0000120C in Section RVA: 00001000 Size:00018000

Now click on GetImports which will throw below log if everything goes fine.

IAT read successfully.

------------------------------------------------

Current imports:

6 (decimal:6) valid module(s) (added: +6 (decimal:+6))

84 (decimal:132) imported function(s). (added: +84 (decimal:+132))

Now click on FixDump and select  dump_test.exe, ImportREC will fix dump_test.exe and creata a new file dump_test_.exe, see below logs

*** New section added successfully. RVA:00029000 SIZE:00001000

Image Import Descriptor size: 78; Total length: 908

C:\Documents and Settings\praveen\Desktop\UnpackMe\upx_calc\dump_test_.exe saved successfully.

To cross verify load the newly created file into PEiD

Done :-) !!! 

Manual unpacking of AHpack can be found at

http://blog.disects.com/2013/12/manual-unpacking-of-ahpack01.html