crl_checker.py

#!/usr/bin/env python3
# Jose Selvi - jselvi[a.t]pentester[d0.t]es - http://www.pentester.es
# Greetings for Python3 port to Tristan Rice - https://github.com/d4l3k
# Version 1.0 - 06/Dec/2020
# 	- Port to Python3.
# 	- Several style fixes.

import scapy
from scapy.layers.ssl_tls import *  # https://github.com/tintinweb/scapy-ssl_tls
from optparse import OptionParser
import re
import socket
import os
import base64, sys


def readPemChainFromFile(
    fileObj,
    startMarker="-----BEGIN CERTIFICATE-----",
    endMarker="-----END CERTIFICATE-----",
):
    cert_chain = []
    state = 0
    while 1:
        certLine = fileObj.readline()
        if not certLine:
            break
        certLine = certLine.strip()
        if state == 0:
            if certLine == startMarker:
                certLines = []
                state = 1
                continue
        if state == 1:
            if certLine == endMarker:
                state = 2
            else:
                certLines.append(certLine)
        if state == 2:
            substrate = ""
            for certLine in certLines:
                if sys.version_info[0] <= 2:
                    substrate = substrate + base64.decodestring(certLine)
                else:
                    if not substrate:
                        substrate = substrate.encode()
                    substrate = substrate + base64.decodebytes(certLine.encode())
            cert_chain.append(substrate)
            state = 0
    return cert_chain


# Usage and options
usage = "usage: %prog [options]"
parser = OptionParser(usage=usage)
parser.add_option(
    "-i",
    "--interface",
    type="string",
    dest="interface",
    default="0.0.0.0",
    help="Listening interface",
)
parser.add_option(
    "-p", "--port", type="int", dest="port", default="443", help="Listening port"
)
parser.add_option(
    "-c", "--cert", type="string", dest="certfile", help="PEM Certificate File"
)
(options, args) = parser.parse_args()

ifre = re.compile("[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+")
# Check options
if (
    not options.interface
    or not ifre.match(options.interface)
    or options.port < 1
    or options.port > 65535
    or not options.certfile
    or not os.path.isfile(options.certfile)
):
    parser.print_help()
    exit()

cert_chain = readPemChainFromFile(open(options.certfile))

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.bind((options.interface, options.port))
s.listen(0)

# Wait until Keyboard Interrupt
try:

    while True:

        (client, address) = s.accept()

        client_hello = SSL(client.recv(1024))
        ch_cipher_suites = client_hello.records[0][2].cipher_suites
        cs = min(ch_cipher_suites)

        random_session_id = os.urandom(32)
        server_hello = (
            TLSRecord()
            / TLSHandshake()
            / TLSServerHello(session_id=random_session_id, cipher_suite=cs)
        )
        client.sendall(str(server_hello))

        # print "--------------------------"
        # print str(cert_chain[0])
        # print "--------------------------"
        # print str(cert_chain[1])
        # print "--------------------------"
        # print str(cert_chain[2])
        # print "--------------------------"

        ssl_certificates = []
        for cert in cert_chain:
            ssl_certificates.append(TLSCertificate(data=cert))

        certificates = (
            TLSRecord()
            / TLSHandshake()
            / TLSCertificateList(certificates=ssl_certificates)
        )
        client.sendall(str(certificates))

        server_hello_done = (
            TLSRecord() / TLSHandshake() / TLSServerHelloDone(length=0, data="")
        )
        client.sendall(str(server_hello_done))

        raw_response = client.recv(1024)
        SSL(raw_response).show()

        try:
            client.shutdown(socket.SHUT_RDWR)
        except KeyboardInterrupt:
            raise KeyboardInterrupt
        except:
            client.close()
            continue

except KeyboardInterrupt:
    print("Exited")

s.close()