{"id":56246,"date":"2020-04-05T17:21:30","date_gmt":"2020-04-05T09:21:30","guid":{"rendered":"http:\/\/4563.org\/?p=56246"},"modified":"2020-04-05T17:21:30","modified_gmt":"2020-04-05T09:21:30","slug":"%e5%85%b3%e4%ba%8eocserv-%e8%ae%a4%e8%af%81%e8%a1%a8%e5%8d%95%e9%97%ae%e9%a2%98%ef%bc%8c%e4%bb%98%e8%b4%b9%e6%b1%82%e5%b8%ae%e5%8a%a9","status":"publish","type":"post","link":"http:\/\/4563.org\/?p=56246","title":{"rendered":"\u5173\u4e8eocserv \u8ba4\u8bc1\u8868\u5355\u95ee\u9898\uff0c\u4ed8\u8d39\u6c42\u5e2e\u52a9"},"content":{"rendered":"\n

\t\t\t\t\t\u5c71\u91ce\u5339\u592b<\/strong> \t\t\t\t\u5927\u4f6c\u6709\u8bdd\u8bf4 : 2020-3-29 20:10:39\t<\/p>\n

\u5173\u4e8eocserv \u8ba4\u8bc1\u8868\u5355\u95ee\u9898\uff0c\u4ed8\u8d39\u6c42\u5e2e\u52a9<\/h3>\n

\t\t \u672c\u5e16\u6700\u540e\u7531 \u5c71\u91ce\u5339\u592b \u4e8e 2020-3-29 20:15 \u7f16\u8f91 <\/p>\n

\u4e4b\u524d\u53d1\u8fc7\u5e16\u5b50\u6ca1\u6709\u627e\u5230\u7b54\u6848<\/p>\n

\u5076\u7136\u770b\u5230\u4e00\u4e2a\u5927\u4f6c5\u5e74\u524d\u4e5f\u7814\u7a76\u8fc7<\/p>\n

\u6b63\u5e38\u914d\u7f6e\u7684ocserv \u5728anyconnect\u5ba2\u6237\u7aef\u4e2d\u662f\u8fd9\u6837\u76842\u4e2a\u9875\u9762<\/p>\n

https:\/\/s1.ax1x.com\/2020\/03\/29\/GZeEVK.png<\/p>\n

\u9700\u8981\u5b9e\u73b0\u7684\u6548\u679c\u662f\u4e0b\u9762\u8fd9\u6837\u8d26\u53f7\u5bc6\u7801\u57281\u4e2a\u9875\u9762
https:\/\/s1.ax1x.com\/2020\/03\/29\/GZZLD0.png<\/p>\n

\u4ee5\u4e0b\u662f\u5927\u4f6c\u641e\u7684hack\u8ba4\u8bc1\u8868\u5355\uff0c\u8ba9\u7528\u6237\u540d\u5bc6\u7801\u5728\u4e00\u6b21\u63d0\u793a\u4e2d\u8f93\u5165\uff0c\u5e76\u80fd\u6b63\u5e38\u8ba4\u8bc1\u4f7f\u7528<\/p>\n

\u80fd\u770b\u660e\u767d\u7684\u5927\u4f6cPM\u4e0b\u8054\u7cfb\u65b9\u5f0f\uff0c\u6211TG\uff1a@gs166 \u4ed8\u8d39\u6c42\u5e2e\u52a9<\/p>\n

\/\/ ocservFront project main.go
package main<\/p>\n

import (
        "bufio"
        "bytes"
        "crypto\/tls"
        "fmt"
        "io"
        "io\/ioutil"
        "log"
        "net"
        "net\/http"
        "os"
        "regexp"
        "strings"
)<\/p>\n

const authFormOld = `<?xml version="1.0" encoding="UTF-8"?>
<config-auth client="\u6276\u5899" type="auth-request">
<version who="sg">0.1(1)<\/version>
<auth id="main">
<message>Please enter your username<\/message>
<form method="post" action="\/auth">
<input type="text" name="username" label="Username:" \/>
<\/form><\/auth>
<\/config-auth>`<\/p>\n

const authFormNew = `<?xml version="1.0" encoding="UTF-8"?>
<config-auth client="\u6276\u5899" type="auth-request">
<version who="sg">0.1(1)<\/version>
<auth id="main">
<message>Please enter your username<\/message>
<form method="post" action="\/auth">
<input type="text" name="username" label="Username:" \/>
<input type="password" name="password" label="Password:" \/>
<\/form><\/auth>
<\/config-auth>`<\/p>\n

var authUserPassRE = regexp.MustCompile("<auth><username>(.*?)<\/username><password>(.*?)<\/password><\/auth>")
var \u6276\u5899CookieRE = regexp.MustCompile("web\u6276\u5899context=(.*?);")<\/p>\n

func main() {
        \/\/@todo load config from file
        cert, _ := tls.LoadX509KeyPair("\/Users\/horsley\/Backup\/ssl\/ihorsley.com.crt", "\/Users\/horsley\/Backup\/ssl\/ihorsley.com.key")
        var cfg tls.Config<\/p>\n

        cfg.Certificates = []tls.Certificate{cert}
        l, err := tls.Listen("tcp", ":15443", &cfg) \/\/@todo load config from file
        if err != nil {
                log.Println("listen error:", err)
                os.Exit(1)
        }<\/p>\n

        defer l.Close()
        for {
                conn, err := l.Accept()
                if err != nil {
                        log.Println("accept error:", err)
                        continue
                }<\/p>\n

                go func(clientConn net.Conn) {
                        log.Println("conn process start")
                        defer clientConn.Close()<\/p>\n

                        \/\/@todo load config from file
                        remoteConn, err := tls.Dial("tcp", "vps9.ihorsley.com:443", nil) \/\/remote can be unix cleartext socket of ocserv
                        if err != nil {
                                log.Println("connect upstream error:", err)
                                return
                        }<\/p>\n

                        defer remoteConn.Close()<\/p>\n

                        \u6276\u5899Cookie := make(chan string, 1)<\/p>\n

                        go func() { \/\/remote => client
                                hackRemoteResponse(clientConn, remoteConn, \u6276\u5899Cookie)<\/p>\n

                                io.Copy(clientConn, remoteConn)
                        }()<\/p>\n

                        \/\/client => remote
                        hackClientRequest(clientConn, remoteConn, \u6276\u5899Cookie)
                        io.Copy(remoteConn, clientConn)<\/p>\n

                        log.Println("conn process done")
                }(conn)
        }<\/p>\n

}<\/p>\n

\/\/hackClientRequest
\/\/hack auth by resend both user and pass form and cookie
func hackClientRequest(clientConn, remoteConn net.Conn, \u6276\u5899Cookie chan string) {
        reader := bufio.NewReader(clientConn)<\/p>\n

        for { \/\/client req hacking
                req, err := http.ReadRequest(reader)<\/p>\n

                if err != nil {
                        log.Println("ReadRequest from client conn err:", err)
                        return
                }<\/p>\n

                if req.URL.Path == "\/auth" {
                        var buf bytes.Buffer
                        _, err = buf.ReadFrom(req.Body)
                        req.Body.Close()<\/p>\n

                        if err != nil {
                                log.Println("read request body from client conn err:", err)
                                return
                        }<\/p>\n

                        req.Body = ioutil.NopCloser(bytes.NewReader(buf.Bytes()))<\/p>\n

                        log.Println("3. second req, auth req, do first sending")
                        req.Write(remoteConn)<\/p>\n

                        \/\/waiting for cookie
                        ck := <-\u6276\u5899Cookie<\/p>\n

                        log.Println("5. got cookie, resend auth req with cookie")<\/p>\n

                        req.Header.Set("Cookie", fmt.Sprintf("web\u6276\u5899context=%s;", ck))
                        req.Body = ioutil.NopCloser(bytes.NewReader(buf.Bytes()))
                        req.Write(remoteConn)<\/p>\n

                        log.Println("6. resend done, hack finish, going to do regular io.Copy")
                        break
                } else {
                        log.Println("1. first req, pass")
                        req.Write(remoteConn)
                }
        }
}<\/p>\n

\/\/hackRemoteResponse
\/\/hack auth by change auth form and drop the first cookie resp
func hackRemoteResponse(clientConn, remoteConn net.Conn, \u6276\u5899Cookie chan string) {
        reader := bufio.NewReader(remoteConn)<\/p>\n

        for { \/\/remote resp hacking
                resp, err := http.ReadResponse(reader, nil)
                if err != nil {
                        log.Println("ReadResponse from remote conn err:", err)
                        return
                }<\/p>\n

                if resp.ContentLength == len(authFormOld) { \/\/hack auth form
                        log.Println("2. first resp, hack resp auth form")
                        resp.Body.Close()
                        resp.ContentLength = int64(len(authFormNew))
                        resp.Body = ioutil.NopCloser(strings.NewReader(authFormNew))
                } else if ck := resp.Header.Get("Set-Cookie"); ck != "" && \u6276\u5899CookieRE.MatchString(ck) { \/\/get context cookie
                        log.Println("4. second resp, grep cookie, resp hacking finish")<\/p>\n

                        if m := \u6276\u5899CookieRE.FindStringSubmatch(ck); m != nil && m != "" {
                                \u6276\u5899Cookie <- m
                                \/\/log.Println("get \u6276\u5899 cookie:", m)
                                break
                        }
                }<\/p>\n

                err = resp.Write(clientConn)
                if err != nil {
                        log.Println("write to client conn err:", err)
                        return
                }
        }
} \t\t\t\t<\/p>\n

\t\t\t\t\t\u5c71\u91ce\u5339\u592b<\/strong> \t\t\t\t\u5927\u4f6c\u6709\u8bdd\u8bf4 : \t<\/p>\n

<\/h3>\n

\t\t\u6765\u4e2a\u8001\u53f8\u673a\t\t\t\t<\/p>\n

\t\t\t\t\tgamerenzz<\/strong> \t\t\t\t\u5927\u4f6c\u6709\u8bdd\u8bf4 : \t<\/p>\n

<\/h3>\n

\t\t\u540c\u5173\u6ce8\u8fd9\u4e2a\uff0c\u6211\u5e0c\u671bocserv\u7684\u5ba2\u6237\u7aef\uff0c\u4e0d\u7528\u7b2c\u4e09\u65b9\uff0c\u4fdd\u5b58\u7528\u6237\u540d\u548c\u5bc6\u7801\uff0c\u4e0d\u7528\u6bcf\u6b21\u90fd\u8f93\u5165\uff0c\u7f51\u4e0a\u627e\u5230\u4e00\u4e2a\uff0c\u4f46\u662f\u4e0d\u77e5\u9053\u600e\u4e48\u7528\uff0c\u697c\u4e3b\u53ef\u4ee5\u770b\u770b \uff0c\u6743\u9650\u539f\u56e0\uff0c\u5730\u5740\u53d1\u4e0d\u4e86\uff0c\u5728v2ex\u4e0a
\u540c\u6c42\u9ad8\u4eba\uff0cocserv \u5ba2\u6237\u7aef\uff0c\u81ea\u52a8\u4fdd\u5b58\u7528\u6237\u540d\u548c\u5bc6\u7801 \uff08\u4e0d\u7528\u7b2c\u4e09\u65b9\u5ba2\u6237\u7aef\u5b9e\u73b0\uff09\t\t\t\t<\/p>\n

\t\t\t\t\t\u5c71\u91ce\u5339\u592b<\/strong> \t\t\t\t\u5927\u4f6c\u6709\u8bdd\u8bf4 : \t<\/p>\n

<\/h3>\n

\t\tgamerenzz \u5927\u4f6c\u6709\u8bdd\u8bf4 : 2020-4-3 11:02
\u540c\u5173\u6ce8\u8fd9\u4e2a\uff0c\u6211\u5e0c\u671bocserv\u7684\u5ba2\u6237\u7aef\uff0c\u4e0d\u7528\u7b2c\u4e09\u65b9\uff0c\u4fdd\u5b58\u7528\u6237\u540d\u548c\u5bc6\u7801\uff0c\u4e0d\u7528\u6bcf\u6b21\u90fd\u8f93\u5165\uff0c\u7f51\u4e0a\u627e\u5230\u4e00\u4e2a\uff0c\u4f46\u662f\u4e0d …<\/p>\n

https:\/\/www.v2ex.com\/t\/195064
\u4f60\u8bf4\u7684\u662f\u8fd9\u4e2a\u5927\u4f6c\u5427\uff0c\u4e0a\u9762\u7684\u8868\u5355\u5c31\u662f\u4ed6\u7684<\/p>\n

\u5982\u679c\u4e0d\u662f\u8bf7\u56de\u590d\u94fe\u63a5\u540e\u7f00\u6211\u7785\u7785\t\t\t\t<\/p>\n

\t\t\t\t\tgamerenzz<\/strong> \t\t\t\t\u5927\u4f6c\u6709\u8bdd\u8bf4 : \t<\/p>\n

<\/h3>\n

\t\t\u5c71\u91ce\u5339\u592b \u5927\u4f6c\u6709\u8bdd\u8bf4 : 2020-4-3 11:39
\u4f60\u8bf4\u7684\u662f\u8fd9\u4e2a\u5927\u4f6c\u5427\uff0c\u4e0a\u9762\u7684\u8868\u5355\u5c31\u662f\u4ed6\u7684<\/p>\n

\u5982\u679c\u4e0d\u662f\u8bf7\u56de\u590d\u94fe\u63a5\u540e\u7f00\u6211\u7785\u7785 …<\/p>\n

\u5bf9\uff0c\u5c31\u662f\u4ed6\u7684\uff0c\u4e0d\u8fc7\u4e0d\u61c2\u8fd9\u4e2a\t\t\t <\/p>\n","protected":false},"excerpt":{"rendered":"

\u5c71\u91ce\u5339\u592b \u5927\u4f6c\u6709\u8bdd\u8bf4 : 2020…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[],"tags":[],"_links":{"self":[{"href":"http:\/\/4563.org\/index.php?rest_route=\/wp\/v2\/posts\/56246"}],"collection":[{"href":"http:\/\/4563.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/4563.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/4563.org\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/4563.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=56246"}],"version-history":[{"count":0,"href":"http:\/\/4563.org\/index.php?rest_route=\/wp\/v2\/posts\/56246\/revisions"}],"wp:attachment":[{"href":"http:\/\/4563.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=56246"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/4563.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=56246"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/4563.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=56246"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}