// marshal 1.4 #include #include #include "MessageGenerator.h" #include MessageGenerator::MessageGenerator() { //srand(100); //srand(time(0)); } std::string MessageGenerator::generateMessage(SessionInfo* info, MESSAGE_TYPE messageType, FIELD field, FUZZTYPE type) { info->incrementRequest(messageType); //stick debug int msgType = 0; /* 1 == invite 2 == bye 3 == cancel 4 == ack 5 == options 6 == register */ std::string message; switch (messageType) { case INVITE:msgType = 1; message = "INVITE"; break; case BYE:msgType = 2; message = "BYE"; break; case CANCEL:msgType = 3; message = "CANCEL"; break; case ACK:msgType = 4; message = "ACK"; break; case OPTIONS:msgType = 5; message = "OPTIONS"; break; case REGISTER:msgType = 6; message = "REGISTER"; break; } message += " sip:" + info->getDestinationName() + "@" + info->getDestinationDomain(); if (messageType != INVITE && info->getProtocol() == UDP) { message += ";transport=udp"; } message += " SIP/2.0\nVIA: SIP/2.0/"; switch (info->getProtocol()) { case TCP: message += "TCP"; break; case UDP: message += "UDP"; break; } // XXX: fixed this message += " " + /*info->getIP()*/ info->getFromDomain() + ":7000;branch=" + info->getBranch() + "\n"; std::string _TO = info->getDestinationName() + " getDestinationName() + "@" + info->getDestinationDomain() + ">"; if ((field == TO) && (type != NA)) _TO = fuzz(_TO, type); message += "TO: " + _TO; if (info->getToTag() != "") message += ";tag=" + info->getToTag() + "\n"; else message += "\n"; std::string _FROM = "\"" + info->getFromName() + "\" getFromName() + "@" + info->getFromDomain() + //stick 7000 ":7000>;tag=" + info->getFromTag(); if ((field == FROM) && (type != NA)) _FROM = fuzz(_FROM, type); message += "FROM: " + _FROM + "\n"; std::string _CALLID = info->getCallID(); if ((field == CALLID) && (type != NA)) _CALLID = fuzz(_CALLID, type); message += "CALL-ID: " + _CALLID + "\n"; message += "CSEQ: "; std::string _CSEQ = info->getSequence(); _CSEQ += " " + info->getLastRequest(); if ((field == CSEQ) && (type != NA)) _CSEQ = fuzz(_CSEQ, type); message += _CSEQ; message += "\nMAX-FORWARDS: 70\n"; if (messageType == INVITE) { message += "CONTACT: \"" + info->getFromName() + "\" getFromName() + "@" + info->getFromDomain(); if (info->getProtocol() == UDP) message += ":7000;transport=udp>\n"; //stick 7000 else message += ">\n"; } if(/*true*/ /*msgType == 2*/false) // bye == 2 { message += "Content-Length: 0\n\n"; } // adding message body if(/*true*/ msgType == 1 || msgType == 2) // invite { message += "Content-Type: application/sdp\n"; //sivus: message += "Content-Length: 119\n\n"; message += "v=0\n"; message += "o=user 29739 7272939 IN IP4 192.168.1.5\n"; message += "s=\n"; message += "c=IN IP4 192.168.1.5\n"; message += "m=audio 49210 RTP/AVP 0 12\n"; message += "a=rtpmap:31 LPC/8000\n"; } else message += "\n0"; return message; } std::string MessageGenerator::generateTag() { std::string message; for (int i = 0; i < 8; i++) { switch (rand() % 3) { case 0: message += ('A' + rand() % 26); break; case 1: message += ('a' + rand() % 26); break; case 2: message += ('0' + rand() % 10); break; } } return message; } std::string MessageGenerator::fuzz(std::string toFuzz, FUZZTYPE method) { std::string temp = ""; char* dest; int position; if (method == COMMANDINJECTION) string cmd_str = "AAAAA"; switch (method) { case SHELLINJECTION: case COMMANDINJECTION: position = rand() % toFuzz.length(); toFuzz.insert(position, cmd_str); return toFuzz; break; case REPEAT: // pick a lenth size rsize = rand() % 3; switch (rize) { case 0: rlength = 256; break; case 1: rlength = 512; break; case 2: rlength = 1024; break; } // pick an offset from the size roffset = rand() % 3; switch (roffset) { case 0: rlength = rlength - 1; break; case 1: rlength = rlength; break; case 2: rlength = rlength + 1; break; } // repeat the string string dest = ""; int maxloops = rlength / toFuzz.length(); int topoff = rlength % toFuzz.length(); for (int i=0; i < maxloops; i++) { dest += toFuzz; } // now add a little more to fill the length dest += toFuzz.substr(0, topoff); return dest; break; } // close switch }