ITSC203 Lab3a

Python
Offensive and Defensive Tool Construction

2|Page
Table of Contents
EVALUATION:...............................................................................................................................1
Objectives......................................................................................................................................2
Background Reading.....................................................................................................................2
Important Information.....................................................................................................................2
Problem 1 (15 pts).....................................................................................................................3
Question 1:.................................................................................................................................3
Interesting Note (no marks)........................................................................................................4
Problem 2 (30 pts).....................................................................................................................5
Criteria: 24pts (includes the 5pts for criteria 4)..........................................................................5
QUESTIONS (6pts)....................................................................................................................7
SUBMISSION.............................................................................................................................7
EVALUATION:
1 Problem 1 15
2 Problem 2 30
TOTAL MARK 45
© 2017, Southern Alberta Institute of Technology. All rights reserved.

This publication and materials herein are protected by applicable intellectual property laws.
Unauthorized reproduction and distribution of this publication in whole or part is prohibited.
For more information, contact:

Director, Centre for Instructional Technology and Development
Southern Alberta Institute of Technology
1301 16 Ave. N.W., Calgary, AB T2M 0L4
2|Page
Offensive and Defensive Tool Construction

Python Programming I
Objectives
This lab focuses on the following objectives:
 Analyze the Linux filesystem using Python.
 Explore the use of python in building basic tools to gather information about the
filesystem.
 Use variables, expressions and statements in Python.
 Use built-in modules to assist in the development of Python Tools.
Background Reading
 Read chapters 6–10 in How to Think Like a Computer Scientist: Learning with Python,
available at www.greenteapress.com/thinkpython/thinkCSpy.pdf.
 https://docs.python.org/3.8/
Important Information
YOU MUST PRESENT IMAGES OF YOUR CODE BEING EXECUTED. DO NOT
SUBMIT YOUR ANSWERS IN THE DOCUMENT. CREATE A BLANK DOCUMENT
AND SUBMIT YOUR ANSWERS THERE.
YOU WILL LOSE MARKS FOR NOT FOLLOWING THE ABOVE

REQUIREMENTS.
All scripts must have the following elements:

1. File and Header comments, which follows the following format:
# Filename: m##XXX.py
# Author: Craig Mac
# Course: ITSC203
# Details: This exercise checks to see if students read the suggested items or
# prior to class or doing the labs.
# Resources: https://www.cs.siue.edu/programming-style-guide
2. Comments on lines where you used some unique computation that might be tricky to
comprehend a month later.
list1 = [x for x in range(20) if x % 4 == 1] # Using list comprehension to ….
3|Page
Problem 1 (15 pts)

During exploitation you will often find yourself needing to generate a non-repeating pattern to be
used to determine where the return address is located on the stack. In a 32 or 64bits system the
address you are trying to find is 4 or 8 bytes in length. If each character requires 1 byte to
represent it, you will need 4 or 8 characters. You can use the random module.
Write a Python program named m3p1.py

Your program will do the following tasks (10pts):
A. Generate a non-repeating sequence of either 4 or 8 bytes. You can use any combination
of alphanumeric and punctuation characters eg: (a-z, A-Z, 0-9, \?/:;()!_)
B. Your program should take as input the length of the sequence to generate.
a. The sequence can be a minimum of 100 and a maximum of 1024.
C. The program will also accept as input the number of bytes in your address.
a. 4 or 8 represents the number of bytes in the address, 32 or 64 bits respectively.
b. If the user doesn’t enter 4 or 8 for the sequence length; your program will print a
usage message to let them know how to use your program.
c. The 4 or 8-byte sequence should be unique within the 100 – 1024 generated
non-repeating pattern.
D. Your program will then wait for you to enter a short subsection of that original sequence.
It will generate an offset value representing where that sub-sequence was found.
E. You will also generate a message at the end to say how many times that 4 or 8 byte
sequence was found in your random pattern
Example of non-repeating sequence:

1. a1a2a3a4b1b2b3b4
2. 1122334455661213141516aabbccddee
Notice if the user enters a1a2 or 11223344 as the test pattern they do not show up again
in the non-repeating sequences above.
Question 1:
1. Imagine you entered a sequence like AAAAAAAAAAA, where the A’s colored in red
represent the sequence you are seeking.
Why is it not possible to tell exactly which offset your AAAA pattern begins at? 1pt
2. Is it possible to put the bytes that represent characters below 0x20 and above 0x7E
into your non-repeating sequence? If it is not possible explain why? 2pts
4|Page
3. Will uppercase letters be treated differently from lowercase letters when placed on the
stack? Why? 1pts
4. Submit a screenshot of your program executing. Also submit the python

code so that it can be tested.
5. To test your program, simply generate a sequence then select a part of that
sequence.
Example execution:
Happy Penetration Testing!!! Remember to always get permission; it’s the right thing to do 😊
Interesting Note (no marks)

Kali Linux has 2 tools that perform a
similar operation to this. You can see
them in action by following the steps on
the left:
Using the information provided:

1.Generate a sequence
2.Find a pattern of any length.
5|Page
Problem 2 (30 pts)

You will create Python code that uses the dictionary provided below and presents the
information using the prettytable module. You ONLY need the prettytable and ipaddress
modules. Don’t install or use any other modules.
Figure 1: Installing the prettytable module. Other required modules can be installed in a similar
fashion.
Criteria: 24pts (includes the 5pts for criteria 4)

1. Write your Python code to take information in the given dictionary and generate the
output as shown in Figure 2 (see page 8).
2. The required fields for your table are as follows:
a. Computer Name, Manufacturer, Asset Tag, IP Address, IP Subnet, and Price
3. Note that the IP address in the dictionary is given using the format:
<IP Address>/<Subnet Mask>
a. You will need to use the ipaddress module to extract the IP Address and the
Subnet Address separately.
4. After generating the table below Figure 2, programmatically list the IP Addresses that
are in the same subnet? 5pts
5. You are not allowed to hardcode any component(s), it must be computed

programmatically from the information given.
{
"Comp477": ["Gigabyte", 9133.27, "70561924KIQqzw", "68.192.163.42/255.255.240.0"],
"Comp678": ["Asus", 7264.42, "56024371IQCewb", "198.78.85.109/255.255.248.0"],
"Comp894": ["Acer", 4564.22, "41928367UHPkxu", "192.167.55.136/255.255.240.0"],
"Comp592": ["Dell", 9378.82, "20451398MFWusg", "192.167.86.14/255.255.255.128"],
"Comp397": ["Acer", 8115.08, "74189306HKLvwu", "176.33.145.182/255.255.248.0"],
"Comp697": ["Asus", 8941.52, "17892534DZOlru", "10.0.252.127/255.255.192.0"],
"Comp966": ["Dell", 9539.92, "46193287TYIurw", "10.0.222.132/255.255.252.0"],
"Comp964": ["Dell", 4274.43, "04237918UTSdkj", "200.3.34.67/255.255.192.0"],
"Comp634": ["Google", 5182.86, "95430287FCQfbk", "68.192.177.108/255.255.192.0"],
"Comp565": ["Toshiba", 1904.33, "57018243JPYtpu", "192.167.63.98/255.255.240.0"],
"Comp906": ["Dell", 5228.37, "96134827IHGibu", "176.33.20.163/255.255.192.0"],
"Comp481": ["Asus", 7790.58, "05793218BRZjgl", "198.78.237.73/255.255.248.0"],
"Comp370": ["Dell", 9251.70, "89531276LIMqby", "68.192.129.199/255.255.192.0"],
"Comp703": ["Toshiba", 7520.04, "53179426FUXqjz", "200.3.191.102/255.255.192.0"],
"Comp493": ["Google", 4621.55, "06514398WINzou", "198.78.59.119/255.255.240.0"]
6|Page
Dictionary: To be included in your python code
Figure 2: Example of the code generating output, it shows the result of printing the dictionary
using the prettyprint module.
7|Page
QUESTIONS (6pts)
1. The table doesn’t appear sorted by any of the fields. What field(s) would be logical
choices if the information were to be sorted? Why would you choose these fields? Give
at least 2. 2pts
2. As part of a Cyber Security team we often need to consider what assets a company has.
Why do you need to know details about the computer assets a company has? 1pt
3. Name at least 2 other relevant pieces of information, not currently considered, a

security focused company should know about its asset. 3pt
a. In answering this question, you can think about security controls that relate to the
physical security of the device and the technology installed on it. Consider how it
will communicate or where it is located.
SUBMISSION
1. Submit your python code, answers to the questions and the screenshot(s) of the output
of your working program.

ITSC203 Lab3a

Uploaded by

Copyright:

Available Formats

ITSC203 Lab3a

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

ITSC203 Lab3a

Uploaded by

Copyright:

Available Formats

Python

Offensive and Defensive Tool Construction

© 2017, Southern Alberta Institute of Technology. All rights reserved.

For more information, contact:

Offensive and Defensive Tool Construction

YOU WILL LOSE MARKS FOR NOT FOLLOWING THE ABOVE

All scripts must have the following elements:

Problem 1 (15 pts)

Write a Python program named m3p1.py

Example of non-repeating sequence:

4. Submit a screenshot of your program executing. Also submit the python

Interesting Note (no marks)

Using the information provided:

Problem 2 (30 pts)

Criteria: 24pts (includes the 5pts for criteria 4)

5. You are not allowed to hardcode any component(s), it must be computed

Dictionary: To be included in your python code

3. Name at least 2 other relevant pieces of information, not currently considered, a

You might also like