Sunday, July 12, 2015

Transfering file to remote machine using tcpdump and dd

Sometimes you need to transfer a file to a remote machine and do not have a file transfer tool available at the remote machine or may be restricted due to firewall rules.
If the remote machine has tcpdump and dd available then you can transfer the file following the process described below.

What do you need  on sender machine?
split and netcat

What do you need on receiver machine?
tcpdump , dd and one reachable port. Most like the dhcp port (67) is going to be open since there has to be a way for the remote to get IP :)

Steps:
On remote machine
1.a:
Create a shell script file like this:
cat > extract.sh <<EOF
# On the receving machine capture tcpdump file using
# tcpdump -i doc0 -w tcpdump.bin port 67

FILE_SIZE=$1
START=82
PACKET_SIZE=1000
FRAME_HEADER=58
BYTES_EXTRACTED=0
while [ $BYTES_EXTRACTED -lt $FILE_SIZE ]
do
        let partName=10000000+$START
        dd if=tcpdump.bin of=$partName.part bs=1 count=1000 skip=$START
        let START=$START+$PACKET_SIZE+$FRAME_HEADER
        let BYTES_EXTRACTED=$BYTES_EXTRACTED+$PACKET_SIZE
done

rm outfile.bin
for name in `ls -1 *.part`
do
        cat $name >> $2
done

EOF


1.b :
Launch tcpdump in a folder where you have write access (typically /dev/ is writable so you can create a folder called /dev/worktmp and launch tcpdump from there).
#mkdir /dev/worktmp
#cd  /dev/worktmp
tcpdump -i doc0 -w tcpdump.bin port 67

Steps on sender machine:
2.a:
Create a file like this:
cat  > sendAFile.sh <<EOF
#On the sending machine
#send the file using this
INFILE=$1
DEST=$2
rm x*
split -b 1000 $INFILE
for name in `ls x*`
do
        cat $name |  nc -w 1 -u $DEST  67 &
        sleep 1 ;
        pkill nc;
        sleep 1;
done
md5sum $INFILE
ls -l $INFILE

EOF

2.b :
Send the file (say the file name is strace) to the remote machine (10.2.2.3) using the script create above:
#bash sendAFile.sh strace 10.2.2.3

Steps on remote machine:
1.c:
Create the final file. The first argument is the file size and second argument is name of the file:
sh extract.sh 45654 strace