Expect

From Network Security Wiki


Basics

Installing Expect

sudo apt-get install expect
        This section is under construction.

Scripts

Expect script to ARP Ping

#!/usr/bin/expect
set timeout 20
spawn telnet 192.200.200.201
expect "Password:"
send "WCPanelF\r"
send "4\r"
send "cyberoam diagnostics utilities arp ping source 10.10.12.27 interface PortB 10.10.44.1\r"
expect "Unicast reply from 10.10.44.1"
#interact
sleep 15
send "^C\r"
send "0\r"
exit

Cron Entry

0 * * * * /home/ibm/Desktop/expect 2>&1 >> /home/ibm/Desktop/script_output.log

Expect script to backup Netscaler config

 #!/usr/bin/expect
 spawn ssh nsroot@10.107.88.78
 expect "Password:"
 send "nsroot\r"
 expect "Done"
 log_file myconfig.txt
 send "show config\r"
 #interact
 expect ""
 sleep 2
 send "^C\r"
 exit


TCP three-way handshake by hand using expect

# Useful constants
set SYN 0x02
set RST 0x04
set ACK 0x10

set target 10.10.10.1
set sport [random 20000:65535]
set dport 22
set interface [outif $target]
set window 4096

# Use a ghost IP. Make sure $myip is not being used
set myip 10.10.10.123
set mymac [random mac]

# Spawn a listener for ARP requests
spawn_network -i $interface host $myip and {arp[6:2]} == 1

expect_network_before {1} {
    # Received an ARP request, send ARP reply
    send_network -o $interface \
        ether(src = $mymac, dst = $arp(sha) )/ \
        arp-reply(tha = $arp(sha), tip = $arp(sip), sha = $mymac, sip = $myip)
    nexp_continue
}

# Start TCP 3-way handshake

# Spawn a listener for TCP segments coming from the FTP server to us
spawn_network -i $interface "tcp and src host $target and dst host $myip and src port $dport and dst port $sport"

set retries 3
set isn [random]

# Send TCP SYN
send_network ip(src = $myip, dst = $target)/ \
             tcp(src = $sport, dst = $dport, \
                 window = $window, syn, seq = $isn, ack-seq = 0)

# Wait for response from the server
expect_network {$tcp(flags) == ($SYN | $ACK)} {
    # Got a SYN+ACK so we need to send the final segment of the 3-way HS
    send_network ip(src = $myip, dst = $target)/ \
                 tcp(src = $tcp(dstport), dst = $tcp(srcport), \
                     window = $window, ack, seq = $tcp(ack), \
                     ack-seq = [expr $tcp(seq) + 1])
} {$tcp(flags) & $RST} {
    puts "Connection refused"
    exit 1
} {1} {
    # Any other weird combination of TCP flags we respond to with a RST
    send_network ip(src = $myip, dst = $target)/ \
                 tcp(src = $tcp(dstport), dst = $tcp(srcport), rst)
    exit 1
} timeout {
    # Our SYN got lost in transit or it was filtered - perform exponential
    # backoff and retransmit the SYN...
    if {$retries > 0} {
        incr retries -1
        set timeout [expr $timeout*2]
        puts "SYN timeout, increasing timeout to $timeout"
        send_network ip(src = $myip, dst = $target)/ \
                     tcp(src = $sport, dst = $dport, \
                         window = $window, syn, \
                         seq = $isn, ack-seq = 0)
        nexp_continue
    } else {
        puts "Connection timed out"
        exit 1
    }
}

# Done with the 3-way handshake. If we want to send more packets
# use correct sequence numbers. Our sequence number is
# $tcp(ack) and the server's is $tcp(seq) + 1.
#

puts Done.

Reboot Netscaler using Expect

  • This script was tested on NS11.1 build 52.13.nc VPX.
  • Recommended to use it under testing environment only as it will NOT perform graceful Netscaler reboot.
  • Use it at your own risk:
#!/usr/bin/expect

# Netscaler Parameters:
set timeout 10
set nsip 10.107.88.78
set user nsroot
set pass pwd@123

# Login into NetScaler:
spawn ssh -oStrictHostKeyChecking=no -oCheckHostIP=no $user@$nsip
expect "Password"
send "$pass\n"
expect "Last login:"

# Reboot Command:
send "reboot\n"
expect ":"
send "Y\r"
sleep 1
exit

Cron entry to schedule reboot at 2:00AM daily

* 2 * * * /home/test/ns_reboot.sh



References





{{#widget:DISQUS |id=networkm |uniqid=Expect |url=https://aman.awiki.org/wiki/Expect }}