sup
This commit is contained in:
DanMcInerney
217
arpdet.py
Executable file
217
arpdet.py
Executable file
@@ -0,0 +1,217 @@
|
||||
#!/usr/bin/python
|
||||
|
||||
#Suppress scapy warnings, but not errors
|
||||
import logging
|
||||
logging.getLogger("scapy.runtime").setLevel(logging.ERROR)
|
||||
|
||||
#turn off the output for scapy functions with conf.verb
|
||||
from scapy.all import *
|
||||
conf.verb=0
|
||||
|
||||
import sys
|
||||
import time
|
||||
import os
|
||||
import smtplib
|
||||
import re
|
||||
import subprocess
|
||||
import commands
|
||||
bash = commands.getoutput
|
||||
|
||||
#user_pass contains the email to send from, the password to that email, and the recipient address
|
||||
try:
|
||||
from user_pass import user, passwd, rcpt
|
||||
except ImportError:
|
||||
print "[?] Error importing user_pass. Are you sure its in this directory? Email won't send."
|
||||
|
||||
IPandMAC = {}
|
||||
prefixIP = ""
|
||||
essid = ""
|
||||
interface = ""
|
||||
routerip = ""
|
||||
devices = 0
|
||||
localIP = ""
|
||||
localMAC = ""
|
||||
MAC = ""
|
||||
IPaddr = ""
|
||||
user=user
|
||||
passwd=passwd
|
||||
rcpt=rcpt
|
||||
|
||||
#Save a few colors for the print function
|
||||
class colors:
|
||||
PURPLE = '\033[95m'
|
||||
OKBLUE = '\033[94m'
|
||||
OKGREEN = '\033[92m'
|
||||
WARNING = '\033[93m'
|
||||
FAIL = '\033[91m'
|
||||
ENDC = '\033[0m'
|
||||
|
||||
def disable(self):
|
||||
self.PURPLE = ''
|
||||
self.OKBLUE = ''
|
||||
self.OKGREEN = ''
|
||||
self.WARNING = ''
|
||||
self.FAIL = ''
|
||||
self.ENDC = ''
|
||||
|
||||
#Example usage of colors
|
||||
#print bcolors.OKBLUE + "Check this out" + colors.ENDC
|
||||
localIP = [x[4] for x in scapy.all.conf.route.routes if x[2] != '0.0.0.0'][0]
|
||||
prefixIP = re.search('\d{2,3}\.\d{1,3}\.\d{1,3}\.', localIP).group()
|
||||
|
||||
print colors.FAIL+"\n-----------------------------------------------------------------------------"
|
||||
print "[!]"+colors.ENDC+" Possible promisucous mode enabled on the following clients:\n"
|
||||
ans,unans = promiscping(prefixIP+"*")
|
||||
print colors.FAIL+"-----------------------------------------------------------------------------\n"+colors.ENDC
|
||||
|
||||
#Get the ESSID to match to iwlist scan "(.*?)" searches for all text between quotes
|
||||
essidcmd = bash('iwgetid')
|
||||
essid = re.search('"(.*?)"', essidcmd).group(1)
|
||||
|
||||
#Define interface in use and router IP
|
||||
routecmd = bash('ip route')
|
||||
routerinfo = re.search('default via (%s\d{1,3}) \w+ (\w[a-zA-Z0-9]\w[a-zA-Z0-9][0-9]?)' % prefixIP, routecmd)
|
||||
interface = routerinfo.group(2)
|
||||
routerip = routerinfo.group(1)
|
||||
|
||||
ipalines=bash('ip addr').splitlines()
|
||||
for l in ipalines:
|
||||
macsearch = re.search(interface+":", l)
|
||||
if macsearch != None:
|
||||
indexof = ipalines.index(l)
|
||||
localMAC = re.search('([a-fA-F0-9]{2}[:|\-]?){6}', ipalines[indexof+1]).group()
|
||||
|
||||
#Define router MAC
|
||||
linelist=bash('iwlist scan').splitlines()
|
||||
startline=linelist.index(' ESSID:"%s"' % essid)
|
||||
routermac = re.search('([a-fA-F0-9]{2}[:|\-]?){6}', linelist[startline-5]).group()
|
||||
|
||||
#Populate the IPandMAC table with an arping
|
||||
if len(IPandMAC) == 0:
|
||||
ans,unans = arping(prefixIP+"*")
|
||||
devices = len(ans)
|
||||
for s,r in ans:
|
||||
IPandMAC[r.sprintf("%ARP.hwsrc%")] = r.sprintf("%ARP.psrc%")
|
||||
IPandMAC[localMAC] = localIP
|
||||
|
||||
#Print the known information
|
||||
print colors.OKBLUE+"-----------------------------------------------------------------------------"+colors.ENDC
|
||||
print colors.OKBLUE+"[+]"+colors.ENDC+" Your device: "+colors.OKBLUE+interface+colors.ENDC+" at "+colors.OKBLUE+localIP+colors.ENDC+" with MAC "+colors.OKBLUE+localMAC+colors.ENDC
|
||||
print colors.OKBLUE+"[+]"+colors.ENDC+" Router: "+colors.OKBLUE+essid+colors.ENDC+" at "+colors.OKBLUE+routerip+colors.ENDC+" with MAC "+colors.OKBLUE+routermac
|
||||
print "[+]"+colors.ENDC+" Number of devices on the local network:",colors.OKBLUE,devices+1,colors.ENDC+'\n'
|
||||
ans.show()
|
||||
print localMAC, localIP
|
||||
print colors.OKBLUE+"-----------------------------------------------------------------------------\n"+colors.ENDC
|
||||
|
||||
#Send the email
|
||||
def smtp(msg):
|
||||
try:
|
||||
server = smtplib.SMTP('smtp.gmail.com:587')
|
||||
except Exception:
|
||||
print colors.PURPLE+"\n[?]"+colors.ENDC+" Contacting Gmail server failed, trying again..."
|
||||
server = smtplib.SMTP('smtp.gmail.com:587')
|
||||
|
||||
server.starttls()
|
||||
server.login(user,passwd)
|
||||
server.sendmail(user, rcpt, msg)
|
||||
|
||||
#Print the new device and new device list then email me the device information
|
||||
def newdevices(pkt):
|
||||
print colors.WARNING+'-----------------------------------------------------------------------------'
|
||||
print colors.WARNING+"[*]"+colors.ENDC+" New device joined the network"
|
||||
print colors.WARNING+"[*]"+colors.ENDC+" Device IP: "+colors.WARNING+IPaddr+colors.ENDC+" Device MAC: "+colors.WARNING+MAC
|
||||
print "[*]"+colors.ENDC+" Updated list of current or previously connected devices:\n"
|
||||
for k,v in IPandMAC.iteritems():
|
||||
print k,v
|
||||
if len(IPandMAC) > devices:
|
||||
#Trigger the email for joining network devices here
|
||||
newdevicemsg = "From: From Me <%s>\nTo: <%s>\nSubject:\n\nNew device joined network! IP: %s MAC: %s" % (user, rcpt, IPaddr, MAC)
|
||||
smtp(newdevicemsg)
|
||||
print colors.WARNING+"\n[*]"+colors.ENDC+" Email sent to "+colors.WARNING+rcpt
|
||||
print '-----------------------------------------------------------------------------\n'+colors.ENDC
|
||||
|
||||
#Launch the deauth packets and send the email
|
||||
def deauth(pkt):
|
||||
print colors.FAIL+'-----------------------------------------------------------------------------'
|
||||
print "[!]"+colors.ENDC+" ARP spoof detected!"
|
||||
print colors.FAIL+"[!]"+colors.ENDC+" Attacker IP: "+colors.FAIL+IPandMAC[MAC]+colors.ENDC+" Attacker MAC: "+colors.FAIL+MAC+colors.ENDC+"\n"
|
||||
|
||||
# Start monitor mode
|
||||
moncmd = bash('airmon-ng start %s' % interface)
|
||||
moniface = re.search('(mon[0-9])', moncmd).group()
|
||||
|
||||
print 'aireplay-ng -0 2 -a %s -c %s %s' % (routermac, MAC, moniface)
|
||||
################## PROBLEM HERE #### causes timeout so errors out timeout to send the email with smtp(arpdetmsg)
|
||||
# Unfortunately when sending custom packet from scapy, it works, and when
|
||||
# sending packet from other laptop it makes the variable server timeout!?
|
||||
# Wireshark stops and says network interface failed whether sending from
|
||||
# scapy or other laptop
|
||||
# I wrapped it in try except and it works well, just take a long time on the
|
||||
# first run
|
||||
deauthcmd = bash('aireplay-ng -0 1 -a %s -c %s %s' % (routermac, MAC, moniface))
|
||||
print deauthcmd
|
||||
|
||||
monexit = bash('airmon-ng stop %s' % moniface)
|
||||
#Send email
|
||||
#print "after monexit heres what email msg contains", user, rcpt, IPandMAC[MAC], MAC
|
||||
arpdetmsg = "From: From Me <%s>\nTo: <%s>\nSubject:\nMIME-Version: 1.0\nContent-type: text/plain\n\nArp spoof detected! Attacker IP: %s Attacker MAC: %s" % (user, rcpt, IPandMAC[MAC], MAC)
|
||||
smtp(arpdetmsg)
|
||||
print colors.FAIL+"\n[!]"+colors.ENDC+" Email sent to "+colors.FAIL+rcpt
|
||||
print '-----------------------------------------------------------------------------\n'+colors.ENDC
|
||||
|
||||
|
||||
########################### MAIN LOOP #######################
|
||||
|
||||
def monitor(pkt):
|
||||
global IPandMAC
|
||||
global IPaddr, MAC
|
||||
|
||||
try:
|
||||
MAC = pkt.getlayer(ARP).hwsrc
|
||||
except Exception:
|
||||
print "MAC = NONETYPE"
|
||||
return
|
||||
if MAC == None:
|
||||
return
|
||||
if MAC == '00:00:00:00:00:00':
|
||||
return
|
||||
IPaddr = pkt.getlayer(ARP).psrc
|
||||
if re.search(prefixIP, IPaddr) == None:
|
||||
return
|
||||
|
||||
#Check for arp spoof
|
||||
if MAC in IPandMAC:
|
||||
if IPaddr != IPandMAC[MAC]:
|
||||
|
||||
#Fire the packets
|
||||
deauth(pkt)
|
||||
|
||||
else:
|
||||
IPandMAC[MAC] = IPaddr
|
||||
newdevices(pkt)
|
||||
|
||||
sniff(store=0, filter='arp', prn=monitor, iface=interface)
|
||||
|
||||
|
||||
|
||||
|
||||
#NOTES
|
||||
|
||||
#check if the transistor's network has DHCP offers and requests when devices join
|
||||
|
||||
#Threading for the arp ping or to ping the router to test for connectivity
|
||||
|
||||
#<omgimdrunk> fly-tri: time.sleep(5000)
|
||||
#<omgimdrunk> and threading is stupid simple, hang on i got a one liner
|
||||
#<pdtpatrick> or use something similar to eventmachine ?
|
||||
#<jorrit> Threading is not the good solution for this.
|
||||
#<jorrit> It rarely is.
|
||||
#<jorrit> Better use some event mechanism like twisted.
|
||||
#<omgimdrunk> import threading
|
||||
#<omgimdrunk> t = threadclass ()
|
||||
#<omgimdrunk> t.start
|
||||
|
||||
#Read about Twisted for the regular interval arp ping, as well as inputing commands while script is running?
|
||||
#Read about curses for user input while the script is running
|
||||
|
||||
#Look at pysnort
|
||||
Reference in New Issue
Block a user