diff --git a/arpdet.py b/arpdet.py index 5139834..7aaa443 100755 --- a/arpdet.py +++ b/arpdet.py @@ -16,8 +16,33 @@ import re import subprocess import commands bash = commands.getoutput +<<<<<<< HEAD import argparse +======= + +#user_pass contains the email to send from, the password to that email, and the recipient address +try: + from user_pass import user, passwd, rcpt +except ImportError: + print "[?] Error importing user_pass. Are you sure its in this directory? Email won't send." + +IPandMAC = {} +prefixIP = "" +essid = "" +interface = "" +routerip = "" +devices = 0 +localIP = "" +localMAC = "" +MAC = "" +IPaddr = "" +user=user +passwd=passwd +rcpt=rcpt + +#Save a few colors for the print function +>>>>>>> 9444156c44b0621f556b59aac415d6013adf9447 class colors: PURPLE = '\033[95m' OKBLUE = '\033[94m' @@ -34,6 +59,7 @@ class colors: self.FAIL = '' self.ENDC = '' +<<<<<<< HEAD try: localIP = [x[4] for x in scapy.all.conf.route.routes if x[2] != '0.0.0.0'][0] except Exception: @@ -61,6 +87,17 @@ except ImportError: if args.promiscping == True: print colors.FAIL+"\n[!]"+colors.ENDC+" Possible promisucous mode enabled on the following clients: " ans,unans = promiscping(prefixIP+"*") +======= +#Example usage of colors +#print bcolors.OKBLUE + "Check this out" + colors.ENDC +localIP = [x[4] for x in scapy.all.conf.route.routes if x[2] != '0.0.0.0'][0] +prefixIP = re.search('\d{2,3}\.\d{1,3}\.\d{1,3}\.', localIP).group() + +print colors.FAIL+"\n-----------------------------------------------------------------------------" +print "[!]"+colors.ENDC+" Possible promisucous mode enabled on the following clients:\n" +ans,unans = promiscping(prefixIP+"*") +print colors.FAIL+"-----------------------------------------------------------------------------\n"+colors.ENDC +>>>>>>> 9444156c44b0621f556b59aac415d6013adf9447 #Get the ESSID to match to iwlist scan "(.*?)" searches for all text between quotes essidcmd = bash('iwgetid') @@ -70,7 +107,11 @@ essid = re.search('"(.*?)"', essidcmd).group(1) routecmd = bash('ip route') routerinfo = re.search('default via (%s\d{1,3}) \w+ (\w[a-zA-Z0-9]\w[a-zA-Z0-9][0-9]?)' % prefixIP, routecmd) interface = routerinfo.group(2) +<<<<<<< HEAD routerIP = routerinfo.group(1) +======= +routerip = routerinfo.group(1) +>>>>>>> 9444156c44b0621f556b59aac415d6013adf9447 ipalines=bash('ip addr').splitlines() for l in ipalines: @@ -93,11 +134,21 @@ if len(IPandMAC) == 0: IPandMAC[localMAC] = localIP #Print the known information +<<<<<<< HEAD print colors.OKBLUE+"\n[+]"+colors.ENDC+" Your device: "+colors.OKBLUE+interface+colors.ENDC+" at "+colors.OKBLUE+localIP+colors.ENDC+" with MAC "+colors.OKBLUE+localMAC+colors.ENDC print colors.OKBLUE+"[+]"+colors.ENDC+" Router: "+colors.OKBLUE+essid+colors.ENDC+" at "+colors.OKBLUE+routerIP+colors.ENDC+" with MAC "+colors.OKBLUE+routermac print "[+]"+colors.ENDC+" Number of devices on the local network:",colors.OKBLUE,devices+1,colors.ENDC ans.show() print localMAC, localIP, "\n" +======= +print colors.OKBLUE+"-----------------------------------------------------------------------------"+colors.ENDC +print colors.OKBLUE+"[+]"+colors.ENDC+" Your device: "+colors.OKBLUE+interface+colors.ENDC+" at "+colors.OKBLUE+localIP+colors.ENDC+" with MAC "+colors.OKBLUE+localMAC+colors.ENDC +print colors.OKBLUE+"[+]"+colors.ENDC+" Router: "+colors.OKBLUE+essid+colors.ENDC+" at "+colors.OKBLUE+routerip+colors.ENDC+" with MAC "+colors.OKBLUE+routermac +print "[+]"+colors.ENDC+" Number of devices on the local network:",colors.OKBLUE,devices+1,colors.ENDC+'\n' +ans.show() +print localMAC, localIP +print colors.OKBLUE+"-----------------------------------------------------------------------------\n"+colors.ENDC +>>>>>>> 9444156c44b0621f556b59aac415d6013adf9447 #Send the email def smtp(msg): @@ -105,25 +156,36 @@ def smtp(msg): server = smtplib.SMTP('smtp.gmail.com:587') except Exception: print colors.PURPLE+"\n[?]"+colors.ENDC+" Contacting Gmail server failed, trying again..." +<<<<<<< HEAD try: server = smtplib.SMTP('smtp.gmail.com:587') except Exception: print colors.PURPLE+"[?]"+colors.ENDC+" Contacting Gmail server failed. Could not send notification." return +======= + server = smtplib.SMTP('smtp.gmail.com:587') +>>>>>>> 9444156c44b0621f556b59aac415d6013adf9447 server.starttls() server.login(user,passwd) server.sendmail(user, rcpt, msg) +<<<<<<< HEAD print colors.WARNING+"[*]"+colors.ENDC+" Email sent to "+colors.WARNING+rcpt+colors.ENDC+"\n" def newdevices(pkt): +======= +#Print the new device and new device list then email me the device information +def newdevices(pkt): + print colors.WARNING+'-----------------------------------------------------------------------------' +>>>>>>> 9444156c44b0621f556b59aac415d6013adf9447 print colors.WARNING+"[*]"+colors.ENDC+" New device joined the network" print colors.WARNING+"[*]"+colors.ENDC+" Device IP: "+colors.WARNING+IPaddr+colors.ENDC+" Device MAC: "+colors.WARNING+MAC print "[*]"+colors.ENDC+" Updated list of current or previously connected devices:\n" for k,v in IPandMAC.iteritems(): print k,v if len(IPandMAC) > devices: +<<<<<<< HEAD newdevicemsg = "From: From Me <%s>\nTo: <%s>\nSubject:\n\nNew device joined network! IP: %s MAC: %s" % (user, rcpt, IPaddr, MAC) smtp(newdevicemsg) @@ -131,16 +193,40 @@ def newdevices(pkt): def deauth(pkt): print colors.FAIL+"[!]"+colors.ENDC+" ARP spoof detected!" print colors.FAIL+"[!]"+colors.ENDC+" Attacker IP: "+colors.FAIL+IPandMAC[MAC]+colors.ENDC+" Attacker MAC: "+colors.FAIL+MAC+colors.ENDC +======= + #Trigger the email for joining network devices here + newdevicemsg = "From: From Me <%s>\nTo: <%s>\nSubject:\n\nNew device joined network! IP: %s MAC: %s" % (user, rcpt, IPaddr, MAC) + smtp(newdevicemsg) + print colors.WARNING+"\n[*]"+colors.ENDC+" Email sent to "+colors.WARNING+rcpt + print '-----------------------------------------------------------------------------\n'+colors.ENDC + +#Launch the deauth packets and send the email +def deauth(pkt): + print colors.FAIL+'-----------------------------------------------------------------------------' + print "[!]"+colors.ENDC+" ARP spoof detected!" + print colors.FAIL+"[!]"+colors.ENDC+" Attacker IP: "+colors.FAIL+IPandMAC[MAC]+colors.ENDC+" Attacker MAC: "+colors.FAIL+MAC+colors.ENDC+"\n" +>>>>>>> 9444156c44b0621f556b59aac415d6013adf9447 # Start monitor mode moncmd = bash('airmon-ng start %s' % interface) moniface = re.search('(mon[0-9])', moncmd).group() print 'aireplay-ng -0 2 -a %s -c %s %s' % (routermac, MAC, moniface) +<<<<<<< HEAD +======= + ################## PROBLEM HERE #### causes timeout so errors out timeout to send the email with smtp(arpdetmsg) + # Unfortunately when sending custom packet from scapy, it works, and when + # sending packet from other laptop it makes the variable server timeout!? + # Wireshark stops and says network interface failed whether sending from + # scapy or other laptop + # I wrapped it in try except and it works well, just take a long time on the + # first run +>>>>>>> 9444156c44b0621f556b59aac415d6013adf9447 deauthcmd = bash('aireplay-ng -0 1 -a %s -c %s %s' % (routermac, MAC, moniface)) print deauthcmd monexit = bash('airmon-ng stop %s' % moniface) +<<<<<<< HEAD #Healing packet function here print colors.WARNING+"[*]"+colors.ENDC+" Sending healing packets" @@ -207,15 +293,51 @@ def monitor(pkt): IPaddr = pkt.getlayer(ARP).psrc arppingDet() +======= + #Send email + #print "after monexit heres what email msg contains", user, rcpt, IPandMAC[MAC], MAC + arpdetmsg = "From: From Me <%s>\nTo: <%s>\nSubject:\nMIME-Version: 1.0\nContent-type: text/plain\n\nArp spoof detected! Attacker IP: %s Attacker MAC: %s" % (user, rcpt, IPandMAC[MAC], MAC) + smtp(arpdetmsg) + print colors.FAIL+"\n[!]"+colors.ENDC+" Email sent to "+colors.FAIL+rcpt + print '-----------------------------------------------------------------------------\n'+colors.ENDC + + +########################### MAIN LOOP ####################### + +def monitor(pkt): + global IPandMAC + global IPaddr, MAC + + try: + MAC = pkt.getlayer(ARP).hwsrc + except Exception: + print "MAC = NONETYPE" + return + if MAC == None: + return + if MAC == '00:00:00:00:00:00': + return + IPaddr = pkt.getlayer(ARP).psrc + if re.search(prefixIP, IPaddr) == None: + return +>>>>>>> 9444156c44b0621f556b59aac415d6013adf9447 #Check for arp spoof if MAC in IPandMAC: if IPaddr != IPandMAC[MAC]: +<<<<<<< HEAD deauth(pkt) +======= + + #Fire the packets + deauth(pkt) + +>>>>>>> 9444156c44b0621f556b59aac415d6013adf9447 else: IPandMAC[MAC] = IPaddr newdevices(pkt) +<<<<<<< HEAD while 1: try: sniff(store=0, filter='arp', prn=monitor, iface=interface) @@ -223,3 +345,30 @@ while 1: print Exception print colors.WARNING+"[!] "+colors.ENDC+"Network down, trying again in a minute." time.sleep(60) +======= +sniff(store=0, filter='arp', prn=monitor, iface=interface) + + + + +#NOTES + +#check if the transistor's network has DHCP offers and requests when devices join + +#Threading for the arp ping or to ping the router to test for connectivity + +# fly-tri: time.sleep(5000) +# and threading is stupid simple, hang on i got a one liner +# or use something similar to eventmachine ? +# Threading is not the good solution for this. +# It rarely is. +# Better use some event mechanism like twisted. +# import threading +# t = threadclass () +# t.start + +#Read about Twisted for the regular interval arp ping, as well as inputing commands while script is running? +#Read about curses for user input while the script is running + +#Look at pysnort +>>>>>>> 9444156c44b0621f556b59aac415d6013adf9447