Making magic with the network stack
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

226 lines
5.0 KiB

  1. #!/usr/bin/env python3
  2. from scapy.all import *
  3. import ipaddress
  4. from threading import Thread, Event
  5. from time import sleep
  6. import os
  7. recv_count = 0
  8. pcount = 0
  9. server_port = 50508
  10. class Sniffer(Thread):
  11. def __init__(self, iface="ens18"):
  12. super().__init__()
  13. self.daemon = True
  14. self.recv_count = 0
  15. self.socket = None
  16. self.iface = iface
  17. self.stop_sniffer = Event()
  18. self.debug_src = ""
  19. self.debug_sport = 0
  20. self.last_ack = 0
  21. self.last_seq = 0
  22. def run(self):
  23. self.socket = conf.L2listen(
  24. type=ETH_P_ALL,
  25. iface=self.iface,
  26. filter="ip"
  27. )
  28. sniff(
  29. opened_socket=self.socket,
  30. prn=self.handle_packet,
  31. )
  32. def join(self, timeout=None):
  33. self.stop_sniffer.set()
  34. super().join(timeout)
  35. def handle_debug_packet(self, payload):
  36. some_packet = IP(bytes(payload))
  37. print_short(some_packet)
  38. #some_packet.show()
  39. def handle_packet(self, packet):
  40. #ip_layer = packet.getlayer(IP)
  41. #print("[!] New Packet: {src} -> {dst}".format(src=ip_layer.src, dst=ip_layer.dst))
  42. if TCP in packet:
  43. tcp_sport = packet[TCP].sport
  44. tcp_dport = packet[TCP].dport
  45. if tcp_dport == server_port:
  46. #print("sniffed a debug packet..")
  47. #packet.show()
  48. if self.recv_count > 3:
  49. some_payload = packet[TCP].payload
  50. self.handle_debug_packet(some_payload)
  51. self.debug_src = packet[IP].src
  52. self.debug_sport = tcp_sport
  53. self.last_ack = packet[TCP].ack
  54. self.last_seq = packet[TCP].seq
  55. self.recv_count += 1
  56. def print_short(pkt):
  57. global pcount
  58. pcount += 1
  59. sport = 0
  60. dport = 0
  61. ptype = "other"
  62. flags = ""
  63. if TCP in pkt:
  64. dport = pkt[TCP].dport
  65. sport = pkt[TCP].sport
  66. flags = " " + str(pkt[TCP].flags)
  67. ptype = "tcp"
  68. if ICMP in pkt:
  69. ptype = "icmp"
  70. if UDP in pkt:
  71. dport = pkt[UDP].dport
  72. sport = pkt[UDP].sport
  73. ptype = "udp"
  74. print("~~ " + str(pcount) + '. NetworkGenie ' + ptype + flags + ' pkt from ' + str(pkt[IP].src) + ":" + str(sport) + " -> + " + str(pkt[IP].dst) + ":" + str(dport) + " with length: " + str(len(pkt)))
  75. # TODO: make this function be able to craft full custom packet including
  76. # source IP, sport, protocol, flags, payload, etc.
  77. def craft_send_payload(dip, dest_port):
  78. payload = ""
  79. send_pkt = IP(dst=dip, src="10.1.10.4") / TCP(dport=dest_port,sport=40555,flags="S",window=8000)
  80. send_bytes = bytes(send_pkt)
  81. payload = send_bytes
  82. send_pkt.show()
  83. print("debug send payload: " + str(payload))
  84. return payload
  85. def get_send_payload():
  86. payload = "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
  87. send_pkt = IP(dst="9.9.9.9", src="10.0.0.161") / TCP(dport=80,sport=40404,flags="S") / "AAAAAAAA"
  88. send_bytes = bytes(send_pkt)
  89. payload = send_bytes
  90. print("debug send payload: " + str(payload))
  91. return payload
  92. def send_debug_packet(sniffer, is_custom):
  93. debug_port = sniffer.debug_sport
  94. debug_ip = sniffer.debug_src
  95. send_seq = sniffer.last_ack
  96. send_ack = sniffer.last_seq
  97. if debug_port == 0 or debug_ip == '':
  98. print("There was no debug source connection to send to")
  99. return
  100. print("sending debug packet to " + str(debug_ip) + ":" + str(debug_port))
  101. send_payload = ""
  102. if is_custom:
  103. print("\n\nEnter dest ip for packet..")
  104. dip = input("Enter IP: ")
  105. print("\n\nEnter dest port for packet..")
  106. dport = input("Enter port: ")
  107. send_payload = craft_send_payload(dip, int(dport))
  108. else:
  109. send_payload = get_send_payload()
  110. packet = IP(dst=debug_ip) / TCP(dport=debug_port, sport=server_port, flags='PA', seq=send_seq, ack=send_ack) / send_payload
  111. send(packet, iface="ens18")
  112. print("sent debug packet: ")
  113. packet.show()
  114. def main():
  115. sniffer = Sniffer(iface='ens18')
  116. print('starting sniffer..')
  117. sniffer.start()
  118. time.sleep(3)
  119. done = False
  120. while not(done):
  121. print("Enter action to take..")
  122. print("1. Keep sniffing")
  123. print("2. Send test packet back")
  124. print("3. Craft custom packet to send from genie")
  125. print("4. Quit")
  126. answer = input("Enter answer: ")
  127. if answer == "1":
  128. print("sleeping for sniffer..")
  129. time.sleep(5)
  130. elif answer == "2":
  131. send_debug_packet(sniffer, False)
  132. elif answer == "3":
  133. send_debug_packet(sniffer, True)
  134. elif answer == "4":
  135. print("ending the sniffer")
  136. done = True
  137. print("user answer was: " + str(answer))
  138. print("\n")
  139. time.sleep(1)
  140. print("\n\nFinished sniffing for debug packets")
  141. if __name__ == '__main__':
  142. main()