95 lines
2.4 KiB
Python
95 lines
2.4 KiB
Python
from scapy.all import *
|
|
import binascii
|
|
import random
|
|
|
|
iface = "wlan1"
|
|
|
|
routerMAC = "d4:6c:6d:3e:a4:13"
|
|
routerIP = "10.0.0.1"
|
|
requestedIP = "10.0.0.200"
|
|
|
|
zeroIP = "0.0.0.0"
|
|
fullIP = "255.255.255.255"
|
|
broadcastMAC = "ff:ff:ff:ff:ff:ff"
|
|
ifaceMAC = get_if_hwaddr(iface)
|
|
myMAC = '54:3f:19:c9:38:6d'
|
|
serverID = "10.0.0.1"
|
|
|
|
def mac_to_bytes(mac_addr: str) -> bytes:
|
|
return binascii.unhexlify(mac_addr.replace(':', ''))
|
|
# macParts = mac_addr.split(':')
|
|
# i = 0
|
|
# intParts = []
|
|
# while i < len(macParts):
|
|
# intParts[i] = macParts[i]
|
|
# i += 1
|
|
#
|
|
# return ''.join('{:02X}'.format(a) for a in intParts)
|
|
# for macPart in macParts:
|
|
# part = int(macPart)
|
|
# hex = '{:02X}'.format(part)
|
|
|
|
|
|
sourceMAC = mac_to_bytes(myMAC)
|
|
|
|
addr1 = '01:01:01:01:01:01'
|
|
addr2 = '02:02:02:02:02:02'
|
|
src = '3.3.3.3'
|
|
dst = '4.4.4.4'
|
|
chaddr = "\x05\x05\x05\x05\x05\x05";
|
|
requestedIP = '6.6.6.6'
|
|
server_id = '7.7.7.7'
|
|
|
|
explori = RadioTap() \
|
|
/Dot11(type=2,
|
|
subtype=0,
|
|
addr1=addr1,
|
|
addr2=addr2,
|
|
addr3=addr1) \
|
|
/IP(src=src, dst=dst) \
|
|
/UDP(dport=68, sport=67) \
|
|
/BOOTP(chaddr=chaddr, xid=RandInt()) \
|
|
/DHCP(options=[
|
|
("message-type", "request"),
|
|
("requested_addr", requestedIP),
|
|
("server_id", server_id),
|
|
"end"])
|
|
|
|
requestedIP = '10.0.0.253'
|
|
|
|
# dhcpRequest = Dot11(
|
|
# addr1=broadcastMAC,
|
|
# addr2=ifaceMAC,
|
|
# addr3=broadcastMAC)
|
|
dhcpRequest = Ether(src=ifaceMAC, dst=broadcastMAC)
|
|
dhcpRequest /= IP(src=zeroIP, dst=fullIP)
|
|
dhcpRequest /= UDP(dport=67, sport=68)
|
|
dhcpRequest /= BOOTP(
|
|
chaddr=mac_to_bytes(ifaceMAC), xid=RandInt()
|
|
)
|
|
dhcpRequest /= DHCP(
|
|
options=[
|
|
("message-type", "request"),
|
|
("requested_addr", requestedIP),
|
|
("server_id", serverID),
|
|
"end",
|
|
]
|
|
)
|
|
|
|
r = raw(dhcpRequest)
|
|
b = bytes(dhcpRequest)
|
|
print(f"Settings:\n\tSrc MAC: {ifaceMAC}\n\tDst MAC: {broadcastMAC}\n\tSrc IP: {zeroIP}\n\tDst IP: {fullIP}\n\tRequested IP: {requestedIP}\n\tServer ID: {serverID}\n")
|
|
print("Bytes:")
|
|
print(b)
|
|
print("\nHexdump:")
|
|
hexdump(b)
|
|
print("\nls:")
|
|
ls(dhcpRequest)
|
|
|
|
ans,unans = sr(dhcpRequest)
|
|
ans.summary()
|
|
|
|
# ls(explori)
|
|
# sendp(dhcpRequest, iface=iface, loop=True)
|
|
# /BOOTP(chaddr=RandString(12, b"0123456789abcdef"), xid=RandInt()) \
|
|
# /BOOTP(sourceMAC, xid=random.randint(1, 2**32-1)) \ |