home *** CD-ROM | disk | FTP | other *** search
- # Source Generated with Decompyle++
- # File: in.pyc (Python 2.4)
-
- import os
- import sys
- import getopt
- import struct
- import re
- import string
-
- try:
- import psyco
- psyco.full()
- except ImportError:
- print 'Psyco optimizer not installed, running anyway...'
-
- from socket import *
- from fcntl import ioctl
- from select import select
- from scapy import Raw, Ether, PrismHeader, Dot11, Dot11WEP, LLC, SNAP, sendp, conf
- from scapy import IP, ICMP
- IN_IFACE = 'ath0'
- OUT_IFACE = 'ath0'
- HAS_PRISM = 1
- WEP = 0
- KEYID = 0
- DEBUG = 0
- VERB = 0
- TTL = 64
- BSSID = ''
- UBSSID = ''
- WEPKEY = ''
-
- def usage(status = 0):
- print 'Usage: wifitap -b <BSSID> [-t <TTL>] [-o <iface>] [-i <iface> [-p]]'
- print ' [-w <WEP key> [-k <key id>]] [-d [-v]]'
- print ' [-h]'
- print ' -b <BSSID> specify BSSID for injection'
- print ' -t <TTL> Set TTL (default: 64)'
- print ' -o <iface> specify interface for injection (default: ath0)'
- print ' -i <iface> specify interface for listening (default: ath0)'
- print ' -p listening interface does not provide Prism Headers'
- print ' -w <key> WEP mode and key'
- print ' -k <key id> WEP key id (default: 0)'
- print ' -d activate debug'
- print ' -v verbose debugging'
- print ' -h this so helpful output'
- sys.exit(status)
-
- opts = getopt.getopt(sys.argv[1:], 'b:o:i:w:k:t:pdvh')
- for opt, optarg in opts[0]:
- if opt == '-b':
- UBSSID = optarg
- continue
- if opt == '-o':
- OUT_IFACE = optarg
- continue
- if opt == '-i':
- IN_IFACE = optarg
- continue
- if opt == '-p':
- HAS_PRISM = 0
- continue
- if opt == '-w':
- WEP += 1
- WEPKEY = optarg
- continue
- if opt == '-k':
- KEYID = int(optarg)
- continue
- if opt == '-t':
- TTL = int(optarg)
- continue
- if opt == '-d':
- DEBUG += 1
- continue
- if opt == '-v':
- VERB += 1
- continue
- if opt == '-h':
- usage()
- continue
-
- if not UBSSID:
- print '\nError: BSSID not defined\n'
- usage()
-
- if re.match('^([0-9a-fA-F]{2}:){5}[0-9a-fA-F]{2}$', UBSSID):
- for i in range(17):
- BSSID += UBSSID[i].lower()
-
- else:
- print '\nError: Wrong format for BSSID\n'
- usage()
- if HAS_PRISM:
- print 'IN_IFACE: %s (Prism headers in capture)' % IN_IFACE
- else:
- print 'IN_IFACE: %s (no Prism headers in capture)' % IN_IFACE
- print 'OUT_IFACE: %s' % OUT_IFACE
- print 'BSSID: %s' % BSSID
- if WEP:
- tmp_key = ''
- if re.match('^([0-9a-fA-F]{2}){5}$', WEPKEY) or re.match('^([0-9a-fA-F]{2}){13}$', WEPKEY):
- tmp_key = WEPKEY
- elif re.match('^([0-9a-fA-F]{2}[:]){4}[0-9a-fA-F]{2}$', WEPKEY) or re.match('^([0-9a-fA-F]{2}[:]){12}[0-9a-fA-F]{2}$', WEPKEY):
- tmp_key = re.sub(':', '', WEPKEY)
- elif re.match('^([0-9a-fA-F]{4}[-]){2}[0-9a-fA-F]{2}$', WEPKEY) or re.match('^([0-9a-fA-F]{4}[-]){6}[0-9a-fA-F]{2}$', WEPKEY):
- tmp_key = re.sub('-', '', WEPKEY)
- else:
- print '\nError : Wrong format for WEP key\n'
- usage()
-
- g = lambda x: chr(int(tmp_key[::2][x], 16) * 16 + int(tmp_key[1::2][x], 16))
- for i in range(len(tmp_key) / 2):
- conf.wepkey += g(i)
-
- print 'WEP key: %s (%dbits)' % (WEPKEY, len(tmp_key) * 4)
- if KEYID > 3 or KEYID < 0:
- print 'Key id: %s (defaulted to 0 due to wrong -k argument)' % KEYID
- KEYID = 0
- else:
- print 'Key id: %s' % KEYID
- elif KEYID != 0:
- print 'WEP not activated, key id ignored'
-
- print 'TTL: %s' % TTL
- if not DEBUG:
- if VERB:
- print 'DEBUG not activated, verbosity ignored'
-
- else:
- print 'DEBUG activated'
- if VERB:
- print 'Verbose debugging'
-
- conf.iface = OUT_IFACE
- if HAS_PRISM:
- s = conf.L2listen(iface = IN_IFACE, filter = 'link[144]&0xc == 8 and link[145]&0xf == 1')
- else:
- s = conf.L2listen(iface = IN_IFACE, filter = 'link[0]&0xc == 8 and link[1]&0xf == 1')
-
- try:
- while None:
- dot11_frame = s.recv(2346)
- if DEBUG and VERB:
- if dot11_frame.haslayer(Dot11WEP):
- os.write(1, 'Received WEP from %s\n' % IN_IFACE)
- else:
- os.write(1, 'Received from %s\n' % IN_IFACE)
-
- if dot11_frame.getlayer(Dot11).addr1 != BSSID:
- continue
-
- if dot11_frame.haslayer(ICMP) and dot11_frame.getlayer(ICMP).type == 8:
- if DEBUG:
- os.write(1, 'Received ICMP Echo Request on %s\n' % IN_IFACE)
- if VERB:
- os.write(1, '%s\n' % dot11_frame.summary())
-
-
- dot11_answer = Dot11(type = 'Data', FCfield = 'from-DS', addr1 = dot11_frame.getlayer(Dot11).addr2, addr2 = BSSID, addr3 = dot11_frame.getlayer(Dot11).addr3)
- if WEP:
- dot11_answer.FCfield |= 64
- dot11_answer /= Dot11WEP(iv = '111', keyid = KEYID)
-
- dot11_answer /= LLC(ctrl = 3) / SNAP() / IP(src = dot11_frame.getlayer(IP).dst, dst = dot11_frame.getlayer(IP).src, ttl = TTL)
- dot11_answer /= ICMP(type = 'echo-reply', id = dot11_frame.getlayer(ICMP).id, seq = dot11_frame.getlayer(ICMP).seq)
- dot11_answer /= dot11_frame.getlayer(ICMP).payload
- if DEBUG:
- os.write(1, 'Sending ICMP Echo Reply on %s\n' % OUT_IFACE)
- if VERB:
- os.write(1, '%s\n' % dot11_answer.summary())
-
-
- sendp(dot11_answer, verbose = 0)
- continue
- except KeyboardInterrupt:
- print 'Stopped by user.'
-
- s.close()
- sys.exit()
-