home *** CD-ROM | disk | FTP | other *** search
/ Hackers Handbook - Millenium Edition / Hackers Handbook.iso / library / hack / changemac.txt < prev    next >
Encoding:
Text File  |  1998-07-17  |  15.7 KB  |  383 lines
  1. /*
  2.  *  In P51-02 someone mentioned Ethernet spoofing.  Here you go.
  3.  *  This tiny program can be used to trick some smart / switching hubs.
  4.  *
  5.  *  AWL production: (General Public License v2)
  6.  *
  7.  *      changemac  version 1.0  (2.20.1998)
  8.  *
  9.  *  changemac  --   change MAC address of your ethernet card.
  10.  *
  11.  *  changemac [-l] | [-d number ] [ -r | -a address ]
  12.  *
  13.  *      -d number       number of ethernet device, 0 for eth0, 1 for eth1 ...
  14.  *                      if -d option is not specify default value is 0 (eth0)
  15.  *
  16.  *      -h              help for changemac command
  17.  *
  18.  *      -a address      address format is xx:xx:xx:xx:xx:xx
  19.  *
  20.  *      -r              set random MAC address for ethernet card
  21.  *
  22.  *      -l              list first three MAC bytes of known ethernet vendors
  23.  *                      (this list is not compleet, anyone who know some more
  24.  *                      information about MAC addresses can mail me)
  25.  *
  26.  *  changemac does not change hardware address, it just change data in
  27.  *  structure of kernel driver for your card.  Next boot on your computer will
  28.  *  read real MAC form your hardware.
  29.  *
  30.  *  The changed MAC stays as long as your box is running, (or as long as next
  31.  *  successful changemac).
  32.  *
  33.  *  It will not work if kernel is already using that ethernet device.  In that
  34.  *  case you have to turn off that device (ifconfig eth0 down).
  35.  *
  36.  *  I use changemac in /etc/rc.d/rc.inet1 (slackware, or redhat) just line
  37.  *  before ifconfig for ethernet device (/sbin/ifconfig eth0 ...)
  38.  *
  39.  *  The author will be very pleased if you can learn something form this code.
  40.  *
  41.  *  Updates of this code can be found on:
  42.  *  http://galeb.etf.bg.ac.yu/~azdaja/changemac.html
  43.  *
  44.  *  Sugestions and comments can be sent to author:
  45.  *  Milos Prodanovic <azdaja@galeb.etf.bg.ac.yu>
  46.  */
  47.  
  48. #include <string.h>
  49. #include <stdio.h>
  50. #include <stdlib.h>
  51. #include <errno.h>
  52. #include <sys/socket.h>
  53. #include <sys/ioctl.h>
  54. #include <net/if.h>
  55. #include <unistd.h>
  56.  
  57. struct LIST
  58. {
  59.     char name[50];
  60.     u_char mac[3];
  61. };
  62.  
  63. /*
  64.  *  This list was obtainted from vyncke@csl.sni.be, created on 01.7.93.
  65.  */
  66.  
  67. struct LIST vendors[] = {
  68.                 {"OS/9 Network                         ",'\x00','\x00','\x00'},
  69.                 {"BBN                                  ",'\x00','\x00','\x02'},
  70.                 {"Cisco                                ",'\x00','\x00','\x0C'},
  71.                 {"Fujitsu                              ",'\x00','\x00','\x0E'},
  72.                 {"NeXT                                 ",'\x00','\x00','\x0F'},
  73.                 {"Sytek/Hughes LAN Systems             ",'\x00','\x00','\x10'},
  74.                 {"Tektronics                           ",'\x00','\x00','\x11'},
  75.                 {"Datapoint                            ",'\x00','\x00','\x15'},
  76.                 {"Webster                              ",'\x00','\x00','\x18'},
  77.                 {"AMD ?                                ",'\x00','\x00','\x1A'},
  78.                 {"Novell/Eagle Technology              ",'\x00','\x00','\x1B'},
  79.                 {"Cabletron                            ",'\x00','\x00','\x1D'},
  80.                 {"Data Industrier AB                   ",'\x00','\x00','\x20'},
  81.                 {"SC&C                                 ",'\x00','\x00','\x21'},
  82.                 {"Visual Technology                    ",'\x00','\x00','\x22'},
  83.                 {"ABB                                  ",'\x00','\x00','\x23'},
  84.                 {"IMC                                  ",'\x00','\x00','\x29'},
  85.                 {"TRW                                  ",'\x00','\x00','\x2A'},
  86.                 {"Auspex                               ",'\x00','\x00','\x3C'},
  87.                 {"ATT                                  ",'\x00','\x00','\x3D'},
  88.                 {"Castelle                             ",'\x00','\x00','\x44'},
  89.                 {"Bunker Ramo                          ",'\x00','\x00','\x46'},
  90.                 {"Apricot                              ",'\x00','\x00','\x49'},
  91.                 {"APT                                  ",'\x00','\x00','\x4B'},
  92.                 {"Logicraft                            ",'\x00','\x00','\x4F'},
  93.                 {"Hob Electronic                       ",'\x00','\x00','\x51'},
  94.                 {"ODS                                  ",'\x00','\x00','\x52'},
  95.                 {"AT&T                                 ",'\x00','\x00','\x55'},
  96.                 {"SK/Xerox                             ",'\x00','\x00','\x5A'},
  97.                 {"RCE                                  ",'\x00','\x00','\x5D'},
  98.                 {"IANA                                 ",'\x00','\x00','\x5E'},
  99.                 {"Gateway                              ",'\x00','\x00','\x61'},
  100.                 {"Honeywell                            ",'\x00','\x00','\x62'},
  101.                 {"Network General                      ",'\x00','\x00','\x65'},
  102.                 {"Silicon Graphics                     ",'\x00','\x00','\x69'},
  103.                 {"MIPS                                 ",'\x00','\x00','\x6B'},
  104.                 {"Madge                                ",'\x00','\x00','\x6F'},
  105.                 {"Artisoft                             ",'\x00','\x00','\x6E'},
  106.                 {"MIPS/Interphase                      ",'\x00','\x00','\x77'},
  107.                 {"Labtam                               ",'\x00','\x00','\x78'},
  108.                 {"Ardent                               ",'\x00','\x00','\x7A'},
  109.                 {"Research Machines                    ",'\x00','\x00','\x7B'},
  110.                 {"Cray Research/Harris                 ",'\x00','\x00','\x7D'},
  111.                 {"Linotronic                           ",'\x00','\x00','\x7F'},
  112.                 {"Dowty Network Services               ",'\x00','\x00','\x80'},
  113.                 {"Synoptics                            ",'\x00','\x00','\x81'},
  114.                 {"Aquila                               ",'\x00','\x00','\x84'},
  115.                 {"Gateway                              ",'\x00','\x00','\x86'},
  116.                 {"Cayman Systems                       ",'\x00','\x00','\x89'},
  117.                 {"Datahouse Information Systems        ",'\x00','\x00','\x8A'},
  118.                 {"Jupiter ? Solbourne                  ",'\x00','\x00','\x8E'},
  119.                 {"Proteon                              ",'\x00','\x00','\x93'},
  120.                 {"Asante                               ",'\x00','\x00','\x94'},
  121.                 {"Sony/Tektronics                      ",'\x00','\x00','\x95'},
  122.                 {"Epoch                                ",'\x00','\x00','\x97'},
  123.                 {"CrossCom                             ",'\x00','\x00','\x98'},
  124.                 {"Ameristar Technology                 ",'\x00','\x00','\x9F'},
  125.                 {"Sanyo Electronics                    ",'\x00','\x00','\xA0'},
  126.                 {"Wellfleet                            ",'\x00','\x00','\xA2'},
  127.                 {"NAT                                  ",'\x00','\x00','\xA3'},
  128.                 {"Acorn                                ",'\x00','\x00','\xA4'},
  129.                 {"Compatible Systems Corporation       ",'\x00','\x00','\xA5'},
  130.                 {"Network General                      ",'\x00','\x00','\xA6'},
  131.                 {"NCD                                  ",'\x00','\x00','\xA7'},
  132.                 {"Stratus                              ",'\x00','\x00','\xA8'},
  133.                 {"Network Systems                      ",'\x00','\x00','\xA9'},
  134.                 {"Xerox                                ",'\x00','\x00','\xAA'},
  135.                 {"Western Digital/SMC                  ",'\x00','\x00','\xC0'},
  136.                 {"Eon Systems (HP)                     ",'\x00','\x00','\xC6'},
  137.                 {"Altos                                ",'\x00','\x00','\xC8'},
  138.                 {"Emulex                               ",'\x00','\x00','\xC9'},
  139.                 {"Darthmouth College                   ",'\x00','\x00','\xD7'},
  140.                 {"3Com ? Novell ? [PS/2]               ",'\x00','\x00','\xD8'},
  141.                 {"Gould                                ",'\x00','\x00','\xDD'},
  142.                 {"Unigraph                             ",'\x00','\x00','\xDE'},
  143.                 {"Acer Counterpoint                    ",'\x00','\x00','\xE2'},
  144.                 {"Atlantec                             ",'\x00','\x00','\xEF'},
  145.                 {"High Level Hardware (Orion, UK)      ",'\x00','\x00','\xFD'},
  146.                 {"BBN                                  ",'\x00','\x01','\x02'},
  147.                 {"Kabel                                ",'\x00','\x17','\x00'},
  148.                 {"Xylogics, Inc.-Annex terminal servers",'\x00','\x08','\x2D'},
  149.                 {"Frontier Software Development        ",'\x00','\x08','\x8C'},
  150.                 {"Intel                                ",'\x00','\xAA','\x00'},
  151.                 {"Ungermann-Bass                       ",'\x00','\xDD','\x00'},
  152.                 {"Ungermann-Bass                       ",'\x00','\xDD','\x01'},
  153.                 {"MICOM/Interlan [Unibus, Qbus, Apollo]",'\x02','\x07','\x01'},
  154.                 {"Satelcom MegaPac                     ",'\x02','\x60','\x86'},
  155.                 {"3Com [IBM PC, Imagen, Valid, Cisco]  ",'\x02','\x60','\x8C'},
  156.                 {"CMC [Masscomp, SGI, Prime EXL]       ",'\x02','\xCF','\x1F'},
  157.                 {"3Com (ex Bridge)                     ",'\x08','\x00','\x02'},
  158.                 {"Symbolics                            ",'\x08','\x00','\x05'},
  159.                 {"Siemens Nixdorf                      ",'\x08','\x00','\x06'},
  160.                 {"Apple                                ",'\x08','\x00','\x07'},
  161.                 {"HP                                   ",'\x08','\x00','\x09'},
  162.                 {"Nestar Systems                       ",'\x08','\x00','\x0A'},
  163.                 {"Unisys                               ",'\x08','\x00','\x0B'},
  164.                 {"AT&T                                 ",'\x08','\x00','\x10'},
  165.                 {"Tektronics                           ",'\x08','\x00','\x11'},
  166.                 {"Excelan                              ",'\x08','\x00','\x14'},
  167.                 {"NSC                                  ",'\x08','\x00','\x17'},
  168.                 {"Data General                         ",'\x08','\x00','\x1A'},
  169.                 {"Data General                         ",'\x08','\x00','\x1B'},
  170.                 {"Apollo                               ",'\x08','\x00','\x1E'},
  171.                 {"Sun                                  ",'\x08','\x00','\x20'},
  172.                 {"Norsk Data                           ",'\x08','\x00','\x26'},
  173.                 {"DEC                                  ",'\x08','\x00','\x2B'},
  174.                 {"Bull                                 ",'\x08','\x00','\x38'},
  175.                 {"Spider                               ",'\x08','\x00','\x39'},
  176.                 {"Sony                                 ",'\x08','\x00','\x46'},
  177.                 {"BICC                                 ",'\x08','\x00','\x4E'},
  178.                 {"IBM                                  ",'\x08','\x00','\x5A'},
  179.                 {"Silicon Graphics                     ",'\x08','\x00','\x69'},
  180.                 {"Excelan                              ",'\x08','\x00','\x6E'},
  181.                 {"Vitalink                             ",'\x08','\x00','\x7C'},
  182.                 {"XIOS                                 ",'\x08','\x00','\x80'},
  183.                 {"Imagen                               ",'\x80','\x00','\x86'},
  184.                 {"Xyplex                               ",'\x80','\x00','\x87'},
  185.                 {"Kinetics                             ",'\x80','\x00','\x89'},
  186.                 {"Pyramid                              ",'\x80','\x00','\x8B'},
  187.                 {"Retix                                ",'\x80','\x00','\x90'},
  188.                 {'\x0','\x0','\x0','\x0'}
  189.                      };
  190.  
  191. void change_MAC(u_char *,int);
  192. void list();
  193. void random_mac(u_char *);
  194. void help();
  195. void addr_scan(char *,u_char *);
  196.  
  197. int
  198. main(int argc, char ** argv)
  199. {
  200.     char c;
  201.     u_char mac[6] = "\0\0\0\0\0\0";
  202.     int nr = 0,eth_num = 0,nr2 = 0;
  203.     extern char *optarg;
  204.  
  205.     if (argc == 1)
  206.     {
  207.         printf("for help: changemac -h\n");
  208.         exit(1);
  209.     }
  210.  
  211.     while ((c = getopt(argc, argv, "-la:rd:")) != EOF)
  212.     {
  213.         switch(c)
  214.         {
  215.             case 'l' :
  216.                 list();
  217.                 exit(1);
  218.             case 'r' :
  219.                 nr++;
  220.                 random_mac(mac);
  221.                 break;
  222.             case 'a' :
  223.                 nr++;
  224.                 addr_scan(optarg,mac);
  225.                 break;
  226.             case 'd' :
  227.                 nr2++;
  228.                 eth_num = atoi(optarg);
  229.                 break;
  230.             default:
  231.                 help();
  232.                 exit(1);
  233.         }
  234.         if (nr2 > 1 || nr > 1)
  235.         {
  236.             printf("too many options\n");
  237.             exit(1);
  238.         }
  239.     }
  240.     change_MAC(mac,eth_num);
  241.     return (0);
  242. }
  243.  
  244. void
  245. change_MAC(u_char *p, int ether)
  246. {
  247.     struct  ifreq  devea;
  248.     int s, i;
  249.  
  250.     s = socket(AF_INET, SOCK_DGRAM, 0);
  251.     if (s < 0)
  252.     {
  253.         perror("socket");
  254.         exit(1);
  255.     }
  256.  
  257.     sprintf(devea.ifr_name, "eth%d", ether);
  258.     if (ioctl(s, SIOCGIFHWADDR, &devea) < 0)
  259.     {
  260.         perror(devea.ifr_name);
  261.         exit(1);
  262.     }
  263.  
  264.     printf("Current MAC is\t");
  265.     for (i = 0; i < 6; i++)
  266.     {
  267.         printf("%2.2x ", i[devea.ifr_hwaddr.sa_data] & 0xff);
  268.     }
  269.     printf("\n");
  270.  
  271. /* an ANSI C  ?? --> just testing your compiler */
  272.     for(i = 0; i < 6; i++) i[devea.ifr_hwaddr.sa_data] = i[p];
  273.  
  274.     printf("Changing MAC to\t");
  275.  
  276. /* right here i am showing how interesting is programing in C */
  277.  
  278.     printf("%2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x\n",
  279.         0[p],
  280.         1[p],
  281.         2[p],
  282.         3[p],
  283.         4[p],
  284.         5[p]);
  285.  
  286.     if (ioctl(s,SIOCSIFHWADDR,&devea) < 0)
  287.     {
  288.         printf("Unable to change MAC -- Is eth%d device is up?\n", ether);
  289.         perror(devea.ifr_name);
  290.         exit(1);
  291.     }
  292.     printf("MAC changed\n");
  293.  
  294.     /* just to be sure ... */
  295.  
  296.     if (ioctl(s, SIOCGIFHWADDR, &devea) < 0)
  297.     {
  298.         perror(devea.ifr_name);
  299.         exit(1);
  300.     }
  301.  
  302.     printf("Current MAC is: ");
  303.  
  304.     for (i = 0; i < 6; i++) printf("%X ", i[devea.ifr_hwaddr.sa_data] & 0xff);
  305.     printf("\n");
  306.  
  307.     close(s);
  308. }
  309.  
  310. void
  311. list()
  312. {
  313.     int i = 0;
  314.     struct LIST *ptr;
  315.  
  316.     printf("\nNumber\t MAC addr \t vendor\n");
  317.     while (0[i[vendors].name])
  318.     {
  319.         ptr = vendors + i;
  320.         printf("%d\t=> %2.2x:%2.2x:%2.2x \t%s \n",
  321.             i++,
  322.             0[ptr->mac],
  323.             1[ptr->mac],
  324.             2[ptr->mac],
  325.             ptr->name);
  326.         if (!(i % 15))
  327.         {
  328.             printf("\n press enter to continue\n");
  329.             getchar();
  330.         }
  331.     }
  332. }
  333.  
  334. void
  335. random_mac(u_char *p)
  336. {
  337.     srandom(getpid());
  338.  
  339.     0[p] = random() % 256;
  340.     1[p] = random() % 256;
  341.     2[p] = random() % 256;
  342.     3[p] = random() % 256;
  343.     4[p] = random() % 256;
  344.     5[p] = random() % 256;
  345. }
  346.  
  347. void
  348. addr_scan(char *arg, u_char *mac)
  349. {
  350.     int i;
  351.  
  352.     if (!(2[arg] == ':' &&
  353.             5[arg] == ':' &&
  354.             8[arg] == ':' &&
  355.             11[arg] == ':' &&
  356.             14[arg] == ':' &&
  357.             strlen(arg) == 17 ))
  358.     {
  359.         printf("address is not in spacified format\n");
  360.         exit(0);
  361.     }
  362.     for(i = 0; i < 6; i++) i[mac] = (char)(strtoul(arg + i*3, 0, 16) & 0xff);
  363. }
  364.  
  365. void
  366. help()
  367. {
  368.     printf(" changemac - soft change MAC address of your ethernet card \n");
  369.     printf(" changemac -l | [-d number ] [ -r | -a address ] \n");
  370.     printf("   before you try to use it just turn ethernet card off, ifconfig ethX down\n");
  371.     printf(" -d number    number of ethernet device \n");
  372.     printf(" -h           this help \n");
  373.     printf(" -a address   address format is xx:xx:xx:xx:xx:xx \n");
  374.     printf(" -r           set random generated address \n");
  375.     printf(" -l           list first three MAC bytes of known ethernet vendors\n");
  376.     printf(" example: changemac -d 1 -a 12:34:56:78:9a:bc\n");
  377. }
  378.  
  379. /* EOF */
  380.  
  381. ---------------------------------------------------------------------------
  382. ⌐ 1998 Rootshell - Unauthorized duplication prohibited.
  383.