-
-
Notifications
You must be signed in to change notification settings - Fork 15
Description
Hi everybody.
I am using libpcap with Python 3 for a school projct.
I am trying to redirect the traffic in order to achieve a MITM attack after poisoning the ARP tables of a server and a client.
The problem is that the libpcap function sendpacket and inject give me the given errors for the given inputs:
ERROR - sending a packet with sendPacketPcapGlobal. ERROR - DEBUG - sendPacketPcapGlobal - str(''.join(pkt_data)).replace("0x","").replace(" ","") = 0242c0a878500242c0a878460800450801ac445140004006fb5bc0a87846c0a8783c8bcc9e786e6731e771b0bd2b801001fe737200000101080a6204a811ca8a402de54ee906b2ad20ab52f25d5b50a00b76f1b789e3e946a134cebd34fb470235022c56261d18dad73ede294a70a4dab1a8a6ada599cb93ee900b01a0f66bc68aa6954540c5669677f9786fef8d3c40f6117f13ca2e4eca706ca7ac2d60a5a548245ddb08b8f6b11ae97bdbf2e3c08114c2aa7c10abcbe704b06620027c3c56dae87948a6ab9e2620a4922865bab31237a8bdbd813c40f8ebcf4ecab245634324712d422862d7009000efe238e031552a9a71a099e2994522f96ea7f745877d35f6728ac411559838f4d6c41f87ce7bcf559d2d95b37d7bd6d1aef5a78c47ac091aeadbc0ec00ec4f7e612efd5a05ba23671359c1b92f29cb605664ce1d63a28dd6098ee58cdb19a9c3e0f3eb31c53463cddd778636f78ebadae6fa720b76c956f09d8441dbd3c6a734bbafc5380e8e9a27feb4b3ee6cca59963c3b29c74d4d414708a0afaa475dfe64ab7d850ebb4016b8f68e497bb365f9d2a52875270e83b680d9c5eaac5a4a81db899e1d1555343d4ac1ba5d8762547410 ERROR - DEBUG - sendPacketPcapGlobal - func_sizePacketDataInt = 442 ERROR - DEBUG - sendPacketPcapGlobal - resInt = -1 ERROR - Error Description: b'send: Bad address'
ERROR - sending a packet with sendPacketPcapGlobal. ERROR - DEBUG - sendPacketPcapGlobal - str(''.join(pkt_data)).replace("0x","").replace(" ","") = 0242c0a878500242c0a8784608004508febc448040004006fe1bc0a87846c0a8783c8bcc9e786e68335f71b0bd2b801801fe70830000010 IMAGINE MORE HEX VALUES HERE - Because GITHUB SAYS: "Comment is too long (maximum is 65536 characters)" ERROR - DEBUG - sendPacketPcapGlobal - func_sizePacketDataInt = 65226 ERROR - DEBUG - sendPacketPcapGlobal - resInt = -1 ERROR - Error Description: b'send: Message too large'
I set the snap length to more than 65226 bytes before activating the pcap_t object. Some code that could be helpful is the function used to inject/send the packet, which is the following:
(Sorry for the bad formatting, I could not get it to work properly...)
"CODE START"
`
def sendPacketPcapGlobal(pkt_data):
"""
sendPacketPcapGlobal sends the data contained in the call variable pkt_data using some global variables, which should be set before calling this function.
The global variables used by this function are:
gl_ifName (str) --> Name of the interface which will be used in order to send the packet
gl_ifNetworkMask (int) --> Network Mask of the interface which will be used in order to send the packet.
"""
global gl_ifNameStr, gl_ifNetworkMaskInt
func_ifName = gl_ifNameStr
func_ifNetworkMask = gl_ifNetworkMaskInt
#Initialize a pcap_t struct
#print("DEBUG - Starting myPcapLoop! \n dev = ", dev_Func, "\n idStr = ", idStr, "\n buf_Func = ", str(buf_Func))
#1. Create a pcap_t
#pcap_t *pcap_create(const char *source, char *errbuf);
func_dev = ctypes.c_char_p(func_ifName.encode(gl_pcap_encode))
func_errBuff = ctypes.create_string_buffer(libpcap.PCAP_ERRBUF_SIZE)
func_pcap_t = libpcap.create(func_dev, func_errBuff)
if not func_pcap_t:
print("ERROR - myPcapLoop could not create a pcap_t object for the device: ", dev_Func)
return 1
#1.2 Set SnapLength
#func_pcap_snaplen = 65535
func_pcap_snaplen = 65535*2
pcap_snaplen = ctypes.c_int(func_pcap_snaplen)
#int pcap_set_snaplen(pcap_t *p, int snaplen);
intRes = libpcap.set_snaplen(func_pcap_t, pcap_snaplen)
if intRes !=0:
print("ERROR - Setting snaplen for capturing data")
#2. Activate a pcap_t in order to be able to capture packets with it
#int pcap_activate(pcap_t *p);
activateInt = libpcap.activate(func_pcap_t)
#Activate returns 0 for succes:
if activateInt != 0:
print("ERROR - Could NOT activate the pcap_t struct for the device = ", dev_Func)
if activateInt == libpcap.PCAP_WARNING_PROMISC_NOTSUP:
print("ERROR - PCAP_WARNING_PROMISC_NOTSUP - Promiscuous mode was requested, but the capture source doesn't support promiscuous mode. " )
elif activateInt == libpcap.PCAP_WARNING_TSTAMP_TYPE_NOTSUP:
print("ERROR - PCAP_WARNING_TSTAMP_TYPE_NOTSUP - The time stamp type specified in a previous pcap_set_tstamp_type(3PCAP) call isn't supported by the capture source (the time stamp type is left as the default), ")
elif activateInt == libpcap.PCAP_WARNING:
print("ERROR - PCAP_WARNING - Another warnign occurred.")
func_error = libpcap.geterr(func_pcap_t)
print("ERROR - ",str(func_error))
elif activateInt == libpcap.PCAP_ERROR_ACTIVATED:
print("ERROR - PCAP_ERROR_ACTIVATED - The handle has already been activated." )
elif activateInt == libpcap.PCAP_ERROR_NO_SUCH_DEVICE:
print("ERROR - PCAP_ERROR_NO_SUCH_DEVICE - The capture source specified when the handle was created doesn't exist. ")
elif activateInt == libpcap.PCAP_ERROR_PERM_DENIED:
print("ERROR - PCAP_ERROR_PERM_DENIED - The process doesn't have permission to open the capture source. ")
elif activateInt == libpcap.PCAP_ERROR_PROMISC_PERM_DENIED:
print("ERROR - PCAP_ERROR_PROMISC_PERM_DENIED - The process has permission to open the capture source but doesn't have permission to put it into promiscuous mode. " )
elif activateInt == libpcap.PCAP_ERROR_RFMON_NOTSUP:
print("ERROR - PCAP_ERROR_RFMON_NOTSUP - Monitor mode was specified but the capture source doesn't support monitor mode. " )
elif activateInt == libpcap.PCAP_ERROR_IFACE_NOT_UP:
print("ERROR - PCAP_ERROR_IFACE_NOT_UP - The capture source device is not up. ")
elif activateInt == libpcap.PCAP_ERROR:
print("ERROR - PCAP_ERROR - Another error occurred:")
func_error = libpcap.geterr(func_pcap_t)
print("ERROR - ",str(func_error))
else:
print("ERROR - Unknow error for libpcap.activate() function")
#Fix the pkt_data if needed
func_pkt_data = str(''.join(pkt_data)).replace("0x","").replace(" ","")
#print("DEBUG - func_pkt_data = ", func_pkt_data)
func_sizePacketDataInt = math.ceil(len(func_pkt_data)/2)
#Store the packet data in a suitable variable to use the library libpcap
#Commented HERE - Possible error
#buf_pcap = (ctypes.c_ubyte*(func_sizePacketDataInt))(*bytes.fromhex(func_pkt_data.replace("0x","")))
#Pointer to packet data:
func_packetPointer = ctypes.cast(func_pkt_data, ctypes.POINTER(ctypes.c_ubyte))
#packetDataHex =
#0242c0a878500242c0a8783c080045000083934740004006355ac0a8783cc0a87846d12200153e89599d41abd7ea801801f5724900000101080a89b2ac700d7890534d44544d2067616c6178792d6e61747572652d6165737468657469632d6261636b67726f756e642d7374617272792d736b792d6d6f756e7461696e2d72656d697865642d6d656469612e6a70670d0a
#0242c0a878500242c0a8784608004500006f7b044000400633a0fc0a87846c0a8783c0015930c14a79c94ddfd0cec801801fe723500000101080a0d7c552e89b671473232302057656c636f6d6520746f206d792046545020736572766963652e204e6f7420796f75727321204d792074726561737572652e2e2e2e0d0a
#0242c0a878500242c0a87846080045000069f959400040063b85ec0a87846c0a8783c0015d12241abd7fe3e8959f2801801fe722f00000101080a0d78905489b2ac7032323720456e746572696e672050617373697665204d6f646520283139322c3136382c3132302c37302c3131322c313136292e0d0a
#Send the packet:
#OLD - Because of too large messages
#resInt = libpcap.sendpacket(func_pcap_t, func_packetPointer, int(func_sizePacketDataInt))
#NEW - With inject function to try to avoid bug
resInt = libpcap.inject(func_pcap_t, func_packetPointer, int(func_sizePacketDataInt))
#Error checking for libpcap.inject function
if resInt != int(func_sizePacketDataInt):
print("ERROR - sending a packet with sendPacketPcapGlobal.")
print("""ERROR - DEBUG - sendPacketPcapGlobal - str(''.join(pkt_data)).replace("0x","").replace(" ","") = """, str(''.join(pkt_data)).replace("0x","").replace(" ",""))
print("ERROR - DEBUG - sendPacketPcapGlobal - func_sizePacketDataInt = ", func_sizePacketDataInt)
print("ERROR - DEBUG - sendPacketPcapGlobal - resInt = ", resInt)
if resInt == libpcap.PCAP_ERROR_NOT_ACTIVATED:
print("ERROR - pcap_t not activated")
elif resInt == libpcap.PCAP_ERROR:
#char *pcap_geterr(pcap_t *p);
errorBuff = libpcap.geterr(func_pcap_t)
print("ERROR - Error Description: ", errorBuff)
else:
print("ERROR - UNKNOWN - resInt = ", resInt)
else:
#print("SUCCESS!!! - Packet send using the function sendPacketPcapGlobal !!!")
pass
"""
#OLD - Because of too large messages
#resInt = libpcap.sendpacket(func_pcap_t, func_packetPointer, int(func_sizePacketDataInt))
#Error checking for sendpacket function
if resInt != 0:
print("ERROR - sending a packet with sendPacketPcapGlobal.")
print("ERROR - DEBUG - sendPacketPcapGlobal - str(''.join(pkt_data)).replace("0x","").replace(" ","") = ", str(''.join(pkt_data)).replace("0x","").replace(" ",""))
print("ERROR - DEBUG - sendPacketPcapGlobal - func_sizePacketDataInt = ", func_sizePacketDataInt)
if resInt == libpcap.PCAP_ERROR_NOT_ACTIVATED:
print("ERROR - pcap_t not activated")
elif resInt == libpcap.PCAP_ERROR:
#char *pcap_geterr(pcap_t *p);
errorBuff = libpcap.geterr(func_pcap_t)
print("ERROR - Error Description: ", errorBuff)
else:
print("ERROR - UNKNOWN")
"""
return 0
`
"CODE END"
EDIT: I forgot some possibly important info about the system:
/home # pip list
Package Version
appdirs 1.4.4
contextlib2 21.6.0
importlib-metadata 6.8.0
importlib-resources 6.1.0
libpcap 1.11.0b7
more-itertools 8.13.0
numpy 1.26.1
ordered-set 4.0.2
packaging 21.3
pep517 0.12.0
pip 22.1.1
pkg-about 1.0.8
pyparsing 2.4.7
retrying 1.3.3
setuptools 68.2.2
six 1.16.0
tomli 2.0.1
zipp 3.17.0
/home # pip install libpcap
Requirement already satisfied: libpcap in /usr/lib/python3.10/site-packages (1.11.0b7)
Requirement already satisfied: setuptools>=63.2.0 in /usr/lib/python3.10/site-packages (from libpcap) (68.2.2)
Requirement already satisfied: pkg-about>=1.0.7 in /usr/lib/python3.10/site-packages (from libpcap) (1.0.8)
Requirement already satisfied: importlib-resources>=5.7.1 in /usr/lib/python3.10/site-packages (from pkg-about>=1.0.7->libpcap) (6.1.0)
Requirement already satisfied: packaging>=21.3.0 in /usr/lib/python3.10/site-packages (from pkg-about>=1.0.7->libpcap) (21.3)
Requirement already satisfied: tomli>=2.0.1 in /usr/lib/python3.10/site-packages (from pkg-about>=1.0.7->libpcap) (2.0.1)
Requirement already satisfied: importlib-metadata>=4.12.0 in /usr/lib/python3.10/site-packages (from pkg-about>=1.0.7->libpcap) (6.8.0)
Requirement already satisfied: zipp>=0.5 in /usr/lib/python3.10/site-packages (from importlib-metadata>=4.12.0->pkg-about>=1.0.7->libpcap) (3.17.0)
I was wondering how to avoid both problems, or if it was a bug of the library libpcap in C or in Python. Any help would be really welcome. Thank you for your time.