2
hunter -- ettercap plugin -- Promisc Finder
4
Copyright (C) 2003 ALoR <alor@users.sourceforge.net>, NaGA <crwm@freemail.it>
6
This program is free software; you can redistribute it and/or modify
7
it under the terms of the GNU General Public License as published by
8
the Free Software Foundation; either version 2 of the License, or
9
(at your option) any later version.
11
This program is distributed in the hope that it will be useful,
12
but WITHOUT ANY WARRANTY; without even the implied warranty of
13
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14
GNU General Public License for more details.
16
You should have received a copy of the GNU General Public License
17
along with this program; if not, write to the Free Software
18
Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
32
#include "../../src/include/ec_main.h"
33
#include "../../src/include/ec_version.h"
34
#include "../../src/include/ec_plugins.h"
35
#include "../../src/include/ec_inet_structures.h"
36
#include "../../src/include/ec_inet.h"
37
#include "../../src/include/ec_inet_forge.h"
42
int Plugin_Init(void *);
43
int Plugin_Fini(void *);
44
int hunter(void *dummy);
48
struct plugin_ops hunter_ops = {
49
ettercap_version: VERSION,
50
plug_info: "Search promisc NICs",
53
hook_point: HOOK_NONE,
54
hook_function: &hunter,
57
struct recv_packet recvpck;
61
//==================================
63
int Plugin_Init(void *params)
65
return Plugin_Register(params, &hunter_ops);
68
int Plugin_Fini(void *params)
73
void SendProbes(char *DestMAC)
78
to_send = recvpck.aligned;
79
to_send += Inet_Forge_ethernet(to_send, MyMAC, DestMAC, ETH_P_ARP);
81
if (!strcmp(Host_Dest.ip, "") )
83
for (i=1; i< number_of_hosts_in_lan; i++)
86
Inet_Forge_arp(to_send, ARPOP_REQUEST, MyMAC, MyIP, DestMAC, inet_addr(Host_In_LAN[i].ip));
87
Inet_SendRawPacket(sock, recvpck.aligned, ETH_HEADER + ARP_HEADER);
92
Inet_Forge_arp(to_send, ARPOP_REQUEST, MyMAC, MyIP, DestMAC, inet_addr(Host_Dest.ip));
93
Inet_SendRawPacket(sock, recvpck.aligned, ETH_HEADER + ARP_HEADER);
97
// =================================
99
int hunter(void *dummy)
101
int len=0, MTU, i, notrecv=1;
106
char OddMAC[6]={0xfd, 0xfd, 0x00, 0x00, 0x00, 0x00};
107
char PassMAC[6]={0xff, 0xff, 0x00, 0x00, 0x00, 0x00};
111
Plugin_Output("Scanning: ");
112
if (!strcmp(Host_Dest.ip, "") )
113
Plugin_Output("ANY\n");
115
Plugin_Output("%s\n", Host_Dest.ip);
117
sock = Inet_OpenRawSock(Options.netiface);
118
Inet_GetIfaceInfo(Options.netiface, &MTU, MyMAC, &MyIP, NULL);
119
Inet_SetNonBlock(sock);
121
recvpck.buf = Inet_Forge_packet( MTU + ALIGN_ETH_TO_WORD);
122
recvpck.aligned = recvpck.buf + ALIGN_ETH_TO_WORD;
126
Hosts=calloc(number_of_hosts_in_lan*2,sizeof(u_long));
132
len = Inet_GetRawPacket(sock, recvpck.aligned, MTU, &pkttype);
135
if ( len > 0 && pkttype == PACKET_HOST )
137
eth = (ETH_header *) recvpck.aligned;
138
if (eth->type == htons(ETH_P_ARP))
140
arp = (ARP_header *)(eth+1);
142
if ( ntohs(arp->opcode) == ARPOP_REPLY )
143
for (i=0; i<number_of_hosts_in_lan*2-1; i++)
145
if (Hosts[i]==*(u_int32 *)arp->source_ip) break;
149
Hosts[i]=*(u_int32 *)arp->source_ip;
159
} while(TIME_ELAPSED < 3);
163
Plugin_Output("\nMost probably sniffing NICs:");
169
len = Inet_GetRawPacket(sock, recvpck.aligned, MTU, &pkttype);
172
if ( len > 0 && pkttype == PACKET_HOST )
174
eth = (ETH_header *) recvpck.aligned;
175
if (eth->type == htons(ETH_P_ARP))
177
arp = (ARP_header *)(eth+1);
179
if ( ntohs(arp->opcode) == ARPOP_REPLY )
180
for (i=0; i<number_of_hosts_in_lan*2-1; i++)
182
if (Hosts[i]==*(u_int32 *)arp->source_ip) break;
188
conv.s_addr = *(u_int32 *)arp->source_ip;
189
Plugin_Output("\n- %s", inet_ntoa(conv));
200
} while(TIME_ELAPSED < 3);
203
Plugin_Output("\n- NONE \n");
207
Plugin_Output("\nLess probably sniffing NICs:");
210
Plugin_Output("\n- NONE");
214
for (i=0; Hosts[i]; i++)
216
conv.s_addr = Hosts[i];
217
Plugin_Output("\n- %s", inet_ntoa(conv));
222
Inet_Forge_packet_destroy( recvpck.buf );