Python l2.LLC屬性代碼示例

# 需要導入模塊: from scapy.layers import l2 [as 別名]
# 或者: from scapy.layers.l2 import LLC [as 別名]
def enBuilder(self, pkt, stream, iVal):

        ## Remove the LLC layer
        del pkt[LLC]

        ## Add the Dot11WEP layer
        encodedPacket = pkt/Dot11WEP(iv = iVal, keyid = 0, wepdata = stream)

        ## Flip FCField bits accordingly
        if encodedPacket[Dot11].FCfield == 1:
            encodedPacket[Dot11].FCfield = 65
        elif encodedPacket[Dot11].FCfield == 2:
            encodedPacket[Dot11].FCfield = 66

        ## Add the ICV
        #encodedPacket[Dot11WEP].icv = int(self.pt.endSwap(hex(crc32(str(encodedPacket[Dot11])[0:-4]) & 0xffffffff)), 16)
        encodedPacket[Dot11WEP].icv = int(self.pt.fcsGen(encodedPacket[Dot11], end = -4), 16)
        return encodedPacket 

# 需要導入模塊: from scapy.layers import l2 [as 別名]
# 或者: from scapy.layers.l2 import LLC [as 別名]
def deal_common_pkt(self, pkt):
        # Send to DHCP server
        # LLC / SNAP to Ether
        if SNAP in pkt:
            ether_pkt = Ether(src=self.client, dst=self.mac) / pkt[SNAP].payload  # noqa: E501
            self.dhcp_server.reply(ether_pkt)

        # If an ARP request is made, extract client IP and answer
        if ARP in pkt and \
           pkt[ARP].op == 1 and pkt[ARP].pdst == self.dhcp_server.gw:
            if self.arp_target_ip is None:
                self.arp_target_ip = pkt[ARP].psrc
                log_runtime.info("Detected IP: %s", self.arp_target_ip)

            # Reply
            ARP_ans = LLC() / SNAP() / ARP(
                op="is-at",
                psrc=self.arp_source_ip,
                pdst=self.arp_target_ip,
                hwsrc=self.mac,
                hwdst=self.client,
            )
            self.send_wpa_to_client(ARP_ans)

    # States 

# 需要導入模塊: from scapy.layers import l2 [as 別名]
# 或者: from scapy.layers.l2 import LLC [as 別名]
def send_wpa_handshake_1(self):

        self.anonce = self.gen_nonce(32)

        rep = RadioTap()
        rep /= Dot11(
            addr1=self.client,
            addr2=self.mac,
            addr3=self.mac,
            FCfield='from-DS',
            SC=(next(self.seq_num) << 4),
        )
        rep /= LLC(dsap=0xaa, ssap=0xaa, ctrl=3)
        rep /= SNAP(OUI=0, code=0x888e)  # 802.1X Authentication
        rep /= self.build_EAPOL_Key_8021X2004(
            key_information=0x89,
            replay_counter=next(self.replay_counter),
            nonce=self.anonce,
        )

        self.send(rep) 

# 需要導入模塊: from scapy.layers import l2 [as 別名]
# 或者: from scapy.layers.l2 import LLC [as 別名]
def send_renew_gtk(self):

        rep_to_enc = LLC(dsap=0xaa, ssap=0xaa, ctrl=3)
        rep_to_enc /= SNAP(OUI=0, code=0x888e)  # 802.1X Authentication

        data = self.build_GTK_KDE()

        eap = self.build_EAPOL_Key_8021X2004(
            # Key information 0x1381:
            #   ARC4 HMAC-MD5, Group Key, KEY ACK, KEY MIC, Secure, Encrypted,
            #   SMK
            key_information=0x1381,
            replay_counter=next(self.replay_counter),
            nonce=self.anonce,
            data=data,
            key_mic=self.kck,
            key_data_encrypt=self.kek,
        )

        rep_to_enc /= eap
        self.send_wpa_to_client(rep_to_enc) 

# 需要導入模塊: from scapy.layers import l2 [as 別名]
# 或者: from scapy.layers.l2 import LLC [as 別名]
def negotiate_trunk(iface=conf.iface, mymac=str(RandMAC())):
    print "Trying to negotiate a trunk on interface %s" % iface
    p = Dot3(src=mymac, dst="01:00:0c:cc:cc:cc")/LLC()/SNAP()/DTP(tlvlist=[DTPDomain(),DTPStatus(),DTPType(),DTPNeighbor(neighbor=mymac)])
    sendp(p) 

# 需要導入模塊: from scapy.layers import l2 [as 別名]
# 或者: from scapy.layers.l2 import LLC [as 別名]
def wepEncrypt(pkt, keyText, iVal = '\xba0\x0e'):
    """Encompasses the steps needed to encrypt a WEP packet
    iVal represents a known good IV for default usage
    """

    ## Encode the LLC layer via rc4
    stream = wepCrypto.encoder(pkt, iVal, keyText)

    ## Return the encrypted packet
    return wepCrypto.enBuilder(pkt, stream, iVal) 

# 需要導入模塊: from scapy.layers import l2 [as 別名]
# 或者: from scapy.layers.l2 import LLC [as 別名]
def wpaEncrypt(encKey, origPkt, decodedPkt, PN, genFCS = True):
    """Encompasses the steps needed to encrypt a WPA packet
    No structure for TKIP has been done as of yet
    """

    ## Increment the PN positively per IEEE spec
    PN[5] += 1

    ## Grab the payload of the decoded packet
    dEverything = decodedPkt[LLC]

    ## Remove the FCS from the original packet
    newPkt = RadioTap((pt.byteRip(origPkt.copy(),
                                  chop = True,
                                  order = 'last',
                                  output = 'str',
                                  qty = 4)))
    del newPkt[Dot11WEP]

    ## The data is ready for encryption
    newPkt = newPkt/dEverything
    encodedPkt = ccmpCrypto.encryptCCMP(newPkt, encKey, PN, genFCS)

    ## Flip FCField bits accordingly
    if encodedPkt[Dot11].FCfield == 1:
        encodedPkt[Dot11].FCfield = 65
    elif encodedPkt[Dot11].FCfield == 2:
        encodedPkt[Dot11].FCfield = 66

    return encodedPkt

### Instantiations 

# 需要導入模塊: from scapy.layers import l2 [as 別名]
# 或者: from scapy.layers.l2 import LLC [as 別名]
def deBuilder(self, packet, stream, genFCS):
        """Take the pkt object and apply stream to [LLC]"""

        ## Remove the FCS from the old packet body
        postPkt = RadioTap(self.pt.byteRip(packet.copy(),
                                           chop = True,
                                           order = 'last',
                                           output = 'str',
                                           qty = 4))

        ## Remove RadioTap() info if required
        if genFCS is False:
            postPkt = RadioTap()/postPkt[RadioTap].payload

        ## Rip off the Dot11WEP layer
        del postPkt[Dot11WEP]

        ## Add the stream to LLC
        decodedPkt = postPkt/LLC(str(stream))

        ## Flip FCField bits accordingly
        if decodedPkt[Dot11].FCfield == 65:
            decodedPkt[Dot11].FCfield = 1
        elif decodedPkt[Dot11].FCfield == 66:
            decodedPkt[Dot11].FCfield = 2

        ## Return the decoded packet with or without FCS
        if genFCS is False:
            return decodedPkt
        else:
            return decodedPkt/Padding(load = binascii.unhexlify(self.pt.endSwap(hex(crc32(str(decodedPkt[Dot11])) & 0xffffffff)).replace('0x', ''))) 

# 需要導入模塊: from scapy.layers import l2 [as 別名]
# 或者: from scapy.layers.l2 import LLC [as 別名]
def decoder(self, pkt, keyText):
        """Take a packet with [Dot11WEP] and apply RC4 to get the [LLC]"""
        ## Re-use the IV for comparative purposes
        # <class 'bytes'>
        # b'z\x00\x00\x124Vx\x90'
        # print('DECODING')
        # print([pkt[Dot11WEP].iv])
        # print(str([pkt[Dot11WEP].iv]))
        # print(type(pkt[Dot11WEP].iv))
        iVal = pkt[Dot11WEP].iv
        # print(iVal)
        # print(keyText)
        seed = self.seedGen(iVal, keyText)

        ## Remove the FCS so that we maintain packet size
        pload = self.pt.byteRip(pkt[Dot11WEP],
                                order = 'last',
                                qty = 4,
                                chop = True,
                                output = 'str')

        ## Return the stream, iv and seed
        # print('\n\n\n')
        # print(type(pload))
        # print('\n')
        # print(pload)
        # print('\n\n\n')
        # print(type(seed))
        # print(seed)
        return rc4(Dot11WEP(pload).wepdata, seed), iVal, seed 

# 需要導入模塊: from scapy.layers import l2 [as 別名]
# 或者: from scapy.layers.l2 import LLC [as 別名]
def deBuilder(self, packet, stream, genFCS):
        """Return the decrypted packet"""

        ## Remove the FCS from the old packet body
        postPkt = RadioTap(self.pt.byteRip(packet.copy(),
                                           chop = True,
                                           order = 'last',
                                           output = 'str',
                                           qty = 4))

        ## Remove RadioTap() info if required
        if genFCS is False:
            postPkt = RadioTap()/postPkt[RadioTap].payload

        ## Rip off the Dot11WEP layer
        del postPkt[Dot11WEP]

        ## Add the stream to LLC
        decodedPkt = postPkt/LLC(str(stream))

        ## Flip FCField bits accordingly
        if decodedPkt[Dot11].FCfield == 65:
            decodedPkt[Dot11].FCfield = 1
        elif decodedPkt[Dot11].FCfield == 66:
            decodedPkt[Dot11].FCfield = 2

        ## Return the decoded packet with or without FCS
        if genFCS is False:
            return decodedPkt
        else:
            return decodedPkt/Padding(load = binascii.unhexlify(self.pt.endSwap(hex(crc32(str(decodedPkt[Dot11])) & 0xffffffff)).replace('0x', ''))) 

# 需要導入模塊: from scapy.layers import l2 [as 別名]
# 或者: from scapy.layers.l2 import LLC [as 別名]
def send_ether_over_wpa(self, pkt, **kwargs):
        """Send an Ethernet packet using the WPA channel
        Extra arguments will be ignored, and are just left for compatibility
        """

        payload = LLC() / SNAP() / pkt[Ether].payload
        dest = pkt.dst
        if dest == "ff:ff:ff:ff:ff:ff":
            self.send_wpa_to_group(payload, dest)
        else:
            assert dest == self.client
            self.send_wpa_to_client(payload) 

# 需要導入模塊: from scapy.layers import l2 [as 別名]
# 或者: from scapy.layers.l2 import LLC [as 別名]
def send_wpa_handshake_3(self, pkt):

        # Both nonce have been exchanged, install keys
        client_nonce = pkt[EAPOL].load[13:13 + 0x20]
        self.install_unicast_keys(client_nonce)

        # Check client MIC

        # Data: full message with MIC place replaced by 0s
        # https://stackoverflow.com/questions/15133797/creating-wpa-message-integrity-code-mic-with-python
        client_mic = pkt[EAPOL].load[77:77 + 16]
        client_data = raw(pkt[EAPOL]).replace(client_mic, b"\x00" * len(client_mic))  # noqa: E501
        assert hmac.new(self.kck, client_data, hashlib.md5).digest() == client_mic  # noqa: E501

        rep = RadioTap()
        rep /= Dot11(
            addr1=self.client,
            addr2=self.mac,
            addr3=self.mac,
            FCfield='from-DS',
            SC=(next(self.seq_num) << 4),
        )

        rep /= LLC(dsap=0xaa, ssap=0xaa, ctrl=3)
        rep /= SNAP(OUI=0, code=0x888e)  # 802.1X Authentication

        self.install_GTK()
        data = self.RSN
        data += self.build_GTK_KDE()

        eap = self.build_EAPOL_Key_8021X2004(
            key_information=0x13c9,
            replay_counter=next(self.replay_counter),
            nonce=self.anonce,
            data=data,
            key_mic=self.kck,
            key_data_encrypt=self.kek,
        )

        self.send(rep / eap) 

# 需要導入模塊: from scapy.layers import l2 [as 別名]
# 或者: from scapy.layers.l2 import LLC [as 別名]
def get_gtk_2(self, pkt):
        # Avoid packet from other interfaces
        if RadioTap not in pkt:
            return

        # Skip retries
        if pkt[Dot11].FCfield.retry:
            return

        # Skip unencrypted frames (TKIP rely on encrypted packets)
        if not pkt[Dot11].FCfield.protected:
            return

        # Normal decoding
        try:
            data = parse_data_pkt(pkt, self.tk)
        except ValueError:
            return
        try:
            data_clear = check_MIC_ICV(data, self.mic_sta_to_ap, pkt.addr2,
                                       pkt.addr3)
        except (ICVError, MICError):
            return

        pkt_clear = LLC(data_clear)
        if EAPOL in pkt_clear and pkt.addr1 == pkt.addr3 == self.mac and \
           pkt_clear[EAPOL].load[1:3] == b"\x03\x01":
            raise self.WAIT_ARP_REPLIES() 

# 需要導入模塊: from scapy.layers import l2 [as 別名]
# 或者: from scapy.layers.l2 import LLC [as 別名]
def send_arp_req(self):

        if self.krack_state & 4 == 0:
            # Set the address for future uses
            self.arp_target_ip = self.dhcp_server.leases.get(self.client,
                                                             self.arp_target_ip)  # noqa: E501
            assert self.arp_target_ip is not None

            # Send the first ARP requests, for control test
            log_runtime.info("Send ARP who-was from '%s' to '%s'",
                             self.arp_source_ip,
                             self.arp_target_ip)
            arp_pkt = self.send_wpa_to_group(
                LLC() / SNAP() / ARP(op="who-has",
                                     psrc=self.arp_source_ip,
                                     pdst=self.arp_target_ip,
                                     hwsrc=self.mac),
                dest='ff:ff:ff:ff:ff:ff',
            )
            self.arp_sent.append(arp_pkt)
        else:
            if self.arp_to_send < len(self.arp_sent):
                # Re-send the ARP requests already sent
                self.send(self.arp_sent[self.arp_to_send])
                self.arp_to_send += 1
            else:
                # Re-send GTK
                self.arp_to_send = 0
                self.arp_retry += 1
                log_runtime.info("Trying to trigger CVE-2017-13080 %d/%d",
                                 self.arp_retry, self.ARP_MAX_RETRY)
                if self.arp_retry > self.ARP_MAX_RETRY:
                    # We retries 100 times to send GTK, then already sent ARPs
                    log_runtime.warning("Client is likely not vulnerable to "
                                        "CVE-2017-13080")
                    raise self.EXIT()

                raise self.RENEW_GTK() 

# 需要導入模塊: from scapy.layers import l2 [as 別名]
# 或者: from scapy.layers.l2 import LLC [as 別名]
def check_arp_reply(self, pkt):
        data = parse_data_pkt(pkt, self.tk)
        try:
            data_clear = check_MIC_ICV(data, self.mic_sta_to_ap, pkt.addr2,
                                       pkt.addr3)
        except (ICVError, MICError):
            return

        decoded_pkt = LLC(data_clear)
        log_runtime.debug(hexdump(decoded_pkt, dump=True))
        log_runtime.debug(repr(decoded_pkt))
        self.deal_common_pkt(decoded_pkt)
        if ARP not in decoded_pkt:
            return

        # ARP.op 2: is-at
        if decoded_pkt[ARP].op == 2 and \
           decoded_pkt[ARP].psrc == self.arp_target_ip and \
           decoded_pkt[ARP].pdst == self.arp_source_ip:
            # Got the expected ARP
            if self.krack_state & 4 == 0:
                # First time, normal behavior
                log_runtime.info("Got ARP reply, this is normal")
                self.krack_state |= 4
                log_runtime.info("Trying to trigger CVE-2017-13080")
                raise self.RENEW_GTK()
            else:
                # Second time, the packet has been accepted twice!
                log_runtime.warning("Broadcast packet accepted twice!! "
                                    "(CVE-2017-13080)")