diff --git a/Makefile b/Makefile index 925bd21..5cc3a8e 100644 --- a/Makefile +++ b/Makefile @@ -6,7 +6,7 @@ # By: lumenthi +#+ +:+ +#+ # # +#+#+#+#+#+ +#+ # # Created: 2017/12/22 14:06:43 by lumenthi #+# #+# # -# Updated: 2022/12/08 10:17:43 by lumenthi ### ########.fr # +# Updated: 2022/12/08 16:19:58 by lumenthi ### ########.fr # # # # **************************************************************************** # @@ -63,7 +63,6 @@ SRCS = main.c \ proxy.c \ interface.c \ malcolm.c \ - resolve_hostname.c \ analysis.c SOURCES = $(addprefix $(SRCDIR)/, $(SRCS)) diff --git a/headers/malcolm.h b/headers/malcolm.h index 4b86110..5794e21 100644 --- a/headers/malcolm.h +++ b/headers/malcolm.h @@ -142,7 +142,4 @@ int ft_proxy(uint8_t *source_ip, uint8_t *target_ip); /* analysis.c */ int launch_thread(pthread_t *thread); -/* resolve_hostname.c */ -int resolve_hostname(char *hostname, uint8_t *dest_ip); - #endif diff --git a/notes/arpspoof.txt b/notes/arpspoof.txt deleted file mode 100644 index 61d1ecd..0000000 --- a/notes/arpspoof.txt +++ /dev/null @@ -1,222 +0,0 @@ -execve("/usr/sbin/arpspoof", ["arpspoof", "-t", "172.17.0.3", "172.17.0.2", "-i", "docker0"], 0x7ffc027b9e58 /* 16 vars */) = 0 -brk(NULL) = 0x5593a9fbf000 -access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory) -openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3 -fstat(3, {st_mode=S_IFREG|0644, st_size=119023, ...}) = 0 -mmap(NULL, 119023, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7faea8431000 -close(3) = 0 -openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libpcap.so.0.8", O_RDONLY|O_CLOEXEC) = 3 -read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320h\0\0\0\0\0\0"..., 832) = 832 -fstat(3, {st_mode=S_IFREG|0644, st_size=310712, ...}) = 0 -mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7faea842f000 -mmap(NULL, 313376, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7faea83e2000 -mmap(0x7faea83e8000, 163840, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x6000) = 0x7faea83e8000 -mmap(0x7faea8410000, 114688, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2e000) = 0x7faea8410000 -mmap(0x7faea842c000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x49000) = 0x7faea842c000 -close(3) = 0 -openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libnet.so.1", O_RDONLY|O_CLOEXEC) = 3 -read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20@\0\0\0\0\0\0"..., 832) = 832 -fstat(3, {st_mode=S_IFREG|0644, st_size=96904, ...}) = 0 -mmap(NULL, 2201528, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7faea81c8000 -mprotect(0x7faea81df000, 2093056, PROT_NONE) = 0 -mmap(0x7faea83de000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x16000) = 0x7faea83de000 -mmap(0x7faea83e0000, 6072, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7faea83e0000 -close(3) = 0 -openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3 -read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@>\2\0\0\0\0\0"..., 832) = 832 -fstat(3, {st_mode=S_IFREG|0755, st_size=1905632, ...}) = 0 -mmap(NULL, 1918592, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7faea7ff3000 -mmap(0x7faea8015000, 1417216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x22000) = 0x7faea8015000 -mmap(0x7faea816f000, 323584, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x17c000) = 0x7faea816f000 -mmap(0x7faea81be000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1ca000) = 0x7faea81be000 -mmap(0x7faea81c4000, 13952, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7faea81c4000 -close(3) = 0 -openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libdbus-1.so.3", O_RDONLY|O_CLOEXEC) = 3 -read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\355\0\0\0\0\0\0"..., 832) = 832 -fstat(3, {st_mode=S_IFREG|0644, st_size=342168, ...}) = 0 -mmap(NULL, 344784, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7faea7f9e000 -mmap(0x7faea7fab000, 196608, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xd000) = 0x7faea7fab000 -mmap(0x7faea7fdb000, 86016, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3d000) = 0x7faea7fdb000 -mmap(0x7faea7ff0000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x51000) = 0x7faea7ff0000 -close(3) = 0 -openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libpthread.so.0", O_RDONLY|O_CLOEXEC) = 3 -read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 l\0\0\0\0\0\0"..., 832) = 832 -fstat(3, {st_mode=S_IFREG|0755, st_size=149520, ...}) = 0 -mmap(NULL, 136304, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7faea7f7c000 -mmap(0x7faea7f82000, 65536, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x6000) = 0x7faea7f82000 -mmap(0x7faea7f92000, 24576, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x16000) = 0x7faea7f92000 -mmap(0x7faea7f98000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1b000) = 0x7faea7f98000 -mmap(0x7faea7f9a000, 13424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7faea7f9a000 -close(3) = 0 -openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libsystemd.so.0", O_RDONLY|O_CLOEXEC) = 3 -read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240:\1\0\0\0\0\0"..., 832) = 832 -fstat(3, {st_mode=S_IFREG|0644, st_size=733976, ...}) = 0 -mmap(NULL, 738576, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7faea7ec7000 -mmap(0x7faea7ed9000, 491520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x12000) = 0x7faea7ed9000 -mmap(0x7faea7f51000, 151552, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x8a000) = 0x7faea7f51000 -mmap(0x7faea7f76000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xae000) = 0x7faea7f76000 -mmap(0x7faea7f7b000, 1296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7faea7f7b000 -close(3) = 0 -openat(AT_FDCWD, "/lib/x86_64-linux-gnu/librt.so.1", O_RDONLY|O_CLOEXEC) = 3 -read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\260#\0\0\0\0\0\0"..., 832) = 832 -fstat(3, {st_mode=S_IFREG|0644, st_size=35808, ...}) = 0 -mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7faea7ec5000 -mmap(NULL, 39904, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7faea7ebb000 -mmap(0x7faea7ebd000, 16384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x7faea7ebd000 -mmap(0x7faea7ec1000, 8192, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x6000) = 0x7faea7ec1000 -mmap(0x7faea7ec3000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x7000) = 0x7faea7ec3000 -close(3) = 0 -openat(AT_FDCWD, "/lib/x86_64-linux-gnu/liblzma.so.5", O_RDONLY|O_CLOEXEC) = 3 -read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0205\0\0\0\0\0\0"..., 832) = 832 -fstat(3, {st_mode=S_IFREG|0644, st_size=158400, ...}) = 0 -mmap(NULL, 160400, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7faea7e93000 -mmap(0x7faea7e96000, 98304, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3000) = 0x7faea7e96000 -mmap(0x7faea7eae000, 45056, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1b000) = 0x7faea7eae000 -mmap(0x7faea7eb9000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x25000) = 0x7faea7eb9000 -close(3) = 0 -openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libzstd.so.1", O_RDONLY|O_CLOEXEC) = 3 -read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\305\0\0\0\0\0\0"..., 832) = 832 -fstat(3, {st_mode=S_IFREG|0644, st_size=890800, ...}) = 0 -mmap(NULL, 892984, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7faea7db8000 -mprotect(0x7faea7dc3000, 843776, PROT_NONE) = 0 -mmap(0x7faea7dc3000, 765952, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xb000) = 0x7faea7dc3000 -mmap(0x7faea7e7e000, 73728, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xc6000) = 0x7faea7e7e000 -mmap(0x7faea7e91000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xd8000) = 0x7faea7e91000 -close(3) = 0 -openat(AT_FDCWD, "/lib/x86_64-linux-gnu/liblz4.so.1", O_RDONLY|O_CLOEXEC) = 3 -read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\3602\0\0\0\0\0\0"..., 832) = 832 -fstat(3, {st_mode=S_IFREG|0644, st_size=137568, ...}) = 0 -mmap(NULL, 139648, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7faea7d95000 -mmap(0x7faea7d98000, 110592, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3000) = 0x7faea7d98000 -mmap(0x7faea7db3000, 12288, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1e000) = 0x7faea7db3000 -mmap(0x7faea7db6000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x20000) = 0x7faea7db6000 -close(3) = 0 -openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libgcrypt.so.20", O_RDONLY|O_CLOEXEC) = 3 -read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\200\305\0\0\0\0\0\0"..., 832) = 832 -fstat(3, {st_mode=S_IFREG|0644, st_size=1176248, ...}) = 0 -mmap(NULL, 1179576, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7faea7c75000 -mmap(0x7faea7c81000, 851968, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xc000) = 0x7faea7c81000 -mmap(0x7faea7d51000, 249856, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xdc000) = 0x7faea7d51000 -mmap(0x7faea7d8e000, 28672, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x118000) = 0x7faea7d8e000 -close(3) = 0 -openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libgpg-error.so.0", O_RDONLY|O_CLOEXEC) = 3 -read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240F\0\0\0\0\0\0"..., 832) = 832 -fstat(3, {st_mode=S_IFREG|0644, st_size=149576, ...}) = 0 -mmap(NULL, 152016, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7faea7c4f000 -mprotect(0x7faea7c53000, 131072, PROT_NONE) = 0 -mmap(0x7faea7c53000, 86016, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x4000) = 0x7faea7c53000 -mmap(0x7faea7c68000, 40960, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x19000) = 0x7faea7c68000 -mmap(0x7faea7c73000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x23000) = 0x7faea7c73000 -close(3) = 0 -mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7faea7c4d000 -mmap(NULL, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7faea7c4a000 -arch_prctl(ARCH_SET_FS, 0x7faea7c4a7c0) = 0 -mprotect(0x7faea81be000, 16384, PROT_READ) = 0 -mprotect(0x7faea7c73000, 4096, PROT_READ) = 0 -mprotect(0x7faea7d8e000, 8192, PROT_READ) = 0 -mprotect(0x7faea7db6000, 4096, PROT_READ) = 0 -mprotect(0x7faea7e91000, 4096, PROT_READ) = 0 -mprotect(0x7faea7f98000, 4096, PROT_READ) = 0 -mprotect(0x7faea7eb9000, 4096, PROT_READ) = 0 -mprotect(0x7faea7ec3000, 4096, PROT_READ) = 0 -mprotect(0x7faea7f76000, 16384, PROT_READ) = 0 -mprotect(0x7faea7ff0000, 8192, PROT_READ) = 0 -mprotect(0x7faea83de000, 4096, PROT_READ) = 0 -mprotect(0x7faea842c000, 8192, PROT_READ) = 0 -mprotect(0x5593a83b8000, 4096, PROT_READ) = 0 -mprotect(0x7faea8479000, 4096, PROT_READ) = 0 -munmap(0x7faea8431000, 119023) = 0 -set_tid_address(0x7faea7c4aa90) = 16517 -set_robust_list(0x7faea7c4aaa0, 24) = 0 -rt_sigaction(SIGRTMIN, {sa_handler=0x7faea7f82690, sa_mask=[], sa_flags=SA_RESTORER|SA_SIGINFO, sa_restorer=0x7faea7f8f140}, NULL, 8) = 0 -rt_sigaction(SIGRT_1, {sa_handler=0x7faea7f82730, sa_mask=[], sa_flags=SA_RESTORER|SA_RESTART|SA_SIGINFO, sa_restorer=0x7faea7f8f140}, NULL, 8) = 0 -rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 -prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 -brk(NULL) = 0x5593a9fbf000 -brk(0x5593a9fe0000) = 0x5593a9fe0000 -socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 3 -openat(AT_FDCWD, "/proc/net/dev", O_RDONLY) = 4 -ioctl(3, SIOCGIFCONF, {ifc_len=512 * sizeof(struct ifreq) => 4 * sizeof(struct ifreq), ifc_buf=[{ifr_name="lo", ifr_addr={sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("127.0.0.1")}}, {ifr_name="enp0s8", ifr_addr={sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("10.0.3.15")}}, {ifr_name="br-658c7f9171b3", ifr_addr={sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("172.19.0.1")}}, {ifr_name="docker0", ifr_addr={sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("172.17.0.1")}}]}) = 0 -fstat(4, {st_mode=S_IFREG|0444, st_size=0, ...}) = 0 -read(4, "Inter-| Receive "..., 1024) = 1024 -ioctl(3, SIOCGIFFLAGS, {ifr_name="lo", ifr_flags=IFF_UP|IFF_LOOPBACK|IFF_RUNNING}) = 0 -ioctl(3, SIOCGIFFLAGS, {ifr_name="enp0s3", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_RUNNING|IFF_MULTICAST}) = 0 -ioctl(3, SIOCGIFADDR, {ifr_name="enp0s3"}) = -1 EADDRNOTAVAIL (Cannot assign requested address) -ioctl(3, SIOCGIFFLAGS, {ifr_name="enp0s8", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_RUNNING|IFF_MULTICAST}) = 0 -ioctl(3, SIOCGIFADDR, {ifr_name="enp0s8", ifr_addr={sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("10.0.3.15")}}) = 0 -ioctl(3, SIOCGIFFLAGS, {ifr_name="br-658c7f9171b3", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_RUNNING|IFF_MULTICAST}) = 0 -ioctl(3, SIOCGIFADDR, {ifr_name="br-658c7f9171b3", ifr_addr={sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("172.19.0.1")}}) = 0 -ioctl(3, SIOCGIFFLAGS, {ifr_name="docker0", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_RUNNING|IFF_MULTICAST}) = 0 -ioctl(3, SIOCGIFADDR, {ifr_name="docker0", ifr_addr={sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("172.17.0.1")}}) = 0 -ioctl(3, SIOCGIFFLAGS, {ifr_name="veth7c8f9a7", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_RUNNING|IFF_MULTICAST}) = 0 -ioctl(3, SIOCGIFADDR, {ifr_name="veth7c8f9a7"}) = -1 EADDRNOTAVAIL (Cannot assign requested address) -read(4, " 16396 130 0 0 0"..., 1024) = 314 -ioctl(3, SIOCGIFFLAGS, {ifr_name="veth03f8133", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_RUNNING|IFF_MULTICAST}) = 0 -ioctl(3, SIOCGIFADDR, {ifr_name="veth03f8133"}) = -1 EADDRNOTAVAIL (Cannot assign requested address) -ioctl(3, SIOCGIFFLAGS, {ifr_name="veth39931d4", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_RUNNING|IFF_MULTICAST}) = 0 -ioctl(3, SIOCGIFADDR, {ifr_name="veth39931d4"}) = -1 EADDRNOTAVAIL (Cannot assign requested address) -ioctl(3, SIOCGIFFLAGS, {ifr_name="vethac2570c", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_RUNNING|IFF_MULTICAST}) = 0 -ioctl(3, SIOCGIFADDR, {ifr_name="vethac2570c"}) = -1 EADDRNOTAVAIL (Cannot assign requested address) -read(4, "", 1024) = 0 -close(4) = 0 -socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL)) = 4 -ioctl(4, SIOCGIFHWADDR, {ifr_name="enp0s3", ifr_hwaddr={sa_family=ARPHRD_ETHER, sa_data=08:00:27:ea:1b:2a}}) = 0 -setsockopt(4, SOL_SOCKET, SO_BROADCAST, [1], 4) = 0 -close(4) = 0 -socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 4 -ioctl(4, SIOCGIFFLAGS, {ifr_name="docker0", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_RUNNING|IFF_MULTICAST}) = 0 -close(4) = 0 -socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL)) = 4 -ioctl(4, SIOCGIFHWADDR, {ifr_name="docker0", ifr_hwaddr={sa_family=ARPHRD_ETHER, sa_data=02:42:62:6a:64:9a}}) = 0 -setsockopt(4, SOL_SOCKET, SO_BROADCAST, [1], 4) = 0 -socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 -ioctl(5, SIOCGARP, 0x7ffdc1619ea0) = -1 ENXIO (No such device or address) -close(5) = 0 -socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP) = 5 -sendto(5, NULL, 0, 0, {sa_family=AF_INET, sin_port=htons(67), sin_addr=inet_addr("172.17.0.3")}, 16) = 0 -close(5) = 0 -clock_nanosleep(CLOCK_REALTIME, 0, {tv_sec=1, tv_nsec=0}, 0x7ffdc1619ee0) = 0 -socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 -ioctl(5, SIOCGARP, 0x7ffdc1619ea0) = 0 -close(5) = 0 -socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 -ioctl(5, SIOCGIFHWADDR, {ifr_name="docker0", ifr_hwaddr={sa_family=ARPHRD_ETHER, sa_data=02:42:62:6a:64:9a}}) = 0 -close(5) = 0 -rt_sigaction(SIGHUP, {sa_handler=0x5593a83b69c0, sa_mask=[HUP], sa_flags=SA_RESTORER|SA_RESTART, sa_restorer=0x7faea802bd60}, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 -rt_sigaction(SIGINT, {sa_handler=0x5593a83b69c0, sa_mask=[INT], sa_flags=SA_RESTORER|SA_RESTART, sa_restorer=0x7faea802bd60}, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 -rt_sigaction(SIGTERM, {sa_handler=0x5593a83b69c0, sa_mask=[TERM], sa_flags=SA_RESTORER|SA_RESTART, sa_restorer=0x7faea802bd60}, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 -write(2, "2:42:62:6a:64:9a ", 172:42:62:6a:64:9a ) = 17 -write(2, "2:42:ac:11:0:3 0806 42: arp repl"..., 512:42:ac:11:0:3 0806 42: arp reply 172.17.0.2 is-at ) = 51 -write(2, "2:42:62:6a:64:9a\n", 172:42:62:6a:64:9a -) = 17 -ioctl(4, SIOCGIFINDEX, {ifr_name="docker0", }) = 0 -sendto(4, "\2B\254\21\0\3\2Bbjd\232\10\6\0\1\10\0\6\4\0\2\2Bbjd\232\254\21\0\2"..., 42, 0, {sa_family=AF_PACKET, sll_protocol=htons(ETH_P_ALL), sll_ifindex=if_nametoindex("docker0"), sll_hatype=ARPHRD_NETROM, sll_pkttype=PACKET_HOST, sll_halen=0}, 20) = 42 -clock_nanosleep(CLOCK_REALTIME, 0, {tv_sec=2, tv_nsec=0}, 0x7ffdc1619f30) = 0 -write(2, "2:42:62:6a:64:9a ", 172:42:62:6a:64:9a ) = 17 -write(2, "2:42:ac:11:0:3 0806 42: arp repl"..., 512:42:ac:11:0:3 0806 42: arp reply 172.17.0.2 is-at ) = 51 -write(2, "2:42:62:6a:64:9a\n", 172:42:62:6a:64:9a -) = 17 -ioctl(4, SIOCGIFINDEX, {ifr_name="docker0", }) = 0 -sendto(4, "\2B\254\21\0\3\2Bbjd\232\10\6\0\1\10\0\6\4\0\2\2Bbjd\232\254\21\0\2"..., 42, 0, {sa_family=AF_PACKET, sll_protocol=htons(ETH_P_ALL), sll_ifindex=if_nametoindex("docker0"), sll_hatype=ARPHRD_NETROM, sll_pkttype=PACKET_HOST, sll_halen=0}, 20) = 42 -clock_nanosleep(CLOCK_REALTIME, 0, {tv_sec=2, tv_nsec=0}, 0x7ffdc1619f30) = 0 -write(2, "2:42:62:6a:64:9a ", 172:42:62:6a:64:9a ) = 17 -write(2, "2:42:ac:11:0:3 0806 42: arp repl"..., 512:42:ac:11:0:3 0806 42: arp reply 172.17.0.2 is-at ) = 51 -write(2, "2:42:62:6a:64:9a\n", 172:42:62:6a:64:9a -) = 17 -ioctl(4, SIOCGIFINDEX, {ifr_name="docker0", }) = 0 -sendto(4, "\2B\254\21\0\3\2Bbjd\232\10\6\0\1\10\0\6\4\0\2\2Bbjd\232\254\21\0\2"..., 42, 0, {sa_family=AF_PACKET, sll_protocol=htons(ETH_P_ALL), sll_ifindex=if_nametoindex("docker0"), sll_hatype=ARPHRD_NETROM, sll_pkttype=PACKET_HOST, sll_halen=0}, 20) = 42 -clock_nanosleep(CLOCK_REALTIME, 0, {tv_sec=2, tv_nsec=0}, 0x7ffdc1619f30) = 0 -write(2, "2:42:62:6a:64:9a ", 172:42:62:6a:64:9a ) = 17 -write(2, "2:42:ac:11:0:3 0806 42: arp repl"..., 512:42:ac:11:0:3 0806 42: arp reply 172.17.0.2 is-at ) = 51 -write(2, "2:42:62:6a:64:9a\n", 172:42:62:6a:64:9a -) = 17 -ioctl(4, SIOCGIFINDEX, {ifr_name="docker0", }) = 0 -sendto(4, "\2B\254\21\0\3\2Bbjd\232\10\6\0\1\10\0\6\4\0\2\2Bbjd\232\254\21\0\2"..., 42, 0, {sa_family=AF_PACKET, sll_protocol=htons(ETH_P_ALL), sll_ifindex=if_nametoindex("docker0"), sll_hatype=ARPHRD_NETROM, sll_pkttype=PACKET_HOST, sll_halen=0}, 20) = 42 -clock_nanosleep(CLOCK_REALTIME, 0, {tv_sec=2, tv_nsec=0}, 0x7ffdc1619f30) = 0 -write(2, "2:42:62:6a:64:9a ", 172:42:62:6a:64:9a ) = 17 -write(2, "2:42:ac:11:0:3 0806 42: arp repl"..., 512:42:ac:11:0:3 0806 42: arp reply 172.17.0.2 is-at ) = 51 -write(2, "2:42:62:6a:64:9a\n", 172:42:62:6a:64:9a -) = 17 -ioctl(4, SIOCGIFINDEX, {ifr_name="docker0", }) = 0 -sendto(4, "\2B\254\21\0\3\2Bbjd\232\10\6\0\1\10\0\6\4\0\2\2Bbjd\232\254\21\0\2"..., 42, 0, {sa_family=AF_PACKET, sll_protocol=htons(ETH_P_ALL), sll_ifindex=if_nametoindex("docker0"), sll_hatype=ARPHRD_NETROM, sll_pkttype=PACKET_HOST, sll_halen=0}, 20) = 42 -clock_nanosleep(CLOCK_REALTIME, 0, {tv_sec=2, tv_nsec=0}, {tv_sec=1, tv_nsec=95011482}) = ? ERESTART_RESTARTBLOCK (Interrupted by signal) diff --git a/notes/notes.txt b/notes/notes.txt index 987d223..a405177 100644 --- a/notes/notes.txt +++ b/notes/notes.txt @@ -50,31 +50,23 @@ apt-get install tcpdump iputils-ping iproute2 net-tools arping curl wget zsh git sh -c "$(curl -fsSL https://raw.github.com/ohmyzsh/ohmyzsh/master/tools/install.sh)" - # ==== TODO ==== -- LNICOSIA ASCII MENU - NUMERIC OPTION ONCE DEFENSE DONE # ==== BONUSES ==== - Persistency - Frequency - Duration -- Proxy +- Passive forwarding +- Restore after spoof - Verbose - Help menu -- Hostname resolution -- Auto ARP resolution for proxy mode +- Auto ARP resolution for default mode - Interface selection - Awesome rotative insane art menu created by insane devs -- Awesome packet printing +- Sniffing activity in another thread # ==== IDEAS ==== (After validation) -- Proxy mode by default -- Spoof the whole network on broadcast -b --broadcast - - sudo ./ft_malcolm [source IP] -i [interface] --broadcast - - This command redirect all the traffic for the whole network to [source IP] on our machine - - -d --deny Service denial ? redirect all the packets to a dummy mac address -- -m --manual: Subject's behavior with persistency mode activated +- Finish active proxy - Packet analysis in another thread ? - WIFI support -- Restore for manual persistent mode ? -- Update version and help menu once done diff --git a/sources/parse_option_line.c b/sources/parse_option_line.c index 94d5a8b..58b68c2 100644 --- a/sources/parse_option_line.c +++ b/sources/parse_option_line.c @@ -34,35 +34,17 @@ static int ft_atom(char *str, uint8_t *dest) return 0; } -static int is_fqdn(char *address) -{ - int i = 0; - while (address[i]) { - if (!ft_isdigit(address[i]) && address[i] != '.') - return 1; - i++; - } - return 0; -} - static int parse_mac(int *arg_count, char *arg) { switch (*arg_count) { case 0: { - if (is_fqdn(arg)) { - g_data.source_hostname = arg; - if (resolve_hostname(arg, g_data.source_ip)) - return 1; - } - else { - in_addr_t ip = inet_addr(arg); - uint8_t *ptr = (uint8_t*)&ip; - g_data.source_ip[0] = ptr[0]; - g_data.source_ip[1] = ptr[1]; - g_data.source_ip[2] = ptr[2]; - g_data.source_ip[3] = ptr[3]; - } + in_addr_t ip = inet_addr(arg); + uint8_t *ptr = (uint8_t*)&ip; + g_data.source_ip[0] = ptr[0]; + g_data.source_ip[1] = ptr[1]; + g_data.source_ip[2] = ptr[2]; + g_data.source_ip[3] = ptr[3]; (*arg_count)++; break; } @@ -75,19 +57,12 @@ static int parse_mac(int *arg_count, char *arg) } case 2: { - if (is_fqdn(arg)) { - g_data.target_hostname = arg; - if (resolve_hostname(arg, g_data.target_ip)) - return 1; - } - else { - in_addr_t ip = inet_addr(arg); - uint8_t *ptr = (uint8_t*)&ip; - g_data.target_ip[0] = ptr[0]; - g_data.target_ip[1] = ptr[1]; - g_data.target_ip[2] = ptr[2]; - g_data.target_ip[3] = ptr[3]; - } + in_addr_t ip = inet_addr(arg); + uint8_t *ptr = (uint8_t*)&ip; + g_data.target_ip[0] = ptr[0]; + g_data.target_ip[1] = ptr[1]; + g_data.target_ip[2] = ptr[2]; + g_data.target_ip[3] = ptr[3]; (*arg_count)++; break; } @@ -110,18 +85,12 @@ static int parse_proxy(int *arg_count, char *arg) switch (*arg_count) { case 0: { - if (is_fqdn(arg)) { - g_data.source_hostname = arg; - resolve_hostname(arg, g_data.source_ip); - } - else { - in_addr_t ip = inet_addr(arg); - uint8_t *ptr = (uint8_t*)&ip; - g_data.source_ip[0] = ptr[0]; - g_data.source_ip[1] = ptr[1]; - g_data.source_ip[2] = ptr[2]; - g_data.source_ip[3] = ptr[3]; - } + in_addr_t ip = inet_addr(arg); + uint8_t *ptr = (uint8_t*)&ip; + g_data.source_ip[0] = ptr[0]; + g_data.source_ip[1] = ptr[1]; + g_data.source_ip[2] = ptr[2]; + g_data.source_ip[3] = ptr[3]; (*arg_count)++; break; } @@ -132,18 +101,12 @@ static int parse_proxy(int *arg_count, char *arg) (*arg_count)++; break; } - if (is_fqdn(arg)) { - g_data.target_hostname = arg; - resolve_hostname(arg, g_data.target_ip); - } - else { - in_addr_t ip = inet_addr(arg); - uint8_t *ptr = (uint8_t*)&ip; - g_data.target_ip[0] = ptr[0]; - g_data.target_ip[1] = ptr[1]; - g_data.target_ip[2] = ptr[2]; - g_data.target_ip[3] = ptr[3]; - } + in_addr_t ip = inet_addr(arg); + uint8_t *ptr = (uint8_t*)&ip; + g_data.target_ip[0] = ptr[0]; + g_data.target_ip[1] = ptr[1]; + g_data.target_ip[2] = ptr[2]; + g_data.target_ip[3] = ptr[3]; (*arg_count)++; break; } diff --git a/sources/resolve_hostname.c b/sources/resolve_hostname.c deleted file mode 100644 index 445d5c7..0000000 --- a/sources/resolve_hostname.c +++ /dev/null @@ -1,39 +0,0 @@ -#include "libft.h" -#include "malcolm.h" -#include -#include -#include -#include -#include -#include - -int resolve_hostname(char *hostname, uint8_t *dest_ip) -{ - int ret; - - struct addrinfo *ai; - struct addrinfo hints; - ft_bzero(&hints, sizeof(hints)); - ai = NULL; - hints.ai_family = AF_INET; - hints.ai_socktype = SOCK_RAW; - hints.ai_flags = AI_CANONNAME; - if ((ret = getaddrinfo(hostname, NULL, &hints, &ai))) - return 1; - struct addrinfo *tmp = ai; - while (tmp) - { - if (tmp->ai_family == AF_INET) - { - struct sockaddr_in *ip4 = (struct sockaddr_in*)tmp->ai_addr; - ft_memcpy(dest_ip, &ip4->sin_addr, sizeof(ip4->sin_addr)); - break; - } - else if (tmp->ai_family == AF_INET6) - { - } - tmp = tmp->ai_next; - } - freeaddrinfo(ai); - return 0; -}