Raspberry Piで Amazon Dash Buttonを自在にハックする方法。tcpdump libpcap方法
|
|
|
|
Raspberry Piで Amazon Dash Buttonを自在にハックする方法。tcpdump libpcap方法 
 ウィルキンソン Dash Button ASIN: B01L2WQ27O |
 フルグラ Dash Button ASIN: B01L2WPA0O |
 ラックス (Lux) Dash Button ASIN: B01L2WOR1C |
 毎日一杯の青汁 Dash Button ASIN: B01L2WP6AI |
#include <stdio.h>
#include <pcap.h>
int main(int argc, char *argv[])
{
char *dev, errbuf[PCAP_ERRBUF_SIZE];
dev = pcap_lookupdev(errbuf);
if (dev == NULL) {
fprintf(stderr, "Couldn't find default device: %s\n", errbuf);
return(2);
}
printf("Device: %s\n", dev);
return(0);
}
#include <stdio.h>
#include <pcap.h>
int main(int argc, char *argv[])
{
char *dev, errbuf[PCAP_ERRBUF_SIZE];
dev = pcap_lookupdev(errbuf);
if (dev == NULL) {
fprintf(stderr, "Couldn't find default device: %s\n", errbuf);
return(2);
}
printf("Device: %s\n", dev);
pcap_t *handle;
handle = pcap_open_live(dev, BUFSIZ, 1, 1000, errbuf);
if (handle == NULL) {
fprintf(stderr, "Couldn't open device %s: %s\n", dev, errbuf);
return(2);
}
if (pcap_datalink(handle) != DLT_EN10MB) {
fprintf(stderr, "Device %s doesn't provide Ethernet headers - not supported\n", dev);
return(2);
}
return(0);
}
#include <pcap.h>
#include <arpa/inet.h>
#include <stdio.h>
#define ETH_ALEN 6 /* Size of Ethernet address */
/*
* This structure defines an ethernet arp header.
* /include/uapi/linux/if_arp.h
*/
typedef struct arphdr {
unsigned short ar_hrd; /* format of hardware address */
unsigned short ar_pro; /* format of protocol address */
unsigned char ar_hln; /* length of hardware address */
unsigned char ar_pln; /* length of protocol address */
unsigned short ar_op; /* ARP opcode (command) */
/*
* Ethernet looks like this : This bit is variable sized however...
*/
unsigned char ar_sha[ETH_ALEN]; /* sender hardware address */
unsigned char ar_sip[4]; /* sender IP address */
unsigned char ar_tha[ETH_ALEN]; /* target hardware address */
unsigned char ar_tip[4]; /* target IP address */
}arphdr_t;
int main(int argc, char *argv[])
{
pcap_t *handle; /* Session handle */
char *dev; /* The device to sniff on */
char errbuf[PCAP_ERRBUF_SIZE]; /* Error string */
struct bpf_program fp; /* The compiled filter */
char filter_exp[] = "port 23"; /* The filter expression */
bpf_u_int32 mask; /* Our netmask */
bpf_u_int32 net; /* Our IP */
struct pcap_pkthdr header; /* The header that pcap gives us */
const u_char *packet; /* The actual packet */
arphdr_t *arpheader = NULL; /* Pointer to the ARP header */
/* Define the device */
dev = pcap_lookupdev(errbuf);
if (dev == NULL) {
fprintf(stderr, "Couldn't find default device: %s\n", errbuf);
return(2);
}
/* Find the properties for the device */
if (pcap_lookupnet(dev, &net, &mask, errbuf) == -1) {
fprintf(stderr, "Couldn't get netmask for device %s: %s\n", dev, errbuf);
net = 0;
mask = 0;
}
/* Open the session in promiscuous mode */
handle = pcap_open_live(dev, BUFSIZ, 1, 1000, errbuf);
if (handle == NULL) {
fprintf(stderr, "Couldn't open device %s: %s\n", dev, errbuf);
return(2);
}
/* Compile and apply the filter */
/*
if (pcap_compile(handle, &fp, filter_exp, 0, net) == -1) {
fprintf(stderr, "Couldn't parse filter %s: %s\n", filter_exp, pcap_geterr(handle));
return(2);
}
*/
/* Compiles the filter expression into a BPF filter program */
if (pcap_compile(handle, &fp, "arp", 1, mask) == -1){
fprintf(stderr, "Couldn't parse filter %s: %s\n", filter_exp, pcap_geterr(handle));
return(2);
}
if (pcap_setfilter(handle, &fp) == -1) {
fprintf(stderr, "Couldn't install filter %s: %s\n", filter_exp, pcap_geterr(handle));
return(2);
}
while (1) {
/* Grab a packet */
packet = pcap_next(handle, &header);
/* Print its length */
// printf("Jacked a packet with length of [%d]\n", header.len);
arpheader = (struct arphdr *)(packet+14); /* Point to the ARP header */
// HTYPE = 1
if (ntohs(arpheader->ar_hrd) != 1) continue;
// PTYPE >= 0x0800
if (ntohs(arpheader->ar_pro) != 0x0800) continue;
// HLEN = 6
if (arpheader->ar_hln != 6) continue;
// PLEN = 4
if (arpheader->ar_pln != 4) continue;
// OPER = 1 Request
if (ntohs(arpheader->ar_op) != 1) continue;
// SHA Sender Hardware Addres = MAC ADRS.
printf("Sender MAC: ");
printf("%02X", arpheader->ar_sha[0]);
for (int i=1; i<6; ++i)
printf(":%02X", arpheader->ar_sha[i]);
printf("\n");
}
/* And close the session */
pcap_close(handle);
return(0);
}
Sender MAC: B4:7C:9C:xx:xx:xx: Sender MAC: FC:A6:67:xx:xx:xx: Sender MAC: 68:37:E9:xx:xx:xx:
pi@raspberrypi:~ $ sudo tcpdump -Q in -e arp -q -n tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on enxb827xxxxxxxx, link-type EN10MB (Ethernet), capture size 262144 bytes 15:26:31.459945 68:37:e9:xx:xx:xx > ff:ff:ff:ff:ff:ff, ARP, length 60: Request who-has 192.168.xxx.xxx tell 192.168.1.5, length 46 15:27:08.329785 68:37:e9:xx:xx:xx > ff:ff:ff:ff:ff:ff, ARP, length 60: Request who-has 192.168.xxx.xxx tell 192.168.1.4, length 46 15:27:09.456846 b4:7c:9c:xx:xx:xx > ff:ff:ff:ff:ff:ff, ARP, length 60: Request who-has 192.168.xxx.xxx tell 192.168.1.2, length 46 15:27:13.461632 fc:a6:67:xx:xx:xx > ff:ff:ff:ff:ff:ff, ARP, length 60: Request who-has 192.168.xxx.xxx tell 192.168.1.3, length 46
