a k#d[@sdZddlmZddlZddlZddlZddlZddlZddl Z ddl m Z m Z m Z mZmZddlmZmZddlmZmZddlmZmZmZmZmZddlmZmZmZm Z m!Z!dd l"m#Z#m$Z$dd l%m&Z&m'Z'm(Z(m)Z)dd l*m+Z+m,Z,dd l-m.Z.m/Z/ddl0m1m2Z2dd l3m4Z4m5Z5ddl6m7Z7ddl8m9Z9ddl6m:Z:m;Z;mZ>m?Z?m@Z@mAZAmBZBde_CddlDmEZEddlFmGZGmHZHdZIejJreIe_Kn@z$eLeMdkrde_Knde_KWneNyde_KYn0eOedsde_PeOedsde_QeOedsde_ReOeds de_SeOed s4ejSe_TeOed!sFd"e_UeOed#sXd$e_VeOed%sjd&e_WeGd'ZXd(d)ZYd*d+ZZdhd-d.Z[did0d1Z\Gd2d3d3eZ]d4d5Z^e]e__ej_j`rejJrd6d7ZaeaZbebsed8[bdjd:d;Zcdd?d?eZeGd@dAdAeZfejghefdkdBdCZidDdEZjdldFdGZkdHdIZldJdKZmdmdLdMZndndNdOZododPdQZpejCreEjqZrdRdSZqeqeE_qdTdUZsdVdWZte;dXdYZue;dpdZdYZudqd[dYZud\d]Zvd^d_Zwd`daZxdbdcZydrdddeZzGdfdgdge9Z{dS)sz5 Customizations needed to support Microsoft Windows. )globN)_windows_titleGetAdaptersAddressesGetIpForwardTableGetIpForwardTable2get_service_status)WINDOWS WINDOWS_XP)confProgPath)Scapy_Exceptionlog_interactive log_loading log_runtimewarning)NetworkInterfaceInterfaceProviderdev_from_index resolve_iface network_name) inet_ntop inet_pton)atolitommac2strstr2mac)construct_source_candidate_set in6_getscope) ARPHDR_ETHER load_manuf)inputwinreg) plain_str) SuperSocket) castoverloadAnyDictListLiteralOptionalTupleUnionT)libpcap) NPCAP_PATH PCAP_IF_UPz\Device\NPF_Loopbackg333333 @z"Microsoft KM-TEST Loopback AdapterzMicrosoft Loopback Adapter IPPROTO_IPIP IP_RECVTTL IPV6_HDRINCL$ IPPROTO_IPV6)SOL_IPV6 IPPROTO_GRE/ IPPROTO_AH3 IPPROTO_ESP2z\WlanHelper.execCsd|S)z0Encapsulate a command with an Administrator flagzmpowershell /command "Start-Process cmd -windowstyle hidden -Wait -PassThru -Verb RunAs -ArgumentList '/c %s'")cmdr?r?R/var/www/html/gsl.tools/lib/python3.9/site-packages/scapy/arch/windows/__init__.py_encapsulate_admincsrBcCsTtj}d}z*t||}t||\}}t|WntyHYdS0tt|S)z Get a Npcap parameter matching key in the registry. List: AdminOnly, DefaultFilterSettings, DltNull, Dot11Adapters, Dot11Support LoopbackAdapter, LoopbackSupport, NdisImPlatformBindingOptions, VlanSupport WinPcapCompatible z2SYSTEM\CurrentControlSet\Services\npcap\ParametersN)r!HKEY_LOCAL_MACHINEOpenKey QueryValueExZCloseKeyZ WindowsErrorr$str)Z param_keyhkeynodekeyZdot11_adapters_r?r?rA_get_npcap_configos   rKPATHc s|dur g}t|ts|g}tr(Stjgtj|tjj|}zt fdd|DWSt t fyt dYn0dS)z@Find file in current dir, in deep_lookup cache or in system pathNc3s6|].}ttj|D]}|rtj|VqqdSN)rospathjoinnormpath).0rOmatchfilenamer?rA sz_where..zFile not found: %s) isinstancelistrrNcurdirenvironsplitrOpathsepnext StopIteration RuntimeErrorIOError)rUdirsenvpathsr?rTrA_wheres    rd ProgramFilesc Cs~|dr|gn |d|g}|D]T}z4|dur8t|}nt|tjtj||gd}Wntynd}Yq 0qvq |p|dS)zwFind executable in current dir, system path or in the given ProgramFiles subdir, and retuen its absolute path. z.exeN)ra)endswithrdrNrOrPrZr`)rU installsubdirrbfnsfnrOr?r?rA win_find_exes "  rkc@seZdZddZddZdS) WinProgPathcCs |dSrM)_reloadselfr?r?rA__init__szWinProgPath.__init__c Cs.d|_d|_d|_td|_td|_td|_td|_|j|_ td|_ td|_ tdd|_ td d d d |_ td ddd |_tdddd |_tdddd |_|j r*z6ttjj|j tjjddtjjd}Wn&ttfytdd}Yn0|r*tjjtjj|jdS)NrfdotZwindumptshark tcpreplayZhexersox wiresharkZ USBPcapCMDZUSBPcapZ programfiles)rhrb powershellzSystem32\WindowsPowerShell\v1.0Z SystemRootcscriptZSystem32r@Zmanufz/Wireshark is installed, but cannot read manuf !) Z pdfreaderZpsreaderZ svgreaderrkrqtcpdumprrrs_defaultdisplayZhexeditrtruZ usbpcapcmdrvrwr@rrNrOseprPr[r`OSErrorrrr Zmanufdb__dict__clearupdate)roZ new_manufr?r?rArmsX          zWinProgPath._reloadN)__name__ __module__ __qualname__rprmr?r?r?rArlsrlcCs(tj|tjdd}|d}||jfS)z7Call a CMD command and return the output and returncodeT)stdoutshellr)spPopenPIPE communicate returncode)commandprocresr?r?rA _exec_cmds  rcCsbzHtjtjjdgtjtjd}|\}}t| }d|voFd|vWSt y\YdS0dS)z0Return whether windump version is correct or notz-help)rstderrsnpcapswinpcapFN) rrr progryrSTDOUTrrlower Exception)Zp_test_windumprerr_outputr?r?rAtest_windump_npcaps  rzvThe installed Windump version does not work with Npcap! Refer to 'Winpcap/Npcap conflicts' in scapy's installation docFcs@ddfddtjr$ddntfddtDS) zReturns windows interfaces through GetAdaptersAddresses. params: - extended: include anycast and multicast IPv6 (default False)cSs4|d}|dkrdSt|d}tt|d|S)NZphysical_address_lengthrfZphysical_address) bytearrayrbytes)xsizedatar?r?rA_get_macs  z%get_windows_if_list.._get_maccsV|d}|d}|d}dd}g}|||rR|||||||S)NZfirst_unicast_addressZfirst_anycast_addressZfirst_multicast_addresscSst|tsgSg}|D]h}|ddj}|jtjkr>d}d}nd}d}t||}t||}tt|j }|r| t |j|q|S)NaddressIpv6 sin6_addrIpv4sin_addr) rWrXcontentsZ si_familysocketAF_INET6getattrrrbyteappendr)yipsipaddrZip_keyZsi_keyrr?r?rA _resolve_ipss     z;get_windows_if_list.._get_ips.._resolve_ips)extend)rZunicastZanycastZ multicastrrextendedr?rA_get_ips sz%get_windows_if_list.._get_ipscSs|jdddS)Nutf8ignoreerrors)encode)rr?r?rA.z%get_windows_if_list..c s^g|]V}|d|d|d|d|tr:dn|dtrHdn|d|dqS)Z friendly_nameZinterface_index descriptionZ adapter_namer ipv4_metric ipv6_metric)nameindexrguidmacrrr)r rRr)rr _str_decoder?rA 1s    z'get_windows_if_list..)sixPY2r"rrr?)rrrrrAget_windows_if_lists "  rcCsd|vrd|ddS|S)zcConverts a Winpcap/Npcap pcpaname to its guid counterpart. e.g. \DEVICE\NPF_{...} => {...} {)r[)Z pcap_namer?r?rA_pcapname_to_guid?srcseZdZdZd&fdd ZfddZddZd d Zd d Zd dZ ddZ d'ddZ ddZ ddZ ddZddZddZddZd d!Zd"d#Zd$d%ZZS)(NetworkInterface_Winz&A network interface of your local hostNcs4d|_d|_d|_d|_d|_tt|||dSrM) cache_moderrrraw80211superrrp)roproviderr __class__r?rArpLs zNetworkInterface_Win.__init__cs|d|_|d|_|d|_|d|_z8tjr^|jtkr^d|d<d|d<d |d <dd g|d <WntyrYn0tt | |d S) zUpdate info about a network interface according to a given dictionary. Such data is provided by get_windows_if_list rrrr00:00:00:00:00:00r 127.0.0.1r::1Zip6rN) rrrrr use_npcapNPCAP_LOOPBACK_NAMEKeyErrorrrr)rorrr?rArUs     zNetworkInterface_Win.updatecCsHtjstd|jdur6td}|r0tt|nd|_|jsDtddS)NzThis operation requires Npcap.Z Dot11SupportFz%Npcap 802.11 support is NOT enabled !)r rr}rrKboolintr )rovalr?r?rA_check_npcap_requirementms z-NetworkInterface_Win._check_npcap_requirementcCs^|jdurtdttdt|jdd||g\}}t|dkrZt|jddd d S) z3Internal function. Set a [key] parameter to [value]NInterface not setup rrxrrrrT)rr}rrBrP _WlanHelperrdecode)rorIrrcoder?r?rA _npcap_setws  zNetworkInterface_Win._npcap_setcCs`|jdurtdtdt|jdd|g\}}t|dkrTt|jdddt|S) Nrrrrxrrrr) rr}rrPrrrr"strip)rorIrrr?r?rA _npcap_gets "zNetworkInterface_Win._npcap_getcCs||dS)zDGet the interface operation mode. Only available with Npcap.moderrrnr?r?rArszNetworkInterface_Win.modecCsB|jdur|jSz|dk}||_|WSty<YdS0dS)zTReturns True if the interface is in monitor mode. Only available with Npcap.NmonitorF)rrr )rorr?r?rA ismonitors   zNetworkInterface_Win.ismonitorTcCsJ|r|d}n |d}|s(tdd|_|}|_|rD|S| S)zTAlias for setmode('monitor') or setmode('managed') Only available with Npcaprmanagedz.Npcap WlanHelper returned with an error code !N)setmodererrorrr)roenablertmpr?r?rA setmonitors   zNetworkInterface_Win.setmonitorcCs||ddS)zEGet all available interface modes. Only available with Npcap.modes,rrr[rnr?r?rAavailablemodessz#NetworkInterface_Win.availablemodescCs@|ddddddd}t|tr0||dn|}|d |S) aSet the interface mode. It can be: - 0 or managed: Managed Mode (aka "Extensible Station Mode") - 1 or monitor: Monitor Mode (aka "Network Monitor Mode") - 2 or master: Master Mode (aka "Extensible Access Point") (supported from Windows 7 and later) - 3 or wfd_device: The Wi-Fi Direct Device operation mode (supported from Windows 8 and later) - 4 or wfd_owner: The Wi-Fi Direct Group Owner operation mode (supported from Windows 8 and later) - 5 or wfd_client: The Wi-Fi Direct Client operation mode (supported from Windows 8 and later) Only available with Npcap.rrZmasterZ wfd_deviceZ wfd_ownerZ wfd_client)rrr1unknownr)rrWrgetr)rorZ_modesmr?r?rArszNetworkInterface_Win.setmodecCs|t|dS)zDGet the channel of the interface. Only available with Npcap.channelrrrrnr?r?rArszNetworkInterface_Win.channelcCs||dt|S)KSet the channel of the interface (1-14): Only available with Npcap.rrrrF)rorr?r?rA setchannelszNetworkInterface_Win.setchannelcCs|t|dS)zFGet the frequence of the interface. Only available with Npcap.freqrrnr?r?rA frequenceszNetworkInterface_Win.frequencecCs||dt|S)rrr)rorr?r?rA setfrequencesz!NetworkInterface_Win.setfrequencecCs||ddS)zRGet all available 802.11 interface modulations. Only available with Npcap.Zmodusrrrnr?r?rAavailablemodulationssz)NetworkInterface_Win.availablemodulationscCs||dS)zNGet the 802.11 modulation of the interface. Only available with Npcap.modurrnr?r?rA modulationszNetworkInterface_Win.modulationc CsN|ddddddddd d d d }t|tr:||d n|}|d t|S)a_Set the interface modulation. It can be: - 0: dsss - 1: fhss - 2: irbaseband - 3: ofdm - 4: hrdss - 5: erp - 6: ht - 7: vht - 8: ihv - 9: mimo-ofdm - 10: mimo-ofdm - the value directly Only available with Npcap.ZdsssZfhssZ irbasebandZofdmZhrdssZerpZhtZvhtZihvz mimo-ofdm) rrrrr1rr rr)rrWrrrrF)rorZ_modusrr?r?rA setmodulations z"NetworkInterface_Win.setmodulation)N)T)rrr__doc__rprrrrrrrrrrrrrrrr __classcell__r?r?rrArIs$     rc@s<eZdZdZdZddZeddZefddZ d d Z d S) WindowsInterfacesProviderr-TcCs|jdkrdSt|jt@S)NrT)flagsrr/)rodevr?r?rA _is_valid+s z#WindowsInterfacesProvider._is_validcCsbtjs dSt}dd}|r dStdtjr6|rTttjd}|rTtddStddS)z$Performs checks/restart pcap adapterNc Ss~tjs dSd}z"ddl}tt|jjj|ddWStt fyxt |}| }|dvrdYdS|dvrBYdSqBYn0dS) NFz(Do you want to start it ? (yes/no) [y]: rr)default)yesrrfT)non) r interactiveIPythonr$rutilsioZ ask_yes_no NameError ImportErrorr rr)msgrZ_confirr?r?rA _ask_user<s z8WindowsInterfacesProvider._pcap_check.._ask_userz:Scapy has detected that your pcap service is not running !askadminzPcap service started !zCould not start the pcap service! You probably won't be able to send packets. Check your winpcap/npcap installation and access rights.) r use_pcappcap_service_statusr rrpcap_service_startrinfo)clsZ_detectrZsucceedr?r?rA _pcap_check2s"   z%WindowsInterfacesProvider._pcap_checkc Csi}tjstt}tD]J}d|dvr8tj|d<|drtjr\|dtjkr\t|d<|||d<qd}t tjD]\}}|\}} } } t |} | | d} | r|| d<t t| d| | d<| | d<n"|d8}|||| |d dd| | d } ||| || <qz|S) NZLoopbackrrrrrr rr) rrrrrrrrrr )r Zcache_pcapiflistrrdictr loopback_namerrr iteritemsrrrXset)rorresultsZwindows_interfacesirnetwZif_datarrr rJrrr?r?rAload`sD       zWindowsInterfacesProvider.loadcCs&d|_tjrddlm}||S)zReload interface listFr) load_winpcapy)Zrestarted_adapterr rscapy.arch.libpcapr(r')ror(r?r?rAreloads  z WindowsInterfacesProvider.reloadN) rrrrr-r  classmethodrrr'r*r?r?r?rAr's - .rcCs<i}ttjD]&}|r(|jd||<q|jd||<q|S)zReturns all available IPs matching to interfaces, using the windows system. Should only be used as a WinPcapy fallback. :param v6: IPv6 addresses rr1)r itervaluesr ifacesr)v6rifacer?r?rAget_ipss r0cCs t|}|jsdSttj|jS)z(Return the raw IPv4 address of interfaces)rrrrAF_INET)Ziffr?r?rAget_if_raw_addrsr2cCs0tdttj|}t|d|dgdS)zEBackward compatibility: indirectly calls get_ips Deprecated. zrget_ip_from_name is deprecated. Use the `ip` attribute of the iface or use get_ips() to get all ips per interface.r.rfr)warningswarnDeprecationWarningr r- dev_from_namer0r)Zifnamer.r/r?r?rAget_ip_from_names  r8cCstjr dSdS)z&Return the pcap adapter service's nameZnpcapZnpf)r rr?r?r?rApcap_service_namesr9cCstt}|ddkS)z:Returns whether the windows pcap adapter is running or notZdwCurrentStater1)rr9)statusr?r?rArs rcCsH|dt}t|rt|n|\}}|dkr@t|jddd|dkS)z)Internal util to run pcap control commandrrrrr)r9rrBrr)actionrrrrr?r?rA_pcap_service_controls r<cCs td|dS)zDStarts the pcap adapter. Will ask for admin. Returns True if successzsc startrr<rr?r?rArsrcCs td|dS)zCStops the pcap adapter. Will ask for admin. Returns True if successzsc stoprr=rr?r?rApcap_service_stopsr>cOsjttt|}|j}|s td|dd}tjrT|durT|}||urT| |t |g|Ri|S)zopen_pcap: Windows routine for creating a pcap from an interface. This function is also responsible for detecting monitor mode. z+Interface is invalid (no pcap match found)!rN) r$rrrr rr rrr_orig_open_pcap)r/argskargsZiface_network_nameZ kw_monitorZ monitoredr?r?rA open_pcaps  rBcCs t|}t|jrt|jpdfS)Ns)rrrr)r/Z_ifacer?r?rAget_if_raw_hwaddrsrCc Csdd}dd}g}tD]}|d}||d}||d}||d}|d }z&ttt|} | jrr| jd krvWqWntyYqYn0| j} t| } || j}||||| | |fq|S) ztRetrieve Windows routes through a GetIpForwardTable call. This is compatible with XP but won't get IPv6 routes.cSsttjtd|S)N._extract_ipcSs trtdtd|dS|S)NrDz>Ir)r rEunpackrF)rr?r?rA_procsz _read_routes_c_v1.._procZForwardIfIndexZ ForwardDestZ ForwardMaskZForwardNextHopZForwardMetric10.0.0.0) rr$rrr ValueErrorrrr) rHrJroutesrouteifIndexdestnetmasknexthopmetricr/rr&r?r?rA_read_routes_c_v1 s(       rTcCsdSrMr?ipv6r?r?rA_read_routes_c0srWcCsdSrMr?rUr?r?rArW6sc s.|r tjntj|rdnd|r$dnd|r0dnd}|r>t}g}fdd}tD]}|d }||d d }|d d }||d } |d} z t|} | jr| jdkrWqZWntyYqZYn0| j} t| } | t | |} |rt |||| | || qZ| t |t t|| | | | fqZ|S)zeRetrieve Windows routes through a GetIpForwardTable2 call. This is not available on Windows XP !rrrrrrcs&|}tt|d}t|S)Nr)rrr)rGrafZ sin_addr_nameZsock_addr_namer?rArHIs z#_read_routes_c.._extract_ipZInterfaceIndexZDestinationPrefixZPrefixZ PrefixLengthZNextHopZMetricrK)rrr1 in6_getifaddrrrrrLrr_append_route6rrrr)rVZ metric_namelifaddrrMrHrNrOrPrQrRrSr/rr&r?rXrArW<s>         c CsTg}ztrt}n tdd}Wn0tyN}ztd|WYd}~n d}~00|S)NFrUz,Error building scapy IPv4 routing table : %s)r rTrWrrr)rMer?r?rA read_routesks"r^cCsfg}tdd}|D],\}}|D]}t|}||||jfq"qtjrbtjrb|ddtjf|S)z: Returns all IPv6 addresses found on the computer Tr3rr)r0itemsrrrr rr!)ZifaddrsZip6sr/rrscoper?r?rArZ}s  rZc sbg}tjkr"|dkrdSdg}nfdd|D}t|||}|sHdS||||||fdS)N::rc3s|]}|dkr|VqdS)rNr?rr/r?rArVrz!_append_route6..)r r!rr) rMZdprefZdpZnhr/r\rSZcsetZdevaddrsr?rbrAr[s   r[c CsPg}tr |Sztdd}Wn0tyJ}ztd|WYd}~n d}~00|S)NTrUz,Error building scapy IPv6 routing table : %s)r rWrrr)Zroutes6r]r?r?rA read_routes6s"rcc CststddStd|r*tjjs6dSn tjjs6dStjtjtj tj}|rf| |j dSt tjjD]$}|d}|tjkrrtjj |qrt tjD]\}}|tjkrtj|q|tjd<|j t_ttjtrtjj tjkr|t_dtjjd<dtjjd<td td d }td td d }||d |j ddf} ddd|j dgdf} ddd|j dgdf} |durtjj | tjj | tjj | tjtjn&|r| | | | n | | dS)zBAdd a route to 127.0.0.1 and ::1 to simplify unit tests on Windowsz4Calling _route_add_loopback is only valid on WindowsNz?This will completely mess up the routes. Testing purpose only !rz&{0XX00000-X000-0X0X-X00X-00XXXX000XXX}zff:ff:ff:ff:ff:ffrrz!Iz 127.0.0.0rz 255.0.0.0rKrrazfe80::)rrr Zroute6rMrNr-Z_add_fake_ifacer!r7rrrXremover_poprWr/rZnetcacheZ arp_cacheZ in6_neighborrErIr inet_atonZinvalidate_cache) rMrVZiflistadapterrNr/ZdevnameZloop_netZ loop_maskZloopback_routeZloopback_route6Zloopback_route6_customr?r?rA_route_add_loopbacksb            ric@seZdZdZddZdS)_NotAvailableSocketzwpcap.dll missingcOs tddS)NzSniffing and sending packets is not available at layer 2: winpcap is not installed. You may use conf.L3socket orconf.L3socket6 to access layer 3)r_)ror@rAr?r?rArpsz_NotAvailableSocket.__init__N)rrrdescrpr?r?r?rArjsrj)NrL)Nre)F)F)F)T)T)T)F)F)NFN)|rrrNplatformZ platform_librrE subprocessrr4Zscapy.arch.windows.structuresrrrrrZ scapy.constsrr Z scapy.configr r Z scapy.errorr r rrrZscapy.interfacesrrrrrZscapy.pton_ntoprrZ scapy.utilsrrrrZ scapy.utils6rrZ scapy.datarrZscapy.libs.sixZlibsrZscapy.libs.six.movesr r!Z scapy.compatr"Zscapy.supersocketr#r$r%r&r'r(r)r*r+r,rZ scapy.archr-r)r.r/rrr!floatreleaserLhasattrr0r2r4r6r8r9r;r=rrBrKrdrkrlrrryrZ windump_okrrrrr-Zregister_providerr0r2r8r9rr<rr>rBr?rCrTrWr^rZr[rcrirjr?r?r?rAs   ,               1   C _s     $   /  E