libpcap, libspoofer, and a "Network Utility"

ry00000, on 15 July 2015 - 02:31 PM said:

Wouldn't this allow for pseudo-MitM type attacks? Like this:
Bank server sends a message to SpoofServer thinking it is the ATM. SpoofServer sends a message to the ATM under the bank server's ID making it transfer all the gold
on the victim's account to the attacker's account.

H4X0RZ, on 15 July 2015 - 04:55 PM said:

ry00000, on 15 July 2015 - 02:31 PM said:

Wouldn't this allow for pseudo-MitM type attacks? Like this:
Bank server sends a message to SpoofServer thinking it is the ATM. SpoofServer sends a message to the ATM under the bank server's ID making it transfer all the gold
on the victim's account to the attacker's account.

That's the reason why you don't use the rednet API for this.

Rednet is a wrapper for the more low-level modem API. Rednet just uses your computer's ID as channel. When using the modem API, you are able to define the channel yourself.

CloudNinja, on 15 July 2015 - 05:24 PM said:

H4X0RZ, on 15 July 2015 - 04:55 PM said:

ry00000, on 15 July 2015 - 02:31 PM said:

Wouldn't this allow for pseudo-MitM type attacks? Like this: Bank server sends a message to SpoofServer thinking it is the ATM. SpoofServer sends a message to the ATM under the bank server's ID making it transfer all the gold on the victim's account to the attacker's account.

That's the reason why you don't use the rednet API for this. Rednet is a wrapper for the more low-level modem API. Rednet just uses your computer's ID as channel. When using the modem API, you are able to define the channel yourself.

You are both 100% correct. But with being able to do pseudo-MitM attacks, you can do that as long as you know a computers ID that you want to attack and doing a constant rednet.send to it. Thats why if you want to be secure you would use encryption of your data and then use the Modem API. All my program does is allow for the capturing and sending of packets, which has malicious uses, but is not intended to do so. Also with your message: "Bank server sends a message to SpoofServer thinking it is the ATM. SpoofServer sends a message to the ATM under the bank server's ID making it transfer all the gold on the victim's account to the attacker's account." Its even easier if you know how rednet messages are formatted through the modem API. You can simply capture the packets being sent, figure out which ones you need to use, and then send a constant stream to the atm server to do X action. Now, this is obviously a malicious use for it, and probably if not definitely get you banned from servers.

H4X0RZ, on 15 July 2015 - 05:54 PM said:

-snip-

You don't even need any knowledge about the messages you want to sniff.
CC modes have a maximum of 65535 channels. One computer can open 128 channels at the same time. So you could sniff every channel with 512 computers. This isn't practical, but it is possible.

Actually, if this limitation (128 channels) applies per modem, and you have 5 wireless modems on the computer (the 6th is wired, so you can transmit the sniffed data to a main computer), it would only take 103 computers.

CloudNinja, on 16 July 2015 - 05:24 PM said:

flaghacker, on 16 July 2015 - 09:04 AM said:

CloudNinja, on 16 July 2015 - 03:01 AM said:

So does this spoof rednet messages as well? or does it just return a desired ID when running the ID command? If it's the latter, theres a MUCH easier way of doing this.

You could just read the code…

Yes, it spoofs rednet, that's the point. What easier way do you have?

I didnt know if it was able to use rednet still or not. I have a way that when you run ID it returns any value you desire, but it breaks rednet (for some reason, i dont know yet)

function os.getComputerID()
return VALUE
end

I also dont want to be THAT guy, but i find it ironic that the instant I release my spoofer, so does someone else :P/>/> Yours is pretty good though, looks like you put a bit of time in.

flaghacker, on 16 July 2015 - 08:43 PM said:

I didn't want to hijack some else's thread, so I'll post this here:

CloudNinja, on 16 July 2015 - 05:24 PM said:

flaghacker, on 16 July 2015 - 09:04 AM said:

CloudNinja, on 16 July 2015 - 03:01 AM said:

So does this spoof rednet messages as well? or does it just return a desired ID when running the ID command? If it's the latter, theres a MUCH easier way of doing this.

You could just read the code…

Yes, it spoofs rednet, that's the point. What easier way do you have?

I didnt know if it was able to use rednet still or not. I have a way that when you run ID it returns any value you desire, but it breaks rednet (for some reason, i dont know yet)

function os.getComputerID()
return VALUE
end

I also dont want to be THAT guy, but i find it ironic that the instant I release my spoofer, so does someone else :P/>/> Yours is pretty good though, looks like you put a bit of time in.

Overriding that function is the only way to spoof your id, and it should work with rednet perfectly fine, if you return a number. How does it "break" rednet? What error/behaviour?

flaghacker, on 16 July 2015 - 08:43 PM said:

I didn't want to hijack some else's thread, so I'll post this here:

CloudNinja, on 16 July 2015 - 05:24 PM said:

flaghacker, on 16 July 2015 - 09:04 AM said:

CloudNinja, on 16 July 2015 - 03:01 AM said:

So does this spoof rednet messages as well? or does it just return a desired ID when running the ID command? If it's the latter, theres a MUCH easier way of doing this.

You could just read the code…

Yes, it spoofs rednet, that's the point. What easier way do you have?

I didnt know if it was able to use rednet still or not. I have a way that when you run ID it returns any value you desire, but it breaks rednet (for some reason, i dont know yet)

function os.getComputerID()
return VALUE
end

I also dont want to be THAT guy, but i find it ironic that the instant I release my spoofer, so does someone else :P/>/> Yours is pretty good though, looks like you put a bit of time in.

Overriding that function is the only way to spoof your id, and it should work with rednet perfectly fine, if you return a number. How does it "break" rednet? What error/behaviour?

flaghacker, on 22 July 2015 - 12:35 PM said:

How is that more powerful? Overwriting that function makes everything use the new ID, including rednet.broadcast and every program that uses the id.

args = {...}
oldID = os.getComputerID()
function os.getComputerID()
return args[1]
end
rednet.broadcast("Test")
function os.getComputerID()
return oldID
end

CloudNinja, on 22 July 2015 - 01:21 PM said:

flaghacker, on 22 July 2015 - 12:35 PM said:

How is that more powerful? Overwriting that function makes everything use the new ID, including rednet.broadcast and every program that uses the id.

Yes while it overwrites anything that uses it, lets say you only need it for rednet functions, while you could spoof the id, send the message, then unspoof, it would be more of a hassle than using our API. lets say, for example

args = {...}
oldID = os.getComputerID()
function os.getComputerID()
return args[1]
end
rednet.broadcast("Test")
function os.getComputerID()
return oldID
end

you can just libspoofer.send(message, toid, fromid) and all without needing to write the API code yourself.

local modem = peripheral.wrap("SomeRandomSide")
modem.transmit(toID,fromID,message)

H4X0RZ, on 22 July 2015 - 05:08 PM said:

-snip-

or you just do this?

local modem = peripheral.wrap("SomeRandomSide")
modem.transmit(toID,fromID,message)

3dsboy08, on 28 July 2015 - 06:27 PM said:

I got an error when using the wireshark utility: Here it is

netutil:46: attempt to concatenate string and table