Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixing Router Advertisement function #24

Merged
merged 2 commits into from
Feb 22, 2022

Conversation

ThePirateWhoSmellsOfSunflowers
Copy link
Contributor

@ThePirateWhoSmellsOfSunflowers ThePirateWhoSmellsOfSunflowers commented Jan 19, 2022

Hello!

Here is a small PR in order to fix two things :

1: Router lifetime
In the blog post about mitm6, it says

mitm6 does not advertise itself as a gateway

However, according to RFC4861 (section 4.2)

Router Lifetime
16-bit unsigned integer. [...] A Lifetime of 0 indicates that the router is not a default router and SHOULD NOT appear on the default router list. The Router Lifetime applies only to the router's usefulness as a default router; it does not apply to information contained in other message fields or options. Options that need time limits for their information include their own lifetime fields.

Before this PR, if you check route PRINT on the victime's machine you should see that the IPv6 default gateway is the attacker machine because the default routerlifetime value in scapy is 1800 . Thus, this PR forces the routerlifetime option to 0.

2: Multiple interfaces on attacker's machine
Force source MAC and the source IPv6 adresse of the RA packet to be adresses associated with the interface sending the packet. Before this PR, RA packet leaks the link-local adresse of my second network interface.

As a side note

If someone stumble upon this PR while searching about IPv6 attacks: I tried to implement a "RA only" version of mitm6 using the RDNS option of RA. However, even if Windows sets my rogue DNS server, it never uses it to resolve names. I suspect that Windows implements RFC8106 (Section 5.3.1):

The DNS options from RAs and DHCP SHOULD be stored in the DNS Repository and Resolver Repository so that information from DHCP appears there first and therefore takes precedence. Thus, the DNS information from DHCP takes precedence over that from RAs for DNS queries.

Thanks for this amazing tool! 👍

🌻

set routerlifetime to 0 and fix src mac and src addr
@dirkjanm dirkjanm merged commit a39d645 into dirkjanm:master Feb 22, 2022
@dirkjanm
Copy link
Owner

Nice catch, thanks! Merged it in

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants