scanner.py 5.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154
  1. import ipaddress
  2. import os
  3. import socket
  4. import struct
  5. import sys
  6. import threading
  7. import time
  8. # сканируем подсеть
  9. SUBNET = '192.168.31.0/24'
  10. # волшебная строка, которую мы будем искать в ICMP-ответах
  11. # MESSAGE = 'PYTHONRULES!'
  12. MESSAGE = 'asdfaskdflajdskfjalsjdf'
  13. class IP:
  14. def __init__(self, buff):
  15. header = struct.unpack('<BBHHHBBH4s4s', buff)
  16. self.ver = header[0] >> 4
  17. self.ihl = header[0] & 0xF
  18. self.tos = header[1]
  19. self.len = header[2]
  20. self.id = header[3]
  21. self.offset = header[4]
  22. self.ttl = header[5]
  23. self.protocol_num = header[6]
  24. self.sum = header[7]
  25. self.src = header[8]
  26. self.dst = header[9]
  27. # IP-адруса, понятные человек
  28. self.src_address = ipaddress.ip_address(self.src)
  29. self.dst_address = ipaddress.ip_address(self.dst)
  30. # сопоставляем константы протоколов с их назначением
  31. self.protocol_map = {1: "ICMP", 6: "TCP", 17: "UDP"}
  32. try:
  33. self.protocol = self.protocol_map[self.protocol_num]
  34. except Exception as e:
  35. print('%s No protocol for %s' % (e, self.protocol_num))
  36. self.protocol = str(self.protocol_num)
  37. class ICMP:
  38. def __init__(self, buff):
  39. header = struct.unpack('<BBHHH', buff)
  40. self.type = header[0]
  41. self.code = header[1]
  42. self.sum = header[2]
  43. self.id = header[3]
  44. self.seq = header[4]
  45. # Добавляет в UDP-датаграммы наше волшебное сообщение
  46. def udp_sender():
  47. with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as sender:
  48. for i in range(10):
  49. sender.sendto(bytes(MESSAGE, 'utf8'), ('77.88.44.242', 5555))
  50. print('send icmp')
  51. # sender.sendto(bytes(MESSAGE, 'utf8'), ('8.8.8.8', 65212))
  52. time.sleep(0.3)
  53. # for ip in ipaddress.ip_network(SUBNET).hosts():
  54. # print(bytes(MESSAGE, 'utf8'), (str(ip), 65212))
  55. # sender.sendto(bytes(MESSAGE, 'utf8'), (str(ip), 65212))
  56. def icmp_sender():
  57. icmp_socket = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_ICMP)
  58. icmp_packet = struct.pack('!BBHHH', 8, 0, 0, 0, 1) + b'pingdata'
  59. crc = 0
  60. for i in range(0, len(icmp_packet), 2):
  61. crc += (icmp_packet[i] << 8) + icmp_packet[i + 1]
  62. class Scanner:
  63. def __init__(self, host):
  64. self.host = host
  65. if os.name == 'nt':
  66. socket_protocol = socket.IPPROTO_IP
  67. else:
  68. socket_protocol = socket.IPPROTO_ICMP
  69. self.socket = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket_protocol)
  70. self.socket.bind((host, 0))
  71. self.socket.setsockopt(socket.IPPROTO_IP, socket.IP_HDRINCL, 1)
  72. if os.name == 'nt':
  73. self.socket.ioctl(socket.SIO_RCVALL, socket.RCVALL_ON)
  74. def sniff(self):
  75. hosts_up = set([f'{str(self.host)} *'])
  76. try:
  77. while True:
  78. # читаем пакет
  79. raw_buffer = self.socket.recvfrom(65535)[0]
  80. # создаем IP-заголовок из первых 20 байт
  81. ip_header = IP(raw_buffer[0:20])
  82. # нас интересует ICMP
  83. # print(raw_buffer)
  84. print(ip_header.src_address, ip_header.dst_address)
  85. # print(ip_header.src_address)
  86. if ip_header.protocol == 'ICMP':
  87. print('ICMP')
  88. offset = ip_header.ihl * 4
  89. buf = raw_buffer[offset:offset + 8]
  90. # print(raw_buffer)
  91. icmp_header = ICMP(buf)
  92. # ищем тип и код 3
  93. print(icmp_header.code, icmp_header.type)
  94. if icmp_header.code == 3 and icmp_header.type == 3:
  95. print('!')
  96. if ipaddress.ip_address(ip_header.src_address) in ipaddress.IPv4Network(SUBNET):
  97. # проверяем содержит ли буфер наше волшебное сообщение
  98. print(raw_buffer[len(raw_buffer) - len(MESSAGE):])
  99. if raw_buffer[len(raw_buffer) - len(MESSAGE):] == bytes(MESSAGE, 'utf8'):
  100. tgt = str(ip_header.src_address)
  101. print(ip_header.src_address, ip_header.dst_address)
  102. if tgt != self.host and tgt not in hosts_up:
  103. hosts_up.add(str(ip_header.dst_address))
  104. print(f'Host Up: {tgt}')
  105. # обрабатываем Ctrl+C
  106. except KeyboardInterrupt:
  107. # если мы в Windows, выключаем неизбирательный режим
  108. if os.name == 'nt':
  109. self.socket.ioctl(socket.SIO_RCVALL, socket.RCVALL_OFF)
  110. print('\nUser interrupted')
  111. if hosts_up:
  112. print(f'\n\nSummary: Hosts up on {SUBNET}')
  113. for host in sorted(hosts_up):
  114. print(f'{host}')
  115. print('')
  116. sys.exit()
  117. if __name__ == '__main__':
  118. if len(sys.argv) == 2:
  119. host = sys.argv[1]
  120. s = Scanner(host)
  121. # time.sleep(1)
  122. t = threading.Thread(target=udp_sender)
  123. t.start()
  124. s.sniff()