Hello everyone! Today we’ll be installing Impacket and Pcapy for Python 2.6 on Windows. The Impacket module lets you parse network packets, this is very useful for example when developing a sniffer. The Pcapy module interfaces with WinPcap to do the actual packet capture.
From the CORE Security webpage:
What is Impacket?
Impacket is a collection of Python classes focused on providing access to network packets. Impacket allows Python developers to craft and decode network packets in simple and consistent manner. It includes support for low-level protocols such as IP, UDP and TCP, as well as higher-level protocols such as NMB and SMB. Impacket is highly effective when used in conjunction with a packet capture utility or package such as Pcapy. Packets can be constructed from scratch, as well as parsed from raw data. Furthermore, the object oriented API makes it simple to work with deep protocol hierarchies.
What is Pcapy?
Pcapy is a Python extension module that interfaces with the libpcap packet capture library. Pcapy enables python scripts to capture packets on the network. Pcapy is highly effective when used in conjunction with a packet-handling package such as Impacket, which is a collection of Python classes for constructing and dissecting network packets.
There is a problem though – Pcapy hasn’t been updated in quite a while, so there is no MSI installer for Python 2.6. I’ve built it myself and hosted in here in the blog, so you don’t have to. đŸ™‚ I’ve also built an EXE installer for Impacket, it’s not really needed since it’s a pure Python module, but why not?
So this is the list of files we’ll be needing:
WinPcap_4_1_1.exe
pcapy-0.10.5.win32-py2.6.msi
Impacket-0.9.8.0.win32.exe
Installation is now pretty much straight forward. After running all the installers, let’s try it out with this example script to dump all connection attempts by sniffing SYN packets:
C:\Documents and Settings\Mario Vilas\Desktop>python connections.py
Available network interfaces:
1 - \Device\NPF_GenericDialupAdapter
2 - \Device\NPF_{5BE055D9-461D-4F51-99DD-188224D1A6D0}
3 - \Device\NPF_{9B7DC2FB-7660-4E68-B4EC-DB9682C76E40}
4 - \Device\NPF_{166A618C-4230-42E7-93AD-298D1145F5BC}
5 - \Device\NPF_{BE987C8D-D523-49B8-8B95-DDDBAA46EB3F}
Choose an interface [0 to quit]: 2
Listening on: \Device\NPF_{5BE055D9-461D-4F51-99DD-188224D1A6D0}
Connection attempt 10.0.2.15 -> 192.168.254.254
Connection attempt 10.0.2.15 -> 192.168.254.254
Connection attempt 10.0.2.15 -> 192.168.254.254
Connection attempt 10.0.2.15 -> 192.168.254.254
Connection attempt 10.0.2.15 -> 192.168.254.254
Connection attempt 10.0.2.15 -> 209.85.227.106
Connection attempt 10.0.2.15 -> 209.85.227.104
Connection attempt 10.0.2.15 -> 209.85.227.104
Connection attempt 10.0.2.15 -> 209.85.227.104
Connection attempt 10.0.2.15 -> 209.85.227.100
^C
Below is the source code to the script. Enjoy! đŸ™‚
Updates
- A newer version of Impacket is hosted at Google Code, so I built a new installer. The previous version of the installer, based on the version of Impacket found in the Core Security webpage, is still available here: Impacket-0.9.6.0.win32.exe
- Ge0 has built Pcapy for Python 2.7 using MingW to avoid having a depencency against the Visual Studio runtimes. You can download it from here: pcapy.pyd
Breaking Code 