Hi folks! In a previous post I talked about using Impacket and Pcapy on Python 2.6. Since those installers are now out of date, here are fresh ones for various versions of Pcapy and Python, built against WinPcap 4.1.2. There’s also a new Impacket MSI installer that works against all Python versions.
Enjoy! 🙂
Edited 6-May-2013: updated Impacket to version 0.9.10
Edited 18-Feb-2014: updated Impacket to version 0.9.11
Hello everyone! Today we’ll be installing Impacket and Pcapy for Python 2.6 on Windows. The Impacket module lets you parse network packets, this is very useful for example when developing a sniffer. The Pcapy module interfaces with WinPcap to do the actual packet capture.
From the CORE Security webpage:
What is Impacket?
Impacket is a collection of Python classes focused on providing access to network packets. Impacket allows Python developers to craft and decode network packets in simple and consistent manner. It includes support for low-level protocols such as IP, UDP and TCP, as well as higher-level protocols such as NMB and SMB. Impacket is highly effective when used in conjunction with a packet capture utility or package such as Pcapy. Packets can be constructed from scratch, as well as parsed from raw data. Furthermore, the object oriented API makes it simple to work with deep protocol hierarchies.
What is Pcapy?
Pcapy is a Python extension module that interfaces with the libpcap packet capture library. Pcapy enables python scripts to capture packets on the network. Pcapy is highly effective when used in conjunction with a packet-handling package such as Impacket, which is a collection of Python classes for constructing and dissecting network packets.
There is a problem though – Pcapy hasn’t been updated in quite a while, so there is no MSI installer for Python 2.6. I’ve built it myself and hosted in here in the blog, so you don’t have to. 🙂 I’ve also built an EXE installer for Impacket, it’s not really needed since it’s a pure Python module, but why not?
So this is the list of files we’ll be needing:
Installation is now pretty much straight forward. After running all the installers, let’s try it out with this example script to dump all connection attempts by sniffing SYN packets:
C:\Documents and Settings\Mario Vilas\Desktop>python connections.py
Available network interfaces:
1 - \Device\NPF_GenericDialupAdapter
2 - \Device\NPF_{5BE055D9-461D-4F51-99DD-188224D1A6D0}
3 - \Device\NPF_{9B7DC2FB-7660-4E68-B4EC-DB9682C76E40}
4 - \Device\NPF_{166A618C-4230-42E7-93AD-298D1145F5BC}
5 - \Device\NPF_{BE987C8D-D523-49B8-8B95-DDDBAA46EB3F}
Choose an interface [0 to quit]: 2
Listening on: \Device\NPF_{5BE055D9-461D-4F51-99DD-188224D1A6D0}
Connection attempt 10.0.2.15 -> 192.168.254.254
Connection attempt 10.0.2.15 -> 192.168.254.254
Connection attempt 10.0.2.15 -> 192.168.254.254
Connection attempt 10.0.2.15 -> 192.168.254.254
Connection attempt 10.0.2.15 -> 192.168.254.254
Connection attempt 10.0.2.15 -> 209.85.227.106
Connection attempt 10.0.2.15 -> 209.85.227.104
Connection attempt 10.0.2.15 -> 209.85.227.104
Connection attempt 10.0.2.15 -> 209.85.227.104
Connection attempt 10.0.2.15 -> 209.85.227.100
^C
Below is the source code to the script. Enjoy! 🙂
A new security advisory has been published today on a new remote vulnerability (MS10-012, CVE-2010-0231) in the SMB protocol on many Windows versions, ranging from the now ancient Windows NT to the latest Windows 7. This would allow an attacker to authenticate to almost any Windows box, read and write any files, or alternatively upload an executable file and run it. Just let me quote the following, it’s what caught my eye the most:
Given that Windows NT 4 was relased in ~1996 this vulnerability has been
present for ~14 years. If it is confirmed this vulnerablity is also
present in older systems such as Windows NT 3.1, released in ~1993,
Windows NTLMv1 authentication mechanism could have been vulnerable for
~17+ years.
Whoa. That’s kind of scary.
Kudos to Hernan Ochoa and Agustin Azubel for this great find! 🙂
Below is the complete text of the advisory, except for the source code to the scripts, which were removed for brevity. The original advisory can be downloaded from: http://www.hexale.org/advisories/OCHOA-2010-0209.txt.
Update: Hernan Ochoa has also written an article regarding the risk assesment for this vulnerability.
Breaking Code 