Spoofing the ARP Table of Remote Computers on a LAN

0. Object of Document

This document explains how to use the WinArpSpoofer program, which spoofs the ARP table of remote computers on a LAN and describes the CBuildPacket class that builds and throws a packet into the network.

1. Introduction

1.1 What is ARP spoofing

ARP spoofing, also called ARP Cache poisoning, is one of hacking methods used to spoof the contents of an ARP table on a remote computer on the LAN. Two addresses are needed for one computer to connect to other computer on an IP/Ether network. One address is the MAC address; the other is the IP address. A MAC address is used on a local area network before packets go out of the gateway; an IP address is used to surf the Internet through a gateway. There is a protocol that asks "who has this MAC address" and answers the question; that is called ARP (Address Resolution Protocol). What the ARP asks the target address for sending is called the ARP Request or ARP who has, and the ARP that responds to the request is called the ARP Request or ARP who has. Although wrong information is inserted into ARP, the computer believes that the information of the ARP is valid and saves the information in its own ARP table for a while. This is ARP spoofing.

Figure 1: ARP Spoofing

1.2 WinArpSpoofer Program

WinArpSpoofer is a program to manipulate the ARP table of another computer on a LAN. Especially, by changing the ARP table of a router, this program can in effect pull all packets on the local area network. After pulling and collecting all packets, this has a function that can forward them to the router (gateway). If you run this program and any sniffer program, you can even get and see all user IDs/passwords on the switch network. This program needs the WinPcap driver and has been tested on WinNT/2000/XP/2003 etc.

1.3 CBuildPacket Class

CBuildPacket is a class that builds a WinArpSpoofer program. Its general purpose is to easily build a cooked packet throwing into the network. It is hard to understand and use existing libnet libraries and so forth in MS Visual.NET, so I have newly designed this class.

The current version of the CBuildPacket class provides some methods for building and sending an ARP to the network. The future version of this class will provide many various types of network packets for building TCP, IP, icmp, and the like.

WinArpSpoofer has been built based on the current CBuildPacket class. It could pull and collect all packets without the users' recognition. The current version, 0.1, has been built for spoofing ARP tables and actually forwarding packets, so we didn't consider a neat and convenient user interface. For the future, when upgrading, that point will be improved.

1.4 Features of WinArpSpoofer

Functions and features of WinArpSpoofer program are as follows:

  • It can pull and collect all the packets on the LAN.
  • It can scan and show the active hosts on the LAN within a very short time (~1–2 seconds).
  • While spoofing arp tables, it can act as another gateway (or ip-forwarder) without other users' recognition on LAN.
  • It can collect and forward packets by selecting inbound, outbound, and both to be sent to the Internet.
  • An ARP table is recovered automatically in a little time (about 30 seconds). But, this program can keep spoofing continuously with a periodic time.
  • Although one or more network interface cards are installed on a computer, this program can scan and spoof selecting one of the NICs.

Because most functions are processed through threads, this program is faster than you think. Spoofing itself doesn't allocate much CPU time. But, if there are many active hosts on the LAN, the problem related to CPU time will be different.

2. Environment

2.1 WinArpSpoofer

System environments using WinArpSpoofer are as follows:

  • Local OS: All Windows platforms
  • Remote OS: All computers and network devices having an ARP table
  • Requisite driver: Current version must install WinPcap Driver (as recent as possible)
  • Main Memory: 64 MB or more
  • HDD: Free space should be 10 MB or more

We actually have tested this program on Windows NT/2000/XP/2003. I am not sure that Win 9x/ME can run this program. In addition, this program is later going to be used without the WinPcap driver.

2.2 CBuildPacket

To use the CBuildPacket class, the WinPcap driver is needed; the IPHlpApi library in the Platform SDK is needed also.

3. The Methods for spoofing ARP Table

3.1 Notations.

  • A,B,a,b: Active computer entities on network. When programming, this means an Ethernet MAC address.
  • Target: A target computer against spoofing attack.
  • Attacker: An attacker's computer.
  • aIP,bIP: IP address of A,B.
  • aMAC,bMAC: MAC address of A,B.
  • TargetMAC: MAC address of the target computer.
  • TargetIP: IP address of the target computer.
  • AttackerMAC: MAC address of the attacker.
  • AttackerIP: IP address of the attacker.
  • ARPrequest: A -> B with (aIP,aMAC,bIP,bMAC): In a ARP packet meaning "ARP who has," to put (IP address of ARP Source A, MAC address of ARP Source A, IP address of ARP Target b, MAC address of ARP Target b) and to transfer A to B.
  • ARPreply: A -> B with (aIP,aMAC,bIP,bMAC): A responsive packet of ARPrequest.

3.2 How to spoof the ARP table

ARPrequest: Attacker -> Target with (aIP, AttackerMAC, TargetIP,TargetMAC)

or

ARPreply: Attacker -> Target with (aIP, AttackerMAC, TargetIP,TargetMAC)

If you do as shown above, an ARPrequest with the wrong information is sent to a target computer and the the target computer knows that the MAC address of A is the Attacker's MAC addres in the ARP table. Therefore, all the packets that the target sends to A are sent to the Attacker.

ARPreply packets are used to keep ARP spoofing. Likewise, the target knows that the MAC address of A is the MAC address of the Attacker in an ARP table. Therefore, all the packets that Target sends to A are sent to the Attacker.

3.3 How to recognize that there is the same IP address on the network

ARPreply: Attacker -> Target with (TargetIP, aMAC, TargetIP,TargetMAC)

or

ARPrequest: Attacker -> Target with (TargetIP, aMAC, TargetIP,TargetMAC)

If you do as shown above, a target computer recognizes that there is the same IP address on the local area network, so the target computer will show "collision of network ip address."

3.4 how to recover spoofing (Unspoofing)

ARPreply : Attacker -> Target with (aIP, aMAC, TargetIP,TargetMAC)

If a correct ARPreply packet to the target is sent to the target as above, the spoofed ARP table should be recovered.

4. How to use WinArpSpoofer

This section describes the installation and usage of WinARpSpoofer program.

4.1 Software requirement

4.2 Installation

  1. Install the WinPcap driver.
  2. Run WinArpSpoofer.

4.3 Using WinArpSpoofer

Figure 2 is the user interface of the WinArpSpoofer program; this section describes function of the buttons as follows.

4.3.1 Function descriptions

Figure 2: WinArpSpoofer Screen Snapshot

Figure 3: Adapter Snapshot of Options

Figure 4: Spoofing Snapshot of Options

Button Function/Description
Opens the saved hosts.
Saves the contents in the list.
Scans the active computer hosts on the Local Area Network. It can scan C Class, 255 hosts at one time. By thread processing, the results are displayed in a ListBox in a short time (~1–2 seconds). After you click the Scan button, you click the "Start" button.
Starts spoofing the ARP tables of the computers displayed in the ListBox. As to the poisoning of the ARP cache against the remote computers, the MAC address of the gateway is changed to the attacker's MAC address. The method to prove this is to type "arp -a" on the target computer. This function has also the features that this program acts as a router while spoofing and pulling all the packets on the LAN. Because of this, although ARP spoofing happens on the LAN, Internet use of the target computer is no problem. While spoofing, the Stop button is enabled.
If the "Start" button is pressed, the "Stop" button will be enabled. While the "Stop" button is enabled, it keeps spoofing. The "Stop" function recovers the spoofed ARP table. Although the "Stop" function isn't run, most of ARP tables are recovered in a normal time (about 30 seconds). In addition, while "Stop" is enabled, the "Scan" and "Options" buttons can't be pressed.
Sets the option value of this program.
Downloads the latest version of this program.
Describes the features and the basic system requirements.
As one of spoofing types by default, intercepts and forwards all the packets to and from the gateway.
As one of spoofing types, intercepts and forwards all the packets to the gateway.
As one of spoofing types, intercepts all the packets from the gateway and forwards them to the target computer.

5. Using CBuildPacket Class

5.1 Overview

CBuildPacket is designed to send the built ARP, TCP, and ICMP packets to the network. There are many libraries or components such as Libnet and so forth on the Internet, but they have some weak points such as decreasing readability. So, this class is developed. The source of CBuildPacket will be opened.

5.2 Member functions

  • OpenAdapter( ): Opens an adapter of the local computer.
  • BuildARP( ): Builds an ARP packet.
  • SendPacket( ): Sends the built packet to the network.
  • CloseAdapter( ): Closes the opened adapter.
  • ConvertMACStrToHex( ): Converts a string MAC address to a 6-byte MAC hexed value.

5.2 ARP Spoofing code by using CBuildPacket

#include <packet32.h>
#include <BuildPacket.h>

CString Target;        // Ethernet Address of Target
CString Attacker;      // Ethernet Address of Attacker
CString Gateway;       // Ethernet Address of Gateway
CString TargetIP;      // IP Address of Target
CString AttackerIP;    // IP Address of Attacker
CString GatewayIP;     // IP Address of Gateway
CString TargetMAC;     // MAC Address of Target
CString AttackerMAC;   // MAC Address of Attacker
CString GatewayMAC;    // MAC Address of Gateway
.
.
.
void SpoofApp::SpoofTarget()
{
   CBuildPacket *arpPacket = new CBuildPacket;

   arpPacket.OpenAdapter( AdapterName );  // To open an adapter
   arpPacket.BuildARP(                    // To build a ARP packet
      Attacker, Target, ARPOP_REQUEST     // for Transmission on MAC
                                          // layer
     GatewayIP, AttackerMAC,              // Spoof IP address of
                                          // Gateway to Attacker IP
      TargetIP, TargetMAC                 //
   );
   arpPacket.SendPacket();      // Send a packet to network
   arpPacket.CloseAdapter();    // To close the adapter
}

5.3 Causing same IP address to collide by using CBuildPacket

void SpoofApp::CollideTargetIP()
{
   CBuildPacket *arpPacket = new CBuildPacket;

   arpPacket.OpenAdapter( AdapterName );  // To open an adapter
   arpPacket.BuildARP(                    // To build a ARP packet
      Attacker, Target, ARPOP_REQUEST     // for Transmission on MAC
                                          // layer
      TargetIP, AttackerMAC,              // Collision because source
                                          // TargetIP is dest TargetIP
      TargetIP, TargetMAC                 //
   );
   arpPacket.SendPacket();                // Send a packet to network
   arpPacket.CloseAdapter();              // To close the adapter
}

5.4 Unspoofing code by using CBuildPacket

void SpoofApp::UnspoofTarget ()
{
   CBuildPacket *arpPacket = new CBuildPacket;

   arpPacket.OpenAdapter( AdapterName );  // To open an adapter
   arpPacket.BuildARP(                    // To build a ARP packet
      Attacker, Target, ARPOP_REPLY       // for Transmission on MAC layer
      GatewayIP, GatewayMAC,              // To recover spoofed ARP Table
      TargetIP, TargetMAC                 //
   );
   arpPacket.SendPacket();                // Send a packet to network
   arpPacket.CloseAdapter();              // To close the adapter
}

6. Conclusion

This article has explained what ARP Spoof is and how to use WinArpSpoof based on CBuildPacket. I believe that the WinArpSpoof program will be a strong Windows-based ARP spoofer program with GUI.

References

http://www.nextsecurity.net/
http://winpcap.polito.it/
http://www.ietf.org/rfc/rfc0826.txt

Document History

Date Description Editor
2004-03-16 Version 0.1 n
  • This program is released.
Gordon Ahn
2004-04-14 Version 0.2
  • User Interface has been newly updated.
  • The each active host can be selected or deselected.
  • Added the live update feature.
  • The contents in the list can be saved to or opened from a file.
  • The feature of acting as a router can be toggled.
Gordon Ahn


Downloads