Running Hosts scanner leveraging ICMP Destination Unreachable response upon UDP closed port packet.

host-scanner-via-udp.py

#!/usr/bin/python

#
# Simple UDP scanner determining whether scanned host replies with
# ICMP Desitnation Unreachable upon receiving UDP packet on some high, closed port.
#
# Based on "Black Hat Python" book by Justin Seitz.
#
# Mariusz B.
#

import os
import sys
import time
import ctypes
import struct
import socket
import threading
from datetime import datetime

try:
    from netaddr import IPNetwork, IPAddress
except ImportError:
    print('[!] No module named "netaddr". Please type:\n\tpip install netaddr')
    sys.exit(1)

DEBUG = False

# Ports that will be used during scanning, considered as most likely closed ports.
SCAN_PORTS = range(65212, 65220)

HOSTS_UP = set()
MAGIC_MESSAGE = '\xec\xcb\x5c\x6f\x41\xbe\x2e\x71\x9e\xd1'


class ICMP(ctypes.Structure):
    _fields_ = [
        ('type',        ctypes.c_ubyte),
        ('code',        ctypes.c_ubyte),
        ('chksum',      ctypes.c_ushort),
        ('unused',      ctypes.c_ushort),
        ('nexthop',     ctypes.c_ushort)
    ]

    def __new__(self, sockBuff = None):
        return self.from_buffer_copy(sockBuff)

    def __init__(self, sockBuff = None):
        self.types_map = {
            0:'Echo Reply',1:'Unassigned',2:'Unassigned ',3:'Destination Unreachable',
            4:'Source Quench',5:'Redirect',6:'Alternate Host Address',7:'Unassigned',
            8:'Echo',9:'Router Advertisement',10:'Router Solicitation',11:'Time Exceeded',
            12:'Parameter Problem',13:'Timestamp',14:'Timestamp Reply',15:'Information Request',
            16:'Information Reply',17:'Address Mask Request',18:'Address Mask Reply',
            30:'Traceroute',31:'Datagram Conversion Error',32:'Mobile Host Redirect',
            33:'IPv6 Where-Are-You',34:'IPv6 I-Am-Here',35:'Mobile Registration Request',
            36:'Mobile Registration Reply',37:'Domain Name Request',38:'Domain Name Reply',
            39:'SKIP',40:'Photuris'
        }

        # Human readable protocol
        try:
            self.message = self.types_map[self.type]
        except:
            self.message = str('')

#
# IPv4 packet structure definition in ctypes.
#
class IP(ctypes.Structure):
    _fields_ = [
        ('ihl',             ctypes.c_ubyte, 4),
        ('version',         ctypes.c_ubyte, 4),
        ('tos',             ctypes.c_ubyte),
        ('len',             ctypes.c_ushort),
        ('id',              ctypes.c_ushort),
        ('offset',          ctypes.c_ushort),
        ('ttl',             ctypes.c_ubyte),
        ('protocol_num',    ctypes.c_ubyte),
        ('sum',             ctypes.c_ushort),
        ('src',             ctypes.c_ulong),
        ('dst',             ctypes.c_ulong)
    ]

    def __new__(self, socketBuffer = None):
        return self.from_buffer_copy(socketBuffer)

    def __init__(self, socketBuffer = None):
        # Map protocol constants to their names.
        self.protocol_map = {
            0:'HOPOPT',1:'ICMP',2:'IGMP',3:'GGP',4:'IPv4',5:'ST',6:'TCP',7:'CBT',8:'EGP',
            9:'IGP',10:'BBN-RCC-MON',11:'NVP-II',12:'PUP',13:'ARGUS',14:'EMCON',15:'XNET',16:'CHAOS',
            17:'UDP',18:'MUX',19:'DCN-MEAS',20:'HMP',21:'PRM',22:'XNS-IDP',23:'TRUNK-1',24:'TRUNK-2',
            25:'LEAF-1',26:'LEAF-2',27:'RDP',28:'IRTP',29:'ISO-TP4',30:'NETBLT',31:'MFE-NSP',32:'MERIT-INP',
            33:'DCCP',34:'3PC',35:'IDPR',36:'XTP',37:'DDP',38:'IDPR-CMTP',39:'TP++',40:'IL',
            41:'IPv6',42:'SDRP',43:'IPv6-Route',44:'IPv6-Frag',45:'IDRP',46:'RSVP',47:'GRE',48:'DSR',
            49:'BNA',50:'ESP',51:'AH',52:'I-NLSP',53:'SWIPE',54:'NARP',55:'MOBILE',56:'TLSP',
            57:'SKIP',58:'IPv6-ICMP',59:'IPv6-NoNxt',60:'IPv6-Opts',62:'CFTP',64:'SAT-EXPAK',
            65:'KRYPTOLAN',66:'RVD',67:'IPPC',69:'SAT-MON',70:'VISA',71:'IPCV',72:'CPNX',
            73:'CPHB',74:'WSN',75:'PVP',76:'BR-SAT-MON',77:'SUN-ND',78:'WB-MON',79:'WB-EXPAK',80:'ISO-IP',
            81:'VMTP',82:'SECURE-VMTP',83:'VINES',84:'TTP',84:'IPTM',85:'NSFNET-IGP',86:'DGP',87:'TCF',88:'EIGRP',
            89:'OSPFIGP',90:'Sprite-RPC',91:'LARP',92:'MTP',93:'AX.25',94:'IPIP',95:'MICP',96:'SCC-SP',
            97:'ETHERIP',98:'ENCAP',100:'GMTP',101:'IFMP',102:'PNNI',103:'PIM',104:'ARIS',
            105:'SCPS',106:'QNX',107:'A/N',108:'IPComp',109:'SNP',110:'Compaq-Peer',111:'IPX-in-IP',112:'VRRP',
            113:'PGM',115:'L2TP',116:'DDX',117:'IATP',118:'STP',119:'SRP',120:'UTI',
            121:'SMP',122:'SM',123:'PTP',124:'ISIS',125:'FIRE',126:'CRTP',127:'CRUDP',128:'SSCOPMCE',
            129:'IPLT',130:'SPS',131:'PIPE',132:'SCTP',133:'FC',134:'RSVP-E2E-IGNORE',135:'Mobility',136:'UDPLite',
            137:'MPLS-in-IP',138:'manet',139:'HIP',140:'Shim6',141:'WESP',142:'ROHC'
        }

        # Human readable IP addresses.
        self.src_address = socket.inet_ntoa(struct.pack('<L', self.src))
        self.dst_address = socket.inet_ntoa(struct.pack('<L', self.dst))

        # Human readable protocol
        try:
            self.protocol = self.protocol_map[self.protocol_num]
        except:
            self.protocol = str(self.protocol_num)


def udpSend(subnet, message):
    time.sleep(5)
    if DEBUG: print('[.] Started spraying UDP packets across {}'.format(str(subnet)))

    packets = 0
    ports = [x for x in SCAN_PORTS]
    sender = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)

    for ip in IPNetwork(subnet):
        try:
            for port in ports:
                sender.sendto(message, (str(ip), port))
                packets += 1
        except Exception, e:
            pass

    print('[.] Spraying thread finished. Sent: {} packets on {} hosts.'.format(
        packets, len(IPNetwork(subnet))
    ))

def processPackets(sniffer, subnet):
    global HOSTS_UP

    # Read in single packet
    try:
        packetNum = 0

        while True:
            packetPrint = ''
            packetNum += 1

            packet = sniffer.recvfrom((1 << 16) - 1)[0]

            # Create an IP header from the first 20 bytes of the buffer.
            ipHeader = IP(packet[0 : ctypes.sizeof(IP)])

            timeNow = datetime.now().strftime('%H:%M:%S.%f')[:-3]

            # Print out the protocol that was detected and the hosts.
            packetPrint += '[{:05} | {}] {} {} > {}'.format(
                packetNum, timeNow, ipHeader.protocol, ipHeader.src_address, ipHeader.dst_address,
            )

            if ipHeader.protocol == 'ICMP':
                offset = ipHeader.ihl * 4
                icmpBuf = packet[offset : offset + ctypes.sizeof(ICMP)]
                icmpHeader = ICMP(icmpBuf)

                packetPrint += ': ICMP Type: {} ({}), Code: {}\n'.format(
                    icmpHeader.type, icmpHeader.message, icmpHeader.code
                )

                if DEBUG: 
                    packetPrint += hexdump(packet)

                # Destination unreachable
                if icmpHeader.code == 3 and icmpHeader.type == 3:
                    if IPAddress(ipHeader.src_address) in IPNetwork(subnet):

                        # Make sure it contains our message
                        if packet[- len(MAGIC_MESSAGE):] == MAGIC_MESSAGE:
                            host = ipHeader.src_address
                            if host not in HOSTS_UP:
                                print('[+] HOST IS UP: {}'.format(host))
                                HOSTS_UP.add(host)
                
                if DEBUG:
                    print(packetPrint)

    except KeyboardInterrupt:
        return

def hexdump(src, length = 16):
    result = []
    digits = 4 if isinstance(src, unicode) else 2
    num = len(src)
    
    for i in range(0, num, length):
        s = src[i:i+length]
        hexa = b' '.join(['%0*X' % (digits, ord(x)) for x in s])
        text = b''.join([x if 0x20 <= ord(x) < 0x7f else b'.' for x in s])
        
        result.append(b'%04x  |  %-*s  |  %s' % (i, length * (digits + 1), hexa, text)) 

    return '\n'.join(result)

def main(argv):
    global BIND

    if len(argv) < 3:
        print('Usage: ./udp-scan.py <bind-ip> <target-subnet>')
        sys.exit(1)

    bindAddr = sys.argv[1]
    subnet = sys.argv[2]

    sockProto = None
    if os.name == 'nt':
        sockProto = socket.IPPROTO_IP
    else:
        sockProto = socket.IPPROTO_ICMP

    sniffer = socket.socket(socket.AF_INET, socket.SOCK_RAW, sockProto)
    if DEBUG: print('[.] Binding on {}:0'.format(bindAddr))
    sniffer.bind((bindAddr, 0))

    # Include IP headers in the capture
    sniffer.setsockopt(socket.IPPROTO_IP, socket.IP_HDRINCL, 1)

    # In Windows, set up promiscous mode.
    if os.name == 'nt':
        try:
            sniffer.ioctl(socket.SIO_RCVALL, socket.RCVALL_ON)
        except socket.error, e:
            print('[!] Could not set promiscous mode ON: "{}"'.format(str(e)))

    # Sending thread
    threading.Thread(target=udpSend, args=(subnet, MAGIC_MESSAGE)).start()

    # Receiving thread
    recvThread = threading.Thread(target=processPackets, args=(sniffer, subnet))
    recvThread.daemon = True
    recvThread.start()

    time.sleep(15)
    if DEBUG: print('[.] Breaking response wait loop.')

    # Turn off promiscous mode
    if os.name == 'nt':
        try:
            sniffer.ioctl(socket.SIO_RCVALL, socket.RCVALL_OFF)
        except socket.error, e:
            pass

if __name__ == '__main__':
    main(sys.argv)