
    hR                     $   d Z ddlZddlZddlZddlZddlZddlmZmZ ddl	m
Z
 ddlmZ ddlmZmZmZ ddlmZmZ ddlmZmZmZ dd	lmZmZmZmZmZ dd
lmZ e
j         ddl!Z"g dZ# ee#d          e
_$         ee#d          e
_%         ee#d          e
_&         ee#d          e
_'         G d de          Z(d\  a)a*a+a,d Z- e-             d Z.d Z/d Z0e
j1        j2        d             Z3d Z4e
j1        j2        dd            Z5	 	 ddZ6d Z7dS ) z+
Clone of p0f v2 passive OS fingerprinting
    N)KnowledgeBaseselect_path)conf)raw)IPTCP
TCPOptions)	NoPayloadPacket)warningScapy_Exceptionlog_runtime)RandIntRandByteRandNum	RandShort
RandString)sniff)z/etc/p0fz/usr/share/p0fz
/opt/localzp0f.fpzp0fa.fpzp0fr.fpzp0fo.fpc                       e Zd Zd Zd ZdS )p0fKnowledgeBasec                 0    t          j        | |           d S N)r   __init__)selffilenames     W/mounts/lovelace/software/anaconda3/lib/python3.11/site-packages/scapy/modules/p0fv2.pyr   zp0fKnowledgeBase.__init__6   s    tX.....    c                 x   	 t          | j                  }n&# t          $ r t          d| j                   Y d S w xY w	 g | _        |D ]}|d         dv rt          |                    d                    }t          |          dk     rCd fd|dd	         D             }| j                            |d         |d         |d         |d
         |d	         |d         |d         |d         d d         f           n&# t          $ r t          d           d | _        Y nw xY w|
                                 d S )NzCan't open base %sr   )#
:   c                 L    |                                  rt          |           S | S r   )isdigitint)xs    r   a2iz'p0fKnowledgeBase.lazy_init.<locals>.a2iI   s"    yy{{ &"1vvHr   c                 &    g | ]} |          S  r)   ).0er'   s     r   
<listcomp>z.p0fKnowledgeBase.lazy_init.<locals>.<listcomp>M   s!    000cc!ff000r                     z,Can't parse p0f database (new p0f version ?))openr   IOErrorr   basetuplesplitlenappend	Exceptionclose)r   flinelir'   s       @r   	lazy_initzp0fKnowledgeBase.lazy_init:   s   	T]##AA 	 	 	($-888FF		DI C C7k))TZZ__--t99q==   1000d1Q3i000 	  $q'2a5"Q%AQ"&q'47DGCRCL"B C C C CC"  	 	 	BCCCDIII	 	
					s    ;;C D    D#"D#N)__name__
__module____qualname__r   r@   r)   r   r   r   r   5   s2        / / /    r   r   )NNNNc                      t          t          j                  at          t          j                  at          t          j                  at          t          j                  a	d S r   )
r   r   p0f_basep0f_kdb	p0fa_basep0fa_kdb	p0fr_basep0fr_kdb	p0fo_basep0fo_kdbr)   r   r   p0f_load_knowledgebasesrM   \   sB    t}--G//H//H//HHHr   c                     | dz  dk    rt           S | dz  dk    rt          S | dz  dv rt          S | dz  dk    rt          S d S )N   r/      )r.         )rF   rH   rJ   rL   )flagss    r   p0f_selectdbrT   g   sW    t|s					$	$			tr   c                 8	   |                                  } |                     t          |                     } |                     t                    r|                     t
                    rp|                     t                    } t          | j        t
                    rn;| j        } |                     t                    r|                     t
                    pt          | t                    rt          | j        t
                    st          d          t          | j        j                  }| j        }t          |           }|dk    r|t          k    rd}nd}|t          k    rd}d}d}d}d}| j        j        dz  d	z
  }| j        j        D ]@}	|d
z  }|	d         dk    r,|dt%          |	d
                   z   dz   z  }|	d
         }|dz  }@|	d         dk    r$|dt%          |	d
                   z   dz   z  }|dz  }p|	d         dk    r7|	d
         d         dk    r|dz  }n|dz  }|	d
         d
         dk    rd}|dz  }|	d         dk    r|dz  }|d
z  }|	d         dk    r|dz  }|	d         dk    r|dz  }|dk    rd}t          |	d         t$                    r!|dt&          d
         |	d                  z  z  }2|d|	d         z  z  }B|d d         }|dk    rd}| j        j        }
|dk    rI|dk    r|
|z  dk    rdt%          |
|z            z   }
n$|
|dz   z  dk    rd t%          |
|dz   z            z   }
t%          |
          }
d}|t          k    r| j        j        d!z  d!k    r|d"z  }| j        j        | j        j        k    r|d#z  }| j        j        dk    r|d$z  }|r|d%z  }| j        dk    r|d&z  }| j        g k    r|d'z  }| j        j        dk    r|d(z  }| j        j        dk    r|d)z  }| j        j        dk    r|d*z  }|r|d z  }|t          k    r| j        j        d+z  dk    r|d,z  }n| j        j        dz  dk    r|d,z  }|t          k    r$t          | j        j        t4                    s|d-z  }|dk    rd}||
|| j        j        |||ffS ).NNot a TCP/IP packetd   *r    r3   Fr/   rQ   r-   MSSM,   WScaleW	TimestampzT0,zT,T	   SAckOKzS,NOPzN,EOLzE,z?%i,.S(   TrR   KQ0PZIUXA    FD)copy	__class__r   haslayerr   r   getlayer
isinstancepayload	TypeErrorrT   rS   ttlr9   rJ   rL   dataofsoptionsstrr	   windowseqackidurgptrreservedr
   DF)pktdbr|   ssooomssqqTqqPilenoptionwinqqs               r   
packet2p0fr   y   s   
((**C
--C
!
!C
,,r

 s||C00 ll2ck3'' 	k	 ,,r

 s||C00  c2 /jc&B&B /-... 
ck'	(	(B 'C	SB	Cxx>> BBB	X~~
C
C
C
CK1$*D+%  *  *	!93VAY'#--C)CAIDDAY(""3VAY'#--CAIDDAY+%%ay|q  utay|q  AIDDAY(""4KCAIDDAY%4KCCAY%4KCaxx&)S)) *v
1fQi 888vq	))
crc(C
byy
+
C
byy!88c	QC#I&CCC"H""C38,---C
c((C	B	X~~;t#t++ #IB
 {#+/)) 	c	
{! 	c	
 
c	
v{{
c	
{b
c	
{Q
c	
{q  
c	
{!
c	
 
c		X~~;t#q(( #IB;t#q((#IB	X~~j)<iHH~
c	 
Rxxc39<S"566r   c                 ,   d}|| d         |d         k    pn|d         dk    pb|d         d         dk    oP| d                                          o6t          | d                   t          |d         dd                    z  dk    z  }||d         | d         k    o|d         | d         z
  dk     z  }dD ]#}|| |         ||         k    p||         dk    z  }$|| d         |d         k    z  }| d                             d	          }|d                             d	          }t          |          t          |          k    rQd
}t	          t          |                    D ]}||         ||         k    st          ||                   dk    rIt          ||                   dk    r0||         d         dk    r||         d         ||         d         k    st          ||                   dk    rt          ||                   dk    ro||         d         dk    r]||         d         ||         d         k    r?t          ||         dd                    t          ||         dd                    z  dk    sd} n|r|t          |          z  }|S )Nr   rX   %r-   rr   )r/   r0   r]   r.   r\   Tr/   F)r$   r%   r8   r9   range)r&   ydixoptyoptsames          r   
p0f_correlr     s}   	A !A$!A$,
q!A$#+
q!A$q'S.*pQqT\\^^*pQTUVWXUYQZQZ]`abcdaefgfhfhai]j]jQjopPprA!A$!A$,
+1Q4!A$;+,A + +	adadl)adck*11AQ4::c??DQ4::c??D
4yyCIIs4yy!! 	 	AGtAw&&a\\Q&&3tAw<<!+;+;!WQZ3&&471:a+C+Ca\\A%%#d1g,,*:*:!WQZ3&&471:a+C+Ca%%DGABBK(8(88A== 	TNAHr   c                    t          |           \  }}|r|                                }ng }|st          d           g S g }t          |d                             d                    dz   }|D ]U}t          ||          }||k    r=|                    |d         |d         |d         | t                   j        z
  f           V|S )ziPassive OS fingerprinting: which OS emitted this TCP packet ?
p0f(packet) -> accuracy, [list of guesses]
zp0f base empty.r.   r\   r0   r1   r2   r-   )	r   get_baser   r9   r8   r   r:   r   r|   )r   r   sigpbrmaxbr   s           r   p0fr   #  s    
 ooGB	 [[]] !"""	
A
c!fll3
 
 1
$C 7 7sA88HHadAaD!A$R"45666Hr   c           
         	 t          |           }n# t          $ r Y dS w xY w|g k    rEddd                    t          t          t          |           d                             z   dz   df}n|d         }d}	 t          |           }n# t          $ r Y nw xY w|dk    rd}|                     d|d         z   d	z   |d         z             }|/||                     d
t	          |dz            z   dz             z  }n||                     d          z  }|d         |dt	          |d                   z   dz   z  }t          |           dS )z,Calls p0f and returns a user-friendly outputNUNKNOWN[r!   r-   z:?:?]r   z%IP.src%:%TCP.sport% -  z (up: i  z- hrs)
  -> %IP.dst%:%TCP.dport% (%TCP.flags%)z(
  -> %IP.dst%:%TCP.dport% (%TCP.flags%)r/   z (distance ))	r   r;   joinmapr   r   
pkt2uptimesprintfprint)r   r   uptimeress       r   prnp0fr   :  ss   HH   Bwwchhs3
30B'C'CDDDwNPTUaDFC   {{
++/!A$6<qtC
D
DCs{{8c&4-&8&88;kkllls{{FGGGt}s1Q4yy(3..	#JJJJJs    
  9B	 	
BBrW   c                 X   t          | t                    st          d          t          | t                    rt          d          t          | t                    st          | j                  S | j        D ]#}|d         dk    r|d         d         |z  }|c S $t          d          )zzCalculate the date the machine which emitted the packet booted using TCP timestamp  # noqa: E501
pkt2uptime(pkt, [HZ=100])zNot a TCP packetr   r`   r-   zNo timestamp option)ry   r   r{   r
   r   r   rz   r~   )r   HZoptts       r   r   r   V  s     c6"" ,*+++#y!! ,*+++c3 '#+&&&{  q6[   Aq	BAHHH	 !
 )
*
**r     c                 j   |                                  } |                     t                    r|                     t                    rp|                     t                    } t          | j        t                    rn;| j        } |                     t                    r|                     t                    pt          | t                    rt          | j        t                    st          d          t          | j        j	                  }r7|
                                }|g }fd|D             }rfd|D             }n|r|g}nt                      |         }|t          k    r,| j        j	        dz  dk    rd |D             }nd |D             }|st          d          |t          j        d	t!          |          d
z
                     }	t#          | j        j                  }
d  |
                    d                    } |
                    d                    }fd|
                    dd          D             }g }|	d         dk    r|	d                             d          D ]}|d	         dk    rD|	d	         d	         dk    r!dt+          |	d	         d
d                   z  }nd}|rd	|cxk    r|k    sn d}|d
d         dk    rG||                    d|f           n)|                    dt          j        d
|          f           n|d
         dk    rmt+          |dd                   }|"||z  d	k    r|                    d|f           n|                    d|t          j        d
||z            z  f           n|                    dt+          |d
d                   f           nV|d	         dk    r|rd	|cxk    rdk     sn d}|d
d         dk    r@||                    d|f           n|                    dt/                      f           n|d
         dk    rit+          |dd                   }|"||z  d	k    r|                    d|f           n|                    d|t1          d
d|z            z  f           ns|                    dt+          |d
d                   f           nE|dk    r|                    d           n(|dk    r||}n<|d	         rd	|d	         cxk     rd k     rn n	|d	         }nt          j        d!d"          }d|	d#         vrd	}n<|d
         rd	|d
         cxk     rd k     rn n	|d
         }nt          j        d
d$          }|                    d||ff           n}|dk    r|                    d%           n`|d&k    r|                    d'           nC|d(k    r|                    d)           n&|d	         d*k    r	t+          |d
d                   t2          d	         v rt2          d	         t+          |d
d                            d	         }t2          d	         t+          |d
d                            d
         }|                    |t5          j        |t9          t5          j        |                                                              f           n=|                    t+          |d
d                   d+f           nt?          d,|           || j        _        |	d	         dk    rtA                      | j        _!        n>|	d	         "                                r!t+          |	d	                   | j        _!        n|	d	         d	         dk    r?t+          |	d	         d
d                   }|t1          d
d|z            z  | j        _!        n|	d	         d	         dk    r+|t+          |	d	         d
d                   z  | j        _!        nu|	d	         d	         dk    rTd- |D             }|st          d.          |d	         d
         t+          |	d	         d
d                   z  | j        _!        nt          d/          |	d
         |z
  | _#        | xj	        d|	d         z  z  c_	        |	d#         dk    r|	d#         D ]}|d0k    rd	| _$        |d1k    rtA                      | j        _%        0|d2k    rtM                      | j        _'        O|d3k    rK|tP          k    r| j        xj	        d4z  c_	        v| j        xj	        t          j)        g d5          z  c_	        |d6k    rD|tP          k    r9| tU          j+        t9          t          j        d
d7                    8          z  } |d9k    r| j        j'        | j        _,        d:|	d#         v rd	| j        _,        n(| j        j,        d	k    rtM                      | j        _,        | j-        r| j-        } | j-        | S );a  Modifies pkt so that p0f will think it has been sent by a
specific OS.  If osdetails is None, then we randomly pick up a
personality matching osgenre. If osgenre and signature are also None,
we use a local signature (using p0f_getlocalsigs). If signature is
specified (as a tuple), we use the signature.

For now, only TCP Syn packets are supported.
Some specifications of the p0f.fp file are not (yet) implemented.rV   Nc                 ,    g | ]}|d          k    |S )r1   r)   )r*   r&   osgenres     r   r,   z#p0f_impersonate.<locals>.<listcomp>  s"    ///Aqtwar   c                 ,    g | ]}|d          k    |S )r2   r)   )r*   r&   	osdetailss     r   r,   z#p0f_impersonate.<locals>.<listcomp>  s'    5551Q49#4#4!#4#4#4r   r.   c                 &    g | ]}d |d         v |S ri   r0   r)   r*   r&   s     r   r,   z#p0f_impersonate.<locals>.<listcomp>  s!    ///3!A$;;!;;;r   c                 &    g | ]}d |d         v|S r   r)   r   s     r   r,   z#p0f_impersonate.<locals>.<listcomp>  s!    3333ad??!???r   zNo match in the p0f databaser   r-   c                 4    t          | t                    r| nd S r   )ry   r%   )vals    r   <lambda>z!p0f_impersonate.<locals>.<lambda>  s    *S#"6"6@33D r   rZ   r^   c                 &    g | ]} |          S r)   r)   )r*   oint_onlys     r   r,   z#p0f_impersonate.<locals>.<listcomp>  s!    MMMqxx{{MMMr   r`   )NNre   r\   r[   rf   i  rX   r   r/   r_         )minr   T0)r`   )r   r   rh   l        x   l    w r0   l    )rb   rY   N)rc   NE)rd   N?rY   zunhandled TCP option %sc                 *    g | ]}|d          dk    |S )r   rZ   r)   r   s     r   r,   z#p0f_impersonate.<locals>.<listcomp>  s!    333QQqTU]]q]]]r   z5TCP window value requires MSS, and MSS option not setz#Unhandled window size specificationrm   ro   rq   rs   rr   )r"   rr   rg   rt   
   )loadrj   rk   ).ru   rw   r   r   rx   ry   rz   r{   rT   rS   r   p0f_getlocalsigsrJ   r   randomrandintr9   dictr~   getr8   r%   r:   r   r   r	   structunpackr   calcsize_fixr   r   r   r$   r|   r   r   r   r   rL   choicer   	raw_layerr   
underlayer)r   r   r   	signature	extrahopsmtur   r   r   pers	orig_optsmss_hintwscale_hintts_hintr~   r   maxmsscoefts_ats_boptname	optstructr   r   r   s    ``                     @r   p0f_impersonater   i  s
    ((**C
,,r

 s||C00 ll2ck3'' 	k	 ,,r

 s||C00  c2 /jc&B&B /-...	ck'	(	(B 
$[[]]:B/////// 	65555R555B	 $[#	X~~;s"c))//R///BB33R333B ><===fnQB!,,-D S[())I@@Hx	e,,--H(9==2233KMMMMIMM+|$L$LMMMGGAw#~~7==%% Z	* Z	*C1v}} 71:$$'CQ,<,<<FF'F $A$;$;$;$;V$;$;$;$;#H
 qrr7c>>+x'89999v~a/H/H'IJJJJVs]]s122w<<D+410D0Dx'89999!4&.FdN*K*K#K(M N N N N NNE3s122w<<#89999Q3 'qK'>'>'>'>$'>'>'>'>"&Kqrr7c>>".+'>????(**'=>>>>Vs]]s122w<<D".;3E3J3J+'>????$dWd@R-S-S-S&S(U V V V V NNHc#abb'll#;<<<<45555%!DDQZ IA
$:$:$:$:U$:$:$:$:$: #1:DD!>#/GHHDd1g%%DDQZ 	8A
$:$:$:$:U$:$:$:$:$:"1:DD ">!Y77DdD\:;;;;~....}----}----Q3s122w<<:a=00(mCABBLL9!<G *1c#abb'll ;A >INNG$*M)2<V_Y=W=W2X2X2]2]2_2_%a %a$b c c c c NNCABBLL"#56666 13777")CK Aw#~~&[[	a		 E a\\	as		47122;!G	d7J$K$K$KK	as		 3tAwqrr{#3#33	as		33'333 	[!"YZZZ VAYT!WQRR[)9)99CDDD 1g	!CGII!d1g+II Aw#~~q' 	2 	2B Syys%.[[""s")))s>>K%%-%%%K%%{{{)C)CC%%%srX~~t~:fnQ6K6K+L+LMMMMs"%+/
 d1g~~	A		!))
. n . Jr   c                  0  	 t          j                    } t          j        dd          }| dk    ri 		fd}t          j                            d          d         }d}t          |dt          |          z   |d	          }|D ]}t          |          D ]} ||            t          j	        | d           n| dk     rt          j        d
           nt          j        d           t          j        t          j        t          j                  }	 |                    d|f           n# t          j        $ r Y nw xY w|                    d|f           |                    d|f           |                                 t          j        d           	S )a  This function returns a dictionary of signatures indexed by p0f
db (e.g., p0f_kdb, p0fa_kdb, ...) for the local TCP/IP stack.

You need to have your firewall at least accepting the TCP packets
from/to a high port (30000 <= x <= 40000) on your loopback interface.

Please note that the generated signatures come from the loopback
interface and may (are likely to) be different than those generated on
"normal" interfaces.i0u  i@  r   c                     | d         vr| d         g| d         <   d S | d         | d                  vr)| d                                       | d                    d S d S )Nr   r-   )r:   )r   results    r   	addresultz#p0f_getlocalsigs.<locals>.addresultG  sp     1vV##"%a&s1vq6A//3q6N))#a&11111 0/r   z	127.0.0.1   ztcp and port r]   )ifacefiltercounttimeoutz
fork errorr-   )type)osforkr   r   r   router   r   r   waitpidr   errortimesleepsocketAF_INETSOCK_STREAMconnectbindr<   _exit)
pidportr   r   r   plr   elts1r   s
            @r   r   r   7  s    '))C>%''D
Qww	2 	2 	2 	2 	2 
  --a0 T'B%YZ[[[ 	 	C!#  	#

3	q,'''' 	
1]6>0BCCC	JJT*++++| 	 	 	D	 	d#$$$


K&'''




Ms   D+ +D=<D=)rW   )NNNr   r   N)8__doc__r   r   r   r   r   
scapy.datar   r   scapy.configr   scapy.compatr   scapy.layers.inetr   r   r	   scapy.packetr
   r   scapy.errorr   r   r   scapy.volatiler   r   r   r   r   scapy.sendrecvr   r   scapy.routescapy	_p0fpathsrE   rG   rI   rK   r   rF   rH   rJ   rL   rM   rT   r   r   commandsregisterr   r   r   r   r   r)   r   r   <module>r     s      				   1 1 1 1 1 1 1 1             1 1 1 1 1 1 1 1 1 1 * * * * * * * * = = = = = = = = = = L L L L L L L L L L L L L L            :888	Ix00Y	22Y	22Y	22(! ! ! ! !} ! ! !H )? %8X0 0 0       $J7 J7 J7Z  :   ,  8 + + + +$ BF26K K K K\4 4 4 4 4r   