MPTCP(8)

NAME
Mptcp - TCP/IP Packet Manipulator and RSOI Handler

DESCRIPTION

Mpctp is a tool for raw packets manipulation that allows a large number of options. Its primary purpose is diagnose and test several scenarios that involving the use of TCP/IP packets. It's capable to send packets to any target type (like hostnames, IPs and MAC address) and manipulate many fields and headers like: Source/Destination IP address, Source/Destination MAC address, TCP flags, ICMP types, TCP/UDP/ICMP packet size, payloads ARP/RARP, etc.

Mptcp is also able to be managed over the RSOI mode (Remote System over IRC), where the software can surrender all control and machine resources to one channel on an remote IRC server. Also, too many types of network based attacks (like packet attacks) also are handled by MpTcp.

SYNOPSIS

[-cbzDvuRAUCWBSK] [-s source] [-d destination] [-p port] [-P source_port] [-q number_packets] [-F delay] [-n number_threads] [-x packet_size] [-t ttl] [-Ie] [-IE] [-Id] [-It] [-Iq] [-Im] [-M mask] [-lI] [-Tc] [-Ts] [-Ta] [-Tr] [-Tf] [-Tp] [-Tx] [-Tn] [-lT <-P port>] [-lC <-P port>] [-lU <-P port>] [-i interface] [-h source_mac] [-H destination_mac] [-lE>] [-a ip_address] [-f number_packets] [-r ip_address-ip_address] [-e ip_address] [-N irc_server] [-L irc_channel] [-G channel_password]

OPTIONS

<GLOBAL>

-d <destination>
    Destination host (hostname or IP address).

-s <source>
    Source host (hostname or IP address). If -s <host> option is not specified, the MpTcp assumes the IP address found by the first interface defined in the system: (eth0, eth1, eth2, etc...) ordinarily.

-p <port>
    Destination port (remote port).

-P <source_port>
    Source port (local port).

-i <interface>
    Specifies the interface option. (Eg: -i eth0).

-q <number_packets>
    Number of packets to send.

-x <packet_size>
    Sets the packet size. The package size can not be larger than 1470 bytes or larger than defined system MTU (eg: MTU=1500).

-t <ttl>
    Sets the TTL field

-c
    Continuous mode. Send packets without interruption with regular    interval of 1 (one) second between the shoots.

-F <delay>
    Flood option. Set the time <delay> between the shoots (in microseconds). The -F option cannot be used with -c or -b options.

-b  Super flood. This option puts MpTcp optimized to send the largest number of packets in a short amount of time.

-z  Don't wait for replies. Ignore packet responses.

-n <number_threads>
    Number of threads to use on send option.

-D  Display the packet content on received packets (tcpdump style).

-V  Print the Version.

--help
    Print the initial help page with arguments.

<ICMP Options>

-Ie Send an ICMP packet Type 8 (Echo Request). The target will respond with an ICMP packet Type 0 (Echo Reply) if it is alive.

-IE Send an ICMP packet Type 0 (Echo Reply).

-Id Send ICMP packets Type 15 (Information Request).

-It Send ICMP packets Type 13 (Timestamp Request).

-Iq Send ICMP packets Type 4 (Source Quench).

-Im Send ICMP packets Type 17 (Mask Request). If the target is configured to reply a request mask, a MaskReply packet will be received with the Mask.

-M <Mask>
    Send ICMP packets Type 18 (Mask Reply). The <Mask> argument is the mask defined to packet. (Eg: Mask is ffff0000 - 255.255.0.0).

-lI ICMP Listen Mode. Listen for incoming ICMP packets. Any ICMP packet "unicast" will be captured.

<TCP Options>

-Tc Simple TCP connection to target. The option -p port is required. This option uses connect() routine for synchronization.

-Ts Send a TCP SYN packet (TCP packet with the SYN bit on).

-Ta Send a TCP ACK packet (TCP packet with the ACK bit on)..

-Tf Send a TCP FINAL packet (TCP packet with the FIN bit on).

-Tr Send a TCP RESET packet (TCP packet with the RST bit on).

-Tp Send a TCP PUSH packet (TCP packet with the PSH bit on).

-Tx Send a TCP packet XMAS (TCP packet with the FIN-PUSH-URG bits on).

-Tn Send a NULL TCP packet (TCP packet with the NONE bits on. All tcp flags off).

-lT <-P port>
    TCP Listen Mode. Listen for incoming TCP packets. This option need be used with option "-P port".

-lC <-P port>
    Listen for TCP connections. This option need to be used with option "-P port". The TCP listen mode uses accept() function for synchronization.

<UDP Options>

-u  UDP mode.

-lU <-P port>
    UDP Listen Mode. Listens for incoming UDP packets. This option need be used with the option "-P port". The UDP listen mode doesn't use a stream connection.

<ARP/RARP Options>

-h <source_mac>
    Source MAC address. This option requires the source IP address, so If "-s <source>" is not given, MpTcp assumes by default the first IP address defined by the first interface found in the system (eth0, eth1, eth2, etc). Use form: -h AA:DD:CC:22:11:AA.

-H <destination_mac>
    Destination MAC address. Option required for ARP packets. This option requires a destination IP address. So if "-d <destination>" is not given, MpTcp will assumes by default a NULL value on this field header. Form eg: -H AA:DD:CC:22:11:AA.

-R  Defines the frame type like RARP packet. All ARP/RARP packets sent by MpTCp on the link layer are ARP by default. If "-R" is defined, then MpTcp send packets type RARP instead.

-A  Defines the ARP/RARP frame type like REQUEST packet. The packets sent by MpTcp on the link layer are REPLY by default. If "-A" is defined, then MpTcp sets the ARP/RARP packets to "REQUEST" type instead.

-a <ip_address>
    Arping Mode. This option sends ARP REQUEST packets to a given IP address. The target receives the packet and returns an ARP REPLY packet. This option is very useful for probing hosts that filter ICMP pings.

-f <number_packets>
    Mac Flood (CAUTION !!). This option sends ARP REPLY packets with SOURCE MAC, DESTINATION MAC, SOURCE IP ADDRESS and DESTINATION IP ADDRESS (randomly generated) on mode Super Food. If not specified the "-i <interface>" MpTcp takes the first valid interface found in the System. Eg usage: # mptcp -f 120000 - This option does a flooding by sending 120000 packets with random IP addresses and random MAC addresses. This attack is also called MAC FLOODING. Note: USE THIS OPTION VERY CAREFULLY. IT CAN OVERFLOW THE ROUTING TABLES OR AN UNEXPECTED BEHAVIOR OF THE SWITCHS AND NEIGHBORING'S HOSTS ON THE NETWORK.

-r <ip_address-ip_address>
    ARP Cannon (CAUTION !!). This option sets MpTcp to send ARP REPLY packets to all defined IP addresses inside the range "ip_address-ip_addresses". This packets will have destination MAC address defined to physical broadcast address (FF:FF:FF:FF:FF:FF) and source MAC address randomly generated. The option range (IP-IP) needs TO BE in the format shown below. Eg: # mptcp -r 10.1.1.1-10.1.1.240 - The above option does a flooding to destination physical broadcast FF:FF:FF:FF:FF:FF, saying to network enlace that all IP adresses in the range "10.1.1.1 to 10.1.1.240" will have source MAC addresses randomly generated. This attack is also called MASSIVE ARP POISONING. This action probally TAKE DOWN for moments all IP addresses defined in the range argument. NOTE: USE THIS OPTION VERY CAREFULLY.

-e <ip_address>
    This option exclude the "ip address" from option ARP CANNON (-r ip-ip) above defined. Eg: # mptcp -r 10.1.1.1-10.1.1.240 -e 10.1.1.10 - The above option will exclude the IP address "10.1.1.10" from ARP CANNON attack.

-lA ARP/RARP Listen Mode. Listen for incoming ARP/RARP packets on link layer.

<WEB Stress Test Options>

-U  UDP attack. Send UDP packets on super flooding mode to HTTP host (default: Port 80).

-C  TCP connections attack. Does TCP connections to HTTP host (default: Port 80).

-W  WEB HTTP attack. Send HTTP requests (GET) on super flooding mode to HTTP host (default: Port 80).

-B  ICMP attack. Send ICMP packets on super flooding mode to HTTP host (also called Death Ping).

-S  TCP SYN attack. Send TCP SYN packets on super flooding mode to HTTP host (default: Port 80). Also called SYN Flood attack.

-K  TCP ACK attack. Send TCP ACK packets on super flooding mode to HTTP host (default: Port 80).

[INFO] Use the option -p <port> to set other port than 80.

<HIVE MIND (Mass Remote Control) options>
                RSOI - Remote System over IRC

-N <irc_server>
    IRC network to connect. This option is required to put MpTcp on RSOI mode.

-L <irc_channel>
    IRC #channel to connection. The channel must be defined without "#" character, where only the "IRC channel" must be typed. If this option is not given, then MpTcp will join on #mptcp channel by default. This option can be omitted.

-G <password>
    IRC channel's password (if exists). If this option is not given, then MpTcp will type the password's channel like "mptcp0" by default. This option can be omitted.

EXAMPLES

# mptcp -d hexcodes -Ie
    Send an ICMP packet (Echo Request) to host "hexcodes".

# mptcp -lI
    ICMP listen. Listen for all ICMP packets like PINGs.

# mptcp -It -d www.hexcodes.org -c
    Send ICMP packets (Timestamp Request) on continuous mode to server "www.hexcodes.org".

# mptcp -s 10.1.100.100 -d www.hexcodes.org -u -p 4140
    Send an empty UDP packet with spoofed source ip "10.1.100.100" to host "hexcodes" on port 4140.

# mptcp -d www.hexcodes.org -u -p 9000 -P 22000 -F 900 -q 20
    Send only 20 UDP packets to server "www.hexcodes.org" and to port 9000, from source port 22000 with flood Delay of 900 miliseconds.

# mptcp -d 201.1.0.13 -Ie -x 512 -t 50 -z
    Sets MpTcp for send ICMP packets (Echo Request) with size of 512 bytes to host "201.1.0.13" with TTL 50. Don't wait for ICMP Echo ReplY.

# mptcp -lU -P 59
    Listen UDP packets on local port 59 (all addresses and loopback).

# mptcp -d hexcodes -Ts -p 6000
    Send a TCP SYN packet to host "hexcodes" on port 6000.

# mptcp -lC -P 12345 > file.txt
    Listen TCP connections on local port "12345", and writes the received data into 'file.txt' file.

# mptcp -d hexcodes -p 12345 < /etc/hosts
    Connect to host 'hexcodes' reading the file '/etc/hosts. The file content will be send over the TCP connection (like netcat style).

# mptcp -lC -P 12345 -s 10.0.0.1
    Listen TCP connections on local port "12345" (only "binded" on address 10.0.0.1).

# mptcp -lT -P 2134 -D
    Listen for TCP packets on local port "2134" and show the packet content.

# mptcp -d www.hexcodes.org -Tr -p 8080 -n 12 -b
    Send TCP RST packets to server "www.hexcodes.org" on port 8080, with 12 threads and super flood mode (HOT).

# mptcp -H FF:FF:FF:FF:FF:FF
    Send an ARP REPLY packet to physical Broadcast FF:FF:FF:FF:FF:FF. (The source MAC address and the source IP address will be obtained locally by the active interface. The destination IP address will be NULL).

# mptcp -i eth2 -h 00:BB:AA:CC:BB:AA -H FF:FF:FF:FF:FF:FF -d 10.1.10.1 -A
    Send an ARP REQUEST packet by the eth2 interface with source MAC 00:BB:AA:CC:BB:AA, to destination physical Broadcast FF:FF:FF:FF:FF:FF, asking "Who ??" on the network have the IP address "10.1.10.1". The IP "10.1.10.1" (if alive) will respond with an ARP REPLY filled with its own MAC/IP address pair.

# mptcp -s 10.2.2.100 -h 00:CC:AA:CC:BB:AA -H FF:FF:FF:FF:FF:FF
    Send an ARP REPLY packet to the destination physical Broadcast FF:FF:FF:FF:FF:FF saying that the source IP address "10.2.2.100" have now the MAC address 00:CC:AA:CC:BB:AA. (Caution: This option changes the ARP cache table. Possible ARP poisoning attack).

# mptcp -a 10.1.50.100
    Send an Arp'ing packet to Host "10.1.50.100". If the host hardware is alive on the network or LAN, by default an ARP REPLY will be returned. Otherwise, nothing happens. This option can be used to bypass ICMP filters (PING filters).

# mptcp -f 250000
    Send 250000 ARP REPLY packets (to the physical broadcast) with the fields (SOURCE MAC, DESTINATION MAC, SOURCE IP and DESTINATION IP ADDRESSESS) randomly generated.

# mptcp -lA -D
    Listen for ARP/RARP packets. Does a listen action for all incoming ARP/RARP packets on link layer and show the packet content.

# mptcp -N irc.quakenet.org -L Cybers
    Sets the MpTcp to connect on IRC Server "irc.quakenet.org" on channel #Cybers. This option puts MpTcp on the RSOI mode. So, the MpTcp will be NO AVAILABLE to be controled by user. Only the users on IRC server "irc.quakenet.org" channel #Cybers CAN DO IT.

# mptcp -d 10.0.0.1 -W -n 40
    This option puts MpTcp to send HTTP requests (GET method) on super flooding mode to host "10.0.0.1" on port 80 (WEB HTTP) with 40 threads. This stress test attempts to exhaust the services on port 80 (Web Server) and check the target's limit response.

OBSERVATIONS

More examples or hard discussions about Dark/White side and RSOI mode (Hive Mind), please check this: http://www.hexcodes.org/tools/mptcp/mptcp.txt

SEE ALSO

tcpdump(8). nmap(1), netcat(1), arping(8).

AUTHOR

Mptcp was written by Felipe Ecker (Khun) <khun@hexcodes.org>.

SECURITY

MpTcp need superuser privileges (root) for operation and execution. DO NOT use the stick bit to allow root privilegies. This is not recommended and may allow involuntary or agressive DoS/DDoS attacks. The privileged MpTcp use also allows users manipulate the ARP cache table of neighbors on network, and put the system over a remote control (RSOI).

DISPONIBILITY

MpTcp is available to anyone who wants to know, manipulate, or disassembly the tool. MpTcp is licensed under GPL and Free Software Foundation. A copy of the license accompanies the software, and was licensed under GPL 3 - Copyright (C) Felipe Ecker. The MpTcp can be freely downloaded here: http://www.hexcodes.org/tools/mptcp/