MAC Spoofing with Netgraph
- Kernel in static or modular configuration that has the following enabled: ng_ether, ng_eiface, and ng_bridge.
- A fair amount of knowledge.
- A machine that you can break the crap out of.
- We will be taking a machine with a physical network interface, adding a virtual interface, bridging them, and using the virtual interface in a live environment.
- There is an awful lot to netgraph(4). Read the manual pages often.
- We have a machine with (1) NIC, labelled 'fxp0'; its IP is "192.168.2.5/24".
- We can remove it from the network for testing. It will not piss off the boss or coworkers.
- First, if you're using the kernel modules, load them:
# kldload ng_ether # kldload ng_eiface # kldload ng_bridge
- Next, create the eiface.
- 'ng_eiface' has exactly one hook, to a lower-level ng_ether node.
# ngctl mkpeer . eiface hook ether
- Now create and name the bridge.
- 'ng_bridge' has NG_BRIDGE_MAX_LINKS hooks, named 'linkN'.
- 'ng_bridge' hook 'link0' connects the downstream ('lower') from ngeth0:
# ngctl mkpeer ngeth0: bridge lower link0 # ngctl name ngeth0:lower bridge0
- Now setup the ngeth0 interface:
# ifconfig ngeth0 link 00:de:ad:be:ef:00 # ifconfig ngeth0 inet 192.168.2.5 netmask 0xffffff00 down
- Now connect the ethernet device to the bridge.
- 'ng_eiface' hook 'upper' for fxp0: leads upstream to the bridge.
# ngctl connect fxp0: bridge0: upper link1
- Now the virtual interface to the other half of the bridge.
- 'ng_eiface' hook 'upper' for ngeth0: leads upstream to the bridge.
# ngctl connect ngeth0: bridge0: upper link2
- Now setup the physical interface:
# ngctl msg fxp0: setpromisc 1 # ngctl msg fxp0: setautosrc 0 # ifconfig fxp0 delete
- And finally, connect it to the last piece of the bridge:
# ngctl connect fxp0: bridge0: lower link3
- Now on your upstream router (if you can access it):
# arp -a | grep "192\.168\.2\.5" machine.domain.com (192.168.2.5) at 00:de:ad:be:ef:00 on em0
- You may need to re-add your default route:
# route add default .......
- Thats it. For an explanation, we'll have to work on that.