cryptolok / ghostinthenet

Ultimate Network Stealther that makes Linux a Ghost In The Net and protects from MITM/DOS/scan

GhostInTheNet

Ultimate Network Stealther that makes Linux a Ghost In The Net and protects from MITM/DOS/scan

Properties:

• Network Invisibility
• Network Anonymity
• Protects from MITM/DOS
• Transparent
• Cross-platform
• Minimalistic

Dependencies:

• Linux 2.4.26+ - will work on any Linux-based OS, including Whonix and RaspberryPI
  • BASH - the whole script
  • root privileges - for kernel controlling

Limitations:

• You can still be found with VLAN logs if using ethernet or by triangulation/beacons if using WiFi
• MAC spoofing won't work if appropriate mitigations has been taken, like DAI or sticky MAC
• Might be buggy with some CISCO switches
• Not suitable for production servers

How it works

The basic and primary network protocol is ARP for IPv4 and NDP (ICMPv6) for IPv6, located in the link and network layer, provides main connectivity in a LAN.

Despite its utility and simplicity, it has numerous vulnerabilities that can lead to a MITM attack and leak of confidentiality.

Patching of such a widely used standard is a practically impossible task.

A very simple, but at the same time effective solution is to disable ARP and NDP responses on an interface and be very cautious with broadcasting.

Considering the varieties of implementations, this means that anyone in the network wouldn't be able to communicatate with such host, only if the host is willing it-self.

The ARP/NDP cache will be erased quickly afterwards.

Here is an example schema:

A >>> I need MAC address of B >>> B

A <<< Here it is <<< B

A <<< I need MAC address of A <<< B

A >>> I'm not giving it >>> B

To increase privacy, it's advised to spoof the MAC address, which will provide a better concealment.

Moreover, the hostname has to be changed (especially if using DHCP and in this case all the leases have to be released).

All this is possible using simple commands in Linux kernel and a script that automates it all.

Analysis

No ARP/NDP means no connectivity, so an absolute stealth and obscurity on the network/link layer.

This protects from all possible DOSes and MITMs (ARP, DNS, DHCP, ICMP, Port Stealing) and far less resource consuming like ArpON.

Such mitigation implies impossibility of being scanned (nmap, arping).

Besides, it doesn't impact a normal internet or LAN connection on the host perspective.

If you're connecting to a host, it will be authorised to do so, but shortly after stopping the communication, the host will forget about you because, ARP/NDP tables won't stay long without a fresh request.

Regarding the large compatibility and cross-platforming, it's very useful for offsec/pentest/redteaming as well.

You see everyone, but nobody sees you, you're a ghost.

Mitigation and having real supervision on the network will require deep reconfiguration of OSes, IDPSes and all other equipement, so hardly feasible.

HowTo

You can execute the script after the connection to the network or just before:

sudo ./GhostInTheNet.sh on eth0

This will activate the solution until reboot.

If you want to stop it:

sudo ./GhostInTheNet.sh off eth0

Of course, you will have to make the script executable in the first place:

chmod u+x GhostInTheNet.sh

Notes

ARP/NDP protocol can be exploited for defensive purpose.

Now your Poisontap is literally undetectable and your Tails is even more anonymous.

You should learn some stuff about IPv6.

"Stars, hide your fires; Let not light see my black and deep desires."

William Shakespeare, Macbeth

ghostinthenet's Issues

adding this to wlan1?

I tried to edit this to start on wlan1. no luck.. would you mind writing a copy or editing a copy to use wlan1 function? it would say wlan1 not active

Bash's $Random is a weak entropy source

In line 96 you use Bash's $RANDOM for the generation of a random mac address. $RANDOM returns an integer between 0 and 32767 (see RANDOM on the manpage). So the generated mac address has only about 2 bytes entropy.
A mac address has 8 bytes, as you hardcode the first byte you would need 7bytes of entropy for an perfectly random address.

I have no idea of the impact and if it is possible that a scanner could detect usage of this script through the 32768 different mac addresses that all start with 64.

So please use another way to generate a random mac address. How about one of the following:

dd if=/dev/urandom bs=8 count=1 2>/dev/null | od -t x8 | sed -nE 's/0000000 (..)(..)(..)(..)(..)(..)(..)..$/64:\1:\2:\3:\4:\5/p'
cat /proc/sys/kernel/random/uuid

It could also be possible to make networkmanager generate the mac address see: https://blogs.gnome.org/thaller/2016/08/26/mac-address-spoofing-in-networkmanager-1-4-0/

@parrotOS renamed to @@4413

For some reason, once using this once, my Tor won't open anymore and my @parrotos in MATE Terminal has been changed to @@4413. Anyway to fix this?

Network Manager WiFi APs not listed if disconnected manually

I don't know if it comes from the update you added which change the hostname (thanks for that, it's great), but when using Ghost, i have internet connection and my hostname and MAC adress are different, but when clicking on Network-Manager(Mate DE) i don't see any AP anymore, i have to reboot my computer.

I usually use wicd-curses, but after a recent python update it crashes so i'm avoiding it. Is there a work around ? I don't know which manager works best with GhostIntheNet, but wicd-curses worked very fast and fine with it.

Known AP saving

Using the ranges of <48:> for MAC adress as a reservation in some places reduces the entropy, as network admins can just use regex in a list to easily find the owner, even if the adress was changed multiples times, making his work easier.

Using the script does not make the user invisible on WIFI. Using Airodump-ng with a good wireless adapter, the MAC of the user can be found very quickly.

The script won't work inside a virtual machine, the connection will just hang until i disable the script (using nmcli and the graphical nm is the same result).

Why did you comment hostnamectl, and went back to using hostname ?

Edit: There's also the fact that graphical applications that might require root(such as bleachbit) cannot run after the change of hostname. It seems that one way to fix that is by adding the .Xauthority entry, but doing that will create problems at reboot when trying to log in session, and a way to fix that would be to add a line that remove the .Xauthority file after using OFF on the script(which is really bad), or using chown on the .Xauthority file

Permission denied

I followed all the steps and got this error

Please help