Sunday, May 11, 2014

MAC address spoofing - Linux

It is too easy than I expected. Just download "macchanger" source from gnu's FTP site.

Now.
Step 1: doing a "ifconfig" should give you all the system's interfaces, and their corresponding IP addresses. In my case, I had only one, and it was something like below.

# ifconfig eth0
eth0      Link encap:Ethernet  HWaddr 00:23:3f:15:cc:dc
          inet addr:10.151.50.15  Bcast:10.151.255.255  Mask:255.255.0.0
          inet6 addr: ef80::250:8ecf:6df3:3731/64 Scope:Link
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
          Memory:ee000000-ee020000

Our focus is on changing the "HWaddr" here.

Note: To me, I had to just unlink the physical cable once to effect the changes, although another time, just disabling the network through software and re-enabling them worked out fine. So, ensure to try both options before posting a  "not working" post.

To generate a random HW address, just type



# macchanger -r eth0
Current MAC:   00:23:3f:15:cc:dc (unknown)
Permanent MAC: 00:23:3f:15:cc:dc (unknown)
New MAC:       53:de:bc:8f:28:dc (unknown)

To update a specific HW address, type


macchanger --mac=23:0d:fc:41:c5:8b eth1

Current MAC:   00:23:3f:15:cc:dc (unknown)
Permanent MAC: 00:23:3f:15:cc:dc (unknown)
Faked MAC:     b2:aa:0e:56:ed:f7 (unknown)

And to reset, type
macchanger -p eth1

Current MAC:   b2:aa:0e:56:ed:f7 (unknown)
Permanent MAC: 00:23:3f:15:cc:dc (unknown)
Faked MAC:     00:23:3f:15:cc:dc (unknown)

My source ref: http://linuxconfig.org/change-mac-address-with-macchanger-linux-command

No comments: