phantap - Phantom Tap (PhanTap) - an ‘invisible’ network tap

项目说明

PhanTap (Phantom Tap)

!PhanTap Logo

PhanTap is an ‘in’ network tap aimed at red teams. With limited physical access to a target building, this tap can be installed inline between a network device and the corporate network. PhanTap is silent in the network and does not affect the ’s traffic, even in networks having NAC (Network Access Control 802.1X - 2004).
PhanTap will analyze traffic on the network and mask its traffic as the device.
It can mount a tunnel back to a remote server, giving the user a foothold in the network for further analysis and pi.
PhanTap is an OpenWrt package and should be compatible with any device. The physical device used for our testing is currently a small, inexpensi, the GL.iNet GL-AR150.
You can find a detailed blogpost describing PhanTap here

Features:

* Transparent network bridge.
* Silent : no arp, multicast, broadcast.
* 802.1x passthrough.
* Automatic configuration:
* capture traffic entering the network (the source is non RFC1918 and the destination is RFC1918), destination IP and MAC is our , source MAC is our gateway,
* SNAT bridge traffic to the MAC and IP address,
* set the router default gateway to the MAC of the gateway detected just before.
* Introspects ARP, multicast and broadcast traffic and adds a route to the machine IP address and adds the machine MAC address to the neighbour list, hence giving the possibility of talking to all the machines in the local network.
* Learns the DNS server from traffic and modifies the one on the router so that it's the same.
* Introspects DHCP packets for dynamic reconfiguration.
* Can run commands (ex: /etc/init.d/open) when a new IP or DNS is configured.
* Lets you choose any , for example OpenVPN tcp port 443 so it goes through most firewalls.
* You can talk to the machine (using the gateway IP).

Setup

PhanTap has been tested with the GL.iNet GL-AR150. This device has two separate network interfaces in OpenWrt (eth0, eth1).
If your device is using an internal switch(swconfig based) with interfaces like eth0.1, eth0.2, some special traffic might be blocked, e.g. 802.1Q(tagged vlan), but PhanTap should work.

* Install a snapshot build, for the GL.iNet GL-AR150
* Update the OpenWrt package list

* Install PhanTap package:

* Configure the Wifi and start administering the router through it.
* Either reboot the device, or run /etc/init.d/phantap setup.
* Get the interface names from that device:

In this example we are using a GL-AR150, which only has 2 interfaces.

* Remove the interfaces from any network interface they might be used by, if that's the case, via the following commands in the cli
(assuming we are using a GL-AR150):

* Add the interfaces to the phantap bridge and restart the network service via the following commands in the cli
(assuming we are using a GL-AR150):

* Phantap is now configured, as soon as you plug it between a and their switch, it will automatically configure the router and give it Internet access.

* You can add your fa VPN to have a remote connection back. We' PhanTap with OpenVpn, port TCP 443, to avoid some detection methods.
* You can also add a command to be ran when a new IP or DNS is configured, in /etc/config/phantap, e.g. /etc/init.d/open (restart Open).
* You can also look at disabling the wifi by default and using hardware buttons to start it ().

Limitations or how it can be detected :

* The GL.iNet GL-AR150 and most inexpensi only support 100Mbps, meanwhile modern network traffic will be 1Gbps.
* The network port will stay up, switch side, when the device is disconnected/shutdown.
* Some traffic is blocked by the Linux bridge (STP/Pause frames/LACP).
* OpenWrt failsafe mode sends IPv4 and IPv6 packets as described in the documentation: This happens during early boot and can get the device detected. There is no easy solution to disable it at runtime, as this configuration is in U-Boot. The U-Boot partition is mounted as read-only and it's configuration can only be accessed and modified from the U-Boot shell (via UART on the GL-AR150 for example). The easier solution is to compile OpenWrt with the TARGET_PREINIT_DISABLE_FAILSAFE option enabled.

Roadmap :

* Add logic to restart the detection when the links go up/down.
* Add IPv6 support.
* Test limitations of devices that ha(swconfig) instead of separate interfaces.

项目信息

开发语言：C

Star 数：625

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Phantom Tap (PhanTap) - an ‘invisible’ network tap aimed at red teams展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。