From 4d07e898e6409c55853a42efb0c46c74675feec1 Mon Sep 17 00:00:00 2001
From: Polaire <polaire@yh.genj.fr>
Date: Fri, 18 Oct 2024 11:52:02 +0200
Subject: [PATCH] Ajouter ICS.py

---
 ICS.py | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)
 create mode 100644 ICS.py

diff --git a/ICS.py b/ICS.py
new file mode 100644
index 0000000..e9948b8
--- /dev/null
+++ b/ICS.py
@@ -0,0 +1,32 @@
+from scapy.all import sniff, ICMP, IP, TCP
+
+
+def detect_os(pkt):
+    if pkt.haslayer(ICMP):
+        ip_src = pkt[IP].src
+        icmp_type = pkt[ICMP].type
+
+        if icmp_type == 0:  # Echo Reply
+            user_agent = pkt[IP].options if hasattr(pkt[IP], 'options') else ""
+            if "Microsoft" in str(user_agent):
+                os_type = "Windows"
+            else:
+                os_type = "Linux or Other"
+
+            print(f"Alerte : paquet ICMP reçu de {ip_src} ({os_type})")
+
+def detect_ftp(pkt):
+    if pkt.haslayer(TCP) and pkt[TCP].dport == 21:  # Port FTP
+        payload = str(pkt[TCP].payload)
+        if "USER root" in payload or "PASS root" in payload:
+            ip_src = pkt[IP].src
+            print(f"Alerte : tentative de connexion FTP avec 'root' de {ip_src}")
+
+
+def start_sniffing():
+    print("Démarrage de l'analyse du réseau... Appuyez sur Ctrl+C pour arrêter.")
+    sniff(filter="icmp or tcp port 21", prn=lambda x: (detect_icmp(x), detect_ftp(x)), store=0)
+
+
+if __name__ == "__main__":
+    start_sniffing()