decode_citrix.c

一个网络工具包,可以嗅探email和http等数据包中的密码等信息.注意要先把libnet-1.0.2a.tar.gz和 libnids-1.16.tar.gz装上,不然会因为缺少库函数而无法编译和安

/*
  decode_citrix.c

  Citrix ICA.

  http://www.securityfocus.com/templates/archive.pike?list=1&date=200 \
  0-04-15&msg=[e-mail]
  
  Thanks to Jeremie Kass <[e-mail]> for providing me with
  traffic traces.
  
  Copyright (c) 2000 Dug Song <[e-mail]>
 
  $Id: decode_citrix.c,v 1.4 2000/11/15 05:27:53 dugsong Exp $
*/

#include "config.h"

#include <sys/types.h>
#include <stdio.h>
#include <string.h>
#include "buf.h"
#include "decode.h"

static u_char ica_magic[] = { 0x32, 0x26, 0x85, 0x92, 0x58 };

int
decode_citrix(u_char *buf, int len, u_char *obuf, int olen)
{
	struct buf inbuf, outbuf;
	u_char key, c, t[2];
	int i;
	
	buf_init(&inbuf, buf, len);
	buf_init(&outbuf, obuf, olen);
	
	while ((i = buf_index(&inbuf, ica_magic, sizeof(ica_magic))) >= 0) {
		buf_skip(&inbuf, i);
		
		if (buf_len(&inbuf) < 60)
			break;
		
		buf_skip(&inbuf, 17);
		
		if (buf_get(&inbuf, &key, 1) != 1)
			break;
		
		buf_skip(&inbuf, 42);
		
		if (buf_get(&inbuf, &c, 1) != 1)
			break;

		c ^= ('C' | key);
		
		buf_put(&outbuf, &c, 1);
		
		i = 0;
		while (buf_get(&inbuf, t, 2) == 2) {
			c = t[0] ^ t[1] ^ key;
			
			if (c == '\0') {
				buf_put(&outbuf, "\n", 1);
				if (++i > 2) break;
			}
			buf_put(&outbuf, &c, 1);
		}
	}
	buf_end(&outbuf);
	
	return (buf_len(&outbuf));
}