Using WINPCAP analog network packet to forge flying autumn Flash screen message

Cause

Do not know from when, colleagues began to fly in the autumn splash screen vibration, and later intensified, became a daily flash. Old Flash back also more trouble, as a procedural ape, there is no lazy way? (The colleague is responsible for the user experience and does not know programming). Then try the following ideas:

UI Automation

Using UISpy to view the autumn Chat window, sad to find that send the splash screen vibration button.

Simulating mouse events

Ready to use Mouse_event to send mouse events to simulate the splash screen vibration of the press. But I think, each splash screen vibration button location is not the same, if you move the window or change the layout of the window, you have to reset the coordinates, trouble, then abandoned.

Forge Network messages

Previously know WinPcap and Wireshark, exactly the previous time in the blog park to see [C #] in the lab LAN ARP spoofing-Yosef Gao-Blog Park, understand that C # also has the relevant parsing and sending tools. Start the program decisively.

Flying autumn packet data conjecture flying autumn network transmission

I know the flying autumn Chat is UDP, the port default is 2425. Do not know also does not matter, opens the flying autumn and so on settings and so on network setting, then you will discover, the flying autumn already understood to tell us.

splash screen Vibration

First open the Wireshark, set the filter condition to udp.port==2425, and then send a splash screen vibration to the test machine to try it.

Found that there are two messages, one of which is the local to each other, and the other is sent to the machine.

Send a few more splash screen vibration, we can roughly guess the flying Autumn splash screen Vibration message law, send the message format is 1_lbt6_0#128# (Sender MAC address, 16-bit) #0 #0#0#4001#9: (guess should be serial number, specific unclear):(Sender user name):( Sender hostname) 209: The Received message is 1_lbt6_0#128# (Sender MAC address, 16-bit) #0 #0#0#4001#9: (guess should be serial number, specifically unclear):(Sender user name):(sender hostname) 210:. Will send the splash screen vibration message with WINPCAP analog data packet, incredibly on the test machine received a splash screen vibration (originally thought that the number of guesses field will have an impact).

Information

After sending a message to the test machine, we found several messages.

After comparing the length and source of the message, guess the other short messages from this machine are sent as input, stop input and so on, and the longer the message is sent. After verification, it is true. And the information message of the flying autumn should be over-dense, can not be directly guessed from the content.

Expression

The expression is basically similar to the message, but the expression appears to be compressed.

File

Generic files are transmitted over TCP and verified. I found it. The list of files to be sent is transmitted over UDP, and the specific file content is transmitted over TCP.

In the UDP transmission, the party sends two messages, the other side sends two messages. The second message sent by the basic party can see the file name.

In the TCP message, in addition to the TCP connection established three times handshake and the connection disconnects four times handshake, in the remaining native sends the message, may clearly see the message content.

This is a text file:

This is a binary file:

Binary files in UltraEdit view:

Description

Because the main interest in the study of the splash screen vibration, the rest of the functionality is simply a look, not in-depth study.

Code implementation Software Interface

The first to make analog splash screen vibration but do not need to fill in any message information, but the login user name can not be obtained through the network, and also by the sending message string to fill in other messages copied from the Wireshark string to simulate other messages (such as information and expression), this form is made.

Precautions

To use PacketDotNet.dll and SharpPcap.dll, you need to install the WINPCAP (I installed the Wireshark directly, which contains WinPcap).

Download link

Blog Park: Feiqcheater

Interesting

1. The first time without sleep, a while (true) send a splash screen vibration message, directly to the designer's flying autumn to play dead, repeatedly restarted invalid, ya still think it is their computer problems. Now we understand the horrors of DOS (denial of service attacks).
2. Can be disguised as someone else to send a splash screen vibration message. I often disguised as someone else to give the designer a splash screen, but also disguised as a designer to send a splash screen for others.
3. Put their own flying autumn after the other side after receiving the message of the fall, still have a response.
4. Later, the designers learned to be smart, through the others, in the fall off the splash screen.

Latest developments

1. In the online can find a part about the message format, such as flying autumn attack to the end-Long-Blog Park (a rough look, the autumn version is not the same), while the legend can also be sent directly to fly pigeon book unencrypted messages, but I have not been verified. If that's the case, you can simulate a fake flying autumn message.
2. I think I can simulate the flash of the Friend list on this computer, and then resolve the received package, so that you can analyze the list of friends, including each friend's user name, IP address, MAC address and other information. This simulates a splash screen vibration without having to enter any information.

Challenge

1. Another notebook to my brother, a single computer bad simulation.
2. It seems that WinPcap can not intercept the target non-native messages, that is, the fake message can only be disguised as the other person by the machine to send out once, and can not forge into other people and the target party to talk. (I used to change the IP, change the name, change the way the Mac disguised as the leader played tricks on other colleagues, said the company is prepared to give him a pay raise, let him silly music).
3. It seems that the package cannot be discarded after the WinPcap received.
4. Lazy cancer committed, do not want to do these things, this is the main reason.

Using WINPCAP analog network packet to forge flying autumn Flash screen message