吾爱破解 - LCG - LSG |安卓破解|病毒分析|www.52pojie.cn

 找回密码
 注册[Register]

QQ登录

只需一步,快速开始

查看: 5511|回复: 12
收起左侧

[C&C++ 转载] 自行构造TCP三次握手的第二次握手包

[复制链接]
00011011 发表于 2017-5-21 09:06
楼主比较水,构造的数据包一直有问题,另附上winshark抓包的资料,给位看官给指点指点
[C] 纯文本查看 复制代码
struct EthernetHeader
{
	u_char DestMAC[6];
	u_char SourMAC[6];
	u_short EthType;
};

struct IPHeader
{
	unsigned char Version_HLen;
	unsigned char TOS;
	unsigned short Length;
	short Ident;
	short Flags_Offset;
	unsigned char TTL;
	unsigned char Protocol;
	short Checksum;
	unsigned int SourceAddr;
	unsigned int DestinationAddr;
};

struct PsdTcpHeader
{
	unsigned long SourceAddr;
	unsigned long DestinationAddr;
	char Zero;
	char Protcol;
	unsigned short TcpLen;
};

struct TcpHeader
{
	unsigned short SrcPort;
	unsigned short DstPort;
	unsigned int SequenceNum;
	unsigned int Acknowledgment;
	unsigned char HdrLen;
	unsigned char Flags;
	unsigned short AdvertisedWindow;
	unsigned short Checksum;
	unsigned short UrgPtr;
};

unsigned short checksum(unsigned short *data, int length)
{
	unsigned long temp = 0;
	while (length > 1)
	{
		temp += *data++;
		length -= sizeof(unsigned short);
	}
	if (length)
	{
		temp += *(unsigned short*)data;
	}
	temp = (temp >> 16) + (temp & 0xffff);
	temp += (temp >> 16);
	return (unsigned short)(~temp);
}

void burn_backet(unsigned char *buffer, int packetlen)
{
	struct EthernetHeader ethernet;
	struct IPHeader ipheader;
	struct TcpHeader tcpheader;
	struct PsdTcpHeader psdheader;

	unsigned char buf[100] = { 0 };
	char TcpData[] = "BA BA LA ~ BA BA LA";

	BYTE destmac[8];
	destmac[0] = 0x11;
	destmac[1] = 0x22;
	destmac[2] = 0x33;
	destmac[3] = 0x44;
	destmac[4] = 0x55;
	destmac[5] = 0x66;
	memcpy(ethernet.DestMAC, destmac, 6);
	BYTE hostmac[8];
	hostmac[0] = 0xaa;
	hostmac[1] = 0xbb;
	hostmac[2] = 0xcc;
	hostmac[3] = 0xdd;
	hostmac[4] = 0xee;
	hostmac[5] = 0xff;
	memcpy(ethernet.SourMAC, hostmac, 6);
	ethernet.EthType = htons(0x0800);

	ipheader.Version_HLen = (4 << 4 | sizeof(ipheader) / sizeof(unsigned long));
	ipheader.TOS = 0;
	ipheader.Length = htons(sizeof(struct IPHeader) + sizeof(struct TcpHeader) + strlen(TcpData));
	ipheader.Ident = 0x00bf;
	ipheader.Flags_Offset = 0;
	ipheader.TTL = 128;
	ipheader.Protocol =IPPROTO_TCP;
	ipheader.Checksum = 0;
	ipheader.SourceAddr = inet_addr(CHAR_SOURCE_IPHEADER);
	ipheader.DestinationAddr = inet_addr(CHAR_TARGET_IPHEADER);

	tcpheader.DstPort = htons(80);
	tcpheader.SrcPort = htons(80);
	tcpheader.SequenceNum = 0x99;
	tcpheader.Acknowledgment = 1;							//ACK
	tcpheader.HdrLen = (sizeof(tcpheader)/4<<4|0);			//首部长度
	tcpheader.Flags = 0x12;								//SYN
	tcpheader.AdvertisedWindow = htons(512);
	tcpheader.UrgPtr = 0;
	tcpheader.Checksum = 0;
	
	psdheader.SourceAddr = ipheader.SourceAddr;
	psdheader.DestinationAddr = ipheader.DestinationAddr;
	psdheader.Zero = 0;
	psdheader.Protcol = IPPROTO_TCP;
	psdheader.TcpLen = htons(sizeof(struct TcpHeader) + strlen(TcpData));

	char TempBuffer[100] = { 0 };
	memcpy(TempBuffer, &psdheader, sizeof(struct PsdTcpHeader));
	memcpy(TempBuffer + sizeof(struct PsdTcpHeader), &tcpheader, sizeof(struct TcpHeader));
	memcpy(TempBuffer + sizeof(struct PsdTcpHeader) + sizeof(struct TcpHeader), TcpData, strlen(TcpData));
	tcpheader.Checksum = checksum((USHORT*)(TempBuffer), sizeof(struct PsdTcpHeader) + sizeof(struct TcpHeader) + strlen(TcpData));

	memset(TempBuffer, 0, sizeof(TempBuffer));

	memcpy(TempBuffer, &ipheader, sizeof(struct IPHeader));
	ipheader.Checksum = checksum((USHORT*)(TempBuffer), sizeof(struct IPHeader));

	memcpy(buf, eernet, sizeof(struct EthernetHeader));
	//memcpy(buf + sizeof(struct EthernetHeader), &ipheader, sizeof(struct IPHeader));
	memcpy(buf + sizeof(struct EthernetHeader), &ipheader, 20);
	memcpy(buf + sizeof(struct EthernetHeader) + sizeof(struct IPHeader), &tcpheader, sizeof(struct TcpHeader));
	memcpy(buf + sizeof(struct EthernetHeader) + sizeof(struct IPHeader) + sizeof(struct TcpHeader), TcpData, strlen(TcpData));
	
	memcpy(buffer, buf, sizeof(buf));
}


截图00.png

2017_05_19.txt

25.46 KB, 下载次数: 12, 下载积分: 吾爱币 -1 CB

winshark抓包结果,把扩展名改为pcapng就OK

发帖前要善用论坛搜索功能,那里可能会有你要找的答案或者已经有人发布过相同内容了,请勿重复发帖。

johnchang96 发表于 2017-8-28 16:12
00011011 发表于 2017-5-21 10:28
就是我构造了个TCP数据包,发送的时候一直有 Frame check sequence 这项出错,我比较水不知道是怎么回事 ...

CRC计算出错了呗
上网找个别人的计算方法就好了
johnchang96 发表于 2017-9-1 18:10
johnchang96 发表于 2017-8-28 16:12
CRC计算出错了呗
上网找个别人的计算方法就好了

补充,wireshark写的很清楚了,FCS的值你计算的是0x00000000,也就是根本没计算啊
shipon 发表于 2017-5-21 09:21
zerg 发表于 2017-5-21 09:25
小白,看不懂啊。
dice1412 发表于 2017-5-21 10:14
纯支持了
 楼主| 00011011 发表于 2017-5-21 10:28
shipon 发表于 2017-5-21 09:21
说白了,我一个都没看懂。

就是我构造了个TCP数据包,发送的时候一直有 Frame check sequence 这项出错,我比较水不知道是怎么回事,求教 真心
逆向学习菜鸟 发表于 2017-5-21 10:59
伪造了,有什么用
 楼主| 00011011 发表于 2017-5-21 11:17

我在做一个IDLE扫描器,需要构造一个伪造IP地址的TCP数据包
非寒 发表于 2017-5-21 13:16
共同学习
逆向学习菜鸟 发表于 2017-5-25 20:59
00011011 发表于 2017-5-21 11:17
我在做一个IDLE扫描器,需要构造一个伪造IP地址的TCP数据包

成功了吗  我没成功
头像被屏蔽
叫我屌炸天 发表于 2017-8-28 14:30
提示: 作者被禁止或删除 内容自动屏蔽
您需要登录后才可以回帖 登录 | 注册[Register]

本版积分规则 警告:本版块禁止灌水或回复与主题无关内容,违者重罚!

快速回复 收藏帖子 返回列表 搜索

RSS订阅|小黑屋|处罚记录|联系我们|吾爱破解 - LCG - LSG ( 京ICP备16042023号 | 京公网安备 11010502030087号 )

GMT+8, 2024-3-29 13:45

Powered by Discuz!

Copyright © 2001-2020, Tencent Cloud.

快速回复 返回顶部 返回列表