|
http://www.hackerschool.org/HS_Boards/zboard.php?id=QNA_programming&no=1249 [복사]
이곳 도서관에 있는 스텔스 포트 스켄을 보고 따라하던중 위도우에서 한번 가동
하고싶어서 윈도우쪽으로 조금 수정을 했습니다. 계속 아무것도 안뜨길레
ethereal로 패킷 캡쳐해보니 가는게 없고, 그래서 에러메세지를 확인하여 보니까
10049에러가 납니다(아래 페이지에서 보면 주소를 할당할수 없음..이라던데..)
http://www.smon.co.kr/solomon_webhelp/LibraryNmicmp/Reference/WinsockErrMsg.htm
어떻게 해결할수 없는지 이렇게 질문 올립니다.
아래 소스는 도서관에 있는 스탤스 스켄에서 제가 조금 수정한 것 입니다.
// 필요한 헤더들 선언
#include <stdio.h>
#include <stdlib.h>
#include <winsock2.h>
#include <windows.h>
#include <WS2TCPIP.H>
//#include <unistd.h>
#include <string.h>
//#include <sys/socket.h>
//#include <sys/types.h>
//#include <arpa/inet.h>
//#include <netinet/in.h>
//#include <linux/ip.h>
//#include <linux/tcp.h>
//#include <netdb.h>
// 발신자의 IP 주소, 컴파일 전에 수정하세요.
#define LOCAL_IP "127.0.0.1"
struct iphdr{
unsigned int ihl;
unsigned int version:4;
unsigned char tos;
unsigned short tot_len;
unsigned short id;
unsigned short frag_and_flag;
unsigned char ttl;
unsigned char protocol;
unsigned short check;
unsigned int saddr;
unsigned int daddr;
};
struct tcphdr {
unsigned short source;
unsigned short dest;
unsigned int seq;
unsigned ack_seq;
// #if defined(__LITTLE_ENDIAN_BITFIELD)
unsigned short res1:4,
doff:4,
fin:1,
syn:1,
rst:1,
psh:1,
ack:1,
urg:1,
ece:1,
cwr:1;
// #elif defined(__BIG_ENDIAN_BITFIELD)
// unsigned short doff:4,
// res1:4,
// cwr:1,
// ece:1,
// urg:1,
// ack:1,
// psh:1,
// rst:1,
// syn:1,
// fin:1;
// #endif
unsigned short window;
unsigned short check;
unsigned short urg_ptr;
};
// 체크섬을 구하는 함수 선언/정의.
unsigned short in_cksum(u_short *addr, int len)
{
int sum=0;
int nleft=len;
u_short *w=addr;
u_short answer=0;
while (nleft > 1){
sum += *w++;
nleft -= 2;
}
if (nleft == 1){
*(u_char *)(&answer) = *(u_char *)w ;
sum += answer;
}
sum = (sum >> 16) + (sum & 0xffff);
sum += (sum >> 16);
answer = ~sum;
return(answer);
}
// 가상 헤더 구조체 선언
struct pseudohdr {
int saddr;
int daddr;
char useless;
char protocol;
short int tcplength;
};
int main( int argc, char **argv )
{
char packet[40];
int raw_socket, recv_socket;
int on=1, len ;
char recv_packet[100], compare[100];
struct iphdr *iphdr;
struct tcphdr *tcphdr;
struct in_addr source_address, dest_address;
struct sockaddr_in address, target_addr;
struct pseudohdr *pseudo_header;
struct in_addr ip;
struct hostent *target;
int port;
WORD wver;
WSADATA wsadata;
wver=MAKEWORD(2,2);
WSAStartup(wver,&wsadata);
// if( argc < 2 ){
//
// fprintf( stderr, "Usage : %s Target\n", argv[0] );
// exit(1);
// }
strcpy( compare, "127.0.0.1" );
source_address.s_addr = inet_addr( LOCAL_IP );
dest_address.s_addr = inet_addr( compare );
// strcpy( compare, argv[1] );
// 인자로 도메인을 주었을 경우 IP로 변환.
if( dest_address.s_addr == -1 ){
if( (target = gethostbyname( compare )) == NULL ){
fprintf( stderr, "도메인 주소가 올바르지 않습니다.\n" );
exit( 1 );
}
//bcopy( target->h_addr, (char *)&ip.s_addr, target->h_length );
memcpy( target->h_addr, (char *)&ip.s_addr, target->h_length );
dest_address.s_addr = ip.s_addr;
strcpy( compare, inet_ntoa( dest_address ) );
}
printf( "\n[Wise Scanner Started.]\n\n" );
// 1번에서부터 500번까지 스캔
for( port=1; port<500; port++ ){
// raw socket 생성
raw_socket = socket( AF_INET, SOCK_RAW, IPPROTO_RAW );
setsockopt( raw_socket, IPPROTO_IP, IP_HDRINCL, (char *)&on, sizeof(on));
// TCP, IP 헤더 초기화
iphdr = (struct iphdr *)packet;
memset( (char *)iphdr, 0, 20 );
tcphdr = (struct tcphdr *)(packet + 20 );
memset( (char *)tcphdr, 0, 20 );
// TCP 헤더 제작
tcphdr->source = htons( 777 );
tcphdr->dest = htons( port );
tcphdr->seq = htonl( 92929292 );
tcphdr->ack_seq = htonl( 12121212 );
tcphdr->doff = 5;
tcphdr->syn = 1;
tcphdr->window = htons( 512 );
// 가상 헤더 생성.
pseudo_header = (struct pseudohdr *)((char*)tcphdr-sizeof(struct pseudohdr));
pseudo_header->saddr = source_address.s_addr;
pseudo_header->daddr = dest_address.s_addr;
pseudo_header->protocol = IPPROTO_TCP;
pseudo_header->tcplength = htons( sizeof(struct tcphdr) );
// TCP 체크섬 계산.
tcphdr->check = in_cksum( (u_short *)pseudo_header,
sizeof(struct pseudohdr) + sizeof(struct tcphdr) );
// IP 헤더 제작
iphdr->version = 4;
iphdr->ihl = 5;
iphdr->protocol = IPPROTO_TCP;
iphdr->tot_len = 40;
iphdr->id = htons( 12345 );
iphdr->ttl = 60;
iphdr->saddr = source_address.s_addr;
iphdr->daddr = dest_address.s_addr;
// IP 체크섬 계산.
iphdr->check = in_cksum( (u_short *)iphdr, sizeof(struct iphdr));
address.sin_family = AF_INET;
address.sin_port = htons( port );
address.sin_addr.s_addr = dest_address.s_addr;
// 패킷 전송
if(sendto( raw_socket, &(packet[0]), sizeof(packet), 0x0,(struct sockaddr *)&address, sizeof(address)) == SOCKET_ERROR) {
printf("%d",WSAGetLastError());
printf("전송실패\n");
switch(WSAGetLastError()){
case WSANOTINITIALISED :
printf("1");
case WSAENETDOWN :
printf("2");
case WSAEACCES :
printf("3");
case WSAEINVAL :
printf("4");
case WSAEINTR :
printf("5");
case WSAEINPROGRESS :
printf("6");
case WSAEFAULT :
printf("7");
case WSAENETRESET :
printf("8");
case WSAENOBUFS :
printf("9");
case WSAENOTCONN :
printf("10");
case WSAENOTSOCK :
printf("11");
case WSAEOPNOTSUPP :
printf("12");
case WSAESHUTDOWN :
printf("13");
case WSAEWOULDBLOCK :
printf("14");
case WSAEMSGSIZE :
printf("15");
case WSAEHOSTUNREACH :
printf("16");
case WSAECONNABORTED :
printf("17");
case WSAECONNRESET :
printf("18");
case WSAEADDRNOTAVAIL :
printf("19");
case WSAEAFNOSUPPORT :
printf("20");
case WSAEDESTADDRREQ :
printf("21");
case WSAENETUNREACH :
printf("22");
case WSAETIMEDOUT :
printf("23");
}
exit(0);
}
// 응답 패킷의 헤더를 저장할 변수 초기화.
iphdr = (struct iphdr *)recv_packet;
tcphdr = (struct tcphdr *)(recv_packet + 20);
memset( (char *)iphdr, 0, 20 );
memset( (char *)tcphdr, 0, 20 );
// 수신용 패킷 생성
recv_socket = socket( AF_INET, SOCK_RAW, IPPROTO_TCP );
len = sizeof( target_addr );
// 응답 패킷 검출
while(1){
recvfrom( recv_socket, recv_packet, 100, 0, (struct sockaddr *)&target_addr, &len );
if( strcmp( inet_ntoa(target_addr.sin_addr), compare ) == 0 ){
if( ntohs(tcphdr->dest) == 777 ){
// syn 플래그 설정 여부 확인
if( tcphdr->syn == 1 )
printf( "%d Port is open.\n", port );
break;
}
}
}
closesocket( recv_socket );
closesocket( raw_socket );
}
printf( "\n[Scan ended.]\n\n" );
return 0;
}
|
Hit : 4143 Date : 2006/12/26 04:20
|
3206, 
10/161 
