Power Hacker 2003/Power_Hacker_2003.iso/Exploit and vulnerability/s0ftpj/icmp_tunnel.h

C/C++ Source or Header | 2000-12-17 | 4.6 KB | 220 lines

/*

Covert Tunnelling in ICMP 0x00 ECHO REPLY messages

  Many thanks to FuSyS and Richard Stevens ^_^

Dark Schneider X1999

*/

#include <winsock2.h>
#include <ws2tcpip.h>
#include <stdio.h>

#define ICMP_ECHOREPLY    0
#define ICMP_ECHO    8

// definizione di alcune costanti

#define IP_HDR    20
#define ICMP_HDR 8
#define ICMP_MINLEN    8
#define MAXMESG    4096
#define MAXPACKET 5004
#define LAST    1
#define REPLY    1
#define ECHO_TAG    0xF001
#define ECHO_LAST    0xF002

// Strutture e Variabili
// Lancio un doveroso Porko D*io liberatorio... dopo ore ho trovato come fare
// a togliermi dalle palle la fottuta icmp.dll (winsock maledette)

// IP Header
struct ip
{
    unsigned char    Hlen:4;
    unsigned char    Version:4;
    unsigned char    Tos;
    unsigned short    LungTot;
    unsigned short    Id;
    unsigned short    Flags;
    unsigned char    Ttl;
    unsigned char    Proto;
    unsigned short    Checksum;
    unsigned int    SourceIP;
    unsigned int    DestIP;

};

// ICMP Header
struct icmp {
            BYTE        Type;
            BYTE        Code;
            USHORT        CheckSum;
            USHORT        Id;
            USHORT        Seq;
            ULONG        Dati;
            };

SOCKET                sockfd;
u_int                icmp_init =1;
struct sockaddr_in    clisrc;

// Funzione di checksum

USHORT checksum(USHORT *buffer, int size)
{

  unsigned long cksum=0;

  while(size >1)
  {
    cksum+=*buffer++;
    size -=sizeof(USHORT);
  }

  if(size )
  {
    cksum += *(UCHAR*)buffer;
  }

  cksum = (cksum >> 16) + (cksum & 0xffff);
  cksum += (cksum >>16);
  return (USHORT)(~cksum);
}

// Reimplemento bcopy e bzero... Ma perche' cavolo windows non le
// rende disponibili?

void bzero(char *pnt, int dim_pnt )
{
    memset((char *)&pnt, 0, dim_pnt);
};

void bcopy(char *src, char *dest, int dim_src)
{
    memmove((char *)&dest, (char *)&src, dim_src);
};

// Micro$oft Sucks
// Funzioni di gestione dei pacchetti ICMP
// Fankulo a quegli stronzi maledetti che si sono inventati la icmp.dll
// Brutti bastardi pezzi di merda, la compatibilita' ve la siete ficcata su
// per il culo?
// Micro$oft Sucks

void ICMP_init(void)
    {
    if(icmp_init)
        {
        if((sockfd = socket(AF_INET, SOCK_RAW, IPPROTO_ICMP)) == INVALID_SOCKET)
            {
            fprintf(stderr, "impossibile creare raw ICMP socket");
            exit(0);
            }
        }
    icmp_init = 0;
    };

void ICMP_reset(void)
    {
    closesocket(sockfd);
    icmp_init = 1;
    };

int ICMP_send(char *send_mesg, size_t mesglen, ULONG dest_ip, int echo, int last)
    {
    int                        sparato;
    struct tunnel
        {
        struct icmp         icmp;
        UCHAR             data[MAXMESG];
        } icmp_pk;
    int                        icmplen    = sizeof(struct icmp);
    int                        pack_dim;
    struct sockaddr_in        dest;
    int                        destlen;

    if(mesglen > MAXMESG) return(-1);

    if(icmp_init) ICMP_init();

    destlen                        = sizeof(dest);
    bzero((char *)&dest, destlen);
    dest.sin_family                = AF_INET;
    dest.sin_addr.s_addr        = dest_ip;
    pack_dim                    = mesglen + sizeof(struct icmp);
    memset(&icmp_pk, 0, pack_dim);
    icmp_pk.icmp.Type            = ICMP_ECHOREPLY;
    bcopy(send_mesg, (char *)&icmp_pk.icmp.Dati, mesglen);
    icmp_pk.icmp.CheckSum        = checksum((USHORT *) &icmp_pk.icmp, (sizeof(struct icmp) + mesglen));
    if(echo) icmp_pk.icmp.Seq    = ECHO_TAG;
    if(last) icmp_pk.icmp.Seq    = ECHO_LAST;

    if(sparato = sendto(sockfd, (char *)&icmp_pk, pack_dim, 0, (struct sockaddr *)&dest, destlen) < 0)
        {
        perror("RAW ICMP SendTo: ");
        return(-1);
        }
        else if(sparato != pack_dim)
        {
        perror("dimensioni pacchetto IP errate: ");
        return(-1);
        }
        return(sparato);
    };

int ICMP_recv(char *recv_mesg, size_t mesglen, int echo)
    {
    struct recv
        {
        struct ip    ip;
        struct icmp icmp;
        char        data[MAXMESG];
        } rcv_pk;
    int                pack_dim;
    int                accolto;
    int                iphdrlen;
    int                clilen = sizeof(clisrc);

    if(icmp_init) ICMP_init();
    while(1)
        {
        pack_dim = mesglen + sizeof(struct ip) + sizeof(struct icmp);
        memset(&rcv_pk, 0, pack_dim);
        if((accolto = recvfrom(sockfd, (char *)&rcv_pk, pack_dim, 0, (struct sockaddr *) &clisrc, &clilen)) < 0) continue;

        iphdrlen = rcv_pk.ip.Hlen << 2;
        if(accolto < (iphdrlen + ICMP_MINLEN)) continue;
        accolto -= iphdrlen;

        if(!echo)
            {
            if(!rcv_pk.icmp.Id && !rcv_pk.icmp.Code && rcv_pk.icmp.Type == ICMP_ECHOREPLY && rcv_pk.icmp.Seq != ECHO_TAG && rcv_pk.icmp.Seq != ECHO_LAST) break;
            }
        if(echo)
            {
            if(!rcv_pk.icmp.Id && !rcv_pk.icmp.Code && rcv_pk.icmp.Type == ICMP_ECHOREPLY && (rcv_pk.icmp.Seq == ECHO_TAG || rcv_pk.icmp.Seq == ECHO_LAST)) break;
            }
        }
        if(!echo)
            {
            accolto -= ICMP_HDR;
            bcopy((char *)&rcv_pk.icmp.Dati, recv_mesg, accolto);
            return(accolto);
            }
        if(echo)
            {
            if(rcv_pk.icmp.Seq == ECHO_TAG)
                {
                accolto -= ICMP_HDR;
                bzero(recv_mesg, sizeof(recv_mesg));
                bcopy((char *)&rcv_pk.icmp.Dati, recv_mesg, accolto);
                return(accolto);
                }
            return(-666);
            }
    };