SNIFFER TCP AVEC LES RAW SOCKETS

#include <cstdlib>
#include <iostream>
#include <winsock2.h>
#include <windows.h>
#pragma comment(lib,"ws2_32.lib")

#define SIO_RCVALL _WSAIOW(IOC_VENDOR,1)
#define RCVALL_ON 1 
#define RCVALL_OFF 0

using namespace std;

/*
Sniffer TCP with Raw Sockets by lilxam
*/

typedef struct iphdr //Entete IP
{
  unsigned char  IHL:4; 
  unsigned char  Version   :4;  // 4-bit IPv4 version
  unsigned char  TypeOfService;           // IP type of service
  unsigned short TotalLength;  // Total length
  unsigned short ID;            // Unique identifier  
  unsigned char  FlagOffset   :5;        // Fragment offset field
  unsigned char  MoreFragment :1;
  unsigned char  DontFragment :1;
  unsigned char  ReservedZero :1;
  unsigned char  FragOffset;    //fragment offset
  unsigned char  Ttl;           // Time to live
  unsigned char  Protocol;      // Protocol(TCP,UDP etc)
  unsigned short Checksum;      // IP checksum
  unsigned int   Source;       // Source address
  unsigned int   Destination;      // Source address
}IP_HDR;   

typedef struct tcphdr // Entete TCP
{
    unsigned short PortSource;
    unsigned short PortDest;
    unsigned int seqnum;
    unsigned int acknum;
    unsigned char unused:4, tcp_hl:4;
    unsigned char flags;
    unsigned short window;
    unsigned short checksum;
    unsigned short urgPointer;
} TCP_HDR;
    
int main(int argc, char *argv[])
{
    char ip[100];
    unsigned short portS, portD;
    char trame[4096];
    char *donnees = NULL;
    unsigned int option;
    
    /* Accés au réseau */ 
    WSAData wsa;
    if(WSAStartup(MAKEWORD(2,2), &wsa) != 0)
    {
        printf("\n[!]Impossible d'acceder au reseau.\n--- Erreur avec WSAStartup() : %d\n\n", WSAGetLastError());
        system("pause");
        return 0;
    }

    /* Creation d'un socket 
    
    Référence : http://msdn2.microsoft.com/en-us/library/ms740506(VS.85).aspx
        
    Prototype de la fontionc socket() :
        SOCKET WSAAPI socket(
          __in  int af,
          __in  int type,
          __in  int protocol
        );
    */
    
    SOCKET sock;
    if((sock = socket(AF_INET, SOCK_RAW, IPPROTO_IP)) == INVALID_SOCKET)
    {
        printf("\n[!]Impossible de creer le socket.\n--- Erreur avec socket() : %d\n\n", WSAGetLastError());
        system("pause");
        return 0;
    }
   
    /* Initialisation des parametres d'écoute */
    SOCKADDR_IN sin;
    sin.sin_family = AF_INET;
    sin.sin_addr.s_addr = inet_addr("192.168.0.11"); //Votre ip locale
    
    /* Ecoute du réseau 
    
    Prototype de la fonction bind() :
        int bind(
          __in  SOCKET s,
          __in  const struct sockaddr* name,
          __in  int namelen
        );
    */
    
    if(bind(sock, (SOCKADDR*)&sin, sizeof(sin)) == SOCKET_ERROR)
    {
        printf("\n[!]Ecoute impossible.\n--- Erreur avec bind() : %d\n\n", WSAGetLastError());
        closesocket(sock);
        system("pause");
        return 0;
    }

    
    /* Activation du mode promiscuous 
    Référence : http://msdn2.microsoft.com/en-us/library/ms741621(VS.85).aspx
    
    Prototype de la fonction WASIoctl() :
        
        int WSAIoctl(
          __in   SOCKET s,
          __in   DWORD dwIoControlCode,
          __in   LPVOID lpvInBuffer,
          __in   DWORD cbInBuffer,
          __out  LPVOID lpvOutBuffer,
          __in   DWORD cbOutBuffer,
          __out  LPDWORD lpcbBytesReturned,
          __in   LPWSAOVERLAPPED lpOverlapped,
          __in   LPWSAOVERLAPPED_COMPLETION_ROUTINE lpCompletionRoutine
        );
    */
    
    DWORD dwBytesRet;
    WSAIoctl(sock,SIO_RCVALL,&option,sizeof(option),NULL,0,&dwBytesRet,NULL,NULL);
    
    
    /* Gestion des données récupérées sur la trame */
    iphdr *HeaderIP=(iphdr*)trame; // voila
    tcphdr *HeaderTCP=(tcphdr*)(sizeof(iphdr)+trame);
    donnees = (char *)(sizeof(tcphdr)+sizeof(iphdr)+trame);
    char tmp[2048];
    
    for(;;)
    {
        /* En attente de packet */
        recv(sock, trame, sizeof(trame), 0);

        /* Traitement des données */
        printf("\n\n    --------| Nouveau Packet |--------");
        portS = ntohs(HeaderTCP->PortSource);
        portD = ntohs(HeaderTCP->PortDest);
        sprintf(ip,"%s:%d",inet_ntoa(*(struct in_addr *)&HeaderIP->Source), portS);
        printf("\n      [+]IP Source : %s",ip);
        sprintf(ip,"%s:%d",inet_ntoa(*(struct in_addr *)&HeaderIP->Destination), portD);
        printf("\n      [+]IP Destination : %s",ip);
        printf("\n      [+]IP Version : %d -> 0x%x", HeaderIP->Version, HeaderIP->Version);
        printf("\n      [+]IP Checksum : %d -> 0x%x", HeaderIP->Checksum, HeaderIP->Checksum);
        printf("\n      [+]Protocol : %d -> 0x%x", HeaderIP->Protocol, HeaderIP->Protocol);
        
        
        memset(tmp, 0, sizeof(tmp));
        for(int i = 0; i <= 2048; i++)
        {
            tmp[i] = donnees[i];
        }
        printf("\n\n    -----* Donnees *----- \n\n%s\n               [...]\n    ------------------------------\n", tmp);
        
    }

    closesocket(sock);
    
    system("PAUSE");
    return EXIT_SUCCESS;
}

Télécharger le zip

25 janvier 2008 16:31:11 :

Changement de catégorie

25 janvier 2008 20:18:46 :

Correction d'une erreur.

25 janvier 2008 20:42:43 :

idem

• STACK WATCHER
• PROCESS DUMPER
• INJECTION DE DLL DANS UN PROCESSUS
• PE ANALYSER

• LIAISON SERIE RS-232
• YAHOO OR GOOGLE
• [WIN32][C][DEV-C++] GRAPH TRANSPARENT DEBIT RESEAU
• [WIN32][C][DEV-C++]MIBREAD SNMP LECTEUR DE MIB RESEAU
• FAST BASE64 / UUENCODING ENCODAGE/DECODAGE

• COMMUNICATION CLIENT SERVEUR , TRANSMITION DE DONNÉES PAR TRAMES , SOCKETS EN LANGAGE C
• LIBCONNECT - BIBLIOTHÈQUE C++ DE CONNEXION
• [WIN32][C][DEV-C++] SNIFF EN RAW SOCKET, AVEC ANNALYSE DES TRAMES
• [C/WINPCAP]SNIFFER TCP(ANALYSEUR DE TRAMES) POUR WINDOWS
• TUTORIAL : LES SOCKETS SOUS WIN (TCP & UDP)