Skip to content

Instantly share code, notes, and snippets.

@eviltik
Created June 19, 2013 19:28
Show Gist options
  • Save eviltik/5817244 to your computer and use it in GitHub Desktop.
Save eviltik/5817244 to your computer and use it in GitHub Desktop.
TCP + IP = generateChecksums failed, i've tried every offsets !
/*
tcpdump -vvv -i lo -n ip
NMAP result (nmap -sS localhost -p 23)
root@debian:/home/zenetik# tcpdump -vvv -i lo -n ip
tcpdump: listening on lo, link-type EN10MB (Ethernet), capture size 65535 bytes
21:50:20.794277 IP (tos 0x0, ttl 40, id 56063, offset 0, flags [none], proto TCP (6), length 44)
127.0.0.1.56649 > 127.0.0.1.23: Flags [S], cksum 0x17c8 (correct), seq 1809790236, win 1024, options [mss 1460], length 0
21:50:20.794292 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 44)
127.0.0.1.23 > 127.0.0.1.56649: Flags [S.], cksum 0xfe20 (incorrect -> 0xa280), seq 2375108310, ack 1809790237, win 43690, options [mss 65495], length 0
21:50:20.794297 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 40)
127.0.0.1.56649 > 127.0.0.1.23: Flags [R], cksum 0x3381 (correct), seq 1809790237, win 0, length 0
syn.js result :
1:51:01.309365 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 48)
127.0.0.1.35643 > 127.0.0.1.23: Flags [S], cksum 0x0000 (incorrect -> 0x01db), seq 234156285:234156289, win 1024, options [mss 1460], length 4
*/
/*
IP Header
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Version| IHL |Type of Service| Total Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Identification |Flags| Fragment Offset |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Time to Live | Protocol | Header Checksum |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Source Address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Destination Address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Options | Padding |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
TCP Headers
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Source Port | Destination Port |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Sequence Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Acknowledgment Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Data | |U|A|P|R|S|F| |
| Offset| Reserved |R|C|S|S|Y|I| Window |
| | |G|K|H|T|N|N| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Checksum | Urgent Pointer |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Options | Padding |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| data |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
*/
var raw = require ("raw-socket");
var options = {
protocol: raw.Protocol.TCP,
//checksumOffset:0x2c
//checksumOffset:0x27
};
var socket = raw.createSocket(options);
var ipBuffer = new Buffer([
0x45, // IP: version (ipv4, static value)
0x00, // IP: Internet Header Length (updated by the module ?)
0x00,0x00, // IP: Type of service (update by the module ?)
0x00,0x00,0x00,0x00, // IP: Total length (updated by the module ?)
0x00, // IP: TTL (updated by the module ?)
0x06, // IP: protocol (ICMP=1, IGMP=2, TCP=6, UDP=17, static value)
0x00,0x00, // IP: checksum for IP part of this packet (computed by the module ?)
0x7f,0x00,0x00,0x01, // IP: ip src (127.0.0.1)
0x7f,0x00,0x00,0x01, // IP: ip dst (127.0.0.1)
]);
var tcpBuffer = new Buffer([
0x8e,0x37, // TCP: src port (should be random)
0x00,0x17, // TCP: dst port (should be the port you want to scan)
0x0b,0x9b,0x3b,0x97, // TCP: sequence number (should be random)
0x00,0x00,0x00,0x00, // TCP: acquitment number (must be null because WE are intiating the SYN, static value)
0x60, // TCP: header length (data offset, static value, seem's not updated by the module)
0x02, // TCP: flags (fin=1,syn=2,rst=4,psh=8,ack=16,urg=32, static value)
0x04,0x00, // TCP: window 1024
0xc0,0xa3, // TCP: checksum for TCP part of this packet)
0x00,0x00, // TCP: ptr urgent
0x02,0x04, // TCP: options
0x05,0xb4 // TCP: padding (mss=1460, static value)
]);
var buffer = Buffer.concat([ipBuffer,tcpBuffer],ipBuffer.length+tcpBuffer.length);
var setPort = function(buf,port,offset) {
buf[offset] = (port >> 8) & 0xff;
buf[offset + 1] = (port & 0xff);
}
var setPortDst = function(buf,port) {
//setPort(buf,port,0x02);
}
var setPortSrc = function(buf,port) {
setPort(buf,port,0x00);
}
var setTcpChecksum = function(buf) {
var sum = 0;
var _sourceIP = 0x0c;
var _destIP = 0x10;
var _protocol = 0x09;
sum += buf[_sourceIP] * 0x100 + buf[_sourceIP + 1] + buf[_sourceIP + 2] * 0x100 + buf[_sourceIP + 3];
sum += buf[_destIP] * 0x100 + buf[_destIP + 1] + buf[_destIP + 2] * 0x100 + buf[_destIP + 3];
sum += buf[_protocol];
return sum;
}
setPortDst(buffer,21);
//setPortSrc(buffer,4444); // port src should be random, not static
//setCrc(buffer);
var target = '127.0.0.1';
socket.on ("close", function () {
console.log ("socket closed");
process.exit (-1);
});
socket.on ("error", function (error) {
console.log ("error: " + error.toString ());
process.exit (-1);
});
socket.on ("message", function (buffer, source) {
var port = buffer[0x14] * 0x100 + buffer[0x15];
if (buffer[0x09] == 0x06) {
// TCP flag found
if (buffer[0x21] == 0x12) {
// SYN flag found
process.stdout.write('\nReceived SYN from '+source+':'+port+'\n');
} else {
process.stdout.write('.');
}
} else {
process.stdout.write('.');
}
});
var beforeSend = function() {
socket.setOption(
raw.SocketLevel.IPPROTO_IP,
raw.SocketOption.IP_HDRINCL,
new Buffer ([0x00, 0x00, 0x00, 0x11]),
4);
socket.generateChecksums(true,1);
}
socket.send (buffer, 0, buffer.length, '127.0.0.1', beforeSend, function (error, bytes) {
if (error) {
console.log (error.toString ());
} else {
console.log ("sent " + bytes + " bytes to " + target);
}
});
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment