Created
June 19, 2013 19:29
-
-
Save eviltik/5817266 to your computer and use it in GitHub Desktop.
TCP only, generateChecksum failed too, every offsets tested, alternative routines for checksum calculation failed too
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
/* | |
IP Header | |
0 1 2 3 | |
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
|Version| IHL |Type of Service| Total Length | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| Identification |Flags| Fragment Offset | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| Time to Live | Protocol | Header Checksum | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| Source Address | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| Destination Address | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| Options | Padding | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
TCP Headers | |
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| Source Port | Destination Port | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| Sequence Number | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| Acknowledgment Number | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| Data | |U|A|P|R|S|F| | | |
| Offset| Reserved |R|C|S|S|Y|I| Window | | |
| | |G|K|H|T|N|N| | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| Checksum | Urgent Pointer | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| Options | Padding | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| data | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
*/ | |
var raw = require ("raw-socket"); | |
var options = { | |
protocol: raw.Protocol.TCP, | |
generateChecksums:false, | |
//checksumOffset:128 | |
//checksumOffset:22 | |
//checksumOffset:0x27 | |
}; | |
var socket = raw.createSocket(options); | |
var buffer = new Buffer([ | |
0x8e,0x37, // TCP: src port (should be random) | |
0x00,0x17, // TCP: dst port (should be the port you want to scan) | |
0x0b,0x9b,0x3b,0x97, // TCP: sequence number (should be random) | |
0x00,0x00,0x00,0x00, // TCP: acquitment number (must be null because WE are intiating the SYN, static value) | |
0x60, // TCP: header length (data offset, static value, seem's not updated by the module) | |
0x02, // TCP: flags (fin=1,syn=2,rst=4,psh=8,ack=16,urg=32, static value) | |
0x04,0x00, // TCP: window 1024 | |
0xc0,0xa3, // TCP: checksum for TCP part of this packet) | |
//0x00,0x00, // TCP: checksum for TCP part of this packet) | |
0x00,0x00, // TCP: ptr urgent | |
0x02,0x04, // TCP: options | |
0x05,0xb4 // TCP: padding (mss=1460, static value) | |
]); | |
//console.log('ici',0xc0*100+0xa3); // 19363 | |
var setPort = function(buf,port,offset) { | |
buf[offset] = (port >> 8) & 0xff; | |
buf[offset + 1] = (port & 0xff); | |
} | |
var setPortDst = function(buf,port) { | |
setPort(buf,port,0x02); | |
} | |
var setPortSrc = function(buf,port) { | |
setPort(buf,port,0x00); | |
} | |
var setTcpChecksum = function(buf) { | |
var sum = 0; | |
var _sourceIP = 0x0c; | |
var _destIP = 0x10; | |
var _protocol = 0x09; | |
for (var i = 0; i < buf.length ; i += 2) | |
sum += buf[i + 1] + buf[i] * 0x100; | |
var src = ''; | |
for (var i = 0;i<4;i++) { | |
src+=buf[_sourceIP+i]+'.'; | |
} | |
src = src.replace(/\.$/,''); | |
var dst = ''; | |
for (var i = 0;i<4;i++) { | |
dst+=buf[_destIP+i]+'.'; | |
} | |
dst = dst.replace(/\.$/,''); | |
sum += buf[_sourceIP] * 0x100 + | |
buf[_sourceIP + 1] + | |
buf[_sourceIP + 2] * 0x100 + | |
buf[_sourceIP + 3]; | |
sum += buf[_destIP] * 0x100 + | |
buf[_destIP + 1] + | |
buf[_destIP + 2] * 0x100 + | |
buf[_destIP + 3]; | |
sum += buf[_protocol]; | |
sum += buf.length; | |
while ((sum >> 16) > 0) | |
sum = (sum & 0xffff) + (sum >> 16); | |
sum = ~sum; | |
//buf[0x10] = (sum >> 8) & 0xff; | |
//buf[0x10 + 1] = sum & 0xff; | |
console.log(src+'->'+dst,sum); | |
return sum; | |
} | |
//setPortDst(buffer,23); | |
//setPortSrc(buffer,4444); // port src should be random, not static | |
//setTcpChecksum(buffer); | |
socket.on ("close", function () { | |
console.log ("socket closed"); | |
process.exit (-1); | |
}); | |
socket.on ("error", function (error) { | |
console.log ("error: " + error.toString ()); | |
process.exit (-1); | |
}); | |
socket.on ("message", function (buffer, source) { | |
var port = buffer[0x14] * 0x100 + buffer[0x15]; | |
if (buffer[0x09] == 0x06) { | |
// TCP flag found | |
if (buffer[0x21] == 0x12) { | |
// SYN flag found | |
//process.stdout.write('\nReceived SYN from '+source+':'+port+'\n'); | |
//console.log('Received SYN from '+source+':'+port+'\n'); | |
} else { | |
//process.stdout.write('.'); | |
} | |
} else { | |
//process.stdout.write('.'); | |
} | |
}); | |
var target = '127.0.0.1'; | |
var level = raw.SocketLevel.IPPROTO_IP; | |
var option = raw.SocketOption.IP_HDRINCL; | |
var i = 0; | |
var max = 2; | |
while (i<max) { | |
socket.send (buffer, 0, buffer.length, target, function() { | |
//console.log(socket.buffer); | |
/* | |
var a = new Buffer ([0x00, 0x00, 0x00, 0x01]); | |
socket.setOption (level, option, a, a.length); | |
*/ | |
//socket.generateChecksums(true,16,true); | |
//console.log(socket.buffer.toString('hex')); | |
//setTcpChecksum(socket.buffer); | |
}, function (error, bytes) { | |
if (error) { | |
console.log (error.toString ()); | |
} | |
}); | |
i++; | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment