Last active
December 19, 2015 17:29
-
-
Save eviltik/5991630 to your computer and use it in GitHub Desktop.
raw socket non working syn packet (bad checksum)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
/* | |
tcpdump -v -n -i lo -x | |
NMAP result (nmap -sS 127.0.0.1 -p 23) | |
root@debian:/home/zenetik# tcpdump -vvv -i lo -n ip | |
tcpdump: listening on lo, link-type EN10MB (Ethernet), capture size 65535 bytes | |
21:50:20.794277 IP (tos 0x0, ttl 40, id 56063, offset 0, flags [none], proto TCP (6), length 44) | |
127.0.0.1.56649 > 127.0.0.1.23: Flags [S], cksum 0x17c8 (correct), seq 1809790236, win 1024, options [mss 1460], length 0 | |
21:50:20.794292 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 44) | |
127.0.0.1.23 > 127.0.0.1.56649: Flags [S.], cksum 0xfe20 (incorrect -> 0xa280), seq 2375108310, ack 1809790237, win 43690, options [mss 65495], length 0 | |
21:50:20.794297 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 40) | |
127.0.0.1.56649 > 127.0.0.1.23: Flags [R], cksum 0x3381 (correct), seq 1809790237, win 0, length 0 | |
---------------- | |
syn_ok.js | |
syn.js result : | |
20:09:03.216809 IP (tos 0x0, ttl 47, id 32969, offset 0, flags [none], proto TCP (6), length 44) | |
127.0.0.1.44924 > 127.0.0.1.23: Flags [S], cksum 0x01df (incorrect -> 0x53aa), seq 3712857496, win 1024, options [mss 1460], length 0 | |
0x0000: 4500 002c 80c9 0000 2f06 0d01 7f00 0001 | |
0x0010: 7f00 0001 af7c 0017 dd4d b598 0000 0000 | |
0x0020: 6002 0400 01df 0000 0204 05b4 | |
IP Header | |
0 1 2 3 | |
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
|Version| IHL |Type of Service| Total Length | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| Identification |Flags| Fragment Offset | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| Time to Live | Protocol | Header Checksum | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| Source Address | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| Destination Address | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| Options | Padding | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
TCP Headers | |
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| Source Port | Destination Port | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| Sequence Number | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| Acknowledgment Number | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| Data | |U|A|P|R|S|F| | | |
| Offset| Reserved |R|C|S|S|Y|I| Window | | |
| | |G|K|H|T|N|N| | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| Checksum | Urgent Pointer | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| Options | Padding | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| data | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
*/ | |
var raw = require ("raw-socket"); | |
var options = { | |
protocol: raw.Protocol.TCP, | |
//checksumOffset:0x2c | |
//checksumOffset:0x27 | |
}; | |
var socket = raw.createSocket(options); | |
var ipBuffer = new Buffer([ | |
0x45, // IP: version (ipv4, static value) | |
0x00, // IP: Internet Header Length (updated by the module ?) | |
0x00,0x2c, // IP: Type of service (update by the module ?) | |
0x80,0xc9,0x00,0x00, // IP: Total length (updated by the module ?) | |
0x2f, // IP: TTL (updated by the module ?) | |
0x06, // IP: protocol (ICMP=1, IGMP=2, TCP=6, UDP=17, static value) | |
0x00,0x00, // IP: checksum for IP part of this packet (computed by the module ?) | |
0x7f,0x00,0x00,0x01, // IP: ip src (127.0.0.1) | |
0x7f,0x00,0x00,0x01, // IP: ip dst (127.0.0.1) | |
]); | |
var tcpBuffer = new Buffer([ | |
0xaf,0x7c, // TCP: src port (should be random) | |
0x00,0x17, // TCP: dst port (should be the port you want to scan) | |
0xdd,0x4d,0xb5,0x98, // TCP: sequence number (should be random) | |
0x00,0x00,0x00,0x00, // TCP: acquitment number (must be null because WE are intiating the SYN, static value) | |
0x60, // TCP: header length (data offset, static value, seem's not updated by the module) | |
0x02, // TCP: flags (fin=1,syn=2,rst=4,psh=8,ack=16,urg=32, static value) | |
0x04,0x00, // TCP: window 1024 | |
0x00,0x00, // TCP: checksum for TCP part of this packet) | |
//0x53,0xaa, // TCP: good values checksum for TCP part of this packet) | |
0x00,0x00, // TCP: ptr urgent | |
0x02,0x04, // TCP: options | |
0x05,0xb4 // TCP: padding (mss=1460, static value) | |
]); | |
var pseudoBuffer = new Buffer([ | |
ipBuffer[12],ipBuffer[13],ipBuffer[14],ipBuffer[15], | |
ipBuffer[16],ipBuffer[17],ipBuffer[18],ipBuffer[19], | |
0x00, | |
ipBuffer[9], | |
(tcpBuffer.length >> 8) & 0xff, (tcpBuffer.length & 0xff), | |
]) | |
raw.writeChecksum(ipBuffer, 10, raw.createChecksum(ipBuffer)); | |
var options = { | |
buffer:pseudoBuffer, | |
offset:0, | |
length:pseudoBuffer.length | |
} | |
raw.writeChecksum(tcpBuffer, 16, raw.createChecksum(pseudoBuffer)); | |
var buffer = Buffer.concat([ipBuffer,tcpBuffer]); | |
socket.on ("message", function (buffer, source) { | |
var port = buffer[0x14] * 0x100 + buffer[0x15]; | |
if (buffer[0x09] == 0x06) { | |
// TCP flag found | |
if (buffer[0x21] == 0x12) { | |
// SYN flag found | |
process.stdout.write('\nReceived SYN from '+source+':'+port+'\n'); | |
} else { | |
process.stdout.write('.'); | |
} | |
} else { | |
process.stdout.write('.'); | |
} | |
}); | |
var beforeSend = function(b) { | |
socket.setOption( | |
raw.SocketLevel.IPPROTO_IP, | |
raw.SocketOption.IP_HDRINCL, | |
0x11 | |
); | |
} | |
socket.send (buffer, 0, buffer.length, '127.0.0.1', beforeSend, function (error, bytes) { | |
if (error) { | |
console.log (error.toString ()); | |
} else { | |
console.log ("sent " + bytes+" bytes"); | |
} | |
}); |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
You need to do
pseudoBuffer = Buffer.concat([pseudoBuffer, tcpBuffer]);
before checksum creation