自行构造TCP三次握手的第二次握手包

00011011

楼主比较水，构造的数据包一直有问题，另附上winshark抓包的资料，给位看官给指点指点

[C] 纯文本查看 复制代码

struct EthernetHeader
{
	u_char DestMAC[6];
	u_char SourMAC[6];
	u_short EthType;
};

struct IPHeader
{
	unsigned char Version_HLen;
	unsigned char TOS;
	unsigned short Length;
	short Ident;
	short Flags_Offset;
	unsigned char TTL;
	unsigned char Protocol;
	short Checksum;
	unsigned int SourceAddr;
	unsigned int DestinationAddr;
};

struct PsdTcpHeader
{
	unsigned long SourceAddr;
	unsigned long DestinationAddr;
	char Zero;
	char Protcol;
	unsigned short TcpLen;
};

struct TcpHeader
{
	unsigned short SrcPort;
	unsigned short DstPort;
	unsigned int SequenceNum;
	unsigned int Acknowledgment;
	unsigned char HdrLen;
	unsigned char Flags;
	unsigned short AdvertisedWindow;
	unsigned short Checksum;
	unsigned short UrgPtr;
};

unsigned short checksum(unsigned short *data, int length)
{
	unsigned long temp = 0;
	while (length > 1)
	{
		temp += *data++;
		length -= sizeof(unsigned short);
	}
	if (length)
	{
		temp += *(unsigned short*)data;
	}
	temp = (temp >> 16) + (temp & 0xffff);
	temp += (temp >> 16);
	return (unsigned short)(~temp);
}

void burn_backet(unsigned char *buffer, int packetlen)
{
	struct EthernetHeader ethernet;
	struct IPHeader ipheader;
	struct TcpHeader tcpheader;
	struct PsdTcpHeader psdheader;

	unsigned char buf[100] = { 0 };
	char TcpData[] = "BA BA LA ~ BA BA LA";

	BYTE destmac[8];
	destmac[0] = 0x11;
	destmac[1] = 0x22;
	destmac[2] = 0x33;
	destmac[3] = 0x44;
	destmac[4] = 0x55;
	destmac[5] = 0x66;
	memcpy(ethernet.DestMAC, destmac, 6);
	BYTE hostmac[8];
	hostmac[0] = 0xaa;
	hostmac[1] = 0xbb;
	hostmac[2] = 0xcc;
	hostmac[3] = 0xdd;
	hostmac[4] = 0xee;
	hostmac[5] = 0xff;
	memcpy(ethernet.SourMAC, hostmac, 6);
	ethernet.EthType = htons(0x0800);

	ipheader.Version_HLen = (4 << 4 | sizeof(ipheader) / sizeof(unsigned long));
	ipheader.TOS = 0;
	ipheader.Length = htons(sizeof(struct IPHeader) + sizeof(struct TcpHeader) + strlen(TcpData));
	ipheader.Ident = 0x00bf;
	ipheader.Flags_Offset = 0;
	ipheader.TTL = 128;
	ipheader.Protocol =IPPROTO_TCP;
	ipheader.Checksum = 0;
	ipheader.SourceAddr = inet_addr(CHAR_SOURCE_IPHEADER);
	ipheader.DestinationAddr = inet_addr(CHAR_TARGET_IPHEADER);

	tcpheader.DstPort = htons(80);
	tcpheader.SrcPort = htons(80);
	tcpheader.SequenceNum = 0x99;
	tcpheader.Acknowledgment = 1;							//ACK
	tcpheader.HdrLen = (sizeof(tcpheader)/4<<4|0);			//首部长度
	tcpheader.Flags = 0x12;								//SYN
	tcpheader.AdvertisedWindow = htons(512);
	tcpheader.UrgPtr = 0;
	tcpheader.Checksum = 0;
	
	psdheader.SourceAddr = ipheader.SourceAddr;
	psdheader.DestinationAddr = ipheader.DestinationAddr;
	psdheader.Zero = 0;
	psdheader.Protcol = IPPROTO_TCP;
	psdheader.TcpLen = htons(sizeof(struct TcpHeader) + strlen(TcpData));

	char TempBuffer[100] = { 0 };
	memcpy(TempBuffer, &psdheader, sizeof(struct PsdTcpHeader));
	memcpy(TempBuffer + sizeof(struct PsdTcpHeader), &tcpheader, sizeof(struct TcpHeader));
	memcpy(TempBuffer + sizeof(struct PsdTcpHeader) + sizeof(struct TcpHeader), TcpData, strlen(TcpData));
	tcpheader.Checksum = checksum((USHORT*)(TempBuffer), sizeof(struct PsdTcpHeader) + sizeof(struct TcpHeader) + strlen(TcpData));

	memset(TempBuffer, 0, sizeof(TempBuffer));

	memcpy(TempBuffer, &ipheader, sizeof(struct IPHeader));
	ipheader.Checksum = checksum((USHORT*)(TempBuffer), sizeof(struct IPHeader));

	memcpy(buf, eernet, sizeof(struct EthernetHeader));
	//memcpy(buf + sizeof(struct EthernetHeader), &ipheader, sizeof(struct IPHeader));
	memcpy(buf + sizeof(struct EthernetHeader), &ipheader, 20);
	memcpy(buf + sizeof(struct EthernetHeader) + sizeof(struct IPHeader), &tcpheader, sizeof(struct TcpHeader));
	memcpy(buf + sizeof(struct EthernetHeader) + sizeof(struct IPHeader) + sizeof(struct TcpHeader), TcpData, strlen(TcpData));
	
	memcpy(buffer, buf, sizeof(buf));
}

johnchang96

00011011 发表于 2017-5-21 10:28
就是我构造了个TCP数据包，发送的时候一直有 Frame check sequence 这项出错，我比较水不知道是怎么回事 ...

CRC计算出错了呗
上网找个别人的计算方法就好了

johnchang96

johnchang96 发表于 2017-8-28 16:12
CRC计算出错了呗
上网找个别人的计算方法就好了

补充，wireshark写的很清楚了，FCS的值你计算的是0x00000000,也就是根本没计算啊

shipon

说白了，我一个都没看懂。

zerg

小白，看不懂啊。

dice1412

纯支持了

00011011

shipon 发表于 2017-5-21 09:21
说白了，我一个都没看懂。

就是我构造了个TCP数据包，发送的时候一直有 Frame check sequence 这项出错，我比较水不知道是怎么回事，求教 真心

逆向学习菜鸟

伪造了，有什么用

00011011

逆向学习菜鸟 发表于 2017-5-21 10:59
伪造了，有什么用

我在做一个IDLE扫描器，需要构造一个伪造IP地址的TCP数据包

非寒

共同学习

逆向学习菜鸟

00011011 发表于 2017-5-21 11:17
我在做一个IDLE扫描器，需要构造一个伪造IP地址的TCP数据包

成功了吗  我没成功