拦截SendArp伪造对应局域网主机MAC地址

    xiaoxiao2024-04-07  108

    int _tmain(int argc, _TCHAR* argv[]) { inithook(); MIB_IPADDRTABLE *pIPAddrTable = (MIB_IPADDRTABLE*)malloc(sizeof(MIB_IPADDRTABLE)); ULONG dwRetVal = 0, dwSize = 0; if (GetIpAddrTable(pIPAddrTable, &dwSize, 0) == ERROR_INSUFFICIENT_BUFFER) { free(pIPAddrTable); pIPAddrTable = (MIB_IPADDRTABLE*)malloc(dwSize); } if ((dwRetVal = GetIpAddrTable(pIPAddrTable, &dwSize, 0)) == NO_ERROR) { ULONG ulHostIp = ntohl(pIPAddrTable->table[0].dwAddr); ULONG ulHostMask = ntohl(pIPAddrTable->table[0].dwMask); for (ULONG i = 0; i < (~ulHostMask); i++) { static ULONG uNo = 0; HRESULT hr;//函数返回值结构 IPAddr ipAddr; ULONG pulMac[2]; ULONG ulLen; ipAddr = htonl(i + (ulHostIp&ulHostMask)); unsigned char* strIpAddr = (unsigned char*)(&ipAddr); memset(pulMac, 0xff, sizeof(pulMac)); ulLen = 6; printf("IP_Address: %d.%d.%d.%d\n", strIpAddr[0], strIpAddr[1], strIpAddr[2], strIpAddr[3]); hr = SendARP(ipAddr, 0, pulMac, &ulLen); if (ulLen == 6) { PBYTE pbHexMac = (PBYTE)pulMac; //PBYTE:无符号单字节数值 printf("SendARP 获取MAC: X X X X X X\n", pbHexMac[0], pbHexMac[1], pbHexMac[2], pbHexMac[3], pbHexMac[4], pbHexMac[5]); getchar(); } } } else { printf("GetAddrTable Failed!"); } printf("Over!"); free(pIPAddrTable); getch(); }

    HOOK 方式 拦截 DeviceIoControl通信

    if (ADR1 != 0) { byte ip_1 = *(byte*)((DWORD)ADR1); byte ip_2 = *(byte*)((DWORD)ADR1 + 1); byte ip_3 = *(byte*)((DWORD)ADR1 + 2); byte ip_4 = *(byte*)((DWORD)ADR1 + 3); byte ip_5 = *(byte*)((DWORD)ADR1 + 4); byte ip_6 = *(byte*)((DWORD)ADR1 + 5); printf("IoControlCode 原始MAC:%X.%X.%X.%X.%X.%X \r\n", ip_1, ip_2, ip_3, ip_4,ip_5,ip_6); if (ip_1!=1) { *(byte*)((DWORD)ADR1) = 0x1; *(byte*)((DWORD)ADR1 + 1) = 0x2; *(byte*)((DWORD)ADR1 + 2) = 0x3; *(byte*)((DWORD)ADR1 + 3) = 0x4; *(byte*)((DWORD)ADR1 + 4) = 0x5; *(byte*)((DWORD)ADR1 + 5) = 0x6; } }

    也可以屏蔽对指定ip的Arp请求,具体偏移 [Buffer]+0x10 这个参数NSI.dll中未公开 是一个结构体 内部3个指针,NSI内部使用 NsiGet(Set)xxx 来初始化这个结构体

    最新回复(0)