Hacking-The-Art-Of-Explotation/codigo/0x470/synscan.c at main · tostolaza/Hacking-The-Art-Of-Explotation · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
// Half-open SYN scan en C — manda SYN, lee SYN-ACK o RST.
// Versión educativa simplificada (no maneja retransmisiones ni estados raros).
//
// Uso: sudo ./synscan <target_ip> <start_port> <end_port>
#include "../0x260/0x265_hacking.h"
#include <netinet/ip.h>
#include <netinet/tcp.h>

unsigned short ip_csum(unsigned short *p, int n) {
    unsigned long s = 0;
    while (n > 1) { s += *p++; n -= 2; }
    if (n == 1) s += *(unsigned char *) p;
    while (s >> 16) s = (s & 0xffff) + (s >> 16);
    return (unsigned short) ~s;
}

struct pseudo_hdr {
    unsigned int src, dst;
    unsigned char zero, proto;
    unsigned short tcp_len;
};

unsigned short tcp_csum(struct iphdr *ip, struct tcphdr *tc) {
    char buf[1500] = {0};
    struct pseudo_hdr *ph = (struct pseudo_hdr *) buf;
    ph->src = ip->saddr; ph->dst = ip->daddr;
    ph->zero = 0; ph->proto = IPPROTO_TCP;
    ph->tcp_len = htons(sizeof(*tc));
    memcpy(buf + sizeof(*ph), tc, sizeof(*tc));
    return ip_csum((unsigned short *) buf, sizeof(*ph) + sizeof(*tc));
}

int main(int argc, char *argv[]) {
    if (argc < 4) {
        fprintf(stderr, "Uso: %s <target_ip> <start_port> <end_port>\n", argv[0]);
        return 1;
    }
    char *target = argv[1];
    int start = atoi(argv[2]), end = atoi(argv[3]);

    int sock = socket(AF_INET, SOCK_RAW, IPPROTO_TCP);
    if (sock < 0) fatal("socket (necesitas root)");
    int one = 1;
    setsockopt(sock, IPPROTO_IP, IP_HDRINCL, &one, sizeof one);

    int recv_sock = socket(AF_INET, SOCK_RAW, IPPROTO_TCP);
    if (recv_sock < 0) fatal("recv socket");
    struct timeval tv = {.tv_sec = 1};
    setsockopt(recv_sock, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof tv);

    char pkt[sizeof(struct iphdr) + sizeof(struct tcphdr)];
    struct iphdr  *ip = (struct iphdr *)  pkt;
    struct tcphdr *tc = (struct tcphdr *) (pkt + sizeof(struct iphdr));

    struct sockaddr_in dst = {.sin_family = AF_INET};
    inet_pton(AF_INET, target, &dst.sin_addr);

    printf("Escaneando %s puertos %d..%d\n", target, start, end);
    for (int port = start; port <= end; port++) {
        memset(pkt, 0, sizeof pkt);
        ip->ihl = 5; ip->version = 4;
        ip->tot_len = htons(sizeof pkt);
        ip->ttl = 64; ip->protocol = IPPROTO_TCP;
        ip->saddr = inet_addr("192.168.0.99");      // ajustar a tu IP real
        ip->daddr = dst.sin_addr.s_addr;
        ip->check = ip_csum((unsigned short *) ip, sizeof(struct iphdr));

        tc->source = htons(40000 + (port % 1000));
        tc->dest   = htons(port);
        tc->seq    = htonl(0xdeadbeef);
        tc->doff   = 5; tc->syn = 1; tc->window = htons(65535);
        tc->check  = tcp_csum(ip, tc);

        sendto(sock, pkt, sizeof pkt, 0, (struct sockaddr *) &dst, sizeof dst);

        char rbuf[1500];
        ssize_t n = recv(recv_sock, rbuf, sizeof rbuf, 0);
        if (n > 0) {
            struct iphdr  *rip = (struct iphdr *)  rbuf;
            struct tcphdr *rtc = (struct tcphdr *) (rbuf + rip->ihl * 4);
            if (ntohs(rtc->source) == port && rip->saddr == dst.sin_addr.s_addr) {
                if (rtc->syn && rtc->ack) printf("  %5d  open\n", port);
                else if (rtc->rst)        ; // closed: no log
            }
        }
    }
    close(sock); close(recv_sock);
    return 0;
}