Tcp syn portscan code in C with Linux sockets-阿里云开发者社区

Port Scanning searches for open ports on a remote system. The basic logic for a portscanner would be to connect to the port we want to check. If the socket gives a valid connection without any error then the port is open , closed otherwise (or inaccessible, or filtered).

This basic technique is called TCP Connect Port Scanning in which we use something like a loop to connect to ports one by one and check for valid connections on the socket.

But this technique has many drawbacks :

1. It is slow since it establishes a complete 3 way TCP handshake. It waits for the connect() function to return.
2. It is detectable. It leaves more logs on the remote system and on any firewall that is running.

TCP-Syn Port scanning is a technique which intends to cure these two problems. The mechanism behind it is the handshaking which takes place while establishing a connection. It sends syn packets and waits for an syn+ack reply. If such a reply is received then the port is open otherwise keep waiting till timeout and report the port as closed. Quite simple! In the TCP connect technique the connect() function sends a ack after receiving syn+ack and this establishes a complete connection. But in Syn scanning the complete connection is not made.

This results in :
1. Faster scans – Partial TCP handshake is done. Only 2 packets exchanged , syn and syn+ack.
2. Incomplete connections so less detectable. But modern firewalls are smart enough to log all syn activites. So this technique is more or less detectable to same extent as TCP connect port scanning.

TCP Connect Port Scan looks like :

You -> Send Syn packet -> Host:port
Host -> send syn/ack packet -> You
You -> send ack packet -> Host

… and connection is established

TCP-Syn Port scan looks like

You -> send syn packet ->Host:port
Host -> send syn/ack or rst packet or nothing depending on the port status -> You

… stop and analyse the reply the host send :
If syn+ack reply then port open.
Closed/filtered otherwise.

Results are almost as accurate as that of TCP connection and the scan is much faster.

So the process is :

1. Send a Syn packet to a port A
2. Wait for a reply of Syn+Ack till timeout.
3. Syn+Ack reply means the port is open , Rst packet means port is closed , and otherwise it might be inaccessible or in a filtered state.

Tools

We shall code a TCP-Syn Port scanner on Linux using sockets and posix thread api.
The tools we need are :
1. Linux system with gcc and posix libraries installed
2. Wireshark for analysing the packets (Optional : for better understanding).

Program Logic

1. Take a hostname to scan.
2. Start a sniffer thread shall sniff all incoming packets and pick up those which are from hostname and are syn+ack packets.
3. start sending syn packets to ports in a loop. This needs raw sockets
4. If the sniffer thread receives a syn/ack packet from the host then get the source port of the packet and report the packet as open.
5. Keep looping as long as you have nothing else to do.
6. Quit the program if someone is calling you.

Code

 
      1 
      /* 
     
      2 
           TCP Syn port scanner code in C with Linux Sockets :)  
     
      3 
      */ 
     
      4 
        
      5 
      #include<stdio.h> //printf 
     
      6 
      #include<string.h> //memset 
     
      7 
      #include<stdlib.h> //for exit(0); 
     
      8 
      #include<sys/socket.h> 
     
      9 
      #include<errno.h> //For errno - the error number 
     
      10 
      #include<pthread.h> 
     
      11 
      #include<netdb.h> //hostend 
     
      12 
      #include<arpa/inet.h> 
     
      13 
      #include<netinet/tcp.h>   //Provides declarations for tcp header 
     
      14 
      #include<netinet/ip.h>    //Provides declarations for ip header 
     
      15 
        
      16 
       void * receive_ack( void *ptr );  
     
      17 
       void process_packet(unsigned char* , int);  
     
      18 
       unsigned short csum(unsigned short * , int );  
     
      19 
       char * hostname_to_ip(char * );  
     
      20 
       int get_local_ip (char *);  
     
      21 
        
      22 
       struct pseudo_header    //needed for checksum calculation  
     
      23 
      { 
     
      24 
           unsigned int source_address;  
     
      25 
           unsigned int dest_address;  
     
      26 
           unsigned char placeholder;  
     
      27 
           unsigned char protocol;  
     
      28 
           unsigned short tcp_length;  
     
      29 
             
      30 
           struct tcphdr tcp;  
     
      31 
      }; 
     
      32 
        
      33 
       struct in_addr dest_ip;  
     
      34 
        
      35 
       int main(int argc, char *argv[])  
     
      36 
      { 
     
      37 
           //Create a raw socket  
     
      38 
           int s = socket (AF_INET, SOCK_RAW , IPPROTO_TCP);  
     
      39 
           if(s < 0)  
     
      40 
           {  
     
      41 
               printf ("Error creating socket. Error number : %d . Error message : %s \n" , errno ,strerror(errno));  
     
      42 
               exit(0);  
     
      43 
           }  
     
      44 
           else  
     
      45 
           {  
     
      46 
               printf("Socket created.\n");  
     
      47 
           }  
     
      48 
                 
      49 
           //Datagram to represent the packet  
     
      50 
           char datagram[4096];     
     
      51 
             
      52 
           //IP header  
     
      53 
           struct iphdr *iph = (struct iphdr *) datagram;  
     
      54 
             
      55 
           //TCP header  
     
      56 
           struct tcphdr *tcph = (struct tcphdr *) (datagram + sizeof (struct ip));  
     
      57 
             
      58 
           struct sockaddr_in  dest;  
     
      59 
           struct pseudo_header psh;  
     
      60 
             
      61 
           char *target = argv[1];  
     
      62 
             
      63 
           if(argc < 2)  
     
      64 
           {  
     
      65 
               printf("Please specify a hostname \n");  
     
      66 
               exit(1);  
     
      67 
           }  
     
      68 
             
      69 
           if( inet_addr( target ) != -1)  
     
      70 
           {  
     
      71 
               dest_ip.s_addr = inet_addr( target );  
     
      72 
           }  
     
      73 
           else  
     
      74 
           {  
     
      75 
               char *ip = hostname_to_ip(target);  
     
      76 
               if(ip != NULL)  
     
      77 
               {  
     
      78 
                   printf("%s resolved to %s \n" , target , ip);  
     
      79 
                   //Convert domain name to IP  
     
      80 
                   dest_ip.s_addr = inet_addr( hostname_to_ip(target) );  
     
      81 
               }  
     
      82 
               else  
     
      83 
               {  
     
      84 
                   printf("Unable to resolve hostname : %s" , target);  
     
      85 
                   exit(1);  
     
      86 
               }  
     
      87 
           }  
     
      88 
             
      89 
           int source_port = 43591;  
     
      90 
           char source_ip[20];  
     
      91 
           get_local_ip( source_ip );  
     
      92 
             
      93 
           printf("Local source IP is %s \n" , source_ip);  
     
      94 
             
      95 
           memset (datagram, 0, 4096); /* zero out the buffer */  
     
      96 
             
      97 
           //Fill in the IP Header  
     
      98 
           iph->ihl = 5;  
     
      99 
           iph->version = 4;  
     
      100 
           iph->tos = 0;  
     
      101 
           iph->tot_len = sizeof (struct ip) + sizeof (struct tcphdr);  
     
      102 
           iph->id = htons (54321); //Id of this packet  
     
      103 
           iph->frag_off = htons(16384);  
     
      104 
           iph->ttl = 64;  
     
      105 
           iph->protocol = IPPROTO_TCP;  
     
      106 
           iph->check = 0;      //Set to 0 before calculating checksum  
     
      107 
           iph->saddr = inet_addr ( source_ip );    //Spoof the source ip address  
     
      108 
           iph->daddr = dest_ip.s_addr;  
     
      109 
             
      110 
           iph->check = csum ((unsigned short *) datagram, iph->tot_len >> 1);  
     
      111 
             
      112 
           //TCP Header  
     
      113 
           tcph->source = htons ( source_port );  
     
      114 
           tcph->dest = htons (80);  
     
      115 
           tcph->seq = htonl(1105024978);  
     
      116 
           tcph->ack_seq = 0;  
     
      117 
           tcph->doff = sizeof(struct tcphdr) / 4;      //Size of tcp header  
     
      118 
           tcph->fin=0;  
     
      119 
           tcph->syn=1;  
     
      120 
           tcph->rst=0;  
     
      121 
           tcph->psh=0;  
     
      122 
           tcph->ack=0;  
     
      123 
           tcph->urg=0;  
     
      124 
           tcph->window = htons ( 14600 );  // maximum allowed window size  
     
      125 
           tcph->check = 0; //if you set a checksum to zero, your kernel's IP stack should fill in the correct checksum during transmission  
     
      126 
           tcph->urg_ptr = 0;  
     
      127 
             
      128 
           //IP_HDRINCL to tell the kernel that headers are included in the packet  
     
      129 
           int one = 1;  
     
      130 
           const int *val = &one;  
     
      131 
             
      132 
           if (setsockopt (s, IPPROTO_IP, IP_HDRINCL, val, sizeof (one)) < 0)  
     
      133 
           {  
     
      134 
               printf ("Error setting IP_HDRINCL. Error number : %d . Error message : %s \n" , errno, strerror(errno));  
     
      135 
               exit(0);  
     
      136 
           }  
     
      137 
             
      138 
           printf("Starting sniffer thread...\n");  
     
      139 
           char *message1 = "Thread 1";  
     
      140 
           int  iret1;  
     
      141 
           pthread_t sniffer_thread;  
     
      142 
        
      143 
           if( pthread_create( &sniffer_thread , NULL ,  receive_ack , (void*) message1) < 0)  
     
      144 
           {  
     
      145 
               printf ("Could not create sniffer thread. Error number : %d . Error message : %s \n" ,errno , strerror(errno));  
     
      146 
               exit(0);  
     
      147 
           }  
     
      148 
        
      149 
           printf("Starting to send syn packets\n");  
     
      150 
             
      151 
           int port;  
     
      152 
           dest.sin_family = AF_INET;  
     
      153 
           dest.sin_addr.s_addr = dest_ip.s_addr;  
     
      154 
           for(port = 1 ; port < 100 ; port++)  
     
      155 
           {  
     
      156 
               tcph->dest = htons ( port );  
     
      157 
               tcph->check = 0; // if you set a checksum to zero, your kernel's IP stack should fill in the correct checksum during transmission  
     
      158 
                 
      159 
               psh.source_address = inet_addr( source_ip );  
     
      160 
               psh.dest_address = dest.sin_addr.s_addr;  
     
      161 
               psh.placeholder = 0;  
     
      162 
               psh.protocol = IPPROTO_TCP;  
     
      163 
               psh.tcp_length = htons( sizeof(struct tcphdr) );  
     
      164 
                 
      165 
               memcpy(&psh.tcp , tcph , sizeof (struct tcphdr));  
     
      166 
                 
      167 
               tcph->check = csum( (unsigned short*) &psh , sizeof (struct pseudo_header));  
     
      168 
                 
      169 
               //Send the packet  
     
      170 
               if ( sendto (s, datagram , sizeof(struct iphdr) + sizeof(struct tcphdr) , 0 , (struct sockaddr *) &dest, sizeof (dest)) < 0)  
     
      171 
               {  
     
      172 
                   printf ("Error sending syn packet. Error number : %d . Error message : %s \n" ,errno , strerror(errno));  
     
      173 
                   exit(0);  
     
      174 
               }  
     
      175 
           }  
     
      176 
             
      177 
           pthread_join( sniffer_thread , NULL);  
     
      178 
           printf("%d" , iret1);  
     
      179 
             
      180 
           return 0;  
     
      181 
      } 
     
      182 
        
      183 
      /* 
     
      184 
           Method to sniff incoming packets and look for Ack replies  
     
      185 
      */ 
     
      186 
       void * receive_ack( void *ptr )  
     
      187 
      { 
     
      188 
           //Start the sniffer thing  
     
      189 
           start_sniffer();  
     
      190 
      } 
     
      191 
        
      192 
       int start_sniffer()  
     
      193 
      { 
     
      194 
           int sock_raw;  
     
      195 
             
      196 
           int saddr_size , data_size;  
     
      197 
           struct sockaddr saddr;  
     
      198 
             
      199 
           unsigned char *buffer = (unsigned char *)malloc(65536); //Its Big!  
     
      200 
             
      201 
           printf("Sniffer initialising...\n");  
     
      202 
           fflush(stdout);  
     
      203 
             
      204 
           //Create a raw socket that shall sniff  
     
      205 
           sock_raw = socket(AF_INET , SOCK_RAW , IPPROTO_TCP);  
     
      206 
             
      207 
           if(sock_raw < 0)  
     
      208 
           {  
     
      209 
               printf("Socket Error\n");  
     
      210 
               fflush(stdout);  
     
      211 
               return 1;  
     
      212 
           }  
     
      213 
             
      214 
           saddr_size = sizeof saddr;  
     
      215 
             
      216 
           while(1)  
     
      217 
           {  
     
      218 
               //Receive a packet  
     
      219 
               data_size = recvfrom(sock_raw , buffer , 65536 , 0 , &saddr , &saddr_size);  
     
      220 
                 
      221 
               if(data_size <0 )  
     
      222 
               {  
     
      223 
                   printf("Recvfrom error , failed to get packets\n");  
     
      224 
                   fflush(stdout);  
     
      225 
                   return 1;  
     
      226 
               }  
     
      227 
                 
      228 
               //Now process the packet  
     
      229 
               process_packet(buffer , data_size);  
     
      230 
           }  
     
      231 
             
      232 
           close(sock_raw);  
     
      233 
           printf("Sniffer finished.");  
     
      234 
           fflush(stdout);  
     
      235 
           return 0;  
     
      236 
      } 
     
      237 
        
      238 
       void process_packet(unsigned char* buffer, int size)  
     
      239 
      { 
     
      240 
           //Get the IP Header part of this packet  
     
      241 
           struct iphdr *iph = (struct iphdr*)buffer;  
     
      242 
           struct sockaddr_in source,dest;  
     
      243 
           unsigned short iphdrlen;  
     
      244 
             
      245 
           if(iph->protocol == 6)  
     
      246 
           {  
     
      247 
               struct iphdr *iph = (struct iphdr *)buffer;  
     
      248 
               iphdrlen = iph->ihl*4;  
     
      249 
             
      250 
               struct tcphdr *tcph=(struct tcphdr*)(buffer + iphdrlen);  
     
      251 
                     
      252 
               memset(&source, 0, sizeof(source));  
     
      253 
               source.sin_addr.s_addr = iph->saddr;  
     
      254 
             
      255 
               memset(&dest, 0, sizeof(dest));  
     
      256 
               dest.sin_addr.s_addr = iph->daddr;  
     
      257 
                 
      258 
               if(tcph->syn == 1 && tcph->ack == 1 && source.sin_addr.s_addr == dest_ip.s_addr )  
     
      259 
               {  
     
      260 
                   printf("Port %d open \n" , ntohs(tcph->source));  
     
      261 
                   fflush(stdout);  
     
      262 
               }  
     
      263 
           }  
     
      264 
      } 
     
      265 
        
      266 
      /* 
     
      267 
        Checksums - IP and TCP  
     
      268 
        */  
     
      269 
       unsigned short csum(unsigned short *ptr,int nbytes)  
     
      270 
      { 
     
      271 
           register long sum;  
     
      272 
           unsigned short oddbyte;  
     
      273 
           register short answer;  
     
      274 
        
      275 
           sum=0;  
     
      276 
           while(nbytes>1) {  
     
      277 
               sum+=*ptr++;  
     
      278 
               nbytes-=2;  
     
      279 
           }  
     
      280 
           if(nbytes==1) {  
     
      281 
               oddbyte=0;  
     
      282 
               *((u_char*)&oddbyte)=*(u_char*)ptr;  
     
      283 
               sum+=oddbyte;  
     
      284 
           }  
     
      285 
        
      286 
           sum = (sum>>16)+(sum & 0xffff);  
     
      287 
           sum = sum + (sum>>16);  
     
      288 
           answer=(short)~sum;  
     
      289 
             
      290 
           return(answer);  
     
      291 
      } 
     
      292 
        
      293 
      /* 
     
      294 
           Get ip from domain name  
     
      295 
        */  
     
      296 
       char* hostname_to_ip(char * hostname)  
     
      297 
      { 
     
      298 
           struct hostent *he;  
     
      299 
           struct in_addr **addr_list;  
     
      300 
           int i;  
     
      301 
                 
      302 
           if ( (he = gethostbyname( hostname ) ) == NULL)  
     
      303 
           {  
     
      304 
               // get the host info  
     
      305 
               herror("gethostbyname");  
     
      306 
               return NULL;  
     
      307 
           }  
     
      308 
        
      309 
           addr_list = (struct in_addr **) he->h_addr_list;  
     
      310 
             
      311 
           for(i = 0; addr_list[i] != NULL; i++)  
     
      312 
           {  
     
      313 
               //Return the first one;  
     
      314 
               return inet_ntoa(*addr_list[i]) ;  
     
      315 
           }  
     
      316 
             
      317 
           return NULL;  
     
      318 
      } 
     
      319 
        
      320 
      /* 
     
      321 
        Get source IP of system , like 192.168.0.6 or 192.168.1.2  
     
      322 
        */  
     
      323 
        
      324 
       int get_local_ip ( char * buffer)  
     
      325 
      { 
     
      326 
           int sock = socket ( AF_INET, SOCK_DGRAM, 0);  
     
      327 
        
      328 
           const char* kGoogleDnsIp = "8.8.8.8";  
     
      329 
           int dns_port = 53;  
     
      330 
        
      331 
           struct sockaddr_in serv;  
     
      332 
        
      333 
           memset( &serv, 0, sizeof(serv) );  
     
      334 
           serv.sin_family = AF_INET;  
     
      335 
           serv.sin_addr.s_addr = inet_addr(kGoogleDnsIp);  
     
      336 
           serv.sin_port = htons( dns_port );  
     
      337 
        
      338 
           int err = connect( sock , (const struct sockaddr*) &serv , sizeof(serv) );  
     
      339 
        
      340 
           struct sockaddr_in name;  
     
      341 
           socklen_t namelen = sizeof(name);  
     
      342 
           err = getsockname(sock, (struct sockaddr*) &name, &namelen);  
     
      343 
        
      344 
           const char *p = inet_ntop(AF_INET, &name.sin_addr, buffer, 100);  
     
      345 
        
      346 
           close(sock);  
     
      347 
      }

Compile and Run

 
      1 
      $ gcc syn_portscan.c -lpthread -o syn_portscan

-lpthread option is needed to link the posix thread libraries.

Now Run

 
      1 
       $ sudo ./syn_portscan www.google.com  
     
      2 
      Socket created. 
     
      3 
      www.google.com resolved to 74.125.235.16 
     
      4 
       Local source IP is 192.168.0.6  
     
      5 
      Starting sniffer thread... 
     
      6 
      Starting to send syn packets 
     
      7 
      Sniffer initialising... 
     
      8 
       Port 53 open  
     
      9 
       Port 80 open

Note :

1. For the program to run correctly the local ip and the hostname ip should be resolved correctly. Wireshark should also show the TCP Syn packets as “Good” and not bogus or something.

2. The get_local_ip method is used to find the local ip of the machine which is filled in the source ip of packets. For example : 192.168.1.2 if you are on a LAN or 172.x.x.x if you are directly connected to internet. The local source ip value will show this.

3. The hostname_to_ip function resolves a domain name to its ip address. It uses the gethostbyname method.

Tcp syn portscan code in C with Linux sockets

热门文章

最新文章

相关课程

相关电子书

相关实验场景

推荐镜像