rendered paste body#include <cstdlib>#include <iostream>#include <winsock2.h>#include <windows.h>#define BUFSIZE 8000#define SIO_RCVALL _WSAIOW(IOC_VENDOR,1)#define MAX_ADDR_LEN 16#define MAX_HOSTNAME_LAN 255using namespace std;FILE* SniffLog;char dateStr [9];char timeStr [9];// IP/TCP header structuresstruct IPHDR{unsigned char verlen; /*IP version & length */unsigned char tos; /*IP type of service*/unsigned short totallength;/*Total length*/unsigned short id; /*Unique identifier */unsigned short offset; /*Fragment offset field*/unsigned char ttl; /*Time to live*/unsigned char protocol; /*Protocol(TCP, UDP, etc.)*/unsigned short checksum; /*IP checksum*/unsigned int srcaddr; /*Source address*/unsigned int dstaddr; /*Destination address*/};struct TCPHDR{unsigned short srcport;unsigned short dstport;unsigned int seqno;unsigned int ackno;unsigned char offset;unsigned char flags;unsigned short window;unsigned short checksum;unsigned short urgptr;};typedef struct item{int weigth;int init;};item knapsackarray[6];const long lNAME_SIZE = 1024;// flagsvoid setthem(){for (int I=0;I < 6; I++){knapsackarray[I].init = 0;}knapsackarray[0].weigth=256; // Finknapsackarray[1].weigth=512; // Synknapsackarray[2].weigth=1024;// Rstknapsackarray[3].weigth=2048;// Pshknapsackarray[4].weigth=4096;// Ackknapsackarray[5].weigth=8192;// Urgknapsackarray[6].weigth=8192;// Urg}// mathematical knapsack algorithm to check which flags are contained within the flags value andstring knapsack(int herein){string retval;int testitem=0;int tempint=0;int I = 5;bool unsolvable=false;testitem = herein;if (testitem == 0){retval = "000000";return retval;}while ((testitem != 0) and (I !=-1)){if ((knapsackarray[I].weigth <= testitem)){testitem-=knapsackarray[I].weigth;knapsackarray[I].init=1;}if ((testitem != 0) and (I == 0)){unsolvable = true;}I--;}if (unsolvable == false){for (I=0;I < 6;I++){if (knapsackarray[I].init == 1)retval+= "1";elseretval+= "0";}}elseretval = "9";return retval;}const char* flag (int f1){if (f1 == 256)return "Fin";if (f1 == 512)return "Syn";if (f1 == 1024)return "Rst";if (f1 == 2048)return "Psh";if (f1 == 4096)return "Ack";if (f1 == 8192)return "Urg";else{char* FlagTable[6] = {"$Fin.","$Syn.","$Rst.","$Psh.","$Ack.","$Urg."};string mulres,rval;setthem();mulres = knapsack(f1);for (int i = 0; i < mulres.length(); i++){if (mulres[i] == 49)rval += FlagTable[i];}return rval.c_str();}return 0;}// these words in FTP context set the flagbool IsFTPPacket(const char *szBuf) {if(strstr(szBuf, "220 ")) return true;if(strstr(szBuf, "230 ")) return true;if(strstr(szBuf, "USER ")) return true;if(strstr(szBuf, "User ")) return true;if(strstr(szBuf, "user ")) return true;if(strstr(szBuf, "PASS ")) return true;if(strstr(szBuf, "Pass ")) return true;if(strstr(szBuf, "pass ")) return true;return false; }// these words in Telnet context set the flagbool IsTelnetPacket(const char *szBuf) {if(strstr(szBuf, "USERNAME")) return true;if(strstr(szBuf, "Username")) return true;if(strstr(szBuf, "username")) return true;if(strstr(szBuf, "PASSWORD")) return true;if(strstr(szBuf, "Password")) return true;if(strstr(szBuf, "password")) return true;return false; }// these words in HTTP context set the flagbool IsHTTPPacket(const char *szBuf) {if(strstr(szBuf, "paypal")) return true;if(strstr(szBuf, "PAYPAL")) return true;if(strstr(szBuf, "ebay")) return true;if(strstr(szBuf, "EBAY")) return true;if(strstr(szBuf, "bank")) return true;if(strstr(szBuf, "BANK")) return true;if(strstr(szBuf, "Bank")) return true;if(strstr(szBuf, "Set-Cookie:")) return true;if(strstr(szBuf, "login")) return true;if(strstr(szBuf, "LOGIN")) return true;if(strstr(szBuf, "Login")) return true;if(strstr(szBuf, "password")) return true;if(strstr(szBuf, "PASSWORD")) return true;if(strstr(szBuf, "Password")) return true;return false; }// these words in any context set the flagbool IsVULNPacket(const char *szBuf) {if(strstr(szBuf, "OpenSSL/0.9.6")) return true;if(strstr(szBuf, "OpenSSH_2")) return true;return false; }void print_data(int datalen, char *data){int t=0;for(int i=38;i != datalen;i++){if(data[i] == 13){fprintf(SniffLog,"\n");t=0;}if ((int)data[i] > 0){if ((((int)data[i]) < 33) or (((int)data[i]) > 126))// print unreadable characters in hexadecimalfprintf(SniffLog,"[%#x]",data[i]);elsefprintf(SniffLog,"%c",data[i]);}t++;if(t > 75){t=0;fprintf(SniffLog,"\n");}}}void GoSniff(){SOCKET sock;char RecvBuf[65535] = {0};DWORD dwBytesRet;unsigned int optval = 1;// make a raw socketsock = socket(AF_INET, SOCK_RAW, IPPROTO_IP);// fetch hostnamechar FAR name[MAX_HOSTNAME_LAN];gethostname(name, MAX_HOSTNAME_LAN);struct hostent FAR * pHostent;pHostent = (struct hostent * )malloc(sizeof(struct hostent));pHostent = gethostbyname(name);SOCKADDR_IN sa;sa.sin_family = AF_INET;sa.sin_port = htons(6000);// bind on port 6000 (doesn't really matter)memcpy(&sa.sin_addr.S_un.S_addr, pHostent->h_addr_list[0], pHostent->h_length);bind(sock, (SOCKADDR *)&sa, sizeof(sa));// set in promiscuous modeWSAIoctl(sock, SIO_RCVALL, &optval, sizeof(optval), NULL, 0, &dwBytesRet, NULL, NULL);while (1){memset(RecvBuf, 0, sizeof(RecvBuf));recv(sock, RecvBuf, sizeof(RecvBuf), 0);// Filter PacketIPHDR *pIpheader;TCPHDR *pTcpheader;char szSourceIP[MAX_ADDR_LEN], szDestIP[MAX_ADDR_LEN];SOCKADDR_IN saSource, saDest;pIpheader = (IPHDR *)RecvBuf;pTcpheader = (TCPHDR *)(RecvBuf+ sizeof(IPHDR));//Check Source IPsaSource.sin_addr.s_addr = pIpheader->srcaddr;strncpy(szSourceIP, inet_ntoa(saSource.sin_addr), MAX_ADDR_LEN);//Check Dest IPsaDest.sin_addr.s_addr = pIpheader->dstaddr;strncpy(szDestIP, inet_ntoa(saDest.sin_addr), MAX_ADDR_LEN);// time and data_strdate( dateStr);_strtime( timeStr );fprintf(SniffLog,"\n************PACKETstart************\n");fprintf(SniffLog,"Date: %s\n",dateStr); // datefprintf(SniffLog,"Time: %s\n",timeStr); // timefprintf(SniffLog,"Route:%s->%s\n", szSourceIP, szDestIP); // source -> destfprintf(SniffLog,"TTL=%d\n",pIpheader->ttl); // TTLfprintf(SniffLog,"Flags=%d\n",htons(pTcpheader->flags));fprintf(SniffLog,"Flags: \n");fprintf(SniffLog,"%s\n",flag(htons(pTcpheader->flags))); // format flagsfprintf(SniffLog,"destport=%d\nsourceport=%d\n", ntohs(pTcpheader->dstport),ntohs(pTcpheader->srcport)); // ports// is it a suspicious packet?char* szPacket=(char*)(RecvBuf+sizeof(*pTcpheader)+sizeof(*pIpheader)); // format packetif ((IsTelnetPacket(szPacket)) && ((ntohs(pTcpheader->srcport) == 23) || (ntohs(pTcpheader->dstport) == 23)))fprintf(SniffLog,"Potentially sensitive Telnet traffic sniffed!\n");if ((IsFTPPacket(szPacket)) && ((ntohs(pTcpheader->srcport) == 21) || (ntohs(pTcpheader->dstport) == 21)))fprintf(SniffLog,"Potentially sensitive FTP traffic sniffed!\n");if ((IsHTTPPacket(szPacket)) && ((ntohs(pTcpheader->srcport) == 80) || (ntohs(pTcpheader->dstport) == 80) || (ntohs(pTcpheader->dstport) == 81) || (ntohs(pTcpheader->dstport) == 443) ||(ntohs(pTcpheader->srcport) == 81) || (ntohs(pTcpheader->srcport) == 443)))fprintf(SniffLog,"Potentially sensitive HTTP traffic sniffed!\n");if (IsVULNPacket(szPacket))fprintf(SniffLog,"Potentially sensitive vulnerable traffic sniffed!\n");fprintf(SniffLog,"\n-----------DATAstart---------\n");print_data(13+(htons(pIpheader->totallength))-sizeof(pIpheader)-sizeof(pTcpheader), RecvBuf); //print packetfprintf(SniffLog,"\n-----------DATAend---------\n");fprintf(SniffLog,"\n\n***************PACKETend************\n\n");}closesocket(sock);WSACleanup();}int main(int argc, char *argv[]){if (argc < 2){printf("Aardvark V1.0\n");printf("Basic promiscuous-mode,outgoing-packet sniffer by Nomenumbra\n");printf("Usage:\n Aardvark.exe <logfile>\n");exit(-1);}WSADATA wsadata;if(WSAStartup(MAKEWORD(2,2),&wsadata)!=0)return -1;SniffLog = fopen(argv[1],"a+");GoSniff();fclose(SniffLog);return 0;}-