Programlama yapalım ve Öğrenelim.

Console TCP Connection View And Control

bu kod size konsoldan nasıl windows tcp tablosuna erişim

bağlantıları görmenize dilediğinizi yani established olanları

koparmanızı sağlar bu kod udp portları göstermez.

geliştirilirse güzel küçük boyutlu bir firewall yazılabilir.

tabi bunun için arabirimm tasarlamak lazım..

bu uygulamanın derlenmiş exe hali 18 kb

sıkıştırılrısa upx 11 kb olur

bu kod 9x ve 2000/xp sistemlerde çalışıyor.

TCPTAble.DPR

------------

program TCPTable;

{$APPTYPE CONSOLE}

uses

System, Windows, TcpApi;

Var

lpTable:PTcpTable;

dwCount:Integer;

begin

// Retrieve the table of tcp entries

if (TCPOpenEnum(lpTable) = ERROR_SUCCESS) then

begin

// Resource protection

try

// Walk the table entries

for dwCount:=0 to Pred(lpTable^.dwNumEntries) do

begin

// Write out

// - the local port (in common format, vs network order)

// - the local address (in string format)

// - the descriptive state of the tcp entry

If (TcpStateDescription(lpTable^.Table[dwCount].dwState)='Listening') Then

Begin

WriteLn(TcpAddrFromLong(lpTable^.Table[dwCount].dwLocalAddr),

':',

TcpPortFromLong(lpTable^.Table[dwCount].dwLocalPort),

' -> ',

TcpStateDescription(lpTable^.Table[dwCount].dwState) );

End

Else

Begin

WriteLn(TcpAddrFromLong(lpTable^.Table[dwCount].dwLocalAddr),

':',

TcpPortFromLong(lpTable^.Table[dwCount].dwLocalPort),

' -> ',

TcpAddrFromLong(lpTable^.Table[dwCount].dwRemoteAddr),

':',

TcpPortFromLong(lpTable^.Table[dwCount].dwRemotePort),

' -> ',

TcpStateDescription(lpTable^.Table[dwCount].dwState) );

End;

// Example of closing a tcp port/connection

// - check for a connection to a remote port 80 (http) and close it

// diyoruzkş eyer birileri 80 nolu porta tcp bağlantısı açtı ise

// onu kapat. cillop gibi firewall size işte

// bağlantıları izle izin varmı diye sor izin yoksa block la.

// lpTable^.Table[dwCount].dwRemoteAddr ilede ip kontrolu yaptırılır.

{ if (TcpPortFromLong(lpTable^.Table[dwCount].dwRemotePort) = 80) then

Begin

TcpDeleteRow(@lpTable^.Table[dwCount]);

End;}

end;

finally

// Free the memory allocated by the open enum function

TCPCloseEnum(lpTable);

end;

Readln;

end.

------------------------------------------------------------------------

TcpApi.pas

----------

unit TcpApi;

////////////////////////////////////////////////////////////////////////////////

// Unit : TCPAPI

// Date : Original - 05.25.2004

// Updated - 11.12.2004

// Author : rllibby

// Description : Set of TCP enumeration and helper routines.

////////////////////////////////////////////////////////////////////////////////

interface

////////////////////////////////////////////////////////////////////////////////

// Include units

////////////////////////////////////////////////////////////////////////////////

uses

Windows;

////////////////////////////////////////////////////////////////////////////////

// General constants

////////////////////////////////////////////////////////////////////////////////

const

ALLOC_SIZE = 4096;

////////////////////////////////////////////////////////////////////////////////

// Data structures

////////////////////////////////////////////////////////////////////////////////

type

PMIB_TCPROW = ^MIB_TCPROW;

MIB_TCPROW = packed record

dwState: LongWord;

dwLocalAddr: LongWord;

dwLocalPort: LongWord;

dwRemoteAddr: LongWord;

dwRemotePort: LongWord;

end;

TTcpRow = MIB_TCPROW;

PTcpRow = ^TTcpRow;

PMIB_TCPTABLE = ^MIB_TCPTABLE;

MIB_TCPTABLE = packed record

dwNumEntries: LongWord;

Table: Array [0..MaxWord] of MIB_TCPROW;

end;

TTcpTable = MIB_TCPTABLE;

PTcpTable = ^TTcpTable;

PIP_BYTES = ^IP_BYTES;

IP_BYTES = Array [0..3] of Byte;

TIpBytes = IP_BYTES;

PIpBytes = ^TIpBytes;

////////////////////////////////////////////////////////////////////////////////

// Function definitions

////////////////////////////////////////////////////////////////////////////////

type

TGetTcpTable = function(lpTcpTable: PTcpTable; lpdwSize: PDWORD; bOrder: BOOL): DWORD; stdcall;

TSetTcpEntry = function(lpTcpRow: PTcpRow): DWORD; stdcall;

////////////////////////////////////////////////////////////////////////////////

// TCP table entry state constants

////////////////////////////////////////////////////////////////////////////////

const

MIB_TCP_STATE_CLOSED = 1;

MIB_TCP_STATE_LISTEN = 2;

MIB_TCP_STATE_SYN_SENT = 3;

MIB_TCP_STATE_SYN_RCVD = 4;

MIB_TCP_STATE_ESTAB = 5;

MIB_TCP_STATE_FIN_WAIT1 = 6;

MIB_TCP_STATE_FIN_WAIT2 = 7;

MIB_TCP_STATE_CLOSE_WAIT = 8;

MIB_TCP_STATE_CLOSING = 9;

MIB_TCP_STATE_LAST_ACK = 10;

MIB_TCP_STATE_TIME_WAIT = 11;

MIB_TCP_STATE_DELETE_TCB = 12;

const

MIB_TCP_STATES: Array [0..12] of PChar =

('Unknown',

'Closed',

'Listening',

'Syn Sent',

'Syn Received',

'Established',

'Fin Wait1',

'Fin Wait2',

'Close Wait',

'Closing',

'Last Ack',

'Time Wait',

'Deleted');

////////////////////////////////////////////////////////////////////////////////

// Late bound function wrappers

////////////////////////////////////////////////////////////////////////////////

function GetTcpTable(lpTcpTable: PTcpTable; lpdwSize: PDWORD; bOrder: BOOL): DWORD; stdcall;

function SetTcpEntry(lpTcpRow: PTcpRow): DWORD; stdcall;

////////////////////////////////////////////////////////////////////////////////

// TCP functions designed to be used by developers

////////////////////////////////////////////////////////////////////////////////

function TcpOpenEnum(var TcpTable: PTcpTable): DWORD;

procedure TcpCloseEnum(TcpTable: PTcpTable);

function TcpPortFromLong(Port: LongWord): Word;

function TcpAddrFromLong(Address: LongWord): String;

function TcpStateDescription(State: LongWord): String;

function TcpDeleteRow(TcpRow: PTcpRow): DWORD;

implementation

////////////////////////////////////////////////////////////////////////////////

// Library and function name constants

////////////////////////////////////////////////////////////////////////////////

const

LIB_IPHLPAPI = 'iphlpapi.dll';

FUNC_GETTCPTABLE = 'GetTcpTable';

FUNC_SETTCPENTRY_NAME = 'SetTcpEntry';

////////////////////////////////////////////////////////////////////////////////

// Protected variables

////////////////////////////////////////////////////////////////////////////////

var

hIphlp: HMODULE = 0;

_GetTcpTable: TGetTcpTable = nil;

_SetTcpEntry: TSetTcpEntry = nil;

function TcpDeleteRow(TcpRow: PTcpRow): DWORD;

begin

// Check assignment

if Assigned(TcpRow) then

begin

// Set entry state

TcpRow^.dwState:=MIB_TCP_STATE_DELETE_TCB;

// Call SetTcpEntry

result:=SetTcpEntry(TcpRow);

end

else

// Invalid param

result:=ERROR_INVALID_PARAMETER;

end;

function TcpStateDescription(State: LongWord): String;

begin

// Handle state

if State in [MIB_TCP_STATE_CLOSED..MIB_TCP_STATE_DELETE_TCB] then

// Return state description

result:=MIB_TCP_STATES[State]

else

// Unknown state

result:=MIB_TCP_STATES[0];

end;

function IntToStr(X: integer): string;

var

TAPInAddr: string;

begin

Str(X, TAPInAddr);

Result := TAPInAddr;

end;

function TcpAddrFromLong(Address: LongWord): String;

var lpBytes: TIpBytes;

dwIndex: Integer;

begin

// Move dword to byte array

Move(Address, lpBytes, SizeOf(LongWord));

// Set start of string

result:=IntToStr(lpBytes[0]);

// Walk remaining bytes

for dwIndex:=Succ(Low(lpBytes)) to High(lpBytes) do result:=result+'.'+IntToStr(lpBytes[dwIndex]);

end;

function TcpPortFromLong(Port: LongWord): Word;

begin

// Convert from network order to common port format

result:=(Port div 256) + (Port mod 256) * 256;

end;

function AllocMem(Size: Cardinal): Pointer;

begin

GetMem(Result, Size);

FillChar(Result^, Size, 0);

end;

function TcpOpenEnum(var TcpTable: PTcpTable): DWORD;

var dwSize: DWORD;

begin

// Set the default size, this is enough to hold appx 204 entries

dwSize:=ALLOC_SIZE;

// Allocate memory

TcpTable:=AllocMem(dwSize);

// Attempt to get the full tcp table

result:=GetTcpTable(TcpTable, @dwSize, True);

// Check for insuffecient buffer

if (result = ERROR_INSUFFICIENT_BUFFER) then

begin

// Re-alloc the table

ReAllocMem(TcpTable, dwSize);

// Call the function again

result:=GetTcpTable(TcpTable, @dwSize, True);

end;

// Check result

if (result <> ERROR_SUCCESS) then

begin

// Failed to get table, cleanup allocated memory

FreeMem(TcpTable);

// Clear the table

TcpTable:=nil;

end;

procedure TcpCloseEnum(TcpTable: PTcpTable);

begin

// Need to free the memory allocated by a call to open enum

if Assigned(TcpTable) then FreeMem(TcpTable);

end;

function GetTcpTable(lpTcpTable: PTcpTable; lpdwSize: PDWORD; bOrder: BOOL): DWORD;

begin

// Make sure the api function was bound

if Assigned(@_GetTcpTable) then

// Call the function

result:=_GetTcpTable(lpTcpTable, lpdwSize, bOrder)

else

// Function was not bound

result:=ERROR_PROC_NOT_FOUND;

end;

function SetTcpEntry(lpTcpRow: PTcpRow): DWORD;

begin

// Make sure the api function was bound

if Assigned(@_SetTcpEntry) then

// Call the function

result:=_SetTcpEntry(lpTcpRow)

else

// Function was not bound

result:=ERROR_PROC_NOT_FOUND;

end;

initialization

// Load the ip helper api library

hIphlp:=LoadLibrary(LIB_IPHLPAPI);

// Attempt to get the function addresses

if (hIphlp > 0) then

begin

// Bind both the get table and set entry functions

@_GetTcpTable:=GetProcAddress(hIpHlp, FUNC_GETTCPTABLE);

@_SetTcpEntry:=GetProcAddress(hIpHlp, FUNC_SETTCPENTRY_NAME);

end;

finalization

// Clear bound functions

@_GetTcpTable:=nil;

@_SetTcpEntry:=nil;

// Free the ip helper api library

if (hIphlp > 0) then FreeLibrary(hIphlp);

end.

----------------------------------------------------------------------------

Delphi - .....................................

Console TCP Tunnel

Bu yazılımı protokol analizi için yazmıştım.

neydi protokol analizinden kastim ?

örneğin bi program bir yere bağlandı bazı veriler aldı

bazı veriler yolladı genelde packet snifferle izlemek

eyer veri text değilse sıkındı oluşturuyor.

bu yazılım tunnelemme yapıyor giden gelen verileri

dosyaya hem platin halini hemde #rakam şeklinde

kaydediyor böylece siz bunları dosyadan alıyorsun

delphide programınıza const lar şeklinde tanımlıyorsun vs vs..

smb exploit ile alakalı yazılım analizini bununla yapmıştım.

program parametre alarak çalışıyor.

program.exe 1234 hedefip hedefport

1234 e yazılım bağlandığı an direk hedefip nin portuna bağlantı açılıp

aradan geçen veriler loglanıyor.

exe nin boyutu 85 kb. upx lersin 30 40 kb olur bu kodu iyice

inceleyerek konsolda nasıl soket açılır konsol uygulamalarda

nasıl thread yaratılır öğrenme şansınızda olur yazdığınız exe

lerin boyutlarının küçük olması anısına :)

Tunnel.DPR

----------

Program Tunnel;

Uses

Windows, WinSock, Helper, Sock, Classes;

Var

PacketCount:Longint=0;

Log:TStringList;

{---}

SourcePort:String='25';

TunelIP:String='10.0.0.20';

TunelPort:String='1234';

Procedure Log_Add(Data,Rotation:String);

Var

I:Longint;

Tmp:String;

Begin

PacketCount:=PacketCount+1;

Log.Add('Packed Index; '+IntToStr(PacketCount)+' | '+Rotation);

Log.Add('- Ascii Begin -');

Tmp:='';

For I:=1 To Length(Data) Do

Begin

Tmp:=Tmp+'+';

Tmp:=Tmp+'#';

Tmp:=Tmp+IntToStr(Ord(Data[I]));

End;

Log.Add(Tmp);

Log.Add('- Ascii END -');

Log.Add('- Platin Begin -');

Log.Add(Data);

Log.Add('- Platin END -');

Log.Add('');

End;

{------------------------------------}

Var

ServerSocket: TServerSocket;

ClientSocket: TClientSocket;

TunelClientSocket: TClientSocket;

{--}

ClientBuffer: array [0..32767] of byte;

TunelBuffer: array [0..32767] of byte;

ClientBytesReceived: integer;

TunelBytesReceived: integer;

Nonblocking: integer;

{--}

Thread_ID:LongWord;

{------------------------------------}

Function BufferToStr(V:Byte; Where:Longint):String;

Var

Tmp:String;

I:Longint;

Begin

Where:=Where-1;

Tmp:='';

If (V=1) Then Begin For I:=0 To Where Do Begin Tmp:=Tmp+Char(ClientBuffer[I]); End; End;

If (V=2) Then Begin For I:=0 To Where Do Begin Tmp:=Tmp+Char(TunelBuffer[I]); End; End;

BufferToStr:=Tmp;

End;

Procedure ClientThread_Start;

Begin

Repeat

ClientBytesReceived:=ClientSocket.ReceiveBuffer(ClientBuffer, 32768);

If ClientBytesReceived > 0 then

begin

Log_Add(BufferToStr(1,ClientBytesReceived),ClientSocket.RemoteAddress+':'+IntToStr(ClientSocket.RemotePort)+' -> '+TunelClientSocket.RemoteAddress+':'+IntToStr(TunelClientSocket.RemotePort));

TunelClientSocket.SendBuffer(ClientBuffer, ClientBytesReceived);

End;

Until (ClientSocket.Connected=False) Or (TunelClientSocket.Connected=False);

End;

Procedure TunelThread_Start;

Begin

Repeat

TunelBytesReceived:=TunelClientSocket.ReceiveBuffer(TunelBuffer, 32768);

If TunelBytesReceived > 0 then

begin

Log_Add(BufferToStr(2,TunelBytesReceived),TunelClientSocket.RemoteAddress+':'+IntToStr(TunelClientSocket.RemotePort)+' -> '+ClientSocket.RemoteAddress+':'+IntToStr(ClientSocket.RemotePort));

ClientSocket.SendBuffer(TunelBuffer, TunelBytesReceived);

End;

Until (ClientSocket.Connected=False) Or (TunelClientSocket.Connected=False);

End;

Begin

SourcePort:=ParamStr(1);

TunelIP:=ParamStr(2);

TunelPort:=ParamStr(3);

Log:=TStringList.Create;

Log.Clear;

ServerSocket:=TServerSocket.Create;

ServerSocket.Listen(StrToInt(SourcePort));

ServerSocket.Idle;

ClientSocket:=ServerSocket.Accept;

ServerSocket.Destroy;

ioctlsocket(ClientSocket.Socket, FIONBIO, Longint(Nonblocking));

TunelClientSocket:=TClientsocket.Create;

TunelClientSocket.Connect(TunelIP,StrToInt(TunelPort));

Thread_ID:=BeginThread(nil, 0, Addr(ClientThread_Start), nil, 0, Thread_ID);

Thread_ID:=BeginThread(nil, 0, Addr(TunelThread_Start), nil, 0, Thread_ID);

Repeat

Sleep(100);

Until (ClientSocket.Connected=False) Or (TunelClientSocket.Connected=False);

TunelClientSocket.Disconnect;

ClientSocket.Disconnect;

TunelClientSocket.Destroy;

ClientSocket.Destroy;

Log.SaveToFile('Data.Log');

Log.Destroy;

End.

---------------------------------------------------------------------------

Sock.Pas

--------

unit Sock;

interface

uses Winsock;

type

TClientSocket = class(TObject)

private

FAddress: pchar;

FData: pointer;

FTag: integer;

FConnected: boolean;

function GetLocalAddress: string;

function GetLocalPort: integer;

function GetRemoteAddress: string;

function GetRemotePort: integer;

protected

FSocket: TSocket;

public

procedure Connect(Address: string; Port: integer);

property Connected: boolean read FConnected;

property Data: pointer read FData write FData;

constructor Create;

destructor Destroy; override;

procedure Disconnect;

procedure Idle(Seconds: integer);

function Address: String;

property LocalAddress: string read GetLocalAddress;

property LocalPort: integer read GetLocalPort;

function ReceiveBuffer(var Buffer; BufferSize: integer): integer;

function ReceiveLength: integer;

function ReceiveString: string;

property RemoteAddress: string read GetRemoteAddress;

property RemotePort: integer read GetRemotePort;

function SendBuffer(var Buffer; BufferSize: integer): integer;

function SendString(const Buffer: string): integer;

property Socket: TSocket read FSocket;

property Tag: integer read FTag write FTag;

end;

TServerSocket = class(TObject)

private

FListening: boolean;

function GetLocalAddress: string;

function GetLocalPort: integer;

protected

FSocket: TSocket;

public

function Accept: TClientSocket;

constructor Create;

destructor Destroy; override;

procedure Disconnect;

procedure Idle;

procedure Listen(Port: integer);

property Listening: boolean read FListening;

property LocalAddress: string read GetLocalAddress;

property LocalPort: integer read GetLocalPort;

end;

var

WSAData: TWSAData;

implementation

constructor TClientSocket.Create;

begin

inherited Create;

WSAStartUp(257, WSAData);

end;

function TClientSocket.Address: String;

type

TaPInAddr = Array[0..10] of PInAddr;

PaPInAddr = ^TaPInAddr;

var

phe: PHostEnt;

pptr: PaPInAddr;

Buffer: Array[0..63] of Char;

I: Integer;

GInitData: TWSAData;

begin

WSAStartup($101, GInitData);

Result := '';

GetHostName(Buffer, SizeOf(Buffer));

phe := GetHostByName(buffer);

if phe = nil then Exit;

pPtr := PaPInAddr(phe^.h_addr_list);

I := 0;

while pPtr^[I] <> nil do

begin

Result := inet_ntoa(pptr^[I]^);

Inc(I);

end;

WSACleanup;

end;

procedure TClientSocket.Connect(Address: string; Port: integer);

var

SockAddrIn: TSockAddrIn;

HostEnt: PHostEnt;

begin

Disconnect;

FAddress := pchar(Address);

FSocket := Winsock.socket(PF_INET, SOCK_STREAM, IPPROTO_TCP);

SockAddrIn.sin_family := AF_INET;

SockAddrIn.sin_port := htons(Port);

SockAddrIn.sin_addr.s_addr := inet_addr(FAddress);

if SockAddrIn.sin_addr.s_addr = INADDR_NONE then

begin

HostEnt := gethostbyname(FAddress);

if HostEnt = nil then

begin

Exit;

end;

SockAddrIn.sin_addr.s_addr := Longint(PLongint(HostEnt^.h_addr_list^)^);

end;

Winsock.Connect(FSocket, SockAddrIn, SizeOf(SockAddrIn));

FConnected := True;

end;

procedure TClientSocket.Disconnect;

begin

closesocket(FSocket);

FConnected := False;

end;

function TClientSocket.GetLocalAddress: string;

var

SockAddrIn: TSockAddrIn;

Size: integer;

begin

Size := sizeof(SockAddrIn);

getsockname(FSocket, SockAddrIn, Size);

Result := inet_ntoa(SockAddrIn.sin_addr);

end;

function TClientSocket.GetLocalPort: integer;

var

SockAddrIn: TSockAddrIn;

Size: Integer;

begin

Size := sizeof(SockAddrIn);

getsockname(FSocket, SockAddrIn, Size);

Result := ntohs(SockAddrIn.sin_port);

end;

function TClientSocket.GetRemoteAddress: string;

var

SockAddrIn: TSockAddrIn;

Size: Integer;

begin

Size := sizeof(SockAddrIn);

getpeername(FSocket, SockAddrIn, Size);

Result := inet_ntoa(SockAddrIn.sin_addr);

end;

function TClientSocket.GetRemotePort: integer;

var

SockAddrIn: TSockAddrIn;

Size: Integer;

begin

Size := sizeof(SockAddrIn);

getpeername(FSocket, SockAddrIn, Size);

Result := ntohs(SockAddrIn.sin_port);

end;

procedure TClientSocket.Idle(Seconds: integer);

var

FDset: TFDset;

TimeVal: TTimeVal;

begin

if Seconds = 0 then

begin

FD_ZERO(FDSet);

FD_SET(FSocket, FDSet);

select(0, @FDset, nil, nil, nil);

end

else

begin

TimeVal.tv_sec := Seconds;

TimeVal.tv_usec := 0;

FD_ZERO(FDSet);

FD_SET(FSocket, FDSet);

select(0, @FDset, nil, nil, @TimeVal);

end;

function TClientSocket.ReceiveLength: integer;

begin

Result := ReceiveBuffer(pointer(nil)^, -1);

end;

function TClientSocket.ReceiveBuffer(var Buffer; BufferSize: integer): integer;

begin

if BufferSize = -1 then

begin

if ioctlsocket(FSocket, FIONREAD, Longint(Result)) = SOCKET_ERROR then

begin

Result := SOCKET_ERROR;

Disconnect;

end;

end

else

begin

Result := recv(FSocket, Buffer, BufferSize, 0);

if Result = 0 then

begin

Disconnect;

end;

if Result = SOCKET_ERROR then

begin

Result := WSAGetLastError;

if Result = WSAEWOULDBLOCK then

begin

Result := 0;

end

else

begin

Disconnect;

end;

function TClientSocket.ReceiveString: string;

begin

SetLength(Result, ReceiveBuffer(pointer(nil)^, -1));

SetLength(Result, ReceiveBuffer(pointer(Result)^, Length(Result)));

end;

function TClientSocket.SendBuffer(var Buffer; BufferSize: integer): integer;

var

ErrorCode: integer;

begin

Result := send(FSocket, Buffer, BufferSize, 0);

if Result = SOCKET_ERROR then

begin

ErrorCode := WSAGetLastError;

if (ErrorCode = WSAEWOULDBLOCK) then

begin

Result := -1;

end

else

begin

Disconnect;

end;

function TClientSocket.SendString(const Buffer: string): integer;

begin

Result := SendBuffer(pointer(Buffer)^, Length(Buffer));

end;

destructor TClientSocket.Destroy;

begin

inherited Destroy;

Disconnect;

WSACleanup;

end;

constructor TServerSocket.Create;

begin

inherited Create;

WSAStartUp(257, WSAData);

end;

procedure TServerSocket.Listen(Port: integer);

var

SockAddrIn: TSockAddrIn;

begin

Disconnect;

FSocket := socket(PF_INET, SOCK_STREAM, IPPROTO_TCP);

SockAddrIn.sin_family := AF_INET;

SockAddrIn.sin_addr.s_addr := INADDR_ANY;

SockAddrIn.sin_port := htons(Port);

bind(FSocket, SockAddrIn, sizeof(SockAddrIn));

FListening := True;

Winsock.listen(FSocket, 5);

end;

function TServerSocket.GetLocalAddress: string;

var

SockAddrIn: TSockAddrIn;

Size: integer;

begin

Size := sizeof(SockAddrIn);

getsockname(FSocket, SockAddrIn, Size);

Result := inet_ntoa(SockAddrIn.sin_addr);

end;

function TServerSocket.GetLocalPort: integer;

var

SockAddrIn: TSockAddrIn;

Size: Integer;

begin

Size := sizeof(SockAddrIn);

getsockname(FSocket, SockAddrIn, Size);

Result := ntohs(SockAddrIn.sin_port);

end;

procedure TServerSocket.Idle;

var

FDset: TFDset;

begin

FD_ZERO(FDSet);

FD_SET(FSocket, FDSet);

select(0, @FDset, nil, nil, nil);

end;

function TServerSocket.Accept: TClientSocket;

var

Size: integer;

SockAddr: TSockAddr;

begin

Result := TClientSocket.Create;

Size := sizeof(TSockAddr);

Result.FSocket := Winsock.accept(FSocket, @SockAddr, @Size);

if Result.FSocket = INVALID_SOCKET then

begin

Disconnect;

end

else

begin

Result.FConnected := True;

end;

procedure TServerSocket.Disconnect;

begin

FListening := False;

closesocket(FSocket);

end;

destructor TServerSocket.Destroy;

begin

inherited Destroy;

Disconnect;

WSACleanup;

end;

end.

---------------------------------------------------------------------------

Delphi - .....................................

Console TCP Tunnel

Bu yazılımı protokol analizi için yazmıştım.

neydi protokol analizinden kastim ?

örneğin bi program bir yere bağlandı bazı veriler aldı

bazı veriler yolladı genelde packet snifferle izlemek

eyer veri text değilse sıkındı oluşturuyor.

bu yazılım tunnelemme yapıyor giden gelen verileri

dosyaya hem platin halini hemde #rakam şeklinde

kaydediyor böylece siz bunları dosyadan alıyorsun

delphide programınıza const lar şeklinde tanımlıyorsun vs vs..

smb exploit ile alakalı yazılım analizini bununla yapmıştım.

program parametre alarak çalışıyor.

program.exe 1234 hedefip hedefport

1234 e yazılım bağlandığı an direk hedefip nin portuna bağlantı açılıp

aradan geçen veriler loglanıyor.

exe nin boyutu 85 kb. upx lersin 30 40 kb olur bu kodu iyice

inceleyerek konsolda nasıl soket açılır konsol uygulamalarda

nasıl thread yaratılır öğrenme şansınızda olur yazdığınız exe

lerin boyutlarının küçük olması anısına :)

Tunnel.DPR

----------

Program Tunnel;

Uses

Windows, WinSock, Helper, Sock, Classes;

Var

PacketCount:Longint=0;

Log:TStringList;

{---}

SourcePort:String='25';

TunelIP:String='10.0.0.20';

TunelPort:String='1234';

Procedure Log_Add(Data,Rotation:String);

Var

I:Longint;

Tmp:String;

Begin

PacketCount:=PacketCount+1;

Log.Add('Packed Index; '+IntToStr(PacketCount)+' | '+Rotation);

Log.Add('- Ascii Begin -');

Tmp:='';

For I:=1 To Length(Data) Do

Begin

Tmp:=Tmp+'+';

Tmp:=Tmp+'#';

Tmp:=Tmp+IntToStr(Ord(Data[I]));

End;

Log.Add(Tmp);

Log.Add('- Ascii END -');

Log.Add('- Platin Begin -');

Log.Add(Data);

Log.Add('- Platin END -');

Log.Add('');

End;

{------------------------------------}

Var

ServerSocket: TServerSocket;

ClientSocket: TClientSocket;

TunelClientSocket: TClientSocket;

{--}

ClientBuffer: array [0..32767] of byte;

TunelBuffer: array [0..32767] of byte;

ClientBytesReceived: integer;

TunelBytesReceived: integer;

Nonblocking: integer;

{--}

Thread_ID:LongWord;

{------------------------------------}

Function BufferToStr(V:Byte; Where:Longint):String;

Var

Tmp:String;

I:Longint;

Begin

Where:=Where-1;

Tmp:='';

If (V=1) Then Begin For I:=0 To Where Do Begin Tmp:=Tmp+Char(ClientBuffer[I]); End; End;

If (V=2) Then Begin For I:=0 To Where Do Begin Tmp:=Tmp+Char(TunelBuffer[I]); End; End;

BufferToStr:=Tmp;

End;

Procedure ClientThread_Start;

Begin

Repeat

ClientBytesReceived:=ClientSocket.ReceiveBuffer(ClientBuffer, 32768);

If ClientBytesReceived > 0 then

begin

TunelClientSocket.SendBuffer(ClientBuffer, ClientBytesReceived);

End;

Until (ClientSocket.Connected=False) Or (TunelClientSocket.Connected=False);

End;

Procedure TunelThread_Start;

Begin

Repeat

TunelBytesReceived:=TunelClientSocket.ReceiveBuffer(TunelBuffer, 32768);

If TunelBytesReceived > 0 then

begin

ClientSocket.SendBuffer(TunelBuffer, TunelBytesReceived);

End;

Until (ClientSocket.Connected=False) Or (TunelClientSocket.Connected=False);

End;

Begin

SourcePort:=ParamStr(1);

TunelIP:=ParamStr(2);

TunelPort:=ParamStr(3);

Log:=TStringList.Create;

Log.Clear;

ServerSocket:=TServerSocket.Create;

ServerSocket.Listen(StrToInt(SourcePort));

ServerSocket.Idle;

ClientSocket:=ServerSocket.Accept;

ServerSocket.Destroy;

ioctlsocket(ClientSocket.Socket, FIONBIO, Longint(Nonblocking));

TunelClientSocket:=TClientsocket.Create;

TunelClientSocket.Connect(TunelIP,StrToInt(TunelPort));

Thread_ID:=BeginThread(nil, 0, Addr(ClientThread_Start), nil, 0, Thread_ID);

Thread_ID:=BeginThread(nil, 0, Addr(TunelThread_Start), nil, 0, Thread_ID);

Repeat

Sleep(100);

Until (ClientSocket.Connected=False) Or (TunelClientSocket.Connected=False);

TunelClientSocket.Disconnect;

ClientSocket.Disconnect;

TunelClientSocket.Destroy;

ClientSocket.Destroy;

Log.SaveToFile('Data.Log');

Log.Destroy;

End.

---------------------------------------------------------------------------

Sock.Pas

--------

unit Sock;

interface

uses Winsock;

type

TClientSocket = class(TObject)

private

FAddress: pchar;

FData: pointer;

FTag: integer;

FConnected: boolean;

function GetLocalAddress: string;

function GetLocalPort: integer;

function GetRemoteAddress: string;

function GetRemotePort: integer;

protected

FSocket: TSocket;

public

procedure Connect(Address: string; Port: integer);

property Connected: boolean read FConnected;

property Data: pointer read FData write FData;

constructor Create;

destructor Destroy; override;

procedure Disconnect;

procedure Idle(Seconds: integer);

function Address: String;

property LocalAddress: string read GetLocalAddress;

property LocalPort: integer read GetLocalPort;

function ReceiveBuffer(var Buffer; BufferSize: integer): integer;

function ReceiveLength: integer;

function ReceiveString: string;

property RemoteAddress: string read GetRemoteAddress;

property RemotePort: integer read GetRemotePort;

function SendBuffer(var Buffer; BufferSize: integer): integer;

function SendString(const Buffer: string): integer;

property Socket: TSocket read FSocket;

property Tag: integer read FTag write FTag;

end;

TServerSocket = class(TObject)

private

FListening: boolean;

function GetLocalAddress: string;

function GetLocalPort: integer;

protected

FSocket: TSocket;

public

function Accept: TClientSocket;

constructor Create;

destructor Destroy; override;

procedure Disconnect;

procedure Idle;

procedure Listen(Port: integer);

property Listening: boolean read FListening;

property LocalAddress: string read GetLocalAddress;

property LocalPort: integer read GetLocalPort;

end;

var

WSAData: TWSAData;

implementation

constructor TClientSocket.Create;

begin

inherited Create;

WSAStartUp(257, WSAData);

end;

function TClientSocket.Address: String;

type

TaPInAddr = Array[0..10] of PInAddr;

PaPInAddr = ^TaPInAddr;

var

phe: PHostEnt;

pptr: PaPInAddr;

Buffer: Array[0..63] of Char;

I: Integer;

GInitData: TWSAData;

begin

WSAStartup($101, GInitData);

Result := '';

GetHostName(Buffer, SizeOf(Buffer));

phe := GetHostByName(buffer);

if phe = nil then Exit;

pPtr := PaPInAddr(phe^.h_addr_list);

I := 0;

while pPtr^[I] <> nil do

begin

Result := inet_ntoa(pptr^[I]^);

Inc(I);

end;

WSACleanup;

end;

procedure TClientSocket.Connect(Address: string; Port: integer);

var

SockAddrIn: TSockAddrIn;

HostEnt: PHostEnt;

begin

Disconnect;

FAddress := pchar(Address);

FSocket := Winsock.socket(PF_INET, SOCK_STREAM, IPPROTO_TCP);

SockAddrIn.sin_family := AF_INET;

SockAddrIn.sin_port := htons(Port);

SockAddrIn.sin_addr.s_addr := inet_addr(FAddress);

if SockAddrIn.sin_addr.s_addr = INADDR_NONE then

begin

HostEnt := gethostbyname(FAddress);

if HostEnt = nil then

begin

Exit;

end;

SockAddrIn.sin_addr.s_addr := Longint(PLongint(HostEnt^.h_addr_list^)^);

end;

Winsock.Connect(FSocket, SockAddrIn, SizeOf(SockAddrIn));

FConnected := True;

end;

procedure TClientSocket.Disconnect;

begin

closesocket(FSocket);

FConnected := False;

end;

function TClientSocket.GetLocalAddress: string;

var

SockAddrIn: TSockAddrIn;

Size: integer;

begin

Size := sizeof(SockAddrIn);

getsockname(FSocket, SockAddrIn, Size);

Result := inet_ntoa(SockAddrIn.sin_addr);

end;

function TClientSocket.GetLocalPort: integer;

var

SockAddrIn: TSockAddrIn;

Size: Integer;

begin

Size := sizeof(SockAddrIn);

getsockname(FSocket, SockAddrIn, Size);

Result := ntohs(SockAddrIn.sin_port);

end;

function TClientSocket.GetRemoteAddress: string;

var

SockAddrIn: TSockAddrIn;

Size: Integer;

begin

Size := sizeof(SockAddrIn);

getpeername(FSocket, SockAddrIn, Size);

Result := inet_ntoa(SockAddrIn.sin_addr);

end;

function TClientSocket.GetRemotePort: integer;

var

SockAddrIn: TSockAddrIn;

Size: Integer;

begin

Size := sizeof(SockAddrIn);

getpeername(FSocket, SockAddrIn, Size);

Result := ntohs(SockAddrIn.sin_port);

end;

procedure TClientSocket.Idle(Seconds: integer);

var

FDset: TFDset;

TimeVal: TTimeVal;

begin

if Seconds = 0 then

begin

FD_ZERO(FDSet);

FD_SET(FSocket, FDSet);

select(0, @FDset, nil, nil, nil);

end

else

begin

TimeVal.tv_sec := Seconds;

TimeVal.tv_usec := 0;

FD_ZERO(FDSet);

FD_SET(FSocket, FDSet);

select(0, @FDset, nil, nil, @TimeVal);

end;

function TClientSocket.ReceiveLength: integer;

begin

Result := ReceiveBuffer(pointer(nil)^, -1);

end;

function TClientSocket.ReceiveBuffer(var Buffer; BufferSize: integer): integer;

begin

if BufferSize = -1 then

begin

if ioctlsocket(FSocket, FIONREAD, Longint(Result)) = SOCKET_ERROR then

begin

Result := SOCKET_ERROR;

Disconnect;

end;

end

else

begin

Result := recv(FSocket, Buffer, BufferSize, 0);

if Result = 0 then

begin

Disconnect;

end;

if Result = SOCKET_ERROR then

begin

Result := WSAGetLastError;

if Result = WSAEWOULDBLOCK then

begin

Result := 0;

end

else

begin

Disconnect;

end;

function TClientSocket.ReceiveString: string;

begin

SetLength(Result, ReceiveBuffer(pointer(nil)^, -1));

SetLength(Result, ReceiveBuffer(pointer(Result)^, Length(Result)));

end;

function TClientSocket.SendBuffer(var Buffer; BufferSize: integer): integer;

var

ErrorCode: integer;

begin

Result := send(FSocket, Buffer, BufferSize, 0);

if Result = SOCKET_ERROR then

begin

ErrorCode := WSAGetLastError;

if (ErrorCode = WSAEWOULDBLOCK) then

begin

Result := -1;

end

else

begin

Disconnect;

end;

function TClientSocket.SendString(const Buffer: string): integer;

begin

Result := SendBuffer(pointer(Buffer)^, Length(Buffer));

end;

destructor TClientSocket.Destroy;

begin

inherited Destroy;

Disconnect;

WSACleanup;

end;

constructor TServerSocket.Create;

begin

inherited Create;

WSAStartUp(257, WSAData);

end;

procedure TServerSocket.Listen(Port: integer);

var

SockAddrIn: TSockAddrIn;

begin

Disconnect;

FSocket := socket(PF_INET, SOCK_STREAM, IPPROTO_TCP);

SockAddrIn.sin_family := AF_INET;

SockAddrIn.sin_addr.s_addr := INADDR_ANY;

SockAddrIn.sin_port := htons(Port);

bind(FSocket, SockAddrIn, sizeof(SockAddrIn));

FListening := True;

Winsock.listen(FSocket, 5);

end;

function TServerSocket.GetLocalAddress: string;

var

SockAddrIn: TSockAddrIn;

Size: integer;

begin

Size := sizeof(SockAddrIn);

getsockname(FSocket, SockAddrIn, Size);

Result := inet_ntoa(SockAddrIn.sin_addr);

end;

function TServerSocket.GetLocalPort: integer;

var

SockAddrIn: TSockAddrIn;

Size: Integer;

begin

Size := sizeof(SockAddrIn);

getsockname(FSocket, SockAddrIn, Size);

Result := ntohs(SockAddrIn.sin_port);

end;

procedure TServerSocket.Idle;

var

FDset: TFDset;

begin

FD_ZERO(FDSet);

FD_SET(FSocket, FDSet);

select(0, @FDset, nil, nil, nil);

end;

function TServerSocket.Accept: TClientSocket;

var

Size: integer;

SockAddr: TSockAddr;

begin

Result := TClientSocket.Create;

Size := sizeof(TSockAddr);

Result.FSocket := Winsock.accept(FSocket, @SockAddr, @Size);

if Result.FSocket = INVALID_SOCKET then

begin

Disconnect;

end

else

begin

Result.FConnected := True;

end;

procedure TServerSocket.Disconnect;

begin

FListening := False;

closesocket(FSocket);

end;

destructor TServerSocket.Destroy;

begin

inherited Destroy;

Disconnect;

WSACleanup;

end;

end.