How to add payload in raw socket

[Rahul Gupta]

Hi,

I have written one script to connect to raw socket. i am able to send header part that i can see on my destination machine using wire-shark that the packets are reaching to that machine.

but, i want to add payload, means send some commands on raw socket and get the response of the same commands.

here is the code:

#!/usr/local/bin/perl


use Socket;

$src_host = "192.1.2.2"; # The source IP/Hostname
$src_port = "1301"; # The Source Port
$dst_host = "192.1.2.3"; # The Destination IP/Hostname
$dst_port = "1302"; # The Destination Port.

if(!defined $src_host or !defined $src_port or !defined $dst_host or !
+defined $dst_port) {
print "Usage: $0 <source host> <source port> <dest host> <dest port>\n
+";
exit;
} 
else {
main();
}
 
sub main {
 my $src_host = (gethostbyname($src_host))[4];
 my $dst_host = (gethostbyname($dst_host))[4];

 socket(RAW, AF_INET, SOCK_RAW, 255) || die $!;
 setsockopt(RAW, 0, 1, 1);
 
 my ($packet) = makeheaders($src_host, $src_port, $dst_host, $dst_port
+);
 my ($destination) = pack('Sna4x8', AF_INET, $dst_port, $dst_host);
 send(RAW,$packet,0,$destination);
}

sub makeheaders {
 local($src_host,$src_port,$dst_host,$dst_port) = @_;
 my $zero_cksum = 0;
 # Lets construct the TCP half
 my $tcp_proto          = 6;
 my ($tcp_len)          = 20;
 my $syn                = 13456;
 my $ack                = 0;
 my $tcp_headerlen      = "5";
 my $tcp_reserved       = 0;
 my $tcp_head_reserved  = $tcp_headerlen .
                          $tcp_reserved;
 my $tcp_urg            = 0; # Flag bits
 my $tcp_ack            = 0; # eh no
 my $tcp_psh            = 0; # eh no
 my $tcp_rst            = 0; # eh no
 my $tcp_syn            = 1; # yeah lets make a connexion! :)
 my $tcp_fin            = 0;
 my $null               = 0;
 my $tcp_win            = 124;
 my $tcp_urg_ptr        = 0;
 my $tcp_all            = $null . $null .
                          $tcp_urg . $tcp_ack .
                          $tcp_psh . $tcp_rst .
                          $tcp_syn . $tcp_fin ;

 # In order to calculate the TCP checksum we have
 # to create a fake tcp header, hence why we did
 # all this stuff :) Stevens called it psuedo headers :)

 my ($tcp_pseudo) = pack('a4a4CCnnnNNH2B8nvn',
  $tcp_len,$src_port,$dst_port,$syn,$ack,
  $tcp_head_reserved,$tcp_all,$tcp_win,$null,$tcp_urg_ptr);

 my ($tcp_checksum) = &checksum($tcp_pseudo);

 # Now lets construct the IP packet
 my $ip_ver             = 4;
 my $ip_len             = 5;
 my $ip_ver_len         = $ip_ver . $ip_len;
 my $ip_tos             = 00;
 my ($ip_tot_len)       = $tcp_len + 20;
 my $ip_frag_id         = 19245;
 my $ip_frag_flag       = "010";
 my $ip_frag_oset       = "0000000000000";
 my $ip_fl_fr           = $ip_frag_flag . $ip_frag_oset;
 my $ip_ttl             = 30;

 # Lets pack this baby and ship it on out!
 my ($pkt) = pack('H2H2nnB16C2na4a4nnNNH2B8nvn',
  $ip_ver_len,$ip_tos,$ip_tot_len,$ip_frag_id,
  $ip_fl_fr,$ip_ttl,$tcp_proto,$zero_cksum,$src_host,
  $dst_host,$src_port,$dst_port,$syn,$ack,$tcp_head_reserved,
  $tcp_all,$tcp_win,$tcp_checksum,$tcp_urg_ptr);

 return $pkt;
}

sub checksum {
 # This of course is a blatent rip from _the_ GOD,
 # W. Richard Stevens.
  
 my ($msg) = @_;
 my ($len_msg,$num_short,$short,$chk);
 $len_msg = length($msg);
 $num_short = $len_msg / 2;
 $chk = 0;
 foreach $short (unpack("S$num_short", $msg)) {
  $chk += $short;
 }
 $chk += unpack("C", substr($msg, $len_msg - 1, 1)) if $len_msg % 2;
 $chk = ($chk >> 16) + ($chk & 0xffff);
 return(~(($chk >> 16) + $chk) & 0xffff);
}

can anyone help me how to add pay load ..

Thanks in advance

[Corion]

What protocol does the receiving machine speak?

Also, why are you constructing your packets manually instead of using a plain TCP connection?

[marto]

Interesting ports, I've only seen them used in DoS attacks. What are you actually trying to do?

[Rahul Gupta]

Hi,

I have one user equipment. and want to send some command on it and get the response on the host machine.

there is only one way to make a connection with UE is Raw socket connection. so i am exploring the things in perl but not getting the right way to do so.

Please suggest me the right way to do so.

Thanks in advance

[marto]

I see you have several previous questions on the same subject (for example Raw socket Connection.). If the method suggested here does not work, you're going to have to be more specific. Give us the details needed to help. What is this device you are trying to communicate with? Which operating system does it run? Which operating system does your computer (which you will use to communicate with this equipment) run? How do I post a question effectively? has more advice.

[flexvault]

Rahul Gupta,

$src_host = "192.1.2.2"; # The source IP/Hostname
$dst_host = "192.1.2.3"; # The Destination IP/Hostname

I believe the addresses you are using are real Internet addresses. The private addresses are:

24-bit block	10.0.0.0 - 10.255.255.255
20-bit block	172.16.0.0 - 172.31.255.255
16-bit block	192.168.0.0 - 192.168.255.255

If you are behind a NAT firewall/router, it doesn't matter since those addresses aren't visible to the Internet. But if you are using a non-NAT device to get to the internet, those addresses will be routed on the Internet and may give you some strange and interesting results :-)

Good Luck...Ed