|
编写dos一个程序在内存中搜索dhcp服务端传给dos下数据。
http://dos.420mb.com/tftpboot.rar这里面的网络工具就是这样获取dhcp服务端ip地址。当然dns,网关这些参数也能获取到。
这是源程序:
DECLARE FUNCTION hex2ip$ (hexstr$)
DECLARE FUNCTION hex2str$ (hexstr$)
DECLARE FUNCTION hex2data$ (hexstr$)
DECLARE SUB querydhcp (opticode$, optilen%, optistr$)
DIM SHARED subnetmask$, gateways$, dns$, si$
DIM memt AS STRING * 2
DIM memstr AS STRING * 4
DIM tmem$(31)
DIM dhcp$(575)
'REDIM dhcp$(575)
dhcplen% = UBOUND(dhcp$)
t1& = TIMER
sign$ = CHR$(&H53) + CHR$(&H63) + CHR$(&H35) + CHR$(&H1) + CHR$(&H5)
TIMER ON
ON TIMER(11) GOSUB ShowError
GOTO continue
ShowError:
t2& = TIMER
IF t2& < t1& THEN t2& = t2& + 86400
PRINT "Time="; t2& - t1&; " Offset="; offset&; " Start="; start&; " Count="; i%; " Keyword="; k1%; k2%
RETURN
continue:
readlen% = 100
offset& = 0 '<65535
start& = 32000
DEF SEG = offset&
startread:
IF start& > 33048 THEN
start& = 280
offset& = offset& + 2048
IF offset& > 20480 THEN
t2& = TIMER
IF t2& < t1& THEN t2& = t2& + 86400
PRINT "Out of range.Time:"; t2& - t1&
'GOSUB ShowError
END
END IF
DEF SEG = offset&
END IF
t$ = ""
FOR s1% = 0 TO readlen%
t$ = t$ + CHR$(PEEK(start& + s1%))
NEXT s1%
s1% = INSTR(t$, sign$)
IF s1% = 0 THEN
start& = start& + readlen%
GOTO startread
END IF
start& = start& + s1% - 281
k& = start& + 16
k1% = PEEK(k&)
k2% = PEEK(k& + 1)
IF k1% > 3 OR k1% = 0 OR INSTR(COMMAND$, "/DEBUG") > 0 THEN autodebug% = 1
FOR mem% = 0 TO dhcplen% STEP 16
mem1% = 0
memstr = STR$(mem% + mem1%)
m1$ = memstr + "->"
FOR mem1% = 0 TO 15
mem$ = HEX$(PEEK(mem% + mem1% + start&))
IF LEN(mem$) < 2 THEN mem$ = "0" + mem$
IF dhcplen% >= mem% + mem1% THEN dhcp$(mem% + mem1%) = mem$
masc% = VAL("&h" + mem$)
IF masc% < 32 OR masc% > 128 THEN masc% = 32
tmem$(mem1%) = mem$
tmem$(mem1% + 16) = CHR$(masc%)
NEXT mem1%
m$ = m1$ + tmem$(0) + " " + tmem$(1) + " " + tmem$(2) + " " + tmem$(3) + " " + tmem$(4) + " " + tmem$(5) + " " + tmem$(6) + " " + tmem$(7) + " "
memstr = STR$(mem% + mem1% - 8)
m2$ = "|" + memstr + "- "
m$ = m$ + m2$ + tmem$(8) + " " + tmem$(9) + " " + tmem$(10) + " " + tmem$(11) + " " + tmem$(12) + " " + tmem$(13) + " " + tmem$(14) + " " + tmem$(15) + " | "
m$ = m$ + tmem$(16) + tmem$(17) + tmem$(18) + tmem$(19) + tmem$(20) + tmem$(21) + tmem$(22) + tmem$(23) + tmem$(24) + tmem$(25) + tmem$(26) + tmem$(27) + tmem$(28) + tmem$(29) + tmem$(30) + tmem$(31) + "|"
IF autodebug% = 1 THEN
PRINT m$
'IF (mem% > 300 AND mem% < 305) OR (mem% + 16 > dhcplen%) THEN
'PRINT "Pause ffset="; offset&; " Start="; start&; " Count="; i%; " Keyword="; k1%; k2%
'DO: LOOP WHILE INKEY$ = ""
'END IF
END IF
NEXT mem%
IF autodebug% = 1 THEN
i% = i% + 1
PRINT "Auto Debug Offset="; offset&; " Start="; start&; " Count="; i%; " Keyword="; k1%; k2%
END IF
IF autodebug% = 1 AND k2% <> 2 AND k2% <> 0 THEN r1 = 1 ELSE r1 = 0
IF (r1 = 1 OR dhcp$(57) <> "00" OR dhcp$(58) = "00") AND offset& <= 16384 THEN
autodebug% = 0
start& = start& + 400
PRINT "Return"
GOTO startread
END IF
IF k2% = 2 AND autodebug% = 1 THEN
dlen% = k2% * 256 + k1%
ELSEIF autodebug% = 0 THEN
dlen% = k1% * 256 + k2%
ELSEIF INSTR(COMMAND$, "/O") > 0 THEN
autodebug% = 0
PRINT "Debug Offset="; offset&; " Start="; start&; " Count="; i%; " Keyword="; k1%; k2%
start& = start& + 300
GOTO startread
END IF
GOSUB ShowError
TIMER OFF
'PRINT "Opcode="; hex2data$(dhcp$(42))
'PRINT "HType="; hex2data$(dhcp$(43))
'PRINT "Hlen="; hex2data$(dhcp$(44))
'PRINT "Hops="; hex2data$(dhcp$(45))
'PRINT "Transaction ID="; hex2data$(dhcp$(46) + dhcp$(47) + dhcp$(48) + dhcp$(49))
'PRINT "Seconds="; hex2data$(dhcp$(50) + dhcp$(51))
'PRINT "Flags="; hex2data$(dhcp$(52) + dhcp$(53))
'PRINT "CIAddr="; hex2ip$(dhcp$(54) + dhcp$(55) + dhcp$(56) + dhcp$(57))
yi$ = hex2ip$(dhcp$(58) + dhcp$(59) + dhcp$(60) + dhcp$(61))
'PRINT "YIAddr="; yi$
si$ = hex2ip$(dhcp$(62) + dhcp$(63) + dhcp$(64) + dhcp$(65))
'***si$ = hex2ip$(dhcp$(26) + dhcp$(27) + dhcp$(28) + dhcp$(29))
'PRINT "SIAddr="; si$
'PRINT "GIAddr="; hex2ip$(dhcp$(66) + dhcp$(67) + dhcp$(68) + dhcp$(69))
mac$ = dhcp$(70) + ":" + dhcp$(71) + ":" + dhcp$(72) + ":" + dhcp$(73) + ":" + dhcp$(74) + ":" + dhcp$(75)
PRINT "CHAddr="; mac$
PRINT "YIAddr="; yi$
t$ = ""
FOR i% = 0 TO 63
a$ = dhcp$(86 + i%)
IF a$ = "00" THEN EXIT FOR
j% = VAL("&H" + a$)
t$ = t$ + CHR$(j%)
NEXT i%
'PRINT "Server name="; t$
t$ = ""
FOR i% = 0 TO 127
a$ = dhcp$(150 + i%)
IF a$ = "00" THEN EXIT FOR
j% = VAL("&H" + a$)
t$ = t$ + CHR$(j%)
NEXT i%
'PRINT "Boot file="; t$
'PRINT "Magic cookie=99.130.83.99"
FOR i% = 282 TO UBOUND(dhcp$) - 20
j% = VAL("&H" + dhcp$(i% + 1))
a$ = ""
FOR k% = i% + 2 TO i% + 1 + j%
a$ = a$ + dhcp$(k%)
NEXT k%
querydhcp dhcp$(i%), j%, a$
IF dhcp$(k%) = "FF" THEN EXIT FOR
i% = k% - 1
NEXT
ipfile$ = LEFT$(ENVIRON$("COMSPEC"), 2) + "\setip.bat"
OPEN ipfile$ FOR OUTPUT AS #1
PRINT #1, "@echo off"
PRINT #1, "SET MAC="; mac$
PRINT #1, "SET MYIP="; yi$
PRINT #1, "SET SUBNETMASK="; subnetmask$
PRINT #1, "SET TFTPIP="; si$
PRINT #1, "SET GATEWAYS="; gateways$
PRINT #1, "SET DNSSERVERS="; dns$
CLOSE #1
END
FUNCTION hex2data$ (hexstr$)
IF LEN(hexstr$) < 8 THEN hexstr$ = STRING$(8 - LEN(hexstr$), "0") + hexstr$
a& = VAL("&H" + LEFT$(hexstr$, 2)) * 256 * 256 * 256
a& = a& + VAL("&H" + MID$(hexstr$, 3, 1)) * 256 * 256
a& = a& + VAL("&H" + MID$(hexstr$, 5, 2)) * 256
a& = a& + VAL("&H" + RIGHT$(hexstr$, 2))
hex2data$ = LTRIM$(STR$(a&))
END FUNCTION
DEFINT A-Z
FUNCTION hex2ip$ (hexstr$)
FOR i% = 1 TO 7 STEP 2
u$ = u$ + LTRIM$(STR$(VAL("&H" + (MID$(hexstr$, i%, 2))))) + "."
NEXT i%
hex2ip$ = LEFT$(u$, LEN(u$) - 1)
END FUNCTION
FUNCTION hex2str$ (hexstr$)
FOR i% = 1 TO LEN(hexstr$) * 2 - 1 STEP 2
a$ = a$ + CHR$(VAL("&H" + MID$(hexstr$, i%, 2)))
NEXT i%
hex2str$ = a$
END FUNCTION
SUB querydhcp (opticode$, optistr%, optistr$)
a% = VAL("&H" + opticode$)
SELECT CASE a%
CASE 1
subnetmask$ = hex2ip$(optistr$)
PRINT "Subnet mask="; subnetmask$
CASE 2
'PRINT "Time offset="; hex2data$(optistr$)
CASE 3
FOR i% = 1 TO optistr% * 2 - 1 STEP 8
a$ = a$ + hex2ip$(MID$(optistr$, i%, 8)) + ","
NEXT i%
gateways$ = LEFT$(a$, LEN(a$) - 1)
PRINT "Gateways="; gateways$
CASE 6
FOR i% = 1 TO optistr% * 2 - 1 STEP 8
a$ = a$ + hex2ip$(MID$(optistr$, i%, 8)) + ","
NEXT i%
dns$ = LEFT$(a$, LEN(a$) - 1)
PRINT "DNS server="; dns$
CASE 12
PRINT "Host name="; hex2str$(optistr$)
CASE 15
PRINT "Domain name="; hex2str$(optistr$)
CASE 44
FOR i% = 1 TO optistr% * 2 - 1 STEP 8
a$ = a$ + hex2ip$(MID$(optistr$, i%, 8)) + ","
NEXT i%
wins$ = LEFT$(a$, LEN(a$) - 1)
PRINT "WINS/NBNS server address="; wins$
CASE 46
'PRINT "WINS/NBT node type="; hex2str$(optistr$)
CASE 47
'PRINT "NetBIOS scope ID="; hex2str$(optistr$)
CASE 51
PRINT "DHCP address lease time="; hex2data$(optistr$)
CASE 53
b% = VAL("&H" + optistr$)
c$ = "DCHP message type="
SELECT CASE b%
CASE 1
'PRINT c$; "DHCP discover"
CASE 2
'PRINT c$; "DHCP offer"
CASE 3
'PRINT c$; "DHCP request"
CASE 4
'PRINT c$; "DHCP decline"
CASE 5
'PRINT c$; "DHCP ack"
CASE 6
'PRINT c$; "DHCP nack"
CASE 7
'PRINT c$; "DHCP release"
END SELECT
CASE 54
seride$ = hex2ip$(optistr$)
IF si$ <> seride$ THEN PRINT "Server IP address may be wrong."
si$ = seride$
'PRINT "Server identifier=";si$
PRINT "SIAddr="; si$
END SELECT
END SUB |
|