文章作者：netxfly [E.S.T]
信息来源：邪恶八进制安全小组（
www.eviloctal.com）
一个简单的通过Banne判断远程主机是否为Winsows系统,其实大家还可以扩充其他的功能.
大家可以随意修改代码,我没意见的.呵呵!
复制内容到剪贴板
代码:
#include "stdio.h"
#include "string.h"
#include "winsock2.h"
#include "windows.h"
#pragma comment(lib,"ws2_32.lib")
#define PORT 80
//Function Proctotype Declaration
//--------------------------------------------
DWORD WINAPI Banner(LPVOID);
void Usage(char*);
void Scan(char*,char*);
//--------------------------------------------
//End Function Proctotype Declaration
//Mian Funtion
int main(int argc,char *argv[])
{
if(argc!=3)
{
Usage(argv[0]);
}
else
{
Scan(argv[1],argv[2]);
}
return 0;
}
//End main Function
//Scan() Function Defination
//--------------------------------------------
void Scan(char *start,char *end)
{
unsigned long StartAddr;
unsigned long EndAddr;
unsigned long i;
DWORD dwThreadid;
HANDLE h;
int NumThread =0;
int TotalNum;
StartAddr=ntohl(inet_addr(start));
EndAddr=ntohl(inet_addr(end));
TotalNum=EndAddr-StartAddr;
printf("Start Scanning...\nPlease Wait...\n");
for(i=StartAddr;i<=EndAddr;i++)
{
h=CreateThread(NULL,0,Banner,(LPVOID)i,0,&dwThreadid);
if(h=NULL)
{
printf("Create Thread Failure...\n");
CloseHandle(h);
}
Sleep(4000);
} CloseHandle(h);
printf("%[%s-%s] All Scaning Compeled! \n",start,end);
return ;
}
//--------------------------------------------
//End Scan() Function Defination
//Banner() Function Defination
//---------------------------------------------
DWORD WINAPI Banner(LPVOID lp)
{
WSADATA wsa;
SOCKET netxfly;
struct sockaddr_in remote;
int ret;
char Sbuffer[]="GET /http/1.1\r\n";
char *Banner="Server:";
char Buffer[1024];
unsigned long target;
char *p;
ret=WSAStartup(MAKEWORD(2,2),&wsa);
if(ret)
{
printf("Load Socket Dll Failure...\n");
exit(0);
}
netxfly=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);
if(netxfly==INVALID_SOCKET)
{
printf("Create Socket Failure...\n");
WSACleanup();
exit(0);
}
target=(unsigned long)lp;
remote.sin_family=AF_INET;
remote.sin_port=htons(PORT);
remote.sin_addr.s_addr=htonl(target);
ret=connect(netxfly,(const struct sockaddr*)&remote,sizeof(remote));
if(ret==SOCKET_ERROR)
{
printf("Connect to Target[%s] Failuer...\n",inet_ntoa(remote.sin_addr));
closesocket(netxfly);
WSACleanup();
return 0;
}
send(netxfly,Sbuffer,strlen(Sbuffer),0);
memset(Buffer,0,sizeof(Buffer));
recv(netxfly,Buffer,1024,0);
p=strstr(Buffer,Banner);
if(p==NULL)
{
printf("[%s] Is not Windows OS\n",inet_ntoa(remote.sin_addr));
}
else
{
printf("[%s] Is Windows OS\n",inet_ntoa(remote.sin_addr));
}
closesocket(netxfly);
WSACleanup();
return 0;
}
//---------------------------------------------
//End Banner() Function Defination
void Usage(char *help)
{
printf("===============================================\n");
printf("Written by Netxfly[E.T.S] 05/02/2005\n");
printf("Usage:\n");
printf("%s <StartIP> <EndIP>\n",help);
printf("===============================================\n");
return ;
} 
