v1.5 update: Win95 users can now be attacked by using the "WinNuke" option!
A word about TTT v1.5 beta 1:
This version of TTT has NOT been tested as to whether it really works. ButtTrumpet v1.2 and WinNuke 1.0 FAT both successfully tested the crashing problems exhibited by the "WinNuke" and "WierdPing" options. TTT is a direct descendant of ButtTrumpet and WinNuke 1.0 FAT, with modifications made in order to join both sources into one program. If you feel that you have verified the test options in the "What can I test this on:" section as NOT working, EMAIL ME ASAP with details. <mailto:s-bytnar@uiuc.edu> If I do not get any feedback, I will assume this version works, and will continue with improving the range of protocols this program supports.
Tips:
•Use the "Trumpetize" and "TrumpetTestTool AEvents script" AppleScripts as base code for your own test scripts.
•When TTT is the frontmost application, it does not always tell you what it is doing. If the mouse is still moving, but clicking does nothing, TRY pressing Command-period! Command-period will cancel most operations.
•Holding the Command key while selecting a menu item shows you the "inconspicuous TommyTrumpet" dialog. I am directing this program more towards a test tool, so this option might soon be phased out in favor of a nice Grayscale Appearance look.
History of fatal TCP/IP stack flaws dealing with non-Macintosh TCP implementations:
•Fall 1995: Wierd-ping flaw of Trumpet Winsock 2.0a established as being a real flaw by a small group of Mac users at UIUC.
•4/30/1995: ButtTrumpet 1.0b1 released. Uses "wierd-pings" to test a crash flaw in the Trumpet Winsock 2.0a (possibly the unregistered users' version only) TCP/IP stack.
•Fall, 1996: Windows 95/NT come with flaws in their TCP/IP stacks that CAUSE other operating systems to crash or exhibit wierd problems. Brought out a wide call to all TCP/IP stack creators to handle invalidly generated ICMP 'ping' packets.
•Summer, 1997: WinNuke 1.0 released by "Ewald R. de Wit" <mailto:Ewald@bitterling.LeidenUniv.nl> at <http://pobox.leidenuniv.nl/%7Eewit/winnuke/>. Uses "Out-Of-Bounds" packet data to cause Windows 95 and Windows NT to crash.
•Microsoft releases Service Pack 2 for NT to fix the WinNuke 1.0 problem, making non-MacOS versions of WinNuke useless.
•Microsoft releases Service Pack 3 for NT4.0 to fix the WinNuke MacOS "Urgent Pointer" problem, making this program useless for testing the FEW servers that have been updated.
General overview of this program:
As a Mac user, you can now test if a Windows 3.1, Windows 95, or Windows NT exhibit some of the fatal TCP/IP stack flaws that are present in these operating systems. Apparently, some non-MacOS TCP stacks have been plagued by fatal bugs for a long time… especially the non-registered version of Trumpet Winsock 2.0a (for Windows 3.1).
Unfortunately Windows 95 and NT are immune to this ("Wierd Ping") part of the program. A 'fix' for this problem will hopefully surface in later versions of TrumpetTestTool.
The user interface is simple. Just run this program, fill in the test users' ip address in the box with the text “test.winsock.user”. It will take dotted-numerical ip addresses (ie. 192.0.0.1) or ip addresses by name (ie. 3w.w1cr050ft.com).
What can I test this on:
WierdPing:
•Windows 3.1 machines that use the non-registered version (maybe even the registered one) of Trumpet Winsock 2.0a).
WinNuke 1.0:
•Windows 95 that has not been updated by Maintenance Pack 3.
•Windows NT that has not been updated by Maintenance Pack 3.
User interface notes:
1) If you hold down the Command key while the program is launching, you will get a lame looking dialog. This dialog is more inconspicuous when used in lab settings! I might be removing this dialog in favor of a Grayscale Appearance look.
2) The upper area text box is just there because the front end was ripped out of another program. The text is actually used in packets, where appropriate.
3) You can copy the TrumpetTestTool sound resource into TrumpetTestTool's resource fork without any adverse effect on the useability of the program. The program size will increase by the size of the "TrumpetTestTool.snd" sound resource you add.
TrumpetTestTool test script Info:
This is a very versatile script.
1) Edit the script and you can put in a range of DOTTED ip addresses you want to attack. (IP ranges will not be able to be specified via drag&drop. AppleScript is much more convienient.)
2) Make a text file. Put a different ip address on every line. The name can be any valid ip address.
Trumpetize script Info:
There are quite a few Windows users who are also IRC addicts. Use this script with Ircle 3.0 or newer. Simply copy it to your "scripts" folder. Then run Ircle. Join a channel (#exceed, #warez, #warez1, #warez2, etc.), and type "/trumpetize" in the Ircle command line. Sit back and relax for a while as it auto-trumpetizes any user who is on that channel. If there are a lot of users on a channel, you can expect it to be relatively slow. Make sure to look at the script's contents, and feel free to spruce it up.
Menu acronyms:
N = Nuke test
P = Ping test
D = Death verification on/off. Attempt to verify that the user really did exhibit the crash side-effect of TrumpetTestTool's options.
Known bugs/deficiencies:
•WinNuke does not perform Death Verification. I am unable to test such a feature at this time, so I am unwilling to fully implement it.
Version History:
v1.5 - Renamed the program "TrumpetTestTool" to reflect the direction I am taking this program. Fixed a really really small memory leak in the "test trumpet user" AppleEvent handler. Added "WinNuke" capabilities and coresponding AppleEvent. Added documentation for the Trumpetize script. Temporarily opens and immediately closes the “TrumpetTestTool.snd” file for the Nuke dialogs. If you want, copy the "TrumpetTestTool.snd" 'snd ' resource into TrumpetTestTool's resource fork if you don't want the file lingering around, but want to heard the sound. Also, the sound is only loaded when the dialog is shown, so it is possible to switch sounds during runtime without problems. Added Balloon Help for the Menus and Menu Items. Recompiled under CW 11. (5/27/97)
v1.2r3 - I improved the TrumpetTestTool AppleScript. You can now "Trumpetize" an irc channel. TrumpetTestTool is still alive and kicking because it apparently still works. Cleanly recompiled under CW 10. (10/31/96)
v1.2r2 - Fixed "CommandKey" dialog problems---ModalDialog handlers on PowerPC MacOS require UPPs! Separated the sound resource from program---this way, if you really want to hear the sound, you just keep it in the same directory as the ButtTrumpet application.
v1.1d3 - Yes, I just felt obligated to animate that About dialog icon. >:-) hehehehe
v1.1d2 - Internal release… Doh! Forgot to add the "MathLib" for PowerMacs! Hopefully, that will fix the problems. All symbols exported, and that makes the program 186K vs 99K! Turned on "Expand Uninitialized data" too just to make sure the problem with the "CommandKey" dialog is NOT something wrong with the compiler.
v1.1r1 - AppleEvent and AppleScript compatible! Descriptive error codes for AppleScripts! Lets you attack multiple ip addresses!
v1.0r2 - Now compiled for 68K and PPC! *wheee!*
v1.0r1 - Initial public release. 68K code only.
Watch for TrumpetTestTool 2.0!
-IP address range support via Drag&Drop on the AppleScript.
-Ping of Death support.
-SYN flood with junk data.
-Seek and destroy. BT will watch the network for Microsoft networking broadcast packets, IPX packets, etc., and appropriately attack that machine. (very far in the future... I don't feel like writing an Ethernet Peeker & TCP/IP stack at this point in time.;-) )
-Rebuild using CFM-68K to take advantage of Apple's shared libraries.
-"set btsound [on/off]" switch via AppleScript.
About Dialog: will play a MIDI of an off pitch trumpet using QT Midi. Also need's default button selected.
-100% Asynchronous attacks. (Right now the code is only about 70% async.)
-Add a "Inconspicuous mode" that changes all the menus, etc. to make it look like a savvy test program. Complemented by "Phreak mode" that changes all the menus, etc. to their acronymed names.
-Make some sample code that auto-trumpetizes irc users when they join a channel. (maybe ignoring users who are returning from a net-split.)
-The new GUI for this program is in progress. Check out the prototype interface in the DLOG #1000 resource.
-Fix the AppleScripts and AppleEvent support so the code doesn't look so disgusting. (Really, this program is one big hack, and that's the way I've been maintaining it. :-) )
-I might rename this program once again, (probably to NetworkStackTestTool) depending on how many more TCP protocol breaches I can implement. Especially since I'll be taking a Networking class this fall in which I will be sure to review protocols for any possibile problems.
-W*API support.
About the author:
Programed by Steven Bytnar (s-bytnar@uiuc.edu) (aka. DDsteve (aka. DoubleD, DDsb,DD-Creations))
Thanks to Dan (of Fear South) for discovering the 'Winsuck' bug and making the trumpet sound =-)
Thanks also to the other Dan for help with the human-butt trumpet icon(s)!
Why did I write this program?
To test my Internet protocol skills.
To see how well I can port UNIX programs to MacOS.
To how people verify known Internet protocol breaches.
All Rights Reserved. Created in the United States of America.
Except as permitted under the United States Copyright Act of 1976,
the compiled part of this program, whether it is the resource fork
or the said data fork, may be reproduced and distributed in any
form by any means, or stored on a data base of retrieval system,
without the prior written permission of the author. However,
modification and redistribution of this program is denied.
One exception to the above: this program is NOT to be distributed
on any permanent storage media (CDs) except as explicitly
allowed by the author.
Disclaimer: This program is environmentally safe, and may cause screen
burnin. Not for human consumption. Any anomalies created by this program
are the responsibility of the user, and not because of any errors in my
programming. Therefore, any problem (ie. loss of data, denial of service,
etc.) caused by this program is the responsibility of the user, NOT ME.
Small Print: Any unsolicited email or denial of service attacks against me, Steven Bytnar, will not be tollerated, and as such will be prosecuted to the fullest extent.
