dnsgoblin.c

/*******************************************************************************
 *                                                                             *
 *         ~    .__ °.__   0       o                    ^   .__ °__  `´        *
 *  °____) __ __|  | | °|   ______°____ 0 ____  __ _________|__|/  |_ ___.__.  *
 *  /    \|  | °\  |°|  | °/  ___// __ \_/ ___\|  | °\_  __ \ o\   __<   |  |  *
 * | o°|  \  |  /  |_|  |__\___ \\  ___/\ °\___| o|  /|  | \/  ||  |° \___ O|  *
 * |___|  /____/|____/____/____ °>\___  >\___  >____/ |__|° |__||__|  / ____|  *
 * `´´`´\/´`nullsecurity team`´\/`´´`´\/`´``´\/  ``´```´```´´´´`´``0_o\/´´`´´  *
 *                                                                             *
 * dnsgoblin.c - nasty creature constantly searching for DNS servers           *
 *                                                                             *
 * DATE                                                                        *
 * 03/11/2011                                                                  *
 *                                                                             *
 * DESCRIPTION                                                                 *
 * dnsgoblin uses standard dns querys and waits for the replies.               *
 *                                                                             *
 * AUTHOR                                                                      *
 * atzeton - http://www.nullsecurity.net/                                      *
 *                                                                             *
 * COMPILE                                                                     *
 * gcc dnsgoblin.c -O2 -lpthread -Wall -Wextra -pedantic \                     *
 * --std=gnu99 -D_REENTRANT                                                    *
 *                                                                             *
 * NOTES                                                                       *
 * This tool is for educational and testing purposes only.                     *
 * The author is NOT responsible for any kind of misusage!                     *
 * You may pipe stdout into a file: ./dnsgoblin > dnslist                      *
 *                                                                             *
 ******************************************************************************/


#include <stdio.h>
#include <time.h>
#include <stdlib.h>
#include <signal.h>
#include <string.h>
#include <netinet/udp.h>
#include <sys/socket.h>
#include <unistd.h>
#include <sys/time.h>
#include <arpa/inet.h>
#include <linux/ip.h>
#include <inttypes.h>
#include <pthread.h>


/* the ip header struct */
struct ipheader {
    uint8_t v;
    uint8_t tos;
    uint16_t len;
    uint16_t id;
    uint16_t off;
    u_char ttl;
    u_char p;
    uint16_t sum;
    uint32_t src;
    uint32_t dst;
};

/* _beginning_ of dns header */
struct dnsheader {
    uint16_t trans_id;
    /* incomplete */
};


void     sig_int(int sig);
char    *human_addr(uint32_t ip_addr);
void    *lstn(void *ptr);
int8_t   check_ip_addr(char *ptr);
int      main(int argc, char **argv);


/* quit if SIGINT is received */
void
sig_int(int sig)
{
    if (sig != SIGINT) {
        exit(EXIT_FAILURE);
    }

    exit(EXIT_SUCCESS);
}

/* check if the given ip is valid */
int8_t
check_ip_addr(char *ptr)
{
    if( strlen(ptr) > 16) {
        printf("error: ip addr too long\n");
        exit(EXIT_FAILURE);
    }

    if( (int)inet_addr(ptr) == -1 ) {
        printf("error: ip addr not correct\n");
        exit(EXIT_FAILURE);
    }

    return(0);
}


/* int ip -> dotted decimals */
char *
human_addr(uint32_t ip_addr)
{
    char *ptr    = calloc(1,16);
    uint8_t oct1 = 0;
    uint8_t oct2 = 0;
    uint8_t oct3 = 0;
    uint8_t oct4 = 0;;

    oct1 = ( ip_addr >> 24 ) & 0xFF;
    oct2 = ( ip_addr >> 16 ) & 0xFF;
    oct3 = ( ip_addr >> 8  ) & 0xFF;
    oct4 =   ip_addr         & 0xFF;

    sprintf(ptr,"%d.%d.%d.%d",oct4,oct3,oct2,oct1);
    return(ptr);
}


/* listen for dns responses */
void
*lstn(void *ptr)
{
    int *sptr             = ptr;
    int sockfd            = *sptr;
    struct ipheader *ip   = NULL;
    uint8_t *pkt_recv     = calloc(1,2048);
    char *cptr            = NULL;

    while(1==1) {
        memset(pkt_recv,0x00,2047);

        if( recv(sockfd, pkt_recv, 2047, 0) > 0) {
            ip = (struct ipheader *)pkt_recv;
            cptr = human_addr(ip->src);
            printf("%s\n",cptr);
            free(cptr);
        }
    }

}


int main(int argc, char **argv)
{
    int32_t sockfd;         /* raw socket to inject packets */
    int32_t sockfd2;        /* prevent ICMP port unreach msgs creating a layer4 udp sock on iface */

    struct sockaddr_in ifcfg;
    struct sockaddr_in sin;

    int        one = 1;
    const int *val = &one;

    /* what can you find out here? */
    char packet[]  = "\x45\x00\x00\x3b\x6c\xbb\x40\x00\x40\x11\x6b\xd4\xc0\xa8\x02\x65\x55\xd6\x49\x3f\x13\x37\x00\x35\x00\x27\x00\x00\xd6\x88\x01\x00\x00\x01\x00\x00\x00\x00\x00\x00\x03\x77\x77\x77\x06\x61\x6d\x61\x7a\x6f\x6e\x02\x64\x65\x00\x00\x01\x00\x01";

    struct ipheader  *ip  = NULL;
    struct udphdr    *udp = NULL;
    struct dnsheader *dns = NULL;

    uint16_t local_port   = 0;
    pthread_t trd_lstn;

    if( argc < 2) {
        printf("error: need local ip as arg\n");
        exit(EXIT_FAILURE);
    }

    check_ip_addr(argv[1]);

    srand ( time(NULL)    );
    signal(SIGINT, sig_int); /* set up a signal handler */


    /* get random port */
    local_port = (uint32_t)rand();

    /* pseudo socket */
    sockfd2 = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);

    /* bind to port (used to prevent icmp bla) */
    ifcfg.sin_family      = AF_INET;
    ifcfg.sin_port        = htons(local_port);
    ifcfg.sin_addr.s_addr = htonl(INADDR_ANY);

    bind(sockfd2, (struct sockaddr *)&ifcfg, sizeof(ifcfg));

    /* create main raw sock */
    sockfd         = socket(AF_INET, SOCK_RAW, IPPROTO_UDP);
    sin.sin_family = AF_INET;
    sin.sin_port   = htons (local_port);

    if (setsockopt (sockfd, IPPROTO_IP, IP_HDRINCL, val, sizeof (one)) < 0) {
        printf("err\n");
    }

    if(sockfd < 0) {
        fprintf(stderr,"error: rawsock cannot be created. No permission.\n");
        exit(EXIT_FAILURE);
    }

    /* change the UDI (-> nobody) */
    setuid(65534);

    /* create thread which is listening for dns responses */
    pthread_create(&trd_lstn, NULL, lstn, (void *)&sockfd);

    ip = (struct ipheader *)packet;
    ip->id  = ntohs( rand() );
    ip->v   = 0x45;
    ip->tos = 0x0054;
    ip->len = 30;
    ip->off = 0x0000;
    ip->ttl = 0xff;
    ip->p   = 17;
    ip->sum = 0x0000;

    ip->src = inet_addr(argv[1]);

    udp         = (struct udphdr *)(packet + sizeof(struct ipheader));
    udp->source = ntohs( local_port );
    udp->dest   = ntohs(53);

    dns = (struct dnsheader *)(packet + sizeof(struct ipheader) + sizeof(struct udphdr) );

    while(1==1) {
        /* do some modifications */
        ip->id  = ntohs( rand() );
        ip->dst = ntohl( rand() );

        dns->trans_id = ntohs( rand() );

        if( sendto(sockfd, &packet, sizeof(packet)-1 , 0, (struct sockaddr *) &sin, sizeof (sin)) < 0){
            printf("error: sendto failed\n");
            exit(EXIT_FAILURE);
        }

        usleep(5000); /* you may increase/decrease this */
    }

    close(sockfd);

    return 0;
}

/* EOF */