/* 
	An example RAW socket program for Linux 2.4.xx - RELOADED

	By j00n1x (c) 2003

	Greetz: sk4zi cr3w for pr0v1d1ng fr13nd5h1p.
	
	This program requires superuser (root). Spoofs a packet of the type:
	TCP SYN, UDP, or ICMP echo reply. Contains checksum algorithm.

	<standard disclaimer>
	NO WARRANTY ON THIS PROGRAM. THIS IS A TUTORIAL PROGRAM
	AND SHOULD NOT BE USED FOR MALICIOUS PURPOSES! YOU HAVE
	BEEN WARNED!

	Ok, who am eye kidding... just d0nt j00se it to t4k3 d0wn y4h00 ok?
	Just remember that Mafiab0y was r00ted by bubba in his 4x4 cell f0r 
	years bef0re h3 st4rt3d r0rt1ng the s3cur1ty industry and g0t p41d
	t0 haxxor. Just as lame as Kevin M1tn1ck, but d1fferent...
*/

// only 1 can be chosen at any one time.
#define USE_UDP
//#define USE_TCP
//#define USE_ICMP

#define SOURCE "127.0.0.1"
#define DEST "127.0.0.1"

#if defined(USE_TCP) || defined(USE_UDP)
#define SPORT 54321
#define DPORT 1234
#endif

// can't be larger than MTU because we don't fragment
#if defined(USE_UDP) || defined(USE_ICMP)
#define PACKETSIZE 500
#else // tcp syn
#define PACKETSIZE 0
#endif

// standard C include files
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

// unix header files
#include <unistd.h> // for write(), close()

// BSD socket header files
#include <sys/socket.h>
#include <sys/types.h>

// resolver header files
#include <netdb.h>
#include <netinet/in.h>

// hostname to ip address conversion functions
#include <arpa/inet.h>

// raw packet files - IP / etc
#include <netinet/ip.h>

#ifdef USE_UDP
#include <netinet/udp.h>
#elif defined(USE_TCP)
#include <netinet/tcp.h>
#elif defined(USE_ICMP)
#include <netinet/ip_icmp.h>
#endif


// Short rantz here: j00 kn0w j00 could use /usr/include/asm/checksum.h
// but like.. nah.. That's fully sik x86 opcodes man! Screw that! It's not 
// p0rt4bl3 enuff.
// p.s. Sorry f0r j00sing lun1x headers.. but BSD headers suck ass.
// take a l00k at the BSD socket API.. it's the w0rst th1ng th4ts h4pp3n3d
// t0 bsd, j00n1x, win32, the world, etc. etc. Why d0 ppl wh0 c0de Operating
// Systems blindly use BSD socket API? j00 d0nt have t0 j00se it ya know?!

unsigned short fold(int sum)
{
	sum = (sum >> 16) + (sum & 0xffff);
	sum += (sum >> 16);
	return (~(sum & 0xffff));
}

unsigned long tcpudpsum(unsigned long saddr, unsigned long daddr, 
	unsigned short len, unsigned char proto, unsigned int sum)
{
	struct {
		unsigned long saddr;
		unsigned long daddr;
		unsigned char zero;
		unsigned char proto;
		unsigned short len;
	} pseudo;
	unsigned short *p;
	int i;

	pseudo.saddr = saddr;
	pseudo.daddr = daddr;
	pseudo.zero = 0;
	pseudo.proto = proto;
	pseudo.len = len;

	p = (unsigned short *) &pseudo;

	for (i = 0; i < 12; i += 2) {
		sum = sum + *p;
		p++;
	}

	return sum;
}	

unsigned long checksum(const void *data, int len)
{
	char *buf;
	unsigned long sum;
	int i;

	buf = malloc(len + 4);
	memset(buf, 0, len + 4);
	memcpy(buf, data, len);

	sum = 0;
	for (i = 0; i < len; i += 2) {
		sum = sum + *(unsigned short *) (buf + i);
	}

	free(buf);

	return sum;
}

void setup_ip(struct iphdr *iph)
{
	// setup IP header data
	iph->version = 4; // version 4 = IPv4
	iph->ihl = sizeof(struct iphdr) / 4; // ip header length in # of 32bits

	iph->tos = 0; // type of service (not used)
	iph->tot_len = htons(0); // filled in by kernel (man 7 raw)
	iph->id = htons(0); // let it fill by kernel 
	iph->frag_off = htons(0|0x4000); // fragment offset; 0 = first fragment,
					// 0x4000 = DF flag
	iph->ttl = 64; // time to live
#ifdef USE_UDP
	iph->protocol = IPPROTO_UDP; // protocol number for UDP
				// cat /etc/protocols for more info
#elif defined(USE_TCP)
	iph->protocol = IPPROTO_TCP;
#elif defined(USE_ICMP)
	iph->protocol = IPPROTO_ICMP;
#endif
	iph->check = htons(0); // filled in by kernel
	iph->saddr = inet_addr(SOURCE); // source (spoofed) address
	iph->daddr = inet_addr(DEST); // destination address
}

#ifdef USE_UDP
void setup_udp(struct udphdr *udph)
{
	// setup UDP header
	udph->source = htons(SPORT); // source port
	udph->dest = htons(DPORT); // dest port
	udph->len = htons(PACKETSIZE + 
		sizeof(struct udphdr)); // size of packet + udp header
	udph->check = htons(0); // set later
}

#elif defined(USE_TCP)
void setup_tcp(struct tcphdr *tcph)
{
	// setup TCP header
	tcph->source = htons(SPORT); // source port
	tcph->dest = htons(DPORT); // dest port
	tcph->seq = htonl(0x0); // initial sequence number --
			// (NB: after the handshake, this increments with
			// the payload amount)
	tcph->ack_seq = tcph->ack_seq;
	tcph->doff = sizeof(struct tcphdr) / 4; // size of tcp header
						// in # of 32-bits

	tcph->syn = 1;  // syn flag

	tcph->window = 0xffff;  // make the window large enough.
	tcph->check = htons(0);        // set later
}

#elif defined(USE_ICMP)
void setup_icmp(struct icmphdr *icmph)
{
	// setup ICMP header
	icmph->type = ICMP_ECHOREPLY;
	icmph->code = 0; // no (sub) code needed for ICMP_ECHOREPLY
	icmph->checksum = htons(0); // set later
	icmph->un.echo.id = htons(0);
	icmph->un.echo.sequence = htons(0);
}
#endif

int main(int argc, char **argv)
{
	int fd, r; 
	char buf[1024*64];
	struct iphdr *iph;
#ifdef USE_UDP
	struct udphdr *udph;
#elif defined(USE_TCP)
	struct tcphdr *tcph;
#elif defined(USE_ICMP)
	struct icmphdr *icmph;
#endif
	char *data;
	struct sockaddr_in to;

	// grab raw socket
	fd = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
	if (fd < 0) { 
		perror("socket");
		exit(1);
	}

	// enable IP_HDRINCL
	r = 1;
	if (setsockopt(fd, IPPROTO_IP, IP_HDRINCL, &r, sizeof(r)) < 0) {
		perror("setsockopt");
		exit(1);
	}

	// setup pointers to point inside buffer
	iph = (void *) buf;
#ifdef USE_UDP
	udph = (void *) buf + sizeof(struct iphdr);
	data = (void *) buf + sizeof(struct iphdr) + sizeof(struct udphdr);
#elif defined(USE_TCP)
	tcph = (void *) buf + sizeof(struct iphdr);
	data = (void *) buf + sizeof(struct iphdr) + sizeof(struct tcphdr);
#elif defined(USE_ICMP)
	icmph = (void *) buf + sizeof(struct iphdr);
	data = (void *) buf + sizeof(struct iphdr) + sizeof(struct icmphdr);
#endif

	setup_ip(iph);

#ifdef USE_UDP
	setup_udp(udph);
#elif defined(USE_TCP)
	setup_tcp(tcph);
#elif defined(USE_ICMP)
	setup_icmp(icmph);
#endif

	// setup data - set "AAAA.." as data

	memset(data, 'A', PACKETSIZE);

	// setup checksum
#ifdef USE_UDP
	udph->check = fold(tcpudpsum(iph->saddr, iph->daddr, udph->len,
			iph->protocol, checksum(udph, sizeof(struct udphdr) + 
			PACKETSIZE)));
#elif defined(USE_TCP)
	tcph->check = fold(tcpudpsum(iph->saddr, iph->daddr, htons(
			sizeof(struct tcphdr) + PACKETSIZE),
			iph->protocol, checksum(tcph, sizeof(struct tcphdr) + 
			PACKETSIZE)));
#elif defined(USE_ICMP)
	icmph->checksum = fold(checksum(icmph, sizeof(struct icmphdr) + 
			PACKETSIZE));
#endif


	// setup our socket address -- should be the same as destination
	to.sin_family = AF_INET;
	to.sin_port = 0; // not required with raw sockets
	to.sin_addr.s_addr = inet_addr(DEST);

	// fire packets away..

	while (1) {
		if (sendto(fd, buf, (data - buf) + PACKETSIZE, 0, 
			(struct sockaddr *) &to, sizeof(to)) < 0) {
			perror("sendto");
		}
		sleep(1);
	}

	close(fd);

	return 0;
}