/* 
	An example RAW socket program for Linux 2.4.xx

	By j00n1x (c) 2003

	Greetz: sk4zi cr3w for pr0v1d1ng fr13nd5h1p

	Rantz: So elus1ve, when d0 w3 g3t t0 j01n the netwerkz haxxorz c1ub??!

	This program requires superuser (root). Spoofs a TCP SYN Packet.

	<standard disclaimer>
	NO WARRANTY ON THIS PROGRAM. THIS IS A TUTORIAL PROGRAM
	AND SHOULD NOT BE USED FOR MALICIOUS PURPOSES! YOU HAVE
	BEEN WARNED!
*/

#define SOURCE "127.0.0.1"
#define DEST "127.0.0.1"
#define SPORT 54321
#define DPORT 1234
// because we're sending syns, we dont have a payload.
#define PACKETSIZE 0

// standard C include files
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

// unix header files
#include <unistd.h> // for write(), close()

// BSD socket header files
#include <sys/socket.h>
#include <sys/types.h>

// resolver header files
#include <netdb.h>
#include <netinet/in.h>

// hostname to ip address conversion functions
#include <arpa/inet.h>

// raw packet files - IP / TCP
#include <netinet/ip.h>
#include <netinet/tcp.h>

int main(int argc, char **argv)
{
	int fd, r; 
	char buf[1024*64];
	struct iphdr *iph;
	struct tcphdr *tcph;
	char *data;
	struct sockaddr_in to;

	srand(getpid());

	// grab raw socket
	fd = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
	if (fd < 0) { 
		perror("socket");
		exit(1);
	}

	// enable IP_HDRINCL
	r = 1;
	if (setsockopt(fd, IPPROTO_IP, IP_HDRINCL, &r, sizeof(r)) < 0) {
		perror("setsockopt");
		exit(1);
	}

	// setup pointers to point inside buffer
	memset(buf, 0, sizeof(buf));
	iph = (void *) buf;
	tcph = (void *) buf + sizeof(struct iphdr);
	data = (void *) buf + sizeof(struct iphdr) + sizeof(struct tcphdr);

	// setup IP header data
	iph->version = 4; // version 4 = IPv4
	iph->ihl = sizeof(struct iphdr) / 4; // ip header length in # of 32bits

	iph->tos = 0; // type of service (not used)
	iph->tot_len = htons(0); // filled in by kernel (man 7 raw)
	iph->id = htons(0); // let it fill by kernel 
	iph->frag_off = htons(0|0x4000); // fragment offset; 0 = first fragment,
				// 0x4000 = DF flag
	iph->ttl = 64; // time to live
	iph->protocol = IPPROTO_TCP; // protocol number for TCP
				// cat /etc/protocols for more info
	iph->check = htons(0); // filled in by kernel
	iph->saddr = inet_addr(SOURCE); // source (spoofed) address
	iph->daddr = inet_addr(DEST); // destination address

	// setup TCP header
	tcph->source = htons(SPORT); // source port
	tcph->dest = htons(DPORT); // dest port
	tcph->seq = htonl(0x0); // initial sequence number -- 
			// (NB: after the handshake, this increments with 
			// the payload amount)
	tcph->ack_seq = tcph->ack_seq;
	tcph->doff = sizeof(struct tcphdr) / 4; // size of tcp header 
						// in # of 32-bits

	tcph->syn = 1;	// syn flag

	tcph->window = 0xffff;	// make the window large enough.
	tcph->check = 0;	// this doesn't get filled in by kernel
				// but it seems to be ignored by the
				// receiver (at least accepted for RST)

	// setup data - set "AAAA.." as data -- nothing done here for TCP SYN

	memset(data, 'A', PACKETSIZE);

	// setup our socket address -- should be the same as destination
	to.sin_family = AF_INET;
	to.sin_port = 0; // not required with raw sockets
	to.sin_addr.s_addr = inet_addr(DEST);

	// fire packets away..

	while (1) {
		if (sendto(fd, buf, sizeof(struct iphdr) + 
			sizeof(struct tcphdr) + PACKETSIZE, 0, 
			(struct sockaddr *) &to, sizeof(to)) < 0) {
			perror("sendto");
		}
		sleep(1);
	}

	close(fd);

	return 0;
}