/************************************************************************
*									*
* ORODRUIN.c			Il Monte del Fato, la forgia entro cui	*
*				l' Uno e' stato creato, nella terra di	*
*				Mordor, dove l'ombra nera attende.	*
*									*
*				    Uno Spoof per regnarli,		*
*					Uno Spoof per trovarli, 	*
*				Uno Spoof per ghermirli, e nel buio	*
*				 incatenarli, nella terra di Redmond	*
*					dove il nero hacker attende ... *
*									*
* 				(C)1999 FuSyS TCP/IP Tools Unlimited	*
************************************************************************/

#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <ctype.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <time.h>

unsigned short ip_fast_csum(unsigned char *iph,unsigned long ihl) {
        unsigned long sum;

        __asm__ __volatile__("
            movl (%1), %0
            subl $4, %2
            jbe 2f
            addl 4(%1), %0
            adcl 8(%1), %0
            adcl 12(%1), %0
1:          adcl 16(%1), %0
            lea 4(%1), %1
            decl %2
            jne 1b
            adcl $0, %0
            movl %0, %2
            shrl $16, %0
            addw %w2, %w0
            adcl $0, %0
            notl %0
2:
 	    "
        : "=r" (sum), "=r" (iph), "=r" (ihl)
        : "1" (iph), "2" (ihl));
        return(sum);
}

struct pseudo {
	unsigned long saddr, daddr;
	unsigned char zero, proto;
	unsigned short len;
};

unsigned long in_aton(const char *str)
{
        unsigned long l;
        unsigned long val;
        int i;

        l = 0;
        for (i = 0; i < 4; i++)
        {
           l <<= 8;
           if (*str != '\0')
           {
               val = 0;
               while (*str != '\0' && *str != '.')
               {
                        val *= 10;
                        val += *str - '0';
                                str++;
                        }
                        l |= val;
                        if (*str != '\0')
                                str++;
                }
        }
        return(htonl(l));
}

void uff(void) {
	printf("\nUso: Orodruin sourceIP destIP ");
	printf("[-h -s -d -n -F -S -R -P -A -U]\n");
	printf("        -h       questa litania di Angmar ...\n");
	printf("	-s porta l' origine dell' Uno\n");
	printf("        -d porta la destinazione dell' Uno\n");
	printf("        -n x     il numero delle creazioni\n");
	printf("        -FSRPAU  le bandiere dell'Uno\n\n");
	exit(1);
}
int main(int argc, char **argv) {

	unsigned char pkt[1500], *x0F, b, flags=0;
	struct sockaddr_in sin;
	struct pseudo psp;
	int fd, fdo, ln, i, snt, opt, hz=1, os=0, od=0;
	unsigned long saddr, daddr;
	unsigned short src=0, dest=0;

	if(argc<3) {
		uff();
		exit(1);
	}

	saddr=in_aton(argv[1]);daddr=in_aton(argv[2]);

	while ((opt = getopt(argc, (char**)argv, "hs:d:n:FSRPAU")) != EOF )
        {
                switch(opt)
                {
			case 'h':
			uff();
			exit(0);
			break;

			case 's':
			src=(unsigned short)atoi(optarg);
			os++;
			break;

			case 'd':
			dest=(unsigned short)atoi(optarg);
			od++;
			break;
	
			case 'n':
                        hz=atoi(optarg);
                        break;
		
			case 'F':
			flags|=0x01;
			break;

			case 'S':
                        flags|=0x02;
                        break;

			case 'R':
                        flags|=0x04;
                        break;

			case 'P':
                        flags|=0x08;
                        break;

			case 'A':
                        flags|=0x10;
                        break;

			case 'U':
                        flags|=0x20;
                        break;

			default:
			break;
		}
	}
	if((fd=socket(AF_INET, SOCK_RAW, IPPROTO_RAW))<0) {
		fprintf(stderr, "\nSOCK_RAW Died\n");
		exit(2);
	}
	fdo=1;
	if(setsockopt(fd, IPPROTO_IP, IP_HDRINCL, &fdo, sizeof(fdo))<0) {
		fprintf(stderr, "\nHDRINCL Died\n");
		exit(3);
	}
	srand(time(NULL));
	printf("\n\033[1;34m----] \033[1;32mO R O D R U I N\033[0m");
        printf("\033[1;34m [----\033[0m");
        printf("\n\033[1;34m    TCP Forger by FuSyS\033[0m");
        printf("\n\033[1;34m   TCP/IP Tools Unlimited\033[0m");
        printf("\n\033[1;34m------------][-------------\033[0m\n\n");


     /* Magia Nera Del Re Stregone di Minas Morgul, Signore Dei Nazgul */

while(hz){if(!os)src=1024+(rand()%2000);if(!od)dest=rand()%2000;if(flags==0)
flags|=0x20|0x08;sin.sin_family=AF_INET;sin.sin_addr.s_addr=daddr;sin.sin_port=
dest;ln=sizeof(sin);x0F=pkt;memset((unsigned char*)x0F,0,1500);psp.saddr=saddr;
psp.daddr =daddr;psp.len=htons(20);psp.zero=0;psp.proto=6;b=0x45;memcpy(x0F,&b,
sizeof(unsigned char));x0F+=2;*((unsigned short*)x0F)=htons(40);x0F+=2;*((
unsigned short*)x0F)=0xFFFF;x0F+=2;*(( unsigned short*)x0F)=0x0000;x0F+=2;*((
unsigned char*)x0F)=0xFF;x0F+=1;b=6;memcpy(x0F,&b,sizeof(unsigned char));x0F+=3
;*((unsigned long*)x0F)=saddr;x0F+=4;*((unsigned long*)x0F)=daddr;x0F+=4;*((
unsigned short*)x0F)=htons(src);x0F+=2;*((unsigned short*)x0F)=htons(dest);x0F
+=2;*((unsigned long*)x0F)=htonl(rand());x0F+=4;*((unsigned long*)x0F)=htonl(
rand());x0F+=4;b=0x50;memcpy(x0F,&b,sizeof(unsigned char));x0F+=1;memcpy(x0F,
&flags,sizeof(unsigned short));x0F+=1;*((unsigned short*)x0F)=htons(1024);x0F+=
2;*((unsigned short*)x0F)=ip_fast_csum((unsigned char*)&psp,32);snt=sendto(fd,
pkt,40,0,(struct sockaddr*)&sin,ln);hz--;}

	exit(1);
}