/*

* Contributed by:

* Brandon Hutcheson, Graeme Neilson and Ryan Ko

*

*/

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#include <unistd.h>

#include <sys/types.h>

#include <sys/time.h>

#include <sys/resource.h>

#include <sys/wait.h>

#include <time.h>

#include <pcap.h>

#include <netinet/in.h>

#include <sys/select.h>

#include "thc-ipv6.h"

#define COUNT_FLAG 11

#define COUNT_BYTE 4

#define COUNT_WORD 16

#define COUNT_XOR 2

#define COUNT_EXTEND 256

#define COUNT_DWORD 256

#define NEVER 2000000000

#define TEST_MAX (NEVER - 1)

#define DO_SOL 1

#define DO_REQ 2

#define DO_CON 3

#define DO_REN 4

#define DO_REB 5

#define DO_DEC 6

#define DO_REL 7

#define DO_INF 8

#define STATELESS 0

#define STATEFULL 1

/*

* Fuzzing data types:

* F = flags = 1 byte = 8 bits | flags | 8 ; 256

* B = byte = 1 byte | 0 1 254 255 xor XOR | 6 ; 256

* X = byte = 1 byte | all values from 0 to 255

* W = word = 2 bytes | 0,1,254,255^2 xor XOR | 18 ; 65536

* D = double word = 4 bytes | {0,1,254,255}^4 xor XOR | 258 ; 4294967295

* . = byte = ignore, jump over

*

*/

char fuzztype_ether[] = ".............."; //14 byte header

char fuzztype_ip6[] = "........................................"; //40 byte header

char fuzztype_udp[] = "........"; //8 byte header

char fuzztype_dhcp6[] = "X..."; //4 byte header (fuzz message type)

char fuzztype_dhcp6no[] = "...."; //4 byte header (don't fuzz message type)

//OPTION HEADERS

char fuzztype_elapsed_time[] = "WWW"; //6 byte header

char fuzztype_client_identifier[] = "WWWWDWWW"; //18 byte header

char fuzztype_server_identifier[] = "WWWWDWWW"; //18 byte header

char fuzztype_IA_NA[] = "WWDDD"; //16 byte header

char fuzztype_IA_Address[] = "WWXX..............DD";

char fuzztype_FQDN[] = "WWF"; //5 byte header + length of domain string to be added in programatically

char fuzztype_option_request[] = "WWW"; //6 byte header (add extra W for each additional option)

// //Matched solicit from RF manual

// char fuzztype_solicit[] = ".......FFFFFFFFF................BBBXXXX";

// //Still have to add in other types.

// char fuzztype_tran_id[] = "XF..WXBXX..............XX..............";

// char fuzztype_options[] = "........................................";

unsigned char flags[] = { 0, 1, 2, 4, 8, 16, 32, 64, 128, 254, 255 }; // 11

unsigned char bytes[] = { 0, 1, 254, 255 }; // 4

unsigned short int words[] = { 0x0000, 0x0001, 0x00fe, 0x00ff, 0x0100, 0x0101,

0x01fe, 0x01ff, 0xfe00, 0xfe01, 0xfefe, 0xfeff, 0xff00, 0xff01, 0xfffe,

0xffff

}; // 16

unsigned int xors[] = { 0, 0xffffffff }; // 2

unsigned char extends[] = { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,

15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33,

34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52,

53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71,

72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90,

91, 92, 93, 94, 95, 96, 97, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107,

108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122,

123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137,

138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149, 150, 151, 152,

153, 154, 155, 156, 157, 158, 159, 160, 161, 162, 163, 164, 165, 166, 167,

168, 169, 170, 171, 172, 173, 174, 175, 176, 177, 178, 179, 180, 181, 182,

183, 184, 185, 186, 187, 188, 189, 190, 191, 192, 193, 194, 195, 196, 197,

198, 199, 200, 201, 202, 203, 204, 205, 206, 207, 208, 209, 210, 211, 212,

213, 214, 215, 216, 217, 218, 219, 220, 221, 222, 223, 224, 225, 226, 227,

228, 229, 230, 231, 232, 233, 234, 235, 236, 237, 238, 239, 240, 241, 242,

243, 244, 245, 246, 247, 248, 249, 250, 251, 252, 253, 254, 255

}; // 256

unsigned int dwords[] = { 0x00000000, 0x00000001, 0x000000fe, 0x000000ff,

0x00000100, 0x00000101, 0x000001fe, 0x000001ff,

0x0000fe00, 0x0000fe01, 0x0000fefe, 0x0000feff,

0x0000ff00, 0x0000ff01, 0x0000fffe, 0x0000ffff,

0x00010000, 0x00010001, 0x000100fe, 0x000100ff,

0x00010100, 0x00010101, 0x000101fe, 0x000101ff,

0x0001fe00, 0x0001fe01, 0x0001fefe, 0x0001feff,

0x0001ff00, 0x0001ff01, 0x0001fffe, 0x0001ffff,

0x00fe0000, 0x00fe0001, 0x00fe00fe, 0x00fe00ff,

0x00fe0100, 0x00fe0101, 0x00fe01fe, 0x00fe01ff,

0x00fefe00, 0x00fefe01, 0x00fefefe, 0x00fefeff,

0x00feff00, 0x00feff01, 0x00fefffe, 0x00feffff,

0x00ff0000, 0x00ff0001, 0x00ff00fe, 0x00ff00ff,

0x00ff0100, 0x00ff0101, 0x00ff01fe, 0x00ff01ff,

0x00fffe00, 0x00fffe01, 0x00fffefe, 0x00fffeff,

0x00ffff00, 0x00ffff01, 0x00fffffe, 0x00ffffff,

0x01000000, 0x01000001, 0x010000fe, 0x010000ff,

0x01000100, 0x01000101, 0x010001fe, 0x010001ff,

0x0100fe00, 0x0100fe01, 0x0100fefe, 0x0100feff,

0x0100ff00, 0x0100ff01, 0x0100fffe, 0x0100ffff,

0x01010000, 0x01010001, 0x010100fe, 0x010100ff,

0x01010100, 0x01010101, 0x010101fe, 0x010101ff,

0x0101fe00, 0x0101fe01, 0x0101fefe, 0x0101feff,

0x0101ff00, 0x0101ff01, 0x0101fffe, 0x0101ffff,

0x01fe0000, 0x01fe0001, 0x01fe00fe, 0x01fe00ff,

0x01fe0100, 0x01fe0101, 0x01fe01fe, 0x01fe01ff,

0x01fefe00, 0x01fefe01, 0x01fefefe, 0x01fefeff,

0x01feff00, 0x01feff01, 0x01fefffe, 0x01feffff,

0x01ff0000, 0x01ff0001, 0x01ff00fe, 0x01ff00ff,

0x01ff0100, 0x01ff0101, 0x01ff01fe, 0x01ff01ff,

0x01fffe00, 0x01fffe01, 0x01fffefe, 0x01fffeff,

0x01ffff00, 0x01ffff01, 0x01fffffe, 0x01ffffff,

0xfe000000, 0xfe000001, 0xfe0000fe, 0xfe0000ff,

0xfe000100, 0xfe000101, 0xfe0001fe, 0xfe0001ff,

0xfe00fe00, 0xfe00fe01, 0xfe00fefe, 0xfe00feff,

0xfe00ff00, 0xfe00ff01, 0xfe00fffe, 0xfe00ffff,

0xfe010000, 0xfe010001, 0xfe0100fe, 0xfe0100ff,

0xfe010100, 0xfe010101, 0xfe0101fe, 0xfe0101ff,

0xfe01fe00, 0xfe01fe01, 0xfe01fefe, 0xfe01feff,

0xfe01ff00, 0xfe01ff01, 0xfe01fffe, 0xfe01ffff,

0xfefe0000, 0xfefe0001, 0xfefe00fe, 0xfefe00ff,

0xfefe0100, 0xfefe0101, 0xfefe01fe, 0xfefe01ff,

0xfefefe00, 0xfefefe01, 0xfefefefe, 0xfefefeff,

0xfefeff00, 0xfefeff01, 0xfefefffe, 0xfefeffff,

0xfeff0000, 0xfeff0001, 0xfeff00fe, 0xfeff00ff,

0xfeff0100, 0xfeff0101, 0xfeff01fe, 0xfeff01ff,

0xfefffe00, 0xfefffe01, 0xfefffefe, 0xfefffeff,

0xfeffff00, 0xfeffff01, 0xfefffffe, 0xfeffffff,

0xff000000, 0xff000001, 0xff0000fe, 0xff0000ff,

0xff000100, 0xff000101, 0xff0001fe, 0xff0001ff,

0xff00fe00, 0xff00fe01, 0xff00fefe, 0xff00feff,

0xff00ff00, 0xff00ff01, 0xff00fffe, 0xff00ffff,

0xff010000, 0xff010001, 0xff0100fe, 0xff0100ff,

0xff010100, 0xff010101, 0xff0101fe, 0xff0101ff,

0xff01fe00, 0xff01fe01, 0xff01fefe, 0xff01feff,

0xff01ff00, 0xff01ff01, 0xff01fffe, 0xff01ffff,

0xfffe0000, 0xfffe0001, 0xfffe00fe, 0xfffe00ff,

0xfffe0100, 0xfffe0101, 0xfffe01fe, 0xfffe01ff,

0xfffefe00, 0xfffefe01, 0xfffefefe, 0xfffefeff,

0xfffeff00, 0xfffeff01, 0xfffefffe, 0xfffeffff,

0xffff0000, 0xffff0001, 0xffff00fe, 0xffff00ff,

0xffff0100, 0xffff0101, 0xffff01fe, 0xffff01ff,

0xfffffe00, 0xfffffe01, 0xfffffefe, 0xfffffeff,

0xffffff00, 0xffffff01, 0xfffffffe, 0xffffffff

}; // 256

char solicit[] = { 0x01, 0x00, 0x00, 0x00, 0x00, 0x08, 0x00, 0x02, 0x00, 0x00,

0x00, 0x01, 0x00, 0x0e, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00,

0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03,

0x00, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,

0x00, 0x00, 0x00, 0x00

};

int port = -1;

void help(char *prg) {

printf("%s %s (c) 2014 by %s %s\n\n", prg, VERSION, "Brandon Hutcheson, Graeme Neilson and Ryan Ko", RESOURCE);

printf("Syntax: %s [-t number | -T number] [-e number | -T number] [-p number] [-md] [-1|-2|-3|-4|-5|-6|-7|-8] interface [domain-name]\n\n", prg);

printf("Fuzzes an DHCPv6 packet\n");

printf("Options:\n");

printf(" -1 fuzz DHCPv6 Solicit (default)\n");

printf(" -2 fuzz DHCPv6 Request\n");

printf(" -3 fuzz DHCPv6 Confirm\n");

printf(" -4 fuzz DHCPv6 Renew\n");

printf(" -5 fuzz DHCPv6 Rebind\n");

printf(" -6 fuzz DHCPv6 Release\n");

printf(" -7 fuzz DHCPv6 Decline\n");

printf(" -8 fuzz DHCPv6 Information Request\n");

printf(" -m fuzz the message type as well\n");

printf(" -t number continue from test no. number\n");

printf(" -e number continue to test no. number\n");

printf(" -T number only performs test no. number\n");

printf(" -n number how many times to send each packet (default: 1)\n");

printf(" -f spoof mac\n");

printf(" -F spoof link address\n");

printf(" -p number perform an alive check every number of tests (default: none)\n");

printf(" -d Use -d to force DNS updates, you can specify a domain name on the commandline.\n");

printf("You can only define one of -0 ... -4, defaults to -1.\n");

printf("Returns -1 on error, 0 on tests done and targt alive or 1 on target crash.\n");

exit(-1);

}

char dnsupdate1[] = { 0, 39, 0, 8, 1, 6, 122, 97, 97, 97, 97, 97 };

char dnsupdate2[] = { 0, 6, 0, 2, 0, 39 };

char dns_option_hdr[256];

int dns_option_hdr_len = 0;

char fuzzbuf[256];

char *interface = NULL, *dns_name = NULL, elapsed[6] = { 0, 8, 0, 2, 0, 0 };

int do_dns = 0, test_start = 0, test_end = TEST_MAX, ping = NEVER, no_send = 1, got_packet = 0;

pcap_t *p = NULL;

int do_type = DO_SOL, fuzz_msg_type = 0;

int timeout = 4;

void ignoreit(u_char *foo, const struct pcap_pkthdr *header, const unsigned char *data) {

return;

}

int try_send_pkt(char *interface, char *pkt, int *pkt_len) {

//Try send packet

int retry_send = 1;

time_t start_time = time(NULL);

while(time(NULL) - start_time < timeout && retry_send) {

if (thc_send_pkt(interface, pkt, pkt_len) < 0)

retry_send = 1;

else

retry_send = 0;

}

if (retry_send) {

fprintf(stderr, "Timeout error: Unable to send check alive packet within timeout\n");

exit(-1);

}

return 0;

}

int check_alive(pcap_t * p) {

int ret = -2, len, pkt_len = 0, i;

time_t t;

char wdatabuf[1024];

char *pkt = NULL;

unsigned char *dst = thc_resolve6("ff02::1:2");

unsigned char *mac6 = thc_get_own_mac(interface);

len = sizeof(solicit);

memcpy(wdatabuf, solicit, len);

// start0: 1-3 rand, 18-21 rand, 22-27 mac, 32-35 rand

for (i = 0; i < 3; i++) {

wdatabuf[i + 1] = rand() % 256;

wdatabuf[i + 18] = rand() % 256;

wdatabuf[i + 32] = rand() % 256;

}

memcpy(wdatabuf + 22, mac6, 6);

if ((pkt = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len, NULL, dst, 1, 0, 0, 0, 0)) == NULL) {

fprintf(stderr, "Error: Failed to create check allive ivp6 packet header\n");

exit(-1);

}

if (thc_add_udp(pkt, &pkt_len, 546, 547, 0, wdatabuf, len) < 0) {

fprintf(stderr, "Error: Failed to create check allive udp packet header\n");

exit(-1);

}

if (thc_generate_pkt(interface, mac6, NULL, pkt, &pkt_len) < 0) {

fprintf(stderr, "Error: Failed to create check allive packet header\n");

exit(-1);

}

// debug = 1;

//Empty packet capture queue

while (thc_pcap_check(p, (char *) ignoreit, NULL) > 0);

//Send initial solicit request

try_send_pkt(interface, pkt, &pkt_len);

//Check for response in loop and timeout if we don't get one

t = time(NULL);

while (ret < 0) {

//Got reply packet; server alive!

if (thc_pcap_check(p, (char *) ignoreit, NULL) > 0)

ret = 1;

//If we still haven't received a packet after 1 second resend the solicit

if (time(NULL) > t + 1 && ret == -2) {

if (thc_send_pkt(interface, pkt, &pkt_len) < 0) { //Don't want to use try_send_pkt as it could take longer than timeout

usleep(75);

thc_send_pkt(interface, pkt, &pkt_len); //Retry sending packet after short time if sending failed

}

ret = -1;

}

//Fail after 4 seconds

if (time(NULL) > t + timeout && ret < 0)

ret = 0;

}

if (ret == 0) {

fprintf(stderr, "Timeout: Failed to receive dhcp solicitation replay in check alive function within %d seconds\n", timeout);

}

// debug = 0;

thc_destroy_packet(pkt);

return ret > 0 ? 1 : 0;

}

int fuzz_loop(char* pkt, int* pkt_len) {

int do_fuzz = 1;

int test_pos = 0, test_ptr = 0, test_cnt = 0, test_current = 0;

int do_it;

int i;

unsigned short int *sip;

unsigned int *intp;

int fragment = 0, frag_offset = 0;

unsigned char *pkt_bak;

thc_ipv6_hdr *hdr = (thc_ipv6_hdr *) pkt;

// backup of generated packet

pkt_bak = malloc(hdr->pkt_len);

memcpy(pkt_bak, hdr->pkt, hdr->pkt_len);

printf("Fuzzing packet, starting at fuzz case %d, ending at fuzz case %d:\n", test_start, test_end);

printf("fuzzbuf(%d): %s\n", strlen(fuzzbuf), fuzzbuf);

while (do_fuzz) {

if (test_cnt == 0)

while (fuzzbuf[test_ptr] == '.') {

test_ptr++;

test_pos++;

}

if (fuzzbuf[test_ptr] == 0)

do_fuzz = 0;

test_cnt++;

do_it = 1;

switch (fuzzbuf[test_ptr]) {

case 0:

break;

case 'X':

if (test_cnt <= COUNT_EXTEND) {

if (pkt_bak[test_pos] != extends[test_cnt - 1])

hdr->pkt[test_pos] = extends[test_cnt - 1];

else

do_it = 0;

} else {

test_cnt = 0;

test_ptr++;

test_pos++;

}

break;

case 'B':

if (test_cnt <= COUNT_BYTE) {

if (pkt_bak[test_pos] != bytes[test_cnt - 1])

hdr->pkt[test_pos] = bytes[test_cnt - 1];

else

do_it = 0;

} else {

i = 0;

while (i < COUNT_BYTE && do_it) {

if (bytes[i] == pkt_bak[test_pos])

do_it = 0;

i++;

}

if (do_it)

hdr->pkt[test_pos] = hdr->pkt[test_pos] ^ xors[test_cnt - COUNT_BYTE - 1];

}

if (test_cnt == COUNT_BYTE + COUNT_XOR) {

test_cnt = 0;

test_ptr++;

test_pos++;

}

break;

case 'F':

if (test_cnt <= COUNT_FLAG) {

if (pkt_bak[test_pos] != flags[test_cnt - 1])

hdr->pkt[test_pos] = flags[test_cnt - 1];

else

do_it = 0;

} else {

i = 0;

while (i < COUNT_FLAG && do_it) {

if (bytes[i] == pkt_bak[test_pos]) // yes, bytes[] is the right one even for flags

do_it = 0;

i++;

}

if (do_it)

hdr->pkt[test_pos] = hdr->pkt[test_pos] ^ xors[test_cnt - COUNT_BYTE - 1];

}

if (test_cnt == COUNT_FLAG + COUNT_XOR) {

test_cnt = 0;

test_ptr++;

test_pos++;

}

break;

case 'W':

sip = (unsigned short int *) &pkt_bak[test_pos];

if (test_cnt <= COUNT_WORD) {

if (*sip != words[test_cnt - 1])

memcpy((char *) &hdr->pkt[test_pos], (char *) &words[test_cnt - 1], 2);

else

do_it = 0;

}

else {

i = 0;

while (i < COUNT_WORD && do_it) {

if (words[i] == *sip)

do_it = 0;

i++;

}

if (do_it) {

i = *sip ^ xors[test_cnt - COUNT_WORD - 1];

sip = (unsigned short int *) &hdr->pkt[test_pos];

*sip = i % 65536;

}

}

if (test_cnt == COUNT_WORD + COUNT_XOR) {

test_cnt = 0;

test_ptr++;

test_pos += 2;

}

break;

case 'D':

intp = (unsigned int *) &pkt_bak[test_pos];

if (test_cnt <= COUNT_DWORD) {

if (*intp != dwords[test_cnt - 1])

memcpy((char *) &hdr->pkt[test_pos], (char *) &dwords[test_cnt - 1], 4);

else

do_it = 0;

} else {

i = 0;

while (i < COUNT_DWORD && do_it) {

if (dwords[i] == *intp)

do_it = 0;

i++;

}

if (do_it) {

i = *intp ^ xors[test_cnt - COUNT_DWORD - 1];

intp = (unsigned int *) &hdr->pkt[test_pos];

*intp = (unsigned int) i;

// *intp = (unsigned int) (i % 4294967295);

}

}

if (test_cnt == COUNT_DWORD + COUNT_XOR) {

test_cnt = 0;

test_ptr++;

test_pos += 4;

}

break;

default:

fprintf(stderr, "This character should not be in the fuzz string, shoot the programmer: %c(%d) position %d string %s\n", fuzzbuf[test_ptr], fuzzbuf[test_ptr], test_ptr,

fuzzbuf);

return -1;

break;

}

if (do_it && do_fuzz) {

if (test_current >= test_start && test_current <= test_end && do_fuzz) {

printf("[%s] pos[%d]=%c -> %d | pkt[%d] | %d (%d=>%d)| \n", /*fuzzbuf*/"", test_ptr, fuzzbuf[test_ptr], test_cnt, test_pos, test_current, test_start, test_end);

// Generate new transaction id

int three_byte_test_current = test_current % 0x1000000;

memcpy(hdr->pkt + 63, (char *) &three_byte_test_current, 3);

// Regenerate UDP checksum

hdr->pkt[60] = 0;

hdr->pkt[61] = 0;

i = checksum_pseudo_header(hdr->original_src, hdr->final_dst, NXT_UDP, &hdr->pkt[54], hdr->pkt_len - 54);

hdr->pkt[60] = i / 256;

hdr->pkt[61] = i % 256;

// send packets

int k;

for (k = 0; k < no_send; k++) {

while(thc_send_pkt(interface, pkt, pkt_len) < 0)

usleep(1);

}

// printf(".");

usleep(250);

// TODO: Server up check

if ((test_current - test_start) % ping == 0 && test_current != 0 && test_start != test_current)

if (check_alive(p) == 0) {

i = ((((test_current - test_start) / ping) - 1) * ping) + test_start + 1;

printf("\nResult: target %s crashed during fuzzing, offending test case no. could be %d to %d\n", thc_ipv62notation(hdr->final_dst), i < 0 ? 0 : i, test_current);

exit(1);

}

}

// reset to basic packet

memcpy(hdr->pkt, pkt_bak, hdr->pkt_len);

test_current++;

}

}

return 0;

}

void construct_from_adv_and_fuzz(u_char *foo, const struct pcap_pkthdr *header, const unsigned char *data) {

int len = header->caplen, pkt_len = 0, mlen = 10, olen;

unsigned char *ptr = (unsigned char *) data, *pkt = NULL;

char *smac, mac[6] = { 0, 0x0d, 0, 0x0d, 0x0d, 0x0e };

char mybuf[1024] = { 0x03, 0, 0, 0, 0, 8, 0, 2, 0, 0 };

int done_dns = 0, i;

//Begin fuzz buffer

strcat(fuzzbuf, fuzztype_elapsed_time);

//Set message type

switch (do_type) {

case DO_REQ:

mybuf[0] = 0x03;

break;

case DO_CON:

mybuf[0] = 0x04;

break;

case DO_REN:

mybuf[0] = 0x05;

break;

case DO_REL:

mybuf[0] = 0x08;

break;

case DO_DEC:

mybuf[0] = 0x09;

break;

case DO_INF:

mybuf[0] = 0x0B;

break;

default:

fprintf(stderr, "Error: Unknown do type %d\n", do_type);

exit(-1);

break;

}

//Skip over header to dhcp header

if (do_hdr_size) {

data += do_hdr_size;

len -= do_hdr_size;

if ((data[0] & 240) != 0x60)

return;

} else {

data += 14;

len -= 14;

}

if (len < 126 || data[6] != NXT_UDP || data[48] != 2)

return;

data += 48;

len -= 48;

//Copy transaction id and skip to message options

memcpy(mybuf + 1, data + 1, 3);

data += 4;

len -= 4;

//Loop over options till reach end of header

while (len >= 4) {

//Set olen to the option length minus type and length fields and check for bogus packet

if ((olen = data[2] * 256 + data[3]) > len - 4 || olen < 0) { //the 4 here is the 4 bytes for the option type and option length fields

printf("Information: evil packet received\n");

olen = 0;

len = -1;

}

else {

//Copy server identifier or IA_NA to message

if (data[1] > 1 && data[1] <= 3 && !(data[1] == 2 && do_type == DO_CON) && !(data[1] == 3 && do_type == DO_INF)) { //skip copying server identifier for confirm or IA_NA for information request messages

memcpy(mybuf + mlen, data, olen + 4);

mlen += olen + 4;

//Append server identifier fuzzing

if (data[1] == 2)

strcat(fuzzbuf, fuzztype_server_identifier);

//Append IA_NA fuzzing + IA Address fuzzing

else if (data[1] == 3) {

strcat(fuzzbuf, fuzztype_IA_NA);

if (olen > 12)

strcat(fuzzbuf, fuzztype_IA_Address);

}

// printf("buf(%d): %s\n", strlen(fuzzbuf), fuzzbuf);

}

//Copy client identifier to message

else if (data[1] == 1) {

memcpy(mybuf + mlen, data, olen + 4);

mlen += olen + 4;

//smac auf client mac in paket setzen

if (olen == 14)

smac = (char *) (data + 12);

else

smac = mac;

//Append client identifier fuzzing

strcat(fuzzbuf, fuzztype_client_identifier);

// printf("buf(%d): %s\n", strlen(fuzzbuf), fuzzbuf);

}

//Copy dns option

else if (data[1] == 39 && do_dns) {

memcpy(mybuf + mlen, data, olen + 4);

mybuf[mlen + 4] = 1; // force server to write dns entry

mlen += olen + 4;

//Append dns fuzzing

strcat(fuzzbuf, fuzztype_FQDN);

for (i = 0; i < olen - 1; ++i)

strcat(fuzzbuf, "B"); //Fuzz the domain name string

strcat(fuzzbuf, fuzztype_option_request);

// printf("buf(%d): %s\n", strlen(fuzzbuf), fuzzbuf);

//Make sure we don't add dns twice

done_dns = 1;

}

data += olen + 4;

len -= olen + 4;

if (len < 0) {

printf("Information: evil packet received\n");

len = -1;

}

}

}

//Add saved dns option onto this packet

if (do_dns && !done_dns) {

memcpy(mybuf + mlen, dns_option_hdr, dns_option_hdr_len);

mlen += dns_option_hdr_len;

//Append dns fuzzing

olen = dns_option_hdr[2] * 256 + dns_option_hdr[3];

strcat(fuzzbuf, fuzztype_FQDN);

for (i = 0; i < olen - 1; ++i)

strcat(fuzzbuf, "B"); //Fuzz the domain name string

strcat(fuzzbuf, fuzztype_option_request);

// printf("buf(%d): %s\n", strlen(fuzzbuf), fuzzbuf);

}

//Build and send fuzzed message packets

if (len >= 0) {

unsigned char* dst = thc_resolve6("ff02::1:2");

if ((pkt = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len, ptr + 38, dst, 1, 0, 0, 0, 0)) == NULL) {

fprintf(stderr, "Error: Couldn't create dhcp requests ipv6 header\n");

exit(-1);

}

if (thc_add_udp(pkt, &pkt_len, 546, 547, 0, mybuf, mlen) < 0) {

fprintf(stderr, "Error: Couldn't create dhcp requests udp header\n");

exit(-1);

}

if (thc_generate_pkt(interface, smac, ptr + 6, pkt, &pkt_len) < 0) {

fprintf(stderr, "Error: Couldn't create dhcp requests ethernet header\n");

exit(-1);

}

if (fuzz_loop(pkt, &pkt_len) < 0) {

fprintf(stderr, "Error: Fuzzing request packet failed\n");

exit(-1);

}

else {

got_packet = 1; //Used to suppress timeout error

}

pkt = thc_destroy_packet(pkt);

}

//Truncate the fuzz buffer back to it's original length

fuzzbuf[66] = 0;

// printf("Trunc fuzzbuf: %s\n", fuzzbuf);

}

int main(int argc, char *argv[]) {

char mac[6] = { 0, 0x0c, 0, 0, 0, 0 }, *pkt = NULL;

// defines mac as 6 pieces and defines pkt as null.

char wdatabuf[1024];

//builds data buffer and sets memory size at 1024mb

unsigned char *mac6 = mac, *src, *dst;

//creates mac6 address usuing

int i, s, len, pkt_len = 0, dlen = 0;

int do_all = 1, use_real_mac = 1, use_real_link = 1;

int state;

if (argc < 2 || strncmp(argv[1], "-h", 2) == 0)

help(argv[0]);

if (getenv("THC_IPV6_PPPOE") != NULL || getenv("THC_IPV6_6IN4") != NULL) printf("WARNING: %s is not working with injection!\n", argv[0]);

//Parse options

while ((i = getopt(argc, argv, "123456789mn:t:e:T:dFp:fr")) >= 0) {

switch (i) {

case '1':

do_type = DO_SOL;

break;

case '2':

do_type = DO_REQ;

break;

case '3':

do_type = DO_CON;

break;

case '4':

do_type = DO_REN;

break;

case '5':

do_type = DO_REB;

break;

case '6':

do_type = DO_REL;

break;

case '7':

do_type = DO_DEC;

break;

case '8':

do_type = DO_INF;

break;

case 'm':

fuzz_msg_type = 1;

break;

case 'n':

no_send = atoi(optarg);

break;

case 't':

test_start = atoi(optarg);

break;

case 'e':

test_end = atoi(optarg);

break;

case 'T':

test_end = test_start = atoi(optarg);

break;

case 'F':

use_real_link = 0; // no break

case 'f':

use_real_mac = 0;

break;

case 'p':

ping = atoi(optarg);

break;

case 'd':

do_dns = 1;

break;

case 'r':

i = 0;

break; // just to ignore -r

default:

fprintf(stderr, "Error: unknown option -%c\n", i);

exit(-1);

}

}

//Check options

if (no_send < 1) {

fprintf(stderr, "ERROR: -n number must be between one and 2 billion\n");

exit(-1);

}

if (test_end < test_start) {

printf("don't fuck up the command line options!\n");

exit(-1);

}

memset(mac, 0, sizeof(mac));

interface = argv[optind];

dns_name = argv[optind + 1];

if (use_real_link)

src = thc_get_own_ipv6(interface, NULL, PREFER_LINK);

else

src = thc_resolve6("fe80::");

if (use_real_mac) {

mac6 = thc_get_own_mac(interface);

memcpy(mac, mac6, sizeof(mac));

}

dst = thc_resolve6("ff02::1:2");

setvbuf(stdout, NULL, _IONBF, 0);

setvbuf(stderr, NULL, _IONBF, 0);

// only to prevent our system to send icmp port unreachable messages

if ((s = thc_bind_udp_port(546)) < 0)

fprintf(stderr, "Warning: could not bind to 546/udp\n");

if ((p = thc_pcap_init_promisc(interface, "ip6 and udp and dst port 546")) == NULL) {

fprintf(stderr, "Error: can not open interface %s in promisc mode\n", interface);

exit(-1);

}

//Establish state

if (do_type == DO_SOL || do_type == DO_REB)

state = STATELESS;

else

state = STATEFULL;

// generate full fuzz mask for stateless types and partial for statefull types

strcpy(fuzzbuf, fuzztype_ether);

strcat(fuzzbuf, fuzztype_ip6);

strcat(fuzzbuf, fuzztype_udp);

if (fuzz_msg_type)

strcat(fuzzbuf, fuzztype_dhcp6);

else

strcat(fuzzbuf, fuzztype_dhcp6no);

if (state == STATELESS) {

strcat(fuzzbuf, fuzztype_elapsed_time);

strcat(fuzzbuf, fuzztype_client_identifier);

strcat(fuzzbuf, fuzztype_IA_NA);

if (do_dns)

strcat(fuzzbuf, fuzztype_FQDN);

}

/** Generate packet **/

len = sizeof(solicit);

memcpy(wdatabuf, solicit, len);

//Add dns option

if (do_dns) {

memcpy(wdatabuf + len, dnsupdate1, sizeof(dnsupdate1));

memcpy(dns_option_hdr + dns_option_hdr_len, dnsupdate1, sizeof(dnsupdate1));

dlen = len + 8;

len += sizeof(dnsupdate1);

dns_option_hdr_len += sizeof(dnsupdate1);

//Append domain string prefix fuzz mask

if (state == STATELESS) { //<-- Do fuzzbuffer later

for (i = 0; i < 7; ++i) //7 == Length of hard coded domain prefix

strcat(fuzzbuf, "B");

}

if (dns_name != NULL && strlen(dns_name) < 240) {

if (dns_name[0] != '.') {

wdatabuf[len] = '.';

wdatabuf[dlen - 5]++;

wdatabuf[dlen - 3]++;

len++;

}

memcpy(wdatabuf + len, dns_name, strlen(dns_name) + 1);

memcpy(dns_option_hdr + dns_option_hdr_len, dns_name, strlen(dns_name) + 1);

wdatabuf[dlen - 5] += strlen(dns_name) + 1;

wdatabuf[dlen - 3] += strlen(dns_name) + 1;

len += strlen(dns_name) + 1;

dns_option_hdr_len += strlen(dns_name) + 1;

//Append variable length domain string suffix fuzz mask

if (state == STATELESS) {

for (i = 0; i < strlen(dns_name) + 1; ++i)

strcat(fuzzbuf, "B");

}

}

memcpy(wdatabuf + len, dnsupdate2, sizeof(dnsupdate2));

memcpy(dns_option_hdr + dns_option_hdr_len, dnsupdate2, sizeof(dnsupdate2));

len += sizeof(dnsupdate2);

dns_option_hdr_len += sizeof(dnsupdate2);

//Append option request (FQDN request) fuzz mask

if (state == STATELESS){

strcat(fuzzbuf, fuzztype_option_request);

}

}

//Set message type

if (state == STATELESS) {

switch (do_type) {

case DO_SOL:

wdatabuf[0] = 0x01;

break;

case DO_REB:

wdatabuf[0] = 0x06;

break;

default:

break;

}

}

//random src mac

if (!use_real_link)

for (i = 0; i < 8; i++)

src[i + 8] = rand() % 256;

// start0: 1-3 rand, 18-21 rand, 22-27 mac, 32-35 rand

for (i = 0; i < 3; i++) {

wdatabuf[i + 1] = rand() % 256;

wdatabuf[i + 18] = rand() % 256;

wdatabuf[i + 32] = rand() % 256;

if (!use_real_mac) {

mac[i * 2] = rand() % 256;

mac[i * 2 + 1] = rand() % 256;

}

if (do_dns)

wdatabuf[i + dlen] = 'a' + rand() % 26;

}

memcpy(wdatabuf + 22, mac, 6);

if ((pkt = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len, src, dst, 1, 0, 0, 0, 0)) == NULL)

return -1;

if (thc_add_udp(pkt, &pkt_len, 546, 547, 0, wdatabuf, len) < 0)

return -1;

if (thc_generate_pkt(interface, mac6, NULL, pkt, &pkt_len) < 0)

return -1;

//Fuzz solicit packet

if (state == STATELESS) {

if (fuzz_loop(pkt, &pkt_len) < 0)

return -1;

}

//Fuzz request, confirm or renew paket

else if (state == STATEFULL) {

//Send a dhcp solicit to discover dhcpv6 servers

if (thc_send_pkt(interface, pkt, &pkt_len) < 0) {

fprintf(stderr, "Error: Failed to send initial solicit packet\n");

return -1;

}

usleep(75); //<-- I don't really know why this is neccessary but it seems to be

//Construct and fuzz packets using server identifier

got_packet = 0;

time_t start_time = time(NULL);

while(time(NULL) - start_time < timeout) {

while (thc_pcap_check(p, (char *) construct_from_adv_and_fuzz, NULL) > 0); //got_packet set in callback function

if (got_packet)

break;

}

if (!got_packet)

fprintf(stderr, "Timeout: Didn't receive solicited advertisement packet within timeout. Is server down?\n");

}

pkt = thc_destroy_packet(pkt);

// printf("fuzzbuf: %s\n", fuzzbuf);

return 0;

}