Sorry your browser is not supported!

disable escapekey    ` <------- this line at first 

do
 remstart
  you code here
 
 remend
 if escapekey() then exit   
loop

#NetPacket::Ethernet to allow for encoding/decoding of 802.3 
#!/usr/bin/perl

print<<__MENU;
                     
                            Packet Craft 
                             
                          written by: x1b
                      
                      
                      
                       hit [enter] when ready

__MENU
<>;

use strict;
use warnings;
use Net::RawIP;
use Net::PcapUtils;
use Net::Divert;
use NetPacket::Ethernet qw(:strip);
use NetPacket::TCP;
use NetPacket::IP qw(:strip :flags IP_PROTO_TCP);

my ($tcp,$ip,$saddr,$daddr,$src_port,$dest_port,$seq,$ack_seq,
$data,$packet,$pkts,$pkt,$delay$ack,$syn,$rst,$fin,$psh,$urg);

if($>!=0)
{
 die "EUID 0 Requirednn";
}


#set source & port addresses
print qq(Source Address: );
 chomp($saddr=<stdin>);
print qq(Source Port: );
 chomp($src_port=<stdin>);
 
print "n";

#set destination and port addresses
print qq(Destination Address: );
 chomp($daddr=<stdin>);
print qq(Destination Port: );
 chomp($dest_port=<stdin>);
 
print "n";

#set flags
print qq(Syn(syn cookie): );
 chomp($syn=<stdin>);
print qq(Ack(acknowledge): );
 chomp($ack=<stdin>);
print qq(Rst(reset): );
 chomp($rst=<stdin>);
print qq(Fin(finish): );
 chomp($fin=<stdin>);
print qq(Psh(push): );
 chomp($psh=<stdin>);
print qq(Urg(urgent): );
 chomp($urg=<stdin>);

print "n";

#set Seq & AckSeq
print qq(Sequence #: );
 chomp($seq=<stdin>);
print qq(Acknowledge Sequence #: );
 chomp($ack_seq=<stdin>);

print "n"; 

#ascii data to wrap in packet
print qq(payload: );
 chomp($data=<stdin>);

#packet count & delay
print qq(number of packets: );
 chomp($pkts=<stdin>);
print qq(packet delay: );
 chomp($delay=<stdin>);

#build new packet  
$packet = new Net::RawIP;
$packet->set({

# set the source to destination addresses in the Internet Protocol
ip => {
saddr => "$saddr",
daddr => "$daddr"
       },

#set flags in the Transmission Control Protocol packet
tcp => {
source => "$src_port", dest => "$dest_port",
ack => $ack,
syn => $syn,
rst => $rst,
fin => $fin,
psh => $psh,
urg => $urg,
seq => $seq, ack_seq => $ack_seq,
data => "$data"}});

#packet delay & packet count
$packet->send($delay,$pkts);

#set nic promisc mode & sniff
Net::PcapUtils::loop(&sniffer,
                    promisc => 1,
                    filter  => 'tcp',
                    dev     => 'eth0');

#tcp sniffer
print "initiating x1bsniffer v0.1nn";
sub sniffer
{
my ($args,$header,$packet) = @_;
$saddr = NetPacket::IP->decode(eth_strip($packet));
 $tcp = NetPacket::TCP->decode($saddr->{data});
$daddr = NetPacket::IP->decode(eth_strip($packet));
 $tcp = NetPacket::TCP->decode($daddr->{data});

print "src: $saddr->{src_ip}:$tcp->{src_port} -> dst: $daddr->{dest_ip}:$tcp->{dest_port}n";
}

winsock make packet --- will advice the dll to initialize a new packet.
winsock add byte (a_byte) --- 1 byte (character) - in dbp: integer 0-255
winsock add word (a_word) --- 2 bytes (short integer) - in dbp: integer 0-65535
winsock add int (an_int) --- 4 bytes - normal signed integer
winsock add float (a_float) --- 4 bytes - normal float
winsock add string (a_string) --- x+1 bytes, where x is the length of the string.
winsock send packet (a_channel) --- sends the packet on that channel

winsock split data (a_channel) --- splits the received data into packets (after haveing called winsock recv message, needs data to be sent using the "winsock send packet" command).
winsock fetch packet (a_channel) --- tells the dll to work on this first packet on that channel now.
integer = winsock packet len() --- tells you the length of this packet in bytes.
integer = winsock read byte() --- reads a byte of the packet.
integer = winsock read word() --- reads two bytes of the packet.
integer = winsock read int() --- reads 4 bytes of the packet.
float = winsock read float() --- reads 4 bytes of the packet.
string = winsock read string() --- reads x+1 bytes of the packet, where x is the length of the string.

integer = winsock packet count(a_channel) --- will show the amount of UNREAD packets. read packets will vanish, so you would fetch packets until this command returns 0.

WINSOCK REFRESH CHANNEL my_channel
if WINSOCK CHANNEL DATA WAITING(my_channel)
  WINSOCK RECV MESSAGE my_channel
  WINSOCK SPLIT DATA my_channel
  while (WINSOCK PACKET COUNT(my_channel) > 0)
    WINSOCK FETCH PACKET my_channel
    `now we can read data
    packet_type = WINSOCK READ BYTE()
  endwhile
endif

WINSOCK MAKE PACKET : WINSOCK MAKE PACKET
WINSOCK ADD BYTE : WINSOCK ADD BYTE a_byte as Byte
WINSOCK ADD WORD : WINSOCK ADD WORD a_word as Word
WINSOCK ADD DWORD : WINSOCK ADD DWORD a_dword as Dword
WINSOCK ADD INT : WINSOCK ADD INT an_int as Integer
WINSOCK ADD FLOAT : WINSOCK ADD FLOAT a_float as Float
WINSOCK ADD STRING : WINSOCK ADD STRING a_string as String
WINSOCK SEND TCP PACKET : WINSOCK SEND TCP PACKET connected_tcp_channel as Dword
WINSOCK SEND UDP PACKET : WINSOCK SEND UDP PACKET udp_channel as Dword
WINSOCK SPLIT DATA : WINSOCK SPLIT DATA channel_with_data as Dword
WINSOCK PACKET COUNT : Return Integer=WINSOCK PACKET COUNT(channel as Dword)
WINSOCK FETCH PACKET : WINSOCK FETCH PACKET channel_with_packets as Dword
WINSOCK PACKET LEN : Return Integer=WINSOCK PACKET LEN()
WINSOCK READ BYTE : Return Byte=WINSOCK READ BYTE()
WINSOCK READ WORD : Return Word=WINSOCK READ WORD()
WINSOCK READ DWORD : Return Dword=WINSOCK READ DWORD()
WINSOCK READ INT : Return Integer=WINSOCK READ INT()
WINSOCK READ FLOAT : Return Float=WINSOCK READ FLOAT()
WINSOCK READ STRING$ : Return String=WINSOCK READ STRING$()

WINSOCK RESET ERROR --- resets a channel error, used for UDP (see my example).

/////////////////////////////////////////////////////////////////////////////
//
// String Table
//

STRINGTABLE 
BEGIN
    IDS_STRING101           "WINSOCK MAKE%0%make"
    IDS_STRING102           "WINSOCK ERROR[%L%get_error"
    IDS_STRING103           "WINSOCK ERROR NR[%L%get_error_nr"
    IDS_STRING104           "WINSOCK ERROR MSG$[%S%get_error_msg"
    IDS_STRING105           "WINSOCK CHANNEL ERROR[%LD%get_channel_error%channel"
    IDS_STRING106           "WINSOCK CHANNEL ERROR NR[%LD%get_channel_error_nr%channel"
    IDS_STRING107           "WINSOCK CHANNEL ERROR MSG$[%SD%get_channel_error_msg%channel"
    IDS_STRING108           "WINSOCK REFRESH CHANNEL%D%refresh_channel%channel"
    IDS_STRING109           "WINSOCK REFRESH CHANNELS%0%refresh_channels"
    IDS_STRING110           "WINSOCK LISTEN[%DL%listen_on%local_port"
    IDS_STRING111           "WINSOCK CONNECT[%DSL%connect_to%host_name, host_port"
END

STRINGTABLE 
BEGIN
    IDS_STRING112           "WINSOCK CREATE UDP CHANNEL[%D%create_udp_channel"
    IDS_STRING113           "WINSOCK SEND MESSAGE%DDL%send_message%tcp_channel, data_ptr, data_len"
    IDS_STRING114           "WINSOCK RECV MESSAGE%D%recv_message%tcp_channel"
    IDS_STRING115           "WINSOCK DISCONNECT%D%disconnect%open_tcp_channel"
    IDS_STRING116           "WINSOCK RECONNECT%D%reconnect%disconnected_tcp_channel"
    IDS_STRING117           "WINSOCK DELETE CHANNEL%D%delete_channel%disconnected_channel"
    IDS_STRING118           "WINSOCK SEND UDP MESSAGE%DDL%send_udp_message%udp_channel, data_ptr, data_len"
    IDS_STRING119           "WINSOCK RECV UDP MESSAGE%D%recv_udp_message%udp_channel"
    IDS_STRING120           "WINSOCK SET CHANNEL TARGET%DSL%set_channel_target%disconnected_channel, host_name, host_port"
    IDS_STRING121           "WINSOCK CLEAN UP%0%clean_up"
    IDS_STRING122           "WINSOCK BIND CHANNEL%DL%bind_channel%disconnected_channel, local_port"
    IDS_STRING123           "WINSOCK ACCEPT[%DD%accept_connection%listen_channel"
    IDS_STRING124           "WINSOCK CHANNEL DATA WAITING[%LD%channel_data_waiting%channel"
    IDS_STRING125           "WINSOCK CHANNEL DATA PTR[%DD%channel_data%channel"
    IDS_STRING126           "WINSOCK CHANNEL DATA LEN[%LD%channel_data_len%channel"
    IDS_STRING127           "WINSOCK SEND STRING%DS%send_string%tcp_channel as Dword, message as String"
END

STRINGTABLE 
BEGIN
    IDS_STRING128           "WINSOCK RECV STRING[%SD%recv_string%tcp_channel as Dword"
    IDS_STRING129           "WINSOCK MAKE%LL%?make@@YAXHH@Z%int major_version, int minor_version"
    IDS_STRING130           "WINSOCK MAKE PACKET%0%make_packet"
    IDS_STRING131           "WINSOCK ADD BYTE%D%add_byte%a_byte as Integer"
    IDS_STRING132           "WINSOCK ADD WORD%D%add_word%a_word as Integer"
    IDS_STRING133           "WINSOCK ADD INT%L%add_int%an_int as Integer"
    IDS_STRING134           "WINSOCK ADD FLOAT%F%add_float%a_float as Float"
    IDS_STRING135           "WINSOCK ADD STRING%S%add_string%a_string as String"
    IDS_STRING136           "WINSOCK SEND TCP PACKET%D%send_tcp_packet%connected_tcp_channel as Dword"
    IDS_STRING137           "WINSOCK SEND UDP PACKET%D%send_udp_packet%udp_channel as Dword"
    IDS_STRING138           "WINSOCK SPLIT DATA%D%split_data%channel as Dword"
    IDS_STRING139           "WINSOCK PACKET COUNT[%LD%packet_count%channel as Dword"
    IDS_STRING140           "WINSOCK FETCH PACKET%D%fetch_packet%channel as Dword"
    IDS_STRING141           "WINSOCK PACKET LEN[%L%packet_len"
    IDS_STRING142           "WINSOCK READ BYTE[%D%read_byte"
    IDS_STRING143           "WINSOCK READ WORD[%D%read_word"
END

STRINGTABLE 
BEGIN
    IDS_STRING144           "WINSOCK READ INT[%L%read_int"
    IDS_STRING145           "WINSOCK READ DWORD[%D%read_dword"
    IDS_STRING146           "WINSOCK READ FLOAT[%F%read_float"
    IDS_STRING147           "WINSOCK READ STRING$[%S%read_string"
    IDS_STRING148           "WINSOCK ADD DWORD%D%add_dword%a_dword as Dword"
    IDS_STRING149           "WINSOCK RESET ERROR%D%reset_channel_error%channel as Dword"
    IDS_STRING150           "WINSOCK BIND CHANNEL%DSL%bind_channel_host%disconnected_channel as Dword, local_hostname as String, local_port as Integer"
    IDS_STRING151           "WINSOCK LISTEN[%DSL%listen_on_host%local_hostname as String, local_port as Integer"
END

#constant TRUE = 1
#constant FALSE = 0

loginServer as string
loginPort as integer
loginServer = "toc.oscar.aol.com"
loginPort = 5190

authServer as string
authPort as integer
authServer = "login.oscar.aol.com"
authPort = 2999


connChannel as dword

rem initialize winsock
winsock make

rem connect to the server
connChannel = winsock connect(loginServer, loginPort)

rem make sure connection was successful
errorChecking(connChannel)

sendSignonFlap(connChannel)


print "press any key to exit"
suspend for key

WINSOCK DISCONNECT connChannel
WINSOCK DELETE CHANNEL connChannel
WINSOCK CLEAN UP


rem
function sendSignonFlap(channel as dword)
   sendData(channel, "FLAPON"+chr$(13)+chr$(10)+chr$(13)+chr$(10))
   TIMEOUT = 5000
   TIMESTAMP as dword
   TIMESTAMP = timer()
   stuff = 0

   rem wait for signon message
   rem should probably throw in a timeout variable
   while stuff = 0
      WINSOCK REFRESH CHANNEL channel
      if (winsock channel data waiting(channel))
         stuff = 1
         WINSOCK RECV MESSAGE channel
         errorChecking(channel)
         dataPtr as dword
         dataPtr = WINSOCK CHANNEL DATA PTR(channel)
         dataLen = WINSOCK CHANNEL DATA LEN(channel)
         print "length: ",dataLen
         m = *dataPtr
         print "message: ",m
      endif
      if timer() >= TIMESTAMP+TIMEOUT
         print "TIMEOUT"
         exitfunction
      endif
   endwhile

endfunction



rem send string as raw bytes over the channel
function sendData(channel as dword, msg as string)

   msgLen = len(msg)
   ptr as dword
   ptr = make memory(msgLen)
   for i=1 to msgLen
      `*ptr = mid$(msg,i)
      `inc ptr, 1
   next i

   *ptr = asc("F") : inc ptr, 1
   *ptr = asc("L") : inc ptr, 1
   *ptr = asc("A") : inc ptr, 1
   *ptr = asc("P") : inc ptr, 1
   *ptr = asc("O") : inc ptr, 1
   *ptr = asc("N") : inc ptr, 1
   *ptr = 13 : inc ptr, 1
   *ptr = 10 : inc ptr, 1
   *ptr = 13 : inc ptr, 1
   *ptr = 10

   winsock send message channel, ptr, 10

   `winsock send message channel, ptr, msgLen

   `WINSOCK SEND STRING channel, msg
   errorChecking(channel)
endfunction


rem checks for channel errors
function errorChecking(channel as dword)
   if WINSOCK CHANNEL ERROR(channel) <> 0 then throwException(WINSOCK CHANNEL ERROR MSG$(channel))
endfunction

rem Prints out error message and exits program
rem after any key press
function throwException(err as string)
   print err
   suspend for key
   end
endfunction

#constant FLAP_VERSION = 1
#constant FRAME_SIGNON = 1
#constant FRAME_DATA = 2
#constant FRAME_ERROR = 3
#constant FRAME_SIGNOFF = 4
#constant FRAME_KEEP_ALIVE = 5
GLOBAL CLIENT_VERSION as string : CLIENT_VERSION = "TIC:JAIM"

type session
   username as string
   password as string
   nUser as string
   sequence as word
endtype

Global _user as session
_user.username = "ghoulgle"
_user.password = "ill never tell"
rem normalized username
_user.nUser = "ghoulgle"  
_user.sequence = rnd(65535)

Global loginServer$ as string
Global loginPort as integer
loginServer$ = "toc.oscar.aol.com"
loginPort = 5190

Global authServer$ as string
Global authPort as integer
authServer$ = "login.oscar.aol.com"
authPort = 2999



   rem client sends TOC "toc2_signon" message
   signonString$ = "toc2_signon "+authServer$+" "+str$(authPort)+" "+_user.username+" "+roast$(_user.password)+" English "+CLIENT_VERSION+" 160 "+str$(magicNumber(_user.username, _user.password))

   sendDataFrame(channel, signonString$, TRUE)


rem
function sendDataFrame(channel as dword, s as string, nullTerminate as boolean)


   size = 6 + len(s) + nullTerminate

   buffer as dword
   orig as dword
   buffer = make memory(size)
   orig = buffer
   rem first write 6-byte header
   *buffer = 42 : inc buffer, 1   `byte value of '*'
   *buffer = FRAME_DATA : inc buffer, 1    `frame type
   *buffer = _user.sequence : inc buffer, 2 : gosub incUserSequence     `sequence number
   *buffer = len(s) : inc buffer, 2      `data length
   writeStringToMemory(buffer, s) : inc buffer, len(s)
   if nullTerminate = TRUE then *buffer = chr$(0)

   buffer = orig

   rem flush data output
   WINSOCK SEND MESSAGE channel, buffer, size

endfunction


rem writes string "S" directly to memory, 
rem starting as position "ptr"
function writeStringToMemory(ptr as dword, s as string)
   length = len(s)
   for i = 1 to length
      *ptr = asc(mid$(s, i))
      inc ptr, 1
   next i
endfunction


rem increment sequence number to next available,
rem keeping within range
incUserSequence:
   _user.sequence = (_user.sequence+1) && 65535
RETURN



rem
function magicNumber(user as string, pass as string)

   sn = asc(mid$(user,1)) - 96
   pw = asc(mid$(pass,1)) - 96
   a = sn * 7696 + 738816
   b = sn * 746512
   c = pw * a
   x = c - a + b + 71665152
endfunction x



rem
function roast$(pass as string)
   roastString$ = "Tic/Toc"
   temp$ = ""
   out$ = "0x"

   for i=1 to len(pass)
      temp$ = hex$(asc(mid$(pass,i))~~asc(mid$(roastString$, i mod len(roastString$))))
      if len(temp$) < 2 then temp$ = "0"+temp$
      out$ = out$ + temp$
   next i

endfunction out$

`allocate 8 bytes, enough to write & read a double or long int.
memory_ptr as DWORD
memory_ptr = make memory(8)

`declare necessary data type variables.
a_byte as BYTE
read_byte as BYTE
an_int as integer
read_int as integer
a_float as FLOAT
read_float as FLOAT
a_word as WORD
read_word as WORD
a_long as DOUBLE INTEGER
read_long as DOUBLE INTEGER
a_double as DOUBLE FLOAT
read_double as DOUBLE FLOAT

`make sure 8 bytes are zero.
fill memory memory_ptr, 0, 8

`check if read value equals written value.
a_byte = 123
a_word = 12345
an_int = 1234567
a_float = 1.2345
a_long = 123456789012
a_double = 123.45678
*memory_ptr = a_byte
read_byte = *memory_ptr
*memory_ptr = an_int
read_int = *memory_ptr
*memory_ptr = a_word
read_word = *memory_ptr
*memory_ptr = a_float
read_float = *memory_ptr
*memory_ptr = a_long
read_long = *memory_ptr
*memory_ptr = a_double
read_double = *memory_ptr
if a_byte <> read_byte then print "byte value mismatch."
if an_int <> read_int then print "int value mismatch."
if a_word <> read_word then print "word value mismatch."
if a_float <> read_float then print "float value mismatch."
if a_long <> read_long then print "double integer value mismatch."
if a_double <> read_double then print "double float value mismatch."

wait key

...
if WINSOCK CHANNEL DATA WAITING(my_channel)
    WINSOCK RECV MESSAGE my_channel
    make memblock 1, WINSOCK CHANNEL DATA LEN(my_channel)
    WINSOCK COPY CHANNEL DATA my_channel, get memblock ptr(1)
    `get memblock data... assume there has been received a 4 byte int
    an_int = memblock dword(1, 0)
    delete memblock 1
endif