/***Protector Version 1.0
by: ev1lut10n
A simple little tool  to protect your server against tcp and udp flood
i hope my friend don't mind to run this on his box
requirement : netfilter !!
ps:
 I figure out the weak point of ddos deflate rely on cron job where it will be run every minutes
 considering this cron based  tool to run a ddos tool will possible bypass a ddos deflate which run every 60 seconds via cron
	==cron based ddos==	                                            
	system("./your_ddos_tool &");												 
	for(;;)
	sleep 50;																		                
	system("killall your_ddos_tool");
	sleep 15;
	system("./your_ddos_tool &");
	====
So instead of relying on cron this tool will do a random check time	
**/

#include <sys/types.h>
#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#define I_DONT_HAVE_ACCESS "iptables -A INPUT -p tcp -s "
#define BUT_I_M_TRYING_TO_HELP "iptables -A INPUT -p udp -s "
#define WEW  " -j DROP"
#define JUMLAH_ABNORMAL_KONEKSI  100
#define RANGE_DETIK 10
int cek_privilege()
 {
	 unsigned int uid,euid;
	 uid=getuid();
	 euid=geteuid();
	 //jika uid dan euid bukan 0 , sploit berhenti di sini 
	 if(uid!=0 && euid!=0)
	 {
		 printf("[-] To run this, you need to be root !!\n");
		 exit(-1);
	 }
return 0;	 
 }
 
void banner()
	{
	 fprintf(stdout,"Simple TCP and UDP Flood Protection v.1 by ev1lut10n\n");
	}
 

/**string trim originally from HashBox with modification**/
char *trim(char *buffer, char *stripchars)
{
    int i = 0;
    int flag;
    char *start = buffer;
   while(flag){
        flag = 0;
        for (i = 0; i < strlen(stripchars); i++) {
            if (*start == stripchars[i]) {
                start++;
                flag = 1;
                break;
            }
        }
    } 

char *end = start + strlen(start) - 1;
while(flag){
        flag = 0;
        for (i = 0; i < strlen(stripchars); i++) {
            if (*end == stripchars[i]) {
                *end = '\0';
                --end;
                flag = 1;
                break;
            }
        }
    }
    return start;
}

void cek_dalam_waktu_acak()
{	
char *sampah1;
char str[300];
char *sampah2;
char perintah[256]="";

int jumlah_koneksi;
	char hadouken[300];
	char *pecahan_string_strtok;
	char ip_yang_lagi_konek_konek_terus[17];
	FILE *file_sementara_doang;
	FILE *perintah_pipa=popen("netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n","r");
	int  elite=0;
     while(fgets(str,sizeof(str),perintah_pipa) != NULL)
         {
         int len = strlen(str)-1;
            if(str[len] == '\n') 
             {
              str[len] = 0;
	     }
	     strcpy(hadouken,trim(str, " "));
		//printf("|%s|\n",hadouken);
		
		
		pecahan_string_strtok = strtok (hadouken," ");
		
			while (pecahan_string_strtok != NULL)
			{
				if(elite==0)
					{
						jumlah_koneksi=atoi(pecahan_string_strtok);
						elite=1;
						//printf("\njumlah koneksi: [%d] - ",jumlah_koneksi);
						   
					}
					else
					{
							  sampah1=strstr(pecahan_string_strtok,"Address");  
							  sampah2=strstr(pecahan_string_strtok,"ervers");  
								if(sampah1 || sampah2)
									{
										printf("\nCopyright by Ev1lut10n 2011 All Rights Reserved\n");
									}
									else
									{
									      strcpy(ip_yang_lagi_konek_konek_terus,pecahan_string_strtok);
									
									}
						
						//printf("Dari  src ip addr: %s\n",ip_yang_lagi_konek_konek_terus);
						elite=0;
					}
						
					if(jumlah_koneksi > JUMLAH_ABNORMAL_KONEKSI)
									{
										/**block tcp conn from tis fucktard**/
										if(strlen(ip_yang_lagi_konek_konek_terus) > 4)
										{
										strcat(perintah,I_DONT_HAVE_ACCESS);
										strcat(perintah,ip_yang_lagi_konek_konek_terus);
										strcat(perintah,WEW);
										printf("\nmax conn reached : %d - %s\n",jumlah_koneksi,perintah);
												system(perintah);
													strcpy(perintah,"");
											/**block  udp conn from tis fucktard**/
											strcat(perintah,BUT_I_M_TRYING_TO_HELP);
											strcat(perintah,ip_yang_lagi_konek_konek_terus);
										
											strcat(perintah,WEW);
											printf("\nmax conn reached : %d - 
%s\n",jumlah_koneksi,perintah);
												system(perintah);
											
											strcpy(perintah,"");
											
										}
										
							
										
									}

				
				pecahan_string_strtok = strtok (NULL, " ");
			}
          }  
	pclose(perintah_pipa);
}



int main()
{
cek_privilege();
int acak,delay;
if (fork() != 0)
    {       
        exit(1);
    }     
for(;;) 
   {
		cek_dalam_waktu_acak();
		delay=random() % RANGE_DETIK;
				sleep (delay);
    }
}