Pasted

#Features
# Fast catch-save reflectors. (Less than 0.05s).
# Chargen, NTP, SSDP, SNMP, DNS, LDAP, MEMCACHED, TFTP, PortMap supported.
# Anti-Duplication feature.
# Filter bytes of each packet.
# Custom output syntax support.
# Lightweight.
#Installation
#wget -O xstealer.py https://github.com/Alemalakra/xStealer/raw/master/xstealer.py && chmod 777 xstealer.py
#
#Usage
#[!] xStealer 1.0 by Alemalakra.
#[!] Usage: python xstealer.py <OUTPUT> <PROTOCOL> <MIN BYTES> <OUTPUT SYNTAX>
#[!] Protocols: ldap, ntp, memcached, tftp, portmap, snmp, dns, ssdp, chargen
#[!] Output syntax variables: [space], [ip], [bytes]
#Sample Usage
#python xstealer.py ntp.txt ntp 400 [ip][space][bytes]
 
#Requeriments
# Python 2.*
# Root access.
 
 
#!usr/bin/python
# -*- coding: utf-8 -*-
 
# xStealer 1.0 by Alemalakra - Python UDP Reflector receiver for amplification lists.
#
# @author Alemalakra
# @version 1.0
 
import socket, sys
from struct import *
 
if len(sys.argv) < 2:
        print '[!] xStealer 1.0 by Alemalakra.'
        print '[!] Usage: python xstealer.py <OUTPUT> <PROTOCOL> <MIN BYTES> <OUTPUT SYNTAX>'
        print '[!] Protocols: ldap, ntp, memcached, tftp, portmap, snmp, dns, ssdp, chargen'
        print '[!] Output syntax variables: [space], [ip], [bytes]'
        sys.exit()
 
# Starting stealer.
 
print '[!] Listening at: ANY PORT UDP.'
print '[!] Reciving protocol: ' + sys.argv[2].upper()
print '[!} For exit please use CTRL + C.'
 
# Arguments set by user.
 
output_file = sys.argv[1] # Output
proto = sys.argv[2] # Protocol.
min_reply = sys.argv[3] # Min bytes reply.
syntax = sys.argv[4] # Synax out reflector.
newfile = open(output_file, 'w')
 
if proto == 'ldap':
    sourceport_check = 389
elif proto == 'ntp':
    sourceport_check = 123
elif proto == 'memcached':
    sourceport_check = 11211
elif proto == 'tftp':
    sourceport_check = 69
elif proto == 'portmap':
    sourceport_check = 111
elif proto == 'snmp':
    sourceport_check = 161
elif proto == 'dns':
    sourceport_check = 53
elif proto == 'ssdp':
    sourceport_check = 1900
elif proto == 'chargen':
    sourceport_check = 19
else:
        print '[!] Protocol is not available'
        sys.exit()
 
def eth_addr (a) : # Decode MAC Ethernet Adress.
    b = "%.2x:%.2x:%.2x:%.2x:%.2x:%.2x" % (ord(a[0]) , ord(a[1]) , ord(a[2]), ord(a[3]), ord(a[4]) , ord(a[5]))
    return b
 
try:
        s = socket.socket( socket.AF_PACKET , socket.SOCK_RAW , socket.ntohs(0x0003))
except socket.error , msg:
        print '[!] Error creating Socket, Youre a root user?'
        sys.exit()
 
servers = []
servers_pps = {}
completed_servers = 0
while True:
    packet = s.recvfrom(65565) # Recive all packets, Including TCP/UDP/ICMP.
    packet = packet[0]
    eth_length = 14  
    eth_header = packet[:eth_length]
    eth = unpack('!6s6sH' , eth_header)
    eth_protocol = socket.ntohs(eth[2])
    if eth_protocol == 8: # IPv4 Packet.
        ip_header = packet[eth_length:20+eth_length]
        iph = unpack('!BBHHHBBH4s4s' , ip_header)
        version_ihl = iph[0]
        version = version_ihl >> 4
        ihl = version_ihl & 0xF
        iph_length = ihl * 4
        ttl = iph[5]
        protocol = iph[6]
        s_addr = socket.inet_ntoa(iph[8]);
        d_addr = socket.inet_ntoa(iph[9]);
        if protocol == 17: # UDP.
            syntax_output = ""
            u = iph_length + eth_length
            udph_length = 8
            udp_header = packet[u:u+8]
            udph = unpack('!HHHH' , udp_header) # Unpack UDP header, For get information like Source Port.
            source_port = udph[0] # Important thing.
            h_size = eth_length + iph_length + udph_length # Header size.
            data_size = len(packet) - h_size
            checksum = udph[3]
            if source_port == sourceport_check:
                if int(data_size) >= int(min_reply):
                    if any(s_addr in s for s in servers): 
                        # Already writed to Output.
                        # Add to Packets count by Reflector.
                        new_count = servers_pps[s_addr] + 1 
                        servers_pps.update({s_addr : new_count})
                        # TEMPORALLY BETA, Filter PPS for Each Reflector, Maybe future version.
                        #print '[!] Recived Packet-From-Reflector: ' + s_addr + ' - Recived Bytes: ' + str(data_size) + ' - PPS/This reflector: ' + str(new_count)
                    else:
                        completed_servers += 1
                        print '[!] Recived working server: ' + s_addr + ' - Recived Bytes: ' + str(data_size) + ' - Servers found: ' + str(completed_servers)
                        syntax_output = syntax.replace("[space]", " ", 5) # 5 is fine.
                        syntax_output = syntax_output.replace("[bytes]", str(data_size), 5) # 5 is fine.
                        syntax_output = syntax_output.replace("[ip]", str(s_addr), 5) # 5 is fine.
                        newfile.write(str(syntax_output)+'\n')
                        servers.append(s_addr)
                        servers_pps.update({s_addr : 1})
 
# Infinite loop, until guy press CTRL + C, xStealer by Alemalakra :)