gandon_detector.py

#!/usr/bin/env python
import socket
import sys
from utils import tobuf

addrs=[]
attacked_server=None
PACKET_HEADER = b'\xff\xff\xff\xff'

def str_to_addr(s):
	ip,port = s.strip().split(':')
	port = int(port)
	return (ip,port)

def outofbound_print(sock, addr, message):
	p = tobuf('\xff\xff\xff\xff' + message)
	sock.sendto(p, addr)

if len(sys.argv) != 2:
	print('usage: gandon_detector.py ip:port')
	sys.exit(1)

attacked_server=str_to_addr(sys.argv[1])

with open('ips.txt') as f:
	lines = f.readlines()
	for line in lines:
		addr = str_to_addr(line)
		if addr == attacked_server:
			continue
		addrs += [addr]

print('%d IPs loaded. Checking who replies bullshit for %s' % (len(addrs),attacked_server))

def probe_list(addrs):
	replies={}

	if len(addrs) == 0:
		return False

	sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
	sock.settimeout(1)

	for i in addrs:
		outofbound_print(sock,i,'info 48')
	outofbound_print(sock,attacked_server,'info 48')

	print('sent messages to %d addresses', len(addrs))

	for i in range(len(addrs)):
		try:
			(data, addr) = sock.recvfrom(512)
		except:
			print('timeout')
			continue
		print('.')

		if data[0:4] != PACKET_HEADER:
			log('Unhandled packet %s from %s:%i' % (data, addr[0], addr[1]))
			continue

		replies[addr] = data

		data = data.strip(PACKET_HEADER)
		if data.startswith(b'info\n\\'): # infostring begin
			continue

		print('disconnect detected\n')

		# unusual packet found
		return True
	return False

def bsearch(addrs):
	# try binary search
	addrs_to_check=addrs[0:int(len(addrs)/2)]
	if probe_list(addrs_to_check):
		if len(addrs_to_check) == 1:
			print('found pidor',addrs_to_check)
		else: bsearch(addrs_to_check)

	addrs_to_check=addrs[int(len(addrs)/2):len(addrs)]
	if probe_list(addrs_to_check):
		if len(addrs_to_check) == 1:
			print('found pidor',addrs_to_check)
		else: bsearch(addrs_to_check)

bsearch(addrs)