Alle 10:33, marted=EC 14 marzo 2006, Marco Ivaldi ha scritto:

> I've recently stumbled upon an interesting behaviour of some Linux kernels
> that may be exploited by a remote attacker to abuse the ID field of IP
> packets, effectively bypassing the zero IP ID in DF packets countermeasure
> implemented since 2.4.8 (IIRC).

Hi Marco!

I've just tested this thing on available hardware:


=2D [PIRELLI HOME ACCESS GATEWAY]

bunker@syn:~$ sudo nmap -sS -P0 xxx.xxx.xxx.136 -O -v
[cut]PORT STATE SERVICE
1720/tcp open H.323/Q.931
MAC Address: (Pirelli Broadband Solutions)
Device type: PBX
Running: 3Com embedded
OS details: 3Com NBX PBX
[cut]IPID Sequence Generation: Incremental

(closed port)
bunker@syn:~$ sudo /usr/sbin/hping -S xxx.xxx.xxx.136 -c 3
HPING xxx.xxx.xxx.136 (eth0 xxx.xxx.xxx.136): S set, 40 headers
len=3D46 ip=3Dxxx.xxx.xxx.136 ttl=3D64 id=3D26002 sport=3D0 flags=3DRA seq=
=3D0 win=3D0
len=3D46 ip=3Dxxx.xxx.xxx.136 ttl=3D64 id=3D26004 sport=3D0 flags=3DRA seq=
=3D1 win=3D0
len=3D46 ip=3Dxxx.xxx.xxx.136 ttl=3D64 id=3D26006 sport=3D0 flags=3DRA seq=
=3D2 win=3D0=20

bunker@syn:~$ sudo /usr/sbin/hping -SA xxx.xxx.xxx.136 -c 3
HPING xxx.xxx.xxx.136 (eth0 xxx.xxx.xxx.136): SA set, 40 headers
len=3D46 ip=3Dxxx.xxx.xxx.136 ttl=3D64 id=3D26008 sport=3D0 flags=3DR seq=
=3D0 win=3D0
len=3D46 ip=3Dxxx.xxx.xxx.136 ttl=3D64 id=3D26010 sport=3D0 flags=3DR seq=
=3D1 win=3D0
len=3D46 ip=3Dxxx.xxx.xxx.136 ttl=3D64 id=3D26012 sport=3D0 flags=3DR seq=
=3D2 win=3D0

(opened port)
bunker@syn:~$ sudo /usr/sbin/hping -S xxx.xxx.xxx.136 -c 3 -p 1720
HPING xxx.xxx.xxx.136 (eth0 xxx.xxx.xxx.136): S set, 40 headers
len=3D46 ip=3Dxxx.xxx.xxx.136 ttl=3D64 id=3D26082 sport=3D1720 flags=3DSA s=
eq=3D0 win=3D8192
len=3D46 ip=3Dxxx.xxx.xxx.136 ttl=3D64 id=3D26084 sport=3D1720 flags=3DSA s=
eq=3D1 win=3D8192
len=3D46 ip=3Dxxx.xxx.xxx.136 ttl=3D64 id=3D26086 sport=3D1720 flags=3DSA s=
eq=3D2 win=3D8192

bunker@syn:~$ sudo /usr/sbin/hping -SA xxx.xxx.xxx.136 -c 3 -p 1720
HPING xxx.xxx.xxx.136 (eth0 xxx.xxx.xxx.136): SA set, 40 headers
len=3D46 ip=3Dxxx.xxx.xxx.136 ttl=3D64 id=3D26074 sport=3D1720 flags=3DR se=
q=3D0 win=3D8192
len=3D46 ip=3Dxxx.xxx.xxx.136 ttl=3D64 id=3D26076 sport=3D1720 flags=3DR se=
q=3D1 win=3D8192
len=3D46 ip=3Dxxx.xxx.xxx.136 ttl=3D64 id=3D26078 sport=3D1720 flags=3DR se=
q=3D2 win=3D8192


=2D [MY BOX WITH 2.6.15.6 #1 i686 pentium4 GNU/Linux (vanilla)]
=2D (no iptables rules)

bunker@syn:~$ sudo nmap -sS -P0 -O -v xxx.xxx.xxx.139
[cut]PORT STATE SERVICE
22/tcp open ssh
53/tcp open domain
1080/tcp open socks
6000/tcp open X11
MAC Address: (Xnet Technology)
Device type: general purpose
Running: Linux 2.4.X|2.5.X|2.6.X
OS details: Linux 2.4.7 - 2.6.11
[cut]IPID Sequence Generation: All zeros

(closed port + S flag)
bunker@syn:~$ cat hping.closed
HPING xxx.xxx.xxx.139 (eth0 xxx.xxx.xxx.139): S set, 40 headers
len=3D46 ip=3Dxxx.xxx.xxx.139 ttl=3D64 DF id=3D4102 sport=3D18 flags=3DRA s=
eq=3D0 win=3D0
len=3D46 ip=3Dxxx.xxx.xxx.139 ttl=3D64 DF id=3D4103 sport=3D18 flags=3DRA s=
eq=3D1 win=3D0
len=3D46 ip=3Dxxx.xxx.xxx.139 ttl=3D64 DF id=3D4104 sport=3D18 flags=3DRA s=
eq=3D2 win=3D0

(opened port + S flag)
bunker@syn:~$ cat hping.open
HPING xxx.xxx.xxx.139 (eth0 xxx.xxx.xxx.139): S set, 40 headers
len=3D46 ip=3Dxxx.xxx.xxx.139 ttl=3D64 DF id=3D0 sport=3D22 flags=3DSA seq=
=3D0 win=3D5840
len=3D46 ip=3Dxxx.xxx.xxx.139 ttl=3D64 DF id=3D0 sport=3D22 flags=3DSA seq=
=3D1 win=3D5840
len=3D46 ip=3Dxxx.xxx.xxx.139 ttl=3D64 DF id=3D0 sport=3D22 flags=3DSA seq=
=3D2 win=3D5840

(closed port + SA flag)
bunker@syn:~$ cat hpingSA.closed
HPING xxx.xxx.xxx.139 (eth0 xxx.xxx.xxx.139): SA set, 40 headers
len=3D46 ip=3Dxxx.xxx.xxx.139 ttl=3D64 DF id=3D4111 sport=3D18 flags=3DR se=
q=3D0 win=3D0
len=3D46 ip=3Dxxx.xxx.xxx.139 ttl=3D64 DF id=3D4112 sport=3D18 flags=3DR se=
q=3D1 win=3D0
len=3D46 ip=3Dxxx.xxx.xxx.139 ttl=3D64 DF id=3D4113 sport=3D18 flags=3DR se=
q=3D2 win=3D0

(opened port + SA flag)
bunker@syn:~$ cat hpingSA.open
HPING xxx.xxx.xxx.139 (eth0 xxx.xxx.xxx.139): SA set, 40 headers
len=3D46 ip=3Dxxx.xxx.xxx.139 ttl=3D64 DF id=3D4108 sport=3D22 flags=3DR se=
q=3D0 win=3D0
len=3D60 ip=3Dxxx.xxx.xxx.139 ttl=3D64 DF id=3D4109 sport=3D22 flags=3DR se=
q=3D0 win=3D0
len=3D46 ip=3Dxxx.xxx.xxx.139 ttl=3D64 DF id=3D4110 sport=3D22 flags=3DR se=
q=3D1 win=3D0


Seems to be interesting the results obtained from 2.6.15.6 with +S flag.
=2D-=20
Andrea "bunker" Purificato
+++++++++++[>++++++>+++++++++++++++++++++++++++++++++>++++
++++++<<<-]>.>++++++++++.>.<----------.>---------.<+++++++.

http://rawlab.altervista.org=20