On friday, Ovidiu Mara reported a vulnerability in ping utility from iputils package. It was announced as MDVSA-2010:138 by Mandriva Security on Full Disclosure mailing list, and CVE-2010-2529 has been reserved for it. Be assured it is not a critical bug. In fact if you ping a malicious host which replies a malicious packet, ping goes in an infinite loop. Just kill it and you're done.
However, I like networking and found the vulnerability funny (reminds me a bit the ping of death), so I investigated, found the vulnerability and developed an exploit.
Showing posts with label scapy. Show all posts
Showing posts with label scapy. Show all posts
Sunday, July 25, 2010
Tuesday, May 25, 2010
Defcon 18 CTF quals writeup - Packet 100
Packet 100 was just... horrible right? :) However some teams managed to get it, here is my writeup.
Description: sumthing is not like the other... Here are your packets.
We have a capture file of several ICMP echo-request/echo-reply pings. We can ignore echo-reply packets because they carry the same payload (it's a ping).
First, we focused on the only packet to have a 129 bytes payload instead of 256, but achieved nothing, so we focused on the other packets.
We tried so many things: frequency analysis, cesar, xors, consider only ascii, sum things, IP checksum, Ethernet mac, use first packet as a key or initialisation vector. But in fact it appeared to be what was explained in the description "sumthing is not like the other", only consider bytes that only reside in this packet and concatenate (sum) them.
Description: sumthing is not like the other... Here are your packets.
We have a capture file of several ICMP echo-request/echo-reply pings. We can ignore echo-reply packets because they carry the same payload (it's a ping).
First, we focused on the only packet to have a 129 bytes payload instead of 256, but achieved nothing, so we focused on the other packets.
We tried so many things: frequency analysis, cesar, xors, consider only ascii, sum things, IP checksum, Ethernet mac, use first packet as a key or initialisation vector. But in fact it appeared to be what was explained in the description "sumthing is not like the other", only consider bytes that only reside in this packet and concatenate (sum) them.
Wednesday, May 05, 2010
UDP scan with ICMP port unreachable and scapy
As you probably now, scanning UDP opened ports is painful because UDP is not connected, so you cannot rely on TCP SYN/SYN-ACK to find opened ports.
The ultimate network scanner nmap knows how to perform an UDP scan:
The ultimate network scanner nmap knows how to perform an UDP scan:
$ nmap -sU -p1-65535 <target>You can add useful options such as -sV (probe open ports to determine service/version info). The scan is much longer than a TCP scan, but sometimes it works. Yes, sometimes. Recently I started a simple UDP server (with socat) on a random port and challenged myself to find it within the whole 1-65535 range: I appeared to be unable to find it with nmap (I'm probably misusing nmap).
Subscribe to:
Posts (Atom)