full-disclosure - Re: Torpark breaks with DEP enabled, and how to break it further so that it works

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 13 Feb 2007 16:34:49 -0800
From: coderman <coderman@...il.com>
To: KJKHyperion <hackbunny@...tpj.org>
Cc: Full-Disclosure@...ts.grok.org.uk
Subject: Re: Torpark breaks with DEP enabled,
	and how to break it further so that it works

On 2/13/07, KJKHyperion <hackbunny@...tpj.org> wrote:
> ...
> Sorry, I'm a noted Windows fanboy and I'm not sure I find that a plus

you must have w2k server, no WSAENOBUFS [0] hell for you!  *g*

in any case, i hope you are aware of which claims are actually
supported by Torpark and which aren't. [1]

> dammit Jim, I'm a kernel hacker, not a network admin! A couple ideas,
> though:
>  * why not PPPoE instead of a VPN? Sorry if it doesn't make sense to
> you, I just have a thing for PPPoE. Not a fetish or anything like that.
> No way. Seriously, it sounds perfect for a bridged tunnel, to me

the problem lies in the routing. PPPoE doesn't resolve this, and i'm
not sure if the tap device can do it anyway (since it is not really an
ethernet device, but sort of).  it will probably require a new device
(like the vmware bridge) to do this.

more to the point, the windows "bridge" from ethernet to the tap is
not really a bridge.  i guess that's the root of the problem (and
where the vmware bridge device acts like a bridge, and doesn't subject
the bridged vmnet device to the same routing table used by the host IP
stack associated with the actual ethernet device)

>  * VMware works flawlessly because it attaches a protocol driver to all
> the bridged interfaces, simulating a bridge (duh). I suspect the tap
> driver is not as smart. Nowhere near as smart.

yes, exactly!   (well, it doesn't actually show as a bridge, it's a
"magic" bridge that can bind to anything that speaks ethernet,
including wireless devices, without giving windows the heads up, and
thus avoids routing table badness.)

>  * alternatively, my psychic debugging powers tell me Qemu might be
> trying to inject packets through a raw socket, or something similarly
> boneheaded that nevertheless works perfectly on Linux.

nah, it's a tap device just like openvpn uses.  it just appears to be
a realtek ethernet device inside the linux guest (or any other guest
OS)...

> (... hey, did you know you can turn a Windows Server into a PPPoE
> terminal server if you install a PPPoE port driver and bind RRAS to it?
> easy like that! now ain't that... cool?)

that's sick dude!  quit drinking the cool-aid before it's too late!  :P

0. "Tor Windows Buffer Problems"
   http://wiki.noreply.org/noreply/TheOnionRouter/WindowsBufferProblems

1. "Traces left by Torpark, and other security discussion"
   http://archives.seul.org/or/talk/Nov-2006/msg00219.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/