full-disclosure - modifying shadowchode exploit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20030719231258.H70485-100000@dekadens.ghettot.org>
From: lcamtuf at ghettot.org (Michal Zalewski)
Subject: modifying shadowchode exploit

On Sat, 19 Jul 2003, Ben Matlock wrote:

> I took a look at the output of the released Cisco exploit and added 2
> lines to make it generate random payload.  More could be done.

Can be indeed. It seems that the trigger of this vulnerability is simply a
<queue size> of IP packets of a group of protocols (such as 55), as
pointed out on INCIDENTS.

And it's being done - I've been hit (and missed) today with something that
appears to be an unpublished exploit for that vulnerability. I was quite
confused at first, seeing it reaching a Linux box, but then realized it's
the same protocol that the one used in shadowchode... made me feel so
special.

The one I've captured does not seem to use such a big payload and uses
incremental TTLs, suggesting it might be more advanced. For more
information, you might want to to go http://lcamtuf.coredump.cx/mobp
(exhibit #12, will probably remove it at some point), here's a sample
packet dump:

22:53:00.340000 80.50.156.4 > 195.117.3.59: ip-proto-55 0 (ttl 2, id
60107)

	4500 0014 eacb 0000 0237 1b01 5032 9c04
        c375 033b 0000 0000 0000 0000 0000 0000
        0000 0000 0000 0000 0000 035a 383d

..and here's a playback utility if you wish to test it (I haven't):
http://lcamtuf.coredump.cx/mine.c

-- 
------------------------- bash$ :(){ :|:&};: --
 Michal Zalewski * [http://lcamtuf.coredump.cx]
    Did you know that clones never use mirrors?
--------------------------- 2003-07-19 21:49 --

-- 
------------------------- bash$ :(){ :|:&};: --
 Michal Zalewski * [http://lcamtuf.coredump.cx]
    Did you know that clones never use mirrors?
--------------------------- 2003-07-19 23:12 --