full-disclosure - ICMP Covert channels question

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <DF20381DFBB2D6E209BD9C6D@utd49554.utdallas.edu>
From: pauls at utdallas.edu (Paul Schmehl)
Subject: ICMP Covert channels question

--On Friday, January 28, 2005 11:45:00 PM +0100 cyberpixl 
<cyberpixl@...il.com> wrote:
>
> Assume there is a local machine (our target) with ip 192.168.0.2 that
> is connected to the internet using a router 192.168.0.1/88.88.88.88
> (that is not blocking icmp packets) and my machine is say,
> 33.33.33.33. If i then send an icmp packet to the 88.88.88.88 router
> with source ip set to 192.168.0.2, would it forward that packet to the
> host in its local network, or will it discard it? Is there any way to
> deliver my packet to that local machine?

No, because non-routeable addresses are...well....non-routeable.  The only 
exception to this is *if* the target machine already had a session going 
with 33.33.33.33 (and it would obviously be nat'd/pat'd) there is a snort 
time frame within with your icmp packet would be delivered because the 
firewall is still translating the address/port for that session.

Of course you have to know in advance all those variables, so, since you're 
sitting right there, just pound the dern thing with a hammer and be done 
with it.  :-)

Paul Schmehl (pauls@...allas.edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu