full-disclosure - Re: 0trace - traceroute on established connections

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <45A2C723.7020102@gatech.edu>
Date: Mon, 08 Jan 2007 17:35:15 -0500
From: Matthew Flaschen <matthew.flaschen@...ech.edu>
To: full-disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: 0trace - traceroute on established connections

Michal Zalewski wrote:
> I'd like to announce the availability of a free security reconnaissance /
> firewall bypassing tool called 0trace. 

Good work.  Are you going to put it under a free license?

> Enough chatter - the tool is available here (Linux version):
> 
>   http://lcamtuf.coredump.cx/soft/0trace.tgz
> 
> Note: this is a 30-minute hack that involves C code coupled with a cheesy
> shellscript. It may not work on non-Linux systems, and may fail on some
> Linuxes, too. It could be improved in a number of ways - so if you like
> it, rewrite it.

I've been trying to get it to work on Ubuntu Edgy.  That system doesn't
have usleep, so I made the following kludge:
-------------------------------------------------------------------------
if [[ ! -x /bin/usleep && ! -x /bin/sleep ]]; then
  echo "[-] Neither /bin/sleep nor /bin/usleep are found on this system,
sorry." 1>&2
  exit 1
fi

usleep()
{
  if [ -x /bin/usleep ]; then
    /bin/usleep $1
  elif [ -x /bin/sleep ]; then
    /bin/sleep $(echo ".000001 * $1" | bc)
  fi
}
-------------------------------------------------------------------------

However, that leaves me with other problems:

[+] Waiting for traffic from target on eth0...
[+] Traffic acquired, waiting for a gap...
./0trace.sh: line 85: printf: 0x: invalid number
./0trace.sh: line 86: printf: 0x: invalid number
[+] Target acquired: : -> : (0/0).
[+] Setting up a sniffer...
[+] Sending probes...
Usage: ./sendprobe src_ip dst_ip sport dport seq ack

I'm using Kubuntu Edgy.  The bash version is 3.1.17(1)-release
(i486-pc-linux-gnu).  Anyone have tips?

Thanks,

Matthew Flaschen

Download attachment "signature.asc" of type "application/pgp-signature" (253 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/