Re: modifying shadowchode exploit

[Michal Zalewski <lcamtuf () ghettot org>]

On Sat, 19 Jul 2003, Ben Matlock wrote:

> I took a look at the output of the released Cisco exploit and added 2
> lines to make it generate random payload.  More could be done.

Can be indeed. It seems that the trigger of this vulnerability is simply a
<queue size> of IP packets of a group of protocols (such as 55), as
pointed out on INCIDENTS.

And it's being done - I've been hit (and missed) today with something that
appears to be an unpublished exploit for that vulnerability. I was quite
confused at first, seeing it reaching a Linux box, but then realized it's
the same protocol that the one used in shadowchode... made me feel so
special.

The one I've captured does not seem to use such a big payload and uses
incremental TTLs, suggesting it might be more advanced. For more
information, you might want to to go http://lcamtuf.coredump.cx/mobp
(exhibit #12, will probably remove it at some point), here's a sample
packet dump:

22:53:00.340000 80.50.156.4 > 195.117.3.59: ip-proto-55 0 (ttl 2, id
60107)

        4500 0014 eacb 0000 0237 1b01 5032 9c04
        c375 033b 0000 0000 0000 0000 0000 0000
        0000 0000 0000 0000 0000 035a 383d

..and here's a playback utility if you wish to test it (I haven't):
http://lcamtuf.coredump.cx/mine.c

-- 
------------------------- bash$ :(){ :|:&};: --
 Michal Zalewski * [http://lcamtuf.coredump.cx]
    Did you know that clones never use mirrors?
--------------------------- 2003-07-19 21:49 --


-- 
------------------------- bash$ :(){ :|:&};: --
 Michal Zalewski * [http://lcamtuf.coredump.cx]
    Did you know that clones never use mirrors?
--------------------------- 2003-07-19 23:12 --


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html