This nuker uses an exploit to crash systems with Win 95, 98 or NT 3.x.
After it sends the IGMP Packets, the most target vulnerable systems will
do what windows knows better to do, show a Blue Screen and block the computer,
or it could just reboot the system.
If your victim does use a higher version of Windows or use Linux or it have
pachted its windows against nukes, the nuke won┤t have any effect on it.
The Igmp Nuker sends IGMP Packets with a delay between each sending. If the
sending operation take more time than the specified delay time, the next sending
operation will start without delay.
The nuker support to be run with a command line. This is very usefull when you want
to call it from a console or want to make a program who calls it. This feature could be
very profit for the IRC scripters too.
The parameters are the following:
1. The first parameter must be always the ip or host address and it isn't optional.
If the host address is passed, it would try to be resolved.
Note: All the rest of parameters are optional if you don┤t specify them, the nuker will use
the default settings.
Options: Description
-t <number of packets> Specify the number of packets.
-d <delay> Specify the deley between each sending in miliseconds.
-ps <packet(s) size> Specify the size of each packet in bytes.
-m Specify the application to minize on startup.
Example:
Igmp.exe my.victim.com -d 100 -t 10 -ps 60000 -m
The Bug
=======
The vulnerability lies in the implementation of the TCP/IP stack. A series of fragmented IGMP packets causes an affected system to access invalid memory, which can cause system services to fail or can cause the machine to crash altogether.
IGMP (Internet Group Management Protocol) is one of the protocols in the TCP/IP protocol suite. It's used to allow IP multicasting, wherein data is sent to an IP address which may reach multiple hosts. Typically, a single IGMP packet is sent to set up a multicast, and the multicast data itself is carried by UDP packets.
Various other protocols also use the IGMP protocol number for their own messages. These include the Distance Vector Multicast Routing Protocol (DVMRP), version 1 of the Protocol Independent Multicast (PIM) routing protocol, and the MRInfo and multicast traceroute (Mtrace) protocols.
Windows 95 and 98 machines are the machines primarily affected by this vulnerability. The stack implementation in Windows NT 4.0 contains the vulnerability, but other system mechanisms decrease the likelihood of adverse affects. During exhaustive testing, we were unable to ever successfully attack a Windows NT 4.0 machine using this vulnerability.
