Hackers Handbook - Millenium Edition/Hackers Handbook.iso/library/hack/attack.txt

Text File | 1997-09-25 | 14.3 KB | 380 lines

ATTACKING FROM THE OUTSIDE
by http://www.student.tdb.uu.se/~t95hhu/secure/outside.html


TAKING ADVANTAGE OF FINGER

Most fingerd installations support redirections to another host.

Ex:   $finger @[e-mail]


finger will in the example go through system.one.com and on to system.two.com.
As far as system.two.com knows it is system.one.com who is fingering. So this method can be
used for hiding, but also for a very dirty denial of service attack. Lock at this:

        $ finger @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@host.we.attack


All those @ signs will get finger to finger host.we.attack again and again and again... The
effect on host.we.attack is powerful and the result is high bandwidth, short free memory and a
hard disk with less free space, due to all child processes.

The solution is to install a fingerd which don't support redirections, for example GNU finger.
You could also turn the finger service off.

UDP AND SUNOS 4.1.3.

SunOS 4.1.3. is known to boot if a packet with incorrect information in the header is sent to
it. This is the cause if the ip_options indicate a wrong size of the packet.

The solution is to install the proper patch.

FREEZING UP X-WINDOWS

If a host accepts a telnet session to the X-Windows port (generally somewhere between 6000 and
 6025. In most cases 6000) could that be used to freeze up the X-Windows system. This can be
made with multiple telnet connections to the port or with a program which sends multiple
XOpenDisplay() to the port.

The same thing can happen to Motif or Open Windows.

The solution is to deny connections to the X-Windows port.

MALICIOUS USE OF UDP SERVICES

It is simple to get UDP services (echo, time, daytime, chargen) to loop, due to trivial
IP-spoofing. The effect can be high bandwidth that causes the network to become useless. In the
 example the header claim that the packet came from 127.0.0.1 (loopback) and the target is the
echo port at system.we.attack. As far as system.we.attack knows is 127.0.0.1 system.we.attack
and the loop has been establish.

Ex:    from-IP=127.0.0.1

        to-IP=system.we.attack

        Packet type:UDP

        from UDP port 7

        to UDP port 7


Note that the name system.we.attack looks like a DNS-name, but the target should always be
represented by the IP-number.

Quoted from [e-mail] (Paul D. Robertson) comment on comp.security.firewalls on matter
of "Introduction to denial of service" A great deal of systems don't put loopback on the wire,
and simply emulate it. Therefore, this attack will only effect that machine in some cases. It's
much better to use the address of a different machine on the same network. Again, the default
services should be disabled in inetd.conf. Other than some hacks for mainframe IP stacks that
don't support ICMP, the echo service isn't used by many legitimate programs, and TCP echo
should be used instead of UDP where it is necessary.

ATTACKING WITH LYNX CLIENTS

A World Wide Web server will fork an httpd process as a respond to a request from a client,
typical Netscape or Mosaic. The process lasts for less than one second and the load will
therefore never show up if someone uses ps. In most causes it is therefore very safe to launch
 a denial of service attack that makes use of multiple W3 clients, typical lynx clients.
But note that the netstat command can be used to detect the attack (thanks to Paul D. Robertson).

Some httpd:s (for example some http-gw) will have problems besides the normal high bandwidth,
 low memory... And the attack can in those causes get the server to loop.

MALICIOUS USE OF telnet

Study this little script:

Ex:     while : ; do

        telnet system.we.attack &

        done


An attack using this script might eat some bandwidth, but it is nothing compared to the finger
method or most other methods. Well the point is that some pretty firewalls and httpd:s thinks
that the attack is a loop and turn them self down, until the administrator sends kill -HUP.

This is a simple high risk vulnerability that should be checked and if present fixed.

MALICIOUS USE OF telnet UNDER SOLARIS 2.4

If the attacker makes a telnet connections to the Solaris 2.4 host and quits using:

Ex:     Control-}

        quit


then will inetd keep going "forever". Well a couple of hundred...

The solution is to install the proper patch.

HOW TO DISABLE ACCOUNTS

Some systems disable an account after N number of bad logins, or waits N seconds. You can use
this feature to lock out specific users from the system.

LINUX AND TCP TIME, DAYTIME

Inetd under Linux is known to crash if to many SYN packets sends to daytime (port 13)
and/or time (port 37).

The solution is to install the proper patch.

HOW TO DISABLE SERVICES

Most Unix systems disable a service after that N sessions have been open in a given time.
Well most systems have a reasonable default (lets say 800 - 1000), but not some SunOS systems
that have the default set to 48...

The solutions is to set the number to something reasonable.

PARAGON OS BETA R1.4

Paragon is Intels supercomputer platform built for high performance scientific and technical
computing. If someone redirects an ICMP (Internet Control Message Protocol) packet to a paragon
OS beta R1.4 will the machine freeze up and must be rebooted. An ICMP redirect tells the system
to override routing tables. Routers use this to tell the host that it is sending to the wrong
router.

The solution is to install the proper patch.

NOVELLS NETWARE FTP

Novells Netware FTP server is known to get short of memory if multiple ftp sessions connects
to it, causing it to crash. About 5 at a time - 100 sessions total within a short period of
time, could do the trick.

ICMP ATTACKS

Gateways uses ICMP redirect to tell the system to override routing tables, that is telling the
system to take a better way. To be able to misuse ICMP redirection we must know an existing
connection If we have found a connection we can send a route that loses it connectivity or we
could send false messages to the host.

One could also send spoofed ICMP Source Quench messages, this could slow down the conncection.


Ex: (false messages to send)

        DESTINATION UNREACHABLE
        TIME TO LIVE EXCEEDED
        PARAMETER PROBLEM
        PACKET TOO BIG

The effect of such messages is a reset of the connection.

The solution could be to turn ICMP redirects off, not much proper use of the service.

BROADCAST STORMS

This is a very popular method in networks there all of the hosts are acting as gateways.

There are many versions of the attack, but the basic method is to send a lot of packets to all
hosts in the network with a destination that don't exist. Each host will try to forward each
packet so the packets will bounce around for a long time. And if new packets keep coming the
network will soon be in trouble.

Services that can be misused as tools in this kind of attack is for example ping, finger and
sendmail. But most services can be misused in some way or another.

EMAIL BOMBING AND SPAMMING

In a email bombing attack the attacker will repeatedly send identical email messages to an
address. The effect on the target is high bandwidth, a hard disk with less space and so on...
Email spamming is about sending mail to all (or rather many) of the users of a system. The point
of using spamming instead of bombing is that some users will try to send a replay and
if the address is false will the mail bounce back. In that cause have one mail transformed to
three mails. The effect on the bandwidth is obvious.

TIME AND KERBEROS

If not the the source and target machine is closely aligned will the ticket be rejected, that
means that if not the protocol that set the time is protected it will be possible to set a
kerberos server off function.

SUNOS KERNEL PANIC

Some SunOS systems (running TIS?) will get a kernel panic if a getsockopt() is done after
that a connection has been reset.

HOSTILE APPLETS

A hostile applet is any applet that attempts to use your system in an inappropriate manner.
The problems in the java language could be sorted in two main groups:



        1) Problems due to bugs.

        2) Problems due to features in the language.


In group one we have for example the java bytecode verifier bug, which makes is possible for
an applet to execute any command that the user can execute.

Note that two other bugs could be found in group one, but they are both fixed in Netscape 2.01
and JDK 1.0.1.

Group two are more interesting and one large problem found is the fact that java can connect
to the ports. Meaning that all the methods described in .C.X. can be performed by an applet.
More information and examples could be found at address
http://www.math.gatech.edu/~mladue/HostileArticle.html

If you need a high level of security you should use some sort of firewall for protection against
java. As a user you could have java disable.

ANONYMOUS FTP ABUSE

If an anonymous FTP archive have a writable area it could be misused for a denial of service
attack similar with with .D.3. That is we can fill up the file system.

Also can a host get temporarily unusable by massive numbers of FTP requests.

SYN FLOODING

Both 2600 and Phrack have posted information about the syn flooding attack. 2600 have also
posted exploit code for the attack.

As we know the syn packet is used in the 3-way handshake. The syn flooding attack is based on
an incomplete handshake. That is the attacker host will send a flood of syn packet but will not
respond with an ACK packet. The TCP/IP stack will wait a certain amount of time before dropping
the connection, a syn flooding attack will therefore keep the syn_received connection queue of
the target machine filled.

PING FLOODING

The impact of ping flooding is big. Under Unix we could try something like: ping -s host to
send 64 bytes packets.

If you have Windows 95, click the start button, select RUN, then type in:
PING -T -L 256 xxx.xxx.xxx.xx. Start about 15 sessions.

In section xxxxxxxxxxxxxxxxxxxxxxxxxxxxx you can find information about a ping-flooding-gun.

Under Unix the -f switch could be of use.

CRASHING SYSTEMS WITH PING FROM WINDOWS 95 MACHINES

If someone can ping your machine from a Windows 95 machine he or she might reboot, freeze or
crash your machine. The attacker simply writes:

ping -l 65510 address.to.the.machine


And the machine will freeze or reboot.

A very good page about the problem and with a long list of affected systems can be found at
address http://www.sophist.demon.co.uk/ping/

The page is maintained by Mr Mike Bremford.

MALICIOUS USE OF SUBNET MASK REPLY MESSAGE

The subnet mask reply message is used under the reboot, but some hosts are known to accept the
message any time without any check. If so all communication to or from the host can be
turned off.

The host should not accept the message any time but under the reboot.

FLEXlm

Any host running FLEXlm can get the FLEXlm license manager daemon on any network to shutdown
using the FLEXlm lmdown command.



# lmdown -c /etc/licence.dat

lmdown - Copyright (C) 1989, 1991 Highland Software, Inc.



Shutting down FLEXlm on nodes: xxx

Are you sure? [y/n]: y

Shut down node xxx

#


BOOTING WITH TRIVIAL FTP

To boot diskless workstations one often use trivial ftp with rarp or bootp. If not protected an
attacker can use tftp to boot the host.

ATTACKING USENET

It can be possible to cancel some ones else's article, destroy newsgroups and sending false
postings to Usenet. Fore more information about this see the FAQ:alt.2600 question 15.

ATTACKING NAME SERVERS

The name server is the program that holds the information about the domain and answers
questions. The part of the domain name space that the name server holds is referred to as
a zone.

The name server is seldom the only one, it is a to important service. Instead can at least two
be found, the primary master and the secondary master. However can not to many secondary
masters exist (10 ?). The secondary master provides a backup to the primary.

Every time the name server makes a request it collects and store information and next time if
another query is made for the information, it already have it in the cache.

An attack at the name server could have a very big impact. Many servers depends heavily on
proper working name servers, for example: rlogin, rsh, rcp, xhost, NFS, smtp, ftp...

To attack the name server could we of course use any method described in this paper, but the
machine running the name server seldom do anything except DNS-work. The DNS-server is also very
important and have had several security problems that are well known. Because of these reasons
will the DNS-server most likely be well protected and other services beside DNS will probably
not exist (although ping flooding could be a threat if not a firewall that filters ping from
the outside exist). The attack that are left is to attack the service it self at port 53.
We could for example:

     Send random garbage to it.
     Send true queries to it.
     Use syn flooding.

Alternative two should be the most effective one, because it will do every thing that
alternative one do and beside that keep the service program it self busy looking up DNS-names.
Putting together a long random list with DNS-name will also contain mostly addresses outside
the zone, making the name server to try querying other name servers.

SSH AND PPP

If a PPP connection is made via SSH drops, all processes controlled by it can get zombied out.
The processes can not be killed with a kill -9 -1. To get rid of the zombies kill sshd.

LOGIN VIA SSH

Ssh can be used to block login. Force sshd to ask for password during login. Connect to the
system but do not give the password. Until you have given the password no one else will be
able to login.

This is a matter of configuration.

BIND

Telnet to port 53 on a host running BIND-4.9.5-P1. Enter something for example abcdef, but if
that doesn't work just try something else. Hit enter and close the connection.

The server will not now accept any TCP connections and the named-process may consume a lot of
CPU time.

ping -sv -i 127.0.0.1 224.0.0.1

    $ ping -sv -i 127.0.0.1 224.0.0.1

Can cause Solaris to reboot or crash.

qmail

A machine running qmail can run out ouf memory if someone are sending SMTP commands of
unlimited length.

Two example programs can be found at address: http://www.student.tdb.uu.se/~t95hhu/programs/qmail.txt