/* ISNprint.c - display ISN numbers of a server Recently, attacks against TCP/IP Initial Sequence Numbers were published : - CERT Advisory CA-2001-09 "Statistical Weaknesses in TCP/IP Initial Sequence Numbers" - http://www.cert.org/advisories/CA-2001-09.html - Michal Zalewski "Strange Attractors and TCP/IP Sequence Number Analysis" http://razor.bindview.com/publish/papers/tcpseq.html To predict ISN, there are two steps : - obtain the serie of generated ISN values - predict the next ISN which may be used by the server This program achieves the first step by displaying ISN numbers of a server : # ./ISNprint www.server.com 80 ISN 0 : 4213610146 1 : 1433396694 [diff -2780213452] 2 : 2342587356 [diff +0909190662] 3 : 3904132205 [diff +1561544849] 4 : 1742387478 [diff -2161744727] 5 : 3486208657 [diff +1743821179] 6 : 3263927723 [diff -0222280934] 7 : 3514925853 [diff +0250998130] 8 : 0729418132 [diff -2785507721] 9 : 2770073670 [diff +2040655538] 10 : 1643678857 [diff -1126394813] 11 : 1658572002 [diff +0014893145] 12 : 1871339414 [diff +0212767412] The second step, the statistical prediction, is not done in this program. If you are a statistical expert, you may want to complete this program and publish it. To compile : # gcc -o ISNprint ISNprint.c -llcrzo -lpcap The library lcrzo is needed : http://www.laurentconstantin.com/us/lcrzo/lcrzo/ [main server] http://go.to/laurentconstantin/us/lcrzo/lcrzo/ [backup server] http://laurentconstantin.est-la.com/us/lcrzo/lcrzo/ [backup server] */ /* include the library headers */ #include #if ! defined _POSIX_SOURCE #define _POSIX_SOURCE 1 #endif #include #include #include #include #include /*-------------------------------------------------------------*/ /* function declarations */ void isn_sig_received1(int i); void isn_sig_received2(int i); int isn_sendsyn(lcrzo_device device, lcrzo_etha clientetha, lcrzo_etha destetha, lcrzo_ipl clientipl, lcrzo_ipl serveripl, lcrzo_uint16 serverport, lcrzo_uint16 startingclientport, lcrzo_uint32 startingclientseqnum); int isn_print(lcrzo_device device, lcrzo_etha clientetha, lcrzo_etha destetha, lcrzo_ipl clientipl, lcrzo_ipl serveripl, lcrzo_uint16 serverport, lcrzo_uint16 startingclientport, lcrzo_uint32 startingclientseqnum); int isn_printseqnum(lcrzo_data sniffdata, lcrzo_int32 sniffdatasize, lcrzo_etha clientetha, lcrzo_etha destetha, lcrzo_ipl clientipl, lcrzo_ipl serveripl, lcrzo_uint16 serverport, lcrzo_uint16 startingclientport, lcrzo_uint32 startingclientseqnum); /*-------------------------------------------------------------*/ /* global variables */ int isn_pid; lcrzo_spoof isn_spoof; lcrzo_sniff isn_sniff; /*-------------------------------------------------------------*/ int main(int argc, char *argv[]) { lcrzo_etha clientetha, destetha; lcrzo_ipl clientipl, serveripl; lcrzo_device device; lcrzo_uint16 serverport, startingclientport; lcrzo_uint32 startingclientseqnum; if ( argc<3 ) { /* print usage */ printf("Usage : %s server port\n", argv[0]); printf("Example : %s 1.2.3.4 80\n", argv[0]); return(LCRZO_ERR_BULCRZOEXBADUSAGE); } /* set server information */ lcrzo_epr(lcrzo_ipl_init_hs(argv[1], &serveripl)); lcrzo_epr(lcrzo_uint16_init_text(argv[2], &serverport)); /* obtain device and Ethernet addresses */ lcrzo_epr(lcrzo_conf_route_to_host(serveripl, device, clientetha, destetha, &clientipl, NULL)); /* determine starting values */ lcrzo_epr(lcrzo_uint16_rand(5000, 30000, &startingclientport)); lcrzo_epr(lcrzo_uint32_rand(0, 0xEFFFFFFFU, &startingclientseqnum)); isn_pid=fork(); if (isn_pid<0) return(LCRZO_ERR_FUFORK); if (isn_pid==0) { /* this process sends a SYN (we left to our computer the job to send a RST) */ /* in case we receive a signal */ signal(SIGINT, isn_sig_received1); lcrzo_epr(isn_sendsyn(device, clientetha, destetha, clientipl, serveripl, serverport, startingclientport, startingclientseqnum)); /*never reatched*/ } else { /* this process sniff and prints sequence numbers */ /* in case we receive a signal */ signal(SIGINT, isn_sig_received2); lcrzo_epr(isn_print(device, clientetha, destetha, clientipl, serveripl, serverport, startingclientport, startingclientseqnum)); /*never reatched*/ } /* never reatched */ return (0); } /*-------------------------------------------------------------*/ void isn_sig_received1(int i) { int language; lcrzo_global_get_language(&language); if ( language==LCRZO_GLOBAL_FRLANG ) printf("Fermeture du spoof (recu : SIG%d)\n", i); else printf("Closing spoof (received : SIG%d)\n", i); lcrzo_spoof_close(&isn_spoof); raise(SIGTERM); } /*-------------------------------------------------------------*/ void isn_sig_received2(int i) { int status, language; lcrzo_global_get_language(&language); if ( language==LCRZO_GLOBAL_FRLANG ) printf("Fermeture du sniff (recu : SIG%d)\n", i); else printf("Closing sniff (received : SIG%d)\n", i); kill(isn_pid, SIGINT); waitpid(isn_pid, &status, 0); lcrzo_sniff_close(&isn_sniff); raise(SIGTERM); } /*-------------------------------------------------------------*/ int isn_sendsyn(lcrzo_device device, lcrzo_etha clientetha, lcrzo_etha destetha, lcrzo_ipl clientipl, lcrzo_ipl serveripl, lcrzo_uint16 serverport, lcrzo_uint16 startingclientport, lcrzo_uint32 startingclientseqnum) { lcrzo_hdrleth hdrleth; lcrzo_hdrlip hdrlip; lcrzo_hdrltcp hdrltcp; lcrzo_uint16 clientport; lcrzo_uint32 clientseqnum; /* initialize Ethernet header */ lcrzo_epr(lcrzo_hdrleth_initdefault(&hdrleth)); memcpy(hdrleth.src, clientetha, LCRZO_ETHA_MAXBYTES); memcpy(hdrleth.dst, destetha, LCRZO_ETHA_MAXBYTES); /* initialize IP header */ lcrzo_epr(lcrzo_hdrlip_initdefault(&hdrlip)); hdrlip.saddr=clientipl; hdrlip.daddr=serveripl; /* initialize TCP header */ lcrzo_epr(lcrzo_hdrltcp_initdefault(&hdrltcp)); hdrltcp.dport=serverport; hdrltcp.syn=1; clientport=startingclientport; clientseqnum=startingclientseqnum; /* spoof */ lcrzo_epr(lcrzo_spoof_init(&isn_spoof)); while(1) { lcrzo_epr(lcrzo_spoof_ethipopttcpoptdata(&isn_spoof, device, hdrleth, hdrlip, NULL, 0, hdrltcp, NULL, 0, NULL, 0)); hdrltcp.sport=clientport++; hdrltcp.seqnum=clientseqnum; clientseqnum+=10; /* you may want to remove this sleep, if you own the server */ lcrzo_epr(lcrzo_time_sleep(100000)); } /*never reatched*/ return(LCRZO_ERR_IEINTERNALERROR); } /*-------------------------------------------------------------*/ int isn_print(lcrzo_device device, lcrzo_etha clientetha, lcrzo_etha destetha, lcrzo_ipl clientipl, lcrzo_ipl serveripl, lcrzo_uint16 serverport, lcrzo_uint16 startingclientport, lcrzo_uint32 startingclientseqnum) { lcrzo_uint32 mtu; lcrzo_data sniffdata; lcrzo_int32 sniffdatasize; int ret; /* init sniff */ lcrzo_epr(lcrzo_mtu_init_device(device, &mtu)); lcrzo_epr(lcrzo_sniff_init(device, mtu, "", &isn_sniff)); /* main loop */ ret=lcrzo_sniff_nextm(&isn_sniff, LCRZO_TRUE, LCRZO_SNIFF_TYPE_NORMAL, &sniffdata, &sniffdatasize); while (ret==LCRZO_ERR_OK) { /* decode TCP and print seqnum */ lcrzo_epr(isn_printseqnum(sniffdata, sniffdatasize, clientetha, destetha, clientipl, serveripl, serverport, startingclientport, startingclientseqnum)); lcrzo_data_free(sniffdata); /* sniff next packet */ ret=lcrzo_sniff_nextm(&isn_sniff, LCRZO_TRUE, LCRZO_SNIFF_TYPE_NORMAL, &sniffdata, &sniffdatasize); } /* close everything */ raise(SIGINT); /*never reatched*/ return(LCRZO_ERR_IEINTERNALERROR); } /*-------------------------------------------------------------*/ int isn_printseqnum(lcrzo_data sniffdata, lcrzo_int32 sniffdatasize, lcrzo_etha clientetha, lcrzo_etha destetha, lcrzo_ipl clientipl, lcrzo_ipl serveripl, lcrzo_uint16 serverport, lcrzo_uint16 startingclientport, lcrzo_uint32 startingclientseqnum) { static lcrzo_uint32 oldseqnum; lcrzo_hdrleth hdrleth; lcrzo_hdrlip hdrlip; lcrzo_hdrltcp hdrltcp; int ret; lcrzo_uint32 diff1, diff2; /* try to decode it */ ret=lcrzo_packet_decodem_ethipopttcpoptdata(sniffdata, sniffdatasize, &hdrleth, &hdrlip, NULL, NULL, &hdrltcp, NULL, NULL, NULL, NULL); if ( ret!=LCRZO_ERR_OK ) return(LCRZO_ERR_OK); /* only count synack */ if ( ! (hdrltcp.syn && hdrltcp.ack) ) return(LCRZO_ERR_OK); /* check if the addresses are the one we are looking for */ if ( ! lcrzo_etha_equal(hdrleth.src, destetha) ) return(LCRZO_ERR_OK); if ( ! lcrzo_etha_equal(hdrleth.dst, clientetha) ) return(LCRZO_ERR_OK); if ( ! lcrzo_ipl_equal(hdrlip.saddr, serveripl) ) return(LCRZO_ERR_OK); if ( ! lcrzo_ipl_equal(hdrlip.daddr, clientipl) ) return(LCRZO_ERR_OK); /* check server port */ if ( hdrltcp.sport!=serverport ) return(LCRZO_ERR_OK); /* now this seems ok, but we verify with starting values */ diff1=hdrltcp.dport-startingclientport; diff2=(hdrltcp.acknum-1-startingclientseqnum)/10; if ( diff1!=diff2 ) return(LCRZO_ERR_OK); /* now, it's OK, so we print the seqnum */ printf("% 6ld : %.10lu\t[diff ", diff1, hdrltcp.seqnum); if (hdrltcp.seqnum>=oldseqnum) printf("+%.10lu]\n", hdrltcp.seqnum-oldseqnum); else printf("-%.10lu]\n", oldseqnum-hdrltcp.seqnum); oldseqnum=hdrltcp.seqnum; return(LCRZO_ERR_OK); }