|=-----------------------------------------------------------------------=|
|=------------=[ T C P   S e s s i o n   H i j a c k i n g ]=------------=|
|=-----------------------------------------------------------------------=|
|=-----------------------=[      by Cheese      ]=-----------------------=|
|=-----------------------=[ cheese[at]mymail.ch ]=-----------------------=|
|=-----------------------=[ http://myCheese.org ]=-----------------------=|
|=-----------------------------------------------------------------------=|


---=[ Contents

    [0x01] - Intro
    
    [0x02] - Theory
        [0x02a] - TCP Sessions
        [0x02b] - Man-in-the-Middle
        [0x02c] - Session Hijack
    
    [0x03] - Practice
        [0x03a] - Tools
        [0x03b] - Scenario
        [0x03c] - Attack

    [0x04] - Outro



---=[ 0x01 - Intro

        Hi guys, in this paper I want to introduce you to the
    theoretical and practical aspects of attacking TCP sessions.
    We will aim to hijack a client-server connection, so we are
    able to bypass password authentications which are normally done
    at the start of a session.


---=[ 0x02 - Theory

-------=[ 0x02a - TCP sessions

        At the establishment of a TCP session the client starts by
    sending a SYN-packet (SYN=synchronize) with an sequence number.
    This number is used to assure the transmission of packets in
    a chronological order. It is increased by one with each packet.
    The both sides of the connection wait for an packet with a specified
    sequence number. The first seq-number for both directions is
    random.
        The server responds with an SYN/ACK packet (ACK-acknowledgment)
    which contains the seq-number of the client+1 and also a own start
    seq-number. The client confirm everything with an ACK packet including
    the seq-number of the server+1, after that the session is established.

                +---+       syn seq=x       +---+
                | C | ------------------->  | S |
                | L |                       | E |
                | I |   syn ack=x+1 seq=y   | R |
                | E | <-------------------- | V |
                | N |                       | E |
                | T |    ack=y+1 seq=x+1    | R |
                +---+ --------------------> +---+
                
        To hijack a session it is required to send a packet with a right
    seq-number, otherwise they are dropped. You have two options to get
    the right seq-number.

        Option A:
            You try to guess the right number. It is made up of 32bit
            so you _just_ have 4294967296 possibilities, good luck!

        Option B:
            You sniff the existing connection, this works at networks
            which use Hub's without problems, but to do this at a switched
            network you have one way:
                Man-in-the-Middle!


-------=[ 0x02b - Man-in-the-Middle

        To get Man-in-the-Middle we use ARP Poison Routing.
    ARP (address resolution protocol) binds MAC addresses to
    IP addresses to make a data transfer on Ethernet possible.
    You should read up about this protocol if you do not know much
    about it.
        In order to sniff the connection between two hosts the attacker
    sends a manipulated ARP packet to one of the hosts which contains
    the IP of the second host and the MAC of the attacker. So this host
    sends every packet that is meant for the second host to the attacker.
    The same is done with the other host, the attacker himself just
    forwards the packets, so he acts as an invisible intermediary, as
    Man-in-the-Middle.

       
    +------+                                             +------+
    |HOST-A| -------------------SWITCH------------------ |HOST-B|
    +------+   .................  |  .................   +------+
                               :  |  :
                               :  |  :
                               :  |  :
                               :  |  :
                              +--------+
        Hello [A], I am [B] > |ATTACKER| < Hello [B], I am [A]
                              +--------+



-------=[ 0x02c - Session Hijack

        Vulnerable to hijacking is every unencrypted connection.
    We start with the Man-in-the-Middle attack between the victim
    and the server, if the server is in another subnet we attack
    the gateway instead of the server. If everything is successful
    we are able to observe every single packet with a sniffer.

        To hijack the session we wait for a packet and use the infos
    from it: source IP, destination IP, source port, destination port,
    and the sequence number. With this data we create a own packet
    and send it instantly to the server. The server accepts it and
    increases the expected seq-number for the next one. As soon the
    next packet from the real client arrives the server drops it as
    outdated, so the client is desynchronized and loses the connection.
     

---=[ 0x03 - Practice
    
-------=[ 0x03a - Tools

        There are many programs which do the complete thing by
    itself (Hunt, Juggernaut, T-Sight), but I got some problems
    with some of them.

        For the Man-in-the-Middle attack I will use the well known
    program "Ettercap". "Wireshark" does the sniffing for me
    and the hijack is done with "Shijack", everything of course
    on a Linux/GNU box.

    Shijack: http://packetstormsecurity.org/sniffers/shijack.tgz
     
     
-------=[ 0x03b - Scenario

        We aim to hijack a telnet session between a client
    and a server.
    
    Network:
    
       +--------+                                 +--------+
       | SERVER | <.......T..E..L..N..E..T......> | CLIENT |
       |10.0.0.1| --------------+  +--------------|10.0.0.2|
       +--------+               |  |              +--------+
                                |  |
                              +------+
                              |SWITCH|
                              +------+
                                 | 
                                 |
                             +--------+
                             |ATTACKER|
                             |10.0.0.3|
                             +--------+

                        
 -------=[ 0x03c - Attack

        As I said in the beginning we start with the MitM attack.
    We will use ettercap to do it. Ettercap is started in the GTK mod
    and we activate "Unified sniffing" in the sniff menu. Choose your
    network interface and we continue with a click at "Scan for hosts"
    at the hosts menu. After the scan is finished we display the hosts
    with "Host list" in the same menu. 
        10.0.0.1 -> Add to Target 1
        10.0.0.2 -> Add to Target 2
    Press "Start sniffing" at the start menu and "Arp poisoning" at the
    Mitm menu.

        Next we start a sniffer, "Wireshark" in my case. There we click
    "List the available capture interfaces..." and get a list of our
    interfaces, choose the right one and the sniffing starts.
    Wait for any packet of the telnet connection, as soon as we get one
    we click it and see the required informations.
        For example:
            Source IP        10.0.0.2
            Destination IP   10.0.0.1
            Source Port      53517
            Destination Port 23

        Now we are finally at the hijack, I will use "Shijack" for it.
    If you got problems compiling you can use the binaries which are
    included.

#    
#cheese:/home/cheese/hijack# ./shijack
#Usage: ./shijack      [-r]
#             The interface you are going to hijack on.
#                The source ip of the connection.
#              The source port of the connection.
#                The destination IP of the connection.
#              The destination port of the connection.
#[-r]                    Reset the connection rather than hijacking it.
#

        OK thats simple. 
        
#        
#cheese:/home/cheese/hijack# ./shijack eth0 10.0.0.2 53517 10.0.0.1 23
#

        Attack!!!!
        
#        
#Waiting for SEQ/ACK  to arrive from the srcip to the dstip.
#(To speed things up, try making some traffic between the two)
#

        The tool runs and waits for another packet to get an
    working seq-number. As soon as it get something it will hijack
    the connection automatically.
    
#
#Got packet! SEQ = 0xad6e5b8e ACK = 0x5ebaf20d
#Starting hijack session, Please use ^C to terminate.
#Anything you enter from now on is sent to the hijacked TCP connection.
#

        Hijack successful! Now we are able to send everything we want
    through the session to the server.
    
    
---=[ 0x04 - Outro


        Every unencrypted session is vulnerable to TCP-session-hijacks,
    although it is mostly more simple to sniff the password directly.
    But I think it is a really dangerous technique since one-time-password
    like TAN or security token are also vulnerable.
        I really hope you like my little paper.
        
       
                    -Thx for reading-
        

    Written by : Cheese <cheese(at)mymail.ch>
         Visit : myCheese.org
               : Back2Hack.cc
               : Core.am
 Shout-Outs to : Asmo, BuntspechT, der_Dude, double_check, easysurfer,
               : gunner, kingfinn, nonverbal, pHySSiX, PsTo, TheBotnetGuy, Ultimate
               : Plus everyone else who knows me