Packet Crafting

1
Packet Crafting for Firewall and
IDS Audits Presented by Don Parker,
GCIA hydra291_at_hotmail.com
2

• Why should you audit your perimeter?
• Updated ACLs and signatures
• Confirm these very same ACLs and signatures
• Proactive defense is good policy
• 4) Check for possible holes (new open ports)

3
Use automated tools with a gui? Retina,
GFiLANguard. pros vs. cons Costs of software
versus budgets Analyst skills degradation No
corroboration of results Ease of use
4
Use of manual tools via cli? hping, nemesis,
tcpdump, isic pros vs. cons No software
costs Analyst skills higher Compare and
corroborate results Steeper learning
curve Granular understanding of TCP/IP
5
Reality versus Practicality Rapier and the
Broadsword Blended vectors Overlap is good You
get what you pay for? Devise a good overall
security audit policy
6
Tools used for the following slides HPing http/
/www.hping.org/ Tcpdump http//www.tcpdump.org/
Snort http//www.snort.org/ Topology used 1
lab box and 1 lab laptop Operating Systems SuSE
Professional 9.0 with default IPTables script in
place
7
Testing for presence of a web server HPing
syntax noted below monkeylabs/home/don hping
-S 192.168.1.108 -p 80 -c 1 HPING 192.168.1.108
(eth0 192.168.1.108) S set, 40 headers 0 data
bytes --- 192.168.1.108 hping statistic --- 1
packets tramitted, 0 packets received, 100
packet loss round-trip min/avg/max 0.0/0.0/0.0
ms Tcpdump syntax noted below /home/don
tcpdump -nXvSs 0 tcp and host 192.168.1.100 and
192.168.1.108 tcpdump listening on eth0
8
Packet as seen on the wire 100730.171332
192.168.1.100.1321 gt 192.168.1.108.80 S tcp sum
ok 19074990581907499058(0) win 512 tos 0x8
(ttl 64, id 45106, len 40) 0x0000 4508 0028
b032 0000 4006 4675 c0a8 0164
E..(.2.._at_.Fu...d 0x0010 c0a8 016c 0529 0050
71b2 2032 53e1 85d2 ...l.).Pq..2S... 0x002
0 5002 0200 b8b0 0000
P....... Firewall output Mar 2
100640 linux kernel SuSE-FW-DROP-DEFAULT
INeth0 OUT MAC0050dac59d8b000c6e8cd4
610800 SRC192.168.1.100 DST192.168.1.108
LEN40 TOS0x08 PREC0x00 TTL64 ID45106
PROTOTCP SPT1321 DPT80 WINDOW512 RES0x00
SYN URGP0
9
Packet as seen on destination computer /home
/don tcpdump -nXvs 0 tcp and host 192.168.1.108
and 192.168.1.100 tcpdump listening on
eth0 100640.474204 192.168.1.100.1321 gt
192.168.1.108.80 S tcp sum ok
19074990581907499058(0) win 512 tos 0x8 (ttl
64, id 45106, len 40) 0x0000 4508 0028 b032
0000 4006 4675 c0a8 0164 E..(.2.._at_.Fu...d 0x
0010 c0a8 016c 0529 0050 71b2 2032 53e1 85d2
...l.).Pq..2S... 0x0020 5002 0200 b8b0 0000
0000 0000 0000 P.............
10
Second firewall test for UDP Port 53 Hping
syntax noted below monkeylabs/home/don hping
-2 192.168.1.108 -p 53 -c 1 HPING 192.168.1.108
(eth0 192.168.1.108) udp mode set, 28 headers
0 data bytes --- 192.168.1.108 hping statistic
--- 1 packets tramitted, 0 packets received,
100 packet loss round-trip min/avg/max
0.0/0.0/0.0 ms monkeylabs/home/don Tcpdump
syntax noted below /home/don tcpdump -nXvSs 0
udp and host 192.168.1.108 and 192.168.1.100
tcpdump listening on eth0
11
Packet as seen on the wire 102430.172588
192.168.1.100.2180 gt 192.168.1.108.53 udp sum
ok  0 0q (0) tos 0x10 (ttl 64, id 47873,
len 28) 0x0000 4510 001c bb01 0000 4011 3b9f
c0a8 0164 E......._at_.....d 0x0010 c0a8
016c 0884 0035 0008 7304 0000 0000
...l...5..s..... 0x0020 0000 0000 0000 0000
0000 0000 0000 ............. Firew
all output Mar 2 102430 linux kernel
SuSE-FW-DROP-DEFAULT INeth0 OUT
MAC0050dac59d8b000c6e8cd4610800
SRC192.168.1.100 DST192.168.1.108 LEN28
TOS0x10 PREC0x00 TTL64 ID47873 PROTOUDP
SPT2180 DPT53
12
Recap of last slides Packet silently
discarded Normal behavior should of been ICMP
outbound Some odd behavior noted via pad
bytes Would an automated tool of seen this?
13
Testing for ICMP acceptance Hping syntax noted
below monkeylabs/home/don hping -1
192.168.1.108 -c 1 HPING 192.168.1.108 (eth0
192.168.1.108) icmp mode set, 28 headers 0
data bytes len46 ip192.168.1.108 ttl64 id122
icmp_seq0 rtt0.4 ms --- 192.168.1.108 hping
statistic --- 1 packets tramitted, 1 packets
received, 0 packet loss round-trip min/avg/max
0.4/0.4/0.4 ms Tcpdump syntax noted
below monkeylabs/home/don tcpdump -nXvs 0 ip
and host 192.168.1.100 and host 192.168.1.108
tcpdump listening on eth0
14
Packet as seen on the wire 111037.458058
192.168.1.100 gt 192.168.1.108 icmp echo request
(ttl 64, id 51585 len 28) 0x0000 4500 001c
c981 0000 4001 2d3f c0a8 0164
E......._at_.-?...d 0x0010 c0a8 016c 0800 5dd0
9a2f 0000
...l..../.. Response fm dst machine 111037.45
8260 192.168.1.108 gt 192.168.1.100 icmp echo
reply (ttl 64, id 117, len 28) 0x0000 4500
001c 0075 0000 4001 f64b c0a8 016c
E....u.._at_..K...l 0x0010 c0a8 0164 0000 65d0
9a2f 0000 0000 0000 ...d..e../...... 0x002
0 0000 0000 0000 0000 0000 0000 0000
..............
15
Testing IDS signatures on Snort Probing Port 80
with ECN/CWR Hping syntax noted
below monkeylabs/home/don hping -X -Y
192.168.1.108 -p 80 -c 1 HPING 192.168.1.108
(eth0 192.168.1.108) XY set, 40 headers 0 data
bytes --- 192.168.1.108 hping statistic --- 1
packets tramitted, 0 packets received, 100
packet loss round-trip min/avg/max 0.0/0.0/0.0
ms Tcpdump syntax noted below /home/don
tcpdump -nXvSs 0 tcp and host 192.168.1.100 and
192.168.1.108 tcpdump listening on eth0
16
Packet as it leaves 084200.081599
192.168.1.100.1215 gt 192.168.1.108.80 WE tcp
sum ok win 512 (ttl 64, id 29279, len
40) 0x0000 4500 0028 725f 0000 4006 8450 c0a8
0164 E..(r_.._at_..P...d 0x0010 c0a8 016c
04bf 0050 460e ae8b 6c89 fe96
...l...PF...l... 0x0020 50c0 0200 c43a 0000

P...... Packet as it arrives 084058.589496
192.168.1.100.1215 gt 192.168.1.108.80 WE tcp
sum ok win 512 (ttl 64, id 29279, len
40) 0x0000   4500 0028 725f 0000 4006 8450 c0a8
0164        E..(r_.._at_..P...d 0x0010   c0a8 016c
04bf 0050 460e ae8b 6c89 fe96        
...l...PF...l... 0x0020   50c0 0200 c43a 0000
0000 0000 0000             P............
17
Snort output below 03/03-084058.589496
0C6E8CD461 -gt 050DAC59D8B type0x800
len0x3C 192.168.1.1001215 -gt 192.168.1.10880
TCP TTL64 TOS0x0 ID29279 IpLen20
DgmLen40 12 Seq 0x460EAE8B  Ack
0x6C89FE96  Win 0x200  TcpLen 20 In the
/var/log/snort/alert file the below noted was
logged as a result of the signature the packet
triggered when it was parsed by
snort. linux/var/log/snort more alert
11111 (spp_stream4) STEALTH ACTIVITY
(unknown) detection 03/03-084058.589496
0C6E8CD461 -gt 050DAC59D8B type0x800
len0x3C 192.168.1.1001215 -gt 192.168.1.10880
TCP TTL64 TOS0x0 ID29279 IpLen20
DgmLen40 12 Seq 0x460EAE8B  Ack
0x6C89FE96  Win 0x200  TcpLen 20
18
LSRR packets Hping syntax noted
below monkeylabs/home/don hping -S --lsrr
192.168.1.108 192.168.1.102 -p 25 -c 1 HPING
192.168.1.102 (eth0 192.168.1.102) S set, 40
headers 0 data bytes --- 192.168.1.102 hping
statistic --- 1 packets tramitted, 0 packets
received, 100 packet loss round-trip min/avg/max
0.0/0.0/0.0 ms Tcpdump syntax noted
below monkeylabs/home/don tcpdump -nXvSs 0 ip
and host 192.168.1.100 and 192.168.1.108 tcpdump
listening on eth0
19
Packet as it leaves 092335.134313
192.168.1.100.1636 gt 192.168.1.108.25 S tcp sum
ok 384787509 384787509(0) win 512 (ttl 64, id
57275, len 48, optlen8 LSRR192.168.1.102
EOL) 0x0000 4700 0030 dfbb 0000 4006 7b22 c0a8
0164 G..0...._at_."...d 0x0010 c0a8 016c
8307 08c0 a801 6600 0664 0019
...l......f..d.. 0x0020 16ef 6435 3ac2 97be
5002 0200 d59f 0000 ..d5...P.......

20
Snort output 03/03-092233.600331
0C6E8CD461 -gt 050DAC59D8B type0x800
len0x3E 192.168.1.1001636 -gt 192.168.1.10825
TCP TTL64 TOS0x0 ID57275 IpLen28
DgmLen48 IP Options (1) gt LSRR S Seq
0x16EF6435  Ack 0x3AC297BE  Win 0x200  TcpLen
20 Taken from the alert file in /var/log/snort/
is what is seen below. 15012 MISC
source route lssre Classification
Potentially Bad Traffic Priority
2 03/03-092233.600331 0C6E8CD461 -gt
050DAC59D8B type0x800 len0x3E 192.168.1.100
1636 -gt 192.168.1.10825 TCP TTL64 TOS0x0
ID57275 IpLen28 DgmLen48 IP Options (1) gt
LSRR S Seq 0x16EF6435  Ack 0x3AC297BE
 Win 0x200  TcpLen 20 Xref gt
http//www.whitehats.com/info/IDS420Xref gt
http//cve.mitre.org/ cgi-bin/cvename.cgi?nameCVE
-1999-0909Xref gt http//www.securityfocus.com/b
id/646
21
Conclusions Packet crafting works for
audits Cant do all scenarios with it Open
source requires more knowledge Blended
environment is best commercial open source It
always comes down to TCP/IP Cost of training far
smaller then the cost of not
22
Questions?