Method2 (against stateless Firewalls)

What is the difference between stateful and stateless firewalls really? Well to understand the difference, you got to understand how a TCP connection looks like: the client sends a TCP packet with the SYN flag set, the server responds with a TCP packet with the SYN and the ACKL flags set. Thereafter the server and the client send TCP packets with the ACK flag set. To ensure two-way communication, stateless firewalls usually have a rule (the very last rule) that states that “established” connections are allowed; packets with the ACK flag set. How does this help us? Well, if I send a packet to a server with only the ACK flag set, the server will respond with a RST (reset) flag. This is due to the fact that the server does not know why I am sending a packet with only the ACK flag set (in other words it says: “hey! We haven’t performed a 3 way handshake – bugger off”). Thus, if the machine is alive we WILL get a response – a RST packet.

How do we do it? Simple – there a nifty tool called hping that does this (and a lot more). Let us see how. Lets send a packet with only the ACK flag set- hping will detect if anything comes back. We run hping against a machine that sits behind a stateless firewall: (first we ping it to show you what happens)

# ping -c 3 196.35.xxx.12

PING 196.35.xxx.12 (196.35.xxx.12): 56 data bytes

--- 196.35.xxx.12 ping statistics ---

3 packets transmitted, 0 packets received, 100% packet loss

Now hping:

# hping 196.35.xxx.12 -c 3 -A

HPING 196.35.xxx.12 (ep0 196.35.xxx.12): A set, 40 headers + 0 data bytes

46 bytes from 196.35.xxx.12: flags=R seq=0 ttl=115 id=20664 win=0 rtt=2088.2 ms

46 bytes from 196.35.xxx.12: flags=R seq=1 ttl=115 id=20665 win=0 rtt=2180.1 ms

46 bytes from 196.35.xxx.12: flags=R seq=2 ttl=115 id=20666 win=0 rtt=2130.1 ms

--- 196.35.xxx.12 hping statistic ---

3 packets tramitted, 3 packets received, 0% packet loss

round-trip min/avg/max = 2088.2/2132.8/2180.1 ms

Although the machine does not respond to ICMP ping packets, it responds with a RST flag if we send an ACK flag. So – there we go – a real TCP ping. How do we hping a lot of hosts? Here’s a quick & dirty PERL script that will do it for you:

#!/usr/bin/perl

# Usage: perl hpings startip-endip 'parameters_to_hping'

# eg. hpings 160.124.19.0-160.124.19.10 '-A -c 2'

$|=1;

@een=split(/-/,@ARGV[0]);

@ip1=split(/\./,@een[0]);

- 29 - Breaking into computer networks from the Internet [Roelof Temmingh & SensePost]

@ip2=split(/\./,@een[$#een]);

for ($a=@ip1[0]; $a<1+@ip2[0]; $a++) {

for ($b=@ip1[1]; $b<1+@ip2[1]; $b++) {

for ($c=@ip1[2]; $c<1+@ip2[2]; $c++) {

for ($d=@ip1[3]; $d<1+@ip2[3]; $d++) {

print "$a.$b.$c.$d : ";

system "hping $a.$b.$c.$d @ARGV[1]";

}}}}