PLUS 내부 세미나 1/22 The Libnet Library 이병영 2004/05/06.
-
Upload
edwina-franklin -
Category
Documents
-
view
224 -
download
1
description
Transcript of PLUS 내부 세미나 1/22 The Libnet Library 이병영 2004/05/06.
PLUS 내부 세미나 2/22
CONTENTS
Introduction of libnet Building packets (with libnet-1.1)
Four steps to send a packet Practical use example with libnet
ARP spoofing TCP RESET attack
PLUS 내부 세미나 3/22
Introduction of Libnet
Libnet is a C library providing a high-level interface to packet injection.
Previous to libnet, programmers had to wrestle with confusing, obscure, and poorly documented interfaces to build and write network packets .
PLUS 내부 세미나 4/22
Introduction of Libnet
PLUS 내부 세미나 5/22
Introduction of Libnet
Libnet is a wonderful utility for writing security-related applications, tools and modules.
Many recent exploits and tools have been rapidly developed using libnet.
PLUS 내부 세미나 6/22
Building packets
Libnet contexts
typedef struct { ... /* some declarations */ } libnet_t;
PLUS 내부 세미나 7/22
Building packets Libnet pblock(packet block)
struct libnet_protocol_block { … /* some declarations */ }; typedef struct libnet_protocol_block libnet_pblock_t;
PLUS 내부 세미나 8/22
Building packets - our example’s plan
Suppose that we want to build a simple UDP packet work in link layer level
So we have to builda UDP, IPV4, ethernet header(pblock)in libnet contexts.
PLUS 내부 세미나 9/22
PLUS 내부 세미나 10/22
Building packets (1)Initializing the context
libnet_t* libnet_init ( int injection_type, char * device, char * err_buf)
injection type Decides your working level LIBNET_RAW4, LIBNET_LINK
device Specify the device you will use
err_buf Buffer to write the error message
PLUS 내부 세미나 11/22
Building packets (2)Building pblock (UDP)
Build a UDP headerlibnet_ptag_t libnet_build_udp( u_int16_t sp, // The src UDP port
u_int16_t dp, // The dst UDP portu_int16_t len, // Length of UDP pac
ket u_int16_t sum, // Checksum, 0 for libnet autofill u_int8_t *payload, // Optional payload u_int32_t payload_s, // Payload size
libnet_t *l, // The libnet context pointer libnet_ptag_t ptag // Protocol tag
);
PLUS 내부 세미나 12/22
Building packets (2)Building pblock (IPV4)
Build a IPV4 header libnet_ptag_t libnet_build_ipv4(
u_int16_t len, // Length of IPV4 packetu_int8_t tos, // Type of service bitsu_int16_t id, // IP identificationu_int16_t frag, // Fragmentation bitsu_int8_t ttl, // Time to liveu_int8_t prot, // Upper layer protocolu_int16_t sum, // Checksum, 0 for libnet autofillu_int32_t src, // Src IP addressu_int32_t dst, // Dst IP addressu_int8_t *payload, // Optional payload
u_int32_t payload_s, // Payload sizelibnet_t *l, // The libnet context pointerlibnet_ptag_t ptag); // Protocol tag
PLUS 내부 세미나 13/22
Building packets (2)Building pblock (Ethernet)
Bulid a ethernet headerlibnet_ptag_t libnet_build_ethernet(
u_int8_t *dst, // Dst ethernet addressu_int8_t *src, // Src ethernet addressu_int16_t type, // Upper layer typeu_int8_t *payload, // Optional payloadu_int32_t payload_s, // Payload sizelibnet_t *l, // The libnet context pointer
libnet_ptag_t ptag); // Protocal tag
PLUS 내부 세미나 14/22
Building packets (3)Write the packet to wire
After building pblock, just call the function libnet_write with argument of libnet_t pointer.
int libnet_write ( libnet_t * ) Returns the amount of bytes
written to the wire.
PLUS 내부 세미나 15/22
Building packets (4)Clean up a libnet context
void libnet_destroy ( libnet_t * ) This function frees memeory of libnet context.
PLUS 내부 세미나 16/22
PLUS 내부 세미나 17/22
Building packets- confirm with tcpdump
PLUS 내부 세미나 18/22
Practical use – (1) ARP spoofing
PLUS 내부 세미나 19/22
Practical use – (2) TCP RESET attack
In a traditional sequence number attack, the exact sequence number considered valid and accepted by the receiving TCP endpoint.
The utilization of the TCP window size to reduce the number of sequence numbers that must be guessed.
More details are in document “Slippling in the window : TCP Reset Attacks”.
PLUS 내부 세미나 20/22
Practical use – (2) TCP RESET attack
PLUS 내부 세미나 21/22
Practical use – (2) TCP RESET attack
PLUS 내부 세미나 22/22
References 1. Libnet reference manual
http://www.packetfactory.net/libnet/dist/deprecated/manual
2. Building packets for dummies and others with libnet http://www.security-labs.org/index.php3?page=libnet
3. TCP/IP Illustrated, Volume1 by Stevens
4. Slippling in the window : TCP Reset Attacks http://www.frame4.com/php/printout2615.html