Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1182453 > unrolled thread

Re: [PATCH v2] add stealth mode

Back to article view | Back to linux.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: [PATCH v2] add stealth mode Matteo Croce <matteo@openwrt.org> - 2015-07-13 01:20 +0200
    Re: [PATCH v2] add stealth mode Austin S Hemmelgarn <ahferroin7@gmail.com> - 2015-07-13 15:10 +0200
      Re: [PATCH v2] add stealth mode Matteo Croce <matteo@openwrt.org> - 2015-07-14 17:00 +0200

#1182453 — Re: [PATCH v2] add stealth mode

2015-07-08 15:32 GMT+02:00 Austin S Hemmelgarn <ahferroin7@gmail.com>:
> On 2015-07-06 15:44, Matteo Croce wrote:
> Just to name a few that I know of off the top of my head:
> 1. IP packets with any protocol number not supported by your current kernel
> (these return a special ICMP message).

Right, I'll handle them

> 2. SCTP INIT and COOKIE_ECHO chunks when you have SCTP enabled in the
> kernel.

Well, I've never played with SCTP before

> 3. Theoretically, some IGMP messages.
> 4. NDP messages.
> 5. ARP queries looking for the machine's IP addresses.

Yes I know, but it's unlikely to receive this packets from WAN, right?
My flag is intended to be used mostly on WAN interfaces,
machines in LAN should be easily discoverable IMHO

> 6. Certain odd flag combinations on single TCP packets (check the
> documentation for Nmap for more info regarding these), which I believe
> (although I may be reading the code wrong) you aren't accounting for.

I've tried many TCP flags combination with hping3, NUL, SYN/ACK, ACK,
SYN/FIN, etc.
They doesn't get any response when the flag is set

> 7. DAD queries.

Never looked at this packets, are a subset of NDP?

> 8. ICMP address mask queries (which you also don't appear to account for).

It's deprecated and actually it doesn't get any response already

> This is by no means an exhaustive list, but all of them really should be
> addressed if you want to do this properly.
>
>

Thank you,
-- 
Matteo Croce
OpenWrt Developer
  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 CHAOS CALMER
 -----------------------------------------------------
  * 1 1/2 oz Gin            Shake with a glassful
  * 1/4 oz Triple Sec       of broken ice and pour
  * 3/4 oz Lime Juice       unstrained into a goblet.
  * 1 1/2 oz Orange Juice
  * 1 tsp. Grenadine Syrup
 -----------------------------------------------------
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [next] | [standalone]

#1182799

[Multipart message — attachments visible in raw view] — view raw

On 2015-07-12 19:13, Matteo Croce wrote:
> 2015-07-08 15:32 GMT+02:00 Austin S Hemmelgarn <ahferroin7@gmail.com>:
>> On 2015-07-06 15:44, Matteo Croce wrote:
>> Just to name a few that I know of off the top of my head:
>> 1. IP packets with any protocol number not supported by your current kernel
>> (these return a special ICMP message).
>
> Right, I'll handle them
>
>> 2. SCTP INIT and COOKIE_ECHO chunks when you have SCTP enabled in the
>> kernel.
>
> Well, I've never played with SCTP before
It should still be checked, as should DCCP and RDS (those are the only 
other Layer 3 protocols that I have ever actually seen people try to 
scan hosts with besides TCP/UDP/SCTP).  SCTP itself is not hugely 
prevalent outside of some clustering uses, but it is still seen on the 
internet sometimes (for example, Gentoo has optional patches for OpenSSH 
to use SCTP).
>
>> 3. Theoretically, some IGMP messages.
>> 4. NDP messages.
>> 5. ARP queries looking for the machine's IP addresses.
>
> Yes I know, but it's unlikely to receive this packets from WAN, right?
> My flag is intended to be used mostly on WAN interfaces,
> machines in LAN should be easily discoverable IMHO.
In theory it's unlikely, but if you use any kind of IPv4 multicast on 
the WAN you will get IGMP (and MLD for IPv6 multicast).  You may also 
get some NDP queries also if you are using IPv6 and your WAN is itself 
behind a NAT router (and yes, there are ISP's who do that).
>
>> 6. Certain odd flag combinations on single TCP packets (check the
>> documentation for Nmap for more info regarding these), which I believe
>> (although I may be reading the code wrong) you aren't accounting for.
>
> I've tried many TCP flags combination with hping3, NUL, SYN/ACK, ACK,
> SYN/FIN, etc.
> They doesn't get any response when the flag is set
How about FIN/ACK and FIN/PSH/URG?
>
>> 7. DAD queries.
>
> Never looked at this packets, are a subset of NDP?
Kind of, it's an ICMPv6 extension for detecting if SLACC configured 
address is already in use.  Most distro's have support for it enabled by 
default.
>> 8. ICMP address mask queries (which you also don't appear to account for).
>
> It's deprecated and actually it doesn't get any response already
Just because it's deprecated doesn't mean you shouldn't account for it, 
although it does appear to get dropped by default by the kernel.

You should also test how different combinations of sysctls under 
/proc/sys/net affect this (there are for example already sysctls for 
ignoring certain types of ICMP packets).

[toc] | [prev] | [next] | [standalone]

#1183762

2015-07-13 15:03 GMT+02:00 Austin S Hemmelgarn <ahferroin7@gmail.com>:
> How about FIN/ACK and FIN/PSH/URG?

Silent:

root@debian64:~# hping3 192.168.0.2 -p 32 -FA
HPING 192.168.0.2 (eth0 192.168.0.2): AF set, 40 headers + 0 data bytes
^C
--- 192.168.0.2 hping statistic ---
3 packets transmitted, 0 packets received, 100% packet loss
round-trip min/avg/max = 0.0/0.0/0.0 ms
root@debian64:~# hping3 192.168.0.2 -p 32 -FPU
HPING 192.168.0.2 (eth0 192.168.0.2): FPU set, 40 headers + 0 data bytes
^C
--- 192.168.0.2 hping statistic ---
3 packets transmitted, 0 packets received, 100% packet loss
round-trip min/avg/max = 0.0/0.0/0.0 ms


Matteo Croce
OpenWrt Developer
  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 CHAOS CALMER
 -----------------------------------------------------
  * 1 1/2 oz Gin            Shake with a glassful
  * 1/4 oz Triple Sec       of broken ice and pour
  * 3/4 oz Lime Juice       unstrained into a goblet.
  * 1 1/2 oz Orange Juice
  * 1 tsp. Grenadine Syrup
 -----------------------------------------------------
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web