banner

[Rule] Rules  [Home] Main Forum  [Portal] Portal  
[Members] Member Listing  [Statistics] Statistics  [Search] Search  [Reading Room] Reading Room 
[Register] Register  
[Login] Loginhttp  | https  ]
 
Forum Index Thảo luận hệ điều hành *nix Làm thế nào để gán TCP options khi inject packet bằng nemesis?  XML
  [Question]   Làm thế nào để gán TCP options khi inject packet bằng nemesis? 17/06/2009 06:04:07 (+0700) | #1 | 183733
[Avatar]
quanta
Moderator

Joined: 28/07/2006 14:44:21
Messages: 7265
Location: $ locate `whoami`
Offline
[Profile] [PM]
Chào các bạn,

Mình đang thực hành nemesis. Bây giờ mình muốn tạo một packet với các TCP options: Maximum segment size (MSS) bằng x, Window Scale option (WSopt) bằng y, Timestamp option (TSopt) bằng z, ... Trong man page của nemesis-tcp cũng chỉ vẻn vẹn có thế này:
Code:
-o TCP-options-file
              This  will  cause nemesis-dns to use the specified TCP-options-file as the options when
              building the TCP header for the injected packet.  TCP options can be up to 40 bytes  in
              length.   The TCP options file must be created manually based upon the desired options.
              TCP options can also be read from stdin by specifying '-o -' instead of a  TCP-options-
              file.


Không hiểu cái TCP options file này có cấu trúc thế nào: ASCII, hex, raw, ...?

Để thử, mình nghĩ ra một cách là: trong Wireshark, mình chọn Follow TCP stream options của một packet nào đó, rồi lưu lại dưới vài dạng như: ASCII, hex, ... Sau đó, dùng làm input cho nemesis như sau:
Code:
sudo nemesis tcp -v -fS -D localhost -o /path/to/<TCP_options_file>

thì gặp thông báo:
Code:
TCP Packet Injection -=- The NEMESIS Project Version 1.4 (Build 26)

                [IP] 23.93.175.115 > 127.0.0.1
             [IP ID] 63957
          [IP Proto] TCP (6)
            [IP TTL] 255
            [IP TOS] 0x00
    [IP Frag offset] 0x0000
     [IP Frag flags] 
         [TCP Ports] 9409 > 8188
         [TCP Flags] SYN 
[TCP Urgent Pointer] 0
   [TCP Window size] 4096
    [TCP Seq number] 1020184460

Wrote 80 byte TCP packet.
*** glibc detected *** nemesis: double free or corruption (out): 0x0805dc48 ***
======= Backtrace: =========
/lib/libc.so.6[0xb7ec2564]
/lib/libc.so.6(cfree+0x90)[0xb7ec6010]
nemesis[0x8055d27]
nemesis[0x805379e]
nemesis[0x8054b59]
/lib/libc.so.6(__libc_start_main+0xe0)[0xb7e6d390]
nemesis[0x8048e51]
======= Memory map: ========
08048000-0805c000 r-xp 00000000 08:03 1198419    /usr/local/bin/nemesis
0805c000-0805d000 rw-p 00014000 08:03 1198419    /usr/local/bin/nemesis
0805d000-0807e000 rw-p 0805d000 00:00 0          [heap]
b7c00000-b7c21000 rw-p b7c00000 00:00 0 
b7c21000-b7d00000 ---p b7c21000 00:00 0 
b7d49000-b7d4b000 rw-p b7d49000 00:00 0 
b7d4b000-b7d4f000 r-xp 00000000 08:03 1020182    /usr/lib/libXdmcp.so.6.0.0
b7d4f000-b7d50000 rw-p 00003000 08:03 1020182    /usr/lib/libXdmcp.so.6.0.0
b7d50000-b7d52000 r-xp 00000000 08:03 1020151    /usr/lib/libXau.so.6.0.0
b7d52000-b7d53000 rw-p 00001000 08:03 1020151    /usr/lib/libXau.so.6.0.0
b7d53000-b7d69000 r-xp 00000000 08:03 1020332    /usr/lib/libxcb.so.1.0.0
b7d69000-b7d6a000 rw-p 00015000 08:03 1020332    /usr/lib/libxcb.so.1.0.0
b7d6a000-b7d6b000 r-xp 00000000 08:03 1020345    /usr/lib/libxcb-xlib.so.0.0.0
b7d6b000-b7d6c000 rw-p 00000000 08:03 1020345    /usr/lib/libxcb-xlib.so.0.0.0
b7d6c000-b7e4f000 r-xp 00000000 08:03 1020134    /usr/lib/libX11.so.6.2.0
b7e4f000-b7e52000 rw-p 000e3000 08:03 1020134    /usr/lib/libX11.so.6.2.0
b7e52000-b7e53000 rw-p b7e52000 00:00 0 
b7e53000-b7e55000 r-xp 00000000 08:03 960416     /lib/libdl-2.7.so
b7e55000-b7e56000 r--p 00001000 08:03 960416     /lib/libdl-2.7.so
b7e56000-b7e57000 rw-p 00002000 08:03 960416     /lib/libdl-2.7.so
b7e57000-b7f9c000 r-xp 00000000 08:03 960413     /lib/libc-2.7.so
b7f9c000-b7f9d000 ---p 00145000 08:03 960413     /lib/libc-2.7.so
b7f9d000-b7f9f000 r--p 00145000 08:03 960413     /lib/libc-2.7.so
b7f9f000-b7fa0000 rw-p 00147000 08:03 960413     /lib/libc-2.7.so
b7fa0000-b7fa3000 rw-p b7fa0000 00:00 0 
b7fa3000-b7fc7000 r-xp 00000000 08:03 960417     /lib/libm-2.7.so
b7fc7000-b7fc8000 r--p 00023000 08:03 960417     /lib/libm-2.7.so
b7fc8000-b7fc9000 rw-p 00024000 08:03 960417     /lib/libm-2.7.so
b7fc9000-b7fdd000 r-xp 00000000 08:03 960419     /lib/libnsl-2.7.so
b7fdd000-b7fde000 r--p 00013000 08:03 960419     /lib/libnsl-2.7.so
b7fde000-b7fdf000 rw-p 00014000 08:03 960419     /lib/libnsl-2.7.so
b7fdf000-b7fe1000 rw-p b7fdf000 00:00 0 
b7fe1000-b7ff0000 r-xp 00000000 08:03 960428     /lib/libresolv-2.7.so
b7ff0000-b7ff1000 r--p 0000f000 08:03 960428     /lib/libresolv-2.7.so
b7ff1000-b7ff2000 rw-p 00010000 08:03 960428     /lib/libresolv-2.7.so
b7ff2000-b7ff4000 rw-p b7ff2000 00:00 0 
b7ffd000-b8007000 r-xp 00000000 08:03 394069     /usr/lib/libgcc_s.so.1
b8007000-b8008000 rw-p 00009000 08:03 394069     /usr/lib/libgcc_s.so.1
b8008000-b8011000 r-xp 00000000 08:03 960422     /lib/libnss_files-2.7.so
b8011000-b8012000 r--p 00008000 08:03 960422     /lib/libnss_files-2.7.so
b8012000-b8013000 rw-p 00009000 08:03 960422     /lib/libnss_files-2.7.so
b8013000-b8014000 rw-p b8013000 00:00 0 
b8014000-b801b000 r-xp 00000000 08:03 961954     /lib/xvnkb.so.0.2.9a-2
b801b000-b8021000 rw-p 00007000 08:03 961954     /lib/xvnkb.so.0.2.9a-2
b8021000-b8023000 rw-p b8021000 00:00 0 
b8023000-b803f000 r-xp 00000000 08:03 960455     /lib/ld-2.7.so
b803f000-b8040000 r--p 0001b000 08:03 960455     /lib/ld-2.7.so
b8040000-b8041000 rw-p 0001c000 08:03 960455     /lib/ld-2.7.so
bf92c000-bf941000 rw-p bffeb000 00:00 0          [stack]
ffffe000-fffff000 r-xp 00000000 00:00 0          [vdso]
Aborted

Trên một cửa sổ khác đang chạy sudo tcpdump -v -i lo tcp mình thu được:
Code:
16:57:12.231935 IP (tos 0x0, ttl 255, id 63957, offset 0, flags [none], proto TCP (6), length 80)
    23.93.175.115.9409 > localhost.8188: Flags [S], seq 1020184460, win 4096, options [[bad opt]
16:57:12.231955 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 40)
    localhost.8188 > localhost.9409: Flags [R.], cksum 0x20e6 (incorrect -> 0x68b5), seq 0, ack 1020184461, win 0, length 0


Vậy là bị bad options rồi.

Mọi người giúp mình giải quyết chỗ này với?

Cảm ơn.
Let's build on a great foundation!
[Up] [Print Copy]
[digg] [delicious] [google] [yahoo] [technorati] [reddit] [stumbleupon]
Go to: 
 Users currently in here 
1 Anonymous

Powered by JForum - Extended by HVAOnline
 hvaonline.net  |  hvaforum.net  |  hvazone.net  |  hvanews.net  |  vnhacker.org
1999 - 2013 © v2012|0504|218|