Chapter 13 exploiting the ICMP protocol
the unauthorized reproduction in whole or in part of this publication in any form is prohibited.
In this chapter we will get to know how the ICMP protocol works.
Let's start by learning about the basic tools ping and traceroute.
We'll look at the useful option of the ping program and see how they work.
Thanks to the paramita minus C minus s and minus t..
It is possible to determine the number of ICMP packets sent as well as their sizes and time to live
or TTL
as we can see after terminating the lifetime of packet number two we see the information we need on
the screen.
After investigating the root of the packet with the trace route program we discover why the packet has
been rejected by the second node.
Radio we can now test the option that will be helpful during the attack.
The first of them is the minus option which determines the packet sending interval.
Another option is minus F which causes flooding with large number of packets.
This option is available only to the system administrator as we can see within less than a second.
We managed to send 10000 packets
but let's try to improve our performance using a specially prepared program.
We will now copy the files we need.
Our program uses raw sockets to send packets after properly filling in the IP and ICMP structures.
The packet can be sent.
We will find the description of the specific structures in the header files.
Finally after having filled in the structures it is possible to create a RA type socket using the socket
function we will now check the functioning of our program.
We should remember that to create a raw socket administrator privileges are required
each dot printed on the screen represents one sent packing.
Let's save the output of our program and count the number of dots in the program
as we can see within approximately five seconds we had managed to send almost 400000 packets.
Now let's consider the ICMP protocol for other purposes.
This protocol is often used in back doors.
Let's have a look at examples.
As we can see the sending of the ICMP packet generates significantly fewer suspicious records in the
net set program to a hacker.
This is a huge advantage.
Now we'll unpacking compile the netcat program that will transmit data in the next example.
Our back door will create a raw socket that will analyze the packets being received when it intercepts
two packets differing in size by 1337.
It will start up the netcat program
as we can see after starting up the back door.
The next step program indicates the presence of only the raw socket.
After having sent two ICMP packets differing in size by 1337 a netcat application has been started that
enables access to the shell.
Unfortunately the connection with the shell is visible at first glance.
To prevent this we will use our next program
the client program will send a properly prepared ICMP packet containing the password and the name of
the file to send
while the server program.
After registering an appropriate packet will send the indicated data in the answer.
Let's compile our programs and see them work.
We have been successful.
The server returned the content of the indicated file this time the net stat program has indicated the
presence of only the raw socket.