Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 19 Apr 1999 11:24:59 -0700 (PDT)
From:      Liam Slusser <liam@tiora.net>
To:        security@FreeBSD.ORG
Subject:   Re: poink attack (was Re: ARP problem in Windows9X/NT)
Message-ID:  <Pine.GSO.4.05.9904191121140.29844-100000@kinetic.tiora.net>
In-Reply-To: <Pine.OSF.4.02.9904191359140.15184-100000@vtopus.cs.vt.edu>

next in thread | previous in thread | raw e-mail | index | archive | help

In a earlier email Chris <freebsd@hiway1.exit109.com>
said his fbsd 3.x was affected...and also said arp errors in
/var/log/messages in 2.2.5....but this looks like a WinNT/9x DoS from
the geek-girl report here. Is fbsd affected..and if so..what versions? 
Thanks!  ;)

liam   

System Administrator Tiora Networks | www.tiora.net <---- tiora's webpage
www.tiora.net/~liam <----- homepage | liam@tiora.net <-- my email address
Lowered turbo powered Honda Civic's are really cool. <---------- my quote

On Mon, 19 Apr 1999, Daniel Hagan wrote:

> I don't have time to find the archive URL for this post right now, but
> this should give people something to work with.  The header to the code
> has a URL reference to another (originating ?) article.
> 
> Daniel
> 
> -- 
> Daniel Hagan
> Computer Systems Engineer
> dhagan@cs.vt.edu
> 
> ---------- Forwarded message ----------
> Date: Tue, 13 Apr 1999 11:25:34 -0700
> From: route@RESENTMENT.INFONEXUS.COM
> To: BUGTRAQ@NETSPACE.ORG
> Subject: Re: ARP problem in Windows9X/NT
> 
> [kay wrote]
> |
> | Could you be more specific with those XX-fields ?
> 
>     The source ethernet address appears to be arbitrary.  The destination
>     ethernet address needs to be either the address of the target host, or
>     a broadcast address.
> 
> | I started writing that proggie with plain syscalls, but it would only run
> | on Linux, so I modified one of the examples in Route's Libnet 0.9 to do
> | the stuff. I haven't tested it yes since I don't have LAN at home...
> 
>     Didn't test your code.  Rolled my from the same libnet example, and it
>     does work against NT and 95/98.
> 
> | For those who are still wondering what the hell Libnet is: check out
> | http://www.infonexus.com/~demon9
> 
>     My site has moved temporarily to http://lazy.accessus.net/~route.
>     Libnet is hosted there for the time being
>     (http://lazy.accessus.net/~route/Libnet) but will move to
>     http://www.packetfactory.net when I get that site up.
> 
>     For those of you who don't know, Libnet is a library for portable
>     injection.  It is the `libpwrite` analog to libpcap.  I suppose this is
>     as good a time as any to announce the release of version 0.99 which adds
>     a lot of new functionality and fixes a few bugs.
> 
>     Oh yah.  Here's poink.  Poink-poink!
> 
> /*
>  *  $Id$
>  *
>  *  poink.c - NT/9x DOS attack
>  *
>  *  Code:
>  *  Copyright (c) 1999 Mike D. Schiffman <mike@infonexus.com>
>  *                         route|daemon9 <route@infonexus.com>
>  *  All rights reserved.
>  *
>  *  Original Idea:
>  *  Joel Jacobson (joel@mobila.cx)
>  *
>  *  This simple exploit was written as per the specification from Joel
>  *  Jacobson's bugtraq post (http://geek-girl.com/bugtraq/1999_1/1299.html).
>  *
>  *  Needs libnet 0.99.
>  *  Currently:  http://lazy.accessus.net/~route/libnet
>  *  Soon:       http://www.packetfactory.net/
>  *
>  *  gcc poink.c -o poink -lnet
>  *
>  * Redistribution and use in source and binary forms, with or without
>  * modification, are permitted provided that the following conditions
>  * are met:
>  * 1. Redistributions of source code must retain the above copyright
>  *    notice, this list of conditions and the following disclaimer.
>  * 2. Redistributions in binary form must reproduce the above copyright
>  *    notice, this list of conditions and the following disclaimer in the
>  *    documentation and/or other materials provided with the distribution.
>  *
>  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
>  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
>  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
>  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
>  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
>  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
>  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
>  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
>  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
>  * SUCH DAMAGE.
>  *
>  */
> 
> [ Source program cut, see geek-girl.com for archive ]
> 
> --
> I live a world of paradox... My willingness to destroy is your chance for
> improvement, my hate is your faith -- my failure is your victory, a victory
> that won't last.
> 
> 
> 
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message
> 



To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.GSO.4.05.9904191121140.29844-100000>