Date: Mon, 19 Apr 1999 14:01:40 -0400 (EDT) From: Daniel Hagan <dhagan@cs.vt.edu> To: security@freebsd.org Subject: poink attack (was Re: ARP problem in Windows9X/NT) Message-ID: <Pine.OSF.4.02.9904191359140.15184-100000@vtopus.cs.vt.edu>
next in thread | raw e-mail | index | archive | help
I don't have time to find the archive URL for this post right now, but
this should give people something to work with. The header to the code
has a URL reference to another (originating ?) article.
Daniel
--
Daniel Hagan
Computer Systems Engineer
dhagan@cs.vt.edu
---------- Forwarded message ----------
Date: Tue, 13 Apr 1999 11:25:34 -0700
From: route@RESENTMENT.INFONEXUS.COM
To: BUGTRAQ@NETSPACE.ORG
Subject: Re: ARP problem in Windows9X/NT
[kay wrote]
|
| Could you be more specific with those XX-fields ?
The source ethernet address appears to be arbitrary. The destination
ethernet address needs to be either the address of the target host, or
a broadcast address.
| I started writing that proggie with plain syscalls, but it would only run
| on Linux, so I modified one of the examples in Route's Libnet 0.9 to do
| the stuff. I haven't tested it yes since I don't have LAN at home...
Didn't test your code. Rolled my from the same libnet example, and it
does work against NT and 95/98.
| For those who are still wondering what the hell Libnet is: check out
| http://www.infonexus.com/~demon9
My site has moved temporarily to http://lazy.accessus.net/~route.
Libnet is hosted there for the time being
(http://lazy.accessus.net/~route/Libnet) but will move to
http://www.packetfactory.net when I get that site up.
For those of you who don't know, Libnet is a library for portable
injection. It is the `libpwrite` analog to libpcap. I suppose this is
as good a time as any to announce the release of version 0.99 which adds
a lot of new functionality and fixes a few bugs.
Oh yah. Here's poink. Poink-poink!
/*
* $Id$
*
* poink.c - NT/9x DOS attack
*
* Code:
* Copyright (c) 1999 Mike D. Schiffman <mike@infonexus.com>
* route|daemon9 <route@infonexus.com>
* All rights reserved.
*
* Original Idea:
* Joel Jacobson (joel@mobila.cx)
*
* This simple exploit was written as per the specification from Joel
* Jacobson's bugtraq post (http://geek-girl.com/bugtraq/1999_1/1299.html).
*
* Needs libnet 0.99.
* Currently: http://lazy.accessus.net/~route/libnet
* Soon: http://www.packetfactory.net/
*
* gcc poink.c -o poink -lnet
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
*/
[ Source program cut, see geek-girl.com for archive ]
--
I live a world of paradox... My willingness to destroy is your chance for
improvement, my hate is your faith -- my failure is your victory, a victory
that won't last.
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.OSF.4.02.9904191359140.15184-100000>