No subject


Thu Nov 23 16:34:03 EST 2017


James Edwards
Routing and Security Administrator
jamesh at ...225...
At the Santa Fe Office: Internet at Cyber Mesa


----- Original Message ----- 
From: "Jason Frisvold" <friz at ...2...>
To: <nanog at ...1680...>
Sent: Friday, July 18, 2003 10:08 AM
Subject: SC Signature and HPING Signature

For those interested, these are the packet dumps of all 4 protocols
using HPing and the release ShadowChode exploit.

I'm told you can create the necessary IDS filters from this.. we're
working on this now as well...  :)  I'm not an IDS expert, so I don't
have the know-how to do this... yet..  :)

-----Forwarded Message-----
From: Keith Pachulski

Output below is from both the SC code and hping performing the same as
SC. Feel free to develop your signatures from it.

SC Exploit
11:59:59.014190 79.111.123.116 > dhcp9-1.noc.corp.ptd.net:  swipe 181
0x0000   4500 00c9 bf25 0000 0235 fe3b 4f6f 7b74        E....%...5.;Oo{t
0x0010   ccba 6301 0001 0203 0405 0607 0809 0a0b        ..c.............
0x0020   0c0d 0e0f 1011 1213 1415 1617 1819 1a1b        ................
0x0030   1c1d 1e1f 2021 2223 2425 2627 2829 2a2b        .....!"#$%&'()*+
0x0040   2c2d 2e2f 3031 3233 3435 3637 3839 3a3b        ,-./0123456789:;
0x0050   3c3d 3e3f 4041 4243 4445 4647 4849 4a4b        <=>?@ABCDEFGHIJK
0x0060   4c4d 4e4f 5051 5253 5455 5657 5859 5a5b        LMNOPQRSTUVWXYZ[
0x0070   5c5d 5e5f 6061 6263 6465 6667 6869 6a6b        \]^_`abcdefghijk
0x0080   6c6d 6e6f 7071 7273 7475 7677 7879 7a7b        lmnopqrstuvwxyz{
0x0090   7c7d 7e7f 8081 8283 8485 8687 8889 8a8b        |}~.............
0x00a0   8c8d 8e8f 9091 9293 9495 9697 9899 9a9b        ................
0x00b0   9c9d 9e9f a0a1 a2a3 a4a5 a6a7 a8a9 aaab        ................
0x00c0   acad aeaf b0b1 b2b3 b4                         .........
11:59:59.014402 dhcp9-1.noc.corp.ptd.net > 79.111.123.116: icmp:
dhcp9-1.noc.corp.ptd.net protocol 53 unreachable [tos 0xc0] 

0x0000   45c0 00e5 80f8 0000 4001 fdc0 ccba 6301        E....... at ...1681...
0x0010   4f6f 7b74 0302 df39 0000 0000 4500 00c9        Oo{t...9....E...
0x0020   bf25 0000 0235 fe3b 4f6f 7b74 ccba 6301        .%...5.;Oo{t..c.
0x0030   0001 0203 0405 0607 0809 0a0b 0c0d 0e0f        ................
0x0040   1011 1213 1415 1617 1819 1a1b 1c1d 1e1f        ................
0x0050   2021 2223 2425 2627 2829 2a2b 2c2d 2e2f        .!"#$%&'()*+,-./
0x0060   3031 3233 3435 3637 3839 3a3b 3c3d 3e3f        0123456789:;<=>?
0x0070   4041 4243 4445 4647 4849 4a4b 4c4d 4e4f        @ABCDEFGHIJKLMNO
0x0080   5051 5253 5455 5657 5859 5a5b 5c5d 5e5f        PQRSTUVWXYZ[\]^_
0x0090   6061 6263 6465 6667 6869 6a6b 6c6d 6e6f        `abcdefghijklmno
0x00a0   7071 7273 7475 7677 7879 7a7b 7c7d 7e7f        pqrstuvwxyz{|}~.
0x00b0   8081 8283 8485 8687 8889 8a8b 8c8d 8e8f        ................
0x00c0   9091 9293 9495 9697 9899 9a9b 9c9d 9e9f        ................
0x00d0   a0a1 a2a3 a4a5 a6a7 a8a9 aaab acad aeaf        ................
0x00e0   b0b1 b2b3 b4                                   .....
11:59:59.014380 36.71.143.53 > dhcp9-1.noc.corp.ptd.net: mobile: [] 
(bad checksum 515)
0x0000   4500 00c9 fefc 0000 0237 d5c9 2447 8f35        E........7..$G.5
0x0010   ccba 6301 0001 0203 0405 0607 0809 0a0b        ..c.............
0x0020   0c0d 0e0f 1011 1213 1415 1617 1819 1a1b        ................
0x0030   1c1d 1e1f 2021 2223 2425 2627 2829 2a2b        .....!"#$%&'()*+
0x0040   2c2d 2e2f 3031 3233 3435 3637 3839 3a3b        ,-./0123456789:;
0x0050   3c3d 3e3f 4041 4243 4445 4647 4849 4a4b        <=>?@ABCDEFGHIJK
0x0060   4c4d 4e4f 5051 5253 5455 5657 5859 5a5b        LMNOPQRSTUVWXYZ[
0x0070   5c5d 5e5f 6061 6263 6465 6667 6869 6a6b        \]^_`abcdefghijk
0x0080   6c6d 6e6f 7071 7273 7475 7677 7879 7a7b        lmnopqrstuvwxyz{
0x0090   7c7d 7e7f 8081 8283 8485 8687 8889 8a8b        |}~.............
0x00a0   8c8d 8e8f 9091 9293 9495 9697 9899 9a9b        ................
0x00b0   9c9d 9e9f a0a1 a2a3 a4a5 a6a7 a8a9 aaab        ................
0x00c0   acad aeaf b0b1 b2b3 b4                         .........
11:59:59.014603 dhcp9-1.noc.corp.ptd.net > 36.71.143.53: icmp:
dhcp9-1.noc.corp.ptd.net protocol 55 unreachable [tos 0xc0] 

0x0000   45c0 00e5 5815 0000 4001 3e0b ccba 6301        E...X... at ...180...>...c.
0x0010   2447 8f35 0302 df39 0000 0000 4500 00c9        $G.5...9....E...
0x0020   fefc 0000 0237 d5c9 2447 8f35 ccba 6301        .....7..$G.5..c.
0x0030   0001 0203 0405 0607 0809 0a0b 0c0d 0e0f        ................
0x0040   1011 1213 1415 1617 1819 1a1b 1c1d 1e1f        ................
0x0050   2021 2223 2425 2627 2829 2a2b 2c2d 2e2f        .!"#$%&'()*+,-./
0x0060   3031 3233 3435 3637 3839 3a3b 3c3d 3e3f        0123456789:;<=>?
0x0070   4041 4243 4445 4647 4849 4a4b 4c4d 4e4f        @ABCDEFGHIJKLMNO
0x0080   5051 5253 5455 5657 5859 5a5b 5c5d 5e5f        PQRSTUVWXYZ[\]^_
0x0090   6061 6263 6465 6667 6869 6a6b 6c6d 6e6f        `abcdefghijklmno
0x00a0   7071 7273 7475 7677 7879 7a7b 7c7d 7e7f        pqrstuvwxyz{|}~.
0x00b0   8081 8283 8485 8687 8889 8a8b 8c8d 8e8f        ................
0x00c0   9091 9293 9495 9697 9899 9a9b 9c9d 9e9f        ................
0x00d0   a0a1 a2a3 a4a5 a6a7 a8a9 aaab acad aeaf        ................
0x00e0   b0b1 b2b3 b4                                   .....
11:59:59.014572 57.21.62.14 > dhcp9-1.noc.corp.ptd.net:  nd 181
0x0000   4500 00c9 bcb9 0000 024d 5450 3915 3e0e        E........MTP9.>.
0x0010   ccba 6301 0001 0203 0405 0607 0809 0a0b        ..c.............
0x0020   0c0d 0e0f 1011 1213 1415 1617 1819 1a1b        ................
0x0030   1c1d 1e1f 2021 2223 2425 2627 2829 2a2b        .....!"#$%&'()*+
0x0040   2c2d 2e2f 3031 3233 3435 3637 3839 3a3b        ,-./0123456789:;
0x0050   3c3d 3e3f 4041 4243 4445 4647 4849 4a4b        <=>?@ABCDEFGHIJK
0x0060   4c4d 4e4f 5051 5253 5455 5657 5859 5a5b        LMNOPQRSTUVWXYZ[
0x0070   5c5d 5e5f 6061 6263 6465 6667 6869 6a6b        \]^_`abcdefghijk
0x0080   6c6d 6e6f 7071 7273 7475 7677 7879 7a7b        lmnopqrstuvwxyz{
0x0090   7c7d 7e7f 8081 8283 8485 8687 8889 8a8b        |}~.............
0x00a0   8c8d 8e8f 9091 9293 9495 9697 9899 9a9b        ................
0x00b0   9c9d 9e9f a0a1 a2a3 a4a5 a6a7 a8a9 aaab        ................
0x00c0   acad aeaf b0b1 b2b3 b4                         .........
11:59:59.014837 dhcp9-1.noc.corp.ptd.net > 57.21.62.14: icmp:
dhcp9-1.noc.corp.ptd.net protocol 77 unreachable [tos 0xc0] 

0x0000   45c0 00e5 8357 0000 4001 4f22 ccba 6301        E....W.. at ...1682..."..c.
0x0010   3915 3e0e 0302 df39 0000 0000 4500 00c9        9.>....9....E...
0x0020   bcb9 0000 024d 5450 3915 3e0e ccba 6301        .....MTP9.>...c.
0x0030   0001 0203 0405 0607 0809 0a0b 0c0d 0e0f        ................
0x0040   1011 1213 1415 1617 1819 1a1b 1c1d 1e1f        ................
0x0050   2021 2223 2425 2627 2829 2a2b 2c2d 2e2f        .!"#$%&'()*+,-./
0x0060   3031 3233 3435 3637 3839 3a3b 3c3d 3e3f        0123456789:;<=>?
0x0070   4041 4243 4445 4647 4849 4a4b 4c4d 4e4f        @ABCDEFGHIJKLMNO
0x0080   5051 5253 5455 5657 5859 5a5b 5c5d 5e5f        PQRSTUVWXYZ[\]^_
0x0090   6061 6263 6465 6667 6869 6a6b 6c6d 6e6f        `abcdefghijklmno
0x00a0   7071 7273 7475 7677 7879 7a7b 7c7d 7e7f        pqrstuvwxyz{|}~.
0x00b0   8081 8283 8485 8687 8889 8a8b 8c8d 8e8f        ................
0x00c0   9091 9293 9495 9697 9899 9a9b 9c9d 9e9f        ................
0x00d0   a0a1 a2a3 a4a5 a6a7 a8a9 aaab acad aeaf        ................
0x00e0   b0b1 b2b3 b4                                   .....
11:59:59.015060 43.53.57.126 > dhcp9-1.noc.corp.ptd.net: pim v0
0x0000   4500 00c9 2404 0000 0267 ff5b 2b35 397e        E...$....g.[+59~
0x0010   ccba 6301 0001 0203 0405 0607 0809 0a0b        ..c.............
0x0020   0c0d 0e0f 1011 1213 1415 1617 1819 1a1b        ................
0x0030   1c1d 1e1f 2021 2223 2425 2627 2829 2a2b        .....!"#$%&'()*+
0x0040   2c2d 2e2f 3031 3233 3435 3637 3839 3a3b        ,-./0123456789:;
0x0050   3c3d 3e3f 4041 4243 4445 4647 4849 4a4b        <=>?@ABCDEFGHIJK
0x0060   4c4d 4e4f 5051 5253 5455 5657 5859 5a5b        LMNOPQRSTUVWXYZ[
0x0070   5c5d 5e5f 6061 6263 6465 6667 6869 6a6b        \]^_`abcdefghijk
0x0080   6c6d 6e6f 7071 7273 7475 7677 7879 7a7b        lmnopqrstuvwxyz{
0x0090   7c7d 7e7f 8081 8283 8485 8687 8889 8a8b        |}~.............
0x00a0   8c8d 8e8f 9091 9293 9495 9697 9899 9a9b        ................
0x00b0   9c9d 9e9f a0a1 a2a3 a4a5 a6a7 a8a9 aaab        ................
0x00c0   acad aeaf b0b1 b2b3 b4                         .........
11:59:59.015239 dhcp9-1.noc.corp.ptd.net > 43.53.57.126: icmp:
dhcp9-1.noc.corp.ptd.net protocol 103 unreachable [tos 0xc0] 

0x0000   45c0 00e5 65bf 0000 4001 7f2a ccba 6301        E...e... at ...202...*..c.
0x0010   2b35 397e 0302 df39 0000 0000 4500 00c9        +59~...9....E...
0x0020   2404 0000 0267 ff5b 2b35 397e ccba 6301        $....g.[+59~..c.
0x0030   0001 0203 0405 0607 0809 0a0b 0c0d 0e0f        ................
0x0040   1011 1213 1415 1617 1819 1a1b 1c1d 1e1f        ................
0x0050   2021 2223 2425 2627 2829 2a2b 2c2d 2e2f        .!"#$%&'()*+,-./
0x0060   3031 3233 3435 3637 3839 3a3b 3c3d 3e3f        0123456789:;<=>?
0x0070   4041 4243 4445 4647 4849 4a4b 4c4d 4e4f        @ABCDEFGHIJKLMNO
0x0080   5051 5253 5455 5657 5859 5a5b 5c5d 5e5f        PQRSTUVWXYZ[\]^_
0x0090   6061 6263 6465 6667 6869 6a6b 6c6d 6e6f        `abcdefghijklmno
0x00a0   7071 7273 7475 7677 7879 7a7b 7c7d 7e7f        pqrstuvwxyz{|}~.
0x00b0   8081 8283 8485 8687 8889 8a8b 8c8d 8e8f        ................
0x00c0   9091 9293 9495 9697 9899 9a9b 9c9d 9e9f        ................
0x00d0   a0a1 a2a3 a4a5 a6a7 a8a9 aaab acad aeaf        ................
0x00e0   b0b1 b2b3 b4                                   .....

HPING
11:56:40.024194 dhcp9-52.noc.corp.ptd.net > dhcp9-1.noc.corp.ptd.net: 
swipe 0
0x0000   4500 0014 9f64 0000 0235 b9a6 ccba 6334        E....d...5....c4
0x0010   ccba 6301 0000 0000 0000 0000 0000 0000        ..c.............
0x0020   0000 0000 0000 0000 0000 0000 0000             ..............
11:56:40.024731 dhcp9-1.noc.corp.ptd.net > dhcp9-52.noc.corp.ptd.net:
icmp: dhcp9-1.noc.corp.ptd.net protocol 53 unreachable [tos 0xc0] 

0x0000   45c0 0030 29df 0000 4001 f083 ccba 6301        E..0)... at ...1681...
0x0010   ccba 6334 0302 fcfd 0000 0000 4500 0014        ..c4........E...
0x0020   9f64 0000 0235 b9a6 ccba 6334 ccba 6301        .d...5....c4..c.
11:57:26.534797 dhcp9-52.noc.corp.ptd.net > dhcp9-1.noc.corp.ptd.net: 
nd 0
0x0000   4500 0014 38fa 0000 024d 1ff9 ccba 6334        E...8....M....c4
0x0010   ccba 6301 0000 0000 0000 0000 0000 0000        ..c.............
0x0020   0000 0000 0000 0000 0000 0000 0000             ..............
11:57:26.534898 dhcp9-1.noc.corp.ptd.net > dhcp9-52.noc.corp.ptd.net:
icmp: dhcp9-1.noc.corp.ptd.net protocol 77 unreachable [tos 0xc0] 

0x0000   45c0 0030 29e1 0000 4001 f081 ccba 6301        E..0)... at ...1681...
0x0010   ccba 6334 0302 fcfd 0000 0000 4500 0014        ..c4........E...
0x0020   38fa 0000 024d 1ff9 ccba 6334 ccba 6301        8....M....c4..c.
11:57:39.829722 dhcp9-52.noc.corp.ptd.net > dhcp9-1.noc.corp.ptd.net:
pim v0
0x0000   4500 0014 368f 0000 0267 224a ccba 6334        E...6....g"J..c4
0x0010   ccba 6301 0000 0000 0000 0000 0000 0000        ..c.............
0x0020   0000 0000 0000 0000 0000 0000 0000             ..............
11:57:39.829814 dhcp9-1.noc.corp.ptd.net > dhcp9-52.noc.corp.ptd.net:
icmp: dhcp9-1.noc.corp.ptd.net protocol 103 unreachable [tos 0xc0] 

0x0000   45c0 0030 29e2 0000 4001 f080 ccba 6301        E..0)... at ...1681...
0x0010   ccba 6334 0302 fcfd 0000 0000 4500 0014        ..c4........E...
0x0020   368f 0000 0267 224a ccba 6334 ccba 6301        6....g"J..c4..c.
11:57:52.245620 dhcp9-52.noc.corp.ptd.net > dhcp9-1.noc.corp.ptd.net:
[|mobile]
0x0000   4500 0014 96be 0000 0237 c24a ccba 6334        E........7.J..c4
0x0010   ccba 6301 0000 0000 0000 0000 0000 0000        ..c.............
0x0020   0000 0000 0000 0000 0000 0000 0000             ..............
11:57:52.245699 dhcp9-1.noc.corp.ptd.net > dhcp9-52.noc.corp.ptd.net:
icmp: dhcp9-1.noc.corp.ptd.net protocol 55 unreachable [tos 0xc0] 

0x0000   45c0 0030 29e3 0000 4001 f07f ccba 6301        E..0)... at ...1681...
0x0010   ccba 6334 0302 fcfd 0000 0000 4500 0014        ..c4........E...
0x0020   96be 0000 0237 c24a ccba 6334 ccba 6301        .....7.J..c4..c.

|Keith A. Pachulski, PPS, GCIH, GCFW | NSA IATF Member| FBI InfraGard
Secure Member|
|PenTeleData/Prolog Internet Services | Information Security & Privacy|
|6B56 C8DC 6201 6D1A BFF5 5799 E193 ABAA 9549 74D0|
|"In God We Trust - - - All Others We Monitor"|
|--- United States Navy Intelligence|

-- 
---------------------------
Jason H. Frisvold
Backbone Engineering Supervisor
Penteledata Engineering
friz at ...2...
RedHat Engineer - RHCE # 807302349405893
Cisco Certified - CCNA # CSCO10151622
MySQL Core Certified - ID# 205982910
---------------------------
"Imagination is more important than knowledge.
Knowledge is limited. Imagination encircles
the world."
      -- Albert Einstein [1879-1955]








More information about the Snort-sigs mailing list