Mystery Net

Simple Nomad

DC214 - 15Jul2004

Mystery Net – Design Goals

Defeat IP address-based access controls

Allow userland tools to spoof

Have little to no social value

Attacker's Dilemma

Firewalls block addresses

Some firewalls allow some traffic in (business partners, trusted clients, etc)

VPNs may limit addresses that can access

Perimeter technologies log stuff (including our IP address)

Spoofing “dies” using TCP/IP

Advanced spoofing requires rewriting every app/tool from scratch

Our Hero

Enter Blue Raja

Blue Raja Features

Uses Packet Purgatory library

Inserts a “wedge” between the kernel and userland.

The “wedge” rewrites outbound packets on the fly.

We simply rewrite our outbound source address, and add options

We can also use a fake “local” IP proxy (and we handle arp for it)

How Does Our Hero Get Responses?

Enter The Shoveler

Shoveler Features

Uses libpcap and libdnet

Can rewrite packets based upon IP address pairs

Can function as a proxy, and can be chained

Real World Scenario

Attacker is blocked, trusted host gets through

Target

Trusted Host

Mr. Furious

Real World Scenario

Attacker uses Blue Raja, packets get through

Target

Trusted Host

Mr. Furious

Blue Raja

Real World Scenario

Shoveler shovels the return packets back

Target

Trusted Host

Attacker

Blue Raja

Shoveler

More Fun...

Attacker is blocked, trusted host gets through

Target

Trusted Host

Attacker

Shoveler

(proxy mode)

Shoveler

(proxy mode)

Shoveler

(proxy mode)

Shoveler

(proxy mode)

Shoveler

(proxy mode)

Shoveler Can Do Even More...

Man-in-the-Middle Scenario

Shoveler intercepts online banking traffic

Target

MyOnlineBank

FakeOnlineBank

Shoveler

Problem Areas

Trusted host is active

RSTs could kill our connection

Can't update Shoveler on the fly

Works great in a lab (needs real world testing)

Future Enhancements - Shoveler

Detect dark IP space from trusted net

“Spleen” mode

DoS against trusted host

Reverse “spleen” mode for better MITM attacks

“Invisible Boy” mode

Update Shoveler remotely via covert channel

Fin

Questions?

http://www.nmrc.org/~thegnome/mn-0.1.tgz (coming soon)

Packet Purgatory

http://www.synacklabs.net/projects/packetp/

Libdnet

http://libdnet.sourceforge.net/

Libpcap

http://www.tcpdump.org/

Mystery Net

NMRC DC214 Presentation

NMRC hack superhuman abilities hacktivism sheep k-y

If we were priests, we would hack the mind of God.
Oh and stop using this Windows shit, you dumbfuck. If you really cared, you'd be using OpenOffice to view this. Fucknut.

NMRC

2002-07-17T22:29:29