分布式拒绝服务攻击工具mstream(2)

　2006-07-04 20:26:58　来源：WEB开发网　　　

核心提示： 可以用ngrep [14]、snort [18](附录B介绍了snort规则)做签名匹配，或者用rid[15](附录C有一个RID模板)搜索空闲(未做攻击)Agents，分布式拒绝服务攻击工具mstream(2)(4)，# ngrep "p[oi]ng" udp por

可以用ngrep [14]、snort [18](附录B介绍了snort规则)做签名匹配，或者用rid[15](附录C有一个RID模板)搜索空闲(未做攻击)Agents。

# ngrep "p[oi]ng" udp port 6838 or udp port 10498

如果攻击者修改了源代码，这条ngrep命令所用端口也要修改。

攻击报文固定在40字节大小，或许是规避某些IDS的大包检测规则。

stream2.c对victim做TCP ACK Flooding，源IP随机化(用random()产生)，源端口和TCP序列号顺序递增。参看如下源代码

-------------------------------------------------------------------------- . . . for ( i = 0; ; ++i ) { cksum.pseudo.saddr = packet.ip.ip_src.s_addr = random(); ++packet.ip.ip_id; ++packet.tcp.th_sport; ++packet.tcp.th_seq; if ( !dstport ) { s_in.sin_port = packet.tcp.th_dport = rand(); } . . . --------------------------------------------------------------------------

由于源IP随机化，伪造得到的点分十进制源IP可能出现某些字节为0的情况。

用tcpdump抓取攻击报文

-------------------------------------------------------------------------- 01:39:24.701083 192.168.0.2.65527 > 192.168.0.20.10498: [bad udp cksum 3100!] udp 24 (ttl 64, id 886) 0x0000 4500 0034 0376 0000 4011 f5dc c0a8 0002 E..4.v..@....... 0x0010 c0a8 0014 fff7 2902 0020 556c 7374 7265 ......)...Ulstre 0x0020 616d 2f31 3932 2e31 3638 2e30 2e31 3030 am/192.168.0.100 0x0030 2f31 300a /10. 01:40:10.132724 192.168.0.2.65526 > 192.168.0.20.10498: [bad udp cksum 3100!] udp 24 (ttl 64, id 930) 0x0000 4500 0034 03a2 0000 4011 f5b0 c0a8 0002 E..4....@....... 0x0010 c0a8 0014 fff6 2902 0020 556d 7374 7265 ......)...Umstre 0x0020 616d 2f31 3932 2e31 3638 2e30 2e31 3030 am/192.168.0.100 0x0030 2f31 300a /10. 01:41:23.674796 192.168.0.2.65525 > 192.168.0.20.10498: [bad udp cksum 4a00!] udp 49 (ttl 64, id 1031) 0x0000 4500 004d 0407 0000 4011 f532 c0a8 0002 E..M....@..2.... 0x0010 c0a8 0014 fff5 2902 0039 a9b4 6d73 7472 ......)..9..mstr 0x0020 6561 6d2f 3139 322e 3136 382e 302e 313a eam/192.168.0.1: 0x0030 3139 322e 3136 382e 302e 3130 303a 3139 192.168.0.100:19 0x0040 322e 3136 382e 302e 322f 3130 0a 2.168.0.2/10. 01:41:23.675771 arp who-has 192.168.0.1 tell 192.168.0.20 0x0000 0001 0800 0604 0001 0010 5a99 6544 c0a8 ..........Z.eD.. 0x0010 0014 0000 0000 0000 c0a8 0001 0000 0000 ................ 0x0020 0000 0000 0000 0000 0000 0000 0000 .............. 01:41:23.675772 arp who-has 192.168.0.100 tell 192.168.0.20 0x0000 0001 0800 0604 0001 0010 5a99 6544 c0a8 ..........Z.eD.. 0x0010 0014 0000 0000 0000 c0a8 0064 0000 0000 ...........d.... 0x0020 0000 0000 0000 0000 0000 0000 0000 .............. 01:41:23.675773 77.172.43.85.38444 > 192.168.0.2.26296: . [tcp sum ok] ack 0 win 16384 [tos 0x8] (ttl 255, id 50237) 0x0000 4508 0028 c43d 0000 ff06 bdde 4dac 2b55 E..(.=......M.+U 0x0010 c0a8 0002 962c 66b8 ea97 d237 0000 0000 .....,f....7.... 0x0020 5010 4000 7c74 0000 0000 0000 0000 P.@.|t........ 01:41:23.675774 88.148.222.45.39212 > 192.168.0.2.10342: . [tcp sum ok] ack 0 win 16384 [tos 0x8] (ttl 255, id 51005) 0x0000 4508 0028 c73d 0000 ff06 fd1d 5894 de2d E..(.=......X..- 0x0010 c0a8 0002 992c 2866 ed97 d237 0000 0000 .....,(f...7.... 0x0020 5010 4000 f705 0000 0000 0000 0000 P.@........... 01:41:23.675775 0.18.219.113.39980 > 192.168.0.2.41622: . [tcp sum ok] ack 0 win 16384 [tos 0x8] (ttl 255, id 51773) 0x0000 4508 0028 ca3d 0000 ff06 555c 0012 db71 E..(.=....U\...q 0x0010 c0a8 0002 9c2c a296 f097 d237 0000 0000 .....,.....7.... 0x0020 5010 4000 d213 0000 0000 0000 0000 P.@........... 01:41:23.675776 121.161.140.109.40748 > 192.168.0.2.16749: . [tcp sum ok] ack 0 win 16384 [tos 0x8] (ttl 255, id 52541) 0x0000 4508 0028 cd3d 0000 ff06 27d1 79a1 8c6d E..(.=....'.y..m 0x0010 c0a8 0002 9f2c 416d f397 d237 0000 0000 .....,Am...7.... 0x0020 5010 4000 02b2 0000 0000 0000 0000 P.@........... 01:41:23.675777 79.238.213.72.41516 > 192.168.0.2.46276: . [tcp sum ok] ack 0 win 16384 [tos 0x8] (ttl 255, id 53309) 0x0000 4508 0028 d03d 0000 ff06 05a9 4fee d548 E..(.=......O..H 0x0010 c0a8 0002 a22c b4c4 f697 d237 0000 0000 .....,.....7.... 0x0020 5010 4000 6a32 0000 0000 0000 0000 P.@.j2........ 01:41:23.675778 104.24.203.64.42284 > 192.168.0.2.61623: . [tcp sum ok] ack 0 win 16384 [tos 0x8] (ttl 255, id 54077) 0x0000 4508 0028 d33d 0000 ff06 f486 6818 cb40 E..(.=......h..@ 0x0010 c0a8 0002 a52c f0b7 f997 d237 0000 0000 .....,.....7.... 0x0020 5010 4000 1a1d 0000 0000 0000 0000 P.@........... 01:41:23.675779 37.60.73.50.43052 > 192.168.0.2.51311: . [tcp sum ok] ack 0 win 16384 [tos 0x8] (ttl 255, id 54845) 0x0000 4508 0028 d63d 0000 ff06 b671 253c 4932 E..(.=.....q%0x0010 c0a8 0002 a82c c86f fc97 d237 0000 0000 .....,.o...7.... 0x0020 5010 4000 0150 0000 0000 0000 0000 P.@..P........ 01:41:23.675780 142.14.73.40.43820 > 192.168.0.2.8979: . [tcp sum ok] ack 0 win 16384 [tos 0x8] (ttl 255, id 55613) 0x0000 4508 0028 d93d 0000 ff06 4aa9 8e0e 4928 E..(.=....J...I( 0x0010 c0a8 0002 ab2c 2313 ff97 d237 0000 0000 .....,#....7.... 0x0020 5010 4000 37e4 0000 0000 0000 0000 P.@.7......... 01:41:23.676748 144.19.212.69.44588 > 192.168.0.2.51668: . [tcp sum ok] ack 0 win 16384 [tos 0x8] (ttl 255, id 56381) 0x0000 4508 0028 dc3d 0000 ff06 ba86 9013 d445 E..(.=.........E 0x0010 c0a8 0002 ae2c c9d4 0298 d237 0000 0000 .....,.....7.... 0x0020 5010 4000 fdff 0000 0000 0000 0000 P.@........... 01:41:23.676749 155.176.45.2.45356 > 192.168.0.2.32793: . [tcp sum ok] ack 0 win 16384 [tos 0x8] (ttl 255, id 57149) 0x0000 4508 0028 df3d 0000 ff06 532d 9bb0 2d02 E..(.=....S-..-. 0x0010 c0a8 0002 b12c 8019 0598 d237 0000 0000 .....,.....7.... 0x0020 5010 4000 dd61 0000 0000 0000 0000 P.@..a........ 01:41:23.676750 10.98.211.13.46124 > 192.168.0.2.1995: . [tcp sum ok] ack 0 win 16384 [tos 0x8] (ttl 255, id 57917) 0x0000 4508 0028 e23d 0000 ff06 3b70 0a62 d30d E..(.=....;p.b.. 0x0010 c0a8 0002 b42c 07cb 0898 d237 0000 0000 .....,.....7.... 0x0020 5010 4000 3af3 0000 0000 0000 0000 P.@.:......... 01:41:23.676751 214.235.187.89.46892 > 192.168.0.2.14172: . [tcp sum ok] ack 0 win 16384 [tos 0x8] (ttl 255, id 58685) 0x0000 4508 0028 e53d 0000 ff06 839a d6eb bb59 E..(.=.........Y 0x0010 c0a8 0002 b72c 375c 0b98 d237 0000 0000 .....,7\...7.... 0x0020 5010 4000 508c 0000 0000 0000 0000 P.@.P......... 01:41:23.676752 90.193.127.8.47660 > 192.168.0.2.64812: . [tcp sum ok] ack 0 win 16384 [tos 0x8] (ttl 255, id 59453) 0x0000 4508 0028 e83d 0000 ff06 3916 5ac1 7f08 E..(.=....9.Z... 0x0010 c0a8 0002 ba2c fd2c 0e98 d237 0000 0000 .....,.,...7.... 0x0020 5010 4000 3d37 0000 0000 0000 0000 P.@.=7........ 01:41:23.676753 160.176.42.60.48428 > 192.168.0.2.17432: . [tcp sum ok] ack 0 win 16384 [tos 0x8] (ttl 255, id 60221) 0x0000 4508 0028 eb3d 0000 ff06 44f3 a0b0 2a3c E..(.=....D...*< 0x0010 c0a8 0002 bd2c 4418 1198 d237 0000 0000 .....,D....7.... 0x0020 5010 4000 ff28 0000 0000 0000 0000 P.@..(........ --------------------------------------------------------------------------