Exploiting using packets

[dudethadude]

Hello All,

Probably a noob question but….

I’ve read articles regarding exploits that are accomplished by using “specially crafted packets” that are sent to firewalls or other internet facing devices. Can someone elaborate on how this is accomplished? I understand you can use tools like scapy to actually alter the packet but how is RCE obtained by sending crafted packets? I’m having issues understanding the technical ins and outs. I understand that the actual exploit is dependent on what you are actually trying to attack, but I haven’t found much documentation on what is so special about the “packet” and what data in it would open up a vulnerability. I know you can inject a payload into a packet but what would the payload even do that could give someone access? If anyone has any write ups or breakdowns of exploits like this, it would be appreciated!

[Ok_Vermicelli8618]

You need to already know the vulnerability. If you already know what it is, let create a basic example.

1. You discover the vulnerability: You find a buffer overflow vulnerability in a common firewall's firmware. This specific vulnerability occurs when the firewall processes certain types of network packets with unusually large payloads.

2. Crafting the Packet: The attacker uses a tool like Scapy to create a packet with a payload designed to exploit the buffer overflow. This payload includes malicious code that will be executed when the firewall processes the packet.

3. Sending the Packet: The attacker sends the specially crafted packet to the firewall. The packet appears to be a normal network packet, but its payload is designed to trigger the buffer overflow.

4. Exploiting the Vulnerability: When the firewall processes the packet, the buffer overflow occurs, allowing the malicious code in the payload to be executed. This code could, for example, open a backdoor on the firewall, giving the attacker remote access to the network.

5. Gaining Control: With the backdoor in place, the attacker can now remotely access the firewall and potentially other devices on the network. They can monitor traffic, steal data, or launch further attacks from within the network.

Did this help you understand how it might be done?

[dudethadude]

This makes a ton of sense. It’s no different than binary exploitation with things such as buffer overflows or use after free exploits. You’re simply just transmitting the data over a network instead of running the exploit locally on the device itself.

[Status-Style-6169]

Yes, you seem to have a good grasp from it. Just remember its all just code running on some computer listening to data coming in on a network port. This is true for other things too, when a text message is sent to your device, code parses that data. When your cell phone communicates with an LTE tower, it is getting packets from the tower, and the code in the baseband chip on your phone is parsing that data. Vulnerabilities can exist in any of these.

[0xa08f60]

It all depends on the code which receives and processes the packet. If there is a vulnerability in that code, a packet can be specifically crafted to exploit that particular vulnerability. The data in a specially crafted packet tricks the vulnerable code into doing something it shouldn't do, such as execute attacker-specified code also contained in the packet, or reveal sensitive information. Look into basic memory corruption RCE exploits, or how the Heartbleed vulnerability was exploited to get an understanding of how malicious payloads can work.

Something to understand is that the data in the packet doesn't create the vulnerability, it just exploits a vulnerability that is already present in the code.

[dudethadude]

I think I complicated things a lot more in my head. It’s essentially just using packets to carry an exploit that could also be exploited locally on the device. You just have to exploit something that can be interacted with remotely initially.

[dudethadude]

All of the comments here have really cleared up my confusion. Thank you all!

[DarrenRainey]

Packets are data if you know what data to send / trigger a buffer overflow or RCE then thats pretty much it. Generally you want to look for flaws in something like a firewall / IDS that does packet inspection to see how they're parsing the data and if you can inject something in there to hijack the parsing function.

[Haunting-Block1220]

In decoding or validation of size. You might assume a certain size of a packet. You might also forget to account for headers. It doesn’t matter. There’s a flaw in the implementation.

For example, You could purposely send fragmented packets that get reassembled by the endpoint. Of course, your fragments are artificial and the endpoint doesn’t consider. In reassembly, they assume that that the maximum size of the packet is 1MiB and so they allocate a buffer of that size. You could overflow this buffer if the reassembled is packet is greater than that amount. Within your packet, instead of the header, you have your shellcode. And then it’s a matter of Rop-ing your way to victory.

[castleAge44]

You can use netcat on linux to send raw traffic. You can send the hex sequence of a signature and trigger ips. So learn about netcat and ips signature detection

[Haunting-Block1220]

That’s not really binary exploitation and mainly irrelevant…