Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 4 down vote favorite
2

My IPS recently detected a type 8 ICMP packet (echo request) with an unusual payload.

The echo request command a fragment of a command that looked like part of a route add. Here's a PCAP of the ICMP data payload.

.&.1Y..! .b....E.
..x..z. ...)....
....(4.. ......e
-p ADD 1 72.16.1.
21 MASK 255.255.
255.255 10.18.12
.33..... ..

The IPS tagged it as Loki tunneling traffic - but it's limited to a single packet. I thought it could be a random grab from memory, but I saw the exact same packet a few days later.

Has anyone seen anything like this before?

share|improve this question

2 Answers

up vote 4 down vote

Ah, tunneling... SSH, DNS, ICMP, netcat, custom VPN... you name it. Sometimes known as "give me free wifi" and in other cases as "give me your network."

I don't know that specific payload (as a compromise), but I do know you can put things over ICMP. Take a look at the surrounding packets. This kind of reminds me of the old "ATH+++" gag. It may be a similar exploit for something that's being tossed around at random. I'd like to give more for an answer, but I think I'd need more to go on.

share|improve this answer
True, it could be anything and the IPS is blocking it, just concerned it maybe something more and the command looks suspiciously like a rule/acl modification – user1959 Apr 5 '11 at 18:32
Well, much like the ATH+++ thing, there is a risk that somehow the target device would interpret that as a command. (The ATH+++ gag would make improperly guarded dialup modems hang up -- a very cute DOS attack). I don't know the source, the target, the systems you have, etc. It is suspicious payload, though. Perhaps somebody has a console forwarded over ICMP and is issuing that command. – Jeff Ferland♦ Apr 5 '11 at 18:36
that would be my guess as well. – Rory Alsop♦ Apr 5 '11 at 19:20
1  
something like this - cs.uit.no/~daniels/PingTunnel ? – user1959 Apr 5 '11 at 19:34
up vote -1 down vote

the is a bug in recent dhclient implementations, which allows running shell commands remotely.
dunno why it ICMP echo, if its related anyway,

share|improve this answer
not sure it's related - I don't think dhclient would be sending out ICMP packets – user1959 Apr 6 '11 at 20:30
@kukkatz, Do you have a pointer to more information about the vulnerability? – D.W. Apr 8 '11 at 1:45
on second thought, i think @Cher Zakalwe is right. @D. W.: i was referring to this: h-online.com/open/news/item/… – kuhkatz Apr 8 '11 at 9:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.