I have been wondering whether it is possible or not to spoof localhost so that when a connection is made the remote server can be tricked into thinking the connections are coming from localhost.

For example, there is a configuration in MySQL that only accepts connections from localhost. As an outside attacker, could it be possible to spoof localhost in order to gain access to this server, granted of course there are no further security measures taken?

  • Interesting question. I'm wondering if there's maybe some kind of DNS trickery that could potentially prove useful in this situation.. – voices Oct 31 '15 at 22:11
  • If there was a known way to reliably do it, MySQL would (hopefully) fix the problem if it could be fixed or update their documentation to explain the limits of the security setting. – Neil Smithline Nov 1 '15 at 0:18

This concept (typically used as part of an attack) is often called "pivoting", as in "I used the server's request forwarding feature to pivot from the Internet to localhost". There's no way to "spoof" localhost traffic over TCP; TCP requires a valid source IP address to complete the handshake. On UDP, you might manage it if the application was listening on external interfaces but was rejecting any connection that doesn't come from the local host - this is different from only listening on the loopback interface, which is what you would normally do if you only wanted local traffic - but I've never heard of that approach being used, probably because it's a stupid way to configure a server.

There are a number of ways you can pivot a network connection to a local (internal) network, or to localhost (which is essentially an extra-small - one machine only - local network). Let's take a trivial, contrived example: the machine running the local-connections-only server is also running an open proxy server exposed to the Internet. You connect to the proxy, and tell it to connect you to on the desired port. The proxy server sends out that request on your behalf, and connects to the restricted server. The proxy then relays your traffic to the restricted server, and its traffic back to you.

There are a number of less-contrived examples that may work. XML External Entity attacks are probably the most common, and can be used to make various kinds of requests, such as HTTP, HTTPS, FTP, and possibly others, to a host and port of your choice (relative to the vulnerable XML parser, which is usually in a web server, so requesting "localhost" in the XXE would make the web server connect to itself on the specified protocol on port). That won't usually get you interactive traffic, but is good for simple requests and can usually be made as often as desired (this can also be used to port-scan an internal network for certain kinds of servers). Anything that lets an external program have the server make an arbitrary request on the external user's behalf can be abused to send a request to the server's localhost-only services.

Another option that might sometimes be relevant is to use this sort of attack to gain privileges on a host after you have compromised it and gained arbitrary code execution in a low-privilege environment. Imagine, for example, a sandboxed web server. You compromise the server and drop a reverse shell on it, letting you run code within the server's sandbox. You then open a network connection to another service on the same server (but outside the webserver's sandbox) that is listening on localhost but is otherwise unauthenticated. If the sandbox doesn't restrict you from doing this and the target server exposes anything not visible from within the sandbox directly, you've just effectively gained additional privileges.

|improve this answer|||||
  • Does it mean that asking my firewall to reject all non-localhost input is unsafe ? – Hey Nov 5 '15 at 17:45
  • Doing that for an application is unsafe (or rather, does not reliably make you safe), yes. Doing that for the machine as a whole is possible - just remove all exemptions to the default "block all incoming traffic" rule - but it's likely to break some functionality you care about (you would no longer be able to connect to the machine for remote administration, for example). Unless you just meant "block all non-localhost traffic", which is easiest and most safely achieved by removing the network cable (and WiFi, if relevant). – CBHacking Nov 6 '15 at 2:52
  • I'm on Linux and I don't need anything listening, except on localhost. I don't want SSH. I already configured my firewall to block all incoming packets except from localhost and I was just wondering if it was safe. Thanks. – Hey Nov 6 '15 at 6:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.