2

I am connecting to a server

nc -v 192.168.0.1 1111

But I want to do IP spoofing because the server on 192.168.0.1 only accepting commands from 7.7.7.7. We are two friends, I am 192.168.1.1, and my friend is 192.168.0.1. My friend installed a daemon (on port 1111) and runs

ncat -u -c /bin/bash --allow 7.7.7.7 -l 1111

I know netcat's -s parameter, but I don't know how to use it. I tried

nc -v 192.168.0.1 1111 -s 7.7.7.7
7.7.7.7: inverse host lookup failed: Unknown server error : Connection timed out

How can I use netcat to connect with a spoofed IP address?

5
  • 2
    You should familiarize your self with the OSI model. This is a very introductory question about the basics of networking.
    – rook
    Commented Apr 22, 2012 at 16:11
  • 1
    Full command ncat -u -c /bin/bash -k -n -v --allow 1.1.1.1 -l 443
    – Tolga
    Commented Apr 23, 2012 at 20:33
  • My Friend's Code is ncat -u -c /bin/bash --allow 7.7.7.7 -l 1111
    – Tolga
    Commented Apr 24, 2012 at 9:50
  • You need to have a lot of networking set up to make this happen. Is his internet firewall set up to accept connections on this port? Is there port redirection?
    – schroeder
    Commented Apr 24, 2012 at 18:29
  • also remember to use UDP switch ...
    – schroeder
    Commented Apr 24, 2012 at 19:22

3 Answers 3

7

Netcat does not support IP-spoofing. Also, when there is one or more routers in between, the odds that IP-spoofing will be working is zero. When using 192.168.1.x and 192.168.0.y having a router in between is very likely.

Also 7.7.7.7 is a publicly assigned address. You cannot use it for your own.

If you want to experiment with other IP-addresses, use addresses from these ranges:

  • 10.x.y.z
  • 172.24.0.0 - 172.31.255.255
  • 192.168.x.y

netcat needs to bind to an IP address that is available on your computer. You can check those by typing sudo ifconfig -a. Notice that all 127.x.y.z addresses are loopback addresses and only exist inside your own PC.

5
  • Thanks.Should I use to program which ip spoof and send the command?
    – Tolga
    Commented Apr 22, 2012 at 11:05
  • 3
    Your friend and you work from the same home or room? If the answer to that question is 'No' then IP-spoofing is not going to work at all.
    – jippie
    Commented Apr 22, 2012 at 11:20
  • No.My friend is from other city.I am sending nc -v friend_address 1111 and no respond.I want to command execute on my friend pc from 1111 port and download secret file.
    – Tolga
    Commented Apr 22, 2012 at 11:34
  • 1
    You won't be able to connect to his 192.168.0.1 address from your home. You need to connect to his internet-facing router's IP and set up his router to forward traffic to his computer. Has this been set up?
    – schroeder
    Commented Apr 24, 2012 at 18:31
  • Study some TCP/IP networking material that explains you how IP-addresses are made up and how routing works. Wikipedia is a nice start: en.wikipedia.org/wiki/Internet_Protocol_Suite
    – jippie
    Commented Apr 24, 2012 at 18:41
6

'Connection' is not possible by spoofing. When his computer responds, it will be to the address that is not you. You have to send commands 'blind'.

To prove this, send a ping request (to your machine) to your friend's netcat session (while spoofing) and capture packets to see if you get anything.

** EDIT **

It IS possible to IP spoof with netcat! Just assign the spoofed IP to your local interface and set up a gateway:

eth0 IP: 192.168.1.1
IP to spoof: 7.7.7.7
Target IP: 5.5.5.5

ifconfig eth0 7.7.7.7
route add -net 7.7.7.0 eth0
nc -nvu -s 7.7.7.7 -g 192.168.1.1 5.5.5.5 1111

The problem is that many Internet routers block this type of spoofing.

Strict Source Routing

You can set up full-connections while spoofing, but you need to set up a gateway chain to do it:

eth0 IP: 192.168.1.10
Firewall IP: 192.168.1.1
IP to spoof: 7.7.7.7
Target IP: 5.5.5.5
IPs of Internet routers to Target (up to 8): n.n.n.[1-8]

ifconfig eth0 7.7.7.7
route add -net 7.7.7.0 eth0
nc -nvu -s 7.7.7.7 -g 192.168.1.10 192.168.1.10 1111
nc -nvu -s 7.7.7.7 -g 192.168.1.10 192.168.1.1 1111
nc -nvu -s 7.7.7.7 -g 192.168.1.10 -g 192.168.1.1 n.n.n.1 1111
...
nc -nvu -s 7.7.7.7 -g 192.168.1.10 -g 192.168.1.1 -g n.n.n.8 5.5.5.5 1111
6
  • netcat doesn't support icmp, so it would never see a ping (icmp echo request). ICMP is a totally different protocol compared to TCP (what you probably want) or UDP.
    – jippie
    Commented Apr 24, 2012 at 18:35
  • @jippie what I meant was to send the ping command to the remote netcat session, because the listener is bound to bash. But, I have totally changed my answer for connection-based options.
    – schroeder
    Commented Apr 24, 2012 at 19:06
  • I give error when add route. SIOCADDRT: Invalid argument
    – Tolga
    Commented Apr 25, 2012 at 15:06
  • Different linux kernels expect different args. Try "ip route add 7.7.7.0/24 dev eth0" or look at the "route --help" to see how to add a route to a network.
    – schroeder
    Commented Apr 25, 2012 at 16:44
  • I did as you showed.And i controlled my packets with wireshark but not move my udp packet.So,no answer target ip.
    – Tolga
    Commented Apr 25, 2012 at 18:54
3

The netcat -s parameter is used to set the source address. This parameter is used if you have multiple interfaces, and multiple exit gateways that can be used. netcat manual

It seem to me that you are trying to set the source ip to an ip that is not routed back to you on your gateway.

The traffic flow would look something similar to this for the three-way handshake: (192.168.0.254 is your default gateway used to reach internet).

7.7.7.7 -> 192.168.0.1 (SYN)

192.168.0.1 -> 192.168.0.254 (SYN+ACK) # At this point, the packet will be routed through the gateway, destination is still 7.7.7.7

192.168.0.254(official internet ip) -> 7.7.7.7 (SYN+ACK)

7.7.7.7 -> 192.168.0.254(official internet ip) (RST) # Packet is disregarded by 7.7.7.7 is not familiar with this connection.

As you can see, you will be able to spoof the initial packet to the server, but you are unable to complete the three-way-handshake which is required to send any commands/data. The reason for this is because the response traffic will not be sent back to you, but to the real 7.7.7.7 ip.

A method to perform a successful spoofing attack is by man-in-the-middle, where you convince 192.168.0.1 that you are the gateway. When 192.168.0.1 send the SYN+ACK response towards 7.7.7.7, you will intercept the traffic and can act as 7.7.7.7.

Paper about ARP and attacks

1
  • he's using UDP, so a 'connection' isn't necessary
    – schroeder
    Commented Apr 24, 2012 at 19:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .