If a client connects to a server he will start listening for the response on some random high port number. The client then expects any packet destined for that port to be a valid answer. Or does he additionally check if the ip-address matches or any checksums etc? Would it be possible to send a specifically crafted packet with malicious content to one of those high ports? Can i scan for those with nmap?
2
-
you could create a script with the nmap NSE if you need such behaviour. But I'm not sure how you'd determine the "random high port". Can you elaborate a bit more on that?– mhrSep 25, 2019 at 13:28
-
lets say i want to open a ftp connection: ich will send a packet to port 21 of the ftp server. My source port will be a random high port like 44563 for example. The answer packet will be sent from server:21 to client:44563.– KingflombSep 25, 2019 at 13:35
Add a comment
|
2 Answers
The client then expects any packet destined for that port to be a valid answer.
No. The client accepts as answer only packets from the ip and port it connected to and which have the correct sequence number. This is both the behavior of a client without firewall and also the behavior of a stateful firewall.
This means an attacker who cannot sniff the traffic must guess both the clients port and the servers sequence number correctly and must be able to spoof the servers IP address.
answered Sep 25, 2019 at 13:36
-
but i could easily spoof ip and port, seq and ack numbers can be guessed as they are always 0 or 1 in the establishing process. So it is possible to send a spoofed packet to a highport? Sep 25, 2019 at 13:39
-
2@Kingflomb they may appear as 0 or 1 in Wireshark or other tools, because they parse it relative to the starting numbers. They are definitely not 0 or 1 in reality (on the wire).– LucSep 25, 2019 at 13:42
-
does wireshark only do that for the connection establishment or for the full connection? Sep 25, 2019 at 13:47
-
1but I could easily spoof ip and port: no, you cannot. Unless you are in the middle when you can capture the packets and change them and would have no need to spoof anything. Sep 25, 2019 at 13:47
-
1@Kingflomb: "could this be achieved with brute-force?" - see Is TCP Sequence Bruteforcing dangerous nowadays?. "if i theoretivally manage to do all that, will the packet be passed on to the application layer?" - if everything is correct it will not be distinguishable from a valid response of the real server. Which means it will passed to the application. It will fail there though if the application does TLS. Sep 25, 2019 at 13:55
does he additionally check if the ip-address matches or any checksums etc?
Yes, it checks if the source address on the IP packet matches the remote site, and if source port matches too. It checks the TCP sequence number too, to see if the packet falls within the expected receiving window. If any of those checks fails, it will usually drop the packet.
Would it be possible to send a specifically crafted packet with malicious content to one of those high ports?
No. You would have to guess the sequence number and port. That is not trivial at all. TCP Sequence Prediction depends on a lot of moving parts, and is not possible on all current operational systems.
Can I scan for those with nmap?
If you are trying to scan the client for those open high ports, you can but you will accomplish nothing. Hitting a port is easy, there are just a couple thousand of them. Guessing the TCP Sequence Number is impossible today. It is a 32-bit number, so good luck (as Nmap used to say).
answered Sep 25, 2019 at 14:00
