0

If a client connects to a server he will start listening for the response on some random high port number. The client then expects any packet destined for that port to be a valid answer. Or does he additionally check if the ip-address matches or any checksums etc? Would it be possible to send a specifically crafted packet with malicious content to one of those high ports? Can i scan for those with nmap?

  • you could create a script with the nmap NSE if you need such behaviour. But I'm not sure how you'd determine the "random high port". Can you elaborate a bit more on that? – mhr Sep 25 at 13:28
  • lets say i want to open a ftp connection: ich will send a packet to port 21 of the ftp server. My source port will be a random high port like 44563 for example. The answer packet will be sent from server:21 to client:44563. – Kingflomb Sep 25 at 13:35
2

The client then expects any packet destined for that port to be a valid answer.

No. The client accepts as answer only packets from the ip and port it connected to and which have the correct sequence number. This is both the behavior of a client without firewall and also the behavior of a stateful firewall.

This means an attacker who cannot sniff the traffic must guess both the clients port and the servers sequence number correctly and must be able to spoof the servers IP address.

  • but i could easily spoof ip and port, seq and ack numbers can be guessed as they are always 0 or 1 in the establishing process. So it is possible to send a spoofed packet to a highport? – Kingflomb Sep 25 at 13:39
  • 2
    @Kingflomb they may appear as 0 or 1 in Wireshark or other tools, because they parse it relative to the starting numbers. They are definitely not 0 or 1 in reality (on the wire). – Luc Sep 25 at 13:42
  • does wireshark only do that for the connection establishment or for the full connection? – Kingflomb Sep 25 at 13:47
  • 1
    but I could easily spoof ip and port: no, you cannot. Unless you are in the middle when you can capture the packets and change them and would have no need to spoof anything. – ThoriumBR Sep 25 at 13:47
  • 1
    @Kingflomb: "could this be achieved with brute-force?" - see Is TCP Sequence Bruteforcing dangerous nowadays?. "if i theoretivally manage to do all that, will the packet be passed on to the application layer?" - if everything is correct it will not be distinguishable from a valid response of the real server. Which means it will passed to the application. It will fail there though if the application does TLS. – Steffen Ullrich Sep 25 at 13:55
1

does he additionally check if the ip-address matches or any checksums etc?

Yes, it checks if the source address on the IP packet matches the remote site, and if source port matches too. It checks the TCP sequence number too, to see if the packet falls within the expected receiving window. If any of those checks fails, it will usually drop the packet.

Would it be possible to send a specifically crafted packet with malicious content to one of those high ports?

No. You would have to guess the sequence number and port. That is not trivial at all. TCP Sequence Prediction depends on a lot of moving parts, and is not possible on all current operational systems.

Can I scan for those with nmap?

If you are trying to scan the client for those open high ports, you can but you will accomplish nothing. Hitting a port is easy, there are just a couple thousand of them. Guessing the TCP Sequence Number is impossible today. It is a 32-bit number, so good luck (as Nmap used to say).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.