1

There is a question bugging me a after reading on network security.

Theoretical situation: there is a packet-filtering firewall, which only accepts tcp/ip communication with destination port 22 on a protected private network.

(The port on a machine outside this protected network is not specified in the firewall's rules.)

Now imagine a botmaster, who tries to carry out an attack and communicate with a bot listening on port 80. The botmaster wants to for example send an IRC message "I got trough!" to any IRC channel, e.g. "starwars".

In order to get the packets trough (i.e. not get dropped by) the firewall, what kind of ipv4-packet should the bot master send in this particular scenario?

I'm especially interested in the TCP fields port numbers and the payload.

I'm totally confused on the 22 vs 80 part, how would that be possible. Why would this attack work?

And how could I adjust the firewall to be improved and detect any malicious behavior?

Improve this question
2
  • My problem is with your question the costly deciphering technology to find out, what do you really want. :-)
    – peterh
    Commented May 15, 2014 at 8:20
  • @csharpforevermore (I am sorry I can't comment...) you are close to what a friend of mine told, but how would such a ipv4 packet look like? (making sure it won't get dropped and e.g. sending an irc-message) And how would I improve the firewall in order to make sure these things don't happen. To put it in a nutshell: "Bot master is outside the network trying to connect to bot on the inside. Bot listens on port X but firewall only allows traffic on port Y."
    – user46650
    Commented May 15, 2014 at 8:24

2 Answers 2

Reset to default
3

The only way to do this is if some running application or process were to forward port 22 (external) to port 80 (internal) on the server. Otherwise (provided the firewall and operating systems are the usual Linux / Windows / Mac OS) it is impossible in all scenarios I know of to do this. A good thing too - otherwise servers would be getting hacked all over the show. A server with a firewall with no ports open would be completely inaccessible unless it allowed an open port

The idea is that a running program "listens" on a port for a communication handshake.

For example, port 22 is listened to by some remote desktop software (such as PC-Anywhere) http://www.speedguide.net/port.php?port=22

Port 80 is the standard web browser access port - meaning that website hosting server software (e.g. Apache, IIS) listen on that port for anyone pointing their web browser there.

Improve this answer
1
  • "provided the firewall and operating systems are the usual Linux / Windows / Mac OS) it is impossible in all scenarios I know of to do this" see SSH Tunnels, a feature built into SSH which typically runs on TCP port 22.
    – Matthew1471
    Commented Mar 25, 2016 at 17:12
0

Port 22 is typically used by the remote login protocol Secure Shell (SSH). SSH supports "Tunnels" / "Port Forwarding", once the user successfully authenticates to an SSH server they can state that any traffic to a port on their local machine (answered by their SSH client software), should actually be relayed to the SSH server and the SSH server should then connect to a final destination of the user's choice and relay that traffic.

Prevention? Disable SSH port forwarding on the SSH server, which if using OpenSSH set the option for "AllowTcpForwarding". See also Secure Shell tunneling.

Improve this answer

You must log in to answer this question.