Snort mailing list archives
Re: SC Signature and HPING Signature
From: Jeff Nathan <jeff () snort org>
Date: Sun, 20 Jul 2003 21:54:50 -0700
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I think I saw something forwarded from Nanog to one of the Securityfocus lists referring to the "hping version" of the "exploit". Hping is a convenience in this case, it's one of several tools besides the publicly released "exploit" that can be used to cause this Denial-of-Service. - -Jeff - --On Friday, July 18, 2003 12:03 -0400 Keith Pachulski <keithp () corp ptd net> wrote:
Output below is from both the SC code and hping performing the same as SC. Feel free to develop your signatures from it. SC Exploit 11:59:59.014190 79.111.123.116 > dhcp9-1.noc.corp.ptd.net: swipe 181 0x0000 4500 00c9 bf25 0000 0235 fe3b 4f6f 7b74 E....%...5.;Oo{t 0x0010 ccba 6301 0001 0203 0405 0607 0809 0a0b ..c............. 0x0020 0c0d 0e0f 1011 1213 1415 1617 1819 1a1b ................ 0x0030 1c1d 1e1f 2021 2223 2425 2627 2829 2a2b .....!"#$%&'()*+ 0x0040 2c2d 2e2f 3031 3233 3435 3637 3839 3a3b ,-./0123456789:; 0x0050 3c3d 3e3f 4041 4243 4445 4647 4849 4a4b <=>?@ABCDEFGHIJK 0x0060 4c4d 4e4f 5051 5253 5455 5657 5859 5a5b LMNOPQRSTUVWXYZ[ 0x0070 5c5d 5e5f 6061 6263 6465 6667 6869 6a6b \]^_`abcdefghijk 0x0080 6c6d 6e6f 7071 7273 7475 7677 7879 7a7b lmnopqrstuvwxyz{ 0x0090 7c7d 7e7f 8081 8283 8485 8687 8889 8a8b |}~............. 0x00a0 8c8d 8e8f 9091 9293 9495 9697 9899 9a9b ................ 0x00b0 9c9d 9e9f a0a1 a2a3 a4a5 a6a7 a8a9 aaab ................ 0x00c0 acad aeaf b0b1 b2b3 b4 ......... 11:59:59.014402 dhcp9-1.noc.corp.ptd.net > 79.111.123.116: icmp: dhcp9-1.noc.corp.ptd.net protocol 53 unreachable [tos 0xc0] 0x0000 45c0 00e5 80f8 0000 4001 fdc0 ccba 6301 E.......@.....c. 0x0010 4f6f 7b74 0302 df39 0000 0000 4500 00c9 Oo{t...9....E... 0x0020 bf25 0000 0235 fe3b 4f6f 7b74 ccba 6301 .%...5.;Oo{t..c. 0x0030 0001 0203 0405 0607 0809 0a0b 0c0d 0e0f ................ 0x0040 1011 1213 1415 1617 1819 1a1b 1c1d 1e1f ................ 0x0050 2021 2223 2425 2627 2829 2a2b 2c2d 2e2f .!"#$%&'()*+,-./ 0x0060 3031 3233 3435 3637 3839 3a3b 3c3d 3e3f 0123456789:;<=>? 0x0070 4041 4243 4445 4647 4849 4a4b 4c4d 4e4f @ABCDEFGHIJKLMNO 0x0080 5051 5253 5455 5657 5859 5a5b 5c5d 5e5f PQRSTUVWXYZ[\]^_ 0x0090 6061 6263 6465 6667 6869 6a6b 6c6d 6e6f `abcdefghijklmno 0x00a0 7071 7273 7475 7677 7879 7a7b 7c7d 7e7f pqrstuvwxyz{|}~. 0x00b0 8081 8283 8485 8687 8889 8a8b 8c8d 8e8f ................ 0x00c0 9091 9293 9495 9697 9899 9a9b 9c9d 9e9f ................ 0x00d0 a0a1 a2a3 a4a5 a6a7 a8a9 aaab acad aeaf ................ 0x00e0 b0b1 b2b3 b4 ..... 11:59:59.014380 36.71.143.53 > dhcp9-1.noc.corp.ptd.net: mobile: [] (bad checksum 515) 0x0000 4500 00c9 fefc 0000 0237 d5c9 2447 8f35 E........7..$G.5 0x0010 ccba 6301 0001 0203 0405 0607 0809 0a0b ..c............. 0x0020 0c0d 0e0f 1011 1213 1415 1617 1819 1a1b ................ 0x0030 1c1d 1e1f 2021 2223 2425 2627 2829 2a2b .....!"#$%&'()*+ 0x0040 2c2d 2e2f 3031 3233 3435 3637 3839 3a3b ,-./0123456789:; 0x0050 3c3d 3e3f 4041 4243 4445 4647 4849 4a4b <=>?@ABCDEFGHIJK 0x0060 4c4d 4e4f 5051 5253 5455 5657 5859 5a5b LMNOPQRSTUVWXYZ[ 0x0070 5c5d 5e5f 6061 6263 6465 6667 6869 6a6b \]^_`abcdefghijk 0x0080 6c6d 6e6f 7071 7273 7475 7677 7879 7a7b lmnopqrstuvwxyz{ 0x0090 7c7d 7e7f 8081 8283 8485 8687 8889 8a8b |}~............. 0x00a0 8c8d 8e8f 9091 9293 9495 9697 9899 9a9b ................ 0x00b0 9c9d 9e9f a0a1 a2a3 a4a5 a6a7 a8a9 aaab ................ 0x00c0 acad aeaf b0b1 b2b3 b4 ......... 11:59:59.014603 dhcp9-1.noc.corp.ptd.net > 36.71.143.53: icmp: dhcp9-1.noc.corp.ptd.net protocol 55 unreachable [tos 0xc0] 0x0000 45c0 00e5 5815 0000 4001 3e0b ccba 6301 E...X...@.>...c. 0x0010 2447 8f35 0302 df39 0000 0000 4500 00c9 $G.5...9....E... 0x0020 fefc 0000 0237 d5c9 2447 8f35 ccba 6301 .....7..$G.5..c. 0x0030 0001 0203 0405 0607 0809 0a0b 0c0d 0e0f ................ 0x0040 1011 1213 1415 1617 1819 1a1b 1c1d 1e1f ................ 0x0050 2021 2223 2425 2627 2829 2a2b 2c2d 2e2f .!"#$%&'()*+,-./ 0x0060 3031 3233 3435 3637 3839 3a3b 3c3d 3e3f 0123456789:;<=>? 0x0070 4041 4243 4445 4647 4849 4a4b 4c4d 4e4f @ABCDEFGHIJKLMNO 0x0080 5051 5253 5455 5657 5859 5a5b 5c5d 5e5f PQRSTUVWXYZ[\]^_ 0x0090 6061 6263 6465 6667 6869 6a6b 6c6d 6e6f `abcdefghijklmno 0x00a0 7071 7273 7475 7677 7879 7a7b 7c7d 7e7f pqrstuvwxyz{|}~. 0x00b0 8081 8283 8485 8687 8889 8a8b 8c8d 8e8f ................ 0x00c0 9091 9293 9495 9697 9899 9a9b 9c9d 9e9f ................ 0x00d0 a0a1 a2a3 a4a5 a6a7 a8a9 aaab acad aeaf ................ 0x00e0 b0b1 b2b3 b4 ..... 11:59:59.014572 57.21.62.14 > dhcp9-1.noc.corp.ptd.net: nd 181 0x0000 4500 00c9 bcb9 0000 024d 5450 3915 3e0e E........MTP9.>. 0x0010 ccba 6301 0001 0203 0405 0607 0809 0a0b ..c............. 0x0020 0c0d 0e0f 1011 1213 1415 1617 1819 1a1b ................ 0x0030 1c1d 1e1f 2021 2223 2425 2627 2829 2a2b .....!"#$%&'()*+ 0x0040 2c2d 2e2f 3031 3233 3435 3637 3839 3a3b ,-./0123456789:; 0x0050 3c3d 3e3f 4041 4243 4445 4647 4849 4a4b <=>?@ABCDEFGHIJK 0x0060 4c4d 4e4f 5051 5253 5455 5657 5859 5a5b LMNOPQRSTUVWXYZ[ 0x0070 5c5d 5e5f 6061 6263 6465 6667 6869 6a6b \]^_`abcdefghijk 0x0080 6c6d 6e6f 7071 7273 7475 7677 7879 7a7b lmnopqrstuvwxyz{ 0x0090 7c7d 7e7f 8081 8283 8485 8687 8889 8a8b |}~............. 0x00a0 8c8d 8e8f 9091 9293 9495 9697 9899 9a9b ................ 0x00b0 9c9d 9e9f a0a1 a2a3 a4a5 a6a7 a8a9 aaab ................ 0x00c0 acad aeaf b0b1 b2b3 b4 ......... 11:59:59.014837 dhcp9-1.noc.corp.ptd.net > 57.21.62.14: icmp: dhcp9-1.noc.corp.ptd.net protocol 77 unreachable [tos 0xc0] 0x0000 45c0 00e5 8357 0000 4001 4f22 ccba 6301 E....W..@.O"..c. 0x0010 3915 3e0e 0302 df39 0000 0000 4500 00c9 9.>....9....E... 0x0020 bcb9 0000 024d 5450 3915 3e0e ccba 6301 .....MTP9.>...c. 0x0030 0001 0203 0405 0607 0809 0a0b 0c0d 0e0f ................ 0x0040 1011 1213 1415 1617 1819 1a1b 1c1d 1e1f ................ 0x0050 2021 2223 2425 2627 2829 2a2b 2c2d 2e2f .!"#$%&'()*+,-./ 0x0060 3031 3233 3435 3637 3839 3a3b 3c3d 3e3f 0123456789:;<=>? 0x0070 4041 4243 4445 4647 4849 4a4b 4c4d 4e4f @ABCDEFGHIJKLMNO 0x0080 5051 5253 5455 5657 5859 5a5b 5c5d 5e5f PQRSTUVWXYZ[\]^_ 0x0090 6061 6263 6465 6667 6869 6a6b 6c6d 6e6f `abcdefghijklmno 0x00a0 7071 7273 7475 7677 7879 7a7b 7c7d 7e7f pqrstuvwxyz{|}~. 0x00b0 8081 8283 8485 8687 8889 8a8b 8c8d 8e8f ................ 0x00c0 9091 9293 9495 9697 9899 9a9b 9c9d 9e9f ................ 0x00d0 a0a1 a2a3 a4a5 a6a7 a8a9 aaab acad aeaf ................ 0x00e0 b0b1 b2b3 b4 ..... 11:59:59.015060 43.53.57.126 > dhcp9-1.noc.corp.ptd.net: pim v0 0x0000 4500 00c9 2404 0000 0267 ff5b 2b35 397e E...$....g.[+59~ 0x0010 ccba 6301 0001 0203 0405 0607 0809 0a0b ..c............. 0x0020 0c0d 0e0f 1011 1213 1415 1617 1819 1a1b ................ 0x0030 1c1d 1e1f 2021 2223 2425 2627 2829 2a2b .....!"#$%&'()*+ 0x0040 2c2d 2e2f 3031 3233 3435 3637 3839 3a3b ,-./0123456789:; 0x0050 3c3d 3e3f 4041 4243 4445 4647 4849 4a4b <=>?@ABCDEFGHIJK 0x0060 4c4d 4e4f 5051 5253 5455 5657 5859 5a5b LMNOPQRSTUVWXYZ[ 0x0070 5c5d 5e5f 6061 6263 6465 6667 6869 6a6b \]^_`abcdefghijk 0x0080 6c6d 6e6f 7071 7273 7475 7677 7879 7a7b lmnopqrstuvwxyz{ 0x0090 7c7d 7e7f 8081 8283 8485 8687 8889 8a8b |}~............. 0x00a0 8c8d 8e8f 9091 9293 9495 9697 9899 9a9b ................ 0x00b0 9c9d 9e9f a0a1 a2a3 a4a5 a6a7 a8a9 aaab ................ 0x00c0 acad aeaf b0b1 b2b3 b4 ......... 11:59:59.015239 dhcp9-1.noc.corp.ptd.net > 43.53.57.126: icmp: dhcp9-1.noc.corp.ptd.net protocol 103 unreachable [tos 0xc0] 0x0000 45c0 00e5 65bf 0000 4001 7f2a ccba 6301 E...e...@..*..c. 0x0010 2b35 397e 0302 df39 0000 0000 4500 00c9 +59~...9....E... 0x0020 2404 0000 0267 ff5b 2b35 397e ccba 6301 $....g.[+59~..c. 0x0030 0001 0203 0405 0607 0809 0a0b 0c0d 0e0f ................ 0x0040 1011 1213 1415 1617 1819 1a1b 1c1d 1e1f ................ 0x0050 2021 2223 2425 2627 2829 2a2b 2c2d 2e2f .!"#$%&'()*+,-./ 0x0060 3031 3233 3435 3637 3839 3a3b 3c3d 3e3f 0123456789:;<=>? 0x0070 4041 4243 4445 4647 4849 4a4b 4c4d 4e4f @ABCDEFGHIJKLMNO 0x0080 5051 5253 5455 5657 5859 5a5b 5c5d 5e5f PQRSTUVWXYZ[\]^_ 0x0090 6061 6263 6465 6667 6869 6a6b 6c6d 6e6f `abcdefghijklmno 0x00a0 7071 7273 7475 7677 7879 7a7b 7c7d 7e7f pqrstuvwxyz{|}~. 0x00b0 8081 8283 8485 8687 8889 8a8b 8c8d 8e8f ................ 0x00c0 9091 9293 9495 9697 9899 9a9b 9c9d 9e9f ................ 0x00d0 a0a1 a2a3 a4a5 a6a7 a8a9 aaab acad aeaf ................ 0x00e0 b0b1 b2b3 b4 ..... HPING 11:56:40.024194 dhcp9-52.noc.corp.ptd.net > dhcp9-1.noc.corp.ptd.net: swipe 0 0x0000 4500 0014 9f64 0000 0235 b9a6 ccba 6334 E....d...5....c4 0x0010 ccba 6301 0000 0000 0000 0000 0000 0000 ..c............. 0x0020 0000 0000 0000 0000 0000 0000 0000 .............. 11:56:40.024731 dhcp9-1.noc.corp.ptd.net > dhcp9-52.noc.corp.ptd.net: icmp: dhcp9-1.noc.corp.ptd.net protocol 53 unreachable [tos 0xc0] 0x0000 45c0 0030 29df 0000 4001 f083 ccba 6301 E..0)...@.....c. 0x0010 ccba 6334 0302 fcfd 0000 0000 4500 0014 ..c4........E... 0x0020 9f64 0000 0235 b9a6 ccba 6334 ccba 6301 .d...5....c4..c. 11:57:26.534797 dhcp9-52.noc.corp.ptd.net > dhcp9-1.noc.corp.ptd.net: nd 0 0x0000 4500 0014 38fa 0000 024d 1ff9 ccba 6334 E...8....M....c4 0x0010 ccba 6301 0000 0000 0000 0000 0000 0000 ..c............. 0x0020 0000 0000 0000 0000 0000 0000 0000 .............. 11:57:26.534898 dhcp9-1.noc.corp.ptd.netdhcp9-52.noc.corp.ptd.net: icmp: dhcp9-1.noc.corp.ptd.net protocol 77unreachable [tos 0xc0] 0x0000 45c0 0030 29e1 0000 4001 f081 ccba 6301 E..0)...@.....c. 0x0010 ccba 6334 0302 fcfd 0000 0000 4500 0014 ..c4........E... 0x0020 38fa 0000 024d 1ff9 ccba 6334 ccba 6301 8....M....c4..c. 11:57:39.829722 dhcp9-52.noc.corp.ptd.net > dhcp9-1.noc.corp.ptd.net: pim v0 0x0000 4500 0014 368f 0000 0267 224a ccba 6334 E...6....g"J..c4 0x0010 ccba 6301 0000 0000 0000 0000 0000 0000 ..c............. 0x0020 0000 0000 0000 0000 0000 0000 0000 .............. 11:57:39.829814 dhcp9-1.noc.corp.ptd.netdhcp9-52.noc.corp.ptd.net: icmp: dhcp9-1.noc.corp.ptd.net protocol 103unreachable [tos 0xc0] 0x0000 45c0 0030 29e2 0000 4001 f080 ccba 6301 E..0)...@.....c. 0x0010 ccba 6334 0302 fcfd 0000 0000 4500 0014 ..c4........E... 0x0020 368f 0000 0267 224a ccba 6334 ccba 6301 6....g"J..c4..c. 11:57:52.245620 dhcp9-52.noc.corp.ptd.net > dhcp9-1.noc.corp.ptd.net: [|mobile] 0x0000 4500 0014 96be 0000 0237 c24a ccba 6334 E........7.J..c4 0x0010 ccba 6301 0000 0000 0000 0000 0000 0000 ..c............. 0x0020 0000 0000 0000 0000 0000 0000 0000 .............. 11:57:52.245699 dhcp9-1.noc.corp.ptd.net > dhcp9-52.noc.corp.ptd.net: icmp: dhcp9-1.noc.corp.ptd.net protocol 55 unreachable [tos 0xc0] 0x0000 45c0 0030 29e3 0000 4001 f07f ccba 6301 E..0)...@.....c. 0x0010 ccba 6334 0302 fcfd 0000 0000 4500 0014 ..c4........E... 0x0020 96be 0000 0237 c24a ccba 6334 ccba 6301 .....7.J..c4..c. | Keith A. Pachulski, PPS, GCIH, GCFW | NSA IATF Member| FBI InfraGard | Secure Member| PenTeleData/Prolog Internet Services | Information | Security & Privacy| Phone: (800) 281-3564 x 2454 | Pager: | 8884414569 () page metrocall com| 6B56 C8DC 6201 6D1A BFF5 5799 E193 ABAA | 9549 74D0| | "In God We Trust - - - All Others We Monitor"| | --- United States Navy Intelligence| ------------------------------------------------------- This SF.net email is sponsored by: VM Ware With VMware you can run multiple operating systems on a single machine. WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines at the same time. Free trial click here: http://www.vmware.com/wl/offer/345/0 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
- -- - -- http://cerberus.sourcefire.com/~jeff (gpg key available) Great spirits have always encountered violent opposition from mediocre minds. - - Albert Einstein -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2 (Darwin) iD8DBQE/G3IfEqr8+Gkj0/0RAlYrAJ93hEwAokQidE6QedzgOHrzUC+ezwCgyY1h 5HPJVjuoTS1c7htxZxhbnH8= =Ykn3 -----END PGP SIGNATURE----- ------------------------------------------------------- This SF.net email is sponsored by: VM Ware With VMware you can run multiple operating systems on a single machine. WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines at the same time. Free trial click here: http://www.vmware.com/wl/offer/345/0 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- SC Signature and HPING Signature Keith Pachulski (Jul 18)
- Re: SC Signature and HPING Signature Jeff Nathan (Jul 20)
- <Possible follow-ups>
- Fw: SC Signature and HPING Signature james (Jul 18)
- Fw: SC Signature and HPING Signature james (Jul 21)
- Fw: SC Signature and HPING Signature james (Jul 21)