Full Disclosure mailing list archives
Re: modifying shadowchode exploit
From: Jon Hart <warchild () spoofed org>
Date: Sat, 19 Jul 2003 20:26:18 -0400
On Sat, Jul 19, 2003 at 04:52:06PM -0400, Ben Matlock wrote:
I took a look at the output of the released Cisco exploit and added 2 lines to make it generate random payload. More could be done. Ben
I haven't heard anywhere that the packets needed to exploit this vulnerability need _any_ payload, much less a specific one. This is the reason that the IDS signatures that have been generated so far do not alert on any specific payloads but just alert on the specific protocols. Yes, such signatures can be noisey, but this all depends on your network setup and can be tweaked accordingly. There still seems to be some confusion of whether or not the TTL must be 0/1 when it lands at the target. If and when that is confirmed, the signatures could be tweaked more. However, I'm not sure alerting *only* when the protocol is one of the 4 and the TTL is 0 or 1 is the right thing. -jon _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- modifying shadowchode exploit Ben Matlock (Jul 19)
- Re: modifying shadowchode exploit Michal Zalewski (Jul 19)
- RE: modifying shadowchode exploit Warren Rees (Jul 19)
- Re: modifying shadowchode exploit Jon Hart (Jul 19)
- Re: modifying shadowchode exploit Michal Zalewski (Jul 19)