Re: tunneling through hotspot firewall

[Paul Melson <pmelson () gmail com>]

On Wed, Apr 22, 2009 at 7:35 AM, Daniel Gultsch <daniel () gultsch de> wrote:
> Ok, lets further suppose I'd have on succesfully logged in (and
> whitelisted) client). An evil attackers joins the notework as well -
> not beeing able to connect to the outside world (because of the
> firewall) but beeing able to sniff all the traffic (it's an unencrypted
> wlan which means hub, basicly). Suppose the attacker would sniff the
> mac address and the ip address of the whitelisted, logged in client and
> give hiself the very same mac address and ip address (both easily can
> be assigned with a simple ifconfig). Suppose the attacker would go on
> and set up a firewall on his computer preventing all packages TCP, IP,
> UDP and everything else from being both recieved or send. (Simple
> iptables rules). He then opens a very tiny whole in his own firewall
> (some strange udp port, which is definitly not used by the other (real)
> client) and uses this udp port to tunnel to an external server
>
> Would this work? Or if not on which layer would it fail. This is
> basicly about Layer 1 and 2. What happens if two clients with the same
> MAC address share a shared medium like wireless lan. The rest starting
> of Layer 4 should definitly work (I'm familar enough with these layers
> to say this. I'm just not sure about the underlaying layers.

You will run into issues with sequence numbers in the 802.11 frames.
But why bother impersonating a whitelisted client address when you can
hijack it altogether with ARP poisoning?

http://ettercap.sourceforge.net/forum/viewforum.php?f=8

PaulM

------------------------------------------------------------------------
This list is sponsored by: InfoSec Institute

Tired of using other people's tools? Why not learn how to write your own exploits? 
InfoSec Institute's Advanced Ethical Hacking class teaches you how to write stack and heap buffer overflow exploits for 
Windows and Linux. Gain your Certified Expert Penetration Tester (CEPT) cert as well. 

http://www.infosecinstitute.com/courses/advanced_ethical_hacking_training.html
------------------------------------------------------------------------