0trace/ 40700 0 0 0 10550026426 10224 5ustar rootroot0trace/types.h100600 764 144 1172 10547774767 12651 0ustar lcamtufusers/* p0f - type definitions ---------------------- Short and portable names for various integer types. Copyright (C) 2003-2006 by Michal Zalewski */ #ifndef _HAVE_TYPES_H #define _HAVE_TYPES_H typedef unsigned char _u8; typedef unsigned short _u16; typedef unsigned int _u32; #ifdef WIN32 typedef unsigned __int64 _u64; #else typedef unsigned long long _u64; #endif /* ^WIN32 */ typedef signed char _s8; typedef signed short _s16; typedef signed int _s32; #ifdef WIN32 typedef signed __int64 _s64; #else typedef signed long long _s64; #endif /* ^WIN32 */ #endif /* ! _HAVE_TYPES_H */ 0trace/0trace.sh100755 0 0 5032 10550027444 12051 0ustar rootroot#!/bin/bash umask 077 T=`mktemp "$HOME/.0trace-XXXXXX"` if [ "$2" = "" ]; then echo "Usage: $0 iface target_ip [ target_port ]" 1>&2 exit 1 fi if [ ! -x /bin/usleep ]; then echo "[-] /bin/usleep not found on this system, sorry." 1>&2 exit 1 fi if [ ! "`uname`" = "Linux" ]; then echo "[-] WARNING: Only Linux is believed to work fine with this utility." 1>&2 fi make sendprobe >/dev/null test -f ./sendprobe || exit 1 echo "0trace v0.01 PoC by " RULE="(tcp[13] & 0x17 == 0x10) and src host $2" test "$3" = "" || RULE="$RULE and src port $3" echo "[+] Waiting for traffic from target on $1..." /usr/sbin/tcpdump -c 1 -s 200 -S -q -i "$1" -n -x "$RULE" >"$T" 2>/dev/null if [ ! -s "$T" ]; then echo "[-] Something went wrong with tcpdump (check parameters)." rm -f "$T" exit 1 fi echo "[+] Traffic acquired, waiting for a gap..." WAITING=0 WAITTIME=0 while [ "$WAITTIME" -lt "80" ]; do /usr/sbin/tcpdump -c 1 -s 200 -S -q -i "$1" -n -x "$RULE" >"$T-2" 2>/dev/null & TPID="$!" usleep 100000 while kill -0 "$TPID" 2>/dev/null; do WAITING=$[WAITING+1] if [ "$WAITING" -gt "20" ]; then kill "$TPID" 2>/dev/null break fi usleep 100000 done test -s "$T-2" || break WAITING=0 cat "$T-2" >"$T" WAITTIME=$[WAITTIME+1] done if [ "$WAITTIME" -ge "80" ]; then echo "[-] Couldn't find a sufficient period of no activity." exit 1 fi cat "$T" | head -3 | tail -1 | sed 's/0x[0-9]*:/ /g' | cut -b25- >"$T-2" read A1 A2 S1 S2 <"$T-2" cat "$T" | head -1 | sed 's/IP //' | cut -d' ' -f2,4 | sed 's/\.\([0-9]*\)[: ]/ \1 /g' >"$T-2" read DADDR DPORT SADDR SPORT <"$T-2" rm -f "$T-2" SEQ=`printf "%u" 0x$S1$S2` ACK=`printf "%u" 0x$A1$A2` echo "[+] Target acquired: $SADDR:$SPORT -> $DADDR:$DPORT ($SEQ/$ACK)." echo "[+] Setting up a sniffer..." /usr/sbin/tcpdump -l -s 200 -S -q -i "$1" -n -x "icmp or ($RULE)" >"$T" 2>/dev/null & TPID="$!" echo "[+] Sending probes..." ./sendprobe $SADDR $DADDR $SPORT $DPORT $SEQ $ACK sleep 2 kill "$TPID" 2>/dev/null echo echo "TRACE RESULTS" echo "-------------" cat "$T" | sed 's/ IP//g;s/^[ ]*0x[0-9]*: //g' | grep -vE '45.0 00' | grep -iA1 'time.excee' | \ grep -vE '^--' | cut -d' ' -f2 | \ sed 's/\([0-9a-f][0-9a-f]\)[0][0]$/\1/g' | \ awk '{if (NR%2) {SAVE=$0} else {print $0 " " SAVE}}' | \ grep -v '[0-9a-f][0-9a-f][0-9a-f][0-9a-f]' | \ while read -r num dat; do echo "$[0x$num] $dat"; done | sort -n -u if grep -qF ': tcp 0' "$T"; then echo "Target reached." else echo "Probe rejected by target." fi echo rm -f "$T" exit 1 0trace/sendprobe.c100600 764 144 5466 10550017521 13437 0ustar lcamtufusers #include #include #include #include #include #include #include #include #include #include #include #include #include "types.h" #define fatal(x) do { perror(x); exit(1); } while (0) #define MAXDIST 30 #define MAXSEQDELTA 3 static _u8 synpacket[] = { /* IP HEADER */ /* IHL */ 0x45, /* ToS */ 0x00, /* totlen */ 0x00, 0x28 + 2, /* ID */ 0x00, 0x00, /* id: [4] */ /* offset */ 0x00, 0x00, /* TTL */ 0xFF, /* ttl: [8] */ /* proto */ 0x06, /* cksum */ 0x00, 0x00, /* saddr */ 0, 0, 0, 0, /* src: [12] */ /* daddr */ 0, 0, 0, 0, /* dst: [16] */ /* TCP HEADER - [20] */ /* sport */ 0, 0, /* sp: [20] */ /* dport */ 0, 0, /* dp: [22] */ /* SEQ */ 0, 0, 0, 0, /* seq: [24] */ /* ACK */ 0, 0, 0, 0, /* ack: [28] */ /* doff */ 0x50, /* flags */ 0x10, /* ACK */ /* wss */ 0xFF, 0xFF, /* cksum */ 0x00, 0x00, /* cksum: [36] */ /* urg */ 0x00, 0x00, 0, 0 }; _u16 simple_tcp_cksum(void) { _u32 sum = 26 + 2 /* tcp, len 20 */; _u8 i; _u8* p = synpacket + 20; for (i=0;i<10 + 1;i++) { sum += (*p << 8) + *(p+1); p+=2; } p = synpacket + 12; for (i=0;i<4;i++) { sum += (*p << 8) + *(p+1); p+=2; } return ~(sum + (sum >> 16)); } int main(int argc, char** argv) { static struct sockaddr_in sain; _s32 sad,dad; _s32 sock, one = 1, i, d; _u16 sp,dp,ck; _u32 seq, ack, seq_o; if (argc - 7 || (sad=inet_addr(argv[1])) == INADDR_NONE || (dad=inet_addr(argv[2])) == INADDR_NONE || !(sp=atoi(argv[3])) || !(dp=atoi(argv[4])) || (sscanf(argv[5],"%lu",&seq_o) != 1) || (sscanf(argv[6],"%lu",&ack) != 1)) { fprintf(stderr,"Usage: %s src_ip dst_ip sport dport seq ack\n",argv[0]); exit(1); } sock=socket(AF_INET,SOCK_RAW,IPPROTO_RAW); if (sock<0) fatal("socket"); if (setsockopt(sock,IPPROTO_IP,IP_HDRINCL,(char *)&one,sizeof(one))) fatal("setsockopt"); sain.sin_family = AF_INET; memcpy(&sain.sin_addr.s_addr,&dad,4); memcpy(synpacket+12,&sad,4); memcpy(synpacket+16,&dad,4); sp=htons(sp); memcpy(synpacket+20,&sp,2); dp=htons(dp); memcpy(synpacket+22,&dp,2); ack=htonl(ack); memcpy(synpacket+28,&ack,4); for (d=1;d