0

I am currently experimenting which Tunnelshell. So, I launched it on the victim and on the attacker, executed a command via the Tunnelshell and captured the traffic via Wireshark to see what's going on under the hood. To my knowledge, all fragments must carry its offset in the original unfragmented packet to ensure that they can be reassembled on the destination host. However, as you can see in the following screenshot:

IP fragmentation

they all have the same offset. In addition, all fragments, except the last one, must have the "More Fragments" flag set, but I can't find that either in any of the fragmented packets. Instead, the flag "Don't fragment" is set:

enter image description here

How can they be successfully reassembled on the attacker's host?

Improve this question
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Commented Aug 14, 2017 at 3:58

1 Answer 1

Reset to default
1

It is kind of the point of covert channels, that they don't play by the normal rules. The idea is that if you follow the standard reassembly algorithm the data looks perfectly harmless. Presumably Tunnelshell runs directly over the packet layer and bypasses the normal reassembly code.

Improve this answer
4
  • Shouldn't the data look perfectly harmless? So why not play by the normal rules?
    – John Doe
    Commented May 15, 2016 at 12:59
  • See Also: Overlapping Fragment Attack. The point of a covert channel is to make the transmission look harmless while not raising any flags. In this case, it'll trip the aforementioned attack signature of any quality firewall.
    – Ricky
    Commented May 16, 2016 at 0:51
  • @RickyBeam Thank you for your response. However, to me this seems quite contradictory. You say that covert channels should make the transmission look harmless, but this behavior should be very suspicious to firewalls etc. (fragmented packets all share the same offset and do not have the "More flag" set, which implies that they are the last of the chain).
    – John Doe
    Commented May 16, 2016 at 12:01
  • I didn't say it was a good covert channel.
    – Ricky
    Commented May 16, 2016 at 19:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.