0

I am currently experimenting which Tunnelshell. So, I launched it on the victim and on the attacker, executed a command via the Tunnelshell and captured the traffic via Wireshark to see what's going on under the hood. To my knowledge, all fragments must carry its offset in the original unfragmented packet to ensure that they can be reassembled on the destination host. However, as you can see in the following screenshot:

IP fragmentation

they all have the same offset. In addition, all fragments, except the last one, must have the "More Fragments" flag set, but I can't find that either in any of the fragmented packets. Instead, the flag "Don't fragment" is set:

enter image description here

How can they be successfully reassembled on the attacker's host?

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 14 '17 at 3:58
1

It is kind of the point of covert channels, that they don't play by the normal rules. The idea is that if you follow the standard reassembly algorithm the data looks perfectly harmless. Presumably Tunnelshell runs directly over the packet layer and bypasses the normal reassembly code.

  • Shouldn't the data look perfectly harmless? So why not play by the normal rules? – John Doe May 15 '16 at 12:59
  • See Also: Overlapping Fragment Attack. The point of a covert channel is to make the transmission look harmless while not raising any flags. In this case, it'll trip the aforementioned attack signature of any quality firewall. – Ricky Beam May 16 '16 at 0:51
  • @RickyBeam Thank you for your response. However, to me this seems quite contradictory. You say that covert channels should make the transmission look harmless, but this behavior should be very suspicious to firewalls etc. (fragmented packets all share the same offset and do not have the "More flag" set, which implies that they are the last of the chain). – John Doe May 16 '16 at 12:01
  • I didn't say it was a good covert channel. – Ricky Beam May 16 '16 at 19:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.