2

I've used iptables to reroute traffic to netsed like this, but it seems to route the traffic to another location.

I've used hexinject like this:

hexinject -s -i eth0 -c 1 -f 'arp' | replace '06 04 00 01' '06 04 00 02' | hexinject -p -i eth0

but the problem with hexinject is that it only injects, it doesn't replace the original packet, it just sends another one.

I've also used ettercap + etterfilter, but it doesn't seem to replace the traffic:

if (ip.proto == UDP) {
   if (search(DATA.data, "\x1f\x0f\x00\x08\x00\x01")) {
      log(DATA.data, "/tmp/payload");
      drop();
      execinject("/bin/sed s/\x1f\x0f\x00\x08\x00\x01/\x1f\x0f\x00\x08\x00\x00/g' /tmp/payload");
      msg("caught!");   
   }
}

What I want to do is replace the hex representation of 1f 0f 00 08 00 01 to 1f 0f 00 08 00 00, just changing the last bit to zero, but I was unable to get iptables + netsed, hexinject, or ettercap + etterfilter to work.

Here's a visualization:

Server attempts to send 1f 0f 00 08 00 01 to someone, a program changes so that 1f 0f 00 08 00 00 is sent instead.

What can I try next? Or maybe I'm using these programs in the wrong way.

  • Heck with hexinject and other possible tools. Formulate the problem (what to be achieved) from the beginning, please; and don’t expect me following to the bullies’ site even by direct links. – Incnis Mrsi Sep 19 '15 at 14:22
1

You can use HexInject and just add a firewall rule to block the forwarding of that specific packet.

Easy and simple.

An example using IPTables to block UDP packets to port 53:

iptables -A FORWARD -p udp --destination-port 53 -j DROP

If you instead want to filter at layer2, you can give a look at EBTables.

It is a sort of firewall for layer 2 frames.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.