I'm working on a pentesting project, and I have the following setup: I have an SSH daemon that is trying to log all of the activity happening on SSH connections out to another server. I'm trying to disable this logging, and in particular, do so in a way that avoids being detected. Thus, I have the following requirements:

  • I need to be able to kill an existing TCP connection, and ideally with as little buffered data sent as possible. That is, if there's outbound data buffered in the kernel, it would be ideal if this data were dropped without being sent.
  • In order to achieve this, it's best if the command that I need to type in is as short as possible so that the entire command can be buffered either in the logging application or in the kernel TCP buffer. This way, if the first bullet point is achieved, the logging server will never receive information about the fact that logging was disabled; it will just appear as a network outage.

I've tried iptables -A OUTPUT -d <ip of logging server> -j DROP, but that doesn't do the trick - the text of the command itself manages to get sent before the rule is enforced. I've also tried tcpkill, similarly to no avail.

  • Can you spoof a packet out with a RST flag to the logging connection? – infixed Apr 7 '17 at 19:46
  • That's what tcpkill is supposed to do, and it unfortunately got logged before taking effect. – joshlf Apr 7 '17 at 20:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.