I'm working on a pentesting project, and I have the following setup: I have an SSH daemon that is trying to log all of the activity happening on SSH connections out to another server. I'm trying to disable this logging, and in particular, do so in a way that avoids being detected. Thus, I have the following requirements:
- I need to be able to kill an existing TCP connection, and ideally with as little buffered data sent as possible. That is, if there's outbound data buffered in the kernel, it would be ideal if this data were dropped without being sent.
- In order to achieve this, it's best if the command that I need to type in is as short as possible so that the entire command can be buffered either in the logging application or in the kernel TCP buffer. This way, if the first bullet point is achieved, the logging server will never receive information about the fact that logging was disabled; it will just appear as a network outage.
iptables -A OUTPUT -d <ip of logging server> -j DROP, but that doesn't do the trick - the text of the command itself manages to get sent before the rule is enforced. I've also tried
tcpkill, similarly to no avail.