0

I am trying to close sockets related to my webserver so the client does not have to refresh the browser twice to connect to the new webserver.

I have successfully written a bash script which can track down the sockets I want to kill (and it even ensures the client isn't actively downloading/uploading data). When it comes to my publicly accessible server, 192.168.0.21:443, killcx can spoof the tcp packets for that connection and then close the sockets. When it comes to my secret challenge server (part of a technical treasure hunt for the public), killcx cannot spoof the tcp packet to kill the sockets. The secret challenge server is located at 127.0.0.1:5002. I have tested all my devices (eth0, wlan0, and lo) and found only wlan0 allows tcpkill to find the challenge server's tcp packets.

TCPKill can successfully kill the sockets for both servers, it just requires the client to send tcp packets it can read. I have not successfully spoofed TCP Packets from either NMap or from hping2, that can cause tcpkill to succeed. TCPKill can detect packets from both NMap and hping2, however, it doesn't successfully kill the sockets unless the tcp packets come from the real browser.

I have been testing this program from the same IP Address my server is located at.

How can I fix the problem where I cannot automatically kill the sockets for a localhost server?


KillCX Error Message for 127.0.0.1:5002

received child signal, checking results...
             => error : connection hasn't been closed

KillConnection.sh

# Sudo is needed for this program (for TCPKill and KillCX)

# $1 is client ip address and $2 is host/port of service
# $3 is network device (e.g. wlan0)

#!/bin/bash
cat=/bin/cat
grep=/bin/grep
cut=/usr/bin/cut
netstat=/bin/netstat
tcpkill=/usr/sbin/tcpkill
sudo=/usr/bin/sudo
perl=/usr/bin/perl
rev=/usr/bin/rev
sed=/bin/sed
tcpkill=/usr/sbin/tcpkill

killcx=/home/web/programs/killconnection/killcx.pl

if [ $# -lt 3 ]
then
  echo "You Need To Specify A Command!!!"
  echo "./program client-ip-address host/port-of-service network-device-e.g.-wlan0"
  exit
fi

# $1 is client ip address and $2 is host/port of service
connections=$($netstat -en | $grep $1 | $grep $2)

#hosts=$(echo $connections | $cut -d: -f2 | $rev | $cut -d' ' -f1 | $rev)
#ports=$(echo $connections | $cut -d: -f3 | $cut -d' ' -f1)
#inodes=$(echo $connections | $rev | $cut -d ' ' -f1 | $rev)

IFS="
"
for connection in $connections
do
  inode=$(echo $connection | $rev | $sed -e 's/^[ \t]*//' | $cut -d' ' -f1 | $rev)
  activity=$($cat /proc/net/tcp | $grep $inode | $cut -d' ' -f7)
  server_send=$(echo $activity | $cut -d: -f1)
  server_receive=$(echo $activity | $cut -d: -f1)

  echo "Connection: $connection"
  echo "Inode: $inode Activity: $activity"
  echo "Send: $server_send Receive: $server_receive"
  if [ "$server_send" = "00000000" ] && [ "$server_receive" = "00000000" ]; then
    # Run TCPKill and KillCX only if the server is not currently transmitting data

    host=$(echo $connection | $cut -d: -f2 | $rev | $cut -d' ' -f1 | $rev)
    port=$(echo $connection | $cut -d: -f3 | $cut -d' ' -f1)

    # https://stackoverflow.com/a/33203048/6828099
    echo $connection

    echo "Client Connection: $host:$port"
    echo $tcpkill -i $3 port $port
    $tcpkill -i $3 port $port &

    #echo $perl $killcx $host:$port $3
    #$perl $killcx $host:$port $3

    #echo nmap -g $port -p 0 $host
    #nmap -g $port -p 0 $host

    # https://serverfault.com/a/585433/379269
    sleep 3
    for child in $(jobs -p | cut -d' ' -f4); do
      echo Kill TCPKill "$child" && kill "$child"
    done
    wait $(jobs -p)
  fi
done

Log of Connection Killing Program - KillCX (Edited)

# This is KillCX killing the sockets for 192.168.0.21:443
➜  killconnection sudo ./killconnection.sh 71.31.185.234 443 wlan0 
Connection: tcp        0      0 192.168.0.21:443        71.31.185.234:57856     ESTABLISHED 1001       519503    
Inode: 519503 Activity: 00000000:00000000
Send: 00000000 Receive: 00000000
tcp        0      0 192.168.0.21:443        71.31.185.234:57856     ESTABLISHED 1001       519503    
Client Connection: 71.31.185.234:57856
/usr/bin/perl /home/web/programs/killconnection/killcx.pl 71.31.185.234:57856 wlan0
killcx v1.0.3 - (c)2009-2011 Jerome Bruandet - http://killcx.sourceforge.net/

[PARENT] checking connection with [71.31.185.234:57856]
[PARENT] found connection with [192.168.0.21:443] (ESTABLISHED)
[PARENT] forking child
[CHILD]  setting up filter to sniff ACK on [wlan0] for 5 seconds
[PARENT] sending spoofed SYN to [192.168.0.21:443] with bogus SeqNum
[CHILD]  hooked ACK from [192.168.0.21:443]
[CHILD]  found AckNum [1075153961] and SeqNum [3467671392]
[CHILD]  sending spoofed RST to [192.168.0.21:443] with SeqNum [1075153961]
[CHILD]  sending RST to remote host as well with SeqNum [3467671392]
[CHILD]  all done, sending USR1 signal to parent [8763] and exiting
[PARENT] received child signal, checking results...
         => success : connection has been closed !

# This is KillCX failing to kill the sockets for 127.0.0.1:5002
➜  killconnection sudo ./killconnection.sh 71.31.185.234 5002 wlan0
Connection: tcp        0      0 127.0.0.1:5002          71.31.185.234:57857     ESTABLISHED 1001       519587    
Inode: 519587 Activity: 00000000:00000000
Send: 00000000 Receive: 00000000
tcp        0      0 127.0.0.1:5002          71.31.185.234:57857     ESTABLISHED 1001       519587    
Client Connection: 71.31.185.234:57857
/usr/bin/perl /home/web/programs/killconnection/killcx.pl 71.31.185.234:57857 wlan0
killcx v1.0.3 - (c)2009-2011 Jerome Bruandet - http://killcx.sourceforge.net/

[PARENT] checking connection with [71.31.185.234:57857]
[PARENT] found connection with [127.0.0.1:5002] (ESTABLISHED)
[PARENT] forking child
[CHILD]  setting up filter to sniff ACK on [wlan0] for 5 seconds
[PARENT] sending spoofed SYN to [127.0.0.1:5002] with bogus SeqNum
[CHILD]  hooked ACK from [127.0.0.1:5002]
[CHILD]  found AckNum [11] and SeqNum [3156305827]
[CHILD]  sending spoofed RST to [127.0.0.1:5002] with SeqNum [11]
[CHILD]  sending RST to remote host as well with SeqNum [3156305827]
[CHILD]  all done, sending USR1 signal to parent [8861] and exiting
[PARENT] received child signal, checking results...
         => error : connection hasn't been closed

Log of Connection Killing Program - TCPKill (Edited)

➜  killconnection sudo ./killconnection.sh 71.31.185.234 5002 wlan0
Connection: tcp        0      0 127.0.0.1:5002          71.31.185.234:57830     ESTABLISHED 1001       514458    
Inode: 514458 Activity: 00000000:00000000
Send: 00000000 Receive: 00000000
tcp        0      0 127.0.0.1:5002          71.31.185.234:57830     ESTABLISHED 1001       514458    
Client Connection: 71.31.185.234:57830
/usr/sbin/tcpkill -i wlan0 port 57830
tcpkill: listening on wlan0 [port 57830]

# These were sent by NMap
192.168.0.21:57830 > 71.31.185.234:80: R 2316481316:2316481316(0) win 0
192.168.0.21:57830 > 71.31.185.234:80: R 2316482340:2316482340(0) win 0
192.168.0.21:57830 > 71.31.185.234:80: R 2316484388:2316484388(0) win 0

# These were sent by Chrome on Desktop
71.31.185.234:57830 > 192.168.0.21:443: R 650205182:650205182(0) win 0
71.31.185.234:57830 > 192.168.0.21:443: R 650207230:650207230(0) win 0
71.31.185.234:57830 > 192.168.0.21:443: R 650211326:650211326(0) win 0
192.168.0.21:443 > 71.31.185.234:57830: R 473027993:473027993(0) win 0
192.168.0.21:443 > 71.31.185.234:57830: R 473028245:473028245(0) win 0
192.168.0.21:443 > 71.31.185.234:57830: R 473028749:473028749(0) win 0
71.31.185.234:57830 > 192.168.0.21:443: R 650205182:650205182(0) win 0
71.31.185.234:57830 > 192.168.0.21:443: R 650207230:650207230(0) win 0
71.31.185.234:57830 > 192.168.0.21:443: R 650211326:650211326(0) win 0
192.168.0.21:443 > 71.31.185.234:57830: R 473028031:473028031(0) win 0
192.168.0.21:443 > 71.31.185.234:57830: R 473028283:473028283(0) win 0
192.168.0.21:443 > 71.31.185.234:57830: R 473028787:473028787(0) win 0
71.31.185.234:57830 > 192.168.0.21:443: R 650205289:650205289(0) win 0
71.31.185.234:57830 > 192.168.0.21:443: R 650207335:650207335(0) win 0
71.31.185.234:57830 > 192.168.0.21:443: R 650211427:650211427(0) win 0
71.31.185.234:57830 > 192.168.0.21:443: R 650205327:650205327(0) win 0
71.31.185.234:57830 > 192.168.0.21:443: R 650207374:650207374(0) win 0
71.31.185.234:57830 > 192.168.0.21:443: R 650211468:650211468(0) win 0
71.31.185.234:57830 > 192.168.0.21:443: R 650205327:650205327(0) win 0
71.31.185.234:57830 > 192.168.0.21:443: R 650207375:650207375(0) win 0
71.31.185.234:57830 > 192.168.0.21:443: R 650211471:650211471(0) win 0
192.168.0.21:443 > 71.31.185.234:57830: R 473028065:473028065(0) win 0
192.168.0.21:443 > 71.31.185.234:57830: R 473028317:473028317(0) win 0
192.168.0.21:443 > 71.31.185.234:57830: R 473028821:473028821(0) win 0
192.168.0.21:443 > 71.31.185.234:57830: R 473028065:473028065(0) win 0
192.168.0.21:443 > 71.31.185.234:57830: R 473028317:473028317(0) win 0
192.168.0.21:443 > 71.31.185.234:57830: R 473028821:473028821(0) win 0
71.31.185.234:57830 > 192.168.0.21:443: R 650205327:650205327(0) win 0
71.31.185.234:57830 > 192.168.0.21:443: R 650207375:650207375(0) win 0
71.31.185.234:57830 > 192.168.0.21:443: R 650211471:650211471(0) win 0
71.31.185.234:57830 > 192.168.0.21:443: R 650205327:650205327(0) win 0
71.31.185.234:57830 > 192.168.0.21:443: R 650207375:650207375(0) win 0
71.31.185.234:57830 > 192.168.0.21:443: R 650211471:650211471(0) win 0
71.31.185.234:57830 > 192.168.0.21:443: R 650205327:650205327(0) win 0
71.31.185.234:57830 > 192.168.0.21:443: R 650207375:650207375(0) win 0
71.31.185.234:57830 > 192.168.0.21:443: R 650211471:650211471(0) win 0
71.31.185.234:57830 > 192.168.0.21:443: R 650205327:650205327(0) win 0
71.31.185.234:57830 > 192.168.0.21:443: R 650207375:650207375(0) win 0
71.31.185.234:57830 > 192.168.0.21:443: R 650211471:650211471(0) win 0
71.31.185.234:57830 > 192.168.0.21:443: R 650205327:650205327(0) win 0
71.31.185.234:57830 > 192.168.0.21:443: R 650207375:650207375(0) win 0
71.31.185.234:57830 > 192.168.0.21:443: R 650211471:650211471(0) win 0
71.31.185.234:57830 > 192.168.0.21:443: R 650205327:650205327(0) win 0
71.31.185.234:57830 > 192.168.0.21:443: R 650207375:650207375(0) win 0
71.31.185.234:57830 > 192.168.0.21:443: R 650211471:650211471(0) win 0
^C

Edit:

I am running my server on a Raspberry Pi 3 running Raspian

➜  killconnection uname -a
Linux Rover 4.14.79-v7+ #1159 SMP Sun Nov 4 17:50:20 GMT 2018 armv7l GNU/Linux

From /etc/knockd.conf

[options]
        #UseSyslog
        logfile = /var/log/knockd.log
        interface = wlan0

# Public Config Below

[webChallenge]
        sequence    = 1234,4321,9876,6789
        seq_timeout = 5
    command = /sbin/iptables -A INPUT -s %IP% -p udp --dport 53 -j ACCEPT && /sbin/iptables -A INPUT -s %IP% -p tcp --dport 5002 -j ACCEPT && /sbin/iptables -t nat -I PREROUTING 1 -s %IP% -p tcp --dport 443 -j DNAT --to-destination 127.0.0.1:5002
        tcpflags    = syn

[webChallenge-Close]
        sequence    = 6789,9876,4321,1234
        seq_timeout = 5
    command = /sbin/iptables -D INPUT -s %IP% -p udp --dport 53 -j ACCEPT && /sbin/iptables -D INPUT -s %IP% -p tcp --dport 5002 -j ACCEPT && /sbin/iptables -t nat -D PREROUTING -s %IP% -p tcp --dport 443 -j DNAT --to-destination 127.0.0.1:5002
        tcpflags    = syn

IP Tables Commands

# Open Web Challenge
/sbin/iptables -A INPUT -s %IP% -p udp --dport 53 -j ACCEPT
/sbin/iptables -A INPUT -s %IP% -p tcp --dport 5002 -j ACCEPT
/sbin/iptables -t nat -I PREROUTING 1 -s %IP% -p tcp --dport 443 -j DNAT --to-destination 127.0.0.1:5002

# Close Web Challenge
/sbin/iptables -D INPUT -s %IP% -p udp --dport 53 -j ACCEPT
/sbin/iptables -D INPUT -s %IP% -p tcp --dport 5002 -j ACCEPT
/sbin/iptables -t nat -D PREROUTING -s %IP% -p tcp --dport 443 -j DNAT --to-destination 127.0.0.1:5002
  • There was just a comment here asking for my host and configuration, so I added those details here. – SenorContento Mar 16 at 16:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.