IPv6 destructive exploit - Printable Version

IPv6 destructive exploit - Printable Version

+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Tutorials (https://sinister.ly/Forum-Tutorials)
+--- Thread: IPv6 destructive exploit (/Thread-IPv6-destructive-exploit)

Pages: 1 2

IPv6 destructive exploit - chmod - 02-02-2013

Hello HC as we know IPv6 is bad, the idea behind it was good but in reality the technology is incredibly insecure, especially in windows machines. This tutorial will teach you about the more dangerous side of IPv6 and will cause windows machines to lock up and crash

vulnerable machines:
Windows-some XP(if IPv6 has been eneabled), vista, 7, 8
other devices I crashed my printer doing this so be warned!
Android seams to be immune to it
I believe iThings are also immune as well as macs
most UNIX\Linux distros are also immune apart from some BSB

OK enough rambling let's get started. We will be using a tool called thc-ipv6, it comes pre-installed on backtrack but for some reason was broken on my install so I had to mess with it to get it working.

Here's how I got it working

First make a temp directory anywhere you like and cd to that in the terminal.
Then enter

Code:
wget http://www.thc.org/releases/thc-ipv6-1.8.tar.gz

to download the required package
Use

Code:
rar zfxv thc-ipv6-1.8.tar.gz

to extract the files then cd into it
Lastly use

Code:
make

then

Code:
make install

That was the hard part believe it or not from your teminal window type:

Code:
flood_router6 eth0*

to make everything die. As the tool runs it floods the target network with IPv6 requests taking up resources until a few seconds later they are all exhausted and the computer freezes meaning the only way to fix is to hard reset the computer.
while the attack is happening you will notice lots of . appearing in the terminal each one represents 100 packets.

*replace eth0 with your network interface

Microsoft are aware of the issue and so far will not be making any effort to fix this.

This tutorial is for educational purposes only. I take no responsibility if you use this information maliciously

RE: IPv6 destructive exploit - malkovicht - 08-20-2013

@chmod o__O sound preety spooky,. thanks for share this,.

RE: IPv6 destructive exploit - joeb12 - 12-09-2013

According to the release notes (https://www.thc.org/thc-ipv6/), flood_router6: flood a target with random router advertisements. So a DoS attack. Surely resetting the network stack would resolve such issues? Anyway if I have a static route table these routing updates would be ignored. Some routers will "see" the false information and update nodes correctly (specifically some Avaya, Juniper and Cisco models).
I fail to see how a machine would "lock up" due to having an incorrect route. Surely that just means you won't be able to get off your local network?

RE: IPv6 destructive exploit - chmod - 12-09-2013

(12-09-2013, 03:10 PM)joeb12 Wrote: According to the release notes (https://www.thc.org/thc-ipv6/), flood_router6: flood a target with random router advertisements. So a DoS attack. Surely resetting the network stack would resolve such issues? Anyway if I have a static route table these routing updates would be ignored. Some routers will "see" the false information and update nodes correctly (specifically some Avaya, Juniper and Cisco models).
I fail to see how a machine would "lock up" due to having an incorrect route. Surely that just means you won't be able to get off your local network?

You are not understanding how this attack works, the vulnerability lies within Windows itself which has not such checking policies. Having one false entry is not a problem you are correct there but this attack uses hundreds each one taking recourses from the computer until after a minute or two there are none left and computer simply locks up. Windows (and a few other OS') itself performs no checks against this happening so simply allows all of these connections to happen.

RE: IPv6 destructive exploit - joeb12 - 12-10-2013

Okay the best I can see here is using up all descriptors so the TCP/IP stack has no resources free. Perhaps the CPU will be inundated to process all this stuff. Surely killing the stack will free resources and eventually free the CPU (if it is busy).
But given most machines come with gigabit interfaces we're talking a HUGE amount of packets. If you're running on say a 10Mbps or a 100Mbps LAN then you're more likely to flood the network than kill off the machine.
Simple mitigations: Filter the known multicast address in your firewall or configure your stack not to listen for them.

Add the CVE: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-4669 from 2001.

Oops that should be 2011 sorry.

Add the CVE: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-4669 from 2001.

Oops that should be 2011 sorry.

RE: IPv6 destructive exploit - chmod - 12-10-2013

(12-10-2013, 11:26 AM)joeb12 Wrote: Okay the best I can see here is using up all descriptors so the TCP/IP stack has no resources free. Perhaps the CPU will be inundated to process all this stuff. Surely killing the stack will free resources and eventually free the CPU (if it is busy).
But given most machines come with gigabit interfaces we're talking a HUGE amount of packets. If you're running on say a 10Mbps or a 100Mbps LAN then you're more likely to flood the network than kill off the machine.
Simple mitigations: Filter the known multicast address in your firewall or configure your stack not to listen for them.

Add the CVE: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-4669 from 2001.

Oops that should be 2011 sorry.

We are talking huge amounts of packets something like 5 or 6 thousand a second. Filtering the multicast address is fine IF you know the address the attacker is using, but this address can be easily spoofed. I have tested this on my own network and can confirm that the effect is correct it locked up 2 Windows machines and the network printer, as I said in my OP most OS' automatically ignore multiple RA's however at the time of writing Windows does not allowing an attacker to take advantage of this method. (I'm not sure if it is now fixed last I heard Microsoft was aware of this and the possible outcome but had no plans to fix this).

RE: IPv6 destructive exploit - chmod - 12-10-2013

(12-10-2013, 11:26 AM)joeb12 Wrote: Okay the best I can see here is using up all descriptors so the TCP/IP stack has no resources free. Perhaps the CPU will be inundated to process all this stuff. Surely killing the stack will free resources and eventually free the CPU (if it is busy).
But given most machines come with gigabit interfaces we're talking a HUGE amount of packets. If you're running on say a 10Mbps or a 100Mbps LAN then you're more likely to flood the network than kill off the machine.
Simple mitigations: Filter the known multicast address in your firewall or configure your stack not to listen for them.

Add the CVE: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-4669 from 2001.

Oops that should be 2011 sorry.

RE: IPv6 destructive exploit - joeb12 - 12-10-2013

The address is in RFC 4286. Try this: netsh interface ipv6 set interface "Local Area Connection" routerdiscovery=disabled

Also open "Windows Firewall with Advanced Security" and double-click the "Core Networking - Router Advertisement (ICMPv6-In)" rule, in the Properties sheet, on the Scope tab, "Remote IP address" section you could put the address of your known router, if you put in something like fe80::/64 it'll accept data from any node.