Security #3394
closedTCP evasion technique by overlapping a TCP segment with a fake packet (4.1.x)
1c63d3905852f746ccde7e2585600b2199cefb4b
Description
It's possible to bypass/evade any tcp based signature by overlapping a TCP segment with a fake FIN packet.
The fake FIN packet is injected just before the PUSH ACK packet we want to bypass. The PUSH ACK packet (containing the data) will be ignored by suricata because it overlaps the FIN packet (the sequence and ack number are identical in the two packets).
The client will ignore the fake FIN packet because the ACK flag is not set.
Both linux and windows client are ignoring the injected packet.
Client =============== Legit TCP handshake ================= Evil Server Client <- [FIN] [Seq=80 Ack=100] XXXXXXX <- Evil Server # injected packet with fake data (ignored by the client) Client <- [PUSH, ACK] [Seq=80 Ack=100] MALWARE <- Evil Server # Legit data (ignored by suricata)
This evasion technique is referenced as CVE-2019-18792.
You can find attached :
- test.rule : A tcp rule that detects the string THIS_IS_A_TEST
- without_evasion.pcap : A web server which sends the string THIS_IS_A_TEST to a client without any evasion technique
- with_evasion_windows.pcap : A web server which sends the string THIS_IS_A_TEST to a windows 10 client with this evasion technique
- with_evasion_linux.pcap : A web server which sends the string THIS_IS_A_TEST to a linux client (tested with kernel 5.2.0) with this evasion technique
Files
Updated by Victor Julien almost 5 years ago
- Copied from Security #3324: TCP evasion technique by overlapping a TCP segment with a fake packet added
Updated by Victor Julien almost 5 years ago
- Status changed from New to Closed
- Priority changed from High to Normal
- Private changed from Yes to No
Updated by Victor Julien over 4 years ago
- Tracker changed from Bug to Security
- CVE set to 2019-18792
- Git IDs updated (diff)