Summerschool Aachen 2004/Notes

General Notes about the Summerschool, Aachen, Software, whatever comes to your mind.

Lab Net

TSocks

If you still have trouble with socks i suggest the tsocks package, works nicely with openssh and apt-get. I guess you already know about proxy enviroment variables. dante is the other LD wrapper for socks.

Proxy ENV

export http_proxy=http://172.17.23.1:3128
export ftp_proxy=http://172.17.23.1:3128

Socat SSH

socat command line to get SSH working I used these commands to access SSH on $REMOTEMACHINE

$ socat TCP4-LISTEN:31228,reuseaddr \
SOCKS4:172.17.23.1:$REMOTEMACHINE:22,socksport=1080
$ ssh localhost -p31228

corkscrew

ilja@nikita:~/corkscrew-2.0%cat ~/.ssh/config
ProxyCommand /home/ilja/corkscrew-2.0/corkscrew 172.17.23.1 3128 %h %p
ilja@nikita:~/corkscrew-2.0%

dante

(Running on OpenBSD under VMWare, but should work anywhere...)

$ cat /etc/socks.conf
# have a route making all connections to loopback addresses be direct.
route {
       from: 0.0.0.0/0   to: 127.0.0.0/8  via: direct
       command: connect udpassociate # everything but bind, bind confuses us.
}

route {
       from: 0.0.0.0/0   to: 172.17.23.0/24   via: direct
}

route {
       from: 0.0.0.0/0   to: 0.0.0.0/0   via: 172.17.23.1 port = 1080
       protocol: tcp udp                # server supports tcp and udp.
       proxyprotocol: socks_v4 socks_v5 # server supports socks v4 and v5.
       method: none #username           # we are willing to authenticate via
                                        # method "none", not "username".
}

Note: On Debian/GNU Linux the config file is called /etc/dante.conf

After configuring dante, the "socksify" script can be used to make applications use the SOCKS proxy.

One of the printers has some issues

While I was sniffing my own traffic I noticed some broadcast from some device (which later turned out to be a printer). The remarkable thing about this packet was that the ethernet frame padding wasn't something like "\x00\x00\x00" instead it was some random string. This is probably an etherleak more info on them here.

Then i decided to do an os fingerprint to see what kind of device it was, the coolest piece of info I got from nmap said:

TCP Sequence Prediction: Class=trivial time dependency
                         Difficulty=0 (Trivial joke)

Then I used isnprobe (you can get that from ftp.ubizen.com) to check the isn's more carefully this is the output:

root@nikita:/home/ilja/isnprober-1.02#./isnprober -n 10 137.226.59.140
-- ISNprober / 1.02 / Tom Vandepoel (Tom.Vandepoel@ubizen.com) -- 

Using eth0:137.226.59.161
Probing host: 137.226.59.140 on TCP port 80.

Host:port           ISN            Delta          
137.226.59.140:80   3146095                       
137.226.59.140:80   3146096        1              
137.226.59.140:80   3146097        1              
137.226.59.140:80   3146098        1              
137.226.59.140:80   3146099        1              
137.226.59.140:80   3146100        1              
137.226.59.140:80   3146101        1              
137.226.59.140:80   3146102        1              
137.226.59.140:80   3146103        1              
137.226.59.140:80   3146104        1              
root@nikita:/home/ilja/isnprober-1.02#

My guess is that the ISN gets incremented by 1 every second.

-- Ilja van Sprundel

Captured Data from the Lab

I used wireshark and tshark to do some analysis of the collected data.

Statistics

• ca. 16h of traffic
• from 2004-09-29 21:59:04 to 2004-09-30 13:55:18
• number of packets: 1876888
• packets/s: 32.713
• Size: 1.6gb