breaking into existing socket connection

[trackh4t]

I'm not 100% certain this is possible, but you guys just let me know if I've got the technicality messed up.

Here's the case:
I have a java applet (no it's not runescape) working with a TCP connection over port 499. I can see from tcpick(ing) that there's an authentication proces, which makes it hard for me to simply open a telnet connection to the server (If I do so it prompts me for a handshake, but I don't know the encoding, so I dont know how to respond).

What I am interested in doing is - after the authentication has happened - break into the socket connected and be able to send my own packets to the server/applet through the existing connection.

How should I approach that, and what tool could I use?

Thank you

[lupin]

You can use something like Hunt to do TCP session hijacking from the local network, but there are limitations to how well it works. Usually you will get to send one communication to the server before an ACK storm occurs - unless you can somehow prevent ACKS from the server for data you sent getting to the original client.

Try it out and report back with your results, I'd be curious to know how you go.

[trackh4t]

I have actually been trying to use hun, but without much success. I could never look up any hosts. I tried entering both my ip from the outside (when i wasn't behind a router) my ip given by the router (192.xx) and the ip of the webserver i was communicating with, but it gave me no match. I've been googling my ass off trying to find a decent guide, but so far I've been unsuccesfull - any Intel on this?

To elaborate on this:
No connections occur. I try opening a telnet connection just to get some response, but not even that is registered. I should say that I'm using interface eth1 or ppp0 and not the default eth0, but I have specified this via the -i parameter, so it should be configured correctly

And i found this h t t p://9lessons.blogspot.com/2008/12/tcp-hijack.html ransmission Control Protocol (TCP) Hijack saying that I could add ports for hunt to listen on, but I don't have any hunt.c or addpolicy file when I try to use "locate hunt.c" I get nothing in return

[lupin]

I have actually been trying to use hun, but without much success. I could never look up any hosts. I tried entering both my ip from the outside (when i wasn't behind a router) my ip given by the router (192.xx) and the ip of the webserver i was communicating with, but it gave me no match. I've been googling my ass off trying to find a decent guide, but so far I've been unsuccesfull - any Intel on this?

To elaborate on this:
No connections occur. I try opening a telnet connection just to get some response, but not even that is registered. I should say that I'm using interface eth1 or ppp0 and not the default eth0, but I have specified this via the -i parameter, so it should be configured correctly

To use hunt both systems need to be on the same subnet.

If this is not the case, you will probably need to take another approach for this, and none of the approaches I can think of will be that easy. Either reverse engineer the logon process and write it into your own tool (which you have apparently already looked at) - java source code for the program may help, capture and replay the logon process (if it is replayable - how much does it change between subsequent attempts?), or create a custom proxy that can switch between two input sources at a time of your choosing to redirect the connection.

[trackh4t]

To use hunt both systems need to be on the same subnet.

If this is not the case, you will probably need to take another approach for this, and none of the approaches I can think of will be that easy. Either reverse engineer the logon process and write it into your own tool (which you have apparently already looked at) - java source code for the program may help, capture and replay the logon process (if it is replayable - how much does it change between subsequent attempts?), or create a custom proxy that can switch between two input sources at a time of your choosing to redirect the connection.

Ouch - I can only use hunt locally? I thought I would be able to, because from my perspective changing post packets with tamper data or wireshark and such seems like the same thing as sending data via an already existing socket to me. perhaps I should study a bit harder on network technicalities. That's a real bitch... Then I will have to reverse engineer. I've actually already penetrated the first of their logon systems (there's a whole sequence - an initial handshake and then a second challengestring which is more heavily encrypted - don't ask me why there are 2 layers :P)

Thank you for your reply.

[lupin]

Ouch - I can only use hunt locally?

I actually might have been wrong about that. I was reading about hunt about a week ago and that reference said that Hunt only worked locally. That may have been referring to an older version though - I just read the Link below referring to v 1.2 and above and it seems to indicate otherwise...

.:[ packet storm ]:. - http://packetstormsecurity.org/

[trackh4t]

something's not working for me entirely right. I found out that I had the bin version of hunt, so I went out and got myself one I could compile with make myself, that had the hunt.c and addpolicy.c file. I changed those and ran "make" I got some errors, but the program SEEMS to start up. I still don't get any connections though. Not even when I open a telnet session will the program respond. (towel.blinkenlights.nl - really funny ascii art btw).

I must've misunderstood the concept of use of hunt. I have no connections whatsoever. Can anyone else get it to compile and work successfully?

(btw lupin: I like your Churcill quote

[thorin]

Seems like you could put something together with netcat and tcpreplay. It'd be a bit kludgey but it can't probably be made to work.

[trackh4t]

I was actually successfull in configuring hunt this time around. I still have no idea why hunt wouldn't let me view the connection when i had recompile with the addpolicy and port 499 set, but I tried just setting it = 0; so it would accept ALL connections, and then my 499 connection was dusplayed too. It works ok, but I get kicked off from time to time, not really knowing why. If any one has a hunch on why this happens - and/or how to disable hunt from reconnecting when it detects an ack storm (because in this particular app it detects normal packets as an ack storm when there are lots of them, and that makes it crash)

Anyway to conclude:

SUCCES, but I might have to code some solution myself, because it seems a bit flawed this one. It's an important part-goal and that's what counts for me right now