THE HACKERS CHOICE
presents:

Attacking theIPv6 Protocol Suite
van Hauser, THC
vh@thc.org
http://www.thc.org© 2008 The Hacker‘s Choice – http://www.thc.org – Page 1

You might know me from ...
Amap

rwwwshell

Login hacker
Covering yourtracksAnonymizing
Unix Systems

THC--Scan
THC
Keyfinder

Hackers go
corporate
Placing
backdoors
throughfirewalls

Hydra
Parasite
Manipulate
data
Secure Delete

Page 2

Contents
1. Short Introduction to IPv6
2. The THC IPv6 Attack Suite
3. Security relevant changes IPv4<>
IPv4<>IPv6
IPv6
4. Security Vulnerabilities in IPv6 so far
5. Implementation Vulnerabilities in IPv6
6. New Research & Future

Page 3

Goals of IPv6
n Enough IP addresses for the next decades
2128=340.282.366.920.938.463.463.374.607.431.768.
211.456n AutoAuto--configuration of IP addresses andnetworking
n Hierarchical address structure
Reduces operational costs

n Integrated security features

Page 4

IPv6 Header Structure
0

4

12

16

24

31

Version6

Class
Payload Length

Flow Label

Next Header

Hop Limit

128 bit Source Address

128 bit Destination Address

Page 5

IPv6 Layer Structure
IPv6 Header

Extension
HeaderUpper Layer
Protocol Data Unit (PDU)
Payload

IPv6 Packet

IPv6 Header ≡ 40 Bytes
Upper Layer PDU ≤ 65535 Bytes
Upper Layer PDU > 65535 Bytes = Jumbo Payload

Page 6

IPv6 Header Structure
Examples for Extension Headers: Hop-by-Hop = 0; UDP = 17; Encapsulated Header = 41; RSVP
= 46; IPSEC – Encapsulating Security Payload = 50 + Authentication Header = 51;
ICMPv6 = 58; No Next Header = 59; Destination Options = 60; OSPFv3 = 98

IPv6 Header

Application Data

TCP Header

Next Header = 6

IPv6 Header

Routing Header

Next Header = 43

Next Header = 6

TCP Header

IPv6 Header

Routing Header

Fragment Header

Next Header = 43

Next Header = 44

Next Header = 6

Application Data

TCP Header

Data

Page 7

Blackhat usage of IPv6 today
Backdoor deployment (history now)n Enable IPv6 6to4 tunnelingn Run Backdoor on IPv6 addressn Not detected by port scanning
n Harder to analyze traffic

Inter--CommunicationIntern Warez exchange, IRC and bouncing

Worms
n Rbot.dud, Rabat, Maroc – Mars 2007

Page 8Availability of Hacker Tools so far …
Not many Hacker tools exist for IPv6:n Port Scanning: nmap
nmap,, halfscan6, …
n Port Bouncers: relay6, 6tunnel, nt6tunnel, asybo,
asybo, …
n Denial
Denial--ofof-Service (connection flooding): 6tunneldosn Packet fun: isic6, scapy6, libnet (partially

implemented only)
only)

More expected when IPv6 deployment is wider.
Specific IPv6 protocol attacking tools?
None. Except …
Page 9

The THC IPv6 Attack Suiten An easyeasy-to
to--use IPv6 packet factory library by

THC J
n IPv6 protocol exploits tools can be coded injust 55-10 lines
n Lots of powerful protocol exploits included
n Linux (little endian
endian)) onlyn IT’S THE ONLY ONE AVAILABLE J

Page 10

The THC IPv6 Attack Suite – The Tools
n Alive6
w Find all local IPv6 systems, checks aliveness of remote systemsn PARSITE6
w ICMP Neighbor Spoofer for Man
Man--InIn-The
The--Middle attacks
n REDIR6
w Redirect traffic to your system on a LAN
n FAKE_ROUTER6
w Fake a router, implant routes, become the default router, …
n DETECT
DETECT--NEW
NEW--IPv6
w Detect new IPv6 systems on the LAN, automatically launch a
scriptn DOS
DOS--NEW
NEW--IPv6
w Denial any new IPv6 system access on the LAN (DAD Spoofing)
Page 11

The THC IPv6 Attack Suite – The Tools
n SMURF6
w Local Smurf Tool (attack you own LAN)n RSMURF6
w Remote Smurf Tool (attack a remote LAN)n TOOBIG6
w Reduce the MTU of a targetn FAKE_MLD6
w Play around with Multicast Listener Discovery Reports
n FAKE_MIPv6
w Reroute mobile IPv6 nodes where you want them if no IPSEC
is required

n SENDPEES6
w Neighbor solicitations with lots of CGAsn Protocol Implementation Tester
w Various tests, more to comePage 12

Overview of security relevant changes
1. Protocol Changes
2. Reconnaissance3. Local Attacks: ARP, DHCP
4. Smurfing (Traffic Amplification)
5. Routing & Fragmentation Attacks
6. IPv4 and IPv6 coexistence
7. Miscellaneous
8. Firewalling
Page 13

1. Protocol Changes
n A few IP header content and options were

removed:w No IP ID field- Nice uptime check not possible anymore L

w No IP Record Route Option- No traceroute alternative anymore L

n No Broadcast addresses existn Multicast addresses can not be destined fromremotew This prevents remote alive scanning!
Page 14

2. Reconnaissance IPv4
Network size in a subnet usually 2^8 = 256 .
Usual attack methodology:
1. Ping sweeps to a target remote class C(takes 55-30 seconds)
2. Port scans to an alive host
3. Vulnerability test to active ports

Wide range of tools available
n NmapNmap,, Amap
Amap,, Nessus
Nessus,, ...

Page 15

2. Reconnaissance IPv6 (1/2)
Network size now 2^64 (varies) in a subnet!
n 18.446.744.073.709.551.616 IPs per subnet
n Ping sweeps will consume too much time
w Brute force: 500 millions years
w Being clever + technology advances: still somemonthsn Public servers need to be in the public DNS
n All hosts need to be in a private DNS for admin

purposes>> DNS Servers will become primary <<>> sources of information => primary targets <<Page 16

2. Reconnaissance IPv6 (2/2)
n Remote
Remote:: only the public servers (via google,
google, DNS,
DNS,etc.) and anycast addressesn New opportunities are standardized multicast
addresses to identify key servers within the local
network (routers, DHCP, Time, etc.)
n Local multicasts ensure that one compromised
host can find all other hosts in a subnet
n Techniques to a single host remain the same (port(portscan, attacking active ports, exploitation, etc.)
n Remote alive scans (ping scans) as we know themon networks are unfeasible
Page 17

2. Reconnaissance with the THC
THC--IPv6 Attack
Toolkitn alive6 – for local/remote unicast targets, andlocal multicast addresses

wSends three different type of packets:
ICMP6 Echo Request- IP6 packet with unknown header- IP6 packet with unknown hophop-by
by--hop option--[IP6 fragment (first fragment) – if needed I will add this]wOne
One--shot fragmentation + routing header
option:Sends packets in one fragment + a routing header for aremote router- Only works if the router allows routing header entries tomulticast addresses – requires bad implementation!

-

Page 18

3. ARP IPv4n ARP uses layer 2 broadcast to perform the

IP > MAC lookup on the local networkn Attackers can respond in order to perform“Man in the middle” Attacks

Page 19

3. DHCP IPv4n DHCP uses broadcast messagesn Any (rogue J ) device can respondn Feed the host with new DNS and routing

information => “Man in the Middle” attack

Page 20

3. ARP/DHCP IPv6n No security added (to both)n ICMP6 Neighbor Discovery / Neighbor

Solicitation = ARP replacementn Duplicate Address Detection based on NS
allows DoS by responding to those checks
n ICMPv6 Stateless auto configuration = DHCP
light

Page 21

3. ICMPv6 Neighbor Discovery
A

B

1. ND
1. NS:ICMP Type = 135
Src = A
Dst = All-Nodes Mulitcast Address
query= Who-has IP B?

2. NS

parasite6:
parasite6:
Answer to every
NS, claim to be
every system on
the LAN J

2. NA:ICMP Type = 136
Src = BDst = A
Data= Link Layer Address

If A needs the MAC of B, it sends an ICMP6 Neighbor
Solicitation to “All-Nodes” multicast address
B sees the request and responds to A with an ICMP6Neighbor Advertisement with its MAC address=> Like ARP But everybody can respond to the request
Page 22

3. ICMPv6 Duplicate Address Detection (DAD)A

1. ND
1. NS:ICMP Type = 135
Src = :: (unspecified)
Dst = All-Nodes Mulitcast Address
query= Who-has IP A?

dos-new
dosnew--ipv6:
ipv6:
Answer to every
NS, claim to be
every system on
the LAN J

2.
No reply if nobody owns
the IP address.

If A sets a new IP address, it makes the Duplicate
Address Detection check, to check if anybody uses theaddress already.
Anybody can respond to the DAD checks…
dos--newnew-ipv6 prevents new systems on the LAN=> dosPage 23

3. ICMPv6 Stateless AutoAuto-Configuration
A

1. RS
1. RS:ICMP Type = 133
Src = ::
Dst = FF02::2:[limited mcast]query= please send RA

2. RA

fake_router6:
fake_router6:
Sets any IP as
default router J

2. RA:ICMP Type = 134
Src = Router Link-local Address
Dst = FF02::1
Data= options, prefix, lifetime,
autoconfig flag

Routers send periodic (& soliticatedsoliticated)) Router
Advertisements (RA) to the All-Nodes multicast address
Clients configure their routing tables and network prefixfrom advertisements => Like a DHCP-light in IPv4
Anyone can send Router Advertisements!
Page 24

4. Smurf IPv4
n Sending a packet to a broadcast address withspoofed source will force responses to asingle target
w Commonly ICMP echo request/reply
n Traffic amplificationn DoS for target link

Page 25

4. Smurf IPv6n No broadcast addresses
n Replaced with various multicast addresses
n RFC 2463 states that no ICMP response

should be sent when destination is amulticast address. But exceptions are made.

wCisco Security Research got it all wrong J
n Exploitable
Exploitable?
?

wLocally: YES!
wRemote: Depends on Implementation of
Routing Headers
Page 26

4. Smurfing with the THC
THC--IPv6 Attack Toolkit
n smurf6 – for local smurfs
w Source is target, destination is local multicast
address
w Generates lots of local traffic that is sent tosourcesmurf, exploits mis
mis-n rsmurf6 – reverse smurf,

implementations (old Linux only)
w Source is local All
All--Nodes multicast address(255.255.255.255 in IPv6IPv6-speak
speak),), destination is
our target
w If target has mis
mis--implemented IPv6, it respondswith an Echo Reply to the All
All--Nodes multicast
address
w FIXED in current kernels now
Page 27

5. Routing Protocols
n Most Routing protocols provide their own

security mechanisms
n This does not change with IPv6
n With the exception of OSPFv3, which has no
security properties and relies on IPSEC

Page 28

5. Routing Header Manipulation
Routing header attack(like IPv4 Source Routing)Internet

Use alive6 for checking if routing
headers are allowed to target
Page 29

5. More fun with routing headers!
n Check if your ISP does ingress filtering

wSend a packet from yourself to yourself via aremote system:- alive6 eth0 YOURYOUR-IP VICTIMVICTIM--IPn Find all servers in the world for an anycast

address

wSend packets to an anycast address via
several remote systems:- alive6 eth0 AnyCastAddr VICTIMVICTIM--IP1;

alive6 eth0 AnyCastAddr VICTIMVICTIM--IP2; … etc.

n DOS network links by sending packets backand forthPage 30

5. Route Implanting with ICMP6 Redirects
n If a system is choosing a wrong local router for apacket, the router tells this to the sender with an
ICMP6 Redirect packet.
n To prevent evil systems implanting bad routes,

the router has to send the offending packet withthe redirect.
n If we are able to guess the full packet the system

is sending to a target for which we want to rereroute, we can implement any route we want!
want!
n If we fake an Echo Request, we know exactly the

reply! J
Page 31

5. Route Implanting with ICMP6 Redirects(V)ictim(A)ttacker(R)outer(T)arget

1. (A)(A)ttacker
ttacker sends Echo Request:

Source: (T)arget(T)arget,, Destination: (V)ictim(V)ictim
2. (V)(V)ictim
ictim received Echo Request, and send a Reply to (T)
3. (A)(A)ttacker
ttacker crafts Redirect,

Source: (R)outer, Destination: (V)ictim(V)ictim,,
redirects all traffic for (T) to (A)Performed by redir6 in the THCTHC-IPv6 Attack Toolkit J
Same concept for toobig6 to reduce the MTU of a (V)(V)ictim
ictim
Page 32

Implementation Example – It’s SIMPLE!
n 5 lines of source are enough (from redir6.c: )n Sending an ICMP6 Echo Request1:

wpkt = thc_create_ipv6(interface,
PREFER_GLOBAL, &pkt_len&pkt_len,, target6
target6,, victim6
victim6,,0, 0, 0, 0, 0);
wthc_add_icmp6(
thc_add_icmp6(pktpkt,, &pkt_len&pkt_len,,
ICMP6_PINGREQUEST, 0, 0xdeadbeef, NULL,0, 0);
wthc_generate_and_send_pkt
thc_generate_and_send_pkt(interface,(interface, NULL,
NULL, pkt,
pkt, &pkt_len&pkt_len););n Victim6 answers with an ICMP6 Echo Reply
1: A ping6 packet can be gen’d+sent in 1 line, but we need do something special

Page 33

Implementation Example
n Sending the ICMP6 Redirect after the ping:

wthc_inverse_packet
thc_inverse_packet(ipv6(ipv6-->pkt + 14, ipv6ipv6>pkt_len - 14);
- Function inverses the Echo Request Packet toan Echo Reply Packet

wthc_redir6(interface, oldrouter6
oldrouter6,, fakemac
fakemac,,
NULL, newrouter6
newrouter6,, mac6, ipv6ipv6->pkt + 14, ipv6ipv6>pkt_len - 14);
- Functions sends the ICMP Redirect, implanting

newrouter6 for src6

n That’s all – traffic will now be sent tonewrouter instead!
Page 34

5. Fragmentationn Fragmentation is performed by source, notrouters; reassembling performed bydestination onlyn Routers in path can not drop packets withrouting header if fragmentation comes firstn Same IPv4 techniques for fragmentation,
fragmentation,
timeout,, replays, etc. exist in IPv6
timeout

Page 35

5. Mobile IPv6
n Mobile IPv6 allows nodes to travel to different

networks, while keeping TCP, UDP etc.
etc.
connections alive – pretty cooln Protocol specification is secure L because
IPSEC is mandatoryn All implementations have the option todisable IPSEC requirementn If this is the done, use fake_mipv6 to redirecttraffic for any mobile IPv6 node to a
destination of your choice
Page 36

6. IPv4 and IPv6 coexistencen For converging IPv4 to IPv6 there are ~15

ways to do itn What could probably go wrong?
n Just two examples

Page 37

6. IPv4 and IPv6 coexistence
Attacks on dual stacks:
Internal
Network

Internet2
IPv4
IPv6

Beware that you have tofilter IPv4 *and* IPv6 !

Public Servers

Page 38

6. IPv4 and IPv6 coexistence
Attacks on 6to4 tunnels:

The Internet (IPv4)
Network A

6to4 Tunnel

Network B

If you know the two tunnel routers its trivial toinject traffic!
IP Spoofing made very easy …
Page 39

Off The Record:
Record: Attack inactive IPv6 Devices
Little hint (e.g. for hacking at a conference *g*):*g*):n Linux, *BSD, Vista, … have IPv6 enabledn If no firewall policy for IPv6 exist = J , but:
w Many OS do not allow TCP/UDP connections totheir Link Local addressn To hack them anyway
anyway::w Use fake_router6 with an IPv6 network prefix
w Local systems will configure themselve a new
IPv6 address based on the network prefix
w Collect the Duplicate Address Detection packets –these are all the systems you can now attack
attack!! J
detect--newnew--ip6 to automate this J- Use detect
Page 40

7. Miscellaneousn ICMP TCP attacks do still work (tear down

TCP sessions – e.g. BGP – by ICMP6 error
messages, see http://tools.ietf.org/html/draft
http://tools.ietf.org/html/draft-gont--tcpm
gont
tcpm--icmpattacksicmpattacks-05)

Page 41

8. Firewalling IPv6
n IPv6 changes how firewalls workn No NAT necessary – and perhaps unfeasiblen Many ICMP6 messages must be allowed

through the firewalls to allow IPv6 to work
(e.g. toobig,
toobig, errors, …)
n IPSEC hides data and upper layer protocols
n Lots of different extension headers andoptions make it hard for a firewall to:

wfilter correctly (not too much, not too less)wget it right not to BOF or DOS
Page 42Implementation Vulnerabilities in IPv6 so far
n IPv6 was meant to be easy to process andeasy to implement.
n Programmers have learned their lessons withIPv4.
n Hey, then what can probably go wrong?

Page 43

Implementation Vulnerabilities in IPv6 so farn Python getaddrinfo Function Remote Buffer Overflow

Vulnerabilityn FreeBSD IPv6 Socket Options Handling Local Memory
Disclosure Vulnerabilityn Juniper JUNOS Packet Forwarding Engine IPv6 Denial ofService Vulnerabilityn Apache Web Server Remote IPv6 Buffer Overflow
Vulnerability
n Exim Illegal IPv6 Address Buffer Overflow Vulnerabilityn Cisco IOS IPv6 Processing Remote Denial Of Service
Vulnerabilityn Linux Kernel IPv6_Setsockopt IPv6_PKTOPTIONS Integer
Overflow Vulnerabilityn Postfix IPv6 Unauthorized Mail Relay Vulnerabilityn Microsoft IPv6 TCPIP Loopback LAND Denial of Service
Vulnerability
Page 44

Implementation Vulnerabilities in IPv6 so far
n Microsoft Internet Connection Firewall IPv6 Traffic Blocking

Vulnerabilityn Microsoft Windows 2000/XP/2003 IPv6 ICMP Flood Denial Of
Service Vulnerabilityn Ethereal OSI Dissector Buffer Overflow Vulnerabilityn SGI IRIX Snoop Unspecified Vulnerabilityn SGI IRIX Snoop Unspecified Vulnerabilityn SGI IRIX IPv6 InetD Port Scan Denial Of Service Vulnerabilityn Apache Web Server FTP Proxy IPv6 Denial Of Service
Vulnerabilityn Sun Solaris IPv6 Packet Denial of Service Vulnerabilityn Multiple Vendor HTTP Server IPv6 Socket IPv4 Mapped
Address Handling Vulnerability
n BSD ICMPV6 Handling Routines Remote Denial Of Service
Vulnerability
Page 45

Implementation Vulnerabilities in IPv6 so far
n Cisco IOS IPv6 Processing Arbitrary Code Execution

Vulnerabilityn Cisco IOS IPv6 Processing Arbitrary Code Execution
Vulnerabilityn Linux Kernel IPv6 Unspecified Denial of Service
Vulnerabilityn HP Jetdirect 635n IPv6/IPsec
IPv6/IPsec Print Server IKE Exchange
Denial Of Service Vulnerabilityn 6Tunnel Connection Close State Denial of Service
Vulnerabilityn HP
HP--UX DCE Client IPv6 Denial of Service Vulnerabilityn Multiple Vendor IPv4IPv4-IPv6 Transition Address Spoofing
Vulnerabilityn ZMailer SMTP IPv6 HELO Resolved Hostname Buffer
Overflow Vulnerabilityn Linux Kernel IPv6 FlowLable Denial Of Service Vulnerabilityn Linux Kernel IP6_Input_Finish Remote Denial Of Service
Vulnerability
Page 46

Implementation Vulnerabilities in IPv6 so far
n Juniper Networks JUNOS IPv6 Packet Processing Remote

Denial of Service Vulnerabilityn Sun Solaris 10 Malformed IPv6 Packets Denial of Service
Vulnerabilityn Sun Solaris Malformed IPv6 Packets Remote Denial ofService Vulnerabilityn Windows Vista Torredo Filter Bypassn Linux Kernel IPv6 Seqfile Handling Local Denial of Service
Vulnerabilityn Linux Kernel Multiple IPv6 Packet Filtering Bypass
Vulnerabilities
n Cisco IOS IPv6 Source Routing Remote Memory Corruption
Vulnerabilityn Linux Kernel IPv6_Getsockopt_Sticky Memory Leak
Information Disclosure Vulnerabilityn Linux Kernel IPv6 TCP Sockets Local Denial of Service
Vulnerability
Page 47

Implementation Vulnerabilities in IPv6 so far
n Linux Kernel IPv6_SockGlue.c NULL Pointer Dereference

Vulnerabilityn Multiple: IPv6 Protocol Type 0 Route Header Denial ofService Vulnerabilityn Linux Kernel Netfilter nf_conntrack IPv6 Packet Reassembly
Rule Bypass Vulnerabilityn Sun Solaris Remote IPv6 IPSec Packet Denial of Service
Vulnerabilityn Linux Kernel IPv6 HopHop-ByBy-Hop Header Remote Denial ofService Vulnerabilityn KAME Project IPv6 IPComp Header Denial Of Service
Vulnerability
n OpenBSD IPv6 Routing Headers Remote Denial of Service
Vulnerabilityn Cisco IOS DualDual-stack Router IPv6 Denial Of Service
Vulnerabilityn Multiple Platform IPv6 Address Publication Denial of Service
Vulnerabilities
Page 48

Implementation Vulnerabilities in IPv6 so far
Vulnerability data from June 2008

47 bugssome multi operating systems
many silently fixed

Page 49

Implementation Vulnerabilities in IPv6 so far

Page 50

DOS is commonn DOS
DOS--ing is easy

wImplementation is hard, DOS is common
wFlooding- router advertisements (clients)- neighbor advertisements (clients and routers)- Router solicitation (routers)- multicast listener discovery (routers)- … etc.

Page 51

DOS is commonn DOS
DOS--ing is easy

wFun with routers: force packet forwarding
processing in CPU rather than ASIC

- Hop
Hop--byby--hop extension header, especially:w router alert option- multicast listener discovery- Usually anything with more than two extension

headers is processed in CPU

wHop
Hop--by
by--Hop router alert + upper layer

processing bugs can be VERY interesting *g*wCrypto CPU hog exploits-

E.g. Sending Neighbor solicititation with lots of
CGAs (sendpees6(sendpees6))
Page 52

Research and Implementation Tests
Tested: Linux 2.6.9, Windows XP SP2, Cisco IOS 12, FreeBSD 5.3
1. Responding to packets to multicast destinations (Echo Request)• Vulnerable: Linux, FreeBSD
2. Responding to packets to multicast destinations (Invalid Header
Options)• Vulnerable: ALL => Status: Can be configured on BSD
3. Responding to packets from multicast address sources• Vulnerable: Linux => Status: FIXED
4. Routing header to multicast address• Vulnerable: none
5. Fragmentation and following Routing Header• Vulnerable: ALL
6. OneOne--Shot Fragmentation• Vulnerable: ALL
Page 53

Upcoming IPv6 Security Research from THC
n Firewall IPv6 implementation tests J

wIpfilter6, ipfw
wFWFW-1, Netscreen
Netscreen,, PIX
n Multicast Fun

wGlobal Multicast FF0E:: exploitation
wMLD/PIM/etc. spoofingn IPv4 <> IPv6 coco--existance solutions

wSecurity weaknesses in Tunneling

Page 54

Upcoming IPv6 Threats and Chances
1. Specific attack tool development for IPv6n No real differences to existing IPv4 attack tools

2. Worms
n TCP/IP Worms (e.g. Slammer types) will not be

as effective anymore – globallyn All other worms will stay (E(E-Mail, Messenger,
P2P, Forum, Social Network)

3. DNS Server will become primary targets
4. Attacks will move to attack Clients fromcompromised servers in a LAN
5. When IPSEC is widely deployed, certificate
stealing will be primary security concern
Page 55

Conclusion Internet Security with IPv6
So far no serious new risks with IPv6, but somesecurity improvements against IPv4:
n Alive
Alive--Scanning & TCP/IP Worming will hardern No IP Record Route Option & no uptime checkn Easier network filtering and attack tracing

Introduction of IPSEC will not make IPv6
secure, but will make attack tracing easy, andsniffing + ManMan-inin-thethe--Middle very difficult
Some implications unclear yet, research needed

Page 56

IPv6 BREAKTHROUGH IS NEAR!!!
“The Great IPv6 Experiment“Free porn for everybody so people start to use IPv6!
It worked with VCR, the web, so why not for IPv6?!
http://www.ipv6experiment.com/

Page 57

Have fun!

Thank you!
Download from:www.thc.org/thc--ipv6
www.thc.org/thc

Page 58