[Full-disclosure] 0trace - traceroute on established connections

[Matthew Flaschen]

Michal Zalewski wrote:
> I'd like to announce the availability of a free security reconnaissance /
> firewall bypassing tool called 0trace. 

Good work.  Are you going to put it under a free license?

> Enough chatter - the tool is available here (Linux version):
> 
>   http://lcamtuf.coredump.cx/soft/0trace.tgz
> 
> Note: this is a 30-minute hack that involves C code coupled with a cheesy
> shellscript. It may not work on non-Linux systems, and may fail on some
> Linuxes, too. It could be improved in a number of ways - so if you like
> it, rewrite it.

I've been trying to get it to work on Ubuntu Edgy.  That system doesn't
have usleep, so I made the following kludge:
-------------------------------------------------------------------------
if [[ ! -x /bin/usleep && ! -x /bin/sleep ]]; then
  echo "[-] Neither /bin/sleep nor /bin/usleep are found on this system,
sorry." 1>&2
  exit 1
fi

usleep()
{
  if [ -x /bin/usleep ]; then
    /bin/usleep $1
  elif [ -x /bin/sleep ]; then
    /bin/sleep $(echo ".000001 * $1" | bc)
  fi
}
-------------------------------------------------------------------------

However, that leaves me with other problems:

[+] Waiting for traffic from target on eth0...
[+] Traffic acquired, waiting for a gap...
./0trace.sh: line 85: printf: 0x: invalid number
./0trace.sh: line 86: printf: 0x: invalid number
[+] Target acquired: : -> : (0/0).
[+] Setting up a sniffer...
[+] Sending probes...
Usage: ./sendprobe src_ip dst_ip sport dport seq ack

I'm using Kubuntu Edgy.  The bash version is 3.1.17(1)-release
(i486-pc-linux-gnu).  Anyone have tips?

Thanks,

Matthew Flaschen

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 252 bytes
Desc: OpenPGP digital signature
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20070108/95f130ef/attachment.bin