POTENTIONAL FIX: etded.x86 getstatus exploit Options

[Guest_Dutchman_*]

Hi,

since a few months there is a exploit floating around abusing the getstatus requests to launch dos attacks against random targets and as a side effect creating massive lags on clients and the server.
Cause of this Yada from Staatsschutz.org made a patch for linux wich reduces the effectivity of this exploit.

etfix_getstatus 0.2 by yada / staatsschutz.org / jan. 2011
------

This patch will ratelimit etded.x86 2.60b getstatus requests to 1 per IP every
4 seconds. This approach is not ideal as the real fix would be to change the
protocol to require some kind of handshake but this would break compatibility
with existing clients so its not really practical. The worst part is that the
patch is (in theory) vulnerable to a dos where legitimate clients could be
denied access to the getstatus command but i feel this is less of a headache
than kiddies using the server to flood random targets and thereby lagging the
server and pushing bandwith usage through the roof (master server is excluded
from ratelimit so no need to worry about it being denied using spoofed
packets).

Download the file right here.

A readme.txt, the sourcecode and a small howto are included.

Your free to distribute this file.

This post has been edited by Dutchman: Jan 6 2011, 11:33 AM

[Ligustah]

As for the CommView program, i see two problems with that.

1. price = 200€ at least
2. no packet filter (as in dropping unwated traffic)

You can of course use that program to find out which IPs are being used on your server, but then you will have to manually ban them
(you can find out how to manually ban IPs with a quick Google search: http://lmgtfy.com/?q=how+to+block+an+ip+on+windows).

Yes, on Windows, it is difficult to make such a script, maybe the new PowerShell could do it ..

The problem would not be getting the script to run on Windows (there are even pre-built binaries of the libraries used by the script i posted), but getting the IP banned. It does not seem to be very common to have automated firewalls on Windows systems. It seems to be possible via the netsh (net shell) provided by Windows. Something along the line:

QUELLTEXT

netsh advfirewall firewall add rule .......

Read up on the manual of that program, if you type the command above (without the dots of course) it will prints lots of useful information.

QUELLTEXT

os.system("iptables -A INPUT -s %s -j DROP" % k)

If you have found the command line that will do the trick for you simply replace it in the script i posted

If I suspect any new spoofing, I will try to find IP and will update this post.

There is no point in posting IPs. You will only see the IPs of the victims getting DDoS'd, besides, at least on my machine I record about 30 to 50 different IPs per day (that is why i strongly advise looking into automated solutions).

Hope this helps.

This post has been edited by Ligustah: Aug 26 2011, 10:31 AM