"Magic packet" generating script has been released (WakeUp on Lan)
Summary
It is possible to cause certain PC configuration to 'Wake Up' (power on) when they receive a special packet that has been standardized by an official standard which leading Network card manufactures and BIOS manufactures has embraced. This is not vulnerability by its own, but it can be used with other vulnerabilities to pose a threat to the affected computer.
Details
By sending a special packet to a dormant computer a remote computer can be caused to "Wake Up" (Boot itself up). This feature can be disabled in the BIOS or in the Network card settings.
This means, for example, that users with a fixed Internet connection are not safe from attacks even when their computer is powered off.
This, in combination with other known attacks (for example: Windows NT protected by a Firewall is vulnerable to penetration during boot) can be used to break into the powered-down computer.
The following Perl script can be used to remotely turn on a computer:
#!/usr/bin/perl
#
# little perl script to send a wake-up "magic" packet via lan to power-on
# a PC. This is only supported by new BIOS versions, and must be supported
# by the LAN adapter.
#
# (c) 1999 by Marc Heuse <mheuse@kpmg.com>, the GPL applies to this code.
#
$IP="255.255.255.255"; # limited broadcast ip (default)
$PORT="9991"; # udp port (default)
$INIT_STREAM="\377\377\377\377\377\377"; # (don't change this)
require 5.002;
use Socket;
if (not defined $ARGV[0]) {
print "(c) 1999 by Marc Heuse <mheuse\@kpmg.com>\n\n";
print "Syntax: $0 ethernet_id [ip-address] [udp-port]\n\n";
print "Sends a magic wakeup packet to turn on a PC via the LAN\n";
print "Example: $0 00:80:c9:d1:e0:eb 10.70.82.255 53\n\n";
exit(1);
}
$ETHERNET_ID = $ARGV[0];
$IP = $ARGV[1] if defined $ARGV[1];
$PORT = $ARGV[2] if defined $ARGV[2];
print STDOUT "Sending to Ethernet-ID $ETHERNET_ID, using destination $IP:$PORT\n";
$protocol = getprotobyname('udp');
socket(S, &PF_INET, &SOCK_DGRAM, $protocol) || die "can't create socket\n";
setsockopt(S, SOL_SOCKET, SO_REUSEADDR, 1);
setsockopt(S, SOL_SOCKET, SO_BROADCAST, 1);
bind(S, sockaddr_in(0, INADDR_ANY)) || die "can't bind\n";
$ipaddr = inet_aton($IP) || die "unknown host: $IP\n";
$paddr = sockaddr_in($PORT, $ipaddr) || die "sockaddr failed\n";
$ETHERNET_ID =~ s/[:-]//g;
$ETHERNET_ID = pack "H12", $ETHERNET_ID;
$WAKE_UP = $INIT_STREAM; $i=0;
while ($i<16) {
$WAKE_UP = $WAKE_UP . $ETHERNET_ID;
$i++;
}
# send three times to be sure the system gets the packet
send (S, $WAKE_UP,0,$paddr) || die "send failed.\n";
send (S, $WAKE_UP,0,$paddr);
send (S, $WAKE_UP,0,$paddr);
Additional information
The script was provided by: Marc Heuse.
Partager