Better start blocking ICMP ;)
https://github.com/Maksadbek/tcpovericmp
Quote from: SofaKing on June 15, 2016, 05:18:42 PM
Better start blocking ICMP ;)
https://github.com/Maksadbek/tcpovericmp
:hankhill:
That's just mean, man...
Not entrely new actually. Useful payload for ICMP echo has been attempted before. I'm sure there are IPS'es paying attention to this. Basic firewalls will allow this to pass however.
Well, I just always try to block the hell out of ICMP, whenever possible.
Reminds me of a story I heard once:
A new admin came in to replace an old engineer who had been fired. He looked all over the place and couldn't find any of the passwords. Needing them he finally broke down and called the old engineer asking him where the password list was, to which the engineer said "They are on the network" and hung up. Fast forward quite some time, and while the admin was looking at a packet capture he saw an odd ICMP packet, upon drilling into it he discovered that the payload was infact all the passwords for the network.
Lol, that's insane... and not recommended, according to my CISSP Official Study Guide.