CN116318801A - SOHO router data modification method - Google Patents

Abstract

The invention relates to the technical field of SOHO router data security, in particular to a SOHO router data modification method, which modifies data of a streaming SOHO router by combining Netfilter and RAW_SOCKET.

Description

A SOHO router data modification method

Technical field:

The invention relates to the technical field of SOHO router data security, in particular to a method for modifying SOHO router data.

Background technique:

SOHO routers are generally used to provide network services for terminal devices connected to it. Its main function is to process the Internet access requests of devices in the LAN and forward them to the target server on the Internet and forward the returned data from the Internet server to the intranet devices. Because SOHO routers generally do not have special security protection software, and users pay less attention to the security of routers, there are many security vulnerabilities in SOHO routers, which may exist for a long time. Through the analysis of SOHO router architecture, it can be seen that its Web Vulnerabilities may exist in services, applications, and the underlying Linux kernel. Vulnerabilities include memory corruption vulnerabilities, traditional Web vulnerabilities such as XSS and CSRF, command injection vulnerabilities, and file upload vulnerabilities, allowing attackers to obtain the underlying Linux system. root access authority, which brings security risks to SOHO routers;

After the attacker controls the SOHO router, he will often further exploit the router by modifying the data packets flowing through the router. In order to discover the attack behavior and trace the source of the attacker, the network security personnel also need to modify the data packet and insert a specific label. Malicious behavior is detected from the traffic level, but the existing way of modifying data packets may affect the normal operation of the router and the normal communication between the two parties. At the same time, the research on router security technology mainly focuses on vulnerability mining. The root authority of the linux kernel operating system at the bottom of the SOHO router does not address the problem of data utilization after obtaining control rights, and there are certain defects. Therefore, it is necessary to develop a data modification method for SOHO routers.

Invention content:

In view of the defects and problems existing above, the present invention provides a SOHO router data modification method, the purpose of which is to use the combination of Netfilter and RAW_SOCKET to modify the data flowing through the SOHO router, and the data modification method does not affect the normal operation of the router , and does not affect the normal communication between the two parties. It can be applied in multiple scenarios such as network security detection and network attack. It can capture data packets before they enter Netfilter for processing and modify them as needed. Set rules at the mount point of Netfilter Discard the original data packet, and finally bypass the router's processing rules for the data packet, and directly send the modified data packet to the network.

The scheme that the present invention solves its technical problem adopts is: 1. a kind of SOHO router data modification method, the Netfilter mechanism in the SOHO router bottom layer linux kernel discards the packet that needs modification, captures and enters with raw socket (original socket) The original data packet of the network card, after modifying the original data packet, bypass the system kernel protocol stack and send the modified data packet from the network card;

S1: drop packet

The filtering of data packets by SOHO routers is based on the Netfilter mechanism in the underlying linux kernel. Netfilter is a series of call entries embedded in the kernel IP protocol stack set on the packet processing path. Netfilter provides data packets according to the flow direction of network packets. For the modified mount point, use Netfilter’s configuration component iptables in the user space to set packet filtering rules at the mount point according to the characteristics of the data packet to be modified, perform preliminary screening of the data packet, and discard the data packet;

S2: capture packet modification sent

Use raw socket (raw socket) and use PF_PACKET socket protocol to capture the original data frame from the data link layer before the original data packet enters Netfilter processing, and process the data packet through the data packet processing system. The data packet processing system includes a data packet sniffing module, a data packet analysis module, a data packet modification module and a data packet sending module;

(1) Before the original data packets are processed by Netfilter, the packet sniffing module captures the original data packets to be processed from the network card;

(2) The data packet analysis module analyzes the captured original data packet to determine whether the data packet is a data packet that needs to be modified. If the data packet is not a data packet that needs to be modified, it will be sent directly. Data packet, then modify the data packet through the data packet modification module, modify the data packet length, SEQ, and ACK fields in the data packet header and recalculate the checksum at the same time, to ensure the correctness of the data packet and the continuity of communication;

(3) The data packet sending module uses raw socket (raw socket), bypasses the TCP/IP protocol stack, and sends the modified data packet from the network card.

Furthermore, the principle of data packet capture is to capture data packets before they are processed by the Netfilter framework, and the principle of data packet transmission is to bypass the Netfilter framework and kernel protocol stack processing, and send the modified data packets to the network.

Furthermore, Netfilter can provide five mount points for modifying data packets according to the flow direction of network packets. The three mount points of Prerouting, Forward, and Postrouting can all discard data packets passing through the router. For the data packets of the router and the data packets sent by the router, choose to set the data packet filtering rules at the Forward mount point to discard the data packets.

Furthermore, the SOHO router is based on ARM or MIPS architecture, use the Buildroot tool to build a corresponding cross-compilation environment, cross-compile the data capture, data processing and data transmission programs that can run on the SOHO router, and realize the modification of the data packet.

Beneficial effects of the present invention: the method of the present invention utilizes the combination of Netfilter and RAW_SOCKET, utilizes the Netfilter mechanism in the SOHO router bottom layer linux kernel to discard the data packet that needs to be modified, captures the original data packet entering the network card with raw socket, and modifies the original Afterwards, the data packet bypasses the system kernel protocol stack and directly sends the modified data packet from the network card. This data modification method does not affect the normal operation of the router or the normal communication between the two communication parties. It can be used in network security detection and network attacks. Scenario application, strong versatility, ensures that the data sender has no sense when the data packet is discarded, so that only the modified data packet reaches the receiver, and the original data packet cannot reach the receiver, avoiding repeated arrival of data packets, and the data processing efficiency through RAW_SOCKET Higher, the delay of data modification is small, and it will not affect normal communication. At the same time, the data packet sent is a data packet constructed by the user. The data packet construction function can be written according to the need, and any modification of the data packet can be realized.

Description of drawings

Fig. 1 is a flow chart of the principle of the present invention.

Figure 2 is a flow chart of the principle of data packet capture and transmission.

FIG. 3 is a diagram showing the relationship between the position of capturing data, the position of sending data, and the position where data packets flow into the SOHO router.

Fig. 4 is a flow chart of the principle of the data packet processing system.

FIG. 5 is a flow chart of filtering data packets by SOHO routers.

Figure 6 is a schematic diagram of the experimental environment for the demonstration of the "discard-resend" data modification method.

FIG. 7 is a diagram showing the result of initiating a connection from the sender to the receiver in a normal network environment and notifying the sender that the connection cannot be made.

Fig. 8 is a diagram showing the result of not returning any information when discarding data packets in the "discard-resend" data modification method.

FIG. 9 is a schematic diagram of data sent by the sender.

FIG. 10 is a schematic diagram of data received by the receiver.

Figure 11 is the program code for modifying the IP of the data packet to realize fake identity communication.

FIG. 12 is a schematic diagram of time difference information of two data packets sent by the sender.

FIG. 13 is a schematic diagram of delay information of two data packets received by the receiver.

Detailed ways:

The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

Example 1, after the attacker controls the SOHO router, he will often modify the data packets flowing through the router to realize further use of the router. In order to discover the attack behavior and trace the source of the attacker, the attacker needs to modify the data packet and insert a specific Labels to detect malicious behaviors from the traffic level, but the existing way of modifying data packets may affect the normal operation of the router and affect the normal communication between the two parties. At the same time, the research on router security technology mainly focuses on vulnerability mining. The purpose is to obtain the root authority of the underlying linux kernel operating system of the SOHO router, and it does not address the data utilization problem after obtaining the control right, and there are certain defects.

In view of the above problems, this embodiment provides a SOHO router data modification method, which uses the combination of Netfilter and RAW_SOCKET to modify the data flowing through the SOHO router. Normal communication can be applied in multiple scenarios such as network security detection and network attack; the principle is to use the Netfilter mechanism in the underlying linux kernel of SOHO routers to discard the data packets that need to be modified, and use raw sockets (raw sockets) to capture and enter the network card After modifying the original data packet, the system kernel protocol stack is bypassed to send the modified data packet from the network card;

The processing of data packets on the router can be divided into three categories: data packets flowing into the router, data packets flowing through the router, and data packets flowing out of the router. The passing and outgoing packets need to be sent by the router. In addition, the flowing data packets also have a FORWARD process, that is, they are transferred from one network card to another network card;

S1: drop packet

As shown in Figure 5, the filtering of data packets by SOHO routers is based on the Netfilter mechanism in the underlying linux kernel. Netfilter is a series of call entries embedded in the kernel IP protocol stack set on the message processing path. Flow direction can provide five mount points for data packet modification, as shown in the figure below, use Netfilter’s configuration component iptables in user space, according to the characteristics of the data packet to be modified, at the three mount points of Prerouting, Forward, and Postrouting All can set data packet filtering rules for the data packets flowing through the router, perform preliminary screening of data packets, and discard data packets. At the same time, in this embodiment, in order not to affect the data packets entering the router and the data packets sent by the router, select the Set data packet filtering rules at the load point to discard data packets;

S2: capture packet modification sent

The principle of data packet capture is to capture the data packet before it is processed by the Netfilter framework, and the principle of data packet transmission is to bypass the Netfilter framework and kernel protocol stack processing, and send the modified data packet to the network;

As shown in Figure 2, using raw socket (raw socket) and using the socket protocol of PF_PACKET to capture the original data frame from the data link layer before the original data packet enters Netfilter processing can also bypass the system The protocol stack of the kernel sends the data packets constructed by the user, and processes the data packets through the data packet processing system. The data packet processing system includes a data packet sniffing module, a data packet analysis module, a data packet modification module and a data packet sending module. Realize the purpose of obtaining the original data packet from the data link layer and sending the data packet to the network; as shown in Figure 3-4,

(1) Before the original data packets are processed by Netfilter, the packet sniffing module captures the original data packets to be processed from the network card;

(2) The data packet analysis module analyzes the captured original data packet to determine whether the data packet is a data packet that needs to be modified. If the data packet is not a data packet that needs to be modified, it will be sent directly. Data packet, then modify the data packet through the data packet modification module, modify the data packet length, SEQ, and ACK fields in the data packet header and recalculate the checksum at the same time, to ensure the correctness of the data packet and the continuity of communication;

(3) The data packet sending module uses raw socket (raw socket), bypasses the TCP/IP protocol stack, and sends the modified data packet from the network card;

The data sniffing module first captures the original data packets entering the network card. Since the captured data packets are not all data packets that need to be modified, the data packets are analyzed through the data analysis module. If the data packets are not the data packets that need to be modified, then directly If the data packet is a data packet that needs to be modified, first modify the data packet according to the need, and then recalculate the checksum window size field of the data packet header, if it is to modify the content part of the TCP data packet, then modify the data packet header The data packet length, SEQ, ACK and other fields in the data packet ensure the correctness of the data packet and the continuity of communication, and finally send the data packet directly to the network through the data sending module; at the same time, the SOHO router is ARM or MIPS architecture, using the Buildroot tool Build the corresponding cross-compilation environment, cross-compile the data capture, data processing and data sending programs that can run on the SOHO router, and realize the modification of the data package.

This method ensures that the data sender has no sense when the data packet is discarded. Secondly, this method can ensure that only the modified data packet reaches the receiver, and the original data packet cannot reach the receiver, avoiding the problem of repeated arrival of data packets, and RAW_SOCKET data processing The efficiency is high, the delay of data modification is small, and the normal communication will not be affected, and the data packet sent is the data packet constructed by the user. The data packet construction function can be written according to the need, and the data packet can be realized in principle Any modification.

"Discard-resend" data modification method utilization scenario:

The "discard-resend" data modification method can insert special data in the data packet or data stream by modifying the data packet, and realize the analysis of network security. The traceability method based on marking (Marking-based traceback, MBT) is The more researched traceability methods, such classic methods as Probabilistic Packet Marking Algorithm [8] (Probabilistic Packet Marking, PPM) and Deterministic Packet Marking Algorithm [9] (Deterministic Packet Marking, DPM) all require data modification, the security of anonymous channels In performance analysis, watermark analysis [10] is a commonly used method. Whether it is a data packet watermark or a flow rate watermark, the essence is to modify the content of the data packet or the delay of the data packet. Using the "discard-resend "The data modification method can be realized;

Experimental proof:

As shown in Figure 6, one host simulates an internal network terminal, and one host simulates an external network server, and communicates through a SOHO router. The WAN port IP of the SOHO router is configured as 10.0.0.1, and the LAN port IP is configured as 192.168.1.1 , the IP configuration of the external network server is 10.0.0.2, and the IP configuration of the internal network host is 192.168.1.2. On the SOHO router, modify the data packets for the internal network host to access the external network server, and respectively on the internal network host and the external network server Packet capture, it should be noted that due to the NAT mechanism of the SOHO router, the data packet captured on the internal network host is the communication data between 192.168.1.2 and 10.0.0.2, but the data packet captured on the external network server is the SOHO router The data packets communicated between WAN port 10.0.0.1 and 10.0.0.2.

Packet drop non-inductive test:

In the network environment, if the data receiver refuses to receive the data packet, it will return a data packet of unreachable data to the data sender, and inform the data sender that the data packet has not been received. The "discard-resend" data modification method cannot send any data packet to the data sender when discarding the data packet, so that the data sender should discard it "insensitively", otherwise, if the data sender knows that the data packet is discarded, then affect subsequent communications.

As shown in Figure 7, in a normal network environment, the sender initiates a connection to the receiver, and the receiver returns a data packet with the RST flag to inform the sender that the connection cannot be made;

As shown in Figure 8, in the data modification method, no information is returned when the data packet is discarded, and the data sender will not know that the data packet is discarded, and the subsequent communication process will not be affected;

Modify the packet content test:

In normal network communication, the content of the data packet received by the receiver is consistent with the content of the data packet sent by the sender. This embodiment uses the "discard-resend" method to successfully modify the data packet. The contents of the packets sent are different,

As can be seen from the data sent by the sender in Figure 9 and the data received by the receiver in Figure 10, the content of the data sent by the sender is test! , but the data received by the receiver is hacked! , indicating that the content of the data packet has been modified.

Forged data sender IP test:

The "discard-resend" data modification method can modify the IP of the data packet to realize the communication of forged identity. As shown in Figure 11, it shows that the sender sends a request to the receiver 10.0.0.2, and the receiver forges when returning data Identity, replying data to the sender with the IP of 8.8.8.8, this method is often used by network attackers to hide their identity and prevent it from being traced;

Modify the inter-packet delay test:

The communication delay of a normal network is relatively fixed, and the time for data packets sent by the sender to arrive at the receiver is also similar. The "discard-resend" data modification method can insert a delay between two data packets to realize the time delay of data flow. watermark;

As shown in Figure 12, the sending time of the two data packets sent by the sender is very small;

As shown in Figure 13, the two data packets received by the receiver are inserted with a delay of 2 seconds;

The above descriptions are only preferred embodiments of the present invention, and do not limit the present invention. Any modifications, equivalent replacements and improvements made within the spirit and principle of the present invention shall be included in the protection scope of the present invention. Inside.

Claims (4)

1. A SOHO router data modification method is characterized in that a Netfilter mechanism in a linux kernel of a bottom layer of the SOHO router discards a data packet to be modified, a raw socket is used for capturing an original data packet entering a network card, and the modified data packet is sent out from the network card by bypassing a system kernel protocol stack after the original data packet is modified;

s1: discarding data packets

The SOHO router filters the data packet based on a Netfilter mechanism in a bottom linux kernel, the Netfilter is a series of call entries which are arranged on a message processing path and embedded in a kernel IP protocol stack, provides a mounting point for modifying the data packet according to the flow direction of a network message, and sets a data packet filtering rule at the mounting point according to the data packet characteristics to be modified by utilizing a configuration component iptables of the Netfilter in a user space, so as to perform preliminary screening of the data packet and discard the data packet;

s2: capturing packet modification issues

The method comprises the steps that a raw socket (original socket) is adopted, a socket protocol of a PF_PACKET is utilized, an original data frame from a data link layer is captured before an original data PACKET enters Netfilter processing, the data PACKET is processed through a data PACKET processing system, and the data PACKET processing system comprises a data PACKET sniffing module, a data PACKET analysis module, a data PACKET modification module and a data PACKET sending module;

(1) Before the original data packet enters Netfilter processing, the data packet sniffing module captures the original data packet to be processed from the network card;

(2) The data packet analysis module analyzes the captured original data packet, determines whether the data packet is a data packet needing to be modified, if the data packet is not the data packet needing to be modified, directly sends the data packet, if the data packet is the data packet needing to be modified, modifies the data packet through the data packet modification module, modifies the data packet length, SEQ and ACK fields in the data packet header and recalculates the checksum, and ensures the correctness of the data packet and the continuity of communication;

(3) And the data packet sending module bypasses a TCP/IP protocol stack by using a raw socket, and sends the modified data packet from the network card.

2. The SOHO router data modification method according to claim 1, wherein a packet capturing principle is capturing before a packet is processed by a Netfilter frame, and a packet transmitting principle is bypassing the Netfilter frame and kernel protocol stack processing, and transmitting the modified packet into the network.

3. The SOHO router data modification method according to claim 1, wherein Netfilter provides five mounting points for modifying the data packet according to the flow direction of the network packet, and each of the three mounting points Prerouting, forward, postrouting discards the data packet flowing through the router, so as not to affect the data packet entering the router and the data packet sent by the router, and selectively sets a data packet filtering rule at the Forward mounting point, and discards the data packet.

4. The method for modifying SOHO router data according to claim 1, wherein the SOHO router is an ARM or MIPS architecture, and uses a Buildroot tool to build a corresponding cross-coding environment, and cross-coding a data capturing, data processing and data transmitting program that can run on the SOHO router, so as to implement modification of the data packet.

Images