Thanks to visit codestin.com
Credit goes to www.slideshare.net

Nelson Brito, profile picture
Uploaded byNelson Brito
1,895 views

Protocol T50: Five months later... So what?

The document outlines the 't50' protocol, focusing on denial-of-service (DoS) attacks, their impacts, and improvements in stress testing tools. It discusses various protocols and enhancements supporting simulated DoS attacks, notably the implementation of classless inter-domain routing (CIDR) and multi-protocol sequential injection. The document emphasizes the importance of open-source licensing and community development for continued improvements in network infrastructure testing.

Protocol T50 “Five months later... So what?”
Agenda • 0000 – Once upon a time… • 0100 – Comparison • 0001 – Introduction • 0101 – Demonstration • 0010 – Improvements • 0110 – Conclusions • 0011 – Protocols • 0111 – Questions and Answers
0000 – Once upon a time…
Denial-of-Service
0001 – Introduction
Why Denial-of-Service? • Is there anything more offensive than a • But, what are the real damages? What DoS, anyways? are the real motivations? Image? – Bear in mind: DoS means “Stress Revenge? Financial? Political? Testing” for this presentation. Hacktivism? • DoS tools are necessary weapons in a • DoS attacks are significantly harmful, cyber warfare… because they violate one of the three key concepts of security that are common to risk management… Which one? • Attacks against the infrastructure are more common than many people might – Confidentiality think, and, when they happen, people – Integrity will certainly be aware of. – Availability T50 shows that some sort of performance enhancements, using an ordinary Linux box and programming in user space, can be done.
T50 – The chaos maker • Primarily, the tool was developed to • This new version is focused on internal address my day-by-day needs, and I am infrastructure, allowing people to test the sharing with the community, because I availability of its resources. always need a tool to perform some “Stress Testing” and that could be launched from • Interior Gateway Protocols (Distance Vector my notebook: Algorithm): – I do not want to carry/rent/buy a Smartbits, Avalanche, etc. – Routing Information Protocol (RIP). – Enhanced Interior Gateway Routing Protocol (EIGRP). • The tool was designed to perform “Stress Testing” on a variety of infrastructure network devices (Version 2.45). • Interior Gateway Protocols (Link State Algorithm): – Open Shortest Path First (OSPF). • The tool was re-designed to extend the “Stress Testing” (Version 5.3), covering some regular protocols (ICMP, IGMP, TCP • Quality-of-Service Protocols: and UDP), some infrastructure specific – Resource ReSerVation Protocol (RSVP). protocols (GRE, IPSec and RSVP) and some routing protocols (RIP, EIGRP and • Tunneling/Encapsulation Protocols: OSPF). – Generic Routing Encapsulation (GRE).
T50 – The chaos maker I did not review any third-party codes… I found my own way to address some challenges!!! #define EIGRP_DADDR_LENGTH(foo) (((foo >> 3) & 3) + (foo % 8 ? 1 : 0)) if(o.eigrp.type == EIGRP_TYPE_SOFTWARE || o.eigrp.type == EIGRP_TYPE_MULTICAST) goto eigrp_software; #define EIGRP_DADDR_BUILD(foo, bar) (foo &= htonl(~(0xffffffff >> ((bar >> 3) * 8)))) #define TCPOLEN_PADDING(foo) ((foo & 3) ? 4 - (foo & 3) : 0)
0010 – Improvements Also known as “New Features”
License • Licensed under GNU General Public License version 2: – Any piece of code cannot be integrated into proprietary applications and appliances. – There is an alternative license to do so. • Free software and 100% Open Source: – You may redistribute and/or modify it under the terms of GPL version 2. – Will always be available as an Open Source project to the community. • Recruiting new coders, hackers and developers to keep the project and add new substantial improvements.
Classless Inter-Domain Routing (CIDR) • CIDR specifies an IP address range using a combination of an IP address and its associated network mask: – 192.168.1.13/24 – 192.168.1.13/255.255.255.0 – 172.16.0.128/15 – 172.16.0.128/255.254.0.0 – 10.200.200.1/10 – 10.200.200.1/255.192.0.0 • CIDR for destination address is supported: – Allows to simulate both Distributed Denial-of-Service and Distributed Reflection Denial-of-Service in a controlled environment. – CIDR network mask supported: • Minimum is “/8” (255.0.0.0). • Maximum is“/30” (255.255.255.252).
Classless Inter-Domain Routing (CIDR) unsigned int hostid = 0, counter = 0, rand_addr = 0; in_addr_t netmask = INADDR_ANY, all_bits_on = 0xffffffff, __1st_addr = INADDR_ANY, addresses[16777214] = INADDR_ANY; struct iphdr *ip; netmask = ~(all_bits_on >> bits); hostid = (unsigned int) (pow(2, (32 - bits)) - 2); __1st_addr = (ntohl(address) & netmask) + 1; [...] for(counter = 0 ; counter < hostid ; counter++) addresses[counter] = htonl(__1st_addr++); [...] rand_daddr = (unsigned int) ((float)(hostid) * rand() / (RAND_MAX + 1.0)); ip->daddr = addresses[rand_daddr]; [...]
Classless Inter-Domain Routing (CIDR) 192.168.1.13 /24 192.168.1.13 /255.255.255.0 0xffffffff 11111111.11111111.11111111.11111111 0x000000ff 00000000.00000000.00000000.11111111 0xffffff00 11111111.11111111.11111111.00000000 0xc0a8010d 11000000.10101000.00000001.00001101 & 0xffffff00 11111111.11111111.11111111.00000000 0xc0a80100 11000000.10101000.00000001.00000000 NETWORK HOST (2(32-24))-2 = (28)-2 = 256-2 = 254
Multi-protocol sequential injection • Version 2.45 (as of November 2010): – Support for four protocols: ICMP, IGMPv1, TCP and UDP. – Sends all of them sequentially, i.e., almost on the same time. • Version 5.3 (as of today): – Support for the previous four protocols: ICMP, IGMPv11, TCP1 and UDP. – Eleven (11) new protocols: IGMPv31, EGP2, RIPv1, RIPv2, DCCP1, RSVP1, GRE3, IPSec (AH/ESP), EIGRP1 and OSPF1. – Sends all of them sequentially, i.e., almost on the same time. 1 This protocol can be improved to cover additional advanced options. 2 This protocol demands more development efforts to cover advanced options. 3 Very first tool able to encapsulate the protocols within GRE packets.
Multi-protocol sequential injection socket_t fd; int flags, n = 1, len, * nptr = &n; fd_set wfds; [...] if((fd = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) == -1) exit(EXIT_FAILURE); if(setsockopt(fd, IPPROTO_IP, IP_HDRINCL, nptr, sizeof(n)) < 0) exit(EXIT_FAILURE); [...]
Multi-protocol sequential injection struct t50{ int proto; void(*raw)(int, struct options); }; [...] while(flood || threshold--){ [...] if(protocol != IPPROTO_T50){ [...] }else{ for(module = 0 ; module < modules ; module++){ protocol = t50[module].proto; t50[module].raw(fd, options); } threshold -= (modules-1); protocol = IPPROTO_T50; } [...]
Multi-protocol sequential injection
Checksum optimization • The version 5.3 introduced a new technique to calculate the checksum, consequentially, a new technique to build the packet. • This technique is MEMCPY(3)-free, and allows to build the packet byte-by-byte – sometimes bit-by-bit. • This technique is more flexible, specially when playing with exotic protocol options – sometimes uses GOTO. For example: – EIGRP IP Internal Routes TLV destination address. – EIGRP IP External Routes TLV destination address. – OSPF HELLO Message with multiple NEIGHBOR addresses. – RSVP Object SCOPE Class with multiple SCOPE addresses. – Etc…
Checksum optimization unsigned int offset = 0; unsigned char packet[packet_size], * checksum = NULL; struct eigrp_hdr * eigrp; [...] offset = sizeof(struct eigrp_hdr); checksum = (unsigned char *)eigrp + offset; *((unsigned short *)checksum) = htons(length); checksum += sizeof(unsigned short); offset += sizeof(usigned short); *((usigned int *)checksum) = htonl(auth_key_id)); checksum += sizeof(unsigned int); offset += sizeof(usigned int); [...] eigrp->check = cksum((u_int16_t *)eigrp, offset); [...]
Checksum optimization
Checksum optimization packet_size = sizeof(ip) + sizeof(eigrp) + eigrp_hdr_len();
Checksum optimization
Checksum optimization 1st step packet ↓
Checksum optimization 1st step packet ↓
packet 1st step ↓ packet 2nd step ↓ Checksum optimization
packet 1st step ↓ packet 2nd step ↓ Checksum optimization
packet 1st step ↓ packet 2nd step ↓ Checksum optimization
packet 1st step ↓ packet 2nd step ↓ Checksum optimization
packet 1st step ↓ packet 2nd step ↓ Checksum optimization
packet 1st step ↓ packet 2nd step ↓ Checksum optimization
packet 1st step ↓ packet 2nd step ↓ Checksum optimization
Checksum optimization 1st step packet eigrp_hdr_len() ↓ 2nd step packet ↓
packet 1st step ↓ packet 2nd step ↓ Checksum optimization offset
packet 1st step ↓ packet 2nd step ↓ Checksum optimization
Checksum optimization
RFC 1700, 1918 and 3330 improvements [...] switch(ntohl(daddr) & 0xff000000){ case 0x0a000000: /* Allowing 10/8 (RFC 1918). */ break; case 0x7f000000: /* Allowing 127/8 (RFC 1700). */ break; case 0xa9000000: /* Allowing 169.254/16 (RFC 3330). */ if(((ntohl(daddr) & 0xffff0000) != 0xa9fe00000)) return(FALSE); break; case 0xac000000: /* Allowing 172.16/12 (RFC 1918). */ if(((ntohl(daddr) & 0xffff0000) < 0xac100000) || ((ntohl(daddr) & 0xffff0000) > 0xac1f0000)) return(FALSE); break; case 0xc0000000: /* Allowing 192.168/16 (RFC 1918). */ if((ntohl(daddr) & 0xffff0000) != 0xc0a80000) return(FALSE); break; [...]
0011 – Protocols
Protocols IGMPv3 TCP • Specific headers for specific types: • Regular TCP options: – Membership Query. – Source Port and Destination Port, Sequence Number (also known as ISN), Acknowledgment – Membership Report. Number, Data Offset, Window, Urgent Pointer and TCP Flags (FIN, SYN, RST, PSH, ACK, URG, ECE and CWR). • Membership Query options: – Max Resp code. • Supported TCP Options: – Group Address. – End of List (EOL), No Operation (NOP), – Suppress Router-processing Flag. Maximum Segment Size (MSS), Windows Scale – Querier’s Robustness Variable (QRV). (WSopt), Timestamp (TSopt), T/TCP Connection Count (CC, CC.NEW and CC.ECHO), Selective – Querier’s Query Interval Code (QQIC). Acknowledgement (SACK), MD5 Signature – Number of Sources. Option and the brand new TCP-AO – Source Address(es). (Authentication Option – RFC 5925). • Membership Report options: • TCP Authentication Option (as of June 2010): – Type (HMAC-MD5). – Group Record Type. – Key ID. – Group Record Multicast Address. – Next Key ID. – Number of Sources. – Authentication Data (RANDOM). – Source Address(es).
Protocols RIP DCCP • Regular RIPv1 and RIPv2 options: • Specific headers for specific types: – Command. – Request Packets – Address Family Identifier. – Response Packet. – Router IP Address. – Data Packets – Router Metric. – Acknowledgment Packet, Data-Ack Packet, Synchronize Packet, Sync-Ack Packet, Close Packet and Close Request Packet. • Enhanced RIPv2 options: – Reset Packet. – Routing Domain. – Route Tag. – Router Network Mask. • Regular DCCP options: – Router Next Hop. – Source Port and Destination Port. – Data Offset. – HC-Sender CCID (CCVal). • RIPv2 Cryptographic Authentication: – Checksum Coverage (CsCov). – Type (HMAC-MD5). – Extended Sequence Numbers (x). – Key ID. – Sequence Numbers (HIGH and LOW). – Cryptographic Sequence Number. – Acknowledgment Numbers (HIGH and LOW). – Authentication Data (RANDOM). – Service Code. – Reset Code.
Exotic protocols • Regular RSVP options: – Flags and Time to Live. RSVP • Supported RSVP types: • SESSION Class options: – Path Message. – Destination address, Protocol ID, Flags and – Resv Message. Destination Port. – Path Teardown Message. – Resv Teardown Message. • RSVP_HOP Class options: – Path Error Message. – IP Next/Previous Hop (Neighbor) Address and – Resv Error Messages Logical Interface Handle. – Confirmation Message. • TIME_VALUES Class options: • Specific RSVP Objects for specific RSVP type: – Refresh Period (Interval). – SESSION Class. – RSVP_HOP Class. • ERROR_SPEC Class options: – TIME_VALUES Class. – IP Error Node Address, Flags, Error Code and – ERROR_SPEC Class. Error Value. – SCOPE Class. – STYLE Class. • SCOPE Class options: – SENDER_TEMPLATE Class. – Number of Address and IP Source Address(es). – SENDER_TSPEC Class. – ADSPEC Class. – RESV_CONFIRM Class. • Etc… Up to 37 command line interface switches.
Exotic protocols • Regular EIGRP options: EIGRP – Opcode, Flags, Sequence Number, Acknowledgment Number, Autonomous System (AS) , Type and Length. • Supported EIGRP opcodes: – Update Message. – Request Message. • General Parameter TLV options: – Query Message. – K1, K2, K3, K4 and K5 Values and Hold Time – Reply Message. (Interval). – Hello Message. – Acknowledgment Message. • Software Version TLV options: – IOS Release Version and EIGRP Protocol • Specific EIGRP TLVs for specific EIGRP types: Release Version. – General Parameter TLV. – Software Version TLV. – Sequence TLV. • IP Internal Routes TLV and IP External Routes – Next Multicast Sequence TLV. TLV options: – IP Internal Routes TLV. – IP Next Hop Address, Delay, Bandwidth, – IP External Routes TLV. Maximum Transmission Unit (MTU), Hop Count, Load, Reliability, IP Source Address(es) and IP Address Prefix (CIDR). • EIGRP Cryptographic Authentication: – Type (HMAC-MD5). – Key-ID. • Etc… Up to 33 command line interface – Authentication Data (RANDOM). switches.
Exotic protocols • OSPF Cryptographic Authentication: OSPF – – Type (HMAC-MD5). Key ID. • Supported OSPF type: – Cryptographic Sequence Number. – Hello Packet. – Authentication Data (RANDOM). – Database Description Packet. – Query Message Packet. • Specific LLS Data Block for specific LLS TLV: – Link State Request Packet. – Extended Options and Flags TLV. – Link State Update Packet. – Cryptographic Authentication TLV. – Link State Acknowledgment Packet. • Regular OSPF options: • Specific LSA Header for specific LSA type: – Type, Router ID, Area ID and Options (Multi- – Router LSA Header. Topology or TOS-Based, External Routing – Network LSA Header. Capability, Multicast Capable, NSSA Supported, – Summary IP Network LSA Header. LLS Data Block in Contained, Demand Circuits is – Summary ASBR Header. Supported, Opaque-LSA and Down Bit). – AS External LSA Header. (ASBR). – No-so-Stubby Area LSA Header (NSSA). • Etc… Up to 54 command line interface – Group Membership LSA Header (Multicast). switches.
0100 – Comparison
Methodology
0101 – Demonstration
T50: an Experimental Mixed Packet Injector Dell Latitude E6400 Dell Latitude D620 • Intel® Core™ 2 Duo P8400 (2.26 GHz) • Intel® Core™ Duo T5600 (1.83 GHz) • Memory 4GB RAM • Memory 2GB RAM • Ubuntu Desktop Linux 10.04 64-bit • Microsoft Windows 7 32-bit • Intel® 82567LM Gigabit Controller • Broadcom NetXtreme 57xx Gigabit Controller • 1 Gbps Network • 1 Gbps Network • Cross-over Cable (CAT-5e) • Cross-over Cable (CAT-5e) Video http://fnstenv.blogspot.com/ Code
0110 – Conclusions
Conclusions • Can be applied to any DoS: • Can be considered a cyber warfare’s – Peer-to-Peer Attacks weapon? – Application Level Attacks – Yes, it can be considered like one. – Distributed Attacks – Reflected Attacks • It is just a matter of time to things get – Level-2 Attacks worse on the Internet. – Degradation-of-Service Attacks – DNS Amplifiers Attacks • A DoS can be perpetrated overnight! • Is DoS and DDoS so 1990’s? • What else? – Please, don’t be silly, again!!! An attacker does not even need multiples zombies.
0111 – Questions & Answers
Any questions?
Protocol T50: Five months later... So what?

More Related Content

PDF
[PH-Neutral 0x7db] Exploit Next Generation®
byNelson Brito
 
PDF
The hangover: A "modern" (?) high performance approach to build an offensive ...
byNelson Brito
 
PDF
A client-side vulnerability under the microscope!
byNelson Brito
 
PDF
Offensive cyber security: Smashing the stack with Python
byMalachi Jones
 
PDF
Embedded device hacking Session i
byMalachi Jones
 
PDF
[ROOTCON13] Pilot Study on Semi-Automated Patch Diffing by Applying Machine-L...
byAsuka Nakajima
 
PPT
OWASP Much ado about randomness
byAleksandr Yampolskiy
 
PDF
HES2011 - Aaron Portnoy and Logan Brown - Black Box Auditing Adobe Shockwave
byHackito Ergo Sum
 
[PH-Neutral 0x7db] Exploit Next Generation®
byNelson Brito
 
The hangover: A "modern" (?) high performance approach to build an offensive ...
byNelson Brito
 
A client-side vulnerability under the microscope!
byNelson Brito
 
Offensive cyber security: Smashing the stack with Python
byMalachi Jones
 
Embedded device hacking Session i
byMalachi Jones
 
[ROOTCON13] Pilot Study on Semi-Automated Patch Diffing by Applying Machine-L...
byAsuka Nakajima
 
OWASP Much ado about randomness
byAleksandr Yampolskiy
 
HES2011 - Aaron Portnoy and Logan Brown - Black Box Auditing Adobe Shockwave
byHackito Ergo Sum
 

What's hot

PDF
john-devkit: 100 типов хешей спустя / john-devkit: 100 Hash Types Later
byPositive Hack Days
 
PPT
Much ado about randomness. What is really a random number?
byAleksandr Yampolskiy
 
PDF
Defcon 22-colby-moore-patrick-wardle-synack-drop cam
byPriyanka Aash
 
PDF
Kernel Recipes 2015: Anatomy of an atomic KMS driver
byAnne Nicolas
 
PDF
Mind your language(s), A Discussion about Languages and Security
byAdaCore
 
PPTX
Slide cipher based encryption
byMizi Mohamad
 
PDF
Where destructors meet threads
byShuo Chen
 
PPTX
1300 david oswald id and ip theft with side-channel attacks
byPositive Hack Days
 
PDF
Defcon 22-paul-mcmillan-attacking-the-iot-using-timing-attac
byPriyanka Aash
 
PDF
44CON London - Attacking VxWorks: from Stone Age to Interstellar
by44CON
 
PDF
The entropic principle: /dev/u?random and NetBSD by Taylor R Campbell
byeurobsdcon
 
PPTX
Secure coding for developers
bysluge
 
PDF
Как мы охотимся на гонки (data races) или «найди багу до того, как она нашла ...
byyaevents
 
PPT
Ilfak Guilfanov - Decompiler internals: Microcode [rooted2018]
byRootedCON
 
PDF
David-FPGA
byguest66dc5f
 
PDF
Tools and Techniques for Understanding Threading Behavior in Android
byIntel® Software
 
PDF
IDA Vulnerabilities and Bug Bounty　 by Masaaki Chida
byCODE BLUE
 
PDF
A22 Introduction to DTrace by Kyle Hailey
byInsight Technology, Inc.
 
PDF
Fuzzing underestimated method of finding hidden bugs
byPawel Rzepa
 
PDF
How to find_vulnerability_in_software
bysanghwan ahn
 
john-devkit: 100 типов хешей спустя / john-devkit: 100 Hash Types Later
byPositive Hack Days
 
Much ado about randomness. What is really a random number?
byAleksandr Yampolskiy
 
Defcon 22-colby-moore-patrick-wardle-synack-drop cam
byPriyanka Aash
 
Kernel Recipes 2015: Anatomy of an atomic KMS driver
byAnne Nicolas
 
Mind your language(s), A Discussion about Languages and Security
byAdaCore
 
Slide cipher based encryption
byMizi Mohamad
 
Where destructors meet threads
byShuo Chen
 
1300 david oswald id and ip theft with side-channel attacks
byPositive Hack Days
 
Defcon 22-paul-mcmillan-attacking-the-iot-using-timing-attac
byPriyanka Aash
 
44CON London - Attacking VxWorks: from Stone Age to Interstellar
by44CON
 
The entropic principle: /dev/u?random and NetBSD by Taylor R Campbell
byeurobsdcon
 
Secure coding for developers
bysluge
 
Как мы охотимся на гонки (data races) или «найди багу до того, как она нашла ...
byyaevents
 
Ilfak Guilfanov - Decompiler internals: Microcode [rooted2018]
byRootedCON
 
David-FPGA
byguest66dc5f
 
Tools and Techniques for Understanding Threading Behavior in Android
byIntel® Software
 
IDA Vulnerabilities and Bug Bounty　 by Masaaki Chida
byCODE BLUE
 
A22 Introduction to DTrace by Kyle Hailey
byInsight Technology, Inc.
 
Fuzzing underestimated method of finding hidden bugs
byPawel Rzepa
 
How to find_vulnerability_in_software
bysanghwan ahn
 

Viewers also liked

PDF
Permutation Oriented Programming: (Re)searching for alternatives!
byNelson Brito
 
PDF
Gestão de Patches e Vulnerabilidades
byMarcelo Martins
 
ODP
Microsoft GDI+ JPEG Integer Underflow Vulnerability
byAshish Malik
 
PDF
Cloud: Should I Stay or Should I Go?
byMarcelo Martins
 
PDF
SyScan Singapore 2010 - Returning Into The PHP-Interpreter
byStefan Esser
 
PDF
Secure Application Development in the Age of Continuous Delivery
byBlack Duck by Synopsys
 
PDF
Exploit Next Generation®: Missão dada é missão cumprida!
byNelson Brito
 
PPTX
Hexadecimal (Calculations and Explanations)
byProject Student
 
PDF
Inception: Tips and tricks I’ve learned reversing vulnerabilities!
byNelson Brito
 
PDF
"Touching the UNTOUCHABLE" (YSTS Seventh Edition)
byNelson Brito
 
PDF
Permutation Oriented Programming
byNelson Brito
 
PDF
The Departed: Exploit Next Generation® – The Philosophy
byNelson Brito
 
PPTX
Workforce Planning (Process, Labour Shortage, Excess Labour)
byProject Student
 
PPTX
Changes in working practices
byProject Student
 
PPTX
Programming Languages / Translators
byProject Student
 
PPTX
FormacaoCrypto
byIgor Antunes
 
PDF
Patch and Vulnerability Management
byMarcelo Martins
 
PDF
The Caesar Cipher
byAnnalisa Di Pierro
 
PPTX
Product (Product Portfolio, Branding, USP, Product Depth and Breadth, Product...
byProject Student
 
PPTX
Cryptography - 101
byn|u - The Open Security Community
 
Permutation Oriented Programming: (Re)searching for alternatives!
byNelson Brito
 
Gestão de Patches e Vulnerabilidades
byMarcelo Martins
 
Microsoft GDI+ JPEG Integer Underflow Vulnerability
byAshish Malik
 
Cloud: Should I Stay or Should I Go?
byMarcelo Martins
 
SyScan Singapore 2010 - Returning Into The PHP-Interpreter
byStefan Esser
 
Secure Application Development in the Age of Continuous Delivery
byBlack Duck by Synopsys
 
Exploit Next Generation®: Missão dada é missão cumprida!
byNelson Brito
 
Hexadecimal (Calculations and Explanations)
byProject Student
 
Inception: Tips and tricks I’ve learned reversing vulnerabilities!
byNelson Brito
 
"Touching the UNTOUCHABLE" (YSTS Seventh Edition)
byNelson Brito
 
Permutation Oriented Programming
byNelson Brito
 
The Departed: Exploit Next Generation® – The Philosophy
byNelson Brito
 
Workforce Planning (Process, Labour Shortage, Excess Labour)
byProject Student
 
Changes in working practices
byProject Student
 
Programming Languages / Translators
byProject Student
 
FormacaoCrypto
byIgor Antunes
 
Patch and Vulnerability Management
byMarcelo Martins
 
The Caesar Cipher
byAnnalisa Di Pierro
 
Product (Product Portfolio, Branding, USP, Product Depth and Breadth, Product...
byProject Student
 
Cryptography - 101
byn|u - The Open Security Community
 

Similar to Protocol T50: Five months later... So what?

PDF
CCNA Advanced Routing Protocols Questions
byDsunte Wilson
 
PPT
Np unit2
byvamsitricks
 
PPTX
G3 phase1 final ppt.pptx
byvisheshs4
 
PDF
Interprocess Message Formats
byPathfinder Solutions
 
PPT
Npc16
byvamsitricks
 
PDF
Sockets
byIndrasena Reddy
 
PDF
Multi Process Message Formats
byPathfinder Solutions
 
PPTX
Ppt of routing protocols
byBhagyashri Dhoke
 
PDF
Cisco IOS Attack & Defense - The State of the Art
byamiable_indian
 
PDF
Eigrp Summary (Ccna4.Com)
byCCNAResources
 
PDF
IPv6 Fundamentals & Securities
byDon Anto
 
PDF
1 using default
byguest10184a
 
PDF
1 using default
byguest10184a
 
PPTX
Routing Protocol in detail
byDil_E_Dastan
 
DOC
Eigrp
byttcskhhyn
 
PPT
Internet protocol
byOnline
 
PPTX
Eric Vyncke - Layer-2 security, ipv6 norway
byIKT-Norge
 
PDF
Eigrp
byMohamed Gamel
 
PDF
Eigrp
byMohamed Gamel
 
PDF
Eigrp
bySwapnil Kapate
 
CCNA Advanced Routing Protocols Questions
byDsunte Wilson
 
Np unit2
byvamsitricks
 
G3 phase1 final ppt.pptx
byvisheshs4
 
Interprocess Message Formats
byPathfinder Solutions
 
Npc16
byvamsitricks
 
Sockets
byIndrasena Reddy
 
Multi Process Message Formats
byPathfinder Solutions
 
Ppt of routing protocols
byBhagyashri Dhoke
 
Cisco IOS Attack & Defense - The State of the Art
byamiable_indian
 
Eigrp Summary (Ccna4.Com)
byCCNAResources
 
IPv6 Fundamentals & Securities
byDon Anto
 
1 using default
byguest10184a
 
1 using default
byguest10184a
 
Routing Protocol in detail
byDil_E_Dastan
 
Eigrp
byttcskhhyn
 
Internet protocol
byOnline
 
Eric Vyncke - Layer-2 security, ipv6 norway
byIKT-Norge
 
Eigrp
byMohamed Gamel
 
Eigrp
byMohamed Gamel
 
Eigrp
bySwapnil Kapate
 

More from Nelson Brito

PDF
SQL Fingerprint NG - A Next Generation DB Scanner
byNelson Brito
 
PDF
Próximo passo evolutivo de um DB Scanner
byNelson Brito
 
PDF
Reversing Engineer: Dissecting a "Client Side" Vulnerability in the APT era
byNelson Brito
 
PDF
Inception: Support Slides
byNelson Brito
 
PDF
DoS: From "Galactic Network" to "Service Unavailable" (Support Slides)
byNelson Brito
 
PDF
Keynote: Where is my identity?
byNelson Brito
 
PDF
Worms 2.0: Evolution — From SyFy to "You Die"
byNelson Brito
 
PDF
Inception: A reverse-engineer horror History
byNelson Brito
 
PPT
Worms: Conheça o inimigo e defenda-se
byNelson Brito
 
SQL Fingerprint NG - A Next Generation DB Scanner
byNelson Brito
 
Próximo passo evolutivo de um DB Scanner
byNelson Brito
 
Reversing Engineer: Dissecting a "Client Side" Vulnerability in the APT era
byNelson Brito
 
Inception: Support Slides
byNelson Brito
 
DoS: From "Galactic Network" to "Service Unavailable" (Support Slides)
byNelson Brito
 
Keynote: Where is my identity?
byNelson Brito
 
Worms 2.0: Evolution — From SyFy to "You Die"
byNelson Brito
 
Inception: A reverse-engineer horror History
byNelson Brito
 
Worms: Conheça o inimigo e defenda-se
byNelson Brito
 

Recently uploaded

PPTX
Introduction-to-Machine-Learning-Part-1-3.pptx
byAliBilal39
 
PDF
Comprehensive Analysis of OpenAI's Strategic Transformation at DevDay 2025.pdf
byAlex Doan
 
PDF
Phishing for Answers: A Tech Filler Quiz.pdf
byConquiztadors- the Quiz Society of Sri Venkateswara College
 
PDF
Session 2 - Specialized AI Associate Series: Orchestrator Deep-Dive and UiPa...
byDianaGray10
 
PDF
OWASP Transparency Exchange API: How We (Will) Share xBOMs
byPavel Shukhman
 
PPTX
⚡Level Up Your Slack Game: Workflows & Conditional Branching🎉
bySanjeetMishra29
 
PPTX
CLOUD STUDY JAM 2025 GOOGLE DEVELOPER GROUPS ON CAMPUS NSEC
byasutoshkumar560
 
PDF
A business case for open source: From lock-in to value.pdf
byMindtrek
 
PDF
Web Mapping 101: Creating Dynamic Web Maps with Geospatial Data
bySafe Software
 
PPTX
hackathon[1][1].pptx Cost-Effective Detection of LV Line Breakage
byvivekpunde6
 
PDF
“Multimodal Enterprise-scale Applications in the Generative AI Era,” a Presen...
byEdge AI and Vision Alliance
 
PDF
Tilannekatsaus tekoälytoimintaan Suomessa.pdf
byMindtrek
 
PPTX
sap 2016-09-14_PP_MRPType_VB_Blogged.pptx
byAmira Jemi
 
PPTX
Unit 1- Strategies to AVOID ErrorsBias.pptx
byapurvshimpi02
 
PDF
Mapping Your Ecosystem: Uniting Content and Data across Systems
byRustici Software
 
PDF
Cloud and internet-of-things secure integration along with security concerns
byIJICTJOURNAL
 
PDF
NeuroXR: Current Research and Opportunities
byMark Billinghurst
 
PDF
A PROJECT ON EVOLUTION OF DNA FINGERPRINTING AND ITS TECHNOLOGY
bychandrakalasahu568
 
PDF
Master Deck: GraphSummit Bengaluru (Oct 7)
byNeo4j
 
PDF
TrustArc Webinar - The Future of Third-Party Privacy Risk: Trends, Tactics & ...
byTrustArc
 
Introduction-to-Machine-Learning-Part-1-3.pptx
byAliBilal39
 
Comprehensive Analysis of OpenAI's Strategic Transformation at DevDay 2025.pdf
byAlex Doan
 
Phishing for Answers: A Tech Filler Quiz.pdf
byConquiztadors- the Quiz Society of Sri Venkateswara College
 
Session 2 - Specialized AI Associate Series: Orchestrator Deep-Dive and UiPa...
byDianaGray10
 
OWASP Transparency Exchange API: How We (Will) Share xBOMs
byPavel Shukhman
 
⚡Level Up Your Slack Game: Workflows & Conditional Branching🎉
bySanjeetMishra29
 
CLOUD STUDY JAM 2025 GOOGLE DEVELOPER GROUPS ON CAMPUS NSEC
byasutoshkumar560
 
A business case for open source: From lock-in to value.pdf
byMindtrek
 
Web Mapping 101: Creating Dynamic Web Maps with Geospatial Data
bySafe Software
 
hackathon[1][1].pptx Cost-Effective Detection of LV Line Breakage
byvivekpunde6
 
“Multimodal Enterprise-scale Applications in the Generative AI Era,” a Presen...
byEdge AI and Vision Alliance
 
Tilannekatsaus tekoälytoimintaan Suomessa.pdf
byMindtrek
 
sap 2016-09-14_PP_MRPType_VB_Blogged.pptx
byAmira Jemi
 
Unit 1- Strategies to AVOID ErrorsBias.pptx
byapurvshimpi02
 
Mapping Your Ecosystem: Uniting Content and Data across Systems
byRustici Software
 
Cloud and internet-of-things secure integration along with security concerns
byIJICTJOURNAL
 
NeuroXR: Current Research and Opportunities
byMark Billinghurst
 
A PROJECT ON EVOLUTION OF DNA FINGERPRINTING AND ITS TECHNOLOGY
bychandrakalasahu568
 
Master Deck: GraphSummit Bengaluru (Oct 7)
byNeo4j
 
TrustArc Webinar - The Future of Third-Party Privacy Risk: Trends, Tactics & ...
byTrustArc
 

Protocol T50: Five months later... So what?

  • 1.
    Protocol T50 “Five monthslater... So what?”
  • 2.
    Agenda • 0000 –Once upon a time… • 0100 – Comparison • 0001 – Introduction • 0101 – Demonstration • 0010 – Improvements • 0110 – Conclusions • 0011 – Protocols • 0111 – Questions and Answers
  • 3.
    0000 – Onceupon a time…
  • 4.
  • 5.
  • 6.
    Why Denial-of-Service? • Isthere anything more offensive than a • But, what are the real damages? What DoS, anyways? are the real motivations? Image? – Bear in mind: DoS means “Stress Revenge? Financial? Political? Testing” for this presentation. Hacktivism? • DoS tools are necessary weapons in a • DoS attacks are significantly harmful, cyber warfare… because they violate one of the three key concepts of security that are common to risk management… Which one? • Attacks against the infrastructure are more common than many people might – Confidentiality think, and, when they happen, people – Integrity will certainly be aware of. – Availability T50 shows that some sort of performance enhancements, using an ordinary Linux box and programming in user space, can be done.
  • 7.
    T50 – Thechaos maker • Primarily, the tool was developed to • This new version is focused on internal address my day-by-day needs, and I am infrastructure, allowing people to test the sharing with the community, because I availability of its resources. always need a tool to perform some “Stress Testing” and that could be launched from • Interior Gateway Protocols (Distance Vector my notebook: Algorithm): – I do not want to carry/rent/buy a Smartbits, Avalanche, etc. – Routing Information Protocol (RIP). – Enhanced Interior Gateway Routing Protocol (EIGRP). • The tool was designed to perform “Stress Testing” on a variety of infrastructure network devices (Version 2.45). • Interior Gateway Protocols (Link State Algorithm): – Open Shortest Path First (OSPF). • The tool was re-designed to extend the “Stress Testing” (Version 5.3), covering some regular protocols (ICMP, IGMP, TCP • Quality-of-Service Protocols: and UDP), some infrastructure specific – Resource ReSerVation Protocol (RSVP). protocols (GRE, IPSec and RSVP) and some routing protocols (RIP, EIGRP and • Tunneling/Encapsulation Protocols: OSPF). – Generic Routing Encapsulation (GRE).
  • 8.
    T50 – Thechaos maker I did not review any third-party codes… I found my own way to address some challenges!!! #define EIGRP_DADDR_LENGTH(foo) (((foo >> 3) & 3) + (foo % 8 ? 1 : 0)) if(o.eigrp.type == EIGRP_TYPE_SOFTWARE || o.eigrp.type == EIGRP_TYPE_MULTICAST) goto eigrp_software; #define EIGRP_DADDR_BUILD(foo, bar) (foo &= htonl(~(0xffffffff >> ((bar >> 3) * 8)))) #define TCPOLEN_PADDING(foo) ((foo & 3) ? 4 - (foo & 3) : 0)
  • 9.
    0010 – Improvements Alsoknown as “New Features”
  • 10.
    License • Licensed underGNU General Public License version 2: – Any piece of code cannot be integrated into proprietary applications and appliances. – There is an alternative license to do so. • Free software and 100% Open Source: – You may redistribute and/or modify it under the terms of GPL version 2. – Will always be available as an Open Source project to the community. • Recruiting new coders, hackers and developers to keep the project and add new substantial improvements.
  • 11.
    Classless Inter-Domain Routing(CIDR) • CIDR specifies an IP address range using a combination of an IP address and its associated network mask: – 192.168.1.13/24 – 192.168.1.13/255.255.255.0 – 172.16.0.128/15 – 172.16.0.128/255.254.0.0 – 10.200.200.1/10 – 10.200.200.1/255.192.0.0 • CIDR for destination address is supported: – Allows to simulate both Distributed Denial-of-Service and Distributed Reflection Denial-of-Service in a controlled environment. – CIDR network mask supported: • Minimum is “/8” (255.0.0.0). • Maximum is“/30” (255.255.255.252).
  • 12.
    Classless Inter-Domain Routing(CIDR) unsigned int hostid = 0, counter = 0, rand_addr = 0; in_addr_t netmask = INADDR_ANY, all_bits_on = 0xffffffff, __1st_addr = INADDR_ANY, addresses[16777214] = INADDR_ANY; struct iphdr *ip; netmask = ~(all_bits_on >> bits); hostid = (unsigned int) (pow(2, (32 - bits)) - 2); __1st_addr = (ntohl(address) & netmask) + 1; [...] for(counter = 0 ; counter < hostid ; counter++) addresses[counter] = htonl(__1st_addr++); [...] rand_daddr = (unsigned int) ((float)(hostid) * rand() / (RAND_MAX + 1.0)); ip->daddr = addresses[rand_daddr]; [...]
  • 13.
    Classless Inter-Domain Routing(CIDR) 192.168.1.13 /24 192.168.1.13 /255.255.255.0 0xffffffff 11111111.11111111.11111111.11111111 0x000000ff 00000000.00000000.00000000.11111111 0xffffff00 11111111.11111111.11111111.00000000 0xc0a8010d 11000000.10101000.00000001.00001101 & 0xffffff00 11111111.11111111.11111111.00000000 0xc0a80100 11000000.10101000.00000001.00000000 NETWORK HOST (2(32-24))-2 = (28)-2 = 256-2 = 254
  • 14.
    Multi-protocol sequential injection •Version 2.45 (as of November 2010): – Support for four protocols: ICMP, IGMPv1, TCP and UDP. – Sends all of them sequentially, i.e., almost on the same time. • Version 5.3 (as of today): – Support for the previous four protocols: ICMP, IGMPv11, TCP1 and UDP. – Eleven (11) new protocols: IGMPv31, EGP2, RIPv1, RIPv2, DCCP1, RSVP1, GRE3, IPSec (AH/ESP), EIGRP1 and OSPF1. – Sends all of them sequentially, i.e., almost on the same time. 1 This protocol can be improved to cover additional advanced options. 2 This protocol demands more development efforts to cover advanced options. 3 Very first tool able to encapsulate the protocols within GRE packets.
  • 15.
    Multi-protocol sequential injection socket_tfd; int flags, n = 1, len, * nptr = &n; fd_set wfds; [...] if((fd = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) == -1) exit(EXIT_FAILURE); if(setsockopt(fd, IPPROTO_IP, IP_HDRINCL, nptr, sizeof(n)) < 0) exit(EXIT_FAILURE); [...]
  • 16.
    Multi-protocol sequential injection structt50{ int proto; void(*raw)(int, struct options); }; [...] while(flood || threshold--){ [...] if(protocol != IPPROTO_T50){ [...] }else{ for(module = 0 ; module < modules ; module++){ protocol = t50[module].proto; t50[module].raw(fd, options); } threshold -= (modules-1); protocol = IPPROTO_T50; } [...]
  • 17.
  • 18.
    Checksum optimization • Theversion 5.3 introduced a new technique to calculate the checksum, consequentially, a new technique to build the packet. • This technique is MEMCPY(3)-free, and allows to build the packet byte-by-byte – sometimes bit-by-bit. • This technique is more flexible, specially when playing with exotic protocol options – sometimes uses GOTO. For example: – EIGRP IP Internal Routes TLV destination address. – EIGRP IP External Routes TLV destination address. – OSPF HELLO Message with multiple NEIGHBOR addresses. – RSVP Object SCOPE Class with multiple SCOPE addresses. – Etc…
  • 19.
    Checksum optimization unsigned intoffset = 0; unsigned char packet[packet_size], * checksum = NULL; struct eigrp_hdr * eigrp; [...] offset = sizeof(struct eigrp_hdr); checksum = (unsigned char *)eigrp + offset; *((unsigned short *)checksum) = htons(length); checksum += sizeof(unsigned short); offset += sizeof(usigned short); *((usigned int *)checksum) = htonl(auth_key_id)); checksum += sizeof(unsigned int); offset += sizeof(usigned int); [...] eigrp->check = cksum((u_int16_t *)eigrp, offset); [...]
  • 20.
  • 21.
    Checksum optimization packet_size = sizeof(ip) + sizeof(eigrp) + eigrp_hdr_len();
  • 22.
  • 23.
  • 24.
  • 25.
    packet 1st step ↓ packet 2nd step ↓ Checksum optimization
  • 26.
    packet 1st step ↓ packet 2nd step ↓ Checksum optimization
  • 27.
    packet 1st step ↓ packet 2nd step ↓ Checksum optimization
  • 28.
    packet 1st step ↓ packet 2nd step ↓ Checksum optimization
  • 29.
    packet 1st step ↓ packet 2nd step ↓ Checksum optimization
  • 30.
    packet 1st step ↓ packet 2nd step ↓ Checksum optimization
  • 31.
    packet 1st step ↓ packet 2nd step ↓ Checksum optimization
  • 32.
    Checksum optimization 1st step packet eigrp_hdr_len() ↓ 2nd step packet ↓
  • 33.
    packet 1st step ↓ packet 2nd step ↓ Checksum optimization offset
  • 34.
    packet 1st step ↓ packet 2nd step ↓ Checksum optimization
  • 35.
  • 36.
    RFC 1700, 1918and 3330 improvements [...] switch(ntohl(daddr) & 0xff000000){ case 0x0a000000: /* Allowing 10/8 (RFC 1918). */ break; case 0x7f000000: /* Allowing 127/8 (RFC 1700). */ break; case 0xa9000000: /* Allowing 169.254/16 (RFC 3330). */ if(((ntohl(daddr) & 0xffff0000) != 0xa9fe00000)) return(FALSE); break; case 0xac000000: /* Allowing 172.16/12 (RFC 1918). */ if(((ntohl(daddr) & 0xffff0000) < 0xac100000) || ((ntohl(daddr) & 0xffff0000) > 0xac1f0000)) return(FALSE); break; case 0xc0000000: /* Allowing 192.168/16 (RFC 1918). */ if((ntohl(daddr) & 0xffff0000) != 0xc0a80000) return(FALSE); break; [...]
  • 37.
  • 38.
    Protocols IGMPv3 TCP • Specific headers for specific types: • Regular TCP options: – Membership Query. – Source Port and Destination Port, Sequence Number (also known as ISN), Acknowledgment – Membership Report. Number, Data Offset, Window, Urgent Pointer and TCP Flags (FIN, SYN, RST, PSH, ACK, URG, ECE and CWR). • Membership Query options: – Max Resp code. • Supported TCP Options: – Group Address. – End of List (EOL), No Operation (NOP), – Suppress Router-processing Flag. Maximum Segment Size (MSS), Windows Scale – Querier’s Robustness Variable (QRV). (WSopt), Timestamp (TSopt), T/TCP Connection Count (CC, CC.NEW and CC.ECHO), Selective – Querier’s Query Interval Code (QQIC). Acknowledgement (SACK), MD5 Signature – Number of Sources. Option and the brand new TCP-AO – Source Address(es). (Authentication Option – RFC 5925). • Membership Report options: • TCP Authentication Option (as of June 2010): – Type (HMAC-MD5). – Group Record Type. – Key ID. – Group Record Multicast Address. – Next Key ID. – Number of Sources. – Authentication Data (RANDOM). – Source Address(es).
  • 39.
    Protocols RIP DCCP • Regular RIPv1 and RIPv2 options: • Specific headers for specific types: – Command. – Request Packets – Address Family Identifier. – Response Packet. – Router IP Address. – Data Packets – Router Metric. – Acknowledgment Packet, Data-Ack Packet, Synchronize Packet, Sync-Ack Packet, Close Packet and Close Request Packet. • Enhanced RIPv2 options: – Reset Packet. – Routing Domain. – Route Tag. – Router Network Mask. • Regular DCCP options: – Router Next Hop. – Source Port and Destination Port. – Data Offset. – HC-Sender CCID (CCVal). • RIPv2 Cryptographic Authentication: – Checksum Coverage (CsCov). – Type (HMAC-MD5). – Extended Sequence Numbers (x). – Key ID. – Sequence Numbers (HIGH and LOW). – Cryptographic Sequence Number. – Acknowledgment Numbers (HIGH and LOW). – Authentication Data (RANDOM). – Service Code. – Reset Code.
  • 40.
    Exotic protocols • Regular RSVP options: – Flags and Time to Live. RSVP • Supported RSVP types: • SESSION Class options: – Path Message. – Destination address, Protocol ID, Flags and – Resv Message. Destination Port. – Path Teardown Message. – Resv Teardown Message. • RSVP_HOP Class options: – Path Error Message. – IP Next/Previous Hop (Neighbor) Address and – Resv Error Messages Logical Interface Handle. – Confirmation Message. • TIME_VALUES Class options: • Specific RSVP Objects for specific RSVP type: – Refresh Period (Interval). – SESSION Class. – RSVP_HOP Class. • ERROR_SPEC Class options: – TIME_VALUES Class. – IP Error Node Address, Flags, Error Code and – ERROR_SPEC Class. Error Value. – SCOPE Class. – STYLE Class. • SCOPE Class options: – SENDER_TEMPLATE Class. – Number of Address and IP Source Address(es). – SENDER_TSPEC Class. – ADSPEC Class. – RESV_CONFIRM Class. • Etc… Up to 37 command line interface switches.
  • 41.
    Exotic protocols • Regular EIGRP options: EIGRP – Opcode, Flags, Sequence Number, Acknowledgment Number, Autonomous System (AS) , Type and Length. • Supported EIGRP opcodes: – Update Message. – Request Message. • General Parameter TLV options: – Query Message. – K1, K2, K3, K4 and K5 Values and Hold Time – Reply Message. (Interval). – Hello Message. – Acknowledgment Message. • Software Version TLV options: – IOS Release Version and EIGRP Protocol • Specific EIGRP TLVs for specific EIGRP types: Release Version. – General Parameter TLV. – Software Version TLV. – Sequence TLV. • IP Internal Routes TLV and IP External Routes – Next Multicast Sequence TLV. TLV options: – IP Internal Routes TLV. – IP Next Hop Address, Delay, Bandwidth, – IP External Routes TLV. Maximum Transmission Unit (MTU), Hop Count, Load, Reliability, IP Source Address(es) and IP Address Prefix (CIDR). • EIGRP Cryptographic Authentication: – Type (HMAC-MD5). – Key-ID. • Etc… Up to 33 command line interface – Authentication Data (RANDOM). switches.
  • 42.
    Exotic protocols • OSPF Cryptographic Authentication: OSPF – – Type (HMAC-MD5). Key ID. • Supported OSPF type: – Cryptographic Sequence Number. – Hello Packet. – Authentication Data (RANDOM). – Database Description Packet. – Query Message Packet. • Specific LLS Data Block for specific LLS TLV: – Link State Request Packet. – Extended Options and Flags TLV. – Link State Update Packet. – Cryptographic Authentication TLV. – Link State Acknowledgment Packet. • Regular OSPF options: • Specific LSA Header for specific LSA type: – Type, Router ID, Area ID and Options (Multi- – Router LSA Header. Topology or TOS-Based, External Routing – Network LSA Header. Capability, Multicast Capable, NSSA Supported, – Summary IP Network LSA Header. LLS Data Block in Contained, Demand Circuits is – Summary ASBR Header. Supported, Opaque-LSA and Down Bit). – AS External LSA Header. (ASBR). – No-so-Stubby Area LSA Header (NSSA). • Etc… Up to 54 command line interface – Group Membership LSA Header (Multicast). switches.
  • 43.
  • 44.
  • 45.
  • 46.
    T50: an ExperimentalMixed Packet Injector Dell Latitude E6400 Dell Latitude D620 • Intel® Core™ 2 Duo P8400 (2.26 GHz) • Intel® Core™ Duo T5600 (1.83 GHz) • Memory 4GB RAM • Memory 2GB RAM • Ubuntu Desktop Linux 10.04 64-bit • Microsoft Windows 7 32-bit • Intel® 82567LM Gigabit Controller • Broadcom NetXtreme 57xx Gigabit Controller • 1 Gbps Network • 1 Gbps Network • Cross-over Cable (CAT-5e) • Cross-over Cable (CAT-5e) Video http://fnstenv.blogspot.com/ Code
  • 47.
  • 48.
    Conclusions • Can beapplied to any DoS: • Can be considered a cyber warfare’s – Peer-to-Peer Attacks weapon? – Application Level Attacks – Yes, it can be considered like one. – Distributed Attacks – Reflected Attacks • It is just a matter of time to things get – Level-2 Attacks worse on the Internet. – Degradation-of-Service Attacks – DNS Amplifiers Attacks • A DoS can be perpetrated overnight! • Is DoS and DDoS so 1990’s? • What else? – Please, don’t be silly, again!!! An attacker does not even need multiples zombies.
  • 49.
  • 50.