Shell over ICMP 0.5

Shell over ICMP consists of two free and open source applications: one server and one client. Shell over ICMP project allows a user to connect to a remote shell daemon, by using ICMP protocol instead of classical TCP.

Entirely written in Python, soicmp is a working proof-of-concept to demonstrate that data can be transmitted across a network by hiding it in traffic that normally does not contain payloads.

How does it work?

The soicmp server is a daemon that must be started on the remote server. When the server receives a request from the client it looks into the packet's payload. The payload must respect certain protocol rules. In detail the client must specify:

command
communication mode (echo|echo/reply)
authentication (y|n)

This is an example of a correct payload string sent by client to server:

$CMD ls -a $MODE echo/reply $PWD root2005 $END

If the payload matches with the server protocol specification then it will pipe the command to "/bin/sh" or "cmd.exe" and execute it. The server then reads the result from the pipe and sends it back to the client that will print it to stdout.

Moreover every client will send ICMP packets having id equal to the client's current process ID and will accept only ICMP replies having the same id value. This prevents output to be printed by other client instances running on the same workstation (this argument is also treated in the FAQs section).

Product's homepage

Here are some key features of "Shell over ICMP":

· Platform independent.
· Possibility to run soicmp daemon on multiple ethernet interfaces simultaneously handling multiple client connections.
· Possibility to specify the buffer size of outgoing packets.
· Client side source IP address spoofing.
· Remote client case-sensitive (plain texted) authentication.
Possibility to select two communication types:
· One based on encapsulating command output in unique "one way" ICMP_ECHOREPLY (type 0) packets sent by server to client (see fig. 1).
· Another one that guarantees the correct packets delivering by using the request/response nature of ECHO and ECHOREPLY ICMP packet types (see fig.2)
· No listening sockets are listed by netstat or similar programs.