Relative IP Identification number change

# SPDX-FileCopyrightText: 1999 SecuriTeam
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.10201");
  script_version("2023-08-03T05:05:16+0000");
  script_tag(name:"last_modification", value:"2023-08-03 05:05:16 +0000 (Thu, 03 Aug 2023)");
  script_tag(name:"creation_date", value:"2005-11-03 14:08:04 +0100 (Thu, 03 Nov 2005)");
  script_tag(name:"cvss_base", value:"2.6");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:H/Au:N/C:P/I:N/A:N");
  script_name("Relative IP Identification number change");
  script_category(ACT_GATHER_INFO);
  script_copyright("Copyright (C) 1999 SecuriTeam");
  script_family("General");
  script_dependencies("os_detection.nasl", "secpod_open_tcp_ports.nasl", "global_settings.nasl");
  script_mandatory_keys("TCP/PORTS", "Host/runs_windows");
  script_exclude_keys("keys/islocalhost", "keys/TARGET_IS_IPV6");

  script_tag(name:"solution", value:"Contact your vendor for a patch");

  script_tag(name:"summary", value:"The remote host uses non-random IP IDs, that is, it is
  possible to predict the next value of the ip_id field of the ip packets sent by this host.");

  script_tag(name:"impact", value:"An attacker may use this feature to determine traffic patterns
  within your network. A few examples (not at all exhaustive) are:

  1. A remote attacker can determine if the remote host sent a packet
  in reply to another request.  Specifically, an attacker can use your
  server as an unwilling participant in a blind portscan of another
  network.

  2. A remote attacker can roughly determine server requests at certain
  times of the day.  For instance, if the server is sending much more
  traffic after business hours, the server may be a reverse proxy or
  other remote access device.  An attacker can use this information to
  concentrate his/her efforts on the more critical machines.

  3. A remote attacker can roughly estimate the number of requests that
  a web server processes over a period of time.");

  script_tag(name:"qod_type", value:"general_note");
  script_tag(name:"solution_type", value:"VendorFix");

  exit(0);
}

include("host_details.inc");
include("misc_func.inc");
include("port_service_func.inc");

if(TARGET_IS_IPV6())
  exit(0);

# localhost results are bogus
if(islocalhost())
  exit(0);

srcaddr = this_host();
dstaddr = get_host_ip();

IPH = 20;
IP_LEN = IPH;

ip = forge_ip_packet(ip_v:4,
                     ip_hl:5,
                     ip_tos:0,
                     ip_len:IP_LEN,
                     ip_id:0xABA,
                     ip_p:IPPROTO_TCP,
                     ip_ttl:255,
                     ip_off:0,
                     ip_src:srcaddr,
                     ip_dst:dstaddr);

port = tcp_get_first_open_port();

soc = open_sock_tcp(port);
if(!soc)
  exit(0);

close(soc);

tcpip = forge_tcp_packet(ip:ip,
                         th_sport:port,
                         th_dport:port,
                         th_flags:TH_SYN,
                         th_seq:0xF1C,
                         th_ack:0,
                         th_x2:0,
                         th_off:5,
                         th_win:512,
                         th_urp:0);

filter = string("tcp and src host ", dstaddr, " and dst host ", srcaddr, " and dst port ", port, " and src port ", port);

relative = "-1";
answer_count = 0;
for(i = 0; i < 10; i++) {
  r[i]="";
  o[i]="";
}

for(packet_count = 0; packet_count < 10; packet_count++) {
  result = send_packet(tcpip, pcap_active:TRUE, pcap_filter:filter);
  if((packet_count > 3) && (answer_count == 0)) {
    exit(0);
  }

  if(result) {
    ip_id = get_ip_element(ip:result, element:"ip_id");
    if(ip_id != 0 ) {
      answer_count++;
      if(relative == "-1") {
        relative = ip_id;
      } else {
        if(ip_id > relative) {
          max = ip_id;
          min = relative;
        } else {
          max = relative;
          min = ip_id;
        }
        relative = max - min;
        r[answer_count-1] = relative;
        o[answer_count-1] = ip_id;
        relative = ip_id;
      }
    }
  }
}

ok = 1;

if(answer_count) {

  # Added by rd :
  #
  # if the ids are relative, then, we have a relation such as:
  #
  #  n      =  n   +  m
  #   i + 1      i
  #
  # with n   = i'th ip_id
  #       i
  #
  # so, we have :
  #
  #  n      = n   + k*m
  #   i + k    i
  #
  # So it's pretty easy to find if ip_ids are relatives or not.

  ni = 0;
  m = 0;
  start = 0;
  for(i = 0; i < 10; i++) {
    if(o[i]) {
      start = i;
      ni = o[i];
      i = 10;
    }
  }

  for(i = start + 1; i < 10; i++) {
    if(o[i]) {
      if(o[i] > ni) {
        mx = o[i];
        mn = ni;
      } else {
        mx = ni;
        mn = o[i];
      }

      m = mx - mn;
      start = i;
      i = 10;
    }
  }

  ok = 1;
  for(i = start + 1; i < 10; i++) {
    if(o[i]) {
      if(o[i] > ni) {
        mx = o[i];
        mn = ni;
      } else {
        mx = ni;
        mn = o[i];
      }

      km = mx - mn;

      #
      # n  = n  + k x m
      #  k    i
      #
      # This implies that km % m = 0
      #
      if(km % m) {
        ok = 0;
        i = 1000;
      }
    }
  }

  #  end of rd's addition

  if(ok)
    security_message( port: 0, data: "The target host was found to be vulnerable" );

}