Luigi Auriemma

Hello,

I have been trying to modify packets for quite a while and for this I have used tools like WPEpro, redox packet editor(kinda like wpe but more advanced) and of course your Proxocket although its a bit too advanced for me, i'm not a coder.

What I am trying to do now is modify a packet's header (or whatever its called the string BEFORE any other data). E.g. I'd like to change the flag on an incoming packet, eg FIN

Please see the pic...this is the empty packet with no data except the header, and WPE or redox dont seem to pick up on it at all, as it is not among the sniffed packets, but wireshark does and this is the screencap. If I would like to change say the FIN value to "not set" how would I do that?

I understand what you mean but it's a too low level thing so the normal program can't reach it but you can reach the same effect in other ways.

it's clear that in your case you want that a connection gets closed when you receive a certain packet so you can do the same by setting the size of the packet to 0 o setting all its content to 0 or other bad values.

anyway remember that it's a tcp stream so you will never receive the packets as you expect, the rule for the tcp streams is that you can even receive the data 1 byte per packet making really hard to make a filter (you should rebuild the whole packet and then checking the filter, terrible).

Actually I don't want the connection to get closed, in this case FIN set to 1 will close it (this is from a flash based chat), and I am trying to change it to something else so the chat app don't see the kick command which I believe is just that FIN value 1.

I have nothing against blocking this type of empty packets by other means, but it looks like I won't be able to do it in wpe or similar tools, or maybe I can?
I remember using your proxocket before too, compiled it OK and used for some other stuff, but I am not sure how to achieve this type of thing. So if I may ask you for the piece of code that would be doing this, it would be really great.

Thanks again

FIN and RST close the connection, so the filtering of the content of the packet is the only choice

I'm not sure I understand. There is no content besides this whats on the pic. There is no data after the TCP info. Is there a way to modify this kind of packet (change the FIN value)?

uhmmm there is something I don't understand.
a FIN packet without content is used to terminate the connection but maybe I'm watching the thing from another point of view.

in short I though you were referring to receiving a FIN packet while I guess that you refer to your program that sends the FIN packet for terminating the connection and instead you want to keep it up, right?

uhmmm in that case I guess it's easy to avoid the calling of closesocket in the program

My mistake, I should have said from the beginning that the packet on the pic is a Recv packet.
So they send it and the flash app on my end terminates the connection, but it first sends a couple of packets back to the server (also with FIN=1 and ACK=1). One final packet from their server with ACK=1 is sent to me and thats the last packet with this remote port (always 7666), after that you're disconnected.
And yes, I would like to keep the connection up. Any ideas?

Yes

I use burpsuite and i used paros and webscarab. I use them for http interception. This is udp/tcp stuff. If it can be intercepted and modified by those tools, please tell me how, I'd be grateful. My goal is not to have admin rights, just to bounce off/modify the kick packet

Nothing is wrong with WPEpro except that it doesn't "see" the crucial packet and hence it can't modify it. It's an empty, header only, packet. Look above

Not the issue here, wireshark can catch this crucial packet and thats all I need it for here. I know commview is cool, btw do you have % of their sales? ;)

ih ih ih sometimes I have the same suspect too :)