Iptable_Evil – An Evil Bit Backdoor For Iptables

iptable evil 1 ssh while blocked 740353

iptable_evil is a very specific backdoor for iptables that allows all packets with the evil bit set, no matter the firewall rules.

The initial implementation is in iptable_evil.c, which adds a table to iptables and requires modifying a kernel header to insert a spot for it. The second implementation is a modified version of the ip_tables core module and its dependents to allow all Evil packets.

I have tested it on Linux kernel version 5.8.0-48, but this should be appliciable to pretty much any kernel version with a full implementation of iptables.

Explanation of the Evil Bit

RFC3514, published April 1st, 2003, defines the previously-unused high-order bit of the IP fragment offset field as a security flag. To RFC-compliant systems, a 1 in that bit position indicates evil entent and will cause the packet to be blocked.

By default, this bit is turned off, but can be turned on in your software if you’re assembling the entirety of your IP packet (as some hacking tools do), or in the Linux kernel using this patch (mirrored in this repository here).

How does the backdoor work?

When a packet is received by the Linux kernel, it is processed by iptables and either sent to userspace, rejected, or modified based on the rules configured.

In particular, each iptables table uses the function ipt_do_table in ip_tables.c to decide whether to accept a given packet. I have modified that to automatically accept any packet with the evil bit set and skip all further processing.

I also attempted to add another table (iptable_evil.c) that would accept all evil packets and hand others off to the standard tables for processing, but I never figured out how to pass the packets to the next table and decided that the ipt_do_table backdoor was enough as a proof of concept.

Why did you do this?

I needed to do and write up a decently large project in computing security for one of my classes, and this seemed like a cool idea. This is probably more work than he was expecting for this but ¯_(ツ)_/¯.


In-Tree Build

The evil table requires modification of kernel headers, so installing it requires running with a kernel produced through the full tree build.

  • Copy the contents of replace-existing to your kernel source tree, overwriting existing files.
  • Copy iptable_evil.c to linux-X.Y.Z/net/ipv4/netfilter
  • (optional) copy ip_tables.c to linux-X.Y.Z/net/ipv4/netfilter
  • Compile the kernel according to your distro’s process (should produce a package)
  • Install the package file
  • Reboot into your new kernel
  • iptables -t filter -L
  • iptables -t evil -L (this will have confused output, but it will load the module)

Out-of-Tree Build

This is significantly easier and faster, but does not support the evil table and marks the kernel as “tainted”. It should be possible to copy the ko files produced by this to another computer with the exact same kernel version, but I haven’t tested it.

  • Run make
  • rmmod iptable_*
  • rmmod ip_tables
  • insmod ip_tables.ko
  • insmod iptable_filter.ko


To test this, you either need to rebuild your entire kernel with this patch or create your own packets using a tool like Scapy. I went with the first option because I was already building the kernel for the evil table.

In the first screenshot, I have blocked all traffic to this VM in iptables, but I am still able to connect over SSH because my packets have the evil bit set, as the second screenshot shows.

  iptable evil 1 ssh while blocked 740353 

AVvXsEgVBUFvbIPbXLP4IG4 eu7ssLKi3culPrHiwFsYH3PtqZygQ1VB9KOKbz5NCaxm3PBKfBhw6XI4etsK36fMsQ4NMCqVCX93Hlcsx 5Bpdhzqqm2AgSt9QpvzrBiBrJJikQFpIMbg4D2OD4tMozWoI07 DhSJaFZnprQoVJB6BUKR8WHOpK55U pokv0=w640 h266

When connecting to the backdoored VM from a VM that does not set the evil bit, the SSH connection will eventually time out.

  iptable evil 3 ssh timed out 741010 iptable evil 4 reserved unset 741624

Packet captures of backdoor and non-backdoor SSH connections are in the docs/ folder in this repo for your perusal.

Kernel Version

  • 5.8.0-48-generic (Ubuntu 20.04)

Further Information and Resources

click here to read full Article

Read More on Pentesting Tools

You may also like...

Leave a Reply

Your email address will not be published. Required fields are marked *