1*647ac401Sbluhm#!/usr/local/bin/python3 27cd47444Sbluhm 3*647ac401Sbluhmprint("ping fragment head that overlaps the first fragment completely") 47cd47444Sbluhm 57cd47444Sbluhm# |---------| 67cd47444Sbluhm# |XXXX| 77cd47444Sbluhm# |----| 87cd47444Sbluhm 97cd47444Sbluhmimport os 107cd47444Sbluhmfrom addr import * 117cd47444Sbluhmfrom scapy.all import * 127cd47444Sbluhm 137cd47444Sbluhmpid=os.getpid() 147cd47444Sbluhmeid=pid & 0xffff 15*647ac401Sbluhmpayload=b"ABCDEFGHIJKLMNOP" 16*647ac401Sbluhmdummy=b"01234567" 177cd47444Sbluhmpacket=IP(src=LOCAL_ADDR, dst=REMOTE_ADDR)/ \ 187cd47444Sbluhm ICMP(type='echo-request', id=eid)/payload 197cd47444Sbluhmfrag=[] 207cd47444Sbluhmfid=pid & 0xffff 217cd47444Sbluhmfrag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, 22*647ac401Sbluhm flags='MF')/bytes(packet)[20:36]) 237cd47444Sbluhmfrag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, 247cd47444Sbluhm frag=1, flags='MF')/dummy) 257cd47444Sbluhmfrag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, 26*647ac401Sbluhm frag=2)/bytes(packet)[36:44]) 277cd47444Sbluhmeth=[] 287cd47444Sbluhmfor f in frag: 297cd47444Sbluhm eth.append(Ether(src=LOCAL_MAC, dst=REMOTE_MAC)/f) 307cd47444Sbluhm 317cd47444Sbluhmif os.fork() == 0: 327cd47444Sbluhm time.sleep(1) 337cd47444Sbluhm sendp(eth, iface=LOCAL_IF) 347cd47444Sbluhm os._exit(0) 357cd47444Sbluhm 367cd47444Sbluhmans=sniff(iface=LOCAL_IF, timeout=3, filter= 377cd47444Sbluhm "ip and src "+REMOTE_ADDR+" and dst "+LOCAL_ADDR+" and icmp") 387cd47444Sbluhmfor a in ans: 397cd47444Sbluhm if a and a.type == ETH_P_IP and \ 407cd47444Sbluhm a.payload.proto == 1 and \ 417cd47444Sbluhm a.payload.frag == 0 and a.payload.flags == 0 and \ 427cd47444Sbluhm icmptypes[a.payload.payload.type] == 'echo-reply': 437cd47444Sbluhm id=a.payload.payload.id 44*647ac401Sbluhm print("id=%#x" % (id)) 457cd47444Sbluhm if id != eid: 46*647ac401Sbluhm print("WRONG ECHO REPLY ID") 477cd47444Sbluhm exit(2) 487cd47444Sbluhm data=a.payload.payload.payload.load 49*647ac401Sbluhm print("payload=%s" % (data)) 507cd47444Sbluhm if data == payload: 517cd47444Sbluhm exit(0) 52*647ac401Sbluhm print("PAYLOAD!=%s" % (payload)) 537cd47444Sbluhm exit(1) 54*647ac401Sbluhmprint("NO ECHO REPLY") 557cd47444Sbluhmexit(2) 56