1*973a6851Sbluhm#!/usr/local/bin/python3 2*973a6851Sbluhm 3*973a6851Sbluhmprint("ping fragment that overlaps fragment at index boundary and replace it") 4*973a6851Sbluhm 5*973a6851Sbluhm# index boundary 4096 | 6*973a6851Sbluhm# |--------------| 7*973a6851Sbluhm# .... 8*973a6851Sbluhm# |--------------| 9*973a6851Sbluhm# |XXXX-----| 10*973a6851Sbluhm# |--------------| 11*973a6851Sbluhm# |--------------| 12*973a6851Sbluhm 13*973a6851Sbluhm# this should trigger "frag tail overlap %d" and "frag head overlap %d" 14*973a6851Sbluhm 15*973a6851Sbluhmimport os 16*973a6851Sbluhmfrom addr import * 17*973a6851Sbluhmfrom scapy.all import * 18*973a6851Sbluhm 19*973a6851Sbluhmpid=os.getpid() 20*973a6851Sbluhmeid=pid & 0xffff 21*973a6851Sbluhmpayload=b"ABCDEFGHIJKLMNOP" 22*973a6851Sbluhmdummy=b"01234567" 23*973a6851Sbluhmfragsize=1024 24*973a6851Sbluhmboundary=4096 25*973a6851Sbluhmfragnum=int(boundary/fragsize) 26*973a6851Sbluhmpacket=IP(src=LOCAL_ADDR, dst=REMOTE_ADDR)/ \ 27*973a6851Sbluhm ICMP(type='echo-request', id=eid)/ \ 28*973a6851Sbluhm (int((boundary+fragsize)/len(payload)) * payload) 29*973a6851Sbluhmfrag=[] 30*973a6851Sbluhmfid=pid & 0xffff 31*973a6851Sbluhmfor i in range(fragnum-1): 32*973a6851Sbluhm frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, 33*973a6851Sbluhm frag=(i*fragsize)>>3, flags='MF')/ 34*973a6851Sbluhm bytes(packet)[20+i*fragsize:20+(i+1)*fragsize]) 35*973a6851Sbluhmfrag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, 36*973a6851Sbluhm frag=(boundary-8)>>3, flags='MF')/ 37*973a6851Sbluhm (dummy+bytes(packet)[20+boundary:20+boundary+8])) 38*973a6851Sbluhmfrag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, 39*973a6851Sbluhm frag=(boundary-fragsize)>>3, flags='MF')/ 40*973a6851Sbluhm bytes(packet)[20+boundary-fragsize:20+boundary]) 41*973a6851Sbluhmfrag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, 42*973a6851Sbluhm frag=(boundary)>>3)/bytes(packet)[20+boundary:]) 43*973a6851Sbluhmeth=[] 44*973a6851Sbluhmfor f in frag: 45*973a6851Sbluhm eth.append(Ether(src=LOCAL_MAC, dst=REMOTE_MAC)/f) 46*973a6851Sbluhm 47*973a6851Sbluhmif os.fork() == 0: 48*973a6851Sbluhm time.sleep(1) 49*973a6851Sbluhm for e in eth: 50*973a6851Sbluhm sendp(e, iface=LOCAL_IF) 51*973a6851Sbluhm time.sleep(0.001) 52*973a6851Sbluhm os._exit(0) 53*973a6851Sbluhm 54*973a6851Sbluhmans=sniff(iface=LOCAL_IF, timeout=3, filter= 55*973a6851Sbluhm "ip and src "+REMOTE_ADDR+" and dst "+LOCAL_ADDR+" and icmp") 56*973a6851Sbluhmfor a in ans: 57*973a6851Sbluhm if a and a.type == ETH_P_IP and \ 58*973a6851Sbluhm a.payload.proto == 1 and \ 59*973a6851Sbluhm a.payload.frag == 0 and \ 60*973a6851Sbluhm icmptypes[a.payload.payload.type] == 'echo-reply': 61*973a6851Sbluhm id=a.payload.payload.id 62*973a6851Sbluhm print("id=%#x" % (id)) 63*973a6851Sbluhm if id != eid: 64*973a6851Sbluhm print("WRONG ECHO REPLY ID") 65*973a6851Sbluhm exit(2) 66*973a6851Sbluhm exit(0) 67*973a6851Sbluhmprint("NO ECHO REPLY") 68*973a6851Sbluhmexit(1) 69