-
Notifications
You must be signed in to change notification settings - Fork 188
Open
Description
So, i don't know if this is just me being stupid or if there is a bug in Scapy, But whenever i pass a integer to ACK3/4 and then send it in ACKP3/4, it either:
-
Sends a integer of 2
-
Sends a big random number that i presume is generated by the IP stack.
Here is the code in Question:
ACKREPLY2=sr1(SYNA/ACK2)
list1 = str(ACKREPLY2.load).split("'")
str1 = list1[1]
str2 = str1.replace('\r\n', '') # Str2 is filtered output. For the **user.**
print("ACK to make sure the server knows we received the data!")
plsize3 = len(ACKREPLY2.load)
print("Payload size: " + str(plsize3))
ACK3=TCP(sport=randomport, dport=targetport, flags='A', seq=ACKREPLY2.ack, ack=plsize3 + 1)
ACKP3=send(SYNA/ACK3)
print("Here is our response from server: " + str2)
print("Command Shell coming soon! For now, lets terminate the connection!")
ACK4=TCP(sport=randomport, dport=targetport, flags='FA', seq=ACKREPLY2.ack, ack=plsize3 +1 )
ACKP4=send(SYNA/ACK4)
ACK5=TCP(sport=randomport, dport=targetport, flags='A', seq=ACKP4.ack, ack=ACKP4.seq + 1)
ACKP5=send(SYNA/ACK5)
Where:
SYNA = Contain IP elements "src" - which points to my ip - and "dst" - which points to my server
ACKREPLY2 = Sends the ACK to open a connection. This sends back a SMTP based payload.
I honestly think the kernel/IP stack is intercepting these packets and malforming them because when i read the packets manually (the packets that i built) in the scapy3 program or script, the ACK and SEQ numbers are correct. Care to explain whats happening?
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels