How to send raw data in tls in scapy? - security

Question

There were packets captured by Wireshark sent by a fuzzing tool, and I'd like to craft to resend the packets in tls by scapy.
Here is the malformed packet captured. The pattern is \x18\x03\x01\x00\x01\x7f.
The structure of the packet disassembled by scapy is as follows:
>>> rdpcap("659726.pcap")[146].show()
###[ Ethernet ]###
dst= aa:aa:aa:aa:aa:aa
src= 00:50:56:bb:64:01
type= 0x800
###[ IP ]###
version= 4
ihl= 5
tos= 0x0
len= 46
id= 4211
flags= DF
frag= 0
ttl= 128
proto= tcp
chksum= 0x0
src= 192.168.40.214
dst= 192.168.40.32
\options\
###[ TCP ]###
sport= 61385
dport= https
seq= 351671141
ack= 2538369473
dataofs= 5
reserved= 0
flags= PA
window= 508
chksum= 0xd267
urgptr= 0
options= []
###[ Raw ]###
load= '\x18\x03\x01\x00\x01\x7f'
The following script, which I modified from /examples/full_rsa_connection_with_application_data.py is to resend the packets. It contains 2 steps: SSL Handshake and a malformed packet.
#!/usr/bin/env python
# -*- coding: utf-8 -*-
from __future__ import with_statement
from __future__ import print_function
from scapy.all import *
try:
# This import works from the project directory
from scapy_ssl_tls.ssl_tls import *
except ImportError:
# If you installed this package via pip, you just need to execute this
from scapy.layers.ssl_tls import *
tls_version = TLSVersion.TLS_1_0
ciphers = [TLSCipherSuite.ECDHE_RSA_WITH_AES_128_GCM_SHA256]
# ciphers = [TLSCipherSuite.ECDHE_RSA_WITH_AES_256_CBC_SHA384]
# ciphers = [TLSCipherSuite.RSA_WITH_AES_128_CBC_SHA]
ciphers = [TLSCipherSuite.RSA_WITH_RC4_128_SHA]
# ciphers = [TLSCipherSuite.DHE_RSA_WITH_AES_128_CBC_SHA]
# ciphers = [TLSCipherSuite.DHE_DSS_WITH_AES_128_CBC_SHA]
extensions = [TLSExtension() / TLSExtECPointsFormat(),
TLSExtension() / TLSExtSupportedGroups()]
def tls_client(ip):
with TLSSocket(client=True) as tls_socket:
try:
tls_socket.connect(ip)
print("Connected to server: %s" % (ip,))
except socket.timeout:
print("Failed to open connection to server: %s" % (ip,), file=sys.stderr)
else:
try:
server_hello, server_kex = tls_socket.do_handshake(tls_version, ciphers, extensions)
server_hello.show()
malformedPacket = Raw('\x18\x03\x01\x00\x01\x7f') #or malformedPacket = IP(dst="192.168.40.32")/TCP(dport=443)/raw('\x18\x03\x01\x00\x01\x7f')
respMalformedPacket = tls_socket.do_round_trip(malformedPacket)
print("response from malformed packet: ==========================================")
respMalformedPacket.show()
print("end of response from malformed packet: ==========================================")
except TLSProtocolError as tpe:
print("Got TLS error: %s" % tpe, file=sys.stderr)
tpe.response.show()
else:
resp = tls_socket.do_round_trip(TLSPlaintext(data="GET / HTTP/1.1\r\nHOST: localhost\r\n\r\n"))
print("Got response from server")
resp.show()
finally:
print(tls_socket.tls_ctx)
if __name__ == "__main__":
if len(sys.argv) > 2:
server = (sys.argv[1], int(sys.argv[2]))
else:
server = ("127.0.0.1", 8443)
tls_client(server)
I just want to send the pattern'\x18\x03\x01\x00\x01\x7f' to the target after SSL Handshake. SSL Handshake is done by tls_socket.do_handshake(). Then I want to send the malformed packet I crafted by adding tls_socket.do_round_trip(malformedPacket) after ChangeCipherSpec as the original packet captured. However, it failed to send successfully, and here is the result. I have no idea of how to send the raw data in tls correctly. I need some suggestion. Thanks.