The winner of The “Ping me!” Packet Challenge is Johannes Ullrich (@johullrich on Twitter) Here’s Johannes’ solution:
Johannes writes:
I used scapy to craft the response. Here is the scapy command line sequence with explanation:
e=Ether(dst=’00:0c:29:a6:5e:2f’, src=’00:0c:29:48:55:1f’, type=0x0800);
The ethernet header: Just reverse source and destination, but keep the type the same.
i=IP(version=4, ihl=5, tos=0, len=36, id=1234, flags=0, frag=0, ttl=64, proto=1, src=’192.168.200.129′,dst=’192.168.200.128′);
For the IP header:
– – we swap the source/destination, but keep everything else the same. TTL could of course be different but lets just assume that the receiving host also uses a Unix’isch starting TTL of 64. I picked a different IP ID just to make a point that it is not necessarily the same as the inbound one.
The ICMP Header:
ic=ICMP(type=0, code=0, id=1, seq=555);
type and code is ‘0’ for an ICMP echo reply. The ID and sequence number have to be the same as in the request.
The payload is the same as the request (Ping me!).
So the complete packet:
p=e/i/ic/’Ping me!’
and then send it at layer 2: sendp(p) (optionally, we could specify the interface here).
Here is the packet as received by tcpdump using the ‘xx’ option to inspect the full ethernet header:
02:19:27.048612 IP 192.168.200.129 > 192.168.200.128: ICMP echo reply, id 1, seq 555, length 16
0x0000: 000c 29a6 5e2f 000c 2948 551f 0800 4500
0x0010: 0024 04d2 0000 4001 63b4 c0a8 c881 c0a8
0x0020: c880 0000 b974 0001 022b 5069 6e67 206d
0x0030: 6521
Chris continues:
Congrats Johannes! Of course if Johannes enters he’s going to win.
Honorable mention goes out to Jon Wohlberg who used Nping to craft the ICMP echo reply. I’ll post Jon’s solution tomorrow.
