Skip to content

Commit

Permalink
catch for new thread error
Browse files Browse the repository at this point in the history
  • Loading branch information
xfangfang committed May 27, 2024
1 parent ae5c324 commit 0a782fc
Showing 1 changed file with 25 additions and 18 deletions.
43 changes: 25 additions & 18 deletions src/exploit.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -771,19 +771,24 @@ int Exploit::stage1() {
* and the PS4 unilaterally ends the PPPoE session.
* To avoid this situation, respond to the PPPoE ECHO_REQ here
*/
dev->startCapture([](pcpp::RawPacket *packet, pcpp::PcapLiveDevice *device, void *cookie) {
pcpp::Packet parsedPacket(packet, pcpp::PPPoESession);
auto *pppLayer = PacketBuilder::getPPPoESessionLayer(parsedPacket, PCPP_PPP_LCP);
if (!pppLayer) return;
if (pppLayer->getLayerPayload()[0] != ECHO_REQ) return;
auto *etherLayer = parsedPacket.getLayerOfType<pcpp::EthLayer>();
if (!etherLayer) return;
auto &&echoReply = PacketBuilder::lcpEchoReply(etherLayer->getDestMac(), etherLayer->getSourceMac(),
pppLayer->getPPPoEHeader()->sessionId,
pppLayer->getLayerPayload()[1], // id
htole32(*(uint32_t * ) & pppLayer->getLayerPayload()[4])); // magic number
device->sendPacket(&echoReply);
}, nullptr);
try {
dev->startCapture([](pcpp::RawPacket *packet, pcpp::PcapLiveDevice *device, void *cookie) {
pcpp::Packet parsedPacket(packet, pcpp::PPPoESession);
auto *pppLayer = PacketBuilder::getPPPoESessionLayer(parsedPacket, PCPP_PPP_LCP);
if (!pppLayer) return;
if (pppLayer->getLayerPayload()[0] != ECHO_REQ) return;
auto *etherLayer = parsedPacket.getLayerOfType<pcpp::EthLayer>();
if (!etherLayer) return;
auto &&echoReply = PacketBuilder::lcpEchoReply(etherLayer->getDestMac(), etherLayer->getSourceMac(),
pppLayer->getPPPoEHeader()->sessionId,
pppLayer->getLayerPayload()[1], // id
htole32(*(uint32_t * ) &
pppLayer->getLayerPayload()[4])); // magic number
device->sendPacket(&echoReply);
}, nullptr);
} catch (const std::system_error &e) {
std::cout << "Cannot create new thread" << e.what() << std::endl;
}

/**
* Send invalid packet to trigger a printf in the kernel. For some
Expand All @@ -805,7 +810,7 @@ int Exploit::stage1() {
TIME_END_PERIOD();
}

dev->stopCapture();
if (dev->captureActive()) dev->stopCapture();
std::cout << "\r[+] Pinning to CPU 0...done" << std::endl;

// LCP fails sometimes without the wait
Expand Down Expand Up @@ -1026,10 +1031,10 @@ int Exploit::stage4() {

// Calculate checksum
std::vector<uint8_t> temp(udpLayer.getHeaderLen());
(*(uint16_t *) &(temp)[0]) = udpHeader->portSrc;
(*(uint16_t *) &(temp)[2]) = udpHeader->portDst;
(*(uint16_t *) &(temp)[4]) = udpHeader->length;
(*(uint16_t *) &(temp)[6]) = 0;
(*(uint16_t * ) & (temp)[0]) = udpHeader->portSrc;
(*(uint16_t * ) & (temp)[2]) = udpHeader->portDst;
(*(uint16_t * ) & (temp)[4]) = udpHeader->length;
(*(uint16_t * ) & (temp)[6]) = 0;
temp.insert(temp.end(), this->stage2_bin.begin(), this->stage2_bin.end());
uint16_t checksumRes = pcpp::computePseudoHdrChecksum(temp.data(),
temp.size(),
Expand Down Expand Up @@ -1108,6 +1113,7 @@ struct Tunnel<M, N> {
friend T &stopThread(U &u) {
return u.*M;
}

friend Q &pcapHandle(V &u) {
return u.*N;
}
Expand All @@ -1117,6 +1123,7 @@ template
struct Tunnel<&pcpp::PcapLiveDevice::m_StopThread, &pcpp::IPcapDevice::m_PcapDescriptor>;

std::atomic<bool> &stopThread(pcpp::PcapLiveDevice &);

pcap_t *&pcapHandle(pcpp::IPcapDevice &);

void Exploit::stop() {
Expand Down

0 comments on commit 0a782fc

Please sign in to comment.