├── .gitattributes
├── README.md
├── ripple20.py
└── .gitignore


/.gitattributes:
--------------------------------------------------------------------------------
1 | # Auto detect text files and perform LF normalization
2 | * text=auto
3 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # ripple20-poc
2 |  Treck Network Stack Discovery Tool by JSOF
3 |  **ICMP_MS_SYNC**: Sending ICMP with type `165 (0xa5)` to the target device results in an answer with ICMP type `166 (0xa6)`.
4 |   - *HIGH RELIABILITY*. This is a unique behavior. However, failure cannot be verified to mean it isn't a Treck device. We have not seen any false positives to date. This can be used as a standalone signature.
5 | 


--------------------------------------------------------------------------------
/ripple20.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/python
 2 | # -*- coding: UTF-8 -*-
 3 | from scapy.all import *
 4 | import sys
 5 | ICMP_MS_SYNC_REQ_TYPE = 0xa5
 6 | ICMP_MS_SYNC_RSP_TYPE = 0xa6
 7 | print("***************************************************")
 8 | print("** Treck Network Stack Discovery Tool by JSOF    **")
 9 | print("** Version: 1.0                                  **")
10 | print("** Release: 06/30/2020                           **")
11 | print("** By: Jiansiting                                **")
12 | print("***************************************************")
13 | print(" ")
14 | if len(sys.argv)<2 :
15 |     print("[*] Lost IP Address!")
16 | else:
17 |     ip=sys.argv[1]
18 |     q = IP(dst=ip)/ICMP()
19 |     ans1, unans1 = sr(q, timeout=1)
20 |     if not ans1:
21 |         print("[!] The target is not alive!")
22 |         exit(0)
23 |     else:
24 |         print("[*] The target is alive!")
25 |     p = IP(dst=ip)/ICMP(type=ICMP_MS_SYNC_REQ_TYPE,code=0)
26 |     ans, unans = sr(p, timeout=1)
27 |     if not ans:
28 |         print("[*] The target is not respond for the active test")         
29 |     for req, resp in ans:
30 |         if ICMP in resp and resp[ICMP].type == ICMP_MS_SYNC_RSP_TYPE:
31 |             print("[!] The target does contain network stack of treck")  
32 |         else:
33 |             print("[*] The target does not contain network stack of treck")  


--------------------------------------------------------------------------------
/.gitignore:
--------------------------------------------------------------------------------
  1 | # Byte-compiled / optimized / DLL files
  2 | __pycache__/
  3 | *.py[cod]
  4 | *$py.class
  5 | 
  6 | # C extensions
  7 | *.so
  8 | 
  9 | # Distribution / packaging
 10 | .Python
 11 | build/
 12 | develop-eggs/
 13 | dist/
 14 | downloads/
 15 | eggs/
 16 | .eggs/
 17 | lib/
 18 | lib64/
 19 | parts/
 20 | sdist/
 21 | var/
 22 | wheels/
 23 | pip-wheel-metadata/
 24 | share/python-wheels/
 25 | *.egg-info/
 26 | .installed.cfg
 27 | *.egg
 28 | MANIFEST
 29 | 
 30 | # PyInstaller
 31 | #  Usually these files are written by a python script from a template
 32 | #  before PyInstaller builds the exe, so as to inject date/other infos into it.
 33 | *.manifest
 34 | *.spec
 35 | 
 36 | # Installer logs
 37 | pip-log.txt
 38 | pip-delete-this-directory.txt
 39 | 
 40 | # Unit test / coverage reports
 41 | htmlcov/
 42 | .tox/
 43 | .nox/
 44 | .coverage
 45 | .coverage.*
 46 | .cache
 47 | nosetests.xml
 48 | coverage.xml
 49 | *.cover
 50 | *.py,cover
 51 | .hypothesis/
 52 | .pytest_cache/
 53 | 
 54 | # Translations
 55 | *.mo
 56 | *.pot
 57 | 
 58 | # Django stuff:
 59 | *.log
 60 | local_settings.py
 61 | db.sqlite3
 62 | db.sqlite3-journal
 63 | 
 64 | # Flask stuff:
 65 | instance/
 66 | .webassets-cache
 67 | 
 68 | # Scrapy stuff:
 69 | .scrapy
 70 | 
 71 | # Sphinx documentation
 72 | docs/_build/
 73 | 
 74 | # PyBuilder
 75 | target/
 76 | 
 77 | # Jupyter Notebook
 78 | .ipynb_checkpoints
 79 | 
 80 | # IPython
 81 | profile_default/
 82 | ipython_config.py
 83 | 
 84 | # pyenv
 85 | .python-version
 86 | 
 87 | # pipenv
 88 | #   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
 89 | #   However, in case of collaboration, if having platform-specific dependencies or dependencies
 90 | #   having no cross-platform support, pipenv may install dependencies that don't work, or not
 91 | #   install all needed dependencies.
 92 | #Pipfile.lock
 93 | 
 94 | # celery beat schedule file
 95 | celerybeat-schedule
 96 | 
 97 | # SageMath parsed files
 98 | *.sage.py
 99 | 
100 | # Environments
101 | .env
102 | .venv
103 | env/
104 | venv/
105 | ENV/
106 | env.bak/
107 | venv.bak/
108 | 
109 | # Spyder project settings
110 | .spyderproject
111 | .spyproject
112 | 
113 | # Rope project settings
114 | .ropeproject
115 | 
116 | # mkdocs documentation
117 | /site
118 | 
119 | # mypy
120 | .mypy_cache/
121 | .dmypy.json
122 | dmypy.json
123 | 
124 | # Pyre type checker
125 | .pyre/
126 | 


--------------------------------------------------------------------------------