Fix LCP magic number

xfangfang · May 26, 2024 · e085bb5 · e085bb5
1 parent 23a9e35
commit e085bb5
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/src/exploit.cpp b/src/exploit.cpp
@@ -781,7 +781,7 @@ int Exploit::stage1() {
         auto &&echoReply = PacketBuilder::lcpEchoReply(etherLayer->getDestMac(), etherLayer->getSourceMac(),
                                                        pppLayer->getPPPoEHeader()->sessionId,
                                                        pppLayer->getLayerPayload()[1], // id
-                                                       *(uint32_t * ) & pppLayer->getLayerPayload()[4]); // magic number
+                                                       htole32(*(uint32_t * ) & pppLayer->getLayerPayload()[4])); // magic number
         device->sendPacket(&echoReply);
     }, nullptr);
 

diff --git a/tests/output.cpp b/tests/output.cpp
@@ -72,7 +72,9 @@ int main() {
     std::cout << "BAD LCP" << std::endl;
     buildMaliciousLcp(nullptr, 0);
     std::cout << "LCP echo" << std::endl;
-    buildLcpEchoReply(nullptr, 0, "12:23:34:45:56:67", "a0:a1:a2:a3:a4:a5", 123, 2, 345);
+    uint8_t magic_number[] = {0x12, 0x34, 0x56, 0x78};
+    buildLcpEchoReply(nullptr, 0, "12:23:34:45:56:67", "a0:a1:a2:a3:a4:a5", 123, 2,
+                      htole32(*(uint32_t *) &magic_number));
     std::cout << "LCP term" << std::endl;
     buildLcpTerminate(nullptr, 0);