//?portions?Copyright?（C）?1994?Nathaniel?W.?Mishkin
//?code?taken?from?rlogind.exe
?
#include?
#include?
#include?se.h>

#ifdef?GAPING_SECURITY_HOLE


#define?BUFFER_SIZE?200

extern?char?*?pr00gie;
void?holler（char?*?str?char?*?p1?char?*?p2?char?*?p3?char?*?p4?char?*?p5?char?*?p6）;
char?smbuff[20];
//
//?Structure?used?to?describe?each?session
//
typedef?struct?{

????//
????//?These?fields?are?filled?in?at?session?creation?time
????//
????HANDLE??ReadPipeHandle;?????????//?Handle?to?shell?stdout?pipe
????HANDLE??WritePipeHandle;????????//?Handle?to?shell?stdin?pipe
????HANDLE??ProcessHandle;??????????//?Handle?to?shell?process

????//
????//
????//?These?fields?are?filled?in?at?session?connect?time?and?are?only
????//?valid?when?the?session?is?connected
????//
????SOCKET??ClientSocket;
????HANDLE??ReadShellThreadHandle;??//?Handle?to?session?shell-read?thread
????HANDLE??WriteShellThreadHandle;?//?Handle?to?session?shell-read?thread

}?SESSION_DATA?*PSESSION_DATA;


//
//?Private?prototypes
//

static?HANDLE
StartShell（
????HANDLE?StdinPipeHandle
????HANDLE?StdoutPipeHandle
????）;

static?VOID
SessionReadShellThreadFn（
????LPVOID?Parameter
????）;

static?VOID
SessionWriteShellThreadFn（
????LPVOID?Parameter
????）;



//?**********************************************************************
//
//?CreateSession
//
//?Creates?a?new?session.?Involves?creating?the?shell?process?and?establishing
//?pipes?for?communication?with?it.
//
//?Returns?a?handle?to?the?session?or?NULL?on?failure.
//

static?PSESSION_DATA
CreateSession（
????VOID
????）
{
????PSESSION_DATA?Session?=?NULL;
????BOOL?Result;
????SECURITY_ATTRIBUTES?SecurityAttributes;
????HANDLE?ShellStdinPipe?=?NULL;
????HANDLE?ShellStdoutPipe?=?NULL;

????//
????//?Allocate?space?for?the?session?data
????//
????Session?=?（PSESSION_DATA）?malloc（sizeof（SESSION_DATA））;
????if?（Session?==?NULL）?{
????????return（NULL）;
????}

????//
????//?Reset?fields?in?preparation?for?failure
????//
????Session->ReadPipeHandle??=?NULL;
????Session->WritePipeHandle?=?NULL;


????//
????//?Create?the?I/O?pipes?for?the?shell
????//
????SecurityAttributes.nLength?=?sizeof（SecurityAttributes）;
????SecurityAttributes.lpSecurityDescriptor?=?NULL;?//?Use?default?ACL
????SecurityAttributes.bInheritHandle?=?TRUE;?//?Shell?will?inherit?handles

????Result?=?CreatePipe（&Session->ReadPipeHandle?&ShellStdoutPipe
??????????????????????????&SecurityAttributes?0）;
????if?（!Result）?{
????????holler（“Failed?to?create?shell?stdout?pipe?error?=?%s“
			itoa（GetLastError（）?smbuff?10）?NULL?NULL?NULL?NULL?NULL）;
????????goto?Failure;
????}
????Result?=?CreatePipe（&ShellStdinPipe?&Session->WritePipeHandle
????????????????????????&SecurityAttributes?0）;

????if?（!Result）?{
????????holler（“Failed?to?create?shell?stdin?pipe?error?=?%s“??
			itoa（GetLastError（）?smbuff?10）?NULL?NULL?NULL?NULL?NULL）;
????????goto?Failure;
????}
????//
????//?Start?the?shell
????//
????Sessi