//?for?license?see?license.txt

//?Modified?12/27/2004?by?Chris?Wysopal??
//?fixed?vulnerability?found?by?hat-squad

//?portions?Copyright?（C）?1994?Nathaniel?W.?Mishkin
//?code?taken?from?rlogind.exe
?
#include?
#include?
#include?se.h>

#ifdef?GAPING_SECURITY_HOLE


#define?BUFFER_SIZE?200

extern?char?*?pr00gie;
void?holler（char?*?str?char?*?p1?char?*?p2?char?*?p3?char?*?p4?char?*?p5?char?*?p6）;
char?smbuff[20];
//
//?Structure?used?to?describe?each?session
//
typedef?struct?{

????//
????//?These?fields?are?filled?in?at?session?creation?time
????//
????HANDLE??ReadPipeHandle;?????????//?Handle?to?shell?stdout?pipe
????HANDLE??WritePipeHandle;????????//?Handle?to?shell?stdin?pipe
????HANDLE??ProcessHandle;??????????//?Handle?to?shell?process

????//
????//
????//?These?fields?are?filled?in?at?session?connect?time?and?are?only
????//?valid?when?the?session?is?connected
????//
????SOCKET??ClientSocket;
????HANDLE??ReadShellThreadHandle;??//?Handle?to?session?shell-read?thread
????HANDLE??WriteShellThreadHandle;?//?Handle?to?session?shell-read?thread

}?SESSION_DATA?*PSESSION_DATA;


//
//?Private?prototypes
//

static?HANDLE
StartShell（
????HANDLE?StdinPipeHandle
????HANDLE?StdoutPipeHandle
????）;

static?VOID
SessionReadShellThreadFn（
????LPVOID?Parameter
????）;

static?VOID
SessionWriteShellThreadFn（
????LPVOID?Parameter
????）;



//?**********************************************************************
//
//?CreateSession
//
//?Creates?a?new?session.?Involves?creating?the?shell?process?and?establishing
//?pipes?for?communication?with?it.
//
//?Returns?a?handle?to?the?session?or?NULL?on?failure.
//

static?PSESSION_DATA
CreateSession（
????VOID
????）
{
????PSESSION_DATA?Session?=?NULL;
????BOOL?Result;
????SECURITY_ATTRIBUTES?SecurityAttributes;
????HANDLE?ShellStdinPipe?=?NULL;
????HANDLE?ShellStdoutPipe?=?NULL;

????//
????//?Allocate?space?for?the?session?data
????//
????Session?=?（PSESSION_DATA）?malloc（sizeof（SESSION_DATA））;
????if?（Session?==?NULL）?{
????????return（NULL）;
????}

????//
????//?Reset?fields?in?preparation?for?failure
????//
????Session->ReadPipeHandle??=?NULL;
????Session->WritePipeHandle?=?NULL;


????//
????//?Create?the?I/O?pipes?for?the?shell
????//
????SecurityAttributes.nLength?=?sizeof（SecurityAttributes）;
????SecurityAttributes.lpSecurityDescriptor?=?NULL;?//?Use?default?ACL
????SecurityAttributes.bInheritHandle?=?TRUE;?//?Shell?will?inherit?handles

????Result?=?CreatePipe（&Session->ReadPipeHandle?&ShellStdoutPipe
??????????????????????????&SecurityAttributes?0）;
????if?（!Result）?{
????????holler（“Failed?to?create?shell?stdout?pipe?error?=?%s“
			itoa（GetLastError（）?smbuff?10）?NULL?NULL?NULL?NULL?NULL）;
????????goto?Failure;
????}
????Result?=?CreatePipe（&ShellStdinPipe?&Session->WritePipeHandle
????????????????????????&SecurityAttributes?0）;

????if?（!Result）?{
????????holler（“Failed?to?create?shell?stdin?pipe?error?=?%s“??
			it

?屬性????????????大小?????日期????時間???名稱
-----------?---------??----------?-----??----
?????文件???????12166??2004-12-28?11:23??netcat-1.11\doexec.c
?????文件????????7283??1996-07-09?16:01??netcat-1.11\generic.h
?????文件???????22784??1996-11-06?22:40??netcat-1.11\getopt.c
?????文件????????4765??1994-11-03?19:07??netcat-1.11\getopt.h
?????文件???????61780??1998-02-06?15:50??netcat-1.11\hobbit.txt
?????文件???????18009??2004-12-27?17:37??netcat-1.11\license.txt
?????文件?????????301??2010-12-26?13:31??netcat-1.11\Makefile
?????文件???????36528??2010-12-26?13:26??netcat-1.11\nc.exe
?????文件???????43696??2010-12-26?13:31??netcat-1.11\nc64.exe
?????文件???????69662??2004-12-29?13:07??netcat-1.11\netcat.c
?????文件????????6833??2004-12-27?17:44??netcat-1.11\readme.txt