eko2019.exe.c

/* This file was generated by the Hex-Rays decompiler.
   Copyright (c) 2007-2018 Hex-Rays <info@hex-rays.com>

   Detected compiler: Visual C++
*/

#include <windows.h>
#include <defs.h>


//-------------------------------------------------------------------------
// Function declarations

__int64 __stdcall exec_gadget(void *);
__int64 init_wsocx();
__int64 __fastcall create_listening_socket(__int64 a1, u_short a2, SOCKET *a3);
__int64 __fastcall copy_gadget(__int64 gadget); // idb
__int64 __fastcall handle_client(SOCKET a1);
int __cdecl main(int argc, const char **argv, const char **envp);
// int printf(const char *const Format, ...);
// void *__cdecl memset(void *, int Val, size_t Size);
void **sub_140001CF4();
void __fastcall sub_140002C60(void *a1);
void sub_140003FC4();
void __fastcall sub_140003FFC();
PVOID sub_140004034();
void sub_14000448C();
PVOID sub_140005E0C();
void __fastcall sub_140006050(__int64 a1);
void __fastcall sub_140006058(__int64 a1);
void __fastcall sub_140006060(void *a1);
__int64 __fastcall sub_140006204(__int64 a1, __int64 a2, unsigned int a3);
BOOL sub_1400089BC();
// int __stdcall WSAStartup(WORD wVersionRequested, LPWSADATA lpWSAData);
// int __stdcall listen(SOCKET s, int backlog);
// int __stdcall bind(SOCKET s, const struct sockaddr *name, int namelen);
// SOCKET __stdcall socket(int af, int type, int protocol);
// u_short __stdcall htons(u_short hostshort);
// int __stdcall send(SOCKET s, const char *buf, int len, int flags);
// int __stdcall recv(SOCKET s, char *buf, int len, int flags);
// int __stdcall closesocket(SOCKET s);
// SOCKET __stdcall accept(SOCKET s, struct sockaddr *addr, int *addrlen);
// BOOL __stdcall WriteProcessMemory(HANDLE hProcess, LPVOID lpBaseAddress, LPCVOID lpBuffer, SIZE_T nSize, SIZE_T *lpNumberOfBytesWritten);
// HANDLE __stdcall GetCurrentProcess();
// UINT __stdcall WinExec(LPCSTR lpCmdLine, UINT uCmdShow);
// PVOID __stdcall DecodePointer(PVOID Ptr);
// PVOID __stdcall EncodePointer(PVOID Ptr);
// FARPROC __stdcall GetProcAddress(HMODULE hModule, LPCSTR lpProcName);
// HMODULE __stdcall LoadLibraryW(LPCWSTR lpLibFileName);
// BOOL __stdcall CloseHandle(HANDLE hObject);

//-------------------------------------------------------------------------
// Data declarations

_UNKNOWN unk_14000ACA8; // weak
_UNKNOWN unk_14000ACB8; // weak
int g_msg_num = 1; // weak
char Format[] = " [+] Header received: %i bytes\n"; // idb
char aErrorInvalidHe[] = "  [-] Error: Invalid header\n"; // idb
char aErrorInvalidCo[] = "  [-] Error: Invalid cookie\n"; // idb
char aErrorSizeTooBi[] = "  [-] Error: Size too big\n"; // idb
char aWaitingUserMes[] = " [+] Waiting user message\n"; // idb
char aMessageReceive[] = " [+] Message received: %i bytes\n"; // idb
char aErrorInvalidSi[] = "  [-] Error: Invalid size alignment\n"; // idb
char aRemoteMessageI[] = " [+] Remote message (%i): '%s'\n"; // idb
char aEkoparty2019Bf[] = "[+] Ekoparty 2019 - BFS challenge\n"; // idb
char aSocketSupportV[] = "[-] Socket support version error\n"; // idb
char a0000[8] = "0.0.0.0"; // weak
char a0000_0[8] = "0.0.0.0"; // weak
char aItWasNotPossib[] = "[-] It was not possible to bind: %s:%i\n"; // idb
char aServerListenin[] = "[+] Server listening\n"; // idb
char aWaitingForClie[] = "[+] Waiting for client connections\n"; // idb
char aClientSocketEr[] = " [-] Client socket error\n"; // idb
char aNewConnectionA[] = " [+] New connection accepted\n"; // idb
char aClosingConnect[] = " [+] Closing connection\n"; // idb
void *off_14000C260 = &unk_14000EF80; // weak
HANDLE hObject = (HANDLE)0xFFFFFFFFFFFFFFFEi64; // idb
__int64 g_size_msg = 0i64; // weak
PVOID qword_14000DA98; // idb
__int64 qword_14000E4B8; // weak
__int64 qword_14000E4D0; // weak
__int64 qword_14000E4D8; // weak
PVOID qword_14000E4E0; // idb
PVOID qword_14000E4E8; // idb
PVOID qword_14000E4F0; // idb
PVOID qword_14000E4F8; // idb
PVOID qword_14000E500; // idb
PVOID qword_14000E508; // idb
_QWORD g_gadget_array[256]; // idb
int dword_14000ED20; // weak


//----- (0000000140001000) ----------------------------------------------------
__int64 __stdcall exec_gadget(void *a1)
{
  ;
}

//----- (0000000140001020) ----------------------------------------------------
__int64 init_wsocx()
{
  struct WSAData WSAData; // [rsp+30h] [rbp-1B8h]
  unsigned int v2; // [rsp+1D0h] [rbp-18h]
  unsigned __int16 v3; // [rsp+1D4h] [rbp-14h]

  v2 = 0;
  v3 = 514;
  if ( !WSAStartup(0x202u, &WSAData) && WSAData.wVersion == v3 )
    v2 = 1;
  return v2;
}

//----- (00000001400010B0) ----------------------------------------------------
__int64 __fastcall create_listening_socket(__int64 a1, u_short a2, SOCKET *a3)
{
  SOCKET s; // [rsp+20h] [rbp-38h]
  unsigned int v5; // [rsp+28h] [rbp-30h]
  struct sockaddr name; // [rsp+38h] [rbp-20h]
  SOCKET *v7; // [rsp+70h] [rbp+18h]

  v7 = a3;
  v5 = 0;
  name.sa_family = 2;
  *(_DWORD *)&name.sa_data[2] = 0;
  *(_WORD *)name.sa_data = htons(a2);
  s = socket(2, 1, 0);
  if ( s != -1i64 && !bind(s, &name, 16) )
  {
    listen(s, 0);
    *v7 = s;
    v5 = 1;
  }
  return v5;
}

//----- (0000000140001170) ----------------------------------------------------
__int64 __fastcall copy_gadget(__int64 gadget)
{
  unsigned int i; // [rsp+8h] [rbp-20h]
  char dst[8]; // [rsp+10h] [rbp-18h]
  __int64 *p_gadget; // [rsp+18h] [rbp-10h]

  p_gadget = &gadget;
  for ( i = 0; i < 8ui64; ++i )
    dst[i] = *((_BYTE *)p_gadget + 7i64 - i);
  return *(_QWORD *)dst;
}

//----- (00000001400011E0) ----------------------------------------------------
__int64 __fastcall handle_client(SOCKET a1)
{
  __int64 result; // rax
  HANDLE v2; // rax
  __int64 response; // [rsp+30h] [rbp-268h]
  SIZE_T NumberOfBytesWritten; // [rsp+38h] [rbp-260h]
  unsigned int num_rcvd; // [rsp+40h] [rbp-258h]
  char gadget_buf[8]; // [rsp+48h] [rbp-250h]
  char buf[512]; // [rsp+60h] [rbp-238h]
  int gadget_idx; // [rsp+260h] [rbp-38h]
  __int64 *p; // [rsp+268h] [rbp-30h]
  struct pkthdr header; // [rsp+270h] [rbp-28h]
  SOCKET s; // [rsp+2A0h] [rbp+8h]

  s = a1;
  response = -1i64;
  p = &g_size_msg;
  gadget_idx = 62;
  // size of buf is 512 (0x200) bytes
  memset(buf, 0, 0x200ui64);
  num_rcvd = recv(s, (char *)&header, 16, 0);
  printf(Format, num_rcvd);
  if ( num_rcvd == 16i64 )
  {
    if ( header.magic == '9102okE' )
    {
      if ( header.size_payload <= 512 )
      {
        printf(aWaitingUserMes);
        num_rcvd = recv(s, buf, LOWORD(header.size_payload), 0);
        printf(aMessageReceive, num_rcvd);
        if ( (int)num_rcvd % 8 )
        {
          printf(aErrorInvalidSi);
          result = 0i64;
        }
        else
        {
          g_size_msg = printf(aRemoteMessageI, (unsigned int)g_msg_num, buf);
          ++g_msg_num;
          *(_QWORD *)gadget_buf = copy_gadget(g_gadget_array[gadget_idx % 256]);
          v2 = GetCurrentProcess();
          WriteProcessMemory(v2, exec_gadget, gadget_buf, 8ui64, &NumberOfBytesWritten);
          response = exec_gadget(p);
          send(s, (const char *)&response, 8, 0);
          result = 1i64;
        }
      }
      else
      {
        printf(aErrorSizeTooBi);
        result = 0i64;
      }
    }
    else
    {
      printf(aErrorInvalidCo);
      result = 0i64;
    }
  }
  else
  {
    printf(aErrorInvalidHe);
    result = 0i64;
  }
  return result;
}
// 14000C000: using guessed type int g_msg_num;
// 14000D4E0: using guessed type __int64 g_size_msg;

//----- (0000000140001410) ----------------------------------------------------
int __cdecl main(int argc, const char **argv, const char **envp)
{
  SOCKET s; // [rsp+20h] [rbp-58h]
  unsigned int i; // [rsp+28h] [rbp-50h]
  int addrlen; // [rsp+2Ch] [rbp-4Ch]
  struct sockaddr addr; // [rsp+38h] [rbp-40h]
  SOCKET v8; // [rsp+58h] [rbp-20h]

  if ( !argc )
    WinExec(*argv, 1u);

  for ( i = 0; i < 0x100; ++i )
    g_gadget_array[i] = ((unsigned __int64)i << 56) + 0x488B01C3C3C3C3i64;

  printf(aEkoparty2019Bf);
  if ( (unsigned int)init_wsocx() )
  {
    // bind listening socket on TCP port 54321 on all interfaces
    if ( (unsigned int)create_listening_socket((__int64)a0000, 54321u, &s) )
    {
      printf(aServerListenin);
      while ( 1 )
      {
        printf(aWaitingForClie);
        addrlen = 16;
        // accept incoming client connection
        v8 = accept(s, &addr, &addrlen);
        if ( v8 == -1i64 )
        {
          printf(aClientSocketEr);
        }
        else
        {
          printf(aNewConnectionA);
          // handle client
          handle_client(v8);
          printf(aClosingConnect);
          closesocket(v8);
        }
      }
    }
    printf(aItWasNotPossib, a0000_0, 54321i64);
  }
  else
  {
    printf(aSocketSupportV);
  }
  return 0;
}

//----- (0000000140001CF4) ----------------------------------------------------
void **sub_140001CF4()
{
  return &off_14000C260;
}
// 14000C260: using guessed type void *off_14000C260;

//----- (0000000140002C60) ----------------------------------------------------
void __fastcall sub_140002C60(void *a1)
{
  qword_14000DA98 = a1;
}

//----- (0000000140003FC4) ----------------------------------------------------
void sub_140003FC4()
{
  void (**i)(void); // rbx

  for ( i = (void (**)(void))&unk_14000ACA8; i < (void (**)(void))&unk_14000ACA8; ++i )
  {
    if ( *i )
      (*i)();
  }
}

//----- (0000000140003FFC) ----------------------------------------------------
void __fastcall sub_140003FFC()
{
  void (**i)(void); // rbx

  for ( i = (void (**)(void))&unk_14000ACB8; i < (void (**)(void))&unk_14000ACB8; ++i )
  {
    if ( *i )
      (*i)();
  }
}

//----- (0000000140004034) ----------------------------------------------------
PVOID sub_140004034()
{
  return EncodePointer(0i64);
}

//----- (000000014000448C) ----------------------------------------------------
void sub_14000448C()
{
  dword_14000ED20 = 0;
}
// 14000ED20: using guessed type int dword_14000ED20;

//----- (0000000140005E0C) ----------------------------------------------------
PVOID sub_140005E0C()
{
  return DecodePointer((PVOID)qword_14000E4B8);
}
// 14000E4B8: using guessed type __int64 qword_14000E4B8;

//----- (0000000140006050) ----------------------------------------------------
void __fastcall sub_140006050(__int64 a1)
{
  qword_14000E4D0 = a1;
}
// 14000E4D0: using guessed type __int64 qword_14000E4D0;

//----- (0000000140006058) ----------------------------------------------------
void __fastcall sub_140006058(__int64 a1)
{
  qword_14000E4D8 = a1;
}
// 14000E4D8: using guessed type __int64 qword_14000E4D8;

//----- (0000000140006060) ----------------------------------------------------
void __fastcall sub_140006060(void *a1)
{
  qword_14000E4E0 = a1;
}

//----- (0000000140006204) ----------------------------------------------------
__int64 __fastcall sub_140006204(__int64 a1, __int64 a2, unsigned int a3)
{
  unsigned int v3; // ebp
  __int64 v4; // r14
  __int64 v5; // r13
  __int64 v6; // rbx
  PVOID v7; // rdi
  HMODULE v8; // rax
  HMODULE v9; // rsi
  FARPROC v10; // rax
  FARPROC v11; // rax
  FARPROC v12; // rax
  FARPROC v13; // rax
  PVOID v14; // r11
  FARPROC v15; // rax
  PVOID v16; // rax
  __int64 (*v17)(void); // rsi
  unsigned int (__fastcall *v18)(__int64, __int64, char *); // rax
  unsigned int (__fastcall *v19)(__int64, __int64, char *); // r12
  __int64 v20; // rax
  __int64 (*v21)(void); // rax
  __int64 (__fastcall *v22)(__int64); // rax
  __int64 (__fastcall *v23)(__int64, __int64, __int64, _QWORD); // rax
  char v25; // [rsp+38h] [rbp-50h]
  char v26; // [rsp+40h] [rbp-48h]

  v3 = a3;
  v4 = a2;
  v5 = a1;
  v6 = 0i64;
  v7 = sub_140004034();
  if ( qword_14000E4E8 )
  {
    v16 = qword_14000E500;
    goto LABEL_8;
  }
  v8 = LoadLibraryW(L"USER32.DLL");
  v9 = v8;
  if ( !v8 )
    return 0i64;
  v10 = GetProcAddress(v8, "MessageBoxW");
  if ( !v10 )
    return 0i64;
  qword_14000E4E8 = EncodePointer(v10);
  v11 = GetProcAddress(v9, "GetActiveWindow");
  qword_14000E4F0 = EncodePointer(v11);
  v12 = GetProcAddress(v9, "GetLastActivePopup");
  qword_14000E4F8 = EncodePointer(v12);
  v13 = GetProcAddress(v9, "GetUserObjectInformationW");
  v14 = EncodePointer(v13);
  qword_14000E508 = v14;
  if ( v14 )
  {
    v15 = GetProcAddress(v9, "GetProcessWindowStation");
    v16 = EncodePointer(v15);
    qword_14000E500 = v16;
LABEL_8:
    v14 = qword_14000E508;
    goto LABEL_9;
  }
  v16 = qword_14000E500;
LABEL_9:
  if ( v16 == v7
    || v14 == v7
    || (v17 = (__int64 (*)(void))DecodePointer(v16),
        v18 = (unsigned int (__fastcall *)(__int64, __int64, char *))DecodePointer(qword_14000E508),
        v19 = v18,
        !v17)
    || !v18
    || (v20 = v17()) != 0 && v19(v20, 1i64, &v25) && v26 & 1 )
  {
    if ( qword_14000E4F0 != v7 )
    {
      v21 = (__int64 (*)(void))DecodePointer(qword_14000E4F0);
      if ( v21 )
      {
        v6 = v21();
        if ( v6 )
        {
          if ( qword_14000E4F8 != v7 )
          {
            v22 = (__int64 (__fastcall *)(__int64))DecodePointer(qword_14000E4F8);
            if ( v22 )
              v6 = v22(v6);
          }
        }
      }
    }
  }
  else
  {
    v3 |= 0x200000u;
  }
  v23 = (__int64 (__fastcall *)(__int64, __int64, __int64, _QWORD))DecodePointer(qword_14000E4E8);
  if ( v23 )
    return v23(v6, v5, v4, v3);
  return 0i64;
}

//----- (00000001400089BC) ----------------------------------------------------
BOOL sub_1400089BC()
{
  BOOL result; // eax

  if ( hObject != (HANDLE)-1i64 && hObject != (HANDLE)-2i64 )
    result = CloseHandle(hObject);
  return result;
}

// nfuncs=188 queued=18 decompiled=18 lumina nreq=0 worse=0 better=0
// ALL OK, 18 function(s) have been successfully decompiled