//-JPGScan:
//-Acts as a proxy server to scan for the JPEG Image Exploit that allows attackers to use a buffer overflow that runs a backdoor on the system embedded in a JPG Image.
//-Will Stop processing of image and replace data with NULL.
//-usage: jpgscan [ip] [port]
//-ghost[iLs]



//-Headers:
#include <stdio.h>
#include <string.h>
#include <winsock2.h>
#include <malloc.h>



//-Macros:



//-Prototypes:
void HTTPScan(char *ip, char *port);
char *parseHostname(char *data);



//-Entry:
int main(int argc, char ** argv)
{


	//-Data:
	char *ServerIp;
	char *ServerPort;
	int WSAStatus;
	WORD WSAVersionRequest = WINSOCK_VERSION;
	WSADATA wsaData;

	
	//-Get IP and PORT from CMDLINE:
	printf("---JPGSCAN---\r\n");
	if(argv[1] != NULL && argv[2] != NULL)
	{
 ServerIp = argv[1];
 printf("Server: %s\r\n", ServerIp);
 ServerPort = argv[2];
 printf("Port: %s\r\n", ServerPort);

	}
	//-Error: Show them how it works:
	else {printf("Usage: jpgscan [server ip] [server port] \r\n"); return -1;}

	

	//-Init Winsock:
	WSAStatus = WSAStartup(WSAVersionRequest, &wsaData);

	//-Winsock DLL not found or other error:
	if(WSAStatus)
	{
 printf("Error: WSAStartup(), cannot load Winsock DLL: Code: %d\r\n", WSAStatus);
 WSACleanup();
 return -1;
	}



	//-Check Version:
	if(wsaData.wVersion != WSAVersionRequest)
	{
 printf("Non compatible Winsock found\r\n");
 WSACleanup();
 return -1;
	}


	//-Start Main Loop:
	printf("Starting Scanner\r\n");
	HTTPScan(ServerIp, ServerPort);



	return 0;
}





//-Declarations:

//-Lets try this with a listen, local, remote socket vs array of sockets and events:
void HTTPScan(char *ip, char *port)
{
	#define LISTEN 0
	#define LOCAL 1
	#define REMOTE 2
	SOCKET Listen, Local, Remote;
	WSAEVENT wEvents[3]; 
	WSAEVENT newEvent;
	WSANETWORKEVENTS netEvent;
	LPHOSTENT lpHostEntry;
	sockaddr_in sockData;
	int Status = 0;
	int i = 0, index = 0;
	char *hostname;	
	char localBuffer[4096];
	char remoteBuffer[4096];
	int bytesRead = 0;



	//-Create Listen Socket:
	Listen = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
	if (Listen == INVALID_SOCKET)
	{
 printf("Error: socket(), invalid socket handle\r\n");
 WSACleanup();
 return;
	}



	//-Server Address:
	sockData.sin_family = AF_INET;
	sockData.sin_addr.s_addr = inet_addr(ip);
	sockData.sin_port = htons(atoi(port));



	//-Bind Listen Socket:	
	Status = bind(Listen, (struct sockaddr *) &sockData, sizeof(sockData));
	//-Check bind:
	if(Status)
	{
 printf("Error: bind(), %s:%s\r\n", ip, port);
 closesocket(Listen);
 WSACleanup();
 return;
	}
	printf("Bound: %s:%s\r\n", ip, port);



	//-Create Event for Listen socket:
	newEvent = WSACreateEvent();
	if(newEvent == WSA_INVALID_EVENT)
	{
 printf("Error: WSACreateEvent(), invalid event handle\r\n");
 WSACleanup();
 return;
	}
	//-Associate Listen Socket with network events:
	Status = WSAEventSelect(Listen, newEvent, FD_ACCEPT|FD_CLOSE|FD_READ|FD_WRITE|FD_CONNECT);
	if(Status == SOCKET_ERROR)
	{
 printf("Error: WSAEventSelect(), socket error\r\n");
 closesocket(Listen);
 WSACleanup();
 return;
	}


	//-Start Listening:
	printf("Bringing up listen service\r\n");
	listen(Listen, SOMAXCONN);
	printf("[Started]\r\n");


	wEvents[LISTEN] = newEvent;
	wEvents[LOCAL] = WSA_INVALID_EVENT;
	wEvents[REMOTE] = WSA_INVALID_EVENT;
	

	//-Enter Main Loop:
	while(true)
	{
 //-Loop Through all events:
 for(i = 0; i < 3; i++)
 {
 	Status = WSAWaitForMultipleEvents(1, &wEvents[i], false, 0, TRUE);
 	if((Status != WSA_WAIT_FAILED) && (Status != WSA_WAIT_TIMEOUT))
 	{
  


  //-Incomming Connection Request:
  if(i == LISTEN)
  {
  	//-See what we got:
  	WSAEnumNetworkEvents(Listen, wEvents[i], &netEvent);

  	if(netEvent.lNetworkEvents & FD_ACCEPT)
  	{
   printf("Local Client: Connect\r\n");

   
   //-Accept and Create Local Socket:
   Local = accept(Listen, NULL, NULL);
   if (Local == INVALID_SOCKET)
   {
   	printf("Error: socket(), invalid socket handle\r\n");
   	WSACleanup();
   	return;
   }

   
   //-Add event for Local Socket:
   newEvent = WSACreateEvent();   
   if(newEvent == WSA_INVALID_EVENT)
   {
   	printf("Error: WSACreateEvent(), invalid event handle\r\n");
   	WSACleanup();
   	return;
   }

   
   //-Add to event list:
   wEvents[LOCAL] = newEvent;

   //-Add event to selector list:
   Status = WSAEventSelect(Local, newEvent, FD_READ|FD_WRITE|FD_CONNECT|FD_CLOSE);        	
  	}
  }



  if(i == LOCAL)
  {  	
  	//-See what we got:
  	WSAEnumNetworkEvents(Local, wEvents[i], &netEvent);


  	if(netEvent.lNetworkEvents & FD_READ)
  	{   
   //-Recieve Data: Terminate at end of bytes recieved:
   Status = recv(Local, localBuffer, 4096, 0);
   localBuffer[Status] = '\0';
   bytesRead = Status;
   printf("Local Bytes Recieved: %i\r\n", bytesRead);
   //printf("%s\r\n",localBuffer);


   //-Parse remote host from data:
   hostname = parseHostname(localBuffer);

     	
   //-Resolve hostname to DNS:
   lpHostEntry = gethostbyname(hostname);
   if(lpHostEntry == NULL)
   {
   	printf("Error: gethostbyname(), bad hostname or couldn't resolve\r\n");
   	continue;
   }


   

   //printf("Hostname: %s\r\n",hostname);

   //-Create new remote socket:
   Remote = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
   if(Remote == INVALID_SOCKET)
   {
   	printf("Error: socket(), invalid socket handle\r\n");
   	closesocket(Remote);
   	continue;   	
   }


   //-Create events and add to event list:
   newEvent = WSACreateEvent();
   if(newEvent == WSA_INVALID_EVENT)
   {
   	printf("Error: WSACreateEvent(), invalid event handle\r\n");
   	continue;
   }

   

   //-Add event to list:
   wEvents[REMOTE] = newEvent;
   

   

   //-Add new remote socket to list:
   Status = WSAEventSelect(Remote, newEvent, FD_READ|FD_WRITE|FD_CLOSE|FD_CONNECT);   
   if (Status == SOCKET_ERROR)
   {
   	printf("Error: WSAEventSelect(), socket error\r\n");
   	closesocket(Remote);
   	continue;   	
   }

   

   //-Remote Host Data:
   sockData.sin_family = AF_INET;   
   sockData.sin_addr = *((LPIN_ADDR)*lpHostEntry->h_addr_list);   
   sockData.sin_port = htons(80); 

   
   
   //-Connect to Remote host: this will block now, but not in the next iteration:
   Status = connect(Remote, (struct sockaddr*)&sockData, sizeof(SOCKADDR_IN));


   //-Copy Local Buffer to Remote buffer: We will send this data on connection to Remote host next iteration:
   memcpy(remoteBuffer, localBuffer, bytesRead);
   remoteBuffer[bytesRead] = '\0';
  	
  	}
  	
  	
  	//-Close socket and events: They will be re-created on new Local Connection:
  	if(netEvent.lNetworkEvents & FD_CLOSE)
  	{
   printf("Local Client: Disconnect\r\n");
   closesocket(Local);
   WSACloseEvent(wEvents[LOCAL]);
   continue;
  	}
  	
  }


  if(i == REMOTE)
  {

  	//-See what we got:
  	WSAEnumNetworkEvents(Remote, wEvents[i], &netEvent);

  	//-Connection to remote host: Forward local proxy client data to remote:
  	if(netEvent.lNetworkEvents & FD_CONNECT)
  	{
   printf("Connect: %s\r\n", hostname);
   Status = send(Remote, remoteBuffer, strlen(remoteBuffer), 0);  	
  	}

  	//-Received data from remote: Forward it to Local:
  	if(netEvent.lNetworkEvents & FD_READ)
  	{
   
   Status = recv(Remote, remoteBuffer, 4096, 0);
   if(WSAGetLastError() == WSAENOBUFS)
   {
   	printf("Error: Remote: recv(), no buffer space\r\n");
   	continue;
   }
   else
   {
   	bytesRead = Status;
   	remoteBuffer[bytesRead] = '\0';
   }
   
   
   send(Local, remoteBuffer,strlen(remoteBuffer),0);  	
   if(WSAGetLastError() == WSAENOBUFS)
   {
   	printf("Error: Remote: send(), no buffer space\r\n");
   	continue;
   }


  	}

  	if(netEvent.lNetworkEvents & FD_CLOSE)
  	{
   printf("Remote Client: Disconnect\r\n");
   closesocket(Remote);
   WSACloseEvent(wEvents[REMOTE]);
   continue;
  	}
  }


 	}

 }
	}


	//-Cleanup:
	closesocket(Listen);
	closesocket(Local);
	closesocket(Remote);
	WSACleanup();
	return;
}





//-parseHostname(...):
//-Parses the hostname from the GET... request.
char *parseHostname(char *data)
{

	char *hostname = (char*) malloc(sizeof(char*) * 512);
	int i = 0;
	
	//-Skip 'GET http://'
	for(i = 0; i < 11; i++)
 {*data++;}
	
	//-Read until first '/' character, this is the end of the hostname.
	i = 0;
	while(*data != '/')
	{
 hostname[i++] = *data;	
 *data++;
	}

	hostname[i++] = '\0';
	return hostname;
}