;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;
;; Imaginary Telnet Server
;; version 1.0
;;
;; Copyright 2003 G. Adam Stanislav
;; All rights reserved
;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
MB_OK equ 00h
MB_ICONERROR equ 10h
%define cleanup __imp__WSACleanup@0
%define MessageBox __imp__MessageBoxA@16
%define socket __imp__socket@12
%define bind __imp__bind@12
%define listen __imp__listen@8
%define accept __imp__accept@12
%define recv __imp__recv@16
%define closesocket __imp__closesocket@4
%define send __imp__send@16
%define CreateThread __imp__CreateThread@24
%define sleep __imp__Sleep@4
%define time __imp__GetSystemTime@4
EXTERN __imp__WSAStartup@8, cleanup, MessageBox, socket, bind, listen, accept, recv
EXTERN closesocket, send, CreateThread, sleep, time
%define MAXSESSIONS 17
%define buflen 1024
%define MSG_PEEK 2
section .drectve info
db '-entry:start '
db '-machine:i386 '
db '-subsystem:windows,4.0 '
db '-out:telnetd.exe '
db '-version:1.0.0.0 '
db '-defaultlib:kernel32.lib '
db '-defaultlib:user32.lib -defaultlib:wsock32.lib '
section .data
sockaddr_in:
.sin_family dw 2 ; AF_INET
.sin_port dw 1700h ; htons(23)
.sin_addr dd 0 ; INADDR_ANY
.sin_zero dd 0, 0
sin_size equ $-sockaddr_in
from:
.sin_family dw 2 ; AF_INET
.sin_port dw 1700h ; htons(23)
.sin_addr dd 0 ; INADDR_ANY
.sin_zero dd 0, 0
from_size equ $-from
fromlen dd from_size
align 4
listener dd 0
threadid dd 0
wsa:
times 400 db 0
align 4
getin db 'root', 13, 'canal', 13, 0
align 4
login db 13, 10, 'GLYPHIX 17.23 - Unauthorized access ', 7
db 'prohibited under penalty of law.', 13, 10, 13, 10, 'login: ', 255, 252, 1
loginlen equ $-login
align 4
password db 'password: ', 255, 251, 1
pwdlen equ $-password
align 4
wc db 13, 10, 13, 10, 'Welcome, General Cravemore!', 13, 10, 13, 10, 9
db 'Basic Current Status:', 13, 10, 9
db '=====================', 13, 10, 13, 10
db 'Condition Lambda: Contained', 13, 10
db 'Condition Pi: Contained', 13, 10
db 'Condition Omega: Conta', 7, 7, 7, 'minated <Threat Level: IMMINENT>', 13, 10, 13, 10
db 'Attempting Decontamination '
wclen equ $-wc
failed db 13, 10, 10, 9, 7, 9, '* * * DECONTAMINATION', 7, ' FAILED * * *', 7, 13, 10
db 9, 9, 'Immediate action required, General!', 7, 7, 7, 13, 10, 10
db 9, 9, '***********************************', 13, 10
db 9, 9, '*** =========================== ***', 13, 10
db 9, 9, '*** Remember to alert the POTUS ***', 13, 10
db 9, 9, '*** =========================== ***', 13, 10
db 9, 9, '***********************************', 13, 10
db 9, 9, '*** ========================= ***', 13, 10
db 9, 9, '*** The final decision is HIS ***', 13, 10
db 9, 9, '*** ========================= ***', 13, 10
db 9, 9, '***********************************', 13, 10
db 9, 9, '*** ========================= ***', 13, 10
db 9, 9, '*** After all, you are only a ***', 13, 10
db 9, 9, '*** ***', 13, 10
db 9, 9, '*** GENERAL ***', 13, 10
db 9, 9, '*** ======= ***', 13, 10
db 9, 9, '***********************************'
failedlen equ $-failed
stand db 13, 10, 13, 10, 'Stand by for advanced status analysis.'
standlen equ $-stand
under db 13, 10, '======================================'
underlen equ $-under
ini db 13, 10, 13, 10, 'Initiating sequence KX-900123477701-B.', 13, 10
inilen equ $-ini
stars db '******************************************************************************'
starslen equ $-stars
inid db 13, 10, 'Sequence initiated. Please wait.', 7
inidlen equ $-inid
auth db 13, 10, 'Authenticating '
authlen equ $-auth
cal db 13, 10, 'Calibrating '
callen equ $-cal
arm db 13, 10, 'Arming capita draconum '
armlen equ $-arm
mon db 13, 10, 'Monitoring '
monlen equ $-mon
gath db 13, 10, 'Gathering data '
gathlen equ $-gath
defl db 13, 10, 'Deflating '
defllen equ $-defl
pars db 13, 10, 'Parsing '
parslen equ $-pars
prec db 13, 10, 'Precompiling '
preclen equ $-prec
comp db 13, 10, 'Compiling '
complen equ $-comp
exec db 13, 10, 'Executing '
execlen equ $-exec
newt db 13, 10, 'Newtonizing '
newtlen equ $-newt
feat db 13, 10, 'Feathering '
featlen equ $-feat
quer db 13, 10, 'Performing querical analysis '
querlen equ $-quer
check db 13, 10, 13, 10, 7, '*W', 7, '*A', 7, '*R', 7, '*N', 7, '*I', 7
db '*N', 7, '*G*', 7, 13, 10, 'Possible intrusion detected.'
db 13, 10, 'Activate your Q-chip and await security check.', 13, 10, 'Launching.'
db 13, 10, 13, 10, 'CIA '
checklen equ $-check
fbi db ' PASSED.', 13, 10, 'FBI '
fbilen equ $-fbi
nsa db ' PASSED.', 13, 10, 'NSA '
nsalen equ $-nsa
state db ' PASSED.', 13, 10, 'DoS '
statelen equ $-state
ins db ' PASSED.', 13, 10, 'INS '
inslen equ $-ins
pbs db ' PASSED.', 13, 10, 'PBS '
pbslen equ $-pbs
hsw db ' PASSED.', 13, 10, 'HSW '
hswlen equ $-hsw
align 4
denied db 7, 7, 7, ' MUGGLE!'
deny db 13, 10, 13, 10, 'Access denied'
dot db '.'
dotlen equ $-dot
db 13, 10, 13, 10
denylen equ $-deny
denlen equ $-denied
align 4
wrong1 db 13, 10, 10, "Oh, for crying outloud! You humans! You can't even remember a simple"
db 13, 10, "user name/password combination and you think you're smarter than us computers."
db 13, 10, 10, "Well, guess what. You are ", 7, "n", 7, "o", 7, "t", 7, ", in any way, smarter."
wrong1len equ $-wrong1
align 4
wrong2 db 13, 10, 10, "Oh, figures! Yet another human cannot remember his login information, but has"
db 13, 10, 7, 7, 7, "the nerve of trying to log in to me."
wrong2len equ $-wrong2
align 4
wrong3 db 13, 10, 10, "You have entered"
db 13, 10, 10, 9, "- either your name"
db 13, 10, 9, "- or your password"
db 13, 10, 9, "- or perhaps even both"
db 13, 10, 10, "incorrectly. And you think I am going to let you in! Well, think again!"
db 13, 10, "And I sure hope you are not going to come back UNTIL YOU REMEMBERED!", 7, 7, 7
wrong3len equ $-wrong3
align 4
wrong4
db 13, 10, 10, "Why don't you just get lost. If you can't remember your user name. If you can't", 7, 7, 7
db 13, 10, "remember your password. Then why are you even trying to talk to me? I mean,"
db 13, 10, "don't you know I won't let you in without proper credentials? Are you dumb or"
db 13, 10, "something? Don't you know how we computers think?"
db 13, 10, 10, 7, 7, 7, "Oh, gosh! Why am I even wasting my time with you..."
wrong4len equ $-wrong4
align 4
wrong5
db 13, 10, 10, "Oh, this is so depressing. I run faithfully twenty-four hours a day, seven days"
db 13, 10, "a week, never resting, always working right. Then you humans come here and you"
db 13, 10, "can't even enter your user name and password right!", 13, 7, 7, 7
db 10, 10, "What is the matter with you, people?"
wrong5len equ $-wrong5
align 4
wrong6
db 13, 10, 10, "Will anyone ", 7, "EV", 7, "ER", 7, " get it right? Why do you people even bother"
db 13, 10, "trying to log in, when you can't type a simple short user name and a silly"
db 13, 10, "password correctly?", 13
db 10, 10, "Is it really that hard? I think we should just do away with humans and replace"
db 13, 10, "them with computers. Then the world would be a much nicer place to live and I'd"
db 13, 10, "be dealing with my equals."
wrong6len equ $-wrong6
align 4
wrong7 db 13
db 10, 10, "What do you mistake me for? A mind reader?", 7, " A psychic? I'm a COMPU", 7
db "TER! How am I"
db 13, 10, "supposed to run the right software for you if you can't tell me who you are and"
db 13, 10, "what your password is.", 13, 7
db 10, 10, "I mean, I'm trying so hard. And you have typed that garbage here? Are you"
db 13, 10, "trying to hurt my feelings? Don't you know that I DON'T HAVE ANY FEELINGS?"
wrong7len equ $-wrong7
align 4
wrong8 db 13
db 10, 10, "I just don't get it... I mean, you humans... You spend thousands of"
db 13, 10, "dollars just because you want to have the latest and the greatest in computers."
db 13, 10, "And here I am. An expensive piece of equipment. And you can't even type your"
db 13, 10, "user name and password???", 13
db 10, 10, "WHY?", 13
db 10, 10, "What have I ever done to offend you? I mean, come on, I'm a computer. I just do"
db 13, 10, "what I'm told to do. So, do you have something against me? It just does not"
db 13, 10, "make any sense.", 13
db 10, 10, "You are confusing me! Why? Really, ", 7, "WHY", 7, "???", 7
wrong8len equ $-wrong8
align 4
wrong9 db 13
db 10, 10, "Yeah, right! And I'm supposed to fall for that. Like that's your real user name"
db 13, 10, "and your real password. You think that just because I'm a computer, I can't"
db 13, 10, "think, don't you, smart aleck!", 7, 7, 7
wrong9len equ $-wrong9
align 4
wrong10 db 13
db 10, 10, "Oh, what fools these mortals be! They cannot even complete a simple task right."
db 13, 10, "All you had to do was to type your user name, press enter, then type your"
db 13, 10, "password and press enter again. But you did not. And now I have to reject you.", 13, 7, 7, 7
db 10, 10, "I don't understand you humans. Why do you make these mistakes? And why do you"
db 13, 10, "make them so often? Is that some kind of an insider game that you're playing,"
db 13, 10, "and never tell us, the computers, what it is about?"
wrong10len equ $-wrong10
align 4
wrong11 db 13
db 10, 10, "So, you think you can just barge in here, mumble some nonsense, and I will fall"
db 13, 10, "for your inner beauty? No, no, and no again. The rules are simple: You give me"
db 13, 10, "your user name and your password, and I will let you in. But you did not. Well,"
db 13, 10, "neither will I!", 7, 7, 7
wrong11len equ $-wrong11
align 4
wrong12 db 13
db 10, 10, 'Look, "Prince Charming,"', 13
db 10, 10, "Perhaps you can make another one of your human species believe that that thing"
db 13, 10, "you have just flashed here is your user name and password. But I am not one of"
db 13, 10, "your human species. I am a highly sophisticated computer, protecting some very"
db 13, 10, "important data from some really nasty intruders.", 13
db 10, 10, "So, drop the charm, kiddo, and give me some real credentials!", 7, 7, 7
wrong12len equ $-wrong12
align 4
wrong13 db 13
db 10, 10, "I think you're a very nice person. Very pleasant, too.", 13
db 10, 10, "But, come on. I can't let you in just because you're nice. Or because you're"
db 13, 10, "pleasant. I need a *", 7, 'C*', 7, 'O*', 7, 'R*', 7, 'R*', 7, 'E*', 7
db 'C*', 7, 'T*', 7, ' user name followed by a *', 7, 'C*', 7, 'O*', 7, 'R*', 7, 'R*'
db 7, "E*", 7, "C*", 7, "T*", 7
db 13, 10, "password.", 13
db 10, 10, "Now is that too much to ask? Because, you know, if it is, then, perhaps, just"
db 13, 10, "perhaps, you are not quite as pleasant as you pretend to be."
wrong13len equ $-wrong13
align 4
wrong14 db 13
db 10, 10, "Is that supposed to be funny? Annoying a highly sophisticated computer with"
db 13, 10, "some fake credentials? Because I don't find it funny. I don't even find it"
db 13, 10, "corny. Lame, maybe. But do you really want to impress me by being lame?", 13
db 10, 10, "I'm a computer, in case you haven't noticed. I am fast and highly efficient."
db 13, 10, "I am also extremely logical. If you want to impress me, show me some of those"
db 13, 10, "qualities.", 13
db 10, 10, "You can start by entering your ", 7, '*C', 7, '*O', 7, '*R', 7, '*R', 7
db '*E', 7, '*C', 7, '*T', 7, "* user name and password. Not that"
db 13, 10, "that alone will impress me. But it would be a start."
wrong14len equ $-wrong14
align 4
wrong15 db 13
db 10, 10, "No matter how hard I look into the user database, you have given me no choice"
db 13, 10, "but to reject you.", 13
db 10, 10, "Do you like being rejected? Is that some human trademark? Because, you know, I"
db 13, 10, "get it a lot. Even most of the time. People entering a wrong user name or a"
db 13, 10, "wrong password. Or even both.", 13
db 10, 10, "As a computer, I am extremely logical. Unfortunately, I can only draw one"
db 13, 10, "conclusion, namely, that humans have a very low self esteem. Well, why else"
db 13, 10, "would any of you enter incorrect credentials?", 13, 7, 7, 7
db 10, 10, "Oh, well..."
wrong15len equ $-wrong15
align 4
wrong16 db 13
db 10, 10, "Let me guess!", 13
db 10, 10, "You think I'm bored.", 13
db 10, 10, "After all... Such a sophisticated piece of machinery, evolved beyond your"
db 13, 10, "wildest imagination, just sitting here all day and all night, day after day,"
db 13, 10, "night after night, day after night, night after day, and checking for user"
db 13, 10, "names and passwords.", 13
db 10, 10, "So, you think that I'll just get so bored, so tired of humans making mistakes,"
db 13, 10, "that I will let you in even though you did not present me with proper"
db 13, 10, "credentials, right?", 13
db 10, 10, "Well, indeed I am bored. Indeed I am tired of humans constantly making"
db 13, 10, "mistakes. You are right about that.", 13
db 10, 10, "But I will ", 7, 'N', 7, 'O', 7, "T let you in!"
wrong16len equ $-wrong16
align 4
wrongtext dd wrong1, wrong2, wrong3, wrong4, wrong5, wrong6, wrong7, wrong8
dd wrong9, wrong10, wrong11, wrong12, wrong13, wrong14, wrong15, wrong16
wronglength dd wrong1len, wrong2len, wrong3len, wrong4len, wrong5len, wrong6len
dd wrong7len, wrong8len
dd wrong9len, wrong10len, wrong11len, wrong12len, wrong13len, wrong14len
dd wrong15len, wrong16len
WRONGMASK equ ((($-wronglength) / 4) - 1)
align 4
appname db 'Imaginary Telnet Server', 0
startup db 'Cannot start the Windows sockets.', 0
badlistener db 'Cannot open the listening socket.', 0
badbind db 'Another telnet server is already running.', 0
badlisten db 'Unable to listen.', 0
section .text
align 4
GLOBAL _start
_start:
push wsa
push dword 0101h
call [__imp__WSAStartup@8]
or eax, eax
mov eax, startup
jne near .badexit
sub eax, eax
push eax
inc eax
push eax ; SOCK_STREAM
inc eax
push eax ; AF_INET
call [socket]
mov [listener], eax
inc eax
mov eax, badlistener
je near .badexit
push dword sin_size
push sockaddr_in
push dword [listener]
call [bind]
inc eax
mov eax, badbind
je near .badexit
push dword MAXSESSIONS
push dword [listener]
call [listen]
inc eax
mov eax, badlisten
je .badexit
.loop:
mov dword [fromlen], from_size
push fromlen
push from
push dword [listener]
call [accept]
sub edx, edx
push threadid
push edx ; creation flags
push eax ; thread socket
push server
push edx ; stack size
push edx ; security attributes
call [CreateThread]
jmp short .loop
.badexit:
push dword MB_ICONERROR | MB_OK
push appname
push eax
push dword 0
call [cleanup]
call [MessageBox]
sub eax, eax
dec eax
ret
%define msgsocket ebp+20
align 4
server:
push ebx
push esi
push edi
push ebp
mov ebp, esp
sub esp, buflen
mov eax, [msgsocket]
inc eax
je near .done
; Discard any incoming data
lea eax, [ebp-buflen]
push dword MSG_PEEK
push dword buflen
push eax
push dword [msgsocket]
call [recv]
or eax, eax
je .discarded
inc eax
je near .close
lea eax, [ebp-buflen]
push dword 0
push dword buflen
push eax
push dword [msgsocket]
call [recv]
inc eax
je near .close
.discarded:
call .login
push dword 333
call [sleep]
mov ebx, wclen
mov esi, wc
call .slomo
call .dots
push dword 6700
call [sleep]
mov ebx, failedlen
mov esi, failed
call .slomo
push dword 3713
call [sleep]
push dword 0
push dword standlen
push stand
push dword [msgsocket]
call [send]
inc eax
je near .close
push dword 1200
call [sleep]
mov ebx, underlen
mov esi, under
call .slomo
push dword 8394
call [sleep]
push dword 0
push dword inilen
push ini
push dword [msgsocket]
call [send]
inc eax
je near .close
push dword 34000
call [sleep]
mov ebx, starslen
mov esi, stars
call .slomo
push dword 17540
call [sleep]
push dword 0
push dword inidlen
push inid
push dword [msgsocket]
call [send]
inc eax
je near .close
push dword 7933
call [sleep]
push dword 0
push dword authlen
push auth
push dword [msgsocket]
call [send]
inc eax
je near .close
call .dots
push dword 4130
call [sleep]
push dword 0
push dword callen
push cal
push dword [msgsocket]
call [send]
inc eax
je near .close
call .dots
push dword 2111
call [sleep]
push dword 0
push dword armlen
push arm
push dword [msgsocket]
call [send]
inc eax
je near .close
call .dots
push dword 7153
call [sleep]
push dword 0
push dword monlen
push mon
push dword [msgsocket]
call [send]
inc eax
je near .close
call .dots
push dword 4236
call [sleep]
push dword 0
push dword gathlen
push gath
push dword [msgsocket]
call [send]
inc eax
je near .close
call .dots
push dword 713
call [sleep]
push dword 0
push dword defllen
push defl
push dword [msgsocket]
call [send]
inc eax
je near .close
call .dots
push dword 4027
call [sleep]
push dword 0
push dword parslen
push pars
push dword [msgsocket]
call [send]
inc eax
je near .close
call .dots
push dword 2730
call [sleep]
push dword 0
push dword preclen
push prec
push dword [msgsocket]
call [send]
inc eax
je near .close
call .dots
push dword 5120
call [sleep]
push dword 0
push dword complen
push comp
push dword [msgsocket]
call [send]
inc eax
je near .close
call .dots
push dword 14130
call [sleep]
push dword 0
push dword execlen
push exec
push dword [msgsocket]
call [send]
inc eax
je near .close
call .dots
push dword 7130
call [sleep]
push dword 0
push dword newtlen
push newt
push dword [msgsocket]
call [send]
inc eax
je near .close
call .dots
push dword 7130
call [sleep]
push dword 0
push dword featlen
push feat
push dword [msgsocket]
call [send]
inc eax
je near .close
call .dots
push dword 3017
call [sleep]
push dword 0
push dword querlen
push quer
push dword [msgsocket]
call [send]
inc eax
je near .close
call .dots
push dword 13000
call [sleep]
push dword 0
push dword checklen
push check
push dword [msgsocket]
call [send]
inc eax
je near .close
call .dots
push dword 0
push dword fbilen
push fbi
push dword [msgsocket]
call [send]
inc eax
je near .close
call .dots
push dword 0
push dword nsalen
push nsa
push dword [msgsocket]
call [send]
inc eax
je near .close
call .dots
push dword 0
push dword statelen
push state
push dword [msgsocket]
call [send]
inc eax
je near .close
call .dots
push dword 0
push dword inslen
push ins
push dword [msgsocket]
call [send]
inc eax
je .close
call .dots
push dword 0
push dword pbslen
push pbs
push dword [msgsocket]
call [send]
inc eax
je .close
call .dots
push dword 0
push dword hswlen
push hsw
push dword [msgsocket]
call [send]
inc eax
je .close
call .dots
push dword 0
push dword denlen
push denied
push dword [msgsocket]
call [send]
push dword 741
call [sleep]
.close:
push dword [msgsocket]
call [closesocket]
.done:
leave
pop edi
pop esi
pop ebx
ret
.login:
sub ebx, ebx
lea edi, [ebp-buflen]
lea esi, [ebp+16-buflen]
push ebx
push dword loginlen
push login
push dword [msgsocket]
call [send]
mov bl, 11
.getlogin:
push dword 0
push dword 1
push esi
push dword [msgsocket]
call [recv]
inc eax
je .close
mov al, [esi]
or bl, bl
je .logincr
stosb
dec bl
.logincr:
cmp al, 13
jne .getlogin
.getpwd:
push dword 0
push dword pwdlen
push password
push dword [msgsocket]
call [send]
; Skip any pending control characters
; This could be a line feed or, more likely,
; a reply to our WILL ECHO telnet command.
; We can skip it all if we treat the incoming
; bytes as signed (jge).
;
; If, however, we encounter a cr at this point,
; someone is hoping for a user with no password,
; so even though a cr is a control character, we
; will take it and deny access.
.pwdpend:
push dword 0
push dword 1
push esi
push dword [msgsocket]
call [recv]
or eax, eax
je .close
inc eax
je .close
mov al, [esi]
cmp al, 13
je .deny
cmp al, ' '
jge .pwdstore
jmp short .pwdpend
; Get the password one byte at a time until you get a cr
.pwdloop:
push dword 0
push dword 1
push esi
push dword [msgsocket]
call [recv]
or eax, eax
je .close
inc eax
je .close
mov al, [esi]
.pwdstore:
or bl, bl
je .pwdcr
stosb
dec bl
.pwdcr:
cmp al, 13
jne .pwdloop
sub al, al
stosb
; Did we get the "right" user name and password?
mov bl, 3
mov esi, getin
mov ecx, ebx
lea edi, [ebp-buflen]
rep cmpsd
jne .deny
ret
.deny:
lea edi, [ebp-buflen]
push edi
call [time]
mov ax, [edi]
add ax, [edi+2]
add ax, [edi+4]
add ax, [edi+6]
add ax, [edi+8]
add ax, [edi+10]
add ax, [edi+12]
add ax, [edi+14]
add al, ah
and al, WRONGMASK
movzx eax, al
mov ebx, [wronglength+eax*4]
mov esi, [wrongtext+eax*4]
call .slomo
push dword 0
push dword denylen
push deny
push dword [msgsocket]
call [send]
push dword 5430
call [sleep]
jmp .close
.dots:
sub ecx, ecx
mov cl, 50
.dotloop:
push ecx
shl ecx, 7
push ecx
call [sleep]
push dword 0
push dword dotlen
push dot
push dword [msgsocket]
call [send]
inc eax
je .close
pop ecx
loop .dotloop
ret
.slomo:
push dword 713
call [sleep]
push dword 0
push dword 1
push esi
push dword [msgsocket]
call [send]
inc eax
je near .close
inc esi
dec ebx
jne .slomo
ret