
 /*-----------------------------------------------------------------------*/
 /*                       R I N G 0,    I S S U E   # 1                   */
 /*-----------------------------------------------------------------------*/

                   socks4  rat

                                                          by CNerd/HangUP

        RAT,      ,
       ...    ...       
 -      .        ,   
     .
        ,    .    
      -    ,
       ( ,    100% 
       -   ).
     ,                  
           ,      
       RAT.
       (  60  -
   Win9x         64) Socks4 -  
    .

        .     ,  
 :

04 01 PH PL IP IP IP IP
 2  -  04  01
 2  -      
  4  - IP 

      ,     :,
         ,    ,    , 
    :

00 5A 00 00 00 00 00 00

  ,    ,    . ,    
  ,       :

 SOCKET as[60],cs[60]; // accepted sockets, proxy client sockets arrays
 SOCKET sw;            //  
 SOCKADDR_IN sa,st;
 int q,r;
 HWND hwnd;            //   

 sw=socket(AF_INET,SOCK_STREAM,PF_UNSPEC); //  
 st.sin_family      = AF_INET;
 st.sin_addr.s_addr = INADDR_ANY;
 st.sin_port        = htons(1080); //  

 bind(sw,&st,sizeof(st));
 listen(sw,60);
 WSAAsyncSelect(sw,hwnd,20000,FD_ACCEPT);  //  

    -    FD_ACCEPT,     
   ,            FD_READ 
 FD_CLOSE.

LRESULT CALLBACK WndProc(HWND hwnd, UINT iMsg,
                         WPARAM wParam, LPARAM lParam)
{
 switch (iMsg)
 {
  case 20000:

    /*     */

   if (LOWORD(lParam) == FD_ACCEPT)
   {
    q=sizeof(sa);
    r=accept(wParam,(struct sockaddr*)&sa,&q); //   
    as[(r-wParam)/4-1]=r;                      //    
    WSAAsyncSelect(r,hwnd,20001,FD_READ|FD_CLOSE); //    
   }

  break;

  ...

              
 FD_READ  (       ,    
   ), FD_CLOSE.

  case 20001:

   lParam=LOWORD(lParam);
   for (r=0;r<60;r++) if (as[r] == wParam) break; //   

    /*    */

   if (lParam == FD_READ)
   {
    q=recv(as[r],b1,65535,0);  //  

      //        ?

     if ((b1[0] == 4) && (b1[1] == 1))
     {
      closesocket(cs[r]);

      cs[r]=socket(AF_INET,SOCK_STREAM,AF_UNSPEC); //   
      sa.sin_family=AF_INET;                       //    

       //  IP
      sa.sin_addr.s_addr=MAKELONG(MAKEWORD(b1[4],b1[5]),MAKEWORD(b1[6],b1[7]));
      sa.sin_port=htons(b1[3]+b1[2]*256); //  

      WSAAsyncSelect(cs[r],hwnd,20002,FD_READ|FD_CLOSE|FD_CONNECT);
      connect(cs[r],&sa,sizeof(sa));
     }
     else send(cs[r],b1,q,0); //  -     

   }

    /*    */

   if (lParam == FD_CLOSE) closesocket(cs[r]); //  .  

  break;

  ...

  ,        -   
       ,      
 .

  case 20002:

   lParam=LOWORD(lParam);
   for (r=0;r<60;r++) if (cs[r] == wParam) break;

    /*     ! -  */

   if (lParam == FD_CONNECT) send(as[r],"\0\132\0\0\0\0\0\0",8,0); // oct132=dec90=hex5A

    /*      as[r] */

   if (lParam == FD_READ)
   {
    q=recv(cs[r],b1,65535,0);
    send(as[r],b1,q,0);
   }

    /*   ,  */

   if (lParam == FD_CLOSE) closesocket(as[r]); //  

  break;

  ...

        . ,       
 ?    . ;)
