Apart from the backdoor, this code seems completely ridden with bugs. E.g. if(strstr(header, "User-Agent:") != NULL) { http_request_t->0xD0 = h

Apart from the backdoor, this code seems completely ridden with bugs. E.g. if(strstr(header, "User-Agent:") != NULL) { http_request_t->0xD0 = header + strlen("User-Agent:") + strspn(header, " \t"); } Note how you could have a header some includes 'User-Agent:' somewhere back in the value, and the arrive with an entirely incorrect pointer to what you think is the value - strstr just finds the needle anywhere in the haystack, not necessarily at the beginning. This particular piece (AFAICT) cannot be exploited for e.g. overruns or similar, maybe just for a subsequent crash or unexpected behaviour due to lack of input sanitization, but still, crazy strstr juggling on untrusted user input? oh oh. If the rest of this code looks like that, this should never, ever be exposed to the wild wild web.