Articles

Metasploit Framework Windows Tutorial
Remote Desktop Connection
Windows Processes That May Be Dangerous
How-To use NetCat a Tutorial
Common Linux Commands
Common Ports
Netcat Commands
HTTP Response Codes
War-Google Hack Terms
Wardriving
Avoiding Social Engineering and Phishing Attacks
Intrusion Detection on Linux
Linux Intrusion Detection
Penetration Testing Guide
Penetration Testing Tools
Social Engineering Fundamentals, Part I: Hacker Tactics
Social engineering (computer security)
The Psychology of Social Engineering

The Archives

General GSO
GovernmentSecurity.org News & Suggestions
In The News
Open Topic
General Security Information
Trash Can
Exploit & Vulnerability Mailing List Archives
Trial Member Forum
Product and Program Reviews GSO Tutorials
System Security
Windows Systems
Beginners Section
Linux & Unix Systems
File Downloads
Exploit Research & Discussion Trojan & Virus Errata
Networking Security / Firewall / IDS / VPN / Routers
System Hardening
E-Mail Security
Wifi Security
Trial Member Uploads
Upload discovered Trojans & Mal ware
GSO Programming Section
C , C++ , VC++
Visual Basic.NET
Perl /CGI
Java/Javascript
PHP/XML/ASP/HTML
Assembly + Other
The Cork Board
Network Security Consultant Directory
Network Security Jobs
The Archives
Encryption Information
General Network Security
Internet Anonymity
HTTP Protocol Security
Linux Security
MS IIS Information
Exploit Articles
Programming / Tool Design
GSO Software Projects
Public Downloads
Microsoft Security Questions and Papers

Full Version: Binding A Shell
n.n.p
Ok this is something im pretty unsure of. Its more a lack of understanding than an actual programming problem but here goes. If I am creating a backdoor on a Win32 system in C++ and I want to create a command prompt or some sort of shell and bind it to a specific port what would be the best way to go about it? Is there a way to do it using system("cmd")? Or would that just open a command prompt on the target machine.

A friend of mine had netcat listening on a port and when it recieved a connection it spawned a shell and the user could use it remotely. How does this work?Does netcat provide options to bind a shell when it recieves a connection? Can someone explain why the shell isnt just opened on the remote system?

Thanks for your time,
NNP
usch
ok i'll try:
when you start netcat it opens a socket at the specified port and listens. that means it waits until somebody finally connects to the port.
http://msdn.microsoft.com/library/default....ck/socket_2.asp
when somebody connects, it starts cmd.exe and redirects its output to the connected user and redirects the users input to cmd.exe via so called pipes.

http://msdn.microsoft.com/library/default...._and_output.asp
programming a simple listening socket for one single client is easy.
redirecting with pipes is a bit more difficult.

hope u got that

cheers
usch
n.n.p
QUOTE(usch @ Aug 9 2005, 04:51 PM)
ok i'll try:
when you start netcat it opens a socket at the specified port and listens. that means it waits until somebody finally connects to the port.
http://msdn.microsoft.com/library/default....ck/socket_2.asp
when somebody connects, it starts cmd.exe and redirects its output to the connected user and redirects the users input to cmd.exe via so called pipes.

http://msdn.microsoft.com/library/default...._and_output.asp
programming a simple listening socket for one single client is easy.
redirecting with pipes is a bit more difficult.

hope u got that

cheers
usch
*




Perfect laugh.gif

Im comfortable with sockets but I have no experience with pipes. I did something like this before but how it worked was as follows.
Listen for connection
Receive command
Redirect output to a file
Read in file and send content back to user

It was in linux though and all that nonsense with the file wasn't particularly elegant.
ninar12
i would advice you to white scorpios homepage

there is one u can study
[_-ViCiOuS-_]
u don't really need pipes.. u can just do execl() or system().. and if u want to get back the output of these commands u can just write the output to a temp file, and then open and send it back
FTPServerTools
A quick cut and paste from my code and removal off all that you dont need.
This little piece handle the commandline in a threading way, so you could call a thread

CODE

DWORD WINAPI UserThreadProcess(WORD wShowWindow,char * Commandline, char *Cwd,DWORD TimeOut,char **Reply)
{
STARTUPINFO si;
PROCESS_INFORMATION pi;
HANDLE hPipeRead,hPipeWrite;
BOOL bPipe=FALSE;
int ProcessExitCode;

memset(&si,0,sizeof(si));
memset(&pi,0,sizeof(pi));
si.cb=sizeof(si);
si.lpTitle=CommandLine;
si.dwFlags=STARTF_USESHOWWINDOW|STARTF_USESTDHANDLES;
si.wShowWindow=wShowWindow;

//Create the console pipe to catch the childs output
SECURITY_ATTRIBUTES SecurityAttributes;

SecurityAttributes.nLength=sizeof(SECURITY_ATTRIBUTES);
SecurityAttributes.bInheritHandle=TRUE;
SecurityAttributes.lpSecurityDescriptor=NULL;
bPipe=CreatePipe(&hPipeRead,&hPipeWrite,&SecurityAttributes,0);
if (bPipe){  //if created well then catch the reply
 si.hStdOutput=hPipeWrite;
 si.hStdError=hPipeWrite;
 //No pipe
 return -1;
}

DWORD StartTick=GetTickCount();
DWORD EndTick=StartTick;
BOOL bRes=CreateProcess(NULL,CommandLine,NULL,NULL,TRUE,0,NULL,Cwd,&si,&pi);
if (!bRes){
 DWORD dwErr=GetLastError();
 //if commandline failed
 CloseHandle(hPipeWrite);
 return -1;
}

ProcessExitCode=0;
BOOL bExit;
//Now in a loop read data from the pipe, first set the pipe to return immediately
DWORD nBytesRead,dwMode=PIPE_NOWAIT;
char Buffer[1024];
SetNamedPipeHandleState(hPipeRead,&dwMode,NULL,NULL);
bool bLastIsCRLF=true;
for (;;){
 WaitForSingleObject(pi.hProcess,1);    //switch tasks so the pipe gets filled
 bExit=GetExitCodeProcess(pi.hProcess,&ProcessExitCode);  //check if process finished or not
 if (ReadFile(hPipeRead,&Buffer,sizeof(Buffer)-1,&nBytesRead,NULL)){
  if (nBytesRead>0){
   Buffer[nBytesRead]='\0';   //if needed replace \b with ' '
   //Add to Reply buffer
   char *n=realloc(Reply,ReplyLen+nBytesRead);
   if (n){      //if not enough memory then stop receiving the pipe info into the buffer
    strcat(n,Buffer);
    Reply=n;
   }
  }
 }
 if (nBytesRead==0 && ProcessExitCode!=STILL_ACTIVE) break; //if process is ended then break
 EndTick=GetTickCount();
 if (EndTick>StartTick && EndTick-StartTick>(TimeOut*1000)) break; //<49.7 days
 if (StartTick>EndTick && (~StartTick)+EndTick>(TimeOut*1000)) break; //>49.7 days
}
CloseHandle(pi.hThread);
CloseHandle(pi.hProcess);
CloseHandle(hPipeRead);
CloseHandle(hPipeWrite);
return 0;
}


This should be more then sufficient to get you started on pipes.
AgentOrange
I like this one:
hxxp://www.rootkit.com/newsread.php?newsid=108
nolimit
If you want to interpret data sent through in any way, then by all means use named pipes.
However, if you just want a simple command shell, you only need to use Windows Sockets 2.0 and direct stdin/out to the socket. It's how shellcode today works. It's much easier then using pipes.
n.n.p
At the moment all i want to do is make a simple command shell.

Assuming im not using pipes for the moment (could you give me an example of where i would want to?) what would be the best way to execute the commands and return them to the user. I cold use system() or one of the exec commands but as for redirecting the output back to the user im not sure.
nolimit
nono, you definately want to use CreateProcess w/ a Process attribute defining the stdin/out/error to the winsock handle.
setthesun
QUOTE(AgentOrange @ Aug 10 2005, 09:34 PM)
I like this one:
hxxp://www.rootkit.com/newsread.php?newsid=108
*



I tried to this one, it seems good but crashing with an write protect exception or similiar. in Win 2003

I checked out permissions are right, any idea ?
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Invision Power Board © 2001-2005 Invision Power Services, Inc.