Windows Socket 程序-- 远程dos shell 服务器和客户端 （1）

前2天看了看网络安全，讲到一种IPC入侵方式，要种植一个网络服务端到被入侵的主机，以实现远程shell的功能，就想自己写一个客户端和服务器。

先一个一个功能实现吧！第一步，实现相互通信的服务器和客户端。客户端可以向服务器发送信息，服务器把信息转成大写后回发给服务器。

服务器：

#include <iostream> #include <sys/types.h> #include <winsock2.h> #include <string.h> #include <stdarg.h> #define BUFFERLEN 512 #pragma comment(lib, "ws2_32") using namespace std; int printErrorAndExit(char *fmt,...) { va_list args; int n; char buf[BUFFERLEN] = {0}; va_start(args, fmt); n = vsprintf(buf, fmt, args); va_end(args); printf("%s/n",buf); WSACleanup(); return -1; } int main(int argc, char**argv) { SOCKET listenSocket, connectSocket; sockaddr_in serAddr,cliAddr; int cliAddrlen = sizeof(cliAddr); int dataLen = 0; char buffer[BUFFERLEN] = {0}; int iRet = 0; WSADATA wsaData; if(WSAStartup(0x101,&wsaData)!=0) { return printErrorAndExit("Socket Stack Error!"); } listenSocket = socket(AF_INET, SOCK_STREAM, 0); if (INVALID_SOCKET == listenSocket) { return printErrorAndExit("create socket error!"); } serAddr.sin_family = AF_INET; serAddr.sin_port = htons((unsigned short)20248); serAddr.sin_addr.s_addr = INADDR_ANY;//inet_addr("139.139.1.2"); iRet = bind(listenSocket,(sockaddr*)&serAddr,sizeof(serAddr)); if (0 != iRet) { return printErrorAndExit("bind error:%d", iRet); } iRet = listen(listenSocket, 5); if (0 != iRet) { return printErrorAndExit("listen error:%d", iRet); } connectSocket = accept(listenSocket,(sockaddr*)&cliAddr,&cliAddrlen); if (NULL == connectSocket) { return printErrorAndExit("failed to accept"); } while(1) { printf("addr:%s,len:%d",inet_ntoa(cliAddr.sin_addr),cliAddrlen); dataLen = recv(connectSocket,buffer,BUFFERLEN, 0); printf("receive data len:%d/n", dataLen); if(dataLen < 0 ) return dataLen;//continue; if (0 == strcmp("quit",buffer)) { shutdown(connectSocket,2); shutdown(listenSocket,2); } else { printf("recv:%s/n",buffer); send(connectSocket,strupr(buffer),BUFFERLEN,0); } } return 0; }

客户端程序：

#include <iostream> #include <sys/types.h> #include <winsock2.h> #include <string.h> #define BUFFERLEN 512 #pragma comment(lib, "ws2_32") using namespace std; int printErrorAndExit(char *fmt,...) { va_list args; int n; char buf[BUFFERLEN] = {0}; va_start(args, fmt); n = vsprintf(buf, fmt, args); va_end(args); printf("%s/n",buf); WSACleanup(); return -1; } int main(int argc, char**argv) { SOCKET clientSocket; sockaddr_in serAddr; int cliAddrlen = 0; int dataLen = 0; char buffer[BUFFERLEN] = {0}; char *p = NULL; int ret = 0; WSADATA wsaData; if(WSAStartup(MAKEWORD(2,2),&wsaData)!=0) { return printErrorAndExit("Socket Stack Error!"); } clientSocket = socket(AF_INET, SOCK_STREAM, 0); if (NULL == clientSocket) { return printErrorAndExit("Socket Stack Error!","Error"); } serAddr.sin_family = AF_INET; serAddr.sin_port = htons(20248); serAddr.sin_addr.S_un.S_addr = inet_addr("127.0.0.1"); ret = connect(clientSocket, (sockaddr*)&serAddr,sizeof(sockaddr)); if (ret == -1) { return printErrorAndExit("failed to connect server: %d",ret); } while(1) { p = gets(buffer); if (p != NULL) { printf("send:%s/n",buffer); send(clientSocket,buffer,BUFFERLEN,0); dataLen = recv(clientSocket,buffer,BUFFERLEN, 0); printf("receive data len:%d", dataLen); if (dataLen>0) { printf("from server:%s/n",buffer); } } } return 0; }

下一步工作，远程服务器端可以远程执行dos命令，并且把dos命令的结果返回给客户端。