As promised below is a link to the netcat like callback program.  It’s sole purpose is to send back cmd.exe to the IP and port of your choosing.  Default is 10.0.0.1 on port 1025.  These can be redefined in main.c.  There is no window on the client so it is relatively stealthy.  Just start your listener with something like ‘nc -l -v -p 1025’.  I’ve already used this successfully in a pentest.

Source Code and Binary