同样不一定要用管道,比如文件,SOCKET等都可以重定向.
如果是用SOCKET,根据网上的名词,可以创建一个"零管道后门"程序.比如在服务器端上的后门程序监听某个端口,一旦有连接请求,接受后创建SOCKET,就在这个时候开启CMD.EXE,并重定向输入输出到服务器上的这个SOCKET,这样便为远程的这个连接请求开了一个服务器上的后门，从而远程连接可以执行服务器并返回结果.
演示代码如下:
//
// File: Main.cpp
// Purpose: Creates a process( cmd.exe for example ), and redirect its standard input
//   by using creating a pipe, then writes some bytes as commands to pipe.
//
#define WIN32_LEAN_AND_MEAN
#include <windows.h>

#include <stdio.h>
#include <stdlib.h>

// Error report
void Error( const char *szErrMsg );

int main( int argc, char **argv )
{
 // Create pipe
 BOOL bRet;
 HANDLE hPipeRead, hPipeWrite;
 HANDLE hPipeReadII, hPipeWriteII;
 SECURITY_ATTRIBUTES sa;
 sa.nLength = sizeof( SECURITY_ATTRIBUTES );
 sa.bInheritHandle = TRUE;
 sa.lpSecurityDescriptor = NULL;
 bRet = ::CreatePipe( &hPipeRead, &hPipeWrite, &sa, 512 );
 bRet &= ::CreatePipe( &hPipeReadII, &hPipeWriteII, &sa, 512 );
 if ( !bRet )
 {
  Error( "Can't create pipe!" );
  return -1;
 }
 // Spawn a process
 STARTUPINFO StartInfo;
 PROCESS_INFORMATION ProcessInfo;
// memset( &StartInfo, 0, sizeof(StartInfo) );
// memset( &ProcessInfo, 0, sizeof(ProcessInfo) );
 ::GetStartupInfo( &StartInfo );
 StartInfo.cb = sizeof(StartInfo);
 StartInfo.dwFlags = STARTF_USESHOWWINDOW | STARTF_USESTDHANDLES;
 StartInfo.wShowWindow = SW_HIDE;
 StartInfo.hStdInput = hPipeRead;
 StartInfo.hStdOutput = hPipeWriteII; //::GetStdHandle( STD_OUTPUT_HANDLE );
 StartInfo.hStdError = hPipeWriteII; //::GetStdHandle( STD_OUTPUT_HANDLE );
 bRet = ::CreateProcess( TEXT("c:\\windows\\system32\\cmd.exe"), NULL, NULL, NULL, TRUE, 0, NULL, NULL, &StartInfo, &ProcessInfo );
 ::Sleep(1000);
 printf("wake up...\n");
 if ( !bRet )
 {
  Error( "Can't create process!" );
  return -1;
 }
 // Write commands to pipe
 char *szCmd = "netstat\r\n";
 DWORD dwDummy;
 ::WriteFile( hPipeWrite, szCmd, 10, &dwDummy, NULL );
 ::Sleep(2000);
 printf("had written...\n");
 // Read from pipe
 char szBuf[1024];
 memset(szBuf, 0, sizeof(szBuf));
 ::ReadFile( hPipeReadII, szBuf, sizeof(szBuf), &dwDummy, NULL );
 // Don't leave till the spawned process goes end
// ::Sleep(2000);
 printf("had read...\n");
// ::WaitForSingleObject( ProcessInfo.hProcess, INFINITE );
 printf("%s\n", szBuf);

 return 0;
}

void Error( const char *szErrMsg )
{
 printf( "Error: %s\n", szErrMsg );
}