[0xDEAD10CC]

Not multiplatform, only works on windows because lolwinsocks, you could make it smaller and multiplatform but it's nice for a first project, i'd also use argv[] instead of hardcoded variables, two reasons:

1. Ease of use
2. "Anti-Forensics" you know your malware sucks when you can run strings and see all the info on it, sure you could monitor traffic but it's a step in the right direction

If you want some ideas:

1. Multiplatform
2. Encrypted Traffic or Password Login (Wouldn't be too hard just be careful to sanatize input)

You've mitigated a few issues here, nice one, not vulnerable to anything I can see, I'd like to see future developments c: Good work

You can hardcode data and still not have string data show up with a program like strings if you encode it as integers or encrypt the string first, and at runtime decrypt them. Strings will not execute your binary to determine what the strings actually are, so it would require some debugging at that point.

Although this is actually very horribly written code to begin with...

---

2. Is a really hacky fix, you should properly allocate the file descriptors, unsure if it works the same way as it does on *nix but if so piping stderr to stdout just out of practice is in my oppinion a bad idea.

Exactly, and furthermore stdout is typically buffered, whereas stderr isn't for obvious reasons.

---

It's good just not good enough..
Using popen isn't bad since you can't get stderr which is simply bad because it's a lack of information returned by the reverse shell, the proper way to do this is to create pipes manually instead of relying on popen.
It also doesn't support the cd command which is good.
Let me also point out this "const char HOST[20] = "127.0.0.1";" where there's no point of defining the size of HOST.
I barely took a look at the code but I believe it gets the job done, at least someone is sharing something over here...

In addition to the size of HOST being 20, what's the point, even the longest IPv4 address can be 15 characters in length, so the buffer will never have to be any larger than 16.