python3黑帽子渗透笔记第二章--网络基础

  1 #!/usr/bin/env python3
  2 # coding=utf-8
  3 import sys
  4 from socket import *
  5 import getopt  # 用来处理命令行参数
  6 import threading
  7 import subprocess  # 启动一个shell，并控制输入输出
  8 
  9 # -e和-p有问题，mac下运行没什么问题，win下有问题，运行的命令会出现问题。
 10 listen = False
 11 command = False
 12 upload = False
 13 execute = ""
 14 target = ""
 15 upload_destination = ""
 16 port = 0
 17 
 18 #帮助提示
 19 def usage():
 20     print("netcat")
 21     print("Usage:nc_hacker.py -t target_host -p target_port")
 22     print("-l --listen                - listen on [host]:[port] for incoming connections")
 23     print("-e --execute=ile_to_run   - execute the given file upon receiving a connection")
 24     print("-c --command               - initialize a command shell")
 25     print("-u --upload=destination    - upon receiving connection upload a file and write to [destination]")
 26     print("Examples: ")
 27     print("nc_hacker.py -t 192.168.0.1 -p 5555 -l -c")
 28     print("nc_hacker.py -t 192.168.0.1 -p 5555 -l -u c:\\target.exe")
 29     print("nc_hacker.py -t 192.168.0.1 -p 5555 -l -e \"cat /etc/passwd\"")
 30     print("echo 'ABCDEFGHI' | ./nc_hacker.py -t 192.168.11.12 -p 135")
 31     sys.exit(0)
 32 
 33 
 34 # 主函数
 35 def main():
 36     global listen
 37     global port
 38     global execute
 39     global command
 40     global upload_destination
 41     global target
 42     # 没有输入值就显示菜单
 43     if not len(sys.argv[1:]):
 44         usage()
 45     try:
 46         # getopt模块处理命令行,
 47         # h后面没有冒号:表示后面不带参数,p:和i:后面有冒号表示后面需要参数
 48         # help后面没有等号=，表示后面不带参数，有=，表示后面需要参数
 49         # 返回值options是个包含元祖的列表，每个元祖是分析出来的格式信息，比如[('-i','127.0.0.1'),('-p','80')]
 50         # args 是个列表，包含那些没有‘-’或‘--’的参数，比如：['55','66']
 51         opts, args = getopt.getopt(sys.argv[1:], "hle:t:p:cu:",
 52                                    ["help", "listen", "execute", "target", "port", "command", "upload"])
 53     except getopt.GetoptError as err:
 54         print(str(err))
 55         usage()
 56     for o, a in opts:
 57         if o in ("-h", "--help"):
 58             usage()
 59         elif o in ("-l", "--listen"):
 60             listen = True
 61         elif o in ("-e", "--execute"):
 62             execute = a
 63         elif o in ("-c", "--command"):
 64             command = True
 65         elif o in ("-u", "--upload"):
 66             upload_destination = a
 67         elif o in ("-t", "--target"):
 68             target = a
 69         elif o in ("-p", "--port"):
 70             port = int(a)
 71         else:
 72             print("unhandled option")
 73     # 从标准输入中发送数据
 74     if not listen and len(target) and port > 0:
 75         # 读取输入的数据
 76         # 这里将阻塞,发送ctrl-d使用
 77         buffer = input()  # sys.stdin.read()
 78         # 发送数据
 79         client_sender(buffer)
 80     # 进行监听
 81     if listen:
 82         print('the server is listening on %s:%d' % (target, port))
 83         server_loop()
 84 
 85 
 86 # 客户端代码
 87 def client_sender(buffer):
 88     client = socket(AF_INET, SOCK_STREAM)
 89     try:
 90         print("start connecting...")
 91         client.connect((target, port))
 92         print("connected")
 93         # 如果我们检测到来自stdin的输入。
 94         # 如果不是，我们就等待用户输入。
 95         if len(buffer):
 96             client.send(buffer)
 97         while True:
 98             # 等待数据回传
 99             recv_len = 1
100             response = ""
101             print("waiting response:")
102             while recv_len:
103                 data = client.recv(4096)
104                 recv_len = len(data)
105                 response += data.decode("utf-8")
106                 if recv_len < 4096:
107                     break
108             print(response, end="")
109             # 等待更多输入
110             buffer = input("")
111             buffer += "\n"
112             client.send(buffer.encode("utf-8"))
113     except:
114         print("[*] Exception! Exiting.")
115         # 断开连接
116         client.close()
117 
118 
119 # 服务端代码
120 def server_loop():
121     global target, port
122 
123     # 如果没有定义目标，就监听所有接口
124     if not len(target):
125         target = "0.0.0.0"
126     server = socket(AF_INET, SOCK_STREAM)
127     server.bind((target, port))
128     server.listen(5)
129 
130     while True:
131         client_socket, addr = server.accept()
132         # print(client_socket)<socket._socketobject object at 0x107552d00>
133         # 分出一个线程来处理新的客户端
134         client_thread = threading.Thread(target=client_handler, args=(client_socket,))
135         client_thread.start()
136 
137 
138 # -c命令
139 def run_command(command):
140     # 返回从字符串末尾删除所有字符串的字符串(默认空白字符)的副本
141     command = command.rstrip()
142     # 运行命令并将输出返回
143     try:
144         # subprocess.STDOUT是抛出异常。
145         output = subprocess.check_output(command, stderr=subprocess.STDOUT, shell=True)
146     except:
147         output = "Failed to execute command.\r\n"
148     # 将输出发送
149     return output
150 
151 
152 # 处理传入的客户端连接
153 def client_handler(client_socket):
154     global upload, execute,
155     # 检测上传文件command
156     if len(upload_destination):
157         # 读取所有的字节并写入
158         file_buffer = ""
159         # 持续读取数据直到没有数据可用为止,有问题
160         while True:
161             data = client_socket.recv(1024)
162             if not data:
163                 break
164             else:
165                 file_buffer += data
166                 # 现在我们取这些字节并试着把它们写出来。
167         try:
168             print('opening')
169             #打开文件并写入
170             file_descriptor = open(upload_destination, "wb")
171             file_descriptor.write(file_buffer)
172             print('written')
173             file_descriptor.close()
174 
175             # 确认文件是否上传
176             client_socket.send("Successfully saved file to %s\r\n" % upload_destination)
177         except:
178             client_socket.send("Failed to save file to %s\r\n" % upload_destination)
179     # 检查命令执行
180     if len(execute):
181         # 运行命令
182         output = run_command(execute)
183         client_socket.send(output)
184     # 如果需要一个命令shell，那我们进入另一个循环，。
185     if command:
186         while True:
187             # 跳出一个窗口
188             client_socket.send(b"<netcat:#> ")
189             # 现在我们接收文件直到发现换行符(enter key)
190             cmd_buffer = ""
191             while "\n" not in cmd_buffer:
192                 cmd_buffer += client_socket.recv(1024).decode("utf-8")
193             # 返还命令输出
194             response = run_command(cmd_buffer)
195             # 返回相应数据
196             client_socket.send(response)
197 
198 
199 if __name__ == "__main__":
200     main()

  1 #!/usr/bin/env python3
  2 # coding=utf-8
  3 import sys
  4 from socket import *
  5 import threading
  6 
  7 
  8 # 16进制导出函数
  9 def hexdump(src, length=16):
 10     result = []
 11     # 判读输入是否为字符串
 12     digits = 4 if isinstance(src, str) else 2
 13     for i in range(0, len(src), length):
 14         # 将字符串切片为16个为一组
 15         s = src[i:i + length]
 16         # 用16进制来输出,x是digits的值，表示输出宽度
 17         hexa = ' '.join(["%0*X" % (digits, (x)) for x in s])
 18         # 用来输出原值
 19         text = ''.join([chr(x) if 0x20 <= x < 0x7F else '.' for x in s])
 20         # %-*s, 星号是length*(digits + 1)的值
 21         result.append("%04X   %-*s   %s" % (i, length * (digits + 1), hexa, text))
 22     print('\n'.join(result))
 23 
 24 
 25 # 设置延时有问题，后续更改
 26 def receive_from(connection):
 27     buffer = b""
 28     # 设置5s延迟,connection=socket(AF_INET, SOCK_STREAM)
 29     connection.settimeout(5)
 30     try:
 31         # 保持数据的读取直到没有数据或超时
 32         while True:
 33             data = connection.recv(4096)
 34             if not data:
 35                 break
 36             buffer += data
 37     except:
 38         pass
 39     return buffer
 40 
 41 
 42 # 对目标主机的请求数据进行修改
 43 def request_handler(buffer):
 44     return buffer
 45 
 46 
 47 # 对返回本地主机的响应数据进行修改
 48 def response_handler(buffer):
 49     return buffer
 50 
 51 
 52 def proxy_handler(client_socket, target_host, target_port, receive_first):
 53     # 连接目标主机
 54     target_socket = socket(AF_INET, SOCK_STREAM)
 55     target_socket.connect((target_host, target_port))
 56 
 57     # 必要时从目标主机接收数据
 58     if receive_first:
 59         target_buffer = receive_from(target_socket)
 60         hexdump(target_buffer)
 61         # 发送给我们的响应处理程序
 62         target_buffer = response_handler(target_buffer)
 63         # 如果要发送数据给本地客户端，发送它
 64         if len(target_buffer):
 65             print("[<==] Sending %d bytes to localhost." % len(target_buffer))
 66             client_socket.send(target_buffer)
 67 
 68     # 现在我们从本地循环读取数据，发送给远程主机和本地主机
 69     while True:
 70         # 从本地读取数据
 71         local_buffer = receive_from(client_socket)
 72         if len(local_buffer):
 73             print("[==>] Received %d bytes from localhost." % len(local_buffer))
 74             hexdump(local_buffer)
 75             # 发送给我们的本地请求
 76             local_buffer = request_handler(local_buffer)
 77             # 发送数据给目标主机
 78             target_socket.send(local_buffer)
 79             print("[==>] Sent to target.")
 80 
 81         # 接收响应的数据
 82         target_buffer = receive_from(target_socket)
 83 
 84         if len(target_buffer):
 85             print("[<==] Received %d bytes from target." % len(target_buffer))
 86             hexdump(target_buffer)
 87             # 发送到响应处理函数
 88             target_buffer = response_handler(target_buffer)
 89             # 将响应发送给本地socket
 90             client_socket.send(target_buffer)
 91             print("[<==] Sent to localhost.")
 92 
 93         # 两边没有数据了，就关闭连接
 94         if not len(local_buffer) or not len(target_buffer):
 95             client_socket.close()
 96             target_socket.close()
 97             print("[*] No more data. Closing connections.")
 98             break
 99 
100 
101 def server_loop(local_host, local_port, target_host, target_port, receive_first):
102     server = socket(AF_INET, SOCK_STREAM)
103     try:
104         server.bind((local_host, local_port))
105     except:
106         print("[!!] Failed to listen on %s:%d" % (local_host, local_port))
107         print("[!!] Check for other listening sockets or correct permissions.")
108         sys.exit(0)
109 
110     print("[*] Listening on %s:%d" % (local_host, local_port))
111 
112     server.listen(5)
113 
114     while True:
115         client_socket, addr = server.accept()
116         # 本地连接信息
117         print("[==>] Received incoming connection from %s:%d" % (addr[0], addr[1]))
118         # 开启线程和目标主机通信
119         proxy_thread = threading.Thread(target=proxy_handler,
120                                         args=(client_socket, target_host, target_port, receive_first))
121         proxy_thread.start()
122 
123 
124 def main():
125     if len(sys.argv[1:]) != 5:
126         print("Usage: ./proxy.py [localhost] [localport] [targethost] [targetport] [receive_first]")
127         print("Example: ./proxy.py 127.0.0.1 9000 10.12.132.1 9000 True")
128         sys.exit(0)
129     # 本地参数
130     local_host = sys.argv[1]
131     local_port = int(sys.argv[2])
132     # 目标参数
133     target_host = sys.argv[3]
134     target_port = int(sys.argv[4])
135 
136     receive_first = sys.argv[5]
137 
138     if "True" in receive_first:
139         receive_first = True
140     else:
141         receive_first = False
142 
143     # 开始监听
144     server_loop(local_host, local_port, target_host, target_port, receive_first)
145 
146 
147 main()