Black Hat Python之#2：TCP代理

在本科做毕设的时候就接触到TCP代理这东西，当时需要使用代理来对发送和收到的数据做修改，同时使用代理也让我对HTTP协议有了更深的了解。

TCP Proxy用到的一个主要的东西就是socket。proxy通过socket分别对localhost和remotehost做连接，然后可以对通过proxy的流量和数据进行分析。

 __author__ = 'seven'
 import sys
 import socket
 import threading

 def hexdump(src, length=16):
     result = []
     digits = 4 if isinstance(src, unicode) else 2

     for i in xrange(0, len(src), length):
         s = src[i:i + length]
         hexa = b' '.join(["%0*X" % (digits, ord(x)) for x in s])
         text = b''.join([x if 0x20 <= ord(x) < 0x7F else b'.' for x in s])
         result.append(b"%04X  %-*s  %s" % (i, length * (digits + 1), hexa, text))

     print b'\n'.join(result)

 def receive_from(connection):
     buffer = ""

     # We set a 2 second time out depending on your target this may need to be adjusted
     connection.settimeout(2)

     try:
         while True:
             data = connection.recv(4096)
             if not data:
                 break
             buffer += data
     except:
         pass

     return buffer

 def request_handler(buffer):
     # perform packet mofifications
     return buffer

 def response_handler(buffer):
     # perform pakect modifications
     return buffer

 def proxy_handler(client_socket, remote_host, remote_port, receive_first):
     remote_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
     remote_socket.connect((remote_host, remote_port))

     if receive_first:
         remote_buffer = receive_from(remote_socket)
         hexdump(remote_buffer)
         remote_buffer = response_handler(remote_buffer)
         if len(remote_buffer):
             print "[<==] Sending %d bytes to localhost." % len(remote_buffer)
             client_socket.send(remote_buffer)

     while True:
         local_buffer = receive_from(client_socket)
         if len(local_buffer):
             print "[==>] Received %d bytes from localhost." % len(local_buffer)
             hexdump(local_buffer)
             local_buffer = request_handler(local_buffer)
             remote_socket.send(local_buffer)
             print "[==>] Sent to remote."
         remote_buffer = receive_from(remote_socket)
         if len(remote_buffer):
             print "[<==] Received %d bytes from remote." % len(remote_buffer)
             hexdump(remote_buffer)
             remote_buffer = response_handler(remote_buffer)
             client_socket.send(remote_buffer)
             print "[<==] Sent to localhost."
         if not len(local_buffer) or not len(remote_buffer):
             client_socket.close()
             remote_socket.close()
             print "[*] No more data. Closing connections."

             break

 def server_loop(local_host, local_port, remote_host, remote_port, receive_first):
     server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
     try:
         server.bind((local_host, local_port))
     except:
         print "[!!] Failed to listen on %s:%d" % (local_host, local_port)
         print "[!!] Check for other listening sockets or correct permissions."
         sys.exit(0)
     print "[*] Listening on %s:%d" % (local_host, local_port)

     server.listen(5)

     while True:
         client_socket, addr = server.accept()
         print "[==>] Received incoming connection from %s:%d" % (addr[0], addr[1])
         proxy_thread = threading.Thread(target=proxy_handler,
                                         args=(client_socket, remote_host, remote_port, receive_first))
         proxy_thread.start()

 def main():
     if len(sys.argv[1:]) != 5:
         print "Usage: ./tcp proxy.py [localhost] [localport] [remotehost] [remoteport] [receive_first]"
         print "Example: ./tcp proxy.py 127.0.0.1 9000 10.12.132.1 9000 True"
         sys.exit(0)

     local_host = sys.argv[1]
     local_port = int(sys.argv[2])

     remote_host = sys.argv[3]
     remote_port = int(sys.argv[4])

     receive_first = sys.argv[5]

     if "True" in receive_first:
         receive_first = True
     else:
         receive_first = False

     server_loop(local_host, local_port, remote_host, remote_port, receive_first)

 main()

在request_handler和response_handler函数中就可以对收到的数据进行修改。

高大上的hexdump函数来自http://code.activestate.com/recipes/142812-hex-dumper/，表示不怎么看得懂..如果有看得懂的朋友欢迎和我交流